Table of Contents - Smart Card Basics – Welcome!

1 Table of Contents Smart Card 5. Overview & 5. Why Smart 6. SIM Cards and 6. Loyalty and Stored 6. Securing Digital content and Physical 6. 6. Bank Issued 7. Healthcare 7. Enterprise and Network 7. Physical 8. Types of Chip 9. Card 9. Contact Memory CPU/MPU Microprocessor Multifunction Contactless Multi-mode Communication Hybrid Cards ..12. Dual Interface Multi-component Smart Card Form 13. Integrated Circuits and Operating 13. Smart Card 15. Contact ..15. Reader & Terminal to Card Applications Development ..16. Smart Card 17. Global System for Mobile Communication (GSM) ..18. OpenCard Global Common Biometric System Planning & 21. Basic Security Value General Multi-Application Card 3. Smart Card Security (Section 1).. 24. What Is Security?..24. What Is Information Security?..24. The Elements Of Data The Mechanisms Of Data Smart Card Security (Section 2).. 26. Data Authorization and Auditing and Data Security Mechanisms and their Respective Smart Card Security (Section 3).

2 30. Host-Based System Card-Based System Threats To Cards and Data Security PKI-Public Key 34. 35. 53. 4. Smart Card Basics Welcome to Smart Card Basics . This is a sponsored site brought to you by a number of leading manufacturers in the Smart card industry. We have tried to make this site informative with out a single perspective or a marketing pitch. It is our belief that informed users make better choices, which in turn leads to a stronger market for all. Smart Card or Chip card technology is fast becoming commonplace in our culture and daily lives. We hope that this site will bring you a little closer in your understanding of this exciting technology and the benefits it can bring to your applications. If you have specific questions regarding a specific technology discussed below feel free to send us an email and the appropriate site sponsor will respond. Overview & Applications A Smart card, a type of chip card, is a plastic card embedded with a computer chip that stores and transacts data between users.

3 This data is associated with either value or information or both and is stored and processed within the card's chip, either a memory or microprocessor. The card data is transacted via a reader that is part of a computing system. Smart card-enhanced systems are in use today throughout several key applications, including healthcare, banking, entertainment and transportation. To various degrees, all applications can benefit from the added features and security that Smart cards provide. According to Eurosmart, worldwide Smart card shipments will grow 10% in 2010 to billion cards. Markets that have been traditionally served by other machine readable card technologies such as bar-code and magnetic stripe are converting as the calculated return on investment is revisited by the each card issuer year after year. First introduced in Europe nearly three decades ago, Smart cards debuted as a stored value tool for pay phones to reduce theft.

4 As Smart cards and other chip-based cards advanced, people found new ways to use them, including charge cards for credit purchases and for record keeping in place of paper. In the , consumers have been using chip cards for everything from visiting libraries to buying groceries to attending movies, firmly integrating them into our everyday lives. Several states have chip card programs in progress for government applications ranging from the Department of Motor Vehicles to Electronic Benefit Transfer (EBT). Many industries have implemented the power of Smart cards into their products such as GSM digital cellular phones to TV-satellite decoders. 5. Why Smart Cards Smart cards greatly the convenience and security of any transaction. They provide tamper-proof storage of user and account identity. Smart card systems have proven to be more reliable than other machine-readable cards, such as magnetic-stripe and bar-code, with many studies showing card read life and reader life improvements demonstrating much lower cost of system maintenance.

5 Smart cards also provide vital components of system security for the exchange of data throughout virtually any type of network. They protect against a full range of security threats, from careless storage of user passwords to sophisticated system hacks. The costs to manage password resets for an organization or enterprise are very high, thus making Smart cards a cost-effective solution in these environments. Multifunction cards can also serve as network system access and store value and other data. Worldwide, people are now using Smart cards for a wide variety of daily tasks. These include: SIM Cards and Telecommunication The largest use application of Smart card technology is in Subscriber Identity Modules (SIM) as required by the standard for all Global System for Mobile Communication (GSM) phone systems; each phone utilizes the unique identity as presented in the SIM to manage the rights and privileges on that network and all other networks that are tied by agreement to roam.

6 This use case represents over half of all Smart cards consumed each year. The Universal Subscriber Identification Modules (USIM) is also being used to bridge the identity gap as phones transition between a GSM and a UTMS or 3G network operator. Loyalty and Stored Value Another use of Smart cards is stored value, particularly loyalty programs that track and incentivize repeat customers. Stored value is more convenient and safer than cash. For issuers, float is realized on unspent balances and residuals on balances that are never used. For multi-chain retailers that administer loyalty programs across many different businesses and POS systems, Smart cards can centrally locate and track all data. The applications are numerous, from transportation systems, including parking and laundry, to gaming, as well as all retail and many entertainment uses. Securing Digital content and Physical Assets In addition to information security, Smart cards achieve greater security of services and equipment, because the card restricts access to all but the authorized user(s).

7 Information and entertainment is being delivered via satellite or cable to the home DVR player or cable box or cable-enabled PC. Home delivery of service is encrypted and decrypted via the Smart card per subscriber access. Digital video broadcast systems have already adopted Smart cards as electronic keys for protection. Smart cards can also act as keys to machine settings for sensitive laboratory equipment and dispensers for drugs, tools, library cards, health club equipment etc. In some environments, Smart card enabled- SD and microSD cards are protecting digital content as it is being delivered to the mobile hand-sets/. phones. E-Commerce Smart cards make it easy for consumers to securely store information and cash for purchasing. The advantages they offer consumers are: The card can carry personal account, credit and buying preference information that can be accessed with a mouse click instead of filling out forms. Cards can manage and control expenditures with automatic limits and reporting.

8 Internet loyalty programs can be deployed across multiple vendors with disparate POS systems and the card acts as a secure central depository for points or rewards. 6. Micro Payments - paying nominal costs without transaction fees associated with credit cards, or for amounts too small for cash, like reprint charges. Bank Issued Cards Around the globe the bank controlled Co-ops (Visa, MasterCard, Discover, and American Express) have rolled out millions of Smart cards under the EMV (Europay, MasterCard, VISA) standard. Often referred to as chip and PIN. cards; these are the de facto type of cards for bank issuance in most countries except the As Canada has just recently started its regulatory shift of EMV cards the will be the sole island in North America that has not yet made the adoption. This adoption is being driven by the increased types of fraud for both credit and debit cards. Smart cards have been proven to secure a transaction with regularity, so much so that the EMV standard has become the norm.

9 As banks enter competition in newly opened markets such as investment brokerages, they are securing transactions via Smart cards at an increased rate. This means: Smart cards increase trust through improved security. Two-Factor Authentication insures protection of data and value across the internet. Threats such as the Man in the middle and Trojan Horses that replay a user name and password are eliminated This is improving customer service. Customers can use secure Smart cards for fast, 24-hour electronic funds transfers over the internet Costs are reduced: transactions that normally would require a bank employee's time and paperwork can be managed electronically by the customer with a Smart card Healthcare Informatics The explosion of health care data brings up new challenges to the efficiency of patient care and privacy safeguards. Smart cards solve both challenges with secure, mobile storage and distribution of everything from emergency data to benefits status.

10 Many socialized countries have already adopted Smart cards as credentials for their health networks and as a means of carrying an immediately retrievable Electronic Health Record (EHR). Benefits include: Rapid, accurate identification of patients; improved treatment Reduction of fraud with authentication of provider/patient visits and insurance eligibility A convenient way to carry data between systems or to sites without systems Reduction of records maintenance costs Embedded Medical Device Control For years, embedded controllers have been in many types of machines, governing the quality and precision of their function. In Healthcare, embedded Smart cards ensure the best and safest delivery of care in devices such as dialysis machines, blood analyzers and laser eye surgery equipment. Enterprise and Network Security Microsoft Windows, Sun Microsystems (a subsidiary of Oracle Corporation) and all new versions of Linux have built-in software hooks to deploy Smart cards as a replacement for user name and passwords.