Card, mobile credential, payment and security
HUNTINGTON, W.Va. – Marshall University has contracted with Higher One, a New Haven, Conn., financial services company for colleges and universities, to provide one-card banking and electronic funds disbursement through MU’s student, faculty and staff ID cards.
Beginning with the first summer term of 2004, Marshall students, faculty and staff will have the option to use their ID card, the Marshall OneCard, as a MasterCard Debit Card. The new system will allow those holding a Marshall OneCard to access a variety of customized banking services through the card.
The ID card program will allow Marshall OneCard holders to use their card for primary bank account access as well as to retrieve cash from ATMs, transfer money electronically and monitor their accounts on-line. Additionally, the Marshall OneCard will permit students to receive their financial aid refund payments and other refunds electronically. The system also will allow students, faculty and staff to have their payroll checks deposited electronically into their accounts.
In addition to being a debit card accepted at more than 31 million merchants worldwide, the new Marshall OneCard also will provide access to the university’s Herd Points program, a stored-value account that allows students to use their ID for purchases on campus. The MU OneCard will be a benefit of enrollment or employment at Marshall.
“Students and parents do request a system that would provide them with an easier mechanism for handling their campus finances,” said Dr. Karen Kirtley, Marshall’s assistant vice president for administration. “The Marshall OneCard program will benefit students by making their financial aid and other refunds available to them faster. It will benefit the university through increased efficiency and administrative cost savings.”
As a financial services provider, Higher One focuses on meeting the unique financial needs of higher education institutions. The company’s goal is to help universities reduce administrative costs, streamline business processes, increase revenue opportunities, improve the student experience and strengthen the campus community.
Located in Huntington, W.Va., Marshall University is a public university with an enrollment this spring of more than 16,300 students. Marshall offers 43 baccalaurate degree programs and 40 master’s degree programs in the liberal and fine arts, business, sciences and education.
Higher One provides customized private label and OneCard banking relationships to higher education institutions. With an exclusive focus on higher education and an innovative approach to student financial services, the company’s solutions help university partners reduce administrative costs, streamline business processes, increase revenue opportunities, improve the student experience, and strengthen campus community.
The company is led by a team of executives with backgrounds in higher education, finance, banking, and entrepreneurship. Higher One’s customers represent a community of more than 100,000 students and include distinguished public and private institutions such as the first higher education institution to win the prestigious Malcolm Baldrige National Quality Award.
The National Association of Campus Card Users (NACCU) Annual Meeting is always a great event, but this year was special. The crowd was large, the education was fresh and strong, and the events and social activities were first class.
To express my appreciation and extend the praise that I heard from so many at the conference, I want to congratulate the association’s board of directors: Your San Antonio conference was a first-rate event that, in nearly every facet, surpassed previous NACCU events and rivaled any of the “larger” higher ed conferences I have attended in recent years.
Conference chairs, Cindy Vetter from the University of Northern Colorado and Dianna Norwood from Florida State University, did an amazing job. As well, the rest of the NACCU board deserves our thanks for their efforts during the conference and throughout the year. Thank you Shirley Everson, University of Minnesota, Jane Barrantes, Santa Clara University, John Beckwith, Loyola Marymount University, Art Gallagher, Johnston and Wales, Mark Kuchefski, Indiana University, and Kathleen Kelly, Carlton University. And certainly, the association’s staff-Kevin Pearcey and Pat Faulkinberry-was instrumental in making it all come together.
Orchestrating an event of this magnitude is no easy task. By my rough estimates, the NACCU team had to successfully coordinate more than 2000 meals, 1500 hotel room nights, and 100 hours of educational sessions and speakers. An event of this size likely means one-half million dollars in revenue for businesses in the host city and peripheral service providers. And remember that the conference chairs and the association board are volunteers-doing all this work on their own time after they have put in a full day on campus.
Several board members have concluded their term of service. To Cindy Vetter, Art Gallagher, and Mark Kuchefski we thank you for your dedicated service. Filling their ‘big shoes’ are Dale Witenhoefer, Arizona State University, Charles Giles, Sinclair Community College, and Gerald Inman, Rhode Island School of Design. Welcome and thank you for agreeing to take on this important role. Likewise, we welcome Lowell Adkins as NACCU’s new Executive Director.
For all those who benefit from NACCU or any other association, I remind you to not take for granted the volunteer boards. Too often it is a thankless job. When you have the opportunity, thank the board members for their service and let them know you appreciate their efforts. They do the job not for financial gain or praise, but simply to better the industry. Let them know that their efforts don’t go unnoticed.
Chris Corum
Editor
[email protected]
The Annual Conference of the National Association of Campus Card Users (NACCU) was a great event and a great opportunity to spot trends and changes in the campus card industry. In the following paragraphs, a number of these developments and observations from the event held early this month in San Antonio are highlighted. Look for more detailed review of many of these items in coming issues of CR80News.
Student Advantage is back
The President and CEO of Student Advantage, Ray Sozzi, succeeded in his efforts to buy back the company from the stockholders and is returning Student Advantage to its roots. The ‘new’ Student Advantage will refocus on its original product, a membership program targeted at students providing discounts at a nationwide network of merchants. In the past, it seemed that nearly every restaurant in a college town had Student Advantage window stickers announcing their participation in the program. But in recent years, the pressure of the public market and the drive to build more moved the company in a variety of other directions. The opportunity for campus card programs to offer Student Advantage memberships to students at the point of card issuance could provide a financial lift to cash-strapped card programs.
New payment system architecture from IDFunds(TM)
Campus card pioneer Bill Norwood’s company HDO Card Systems announced an innovative new payment product called IDFunds(TM). The product will enable a campus’ existing ISO number to be added to the global financial transaction networks, thus adding ATM and debit card functionality to card programs without the need to recard or enter a traditional bank partnership. IDFunds(TM) also enables funds to be segregated into separate accounts to enable specific transactions to pull from dedicated pools of money (e.g. dining account, bookstore account, open account).
Renewed bank interest in campus card programs
The renewed interest in bank partnerships was again evident at this year’s event with a number of institutions-including USBank, Wells Fargo, PNC, Wachovia, TCF, Penn Security, and HigherOne-all in attendance. USBank’s Whitney Bright gave a great presentation on how campuses should approach banking partnerships. Wells Fargo brought their big red bus to showcase the mobile training facilities and explain how the bus with a dozen wirelessly connected workstations can serve as an account enrollment facility during orientation or recarding events.
Riding this renewed wave of interest, the CR80News Team is excited to announce a new feature beginning in April - The Banking Corner sponsored by U.S. Bank. This informative, unbiased look at the world of card-related financial services is sure to become a reader-favorite.
Handhelds and wireless are hot topics
As we discussed in the February issue of CR80News, handheld devices are a hot topic on campus and were a major focus at the conference. Companies including Sequoia, Vision Database, Tokenworks, General Meters, and Blackboard all demonstrated their applications running on handheld computers or PDAs with integrated card readers. These devices are available to read magnetic stripes, barcodes, 2D barcodes, smart cards, proximity cards, and contactless smart cards. Biometric versions are also available. The ability to use these devices to collect and store data was showcased as was the ability to communicate directly with host systems using a campus’ wireless network.
Smart cards beginning to regain their footing
After several years of struggle, smart cards were once again a topic of conversation. Several companies including SmartCentric, ITC Systems, and Ingenico/Debitek showcased a range of new software applications and readers that rely on smart card technology. With the massive commitment of the federal government and many of its agencies to smart card technology, the technology is becoming more cost effective and the application suites more comprehensive.
Biometric access control is big
There was a great deal of discussion about biometric technologies, particularly as it relates to controlling access to recreation facilities on campus. A number of campuses-including Johnston and Wales, University of Georgia, and Emory University-described their experiences during a very strong panel discussion.
IP Addressable readers are hot
Everyone, it seemed, used the forum to showcase their IP addressable card readers. Blackboard, CBORD, and Diebold all described their TCP/IP communicating devices during their corporate presentation while a number of additional companies showcased the devices in the exhibit hall.
Wireless communications for security and access readers
A company called Wyreless Access showcased its ability to connect an access control reader to a security system via wireless communication. The relevance of this is the simplification of the installation process in locations that are not conducive to hardwiring. As an example, a parking gate controller connected via a Wyreless Access device can be hooked up to a system in just minutes-eliminating the need to dig a trench through the parking lot and disrupt the surrounding area.
Contactless technology replacing mag and prox for access control
Until very recently, magnetic stripes and proximity cards were the only real technologies used for access control on campuses. But several campuses have made the move to the more advanced contactless technology in recent months and several other major universities spoke of their pending implementations of the technology. Proximity card leader HID is leading the way into the next generation of access control technology with its iClass contactless cards and readers. Expect to see a solid number of iClass-enabled campuses by Fall of this year.
The Trinity University Tour Draws Largest Attendance in NACCU history
The NACCU conference, held in San Antonio, TX on March 12-17, included a tour to Trinity University enabling attendees to experience first-hand a robust installation of CBORD’s campus card solution. The tour pulled in a record number of attendees this year and was, by all accounts, an outstanding success.
Jerry Ferguson, Director Card Services for Trinity University, hosted the tour. Trinity staff got the opportunity to show off their campus and highlight their services to a large number of college & university administrators from across the globe.
The tour was broken into groups each led by members of the Trinity staff and accompanied by CBORD personnel. Throughout the tour, guests were given the opportunity to review the CBORD Odyssey PCS Campus-wide card system in all venues of the campus, including; dining, laundry, on-line vending, BEST door access, bookstore, Kinko’s Paw Prints Store running Pharos UnipriNT, JSA Technology’s WebVTS, the DataCard ID Works system, ValuePort stations, the Tigers Den Pub and the C3 convenience store. Tour guests also received a “Put your Paws on this” TigerBucks shirt compliments of Trinity University.
Trinity University is home to some 2700 students and is situated on more than 117 acres in San Antonio. Utilizing the CBORD Odyssey PCS system, Trinity students use their TigerBucks and TigerCub cards across the entire campus for all their daily account transaction needs.
Trinity converted to the CBORD system in June, 2000 and has continued to add functionality over the years. “CBORD has continued to provide us with exceptional technical support throughout our rapid growth process. The technical support staff is tenacious to the point of being unwilling to give up until a problem is solved to our satisfaction. They listen attentively to our needs and strive hard to meet them. We value the partnership with the CBORD group,” says Jerry Ferguson.
For more information on the CBORD Group, Inc., headquartered in Ithaca, New York, visit www.cbord.com or www.gotmycard.com .
A company called CardSmith is working toward a Fall 2004 launch of a new campus card offering. Though the company is new its management team is made up of campus card veterans. CardSmith’s Founder and CEO, Jay Summerall, helped lead both AT&T and Student Advantage in the campus card arena. Co-founder and VP of Product Development, Taran Lent, created an off-campus card program at Dartmouth in the mid-1990s. He continued these efforts by leading Student Advantage’s SACash development team after his company was acquired by Student Advantage in 1998.
Last year, Blackboard purchased the SACash product from Student Advantage. As a result, Mr. Summerall and Mr. Lent moved on to form CardSmith. Says Mr. Summerall, “because there was the change occurring with SA Cash, we had a choice to make. We decided to expand our scope and build a new kind of product targeted at an underserved segment of this marketplace.”
“We really believe in the campus card phenomenon,” he adds. “That it is a rare ‘everybody wins’ scenario. Our mission is to make it easier to afford, use and maintain so that the whole range of campuses can reap the benefits card programs bring to a campus.”
“Today,” says Mr. Lent, “there are literally thousands of campuses that have yet to deploy an effective card program. Many are too small or lack the resources to take advantage of current industry offerings. We plan to fill this void offering a product that requires no up-front capital investment and fits perfectly within institutions from 2,000 to 5,000 students.”
The CardSmith product
CardSmith will be offering a product that powers core campus card applications, with a focus-at least initially-on enabling students to conduct financial transactions on and around campus. The core of the product offering is a hosted authorization system that utilizes open standards-based technology to facilitate transactions at university-approved locations.
But unlike more traditional campus card payment solutions, CardSmith leverages the existing national payment infrastructure and processing networks to acquire and route transactions to its centrally-managed host processing system. In essence, the campus card payment will function with the sophistication of a traditional point-of-sale debit card-but with the university still in full control of the card.
Says Mr. Lent, “We are applying the efficiency of bank industry processing knowledge to campus card applications, while maintaining the unique characteristics of the traditional campus card.”
How do they do that? CardSmith’s software and servers will be housed at a major, secure transaction processing company and the company will route campus card transactions to that server in the same manner that bankcard transactions are pointed to individual cardholder banks for authorization.
“This fall, we will support multiple accounts associated with an individual card,” adds Mr. Lent. This can be accomplished because CardSmith has control of both the processing end and the merchant point-of-sale end of the solution. Based on the merchant terminal ID number, the processing server knows the specific account from which to access funds.
For example, imagine that a cardholder with card number 1111-2222-3333-4444 has funds in both an unlimited use account and a dedicated on-campus meal account. When the card is used at the on-campus pizza parlor, the pizza vendors terminal ID is sent along with transaction to the server. The server looks up the terminal ID and sees that the merchant is an on-campus food vendor and defaults to use funds from the on-campus meal account. If the cardholder has no on-campus meal account or there are no funds in the account, the funds are accessed from the unlimited use account. Transactions can be “split-tender” or paid partially from one account and partially from another automatically.
“We will also support point-based meal plans and board plans as well as time-of-day and merchant location discounting,” says Mr. Lent. This, too, is accomplished by setting a priority ordering for the account to be used for a specific transaction originating at a specific merchant terminal. If a cardholder has a board plan, use that first at the campus dining hall but don’t access this account at an off-campus retailer. And to enable total student control of these accounts, this default order can be overridden at the merchant terminal at the request of the cardholder.
“A real benefit of the system,” says Mr. Summerall, “is that we have been able to leapfrog technologically. We are using IP-addressable terminals, 802.11 B wireless capability, and SSL encryption.” Existing campus card vendors are working to catch up with emerging technology and standards, he added, while CardSmith is building upon them.
Total Program Management
The CardSmith service bundle is called Total Program Management (TPM). “We have designed the service to be fully outsourced,” says Mr. Summerall. “We handle everything. What should my card look like? How do my accounts interact? How do I market the program?”
Additionally, all aspects of the transaction are handled for the client institution. CardSmith will setup, deploy, and support the terminals; process transactions; settle between campus and merchant accounts; and provide reporting to each party along the way. They also provide a full-featured cardholder website to enable account management and revalue.
Paying for the system
“Our goal,” says Mr. Summerall, “is to make it easier for campuses to get into the business. In essence, we offer a no money down situation. You need no servers on campus, no technical support, and there is no software licensing for our program.”
The company will charge a fee for the management services, Mr. Summerall says, based on the number of students and number of transactions. He adds that the lack of capital expense for servers, hardware, and software will make the system far less expensive both initially and over time. “On an all-in basis we are going to be dramatically less expensive. We expect our solution will be 50% of the cost of current systems and card program operations.”
The company plans to target an unspecified number of campuses in the Northeast U.S. for Fall 2004 installations. Though he is quick to stress that the system works equally well for both large and small institutions, Mr. Lent notes that, “initially we are focused on the 2,000-5,000 student institutions.” He adds, “there are a lot of smaller private schools in the Northeast region that are not served by card systems from bigger vendors. Often they lack the headcount to warrant buying a whole system and running it on their own.”
Both Mr. Summerall and Mr. Lent concur, “we want to get a handful of customers for this first year, show them how well the system and our service operates, and then build from there.” Certainly, they have the experience to do just that. We look forward to keeping tabs on the initial installations of this new campus card innovator.
To learn more, visit www.Card-Smith.com or contact Jay Summerall at [email protected] or Taran Lent at [email protected].
Relatively young, as card programs go, East Stroudsburg University’s eCard began just four years ago. The small four-year Pennsylvania school located in the Pocono Mountains was using a photo ID card that included the Social Security Number, a rising cause for concern in today’s ID-theft-prone world.
In March 2000, the 6,200-student university recarded the campus, said the university’s director of the Campus Card Center, Bob Smith. What ESU installed was General Meters’ University One Card System, “General Meters had the most expansive and all-inclusive system of the ones we looked at,” he said.
General Meters, headquartered in Colorado Springs, Colorado has been in business since 1979 and developed its One Card System in 1981. The first school to make use of it was Utah’s Brigham Young University’s law library, said Mr. Zander. The company currently services 350 universities in the U.S., Canada and Europe, he added, including Canada’s largest college, the University of Waterloo at Ontario.
“We have clients with as few as 1,000 students all the way up to 250,000 students for universities with multiple campuses,” he said. “We do campuses with 90,000 students, some in Canada, some here. They didn’t start that way, but as their campuses grew they only paid for the modules they were using.” He said a single module can cost anywhere from $ 6,000 to $50,000 depending on the number of students.
This ability to grow, without having to pay for something you’re not using, meant an ideal situation for a small college like ESU. In addition, only about a third of ESU’s students live on campus. The rest commute.
ESU’s eCard, with a picture of the student overlaid against an aerial view of the university, is used for residence hall access to perimeter doors. The card is also used for meals, vending, campus bookstore, and laundry payments.
The card is also used in the library to check out books, use copiers or laser printers, and pay fines. Since the students have to have their eCard to pay for printer or copier use it cut down on paper waste. “Some students were printing 100 pages and throwing away 98,” said Mr. Smith.
Students are, or soon will be, billed for their telephone and cable television bills through their eCard, he said.
Each student who buys a meal plan also receives about $100 of what Mr. Smith calls “play money” that students can use to buy food at any of the campus’s four eating establishments.
“We’re doing the university in steps,” he said. “We started in 2000 with two (of nine) residence halls with laundry and vending, then a month or two later, we added another building. Two years ago we added the parking gate,” he said. “A lot of the students were parking in the faculty or staff lots, so we felt the need for the gate.” Parking at ESU is first-come parking for juniors and seniors who are issued hang-tag parking permits. “We don’t allow freshmen or sophomores to bring their cars to campus unless they have a medical condition, are over 21, or have earned 30 credit hours.”
When the University One system was first installed, “we had a few bumps and grinds at the beginning because every building is different. The first year was rough, we had a lot of problems with certain building accesses and vending, but General Meters was excellent in tech support. I can’t say enough about them. If we can’t figure out the problem over the phone, they’ll send someone out.”
If the card is lost or stolen, it can be easily locked out, as long as the university knows about it. Otherwise, like with credit cards, the student is only liable for $50, said Mr. Smith.
Students with lost cards are issued a temporary one which costs $15 and allows them access to their dorms and meals. The $15 is returned to the student if the card is found, or it’s good for a new card if the lost one never turns up, said Mr. Smith.
While the General Meters’ system has the capability of allowing the card to be used off campus, Mr. Smith said ESU has no plans to do so. Right now, he added, there is only one location (away from the main office) for the card to be reloaded-an automatic deposit machine in the library. “We’re thinking about adding another in the University Center,” added Mr. Smith.
“At the deposit machine, cash or credit cards can be used. At our office we also accept checks. While we do not have an Internet option for card reloading, parents can call and add money via a credit card,” he said. “We felt there was a security issue with going online,” he said.
Mr. Zander said General Meters does have a “web module” available “that will clear credit cards for remote deposits into the One Card system.”
“We went to the card in the first place for the convenience of the students,” said Mr. Smith. “That means fewer keys. All of our employees also have eCards.”
A new addition to the campus is the $10 million recreation center that opened last August. The card is swiped at a turnstile, granting the student access.In the works is a 100,000 square-foot science and technology building which will add new challenges for the eCard. “Currently, we have 130 points of access on our entire campus,” said Mr. Smith. “This one building will have 100 points of access, all available by the eCard.”
But Mr. Smith is already planning for an expansion of his department. He’s looking for more computers and more staff. Currently he has himself, one full-time assistant and five work study students who each put in 10 hours a week.
During the summer ESU hosts several conferences/camps, such as soccer, bagpipes, band camp, and wrestling, all involving various age groups. “We can have 2,000 or 3,000 people on campus at one time,” said Mr. Smith. “All the conference attendees get a non-photo ID card that includes a meal plan so our foodservice provider, Aramark, can track how many meals each camp uses.”
Next up? ESU intends to upgrade their point-of-sale terminals with the new stealth touch screens from General Meters. “Right now we have a 140-key keyboard,” says Mr. Smith. “We’ll add five POS terminals and get rid of the keyboards in the food establishments.” And it seems that ESU’s commitment to General Meters is quite strong. According to Mr. Smith, the university is in the process of signing another five-year contract with General Meters.
Florida has become the latest state attempting to severely limit the use of social security numbers on college campuses. The state’s Legislature, in session until the end of April, has bills pending in the House and Senate. Both bills are moving rapidly and are likely to pass. In addition, Gov. Jeb Bush, given his history of privacy concerns and the fact that one of his task forces several years ago recommended limited use of social security numbers, is likely to sign the bill if it reaches his desk.
The bill would prohibit state universities or community colleges from using a student’s social security number to identify a student, except for purposes of employment, financial aid, research, assessment, accountability, transcripts, or as otherwise required by state or federal law. In addition, the bill prohibits displaying a student’s social security number, printing a student’s social security number on any identification document issued by the institution-including the campus ID card, or requiring a student to use his or her social security number on the Internet unless sufficient security precautions are used.
It also requires each state university or community college to develop a plan for implementation by July 1, 2005. This plan must include provisions for educating staff on the proper uses of social security numbers. An affected student may petition a circuit court for an order directing a university or community college cease the improper use of a social security number or to implement a plan to prevent the improper use of a social security number.
The state already has a law exempting documents held by a state agency from the state’s liberal public records law.
According to a staff analysis of the bill, the University of Florida, the University of North Florida and Florida International University have begun moving away from their reliance on social security numbers. The University of Florida reported it took more than a year to implement the change-over to an eight-digit number and cost the university $5 million. The Department of Education estimates it could cost each of Florida’s 28 community colleges $100,000 to $250,000 to comply with the proposed law.
The same analysis points out that Arizona requires universities to assign an identification number to a student that is not the SSN, while Virginia forbids the use of the SSN on a student’s identification card and West Virginia has banned the public display of the SSN. Washington, New York, and Illinois all have laws similar to what Florida legislators are trying to pass.
What imaging/card production software do you recommend to your clients and what card printers?
Chris Rizetto, Director-Higher Ed, Vision Database Systems
We recommend our RapIDcard line of products. Typically for colleges or universities we recommend either our IDMS (ID Management System), or Pro versions because of their flexibility and integration capabilities with other campus systems such as SIS, an existing card system, meal plan, library, etc. Also, our software is able to use most cameras and printer brands.
We are a “one stop shop” and offer all ID card components including choice of most printer brands/types. Recommendations are based solely on client needs and requirements.
Mark Reinart, Mgr, Marketing & Business Development, Diebold
Diebold sells the DataCard ID Works solution with an easy to use seamless interface to CS Gold. CS CardLink makes the ID badging process fast and efficient.
Diebold offers a wide range of ID badge printers. The most popular models currently are the DataCard Select and Magna series of quality printers.
Jeff Zander, General Meters Corporation, Vice President
General Meters has designed GMCID software (aka: ID32) which allows images to be sent/shared across the campus network, prints photo seating charts and semester validations and most importantly, permits the ID database to integrate with the OneCard (debit/access/meal plan) database so captured images can be viewed from within any card holder record and at all Administrative Terminals.
We use primarily Fargo printers however, we are able to work with virtually every ID card printer manufactured in the US, Canada and Europe.
Do you recommend that campuses have their cards pre-printed at the manufacturer or elsewhere or do you suggest that they start with blank white card stock and use their on-site card imaging systems for all elements?
Chris Rizetto, Director-Higher Ed, Vision Database Systems
It varies from client to client and the equipment they want to purchase and/or currently use. Usually we recommend back pre-printing with static data when a client does not desire to put personal data/barcode on the back of the card or buy a printer with duplex capabilities. For card fronts we have clients who pre-print, but most clients are opting for blank white fronts so they can issue a variety of card designs for visual identification. This is accomplished automatically though our RapIDcard software.
Mark Reinart, Mgr, Marketing & Business Development, Diebold
This depends on the complexity of the artwork, the amount of control and resulting quality the institution wants during the card production.
Pre-printed quality will be better with regard to the color separation and resolution of a 4-color process from a manufacturer’s printing press. Dye sublimation card printers are limited to a 300 dpi printing capability and therefore excellent for spot color printing solutions.
Spot color printing can easily be done on site at the campus, with excellent results and a relatively low cost.
The ROI from an on-site printer station can be seen in a relatively short amount of time when large quantities of cards are being printed.
Jeff Zander, General Meters Corporation, Vice President
Many General Meters clients enjoy the flexibility, myriad of card designs and low cost of producing their own card art with the easy to use interface found in our ID32 software. Since the same amount of printer ribbon is used when printing the text, id photo and/or card art background - designing and printing cards ‘in house’ has become more popular (than preprinting). Couple this with not having to wait 2-4 weeks for your cards (from an outside graphics shop), paying less than .35¢ per card in most cases, and the better quality of printers … and printing cards in house is here to stay.
In the February issue of SecureIDNews, part one of our series on biometric technology concepts was presented. In this second part review, key concepts are described building upon those presented prior.
As you may recall, biometrics are numeric representations of physical characteristics that enable identification or verification of the individual possessing the characteristic. Biometrics can be physical or behavioral. Physical biometrics focus on an individual's physical attributes such as fingerprints, hand geometry, and iris or retinal patterns. Behavioral biometrics measure an individual's actions such as the manner of walking (referred to as gate) or the way he or she types at a keyboard.
There are two key stages to a biometric system: enrollment and presentment. At enrollment, the individual presents the item or action to be measured to the measuring device or scanner. The device conducts the scan and the software generates a numeric representation of the image based on set algorithms. Using a fingerprint as an example, the person places the finger on the scanner. The scanner takes one or more readings of the fingerprint pattern and applies the system's specific algorithmic settings to it. A numeric string is created based upon the specific fingerprint pattern and this number is stored as the biometric template.
At presentment, the previously enrolled individual presents the item (e.g. the finger) again. This time the purpose is not to enroll the individual into the system but rather to verify that the person is who they claim to be or identify the person from a pool of individuals. Continuing the previous example of the fingerprint scan, the individual places the finger on the scanner and the same algorithm is applied to the scanned print. The resulting numeric template is compared to the enrolled template and, if they match, access is granted.
A key concept of, and major difference between, biometric systems involves the storage of the enrolled template. To function, the enrolled biometric template must be available for comparison against the newly presented fingerprint and resultant template. But where will the system store the enrolled template? While there are many possible points of storage, the real question boils down to this: "should the template be kept on the system or in the possession of the individual?"
Commonly the terms "storage on reader, panel, or system" is used when the enrolled template is housed on the system and "storage on card" when the template is kept in the possession of the individual (e.g. on a smart card).
While this might seem like an insignificant difference, it is at the root of many of the anti-biometric privacy opposition arguments. If the template is in the possession of the system it is, by default, outside of the absolute control of the individual. This has been a cause for significant concern among privacy advocates. If the template is housed only on a card that remains in the possession of the individual, this concern is alleviated.
For a biometric system to function, a presented template must be compared to an enrolled template or a database of enrolled templates. Just as the location of the template's storage is an important differentiator of biometric systems, so too is the location for this comparison or matching process.
A biometric match can be conducted in the same two basic areas as template storage: on the system or on the card. The key here again is the location of the individual's biometric template. If the match operation is performed on the system (e.g. at the reader, at the panel) it is, by definition outside of the absolute control of the individual. Thus, many systems are designed to perform the match operation on the card itself, using the processing capability of the smart card. In this scenario, the actual enrolled biometric never leaves the card and thus is at a lesser risk for compromise.
The most secure and most privacy-protecting architecture includes storage of the enrolled biometric template on the card as well as matching of the enrolled and presented biometrics on the card.
As nearly every biometric industry representative will attest, it is impossible to ‘reverse engineer' the actual physical or behavioral characteristic from a biometric template. Using our fingerprint example, the scanned finger is mathematically summarized into a series of digits based on certain key points in that fingerprint image. Someone possessing the string of digits could not recreate the fingerprint even if they had access to the formulas used as only bits and pieces of the finger are incorporated.
It is analogous to describing a person's physical appearance. The man is 6 feet tall, he has brown eyes, and black hair. He has a birthmark on his right ear and small scar above his left eye. While this description can be used to identify a person (at least to a point), it would in no way enable an accurate recreation of the person or his likeness.
Thus, the need for storage and matching of the biometric on the card for reasons of privacy protection is likely overemphasized. It can be, however, the best architecture for certain applications and environments. And if the people perceive that there is a risk, this perception is difficult to counter. It seems that both in biometric measurement and in the public view of biometric technology, perception is reality.
