Is contactless smart card technology the same as RFID?

Contactless smart card technology is not the same as RFID. Discussions of RF-enabled applications can be confusing, and contactless smart card technology is often incorrectly referred to as RFID. Currently, a wide range of RF technologies are used for a variety of applications, each with different operational parameters, frequencies, read ranges, and security and privacy features. For example, the RFID technologies that are used to track inventory operate over long ranges (e.g., 25 ft.) and have minimal built-in support for security and privacy. Contactless smart cards use RF technology but, by design, operate at short ranges (less than 4 in.) and are very secure. Contactless smart card technology is currently being used for secure identity applications worldwide.

Do all smart cards look the same?

Smart card technology conforms to international standards ISO/IEC 7816 and ISO/IEC 14443, which enable smart cards to be interoperable. Smart card technology is available in a wide variety of form factors , including plastic cards, key fobs, the subscriber identification modules used in GSM mobile phones, and USB-based tokens. Different applications may use different form factors depending on the application and end user requirements.

Can smart cards store a patient's complete medical record?

Some smart health card implementations will provide secure access to cloud-based health information systems as a way of ensuring a patient’s health information is protected and accurate. However, smart cards are also available with a variety of features and memory capacity. A card equipped with 128 Kbytes of memory, for example, can store more than 120 pages of data. Large data files that cannot be stored on the card, such as lab reports or diagnostic images, can be stored on a central server and be accessed by the card. For example, EMT responders or an “outside” provider could use the card to access patients’ health records stored on a server in the cloud. Since the card authenticates the patient’s identity and carries additional medical and demographic data, it can be used as a key for authorized healthcare providers to unlock and access additional data.

Who can access the information on a smart card?

Smart cards are very secure. Access to the information on a card can be controlled and granted only to authorized personnel. A patient can control who accesses information, and access can be granted only with patient consent and given only to individuals identified by the patient or specified by policy. Access requirements can be defined; individuals may be given permission to access only specific information. For example, emergency personnel may need access only to details on allergies, prescriptions, or blood types. Access can also be controlled by PIN or biometric factor. All access transactions can be recorded for audit purposes and reported. The answers to Questions 5 and 6 include additional information describing the security provided by smart cards.

What are the advantages of smart cards over a biometrics-only solution for identity authentication?

Healthcare organizations considering different approaches for verifying patient and healthcare provider identity must look at the privacy, security, usability and performance implications of the different options. Smart healthcare cards – either alone or combined with biometrics – provide a privacy sensitive, secure solution, and also offer additional features and functions that can provide significant benefits to healthcare providers when compared to a biometrics-only solution. Biometrics-only solutions are not ideal for patient health ID cards. A smart healthcare card with a photo provides a solution that patients are familiar with and will readily accept. In addition, the smart healthcare card promotes the healthcare organization brand, can support a wide variety of applications that add value, and can be interoperable and usable among disparate groups. Either a smart provider ID card or a smart provider ID card with a biometric can provide healthcare organizations with the features needed to authenticate provider identities and offer better performance than a biometrics-only solution. Providers need an identity authentication solution that can be used at multiple facilities and in emergency situations. Smart healthcare cards are built on standards, can be interoperable across multiple locations, and can be used with portable readers in emergency response situations. For multi-factor authentication, a smart healthcare card with a personal identification number can be significantly more cost-effective for a healthcare organization than a biometric solution. Combining smart cards and biometrics can provide a full-feature solution for healthcare provider identity authentication. By storing the biometric and performing the biometric match on the smart healthcare card, the privacy and security of biometric authentication are enhanced and system performance is improved, with local, offline identity authentication. Only identity verification solutions based on smart card technology can provide identity assurance and authentication while increasing privacy and security. Smart cards also bring operational efficiencies to the healthcare system that reduce costs, reduce fraud, and increase patient satisfaction. As electronic health records (EHRs) and personal health records (PHRs) move to the mainstream, smart health ID cards can be used as a two-factor authentication mechanism into a provider or insurer web portal. Smart healthcare cards protect patient privacy and security when accessing online records and support the National Strategy for Trusted Identities in Cyberspace (NSTIC), which identifies consumer access to online electronic health records as warranting two-factor authentication. Smart card technology is used globally for secure identity, access and payment applications. As a standards-based technology, smart card solutions for patient and provider identity management are deployed around the world and are available from numerous vendors. Smart card technology provides a strong foundation for healthcare ID cards, enabling improvement in healthcare processes and in patient and provider identity verification, while securing information and protecting privacy.

Jafar E

Aug 15, 20215 min read

What is Smart Card?

Updated: Oct 9, 2021

A smart card is a physical card that has an embedded integrated chip that acts as a security token.

Smart cards are typically the same size as a driver's license or credit card and can be made out of metal or plastic. They connect to a reader either by direct physical contact (also known as chip and dip) or through a short-range wireless connectivity standard such as radio-frequency identification (RFID) or near-field communication (NFC).

The chip on a smart card can be either a microcontroller or an embedded memory chip. Smart cards are designed to be tamper-resistant and use encryption to provide protection for in-memory information. Those cards with microcontroller chips can perform on-card processing functions and can manipulate information in the chip's memory.

Smart cards are used for a variety of applications, though most commonly are used for credit cards and other payment cards. Distribution of smart cards in recent years has been driven by the payment card industry's move to support smart cards for the EMV payment card standard. Smart cards capable of short-range wireless connectivity can also be used for contactless payment systems; they can also be used as tokens for multifactor authentication.

International standards and specifications cover smart card technology, with some focused on industry-specific applications. In the United States, smart card technology conforms to international standards (ISO/IEC 7816 and ISO/IEC 14443) championed by the Smartcard Alliance.

The first mass use of smart cards was the Télécarte, a telephone card for payment in French pay phones which launched in 1983. Smart cards are now ubiquitous and have largely replaced magnetic stripe (also known as "mag stripe") card technology, which only has a capacity of 300 bytes of non-rewriteable memory and no processing capability.

How smart cards work

Smart card microprocessors or memory chips exchange data with card readers and other systems over a serial interface. The smart card itself is powered by an external source, usually the smart card reader. A smart card communicates with readers either via direct physical contact or using a short-range wireless connectivity standard such as RFID or NFC. The card reader then passes data from the smart card to its intended destination, usually a payment or authentication system connected to the smart card reader over a network connection.

Uses of smart cards

Smart cards are generally used in applications that must deliver fast, secure transactions and protect personal information such as credit cards and other types of payment cards, corporate and government identification cards and transit fare payment cards. Smart cards are also sometimes used to function as documents such as electronic passports and visas.

Smart cards are often designed to be used with a PIN, for example, when they are used as debit or ATM cards. Organizations also use smart cards for security purposes; in addition to their use as multifactor authentication tokens, the cards can also be used for authenticating single sign-on users.

Types of smart cards

Smart cards can be categorized on different criteria including by how the card reads and writes data, by the type of chip implanted in the card and by the capabilities of that chip. Some of the different of types of smart cards include:

Contact smart cards are the most common type of smart card. Contact smart cards are inserted into a smart card reader that has a direct connection to a conductive contact plate on the surface of the card. Commands, data and card status are transmitted over these physical contact points.
Contactless smart cards require only close proximity to a card reader to be read; no direct contact is necessary for the card to function. The card and the reader are both equipped with antennae and communicate using radio frequencies over the contactless link. A contactless smart card functions by being put near the reader to be read.
Dual-interface cards are equipped with both contactless and contact interfaces. This type of card enables secure access to the smart card's chip with either the contactless or contact smart card interfaces.
Hybrid smart cards contain more than one smart card technology. For example, a hybrid smart card might have one embedded processor chip that is accessed through a contact reader as well as an RFID-enabled chip used for proximity connection. The two different chips may be used for different applications linked to a single smart card, as when the proximity chip is used for physical access to restricted areas while the contact smart card chip is used for single sign-on authentication.
Memory smart cards contain memory chips only and can only store, read and write data to the chip; the data on memory smart cards can be over-written or modified, but the card itself is not programmable so data can't be processed or modified programmatically. Memory smart cards can be read-only and used to store data such as a PIN, password or public key; they can also be read-write and used to write or update user data. Memory smart cards can be configured to be rechargeable or disposable, in which case they contain data that can only be used once or for a limited time before being updated or discarded.
Microprocessor smart cards have a microprocessor embedded onto the chip in addition to memory blocks. A microprocessor card may also incorporate specific sections of files where each file is associated with a specific function. The data in the files and the memory allocation are managed with a smart card operating system. This type of card can be used for more than one function and is usually designed to enable adding, deleting and otherwise manipulating data in memory.

Smart cards can also be categorized by their application, such as credit card, debit card, entitlement or other payment card, authentication token and so on.

Advantages of smart cards

Smart cards can provide a higher level of security than magnetic stripe cards as they can contain microprocessors capable of processing data directly without remote connections; even memory-only smart cards can be more secure because they can securely store more authentication and account data than traditional mag stripe cards.

Another advantage of smart cards is that once information is stored on a smart card, it can't easily be deleted, erased or altered. As such, smart cards are good for storing valuable data that can't be -- or shouldn't be -- easily reproduced.

Smart card technology is generally safe against electronic interference and magnetic fields, unlike magnetic stripe cards. In addition, applications and data on a card can be updated through secure channels so issuers do not necessarily have to issue new cards when an update is necessary. Multiservice smart card systems can enable users to access more than one different service with just one smart card.

Disadvantages of smart cards

While smart cards have many advantages, the cards themselves -- as well as the smart card readers -- can be expensive.

Another disadvantage of smart cards is that not all smart card readers are compatible with all types of smart cards. With multiple types of smart cards available, some use nonstandard protocols for data storage and card interface; some smart cards and readers also use proprietary software that is incompatible with other readers.

While smart cards can be more secure for many applications, they are still vulnerable to certain types of attack. Attacks that can recover information from the chip are possible against smart card technology. Differential power analysis can be used to deduce the on-chip private key used by public key algorithms such as RSA. Some implementations of symmetric ciphers can be vulnerable to timing attacks or differential power analysis as well. Smart cards may also be physically disassembled in order to gain access to the on-board microchip.

Examples of smart cards

Smart card applications include:

Payment cards, including debit or credit cards issued by commercial credit card companies and banks.
Electronic benefits transfer (EBT) cards, which are used for distribution of government benefits such as the U.S. Supplemental Nutrition Assistance Program.
Transit cards can be used by local and regional transit systems to process payments as well as give riders points on their purchases.
Smart cards are used as ID cards issued by schools, corporations and government entities to control access to physical locations.
Medical institutions use smart cards to securely store patient medical records.

Article Courtesy : techtarget.com

Authors: Linda Rosencrance | Michael Cobb

What is Smart Card?

Recent Posts

Comments