Smart Card Technology
Smart Card Technology
What is a Smart Card? What is a smart card? The term Smart Card is loosely used to describe any card with a capability to relate information to a particular application such as magnetic stripe, optical, memory, and microprocessor cards. It is more precise, however to refer to memory and microprocessor cards as smart cards.
A magnetic stripe card has a strip of magnetic tape material attached to its surface. This is the standard technology used for bank cards. Optical cards are bank card-size, plastic cards that use some form of laser to write and read the card. Memory cards can store a variety of data, including financial, personal, and specialized information; but cannot process information. Smart cards with a microprocessor look like standard plastic cards, but are equipped with an embedded Integrated Circuit (IC) chip. Microprocessor cards can store information, carry out local processing on the data stored, and perform complex calculations. These cards take the form of either "contact" cards which require a card reader or "contactless" cards which use radio frequency signals to operate.
The Micromodule Smart cards are credit card-sized, often made of flexible plastic (polyvinyl chloride or PVC), and are embedded with a micromodule containing a single silicon integrated circuit chip with memory and microprocessor. The micromodule has eight metallic pads on its surface, each designed to international standards for VCC (power supply voltage), RST (used to reset the microprocessor of the smart card), CLK (clock signal), GND (ground), VPP (programming or write voltage), and I/O (serial input/output line). Two pads are reserved for future use (RFU). Only the I/O and GND contacts are mandatory on a card to meet international standards; the others are optional.
When a smart card is inserted into a Card Acceptance Device or CAD (such as a point-ofsale terminal), the metallic pads come into contact with the CAD's corresponding metallic pins, thereby allowing the card and CAD to communicate. Smart cards are always reset when they are inserted into a CAD. This action causes the smart card to respond by sending an "Answer-to-Reset " (ATR) message, which informs the CAD, what rules govern communication with the card and the processing of a transaction. Micromodule Components The micromodule on board the smart card is made up of certain key components that allow it to execute instructions supporting the card's functionality. Click each component in the diagram for an explanation. The Microprocessor Unit (MPU) executes programmed instructions. Typically, older version smart cards are based on relatively slow, 8-bit embedded microcontrollers. The trend during the 1990s has been toward using customized controllers with a 32-bit Reduced Instruction Set Computing (RISC) processor running at 25 to 32 MHz. The I/O Controller manages the flow of data between the Card Acceptance Device (CAD) and the microprocessor. Read Only Memory (ROM) or Program Memory is where the instructions are permanently burned into memory by the silicon manufacturer. These instructions (such as when the power supply is activated and the program that manages the password) are the fundamentals of the Chip Operating System (COS) or, as often called, the "Mask." Random Access Memory (RAM) or Working Memory serves as a temporary storage of results from calculations or input/output communications. RAM is a volatile memory and loses information immediately when the power supply is switched off. Application Memory, which today is almost always double E-PROM (Electrically Erasable Programmable Read-Only Memory) can be erased electronically and rewritten. By international standards, this memory should retain data for up to 10 years without electrical
power and should support at least 10,000 read-write actions during the life of the card. Application memory is used by an executing application to store information on the card. Key Features and Characteristics Shown below are some of the key features and characteristics of smart cards.
Cost Typical costs range from $2.00 to $10.00. Per card cost increases with chips providing higher capacity and more complex capabilities; per card cost decreases as higher volume of cards are ordered. Reliability Vendors guarantee 10,000 read/write cycles. Cards claiming to meet International Standards Organization (ISO) specifications must achieve set test results covering drop, flexing, abrasion, concentrated load, temperature, humidity, static electricity, chemical attack, ultra-violet, X-ray, and magnetic field tests. Error Correction Current Chip Operating Systems (COS) perform their own error checking. The terminal operating system must check the two-byte status codes returned by the COS (as defined by both ISO 7816 Part 4 and the proprietary commands) after the command issued by the terminal to the card. The terminal then takes any necessary corrective action. Storage Capacity EEPROM: 8K - 128K bit. (Note that in smart card terminology, 1K means one thousand bits, not one thousand 8-bit characters. One thousand bits will normally store 128 characters, the rough equivalent of one sentence of text. However, with modern data
compression techniques, the amount of data stored on the smart card can be significantly expanded beyond this base data translation.)
Ease of Use Smart cards are user-friendly for easy interface with the intended application; handled like the familiar magnetic stripe bank card.
LIST OF FIGURES
1. Figure 1.1: Smart Card Reader with integrated fingerprint scanner for authentication including biometrics. 2. Figure 1.2: Smart Card Reader for PCMCIA port used for mobile application. 3. Figure 1.3:Smart Card USB dongle a smart card reader/writer for SIM cards 4. Figure1.4: Smart Card Reader terminal for secure PIN entry 5. Figure 1.5: Various types of Smart Cards
6. 7. 8. 9. 10. Figure 1.6: Dolphin fast, full color plastic card printer with smart card encoder option. Figure 1.7:Fast, Monochrome, High-Quality plastic card printer. Figure 1.8:Dual-sided,Edge-to-Edge color card printer. Figure 1.9:Dual-sided color card printer with built-in laminator. Figure 1.10: Fast ,Full-color, High- Quality Plastic card printer
INTRODUCTION
A smart card is a standard credit card-sized plastic token within which a microchip has been embedded. This chip is the engine room of the smart card, and indeed is what makes it 'smart'. Smart card chips come in two broad varieties: memory-only chips, with storage space for data, and with a reasonable level of built-in security; and microprocessor chips which, in addition to memory, embody a processor controlled by a card operating system, with the ability to process data onboard, as well as carrying small programs capable of local execution. The main storage area in such cards is normally EEPROM (Electrically Erasable Programmable Read-Only Memory), which - subject to defined security constraints - can have its content updated, and which retains current contents when external power is removed. Newer smart card chips may also have maths co-processors integrated into the microprocessor chip, able to perform quite complex encryption routines relatively quickly. A smart card is therefore characterised uniquely by its chip, with its ability to store much more data (currently up to about 32,000 bytes) than is held on a magnetic stripe, all within an extremely secure environment. These security features built into smart card chips are amongst the most sophisticated of their type available in the commercial world. Data residing in the chip can be protected against external inspection or alteration, so effectively that the vital secret keys of the cryptographic systems used to protect the integrity and privacy of card-related communications can be held safely against all but the most sophisticated forms of attack. The ingenuity of the cryptographers further supplements the physical security of the chip, ensuring that penetrating one card's security does not compromise an entire card scheme. It is because of these security and data storage features that smart cards are rapidly being embraced as the consumer token of choice in many areas of the public sector and commercial worlds. The Internet, in particular, is focussing the need for online identification and authentication between parties who cannot otherwise know or trust each other, and smart cards - coupled with effective cardholder verification techniques - are believed to be the most efficient and portable way of enabling the new world of e-trade. 6
Interoperability (see below) is the key requirement to facilitate universal consumer acceptability: the ability of a card function developed by one organisation to be used without difficulty in schemes owned and operated by many organisations. So it is that the current world population of smart cards of some 1.7 billion is set to increase to 4 billion or more cards within the next 3-4 years. The term Smart Card is loosely used to describe any card with a capability to relate information to a particular application such as magnetic stripe, optical, memory, and microprocessor cards. It is more precise, however to refer to memory and microprocessor cards as smart cards.
A magnetic stripe card has a strip of magnetic tape material attached to its surface. This is the standard technology used for bank cards. Optical cards are bank card-size, plastic cards that use some form of laser to write and read the card. Memory cards can store a variety of data, including financial, personal, and specialized information; but cannot process information. Smart cards with a microprocessor look like standard plastic cards, but are equipped with an embedded Integrated Circuit (IC) chip. Microprocessor cards can store information, carry out local processing on the data stored, and perform complex calculations. These cards take the form of either "contact" cards which require a card reader or "contactless" cards which use radio frequency signals to operate.
power supply is activated and the program that manages the password) are the fundamentals of the Chip Operating System (COS) or, as often called, the "Mask." Random Access Memory (RAM) or Working Memory serves as a temporary storage of results from calculations or input/output communications. RAM is a volatile memory and loses information immediately when the power supply is switched off. Application Memory, which today is almost always double E-PROM (Electrically Erasable Programmable Read-Only Memory) can be erased electronically and rewritten. By international standards, this memory should retain data for up to 10 years without electrical power and should support at least 10,000 read-write actions during the life of the card. Application memory is used by an executing application to store information on the card.
10
Smart cards are user-friendly for easy interface with the intended application; handled like the familiar magnetic stripe bank card. Susceptibility Susceptible to chip damage from physical abuse, but more difficult to disrupt or damage than the magnetic stripe card. Security Smart cards are highly secure. Information stored on the chip is difficult to duplicate or disrupt, unlike the outside storage used on magnetic stripe cards that can be easily copied. Chip microprocessor and Co-processor supports DES, 3-DES, RSA or ECC standards for encryption, authentication, and digital signature for non-repudiation. First Time Read Rate ISO 7816 limits contact cards to 9600 baud transmission rate; some Chip Operating Systems do allow a change in the baud rate after chip power up; a well designed application can often complete a card transaction in one or two seconds. Speed of Recognition Smart cards are fast. Speed is only limited by the current ISO Input/Output speed standards. Proprietary Features These include Chip Operating System and System Development Kits. Processing Power Older version cards use an 8-bit micro-controller clockable up to 16 MHz with or without co-processor for high-speed encryption. Current trend is toward customized controllers with a 32-bit RISC processor running at 25 to 32 MHz. Power Source
11
Mostly 5 volt DC power source. Support Equipment Required For most host-based operations, only a simple Card Acceptance Device (that is, a card reader/writer terminal) with an asynchronous clock, a serial interface, and a 5-volt power source is required. For low volume orders, the per unit cost of such terminals runs between $100 and $250, the cost decreasing significantly with higher volumes. More costly Card Acceptance Devices are hand-held, battery-operated terminals and EFT/POS desktop terminals.
12
13
The current proliferation of consumer plastic, giving rise to serious purse and wallet bulge, is focussing card issuers on the challenge of providing multi-application platforms within smart cards, able to carry functions relating not only to the card issuer's business, but also carrying functions issued by third party application providers who may wish to rent space within such cards. This requirement has given rise to the need for suitable platforms able to carry segmented data sets in a discrete way to ensure that one application provider's data cannot be compromised by a third party. Accordingly, a number of multiapplication platform products have been developed, not only by the more traditional smart card suppliers but, more unusually, by card scheme operators with an interest in issuing cards and then defraying costs by renting space within them. Such multi-application platforms allow the addition and deletion of application data areas in-flight, without the need for replacing cards. This ability in turn leads to major branding, ownership and control issues, many of which have yet to be addressed and resolved.
14
APPLICATION AREAS
15
The first chip cards were simple prepaid telephone cards implemented in Europe in the mid-1980s, using memory cards. Today, the major active application areas for microprocessor-based smart cards include: financial, communications, government programs, information security, physical access security, transportation, retail and loyalty, health care, and university identification. These are intersecting areas in that the smart card may carry applications from more than one area (for example, combining information and physical security access, or financial and retail/loyalty). Here are some industries and their applications: Industry Accountants Airports Application Business cards, client id, promotions, calendar cards Employee access cards, security ID badges Identification cards (ID cards), point of sale (POS) discounts, Associations Memberships calendar cards Automobile dealers VIN ID cards, dealer loyalty, discounts, warranty cards Bars, nightclubs VIP cards, preferred door entry, membership cards Car Wash Frequency cards, pre-paid car wash cards Clubs Membership cards Computers Warranty card, customer support, internet access#'s, discounts Dry Cleaners Discount cards, frequent customer cards Golf Courses Membership cards, bag tags, prepaid greens, ball dispensers Hotels Discount, frequency cards, key cards, employee ID badges Investment Customer cards, calendar cards Library ID cards, bar codes Real Estate Business cards, telephone cards, calendar cards Rental Services Identification, preferred entry Promotional, discount, membership, loyalty, preferred customer Restaurants cards Retail Customer cards, cheque cashing, discount & loyalty cards Security Access control, name badges Shopping Centers Customer, discount cards, loyalty programs Travel Agents Telephone cards, customer cards Shown below are examples of smart card applications. Financial Applications
Electronic Purse to replace coins for small purchases in vending machines and over-the-counter transactions. Credit and/or Debit Accounts, replicating what is currently on the magnetic stripe bank card, but in a more secure environment. Securing payment across the Internet as part of Electronic Commerce.
16
Communications Applications
The secure initiation of calls and identification of caller (for billing purposes) on any Global System for Mobile Communications (GSM) phone. Subscriber activation of programming on Pay-TV.
Government Programs
Electronic Benefits Transfer using smart cards to carry Food Stamp and WIC food benefits in lieu of paper coupons and vouchers. Agricultural producer smart marketing card to track quotas.
Information Security
Employee access card with secured passwords and the potential to employ biometrics to protect access to computer systems.
Physical Access
Employee access card with secured ID and the potential to employ biometrics to protect physical access to facilities.
Transportation
Drivers Licenses. Mass Transit Fare Collection Systems. Electronic Toll Collection Systems.
Consumer reward/redemption tracking on a smart loyalty card, that is marketed to specific consumer profiles and linked to one or more specific retailers serving that profile set.
Health Card
17
Consumer health card containing insurance eligibility and emergency medical data.
University Identification
All-purpose student ID card (a/k/a/ campus card) , containing a variety of applications such as electronic purse (for vending and laundry machines), library card, and meal card.
The capacity provided by the on-board microprocessor and data capacity for highly secure, off-line processing.
18
Adherence to international standards, ensuring multiple vendor sources and competitive prices.
Established track record in real world applications. Durability and long expected life span (guaranteed by vendor for up to 10,000 read/writes before failure).
Chip Operating Systems that support multiple applications and secure independent data storage on one single card.
Relatively higher cost of smart cards as compared to magnetic stripe cards. (The difference in initial costs between the two technologies, however, decreases
19
significantly when the differences in expected life span and capabilities-particularly in terms of supporting multiple applications and thus affording cost sharing among application providers--are taken into account.)
Present lack of infrastructure to support the smart card, particularly in the United States, necessitating retrofitting of equipment such as vending machines, ATMs, and telephones.
Proprietary nature of the Chip Operating System. The consumer must be technically knowledgeable to select the most appropriate card for the target application.
Lack of standards to ensure interoperability among varying smart card programs. Unresolved legal and policy issues, such as those related to privacy and confidentiality, or to consumer protection laws.
20
Chip Operating System (COS) The smart card's Chip Operating System (frequently referred to simply as COS; and sometimes referred to as the Mask) is a sequence of instructions, permanently embedded in the ROM of the smart card. Like the familiar PC DOS or Windows Operating System, COS instructions are not dependent on any particular application, but are frequently used by most applications. Chip Operating Systems are divided into two families:
The general purpose COS which features a generic command set in which the various sequences cover most applications, and The dedicated COS with commands designed for specific applications and which can even contain the application itself. An example of a dedicated COS would be a card designed to specifically support an electronic purse application.
The baseline functions of the COS which are common across all smart card products include:
Management of interchanges between the card and the outside world, primarily in terms of the interchange protocol. Management of the files and data held in memory. Access control to information and functions (for example, select file, read, write, and update data). Management of card security and the cryptographic algorithm procedures. Maintaining reliability, particularly in terms of data consistency, sequence interrupts, and recovering from an error. Management of various phases of the card's life cycle (that is, microchip fabrication, personalization, active life, and end of life).
In most cases the issuer has to commit to a specific application developer, operating system and chip for each service the issuer wished to provide to its customer base. This leaves almost no flexibility to change any of these components without having to invest funds into 21
a new software and/or hardware implementation. As a result early smart cards were costly and inflexible. But today we can clearly see a develpment towards open operating systems that support multiple applications. For on-card application development of programs that run inside the secure environment of the smart card chip, we highly recommend operationg systems that have bigger market exposure such as JavaCard OS, MultOS and lately Windows for smart cards. Multi Application Card Operating Systems (MACOS) Until the emergence of multi-application smart cards, each software application representing a product or service on a card was written for a specific operating system, which in turn was specific to a particular hardware (chip) or silicon platform supplier. Multi-application operating systems allow the development of multiple applications that run on one card. Ideally the on-card applications can't interfere with each other and are protected by a firewall. Currently there are three major operating systems on the market.
Java Card for program development using Java. MultOS is the first, open, high security, multi-application operating system for smart cards. MultOS allows you to dynamically load, update or delete any application during the life of the card.
Windows for Smart Cards Microsoft licenses Windows for Smart Cards Toolkit source code and promotes an open software standard for smart card manufacturers, software developers and customers with this operating system.
22
software interfaces should be defined according to standards, whenever they exist. The following list contains links to important smartcard related standards:
ISO7816 identification card standard from the International Organization for Standardization. ISO 14443 RFID cards; contactless proximity cards operating at 13.56 MHz in up to 5 inches distance ISO 15693 RFID cards; contactless vicinity cards operating at 13.56 MHz in up to 50 inches distance EMV 2000 version 4.00, Europay, MasterCard and Visa worked jointly over the last few years to develop specifications that define a set of requirements to ensure interoperability between chip cards and terminals on a global basis, regardless of the manufacturer, the financial institution, or where the card is used. The latest version of the specifications, EMV 2000 version 4.0, was published in December 2000. It is envisaged that the specifications will in the near future be supplemented with support for lower voltage cards and a definition of a contact-less interface to EMV chip cards.
PC/SC Builds upon existing industry smart card standards - ISO7816 and EMV and complements them by defining low-level device interfaces and deviceindependent application APIs as well as resource management, to allow multiple applications to share smart card devices attached to a system.
GSM 11.11 & 1.14, Global System for Mobile Telecommunications standard
23
Some cardreaders already come with advanced security features such as secure PIN entry, secure display ao even integrated fingerprint scanners for the next-generation of multi-layer security and three-factor authentication.
Figure 1.1: Smart Card Reader with integrated fingerprint scanner for authentication including biometrics. Smart Card Readers will be part of a standard PC, soon, but today, in most cases you need to connect a reader to the USB port, the PCMCIA or the serial RS232 port of a computer system. You can also get computer systems with keyboards that have a Smart Card reader/Writer integrated. It won't take long until smartcard readers become an integral part of every computer.
Figure 1.2: Smart Card Reader for PCMCIA port used for mobile application. Smartcard readers are used as Smart Card programmers to configure and personalize integrated circuit cards. This means that not only CPU based smart cards, but also simple memory cards can be programmed using a smart card reader. Of cause the cardreader must support the appropriate protocol such as the asynchronous T=0, T=1 or synchronous I2C protocols. You can also find smart card readers in form of a USB dongle, which is a great way to develop a hardware token and deploy reader and card in one device. USB dongles are also
24
frequently used with GSM phones, which contain a SIM smart card. Phone numbers can be edited on a PC using the USB smart card dongle.
Figure 1.3:Smart Card USB dongle a smart card reader/writer for SIM cards. Smart card readers also write to smart cards. So even if someone talks about a smart card reader she really means a smart card reader/writer. The most common smartcard readers read ISO 7816 compliant cards. These are credit cardsized smart cards with contacts. But as contactless smart cards are being deployed in more places, expect smart card readers that support contactless cards to become more popular, too. Especially in applications for public tranportation and building access so-called proximity cards are being used.
25
SMART CARDS
26
Figure 1.6: Dolphin fast, full color plastic card printer with smart
27
BIBLIOGRAPHY
1. www.cardwerk.com 2. www.cardtechnology.com 3. www.smartex.com
28
BIO-DATA
Name: Anil Kumar Tailor Fathers Name: Shri Om Prakash Tailor Date of Birth: May 01, 1982 10th Percentage: 77% 12th Percentage: 74% B.E. Percentage (Current): 70% Present Address: C/o Sh.Pratap singh Saini 6/121,M.P. Colony, Bikaner (Rajasthan) Present Phone No.: 9829498035 Permanent Address: Shri Om Prakash Tailor Village:Anandpur Kalu Tehsil: Jaitaran Distt.: Pali (Rajasthan) PIN : 306301 Phone:02939-283013(Home) E-mail ID: [email protected]
29
30