Wave Systems Corp. (fka WAVXQ)

[Fullmoon]

OT: Advances in Linking Smart Cards to PCs
By Tim Kridell

http://www.cardtechnology.com/cgi-bin/readstory.pl?story=20041201CTMI661.xml

In the Lombardy region of northern Italy, doctors spend their days handling blood pressure cuffs, stethoscopes and, now, smart cards. That’s because the area’s health care facilities are in the midst of a major smart card rollout that requires adding smart card readers to roughly 35,000 computers. Each computer is equipped with a reader that can communicate with both the doctor’s and the patient’s smart cards; it also has a PIN pad.

This type of reader ensures that a patient’s data is read only by authorized health professionals and only after the patient has handed over a new smart card that Lombardy citizens are being issued in a test of a card that eventually may be adopted throughout the European Union.

The operator–such as a doctor or nurse–also must insert his or her card into a reader and enter their PIN before the reader will access the data on the patient’s card.

“The citizen card certifies both identity and his will to allow the operator to access his clinical data stored in the system,” says Carlo Leonardi, who’s overseeing the project. The health professional’s profile stored on the card specifies what data that individual can access.

The Lombardy deployment is noteworthy not just for its planned scale–145,000 health care providers and 9.2 million citizens–but also because it’s part of the European Netc@rds project, which seeks to replace paper and red tape with electronic documents. Programs such as Netc@rds, which is being tested in seven European countries, create demand for smart cards and readers, including readers with such new features as dual card slots and PIN pads.

Demand for smart card readers is increasing rapidly, according to U.S.-based research firm Frost & Sullivan. The firm projects unit shipments will grow from 9.4 million in 2003 to 35.5 million readers in 2008, a compound annual growth of 30.6%.

Frost & Sullivan says France-based Gemplus International, best known as one of the top smart card vendors, led the way in readers in 2003, shipping 1.9 million units for a 20.8% market share. Gemplus has two major competitors in smart card readers: U.S.-based SCM Microsystems and Germany-based Omnikey, a subsidiary of Assa Abloy of Sweden.

These and other vendors are offering more choices: from tokens that contain smart card chips and do away with the reader, to contactless readers that promise greater durability and convenience.

There also are more vendors to choose from and stiffer price competition, notes Karthik Nagarajan of Frost & Sullivan. He points to Hong Kong-based Advanced Card Systems, a company founded in 1995, which Frost & Sullivan ranks fourth in the global market for smart card readers for PCs.

Those deploying smart card readers say they are becoming easier to install, although some hassles remain. In Lombardy, readers connect to workstations via a USB cable. “[There’s] no difficulty whatsoever,” Leonardi says.

Vendors say most of the readers they ship nowadays connect to a PC’s USB port. Those USB ports have been standard on PCs since the late 1990s, and plugging them in is no more difficult than plugging in a toaster–that is, if you know where to find the USB port.

Not everyone does, points out Trent Henry, an analyst with the Burton Group, a U.S. company that specializes in IT security. There are also software drivers to download, which some end-users will find challenging. “The large organizations that have had successful deployments have had to write fairly in-depth tutorials for their users in order to get the card infrastructure, including the readers, to work successfully.”

Some card vendors are incorporating the USB interface and Internet protocols in their card software, which would eliminate the need for users to download software drivers or middleware to their PCs. Only a USB connection, linking the card and PC would be needed. These cards will first hit the market in 2005, so it could be a few years before they gain acceptance.

Until then, current readers that plug into the PC’s USB port are easier to use than the earlier readers that plug into serial ports. Although SCM hasn’t discontinued its serial-port product, “we aren’t selling much of it at all,” says Jason Schouw, vice president and general manager for the Americas. “The majority of demand, even on older systems, is USB.”

A third type of reader fits into the PCMCIA slot that many laptops include. “The demand for PCMCIA readers is boosted by high laptop adoption,” says Alain Sigaud, head of the smart card reader business at Gemplus.

Prices for USB readers have fallen into the range of $10 to $15 apiece in large volumes. A PCMCIA reader typically goes for about twice as much.

But in a deployment of, say, 100,000 smart cards, a $15 reader still could add up to $1.5 million worth of overhead. One way to cut that cost is by using USB tokens, which are about the size of a house key and contain a smart card chip. They plug directly into the PC’s USB port.

“The advantage there is that you pretty much skirt the whole reader issue because you don’t need to attach an additional piece of hardware to your machine, although (software) drivers usually are still required,” says Henry of the Burton Group.

The convenience of combining the card and reader into a single package is winning over some customers. For example, Gemplus says it has sold more than 400,000 USB tokens in China this year, in a project driven by a major bank.

But many organizations want employees to carry a single credential that functions both as a photo ID card and as a way to authenticate the individual’s identity for network access. One reason is cost: A single badge that combines credentials, such as building entry and network access, is up to 20% cheaper than issuing multiple cards, according to a Burton Group study.

That reduced overhead, along with increased productivity from faster PC log-ins, saved one large enterprise $8 million in the first year of its smart card deployment, with future annual savings of at least $3 million, Burton Group says. The consulting firm did not identity the organization.


Contactless Options

Those cards will carry both a contact chip for network access and a contactless chip so cardholders can enter buildings by waving their cards near readers that emits radio signals. While contact smart cards that must be inserted into readers are the norm for network security applications, Nagarajan says some organizations may begin using contactless cards and readers for network access.

Because contactless cards need not be inserted into readers, there’s minimal wear and tear on the card and reader, so they last longer. However, the potential for confidential data to be intercepted as it travels through the short gap between card and reader remains a concern.

Cost is also an issue. Although contactless hardware carries a price premium over comparable contact gear, some buyers say that in bulk a $25 contactless reader can be had for as little as $20. And adding a contactless interface to a card–which can be done with a separate contactless chip or a dual-interface contact/contactless chip–also means spending more on the smart card.

Leonardi of Lombardy, which is considering adding a contactless interface so that citizens’ health cards can also be used for mass transit, estimates that contactless adds 1.5 euros (US$1.94) to the cost of the card.

The added cost of card and reader may be justifiable if contactless means lower total cost of ownership because cards and readers can last longer. As one U.S. government buyer says: “Even if you have to put another $20 (per user) into the infrastructure, it’s money well spent.”

Burton Group’s Henry says contactless also may be a better choice for such environments as factory floors, where the reader slots for contact smart cards may be quickly gummed up by dirt and grease.

Contactless is gaining momentum rapidly in Asia, where it first was used on a wide scale in cards that commuters wave past subway turnstiles for faster fare payment. For instance, Sony Corp. of Japan says it has distributed about 1 million contactless card readers to consumers who carry Sony’s Elio credit card. That card also carries the contactless Edy electronic purse on it, and consumers can use it to make small payments on the Internet by laying their card on the contactless card reader. To date, Sony records few contactless credit or e-purse transactions online, however.

Sony in October began a test of a contactless card and reader in the United States, but just for use as a loyalty card that members of its Sony Club rewards program can use for easier Web access and to take advantage of special offers.

Cardholders lay the contactless card on the reader and enter a personal identification number to access a customized Web page and a toolbar that provides easy access to Web sites of Sony and partner companies. The card also stores user names and passwords for easy log-on to favorite Web sites.

Sony signed up 7,000 consumers by e-mailing members of the Sony Club rewards program, says Jeffrey Dorn, senior vice president of financial services strategy. Those consumers received the Wave card and reader free after completing a survey and downloading the needed software.

Sony planned to send another batch of e-mails later in the fall to a second group of Sony Club members, who would have to pay $29.95 plus 500 Sony Club points for the card and reader. In both cases, those who sign up receive coupons worth $50 from Sony and its partners. Sony also planned a direct mail offer of the card and reader to some of the nearly 1 million holders of the Sony Card, a cobranded Visa credit card issued by J.P. Morgan Chase & Co.


PIN Security

For many others shopping for smart card readers, security is the key. Some organizations want readers with PIN pads so that when the cardholder types in their PIN it is never seen by the PC. That is to prevent a hacker from inserting spyware onto the computer that would record the PIN and return it to the hacker.

Readers with PIN pads, known as Class 2 readers, represent less than 5% of the market. These cost about 50% more than basic readers. But the big obstacle has been integrating such readers with PCs, says Uwe Schnabel, chief technology officer at Omnikey.

The PC/SC specification that facilitates the integration of basic smart card readers with Windows-based PCs does not cover readers with PIN pads. That means that smart card vendors, or developers of software for smart card projects, must write special software to communicate with these readers from each manufacturer, Schnabel says.

To overcome that obstacle, Omnikey, SCM and Germany-based reader manufacturer Kobil Systems this fall developed a proposed standard way for PCs to communicate with the high-end readers. He says the three companies have proposed adding this protocol to the PC/SC standard. He hopes a decision will be made by year’s end.

That work illustrates how vendors are upgrading their devices to meet new and growing demand. Whatever the users’ needs, there are more vendors offering more models than ever before. CT