Smari Card Technology With Case Studies
Michael R. Carr
SchlumbergerSema, IT & Public Sector Cards Group
Addison, TX 75001
Abstract: Smart card technology not only
enables secure access to logical and
physical applications but also provides
inherent value in the areas of security,
authentication and multi-application
capabilities for a variety of industries in the
areas of transportation, banking,
telecommunications and public sector.
The impact of society on the use of security
systems and technology enabled with smart
card technology is rapidly accelerating since
the events of September 1lth.
This presentation will provide an overview of
smart card technology for understanding
where the technology is migrating, and offer
four (4) smart card case studies (domestic
and international) in the areas of IT Network
Security, public-sector healthcare, financial
services and cashless gaming. The
presentation will also examine and compare
similarities provided to end users in each
case study pointing out 'value'
characteristics that encourage adoption of
smart card technology and applications
enabled using smart cards. Finally the
presentation will discuss how to begin
evaluating a smart card project and
elements for consideration toward
successful development, implementa-tion
and deployment.
Introduction
Smart card technology has flourished
outside of North America for several
decades primarily due to the need for
wireless telecommunications. The majority
of chips used in a smart card form factor are
built for SIM (Subscriber Identity Module)
chips found in specific types of cellular
phones that operate on the GSM spectrum.
In North America more landlines can be
found than wireless chip based technologies
though this is starting to change.
Forecasts:
0-7803-7436-3/02/$17.00 02002 IEEE
As reported by Frost & Sullivan in their
Smart Card Market Q2-2002 (6780-33)
report, the worldwide demand for smart
cards (both memory and microprocessor)
stood at 816 million for 2001. The report
goes on to predict that this figure will rise to
$861M in 2002 growing at an annual 8%
Compounded Annual Growth Rate (CAGR).
lnfineon Technology, one of the worlds
largest chip makers, reported that in 1999
they shipped their one-billionth module and
thirty months later they reportedly shipped
two billion modules.
The Technology:
Smart cards are built with a variety of chips.
Some smart cards are simple memory
consisting of bytes of information used in
pre-paid phone cards or retail loyalty store
schemes. Other smart cards may have
anywhere from 1K up to 64K of micro-
controller or multi-application memory.
There are also contactless and RFlD type
card products available as well. Ultimately
the power of the smart card resides in the
chip regardless of form factor.
Case Study 1: IT Network and Security
Identification
The Common Access Card or CAC was
developed specifically for the United States
Department of Defense (DoD) Defense
Manpower Data Center (DMDC), the area of
the DoD that manages all personnel
functions for all military active duty, retirees
as well as dependents for all branches of the
uniformed military services (i.e. Air Force,
Navy, Army, Marines, DoD civilian and
contractor personnel).
By Q 4 of 2003 it is anticipated that these ID
smart cards will be deployed to over 4
million military personnel in over 900
locations worldwide. The highly secure,
multiple application cards used for physical
identification, building access, and network
158
access are part of a multi-tiered program
that is in the final stages of rolling out.
Case Study 2: Public Health
State of California constituents in over 50
counties passed a voter referendum known
as Proposition 36 referred to as the
Substance Abuse Crime Prevention Act of
2000 that offered non-violent first 'and
second time substance abusers with options
for treatment outside of incarceration (also
known as a diversion program).
The card stores a medical record software
application utilizing Microsoft Visual 'Basic
with a 16K Java Card that securely stored
information about an individuals visits to
various county agencies such as the court,
counselor, medical clinic (urinalysishlood
work results) and probation. The application
on the smart card took into account the need
for securing confidential information from
different county agencies through a central
registry using roles based access to
coordinate reporting of information back to
the county and state more quickly than a
standard paper based system.
Case Study 3: Banking & Finance
Smart card enabled financial banking cards
are prevalent throughout Europe and Asia
as banking infrastructures in these regions
of the world support chip based
technologies.
Financial smart cards in North America
provide encryption used to keep account
information and online transactions private.
An individuals PIN allows them to store
information on the chip. Information can be
accessed using a smart card reader that can
be provided by the issuing bank. CUStOmerS
can make secure purchases worldwide
through the convenience of a magnetic
stripe or online through the use of a
microprocessor chip. The chip can save
favorite web site URL's, user names'and
passwords for quick logins..
159
Case Study 4: Cashless Gaming
Sun International utilizes slot machines in
their South African casinos that are enabled
using smart card technology. The casinos
required a solution that prevented fraud and
theft of the slot machine proceeds.
Personnel who moved coin proceeds from
slot machines might be injured moving the
heavy coins to the vault of the casino and
might also be tempted to take some of the
gambling proceeds for themselves.
Sun International procured a smart card
enabled application for managing cash flow
from customers to their slot machines and
from the machines back to the customers.
Encouraging Adoption
Adoption of smart card Technology can be
accomplished by:
-Give end users (constituents) choice of opt
idout
Critical mass of cards and infrastructure in
a community of common interest
Multiple consumer applications
Simplified transactions
Brand identification
Alliances to maintain necessary value
chain components
Getting Started
To initiate a smart card program the
following specifications need to be defined:
Business Requirements
- User applications
- Program goals
Systems Requirements
-Card management life cycle
-Applications management
-Card issuance
- PKI
-Interoperability
Software Development Kit (SDK)
-Third party developers or integrators