EUROSMART is working to design products to the state-of-the-art security level in accordance with operators` security level requirements that best fit their application. EUROSMART represents companies with up to 25 years of experience in smart cards. Information leakage has been an area of concern as the security of smart card applications is paramount.
EUROSMART created a Security Working Group in 1997 to coordinate standardisation initiatives in this matter. This forum works actively on improving and implementing all security evaluation methods such as FIPS, ITSEC and Common Criteria, with clear evaluation scales to demonstrate the products security. It is in contact with European institutions to discuss privacy protection and electronic transaction security requirements for incorporation in European legal frameworks.
EUROSMART recommends evaluating, certifying and maintaining certification of smart card products, in particular using the Common Criteria (ISO 15408 standard) methodology. All Common Criteria Certified Protection Profiles take into account all possible threats on smart cards and security functions to countermeasure potential attacks like site attacks, DFA, DPA, physical attacks, mathematical attacks and many others.
Smart cards associated with biometrics is the best technology combination to build cost effective and convenient platforms that meet the requirements of future secure personal ID systems. Smart cards compare favourably with static memory devices, such as 2D bar codes, laser cards or memory cards.
The smart card is a unique, portable, personal object that easily combines secure identification and authentication functions for both the physical and the digital worlds. Smart cards are well perceived by citizens, offering convenience, security, and crucial personal information privacy management features.
ICAO has adopted recommendations at the end of May 2003 as guidelines for a Machine Readable Transport Document including the use of biometrics technology for faster and more secure control of travellers` identity.
US security agencies have also recommended the use of biometrics features for frontier control and the incorporation of Public Key cryptography (PKI) and Digital Signature Standards for future visa systems.
The European Commission is now launching the second generation of Schengen Information System and is also recommending biometrics for an EUwide visa system. EUROSMART has made certain recommendations to assist the European Commission in the preparation of this approach.
Smart cards associated with biometrics are the best technology combination to build cost effective platforms that meet the requirements of future secure personal ID systems. Coupled with a secure, privacy-sensitive information technology architecture and a strong policy framework, a smart card based secure personal ID system:
- provides accurate personal identification, through classic identity verification by the authorities using a security document. The card body has demonstrated in many countries and applications its capability to embed advanced security features.
- provides accurate personal identification in the digital world, using well understood automatic authentication procedures that are commonly used by the banking industry -- e.g. GSM mobile telephony industries. The card enables authorities to use the powerful digital networks to access and verify citizen related information, and also enables the citizen to access e-government online services.
- protects the individual` s personal information -- that is stored in the card and provided by voluntary action -- and so ensures better acceptance by citizens
- effectively addresses legal requirements currently being debated in many countries
EUROSMART recommendations for generic personal ID systems
Many countries have started to study the development and implementation of secure personal ID systems taking into account the following requirements in term of ability to:
- Provide effective verification of an individual`s identity
- Guarantee a significant increase of security and trust in respect of currently existing systems
- Protect the privacy of individual`s identity information
- Ensure interoperability between various systems of different countries
- Provide for a given country or a group of countries (like the EU), access to government services.
The best suitable Machine Readable Transport Document (MRTD) device is the smart card since it offers all naked eyes control capability, while providing additional security features to reduce fraud and provide security and trust for on-line systems. Smart cards better cover the privacy issues that are essential for European citizens.
Smart card based personal ID system have to integrate biometric technology to make the citizens experience at heavy traffic identity verification points a swift and enjoyable one. Any biometric sample fits and can be handled by the smart card technology that exists today. Several such samples would fit easily within a relatively low-end smart card.
As the silicon and security technologies continues to evolve rapidly, it is certain that even the highest performance cards of today will be commonplace and relatively low-end in the next few years. The card memory capacity and the CPU computing power must be selected according to the data storage and processing needs, and optimised to meet the best performance/cost ratio at the time of large scale deployment.
The smart cards features can also be used in a contactless/wireless environment; however expert design must be applied in this case since these features may come at the expense of privacy.
As long as acceptance by public and respect of privacy is ensured, any biometric data can be used in secure personal ID system (face recognition and fingerprint being the most common candidates, but could be complemented by a third or several other techniques if needed).
Interoperability between countries needs to be ensured through the use of a standardized Biometric Application Programming Interfaces (API) . EUROSMART, the US based Smart Card Alliance, the JavaCard Forum and several other industry associations have united their efforts towards such standardization. These efforts would be accelerated by the adoption of a smart card combined with biometrics recommendation by the European Community for its visa, passport and e-government initiatives, leading to an ISO standard. A Public Key Infrastructure (PKI) needs to be used to ensure exchanges between multiple countries.
Full biometric Match-On-Card process is recommended for One to One verification. This capability ensures that the biometric sample comparison with the reference sample stored in the smart card is made inside the secure smart card without the original sample ever being exposed outside of the smart card. This is true if no official agent is present to control the authentication process.
For the One to Many identification, matching can be performed on the central secure database. Associated with a strong PKI architecture, smart card will ensure an acceptable security and privacy level.
