Smart Card

Posted by : Unknown Wednesday, May 1, 2013

Introduction

We all posses or have seen bank cards, identification cards and other plastic cards, which hold personal information about their owner. Some of the information is visibly printed on them, such as the holder's photo, name, signature, address, a bar code, etc. But most of the data is contained in the magnetic stripe, the embedded microchip or can be accessed from databases by "linking" the card to a computer network through a card reader or scanner. We can only read the printed information visible on these cards, but what is stored about us in the magnetic stripe, microchip or the linked databases we do not know. And they are not going to tell us, because they know we would get pretty angry at the violation of our personal privacy.

A SmartCard is….

Smart cards are the most advanced plastic cards, which can store thousands of pages of data in the embedded microchip. The chip can be either a memory chip or a microprocessor. This card-computer can be programmed to perform tasks and store information. Smart cards are classified into different types depending upon their method of communication with card readers or other devices.

Manufacturers of SmartCards:

The International Card Manufacturers Association (ICMA) is a global non-profit association of plastic card manufacturers, suppliers and other industry participants which promotes the plastic card industry and the value of its products and services.

Inside a Smart Card

The basic parts of a smart card will be familiar to any personal computer user. These include a Central Processing Unit (CPU), which performs calculations; a Read-Only Memory (ROM), which stores the operating system; Random Access Memory (RAM), which is used for temporary storage while calculations are performed; Electronically Erasable and Programmable Read-Only Memory (EEPROM), which stores data (such as account balances or encryption keys) that will be regularly changed; a Clock (which paces the rate at which instructions are processed); and Input-Output (IO)¾ via contacts which interface with a card reader (or, if the card is contactless, through induction or high-frequency radio transmission).

A smart card might have :

o 8-bit to 16bit microprocessor operating at 5 megahertz

o 256 to 1024 bytes of RAM( maximum upto 8 kilobytes)

o 6 to 24 kilobytes of ROM( maximum upto 346 kilobytes)

o 256 kilobytes of programmable ROM

o 1 to 16 kilobytes of EEPROM.

CPU	Microprocessor
¯
Reset	ROM (operating system)
¯	¯
[Memory Areas] ¬ ¾ ¾ ®	RAM (scratch pad)
¯	¯
Input/Output	EEPROM/EPROM (non-volatile)
¯
Clock

The smart card uses a serial interface and receives its power from external sources like a card reader. The processor uses a limited instruction set for applications such as cryptography. These are all contained in a single chip called a SPOM(self-programmable one-chip micro computer)Europay, MasterCard, and Visa jointly created a set of smart card specifications (EMV ‘96) based on ISO 7816. [8] [9] [10] Visa then developed a specification based on EMV. [28]

Types of Smart Cards

Smart Cards are classified into different types .They are as follows:

· Memory Smart Cards.

· Magnetic Strip Smart card.

· Microprocessor Smart Cards.

· Contact Smart Cards.

· Contact less Smart Cards.

· Combi Smart Cards.

· Multifunctional or Multi-application Smart Cards.

Memory Smart Card: ( Floppy disks, Compact disks etc)

Memory cards contain an embedded memory chip and are similar to floppy disks: they store data, which can be read and updated by external devices. These cards do not have data processing capabilities. The first smart cards were stored-value memory cards and were introduced in Europe for use in payphones. Stored-value cards are purchased with a stored value which is decremented whenever the card is used. They store electronic money, which consists of some numbers in the embedded memory chip. These cards are either disposable or rechargeable. The new laser or optical memory cards are based on optical recording technology and can store megabytes of digitized data: text, picture, voice, music, software.

Magnetic Stripe Cards

Magnetic stripe technology remains in wide use in the United States. However, the data on the stripe can easily be read, written, deleted or changed with off-the-shelf equipment. Therefore, the stripe is really not the best place to store sensitive information. To protect the consumer, businesses in the U.S. have invested in extensive online mainframe-based computer networks for verification and processing. In Europe, such an infrastructure did not develop -- instead, the card carries the intelligence

Microprocessor Smart Card: (SimCards, Digital Calculators)

These cards contain a microprocessor similar to those used in personal computers, and can not only store, but process data as well. The chip is called SPOM (self-programmable one-chip microcomputer). This microcomputer comes with a built-in operating system, such as Windows for Smart Cards, and is capable of storing and updating data, making calculations and decisions, and communicating with external devices.

These cards store and process so much information, they can be regarded as credit-card sized computers without a keyboard or a monitor. But because they are so miniaturized, people tend to disregard their power. Smart cards store personal information about their owner, so they are like little spies in the pocket. And who wants to carry around spies?

Contact Smart Cards: (Scratch Cards, Voting Cards)

Contact smart cards need to be inserted into card readers to communicate with external devices and computers. When these cards are inserted into the devices they directly communicate with the device through the microchip beneath the magnetic strip. These Cards holds the information of the personal either it may be details like name, address, photo etc.These Contact Smart Cards are widely used in the current generation as for concerned improvement in the technology has developed hugely.

Contact less Smart Cards: ( cellphones, Walkytalkies)

Contactless cards contain an embedded tiny radio transceiver to communicate with card readers or other devices. These cards may remain inside the purse or wallet during transactions.

Combi Smart Cards: ( cellphones)

Hybrid or combi cards are equipped with a contact chip and a radio transreceiver to enable both contact and contactless transactions to be performed.

Multifunctional or Multi-Applicational Smart Cards:

These microprocessor-based smart cards are capable of performing multiple applications, such as identification, access control, financial, loyalty, health care and other applications.

Distribution of Smart Cards:

Proton is the largest distributor of smart cards, especially for banking applications. The Proton smart card platform is used in 30 million cards distributed by over 250 banks, and accepted by 200,000 terminals in 15 countries. Proton was created by Banksys, the Belgian electronic funds transfer and security specialist. Users include American Express, ERG (a public transport smart card company), Interpay Nederland, and Visa International.

CardLogix : is other company in the production of smart cards . The OMNIKEY smart card reader family is now available from CardLogix. Cardlogix has also included support for the OMNIKEY readers in the Winplex® API. System designers use Winplex's powerful 32-bit technology to accelerate development, eliminating port managment hassles and to take advantage of the specific features of each reader, versus the PCSC approach. With the versatile range of readers from OMNIKEY, you can quickly deliver a responsive and secure smart card solution virtually anywhere you need it, for everything from access control to home banking to digital signatures and PKI.

Smart cards used in the banking system can authorize transactions off-line when cardholders enter their PINs. A more recent application is Mondex, which is an electronic wallet system that allows electronic currency to pass from hand to hand without redepositing. Mondex cards can also store several national currencies

Smart Card Readers:

The Smartcard readers are of different types for different smart cards. They are

1. Contact Card readers

2. Contact less Card readers

3. Pc link Card readers

4. Mobile Card readers.

Smart Cards Associated with Security:

One of the fundamental problems in securing computer systems is the need for tamper-resistant storage of keys. Smart cards provide this functionality as well as the ability to upgrade and/or replace a security solution when it becomes compromised. For example, there are millions of digital satellite systems that are smart card-enabled, and if some enterprising hacker cracks the security, the millions of DSS units need not be replaced; we can just mail out new cards.

Let’s now return to the internal structure of a smart card. To prevent counterfeiting or misuse, a smart card relies on the access to the data residing in EEPROM for its own internal applications being controlled by a secure operating system residing in

ROM.

The EEPROM data might include a newly generated 1024-bit RSA(Resistant Storage Access) key, or updateable information about the cardholder (if the card is used for identification), or the current cash balance on the card, while the secure operating system might include ROM cryptographic routines.

A well-designed card system will involve various security measures. The smart card may authenticate the card holder through a password (or passwords) stored in EEPROM. The user must enter the correct password before the other functions of the smart card chip are unlocked

The card may authenticate the card reader (the external world) by generating a random number and sending it to the reader. The reader has to encrypt the random challenge with a shared encryption key and return the result to the card. The card then compares the returned result with its own encryption before agreeing to communicate with the reader.

The card reader (the external world) may also authenticate the card’s identity by sending a random challenge (number) to the card. The card is then required to sign the number with its own private key (of a private key/public key pair) and return it to the external world for verification.

The integrity of data exchanged between the card and the outside world can be verified through a MAC (message authentication code). The MAC is a number that is calculated based on 1) the data itself, 2) an encryption key, and 3) a random number. If data has been altered (for any reason, including transmission errors), the MAC will not verify.

Applications :

There are many significant smart card applications.

Banks: Small trials in the banking system encountered to a good performance and best result in usage of the smart card in many countries.
Medical applications: In Germany 80 million people are using smart cards when they go to the doctor.
Voting: In Sweden one can vote with your smart card, which serves as a non-repudiation device.
Entertainment: Most DSS dishes in the U.S. have smart cards.
Telecommunications: Many cellular phones are engagged with the memory smart cards in few countries and will soon be shipping to all the world.

The top five applications for smart cards through out the world currently are as follows:

1. PublicTelephony--prepaid phone memory cards using contact technology

2. Mobile Telephony—mobile phone terminals featuring subscriber identification and directory services

3. Banking—debit/credit payment cards and electronic purse

4. Loyalty—storage of loyalty points in retail and gas industries

5. PAY-TV—access key to TV broadcast services through a digital set-top box

Benefits to the user’s:

Smart cards contain unique features.

Chip is tamper-resistant.
Information stored on the card can be PIN protected and/or read-write protected.
Capable of performing data encryption.
Capable of processing (not just storing) information.
Post-issuance update of information and application.

Disadvantages:

The biggest problem smart cards facing is security and the problem is two fold.

The first issue is that not all smart cards are in fact secure. VISA and MasterCard developed a new standard, SET, in early 1996 in an attempt to get the entire industry on a standard of encryption. But still some smart cards are not inviolate. Mondex, a maker of banking smart cards, solves this problem by making its transactions possible only between Mondex cards. But in order for smart cards to reach their full potential, they must be able to interact with a host of interfaces. And they must do so securely.

The second issue with security involves public perception of the technology. People must believe that the cards are secure. This depends to a great extent upon actual security, but people must also be convinced of it. And once people are comfortable that the card is secure, they must still be confident that Big Brother isn't somewhere collecting and analyzing all of the information gleaned from the smart cards' use.

A third issue concerns who holds responsibility for the card. If the cash balance is wiped clean by a memory failure, who is liable, the person or the bank? If a transaction is not recorded, where are the lines drawn? Currently companies have begun to write out agreements in order to draw boundaries, but these will have to be ones which consumers are comfortable with in order for people to begin to use smart cards.

The final problem which smart cards will face in their move to diffuse extensively involves product complements. While smart cards themselves are fairly cheap, card readers are not (costing between $50 and $200). However, in an effort to make smart cards more pervasive, companies such as Netscape and Microsoft are proposing putting software in packages they make. Additionally, Gemplus has created a new pocket reader and other companies are considering adding readers to keyboards.

Center for Smart Card Solutions

GSA's (Global Smartcard Assistance) Center for Smart Card Solutions provides assistance to federal agencies in implementing smart card projects. The Center has a group of smart card technical and program experts that can provide full service assistance to federal civilian and military agencies.

Services range from:

· Understanding the basics of smart card technology,

· Requirements analysis,

· Assistance with pilot projects,

· Developing technical specifications,

· Placing orders under GSA's Smart Card Contract,

· Acquisition strategies and options, and Self-service support.

The Center can also help with:

· Purchasing cards and readers,

· Smart card applications,

· New applications development,

· Technical and administrative support,

· Complete system integration, and

· Smart card interoperability.

GSA's smart card experts are ready to help federal civilian and military agencies save time, money, and resources.

Adoption of Smart Cards

Even though there are hundreds of smart card pilots in existance around the world, users may not take a card one country or scheme and use it in another. An industry-wide trnd toward interoperability is now emerging, enabling the developement of cards and applications that will work together in open environments. To do this, the GSA in collaboration with NIST and the industry is examining the business and technical issues while developing a standardizable interface between cards, which is the key to securing dramatic growth for the industry. The ISO has developed standards for smart cards. These standards were developed for use by multiple industries.

Conclusion:

This article has highlighted some of the technical and non-technical issues in creating smart cards. The standardization of technology will go a long way to harmonizing the look and feel of smart-card-based monetary transactions. This standardization may involve such apparently simple, but actually complicated. As the fact that smart cards operate on a few applications. Hence there is a push to change the usage of smart cards from all the applications to a wider range entire the world. The fore coming generations will be completely habituated to the usage of the smart cards