What are smartcards?
Smartcards contain a processor and nonvolatile memory
so they perform dynamic data processing capabilities in addition to data storage.
The chip is so small that it's often embedded in something larger to make it
easy to carry, such as credit card or key shape.
Unlike memory cards, it actively participates in the secure conversation
from the host, so even eavesdropping cannot clone the card
or reply the transaction.
Some are Java based so the internal processor runs downloadable Java applets
instead of just using pre-defined functions.
This means the smartcard becomes a computational element of the protocol,
not just a storage device.
While that doesn't sound very exciting, it's a big step up from
cards with just a magnetic strip with limited storage capacity.
With a magnetic card, you can't "write protect" specific areas.
With a smartcard, memory contents can be read/write, read-only,
or accessed only via well defined interfaces.
Smart Card issuers are exploring ways to use the "spare" memory,
to make the card more pleasant and desirable to use over other methods.
Some already save the user's preferences.
Perhaps such preferences will be standardized so settings for
would be honored by all machines using the card (atm, vending machine, ...).
- left/right handed
- special needs
"Loyalty" programs are exploring such features so there's no need
to carry a separate card for CVS, Pathmark, ShopRite, etc.
That way, I would be encouraged to use the same credit card for all purchases
to get the preferred customer prices.
BUT: there are privacy concerns because all the data about
my buying habits are consolidated too!
A related note: until smart cards are widely accepted, a clever kid patented
the idea of adding more magnetic strips to your current card for loyalty programs
instead of issuing additional cards. While that's better than the keyring-of-many-cards,
most of those cards are barcoded so this doesn't help much.
Smart cards already deployed
- Cellular phones call their SmartCard the SIM (Subscriber Identity Module)
[see the small blue card on the barcode of the Dish Network card].
The permanent ID is protected,
but the phone list, user preferences, calendar, etc are stored in it too.
Some phones differentiate things stored in the SIM insecurely,
securely (important if the phone is stolen)
or in the phone's own memory (useful for pre-paid SIMs).
Here's a SIM reader for the PC to read/sync the non-secure phone list
from phones with no PC link (USB, serial, I-R, Bluetooth).
- The Segway Human Transporter (HT) is the 2 wheel scooter-like mobile
that's occasionally in the news (police, mail carriers are trying them).
Note that multiple DSPs (digital signal processors: specialized CPUs)
are used for sensing the tilt (using gyros), controlling the motors, etc.
This would not be possible if not for ubiquitous computing!
Each Segway comes equipped with a 64-bit encrypted magnetic key to prevent theft.
The key sets the Segway's profile that governs speed,
turning radius, and battery life.
For example, a "new user" profile
limits the speed of the Segway until the rider feels comfortable
to unlock its full capabilities.
Imagine such a smart card for your car:
- valet profile: limits speed, no access to trunk or glove box
- student driver profile: limits speed, nags user to phone home, etc.
- vending machines use prepaid "stored value" cards
(the laundry room in my apartment building too!)
American Express's "Blue" card has both the magnetic strip and a smartcard.
Smartcard readers are free for home use for secure online ordering,
and for obtaining a secure, temporary transaction number instead of your actual card number
for otherwise insecure payments.
Military: personal ID smart-cards augment dogtags, used for authentication
and multi-level security access (they play well with printed cards, magstripes, barcodes).
Wireless smard-cards (RFID) track supplies (civilian uses: reduce theft).
So why don't I see them everywhere?
The first obstacle is justifying the cost of installing the new readers,
particularly if the existing system works!
Subway systems such as
still use magstripe cards very successfully and securely.
- New York MTA's Metrocard
- NY/NJ PATH's QuickCard
- NJ/PA Patco
- The Washington Metropolitan Area Transit Authority Metro
There are many opportunities but false starts have made people cautious and
slow to deploy new technologies.
An large installed base of readers is needed for them to succeed:
in terminals / PCs
The smartcard reader can be built directly into USB keyboards so the card's used
in lieu of typing userid/password (or augmented with a PIN to prove who's at the keyboard).
The card can also help securely manage other keys and private data,
but would compete with existing technologies such as USB-drives and memory cards.
Microsoft's technet advocates smartcard technology, saying
Windows Powered Smart Cards can be customized for each user,
And they can be programmed with multiple keys.
The cards can be used to log on to a PC or to one or more networks
and to perform remote logons. By storing all of a user's authentication information,
one Windows Powered Smart Card can gain for a user admittance
to all of his or her accounts - on the corporate network,
within Internet chat rooms, or within financial institutions.
NYNEX/NY Telephone once had special yellow phones that only
accepted their pre-paid cards, but I don't see them anywhere anymore,
and despite the spread of phone-fraud, few phones have any sort of card reader.
I fear there is no incentive since so few customers have smartcards,
the current equipment works well and credit card fraud detection depends on other factors now.
Incentives to convert to SmartCards could include
- stronger guarantee against fraud
- free equipment
- lower transaction fee
- links to "loyalty" programs
Ethical, privacy and security concerns
here's an analogy:
- Does the cardholder have the right to examine all the contents of the card?
What about controlling the content and delivery?
Will laws guarantee that (there are already laws concerning privacy,
data accuracy, disclosure and sharing)
- Is each content provider required to disclose the data, when and how it's used?
web browsers (Netscape, Internet Explorer, Mozilla, Konqueror) handle "cookies" but
I see no such guarantee with the smart cards, as if I don't have the right to know
what's stored on the card or manage it
- there's security and control: you can only get your own cookies, can't spy and take others
ex: B&N can't get Amazon's cookies
- I can manage the cookies
- filter what cookies are accepted/rejects: per cookie, per site
- I can view/edit/delete the saved cookies
Visa and AmEx had contests for folks to write applications for the smart cards.
NOWHERE in the rules did they mention ANY guidelines for privacy or security.
I'm concerned about the attitude they're conveying about uses for such capabilities.
To learn more
FAQ, links, news, suppliers
Introduction to Windows for Smart Cards
The Smart Card Deployment Cookbook for deploying smart cards in an enterprise
that is deploying Microsoft Windows 2000 Active Directory.
The white papers in this series will help you understand the principal
smart card concepts and guide you through the planning tasks.
yet another "smartphone", an attempt at an internet appliance
similar to the already abandoned 3com Audrey, Netpliance's i-opener, etc.
Citing the web site:
The CyberFone, with the optional smart card/swipe card reader,
will have the capability of taking orders by use of a smart card, credit card or debit card.
industry PR site
lists types of cards, price/performance tradeoff
The OpenCard Framework provides a common interface for both the smart card reader
and the application on the card. Basing the architecture on Java technology ...
The Segway Human Transporter (HT)
lists many smartcard makers
the leading maker of smartcards and readers