Card, mobile credential, payment and security
While Harvard’s new contactless student ID cards get high marks for the university’s forward thinking, the school’s student newspaper, The Harvard Crimson, panned the cards for creating a high frustration level. The reason? It’s hard to find the “sweet spot” on the reader that opens doors.
In addition, it was thought students would be able to open doors without removing the card from their wallets. That has led to “a great deal of pelvic thrusting” to get the card to work, notes this Crimson opinion piece.
Freiker Inc., a bike-to-school program based in Boulder, Colo., received a grant from Trek Bicycle Corporation to help fund its Frequent Biker program among area elementary schools.
The program was founded to encourage children to ride bikes to and from school by tracking their progress and rewarding them based on the number of times they rode their bikes to school. Rides are tracked using RFID tags mounted to the riders bike helmets and are read by RFID sensors placed near the school grounds. Their progress is wirelessly uploaded to the Freiker Web site, where participants can go to track progress towards their riding goals.
The program has been implemented at five Boulder area schools and has expanded to Madison, Wis. and Bend, Ore. In addition to promoting exercise among children, it also encourages safety, since the tags must be adhered to bike helmets in order to be registered in the program.
Saint James, N.Y.-based IDetect has released a new age verification scanner ideal for use on college campuses. The portable, ruggedized IDetect LITE ID Scanner can also scan driver licenses and corporate IDs.
While it can scan 3D bar codes and magnetic stripe IDs, if the license or ID can’t be scanned, IDetect will take a picture of the license which can help bar owners or liquor store operators avoid fines or license revocations.
Automatically upon an identification scan, the entrant’s picture is taken and saved with entry information. The picture can be used to locate any individual in seconds. IDetect’s exclusive license picture function also takes a picture of an ID that is not able to be scanned.
This feature, coupled with the automatic picture of the entrant, and the IDetect ID scanner’s time and date stamp history feature, is a strong defense and proof of diligence against fines and state authority investigations. IDetect’s License Scanners also flag an ID that is fake, tampered with, shared with another entrant, or banned for any reason, all in less than a second.
IDetect ID Validation Systems have been utilized for more than 15 years in night clubs, universities, casinos, military bases, office buildings, rental car agencies, festivals, banks and liquor stores throughout the United States, Canada and Mexico.
Previously offline access systems move closer to online via virtual networks and WiFi
By Chris Corum, Executive Editor
Controlling access to buildings and dorms is an essential component of campus safety, but administrators face a constant struggle to balance security and cost. Standalone electric door locks offer a compromise that can deliver solid security at an affordable cost. In recent years, advances in these un-wired solutions have improved the functionality moving them closer to their wired counterparts.
For more than a decade, campuses have deployed ‘hotel-style,’ card reading locks on interior dorm, lab and office doors. Electronic key codes encoded in the ID card’s magnetic stripe controlled access to an approved door or grouping of doors.
In early implementations, most were standalone systems that required keyholder data to be loaded manually into a dedicated database. Over the years, providers worked to integrate the offline lock program into the broader campus security, housing and card systems.
Still, however, the un-wired attribute that made them desirable also left them vulnerable. The ability to change keys, cancel lost and stolen cards, or lock out an existing cardholder was cumbersome and often required personnel to physically visit each lock.
But all this is changing. Two different approaches are changing the way these standalone lock systems are deployed, and each is advancing the power of the product.
The first approach relies on the intelligence and storage capabilities of a contact or contactless smart card to create a virtual network among the offline readers. The second approach puts these standalone locks online via wireless networking.
The card as the network
In the case of the card-enabled or card-connected networks, the ID credential itself serves as a virtual network updating the standalone locks with important information, such as individual usage history, newly cancelled card lists, and more.
Corestreet offers a card-connected solution that relies on contact or contactless smart cards and cryptographic keys to create a highly secure virtual network within an installation of standalone locks (see Card-connected access control, Re:ID Magazine, Summer 2008).
Other companies also rely on the card to transfer and spread key transaction and system data.
Chuck Hummitsch, regional business manager for Salto Systems, a Spanish company with U.S. headquarters in Atlanta, calls his company’s locking solution a “hybrid product that gives you ease of installation but the flexibility of a hard wired system.”
“Our locks are networked, stand-alone locks in which the main component of the network is the credential you’re carrying,” Hummitsch says. In Salto’s case, the credential is a standard contactless card, keyfob, sticker, wristband, cell phone or any other object into which a chip can be embedded. When you go to the lock, it actually talks back to the contactless card, and the card records information about the transaction, making the credential a two-way data transporter, he adds.
Instead of each door being wired to the network, so-called “hot-spots” are used to refresh the card information. Hot-spots look different. They’re basically wall readers situated in main access areas since they also work as time and attendance devices. “We recommend installing the hot-spots in high traffic areas such as parking entrances, main entrances and elevators,” says Hummitsch.
When you enter your parking lot, the hot-spot reader may be at the parking gate or the main entrance. When you present your card, your access privileges are updated and all your previous access history is also updated and transferred back to a main computer that generates up-to-date audit-trails,” says Hummitsch.
Not every door is a hot spot. Your office door may not be. But if you somehow bypassed the hot spot door on your way in, you may be unable to gain access to your office because the system won’t recognize that you’re there legitimately.
“It’s up to the end user as to how many hotspots are installed,” says Hummitsch. “A university will put them in places where there is consistent traffic flow.”
In cases of lost or stolen cards, once reported, that person’s card is locked out and immediately the hot-spots begin spreading the “cancel card message” to each and every one of the other users’ cards that are presented when accessing the premises. This is how the message is spread and that is why all main entrances and detrimental access areas require hot-spots.
The University of Hawaii, Hilo, which recently installed Salto’s offline door locks at its new recreation center, has 10 online hotspots. “The rest of the interior doors, probably 30 to 50 locks, are offline,” says Hummitsch. “We’re getting ready to do its pharmacy building which is going with another 10 hotspots and 80 interior door locks.”
One of the added benefits to the Salto system is that distance does not matter. “Let’s say you have a remote building, such as the University of Hawaii’s astronomy building which is on top of a mountain, put a standalone lock on the door and it can still be read,” says Hummitsch.
But these card-connected systems are not without drawbacks. Most of the current offerings rely on a contact or contactless smart card to power the virtual network. If the card is not already deployed on the campus, the added cost could negate the savings of the un-wired access control system.
“You are getting the ability to carry the authorization and maybe bring back some audit trail, but you lack the ability to get an alarm back from the door,” explains Bret Tobey, Intelligent Openings Business Development and Product Manager, Assa Abloy.
“Add a few hundred dollars and you can get the alarm back,” he adds, referring to the addition of wireless communication to the standalone lock.
WiFi replaces wires for standalone locks
The second new approach relies on the proliferation of wireless networks on campus to enable management of standalone locks in near real-time.
“One of the key advancements involves taking lock systems online via wireless,” says Dan Gretz, senior director of marketing at Blackboard. “Our clients appreciate the ability to deploy wireless locks much faster and maintain connectivity and control remotely.”
“This is a big trend and focus with our campuses,” says Taran Lent of campus card provider Cardsmith. “Schools want the best security solutions available and are not as concerned with saving money in this area. Schools want proven security solutions that are also leveraging new technology.”
Cardsmith has partnered with Ingersoll Rand to provide locking systems to the universities serviced by the campus card provider.
“Many of our clients were choosing Ingersoll based on their own research. Ingersoll has innovated and holds patents on wireless door locks,” says Cardsmith’s Lent. “IR uses online locks where it makes sense, offline where it makes sense.”
With main exterior doors it will be a wired or wireless lock but online and actively communicating with the system. Individual doors like dorm rooms would be offline, says Lent.
Blackboard’s Gretz reports, “Blackboard’s offering features Blackboard Wireless Door Access by Ingersoll Rand, and we also offer integration support for Persona, Best and Onity.”
Like the card-enabled locks described previously, wireless locks have some shortcomings as well. Wireless communication, and thus system operation, can be disrupted by normal or malicious causes. Power consumption for wireless operation is larger than for other standalone locks, so battery life is limited.
A comprehensive approach to security planning
“Because we have so many types of companies, we try to look at it as a mix and match to pick the best products and communication modes for the specific installation,” says Assa Abloy’s Tobey. The company owns numerous lock and security manufacturers including household names like Sargent and Yale.
“Customers don’t pick online or offline,” he states. “They mix the two and they look at how much they want to spend per opening … weighing that against what they need to get done.”
“I would never use a (wireless) radio on an exterior door,” he explains stressing that these locations should be hard wired to the security system. “In the lab or lounge inside, you may want a (wireless) radio lock, then at the residence hall doors you may want to go standalone without a radio. It depends on the unique needs of the campus and even the building.”
Campuses need to ask the questions:
“We often see systems from 5, 6, or 7 companies on a single campus,” says Tobey. “I don’t see this going away.”
Sargent and Persona have announced a new physical access control system for college campuses. The SARGENT Passport 1000 lockset, available in offline and WiFi-enabled versions, is an electronic locking system that operates with PERSONA Campus software.
The Grade 1 lock utilizes magnetic stripe and PIN code technologies for dual validation that can be customized to each facility. This lock and software combination integrates into a One Card solution system providing access control for campus housing and facilities.
The PERSONA Campus 1000 software works with most existing magnetic stripe card systems and imports student or personnel information without duplicating existing databases. Administrators can encode key cards with the Conference Guest Wizard feature.
The Passport 1000 PG offline version provides stand-alone access control without wiring. Data transfer between the lock and PC is accomplished through LockLink PDA. The PG accommodates up to 1,200 users per door and a 700-event transaction trail.
The Passport 1000 P2 version features WiFi technology that enables the lock to connect wirelessly into an access control system. The P2 can operate indefinitely without any wireless connection to a host server or access control panel.
Okanagan College in British Columbia has become the third college in Canada to choose SALTO Systems to provide a contactless electronic access control solution. The first building to roll out the system will be the new $28 million Centre for Learning, a jointly funded project between the provincial government and the college. The facility, which is under construction, will add 22 classrooms to the campus and will be used to provide training for a wide variety of careers.
“The College, which is home to 5,000 students, chose SALTO for its flexibility and the fact that our access control would not have to be hard-wired to every door. Our ANSI stand-alone locks require no wires and are able to communicate with the SALTO software via hotspot wall readers just through normal card use,” says Amir Zouak, vice president of SALTO Systems in Canada.
SALTO will be providing a mix of perimeter and internal locking systems across campus, replacing the majority of mechanical locks in all the existing college buildings and facilities over the next several years.
The eventual goal is interoperability, but issuing the card and adding functionality is first
By Andy Williams, Contributing Editor
In the past 18 months, two companies have issued more than one million dual-interface smart card IDs to students of 450 universities, colleges and high schools. Interoperability of the applications between the different institutions hasn’t happened yet but it may be on the horizon.
The Polish government thought a smart card student ID system could enable interoperability between universities and make it easier to identify students.
“Universities dream about interoperability, but they approach it carefully,” says Jacek Blahut, IT systems director responsible for development and sales of card-based systems at OPTeam, the Rzeszów, Poland company responsible for the student ID card deployment. “They make small steps, like one university makes its library available to students from other universities in the city using their student card as a library ID. It requires some decisions, setting up some procedures and integrating several library and campus card systems, but they can do it, with our help.”
According to Blahut, OPTeam specializes in implementing card-based systems for financial institutions, corporations, retailers, universities and governments. Its university campus card system goes by OPTIcamp. “We have been dealing with smart card technology since 1996 and we implemented the first campus card system in Poland in 1999,” says Blahut.
While a smart card student ID system is not mandatory, the Polish government recommends it, says Blahut. “A paper ID is still valid and some universities issue paper student IDs instead of a smart card,” he says. “The important fact is that the new card entitles its users to discounts in public transportation. That is why universities wanted one card only, for both campus purposes and a nationwide student ID recognized in public transportation.”
Prior to the introduction of the smart student ID card, students had to use two documents, a paper student ID that is useable in public transit, and a smart card used only in campus card systems, he says.
OPTeam is a value-added reseller of Gemalto, which provided the cards. OPTeam then personalized the cards for the colleges and schools. Large-scale deployment started last fall.
“About 80 universities use our campus card system,” says Blahut. “There are 1.9 million students in Poland and we have delivered one million student cards to universities. We are now in the process of implementing four more campus card systems, which are supposed to start at the end of September and we are negotiating with several more. And those systems already implemented will continue to evolve by adding new functions and services.”
OPTeam’s campus card solution provides the student card personalization. “We also set up the whole personalization system (software, hardware, procedures) in the university. Most universities built their own personalization centers. Some small universities use personalization centers of other universities,” says Blahut.
He says new functions are gradually being added to the student ID cards. “Universities build functionality of their campus card systems separately, but we are now starting several projects in which certain functions available at one university will be offered to students at other universities, like libraries or bike rental systems.
While many of the cards do include electronic purses, they are not bank cards, Blahut emphasizes. That’s because the cards don’t match the requirement of payment organizations like Visa or MasterCard. “Some universities use student cards for building local e-purse systems, such as payment for prints and photocopies, vending machines and other items.”
Some universities are incorporating digital signature applications into their student cards. “Universities usually set up their own certificate authority systems and use the digital certificate internally for logging in to workstations or integrating it with their back office systems,” Blahut says.
The digital signature can also enable students to electronically sign documents, sparing them the hassle of having to go to a university office to handle paperwork. With the authentication capability, students can also gain access to specific documents on the university’s computers and to the information kiosk, which provides course details.
In addition, Poland’s national ID card is supposed to include a digital signature. “So the question is where to put my digital signature, on my student card or on my national ID,” says Blahut. “Tests using a student card as a carrier of a common digital certificate are underway we should know the best solution in several months.”
All cards supplied to the universities are hybrid, dual interface cards capable of both contact and contactless transactions, says Blahut. “The contactless part of the card is used for door access mostly, but there are projects starting now where it is also used for identification in a library and for a local e-purse,” he says.
“In some cities, such as Warsaw, Krakow, Gdansk, Poznan and Lublin, public transport tickets are stored in the contactless part of the card. These electronic ticketing systems are different in all these cities so if you are studying in Warsaw and your card is working within the Warsaw electronic ticketing system, you can’t use it in any other city,” adds Blahut. “But all universities located in any of these cities – for example, there are about 10 universities in Lublin and dozens in Warsaw – may issue student cards, which can be used as carriers of electronic tickets in a given city.”
Choosing a vendor
The universities choose Gemalto because they best product available for the job. The specs were routine, such as meeting ISO 7816 requirements, says Blahut. “Gemalto offered a sophisticated hybrid card, a Java based GemXpresso card, with cryptographic applets and an additional contactless Mifare chip, with a price which was not available from other manufacturers,” he adds.
