SECURITY SYSTEM, RFID, SMART CARD, ACCESS CARD, EMPLOYEE CARDS, SECURITY AND BILLING TAGS, DELHI - INDIA
|
Home | Request Info. | SiteMap
|
||||||||||||||||||||
|
||||||||||||||||||||
RFID, Smart Card, Bio-Metric Security Systems |
||||||||||||||||||||
|
|
|||||||||||||||||||
|
||||||||||||||||||||
|
||||||||||||||||||||
|
RFID, Smart Card, Bio-Metric Security System Company in Delhi, India |
||||||||||||||||||||
|
||||||||||||||||||||

RFID (Radio Frequency Identification ) SYSTEM
Low-frequency:
From 30 kHz to 300 kHz. Low-frequency tags typical operate at 125 kHz or 134
kHz. The main disadvantages of low-frequency tags are they have to be read from
within three feet and the rate of data transfer is slow. But they are less
subject to interference than UHF tags.
Ultra-high frequency:
From 300 MHz to 3 GHz. Typically, RFID tags that operate between 866 MHz to 960
MHz. They can send information faster and farther than high- and low-frequency
tags. But radio waves don’t pass through items with high water content, such as
fruit, at these frequencies.
Reader:
A device used to communicate with RFID tags. The reader has one or more
antennas, which emit radio waves and receive signals back from the tag. The
reader is also sometimes called an interrogator because it "interrogates" the
tag.
Antenna:
The tag antenna is the conductive element that enables the tag to send and
receive data. Passive, low- (135 kHz) and high-frequency (13.56 MHz) tags
usually have a coiled antenna that couples with the coiled antenna of the reader
to form a magnetic field. UHF tag antennas can be a variety of shapes. Readers
also have antennas which are used to emit radio waves. The RF energy from the
reader antenna is "harvested" by the antenna and used to power up the microchip,
which then changes the electrical load on the antenna to reflect back its own
signals.
High-frequency:
This is generally considered to be from 3 MHz to 30 MHz. HF RFID tags typically
operate at 13.56 MHz. They can be read from less than 3 feet away and transmit
data faster than low-frequency tags. But they consume more power than
low-frequency tags.
RFID tag:
A microchip attached to an antenna that is packaged in a way that it can be
applied to an object. The tag picks up signals from and sends signals to a
reader. The tag contains a unique serial number, but may have other information,
such as a customers' account number. Tags come in many forms, such smart labels
that can have a barcode printed on it, or the tag can simply be mounted inside a
carton or embedded in plastic. RFID tags can be active, passive or semi-passive.
Transponder:
A radio transmitter-receiver that is activated when it receives a predetermined
signal. RFID transponders come in many forms, including smart labels, simple
tags, smart cards(Smart cards:A credit card or other kind of card with an
embedded microchip. When the card uses RFID technology to send and receive data
it is called a contactless smart card. ) and keychain fobs. RFID tags are
sometimes referred to as transponders.
The transponders can be read(Read:The process of retrieving data stored on an
RFID tag by sending radio waves to the tag and converting the waves the tag
sends back into data.)/write (depending on the chip used), which allows
information about the contents of the crate or pallet to be written to the
transponder. Lindström says the transponders can cost less than $1, depending on
the volume, form factor, chip and other factors. Since the containers might go
through seven or more turns a year and last five year or more, the price per use
will likely be no more than a few pennies. Form factor: The packaging a
transponder can be put in. These include thermal transfer labels, plastic cards,
key fobs and so on.
Read range:
The distance from which a reader can communicate with a tag. Active tags have a
longer read range than passive tags because they use their own power source
(usually a battery) to transmit signals to the reader. With passive tags, the
read range is influenced by frequency, reader output power, antenna design, and
method of powering up the tag. Low-frequency tags use inductive coupling, which
requires the tag to be within a few feet of the reader.
**********************************
Active tag:
An RFID tag that has a transmitter to send back information, rather than
reflecting back a signal from the reader, as a passive tag does. Most active
tags use a battery to transmit a signal to a reader. However, some tags can
gather energy from other sources. Active tags can be read from 300 feet (100
meters) or more, but they're expensive (typically more than US$20 each). They're
used for tracking expensive items over long ranges. For instance, the U.S.
military uses active tags to track containers of supplies arriving in ports.
Passive tag:
An RFID tag without its own power source and transmitter. When radio waves from
the reader reach the chip’s antenna, the energy is converted by the antenna into
electricity that can power up the microchip in the tag. The tag is able to send
back information stored on the chip. Today, simple passive tags cost from U.S.
20 cents to several dollars, depending on the amount of memory on the tag,
packaging and other features.
Automatic Identification:
A broad term that covers methods of collecting data and entering it directly
into computer systems without human involvement. Technologies normally
considered part of auto-ID include bar codes, biometrics, RFID and voice
recognition.
Automatic identification and data capture:
A broad term that covers methods of identifying objects, capturing information
about them and entering it directly into computer systems without human
involvement. Technologies normally considered part of auto-ID include bar codes,
biometrics, RFID and voice recognition.
Bar code:
A standard method of identifying the manufacturer and product category of a
particular item. The bar code was adopted in the 1970s because the bars were
easier for machines to read than optical characters. The main drawbacks of bar
codes main are they don’t, in most cases, identify unique items and scanners
have to have line of sight to read them.
Capacitor:
An electric circuit element used to store a charge temporarily. A capacitor
usually consists of two metallic plates separated and insulated from each other
by a dielectric substance.
Chipless RFID tag:
An RFID tag that doesn't depend on a silicon microchip. Some chipless tags use
plastic or conductive polymers instead of silicon-based microchips. Other
chipless tags use materials that reflect back a portion of the radio waves
beamed at them. A computer takes a snapshot of the waves beamed back and uses it
like a fingerprint to identify the object with the tag. Companies are
experimenting with embedding RF reflecting fibers in paper to prevent
unauthorized photocopying of certain documents. Chipless tags that use embedded
fibers have one drawback for supply chain uses—only one tag can be read at a
time.
Data carrier:
A medium that holds machine-readable data. Bar codes and RFID tags are types of
data carriers. The term is also applied to a carrier frequency used to transmit
data.
Data field:
An area of memory in RFID microchips that is assigned to a particular type of
information. Data fields may be protected (see below) or they may be written
over, so a data field might contain information about where an item should be
sent. When the destination changes, the new information is written to the data
field.
Data field protection:
The ability to prevent data stored in a specific area of memory of an RFID
microchip from being overwritten. Companies might want to protect the data field
that stores an Electronic Product Code(A serial, created by the Auto-ID Center,
which will complement barcodes. The EPC has digits to identify the manufacturer,
product category and the individual item.), which doesn't change during the life
of the product it's associated with
Data transfer rate:
The number of characters that can be transferred from an RFID tag to a reader
within a given time. Baud rates are also used to quantify how fast readers can
read the information on the RFID tag. This differs from read rate, which refers
to how many tags can be read within a given period of time.
Edge server:
A computer for running middleware or applications that is close to the edge of
the network, where the digital world meets the real world. Edge servers are put
in warehouses, distribution centers and factories, as opposed to corporate
headquarters.
Middleware:
In the RFID world, this term is generally used to refer to software that resides
on a server between readers and enterprise applications. The middleware is used
to filter data and pass on only useful information to enterprise applications.
Some middleware can also be used to manage readers on a network.
Electrically Erasable Programmable Read-Only Memory(EEPROM):
A method of storing data on microchips. Usually bytes can be erased and
reprogrammed individually. RFID tags that use EEPROM are more expensive than
factory programmed tags, where the number is written into the silicon when the
chip is made, but they offer more flexibility because the end user can write an
ID number to the tag at the time the tag is going to be used.
Factory programming:
Some read-only have to have their identification number written into the silicon
microchip at the time the chip is made. The process of writing the number into
the chip is called factory programming. This data can't be written over or
changed.
Field programming:
Tags that use EEPROM, or non-volatile memory, can be programmed after it is
shipped from the factory. That is, users can write data to the tag when it is
placed on a product.
FLASH:
A special type of EEPROM that can be erased and reprogrammed in blocks instead
of one byte at a time. It is usually written in capital letters, but it is not
an acronym.
Input-output ports:
Ports on an RFID reader that can be connected to external devices. An input port
might be connected to a photoelectric eye to turn on the reader when an object
enters the reader field. An output device might be connected to a door that
opens when a tag is read.
Item-level:
A term used to discribed the tagging of individual products, as opposed to
case-level and pallet-level tagging.
Lossy:
Characterized by or causing dissipation of energy. For instance, a cable is said
to be a lossy cable if the signal attenuates as it travels through the cable.
License plate:
This term generally applies to a simple RFID that has only a serial number that
is associated with information in a database. The Auto-ID Center promoted the
concept as a way to simplify the tag and reduce the cost.
Memory:
The amount of data that can be stored on the microchip in an RFID tag. It can
range from 64 bits to 2 kilobytes or more on passive tags.
Memory block:
Memory on the microchip in an RFID tag is usually divided into sections, which
can be read or written to individually. Some blocks might be locked, so data
can't be overwritten, while others are not.
Microcontroller:
A complete microprocessor on a chip. A microcontroller includes a central
processing unit, RAM or EPROM, clock and control circuits, and serial and
parallel I/0 ports.
NanoBlock:
The term Alien Technology uses to describe its tiny microchips, which are about
the width of three human hairs.
One-time programmable:
Memory that can be written to, or programmed, only once and is afterwards write
protected. After the memory is written to, it is like read-only memory.
One-time programmable tag:
Also called a field-programmable tag. An RFID tag that can be written to once
and read many times (see WORM).
Physical Markup Language:
An Auto-ID Center-designed method of describing products in a way computers can
understand. PML is based on the widely accepted eXtensible Markup Language used
to share data over the Internet in a format all computers can use. The idea is
to create a computer language that companies can use to describe products so
that computer can search for, say, all "soft drinks" in inventory.
Commissioning a tag:
This term is sometime used to refer to the process of writing a serial number to
a tag (or programming a tag) and associating that number with the product it is
put on in a database.
Programming a tag:
Writing data to an RFID tag. When a serial number is first written to a tag,
this is sometimes called "commissioning a tag."
Quiet tag:
An RFID tag that can be read only occasionally with the interrogator output at
full power, or which can only be read at very close range.
Real-time locating system:
A system of finding the position of assets, using active RFID tags. The tags
broadcast a signal, which is received by three reader antennas. The time each
signal is received is passed on to a software system that uses triangulation to
calculate the location of the asset. RTLS is used to find containers in a
distribution yard, and many automakers use it to track parts bins within a large
factory.
Savants:
A term used to describe distributed middleware designed by the Auto-ID Center to
filter data from EPC readers and pass it on to enterprise systems. It was
envisioned that Savants would reside on servers across the EPC Network and pass
data to one another and act as a kind of nervous system for the network. The
term is being phase out by EPCglobal and many of the functions of Savants are
being incorporated in commercial middleware products.
Scanner:
An electronic device that can send and receive radio waves. When combined with a
digital signal processor that turns the waves into bits of information, the
scanner is called a reader or interrogator.
Semi-passive tag:
Similar to active tags, but the battery is used to run the microchip's circuitry
but not to broadcast a signal to the reader. Some semi-passive tags sleep until
they are woken up by a signal from the reader, which conserves battery life.
Semi-passive tags can cost a dollar or more. These tags are sometimes called
battery-assisted tags.
Sensor:
A device that responds to a physical stimulus and produces an electronic signal.
Sensors are increasingly being combined with RFID tags to detect the presence of
a stimulus at an identifiable location.
Signal attenuation:
The weakening of RF energy from an RFID tag or reader. The energy emitted by the
reader naturally decreases with distance. The rate of decrease is proportional
to the inverse square of the distance. Passive UHF RFID tags reflect back a
signal at very low power levels. A tag’s reflected signal decreases as the
inverse fourth power of the distance between tag and reader. Attenuation can be
increased by external factors as well. For instance, water absorbs UHF energy,
causing signal attenuation.
Silent Commerce:
This term covers all business solutions enabled by tagging, tracking, sensing
and other technologies, including RFID, which make everyday objects intelligent
and interactive. When combined with continuous and pervasive Internet
connectivity, they form a new infrastructure that enables companies to collect
data and deliver services without human interaction.
Subscriber identity module:
An essential component of a GSM mobile phone. It contains the identity of the
subscriber and assures the authentication during the access into the network and
provides data storage for other subscriber related information, such as a
personal address books.
Contactless smart card:
An awkward name for a credit card or loyalty card that contains an RFID chip to
transmit information to a reader without having to be swiped through a reader.
Such cards can speed checkout, providing consumers with more convenience.
Smart cards:
A credit card or other kind of card with an embedded microchip. When the card
uses RFID technology to send and receive data it is called a contactless smart
card.
Smart label:
A generic term that usually refers to a bar code label that contains an RFID
transponder. It's considered "smart" because it can store information, such as a
unique serial number, and communicate with a reader.
Intelligent reader:
A generic term that is sometimes used to describe a reader that has the ability
to filter data, execute commands and generally perform functions similar to a
personal computer.
Tag talks first:
A means by which a reader in a passive UHF system identifies tags in the field.
When tags enter the reader's field, they immediately communicate their presence
by reflecting back a signal. This is useful when you want to know everything
that is passing a reader, such as when items are moving quickly on a conveyor.
In other cases, the reader wants to simply find specific tags in a field, in
which case it wants to broadcast a signal and have only certain tags respond.
(See Reader talks first.)
Reader talks first:
A means by which a passive UHF reader communicates with tags in its read field.
The reader sends energy to the tags but the tags sit idle until the reader
requests them to respond. The reader is able to find tags with specific serial
numbers by asking all tags with a serial number that starts with either 1 or 0
to respond. If more than one responds, the reader might ask for all tags with a
serial number that starts with 01 to respond, and then 010. This is called
"walking" a binary tree, or "tree walking." (See singulation.)
Time division multiple access:
A method of solving the problem of the signals of two readers colliding.
Algorithms are used to make sure the readers attempt to read tags at different
times.
Transceiver:
A device that both transmits and receives radio waves.
SMART CARD
Smart Card Overview
A smart card, a type of chip card is a plastic card embedded with a computer
chip that stores and transacts data between users. This data is associated with
either value or information or both and is stored and processed within the
card's chip, either a memory or microprocessor. The card data is transacted via
a reader that is part of a computing system. Smart card-enhanced systems are in
use today throughout several key applications, including healthcare, banking,
entertainment and transportation. To various degrees, all applications can
benefit from the added features and security that smart cards provide. According
to Dataquest, the worldwide smart card market will grow to 6.8 Billion units and
$11 Billion by 2006.
Applications
First introduced in Europe over a decade ago, smart cards debuted as a
stored value tool for pay phones to reduce theft. As smart cards and other
chip-based cards advanced, people found new ways to use them, including charge
cards for credit purchases and for record keeping in place of paper.
In the U.S., consumers have been using chip cards for everything from visiting
libraries to buying groceries to attending movies, firmly integrating them into
our everyday lives. Several states have chip card programs in progress for
government applications ranging from the Department of Motor Vehicles to
Electronic Benefit Transfer (EBT). Many industries have implemented the power of
smart cards into their products such as the new GSM digital cellular phones to
TV-satellite decoders.
Why Smart Cards
Smart cards greatly improve the convenience and security of any transaction.
They provide tamper-proof storage of user and account identity. Smart cards also
provide vital components of system security for the exchange of data throughout
virtually any type of network. They protect against a full range of security
threats, from careless storage of user passwords to sophisticated system hacks.
Multifunction cards can also serve as network system access and store value and
other data. People worldwide are now using smart cards for a wide variety of
daily tasks, these include:
Loyalty and Stored Value
A primary use of smart cards is stored value, particularly loyalty programs
that track and incentivize repeat customers. Stored value is more convenient and
safer than cash. For issuers, float is realized on unspent balances and
residuals on balances that are never used.
For multi-chain retailers that administer loyalty programs across many different
businesses and Point of sale systems, smart cards can centrally locate and track
all data. The applications are numerous, from parking and laundry to gaming, as
well as all retail and entertainment uses.
Securing Information and Physical Assets
In addition to information security, smart cards achieve greater physical
security of services and equipment, because the card restricts access to all but
the authorized user(s). E-mail and PCs are being locked-down with smart cards.
Information and entertainment is being delivered via to the home or PC. Home
delivery of service is encrypted and decrypted per subscriber access. Digital
video broadcasts accept smart cards as electronic keys for protection. Smart
cards can also act as keys to machine settings for sensitive laboratory
equipment and dispensers for drugs, tools, library cards, health club equipment
etc.
E-Commerce
Smart cards make it easy for consumers to securely store information and
cash for purchasing. The advantages they offer consumers are:
The card can carry personal account, credit and buying preference information
that can be accessed with a mouse click instead of filling out forms.
Cards can manage and control expenditures with automatic limits and reporting.
Internet loyalty programs can be deployed across multiple vendors with disparate
POS systems and the card acts as a secure central depository for points or
rewards.
Micro Payments - paying nominal costs without transaction fees associated with
credit cards or for amounts too small for cash, like reprint charges.
Personal Finance
As banks enter competition in newly opened markets such as investment
brokerages, they are securing transactions via smart cards at an increased rate.
This means:
Smart cards increase trust through improved security. Two-Factor Authentication
insures protection of data and value across the internet. Threats such as the
"Man in the middle" and "Trojan Horses" that replay a user name and password are
eliminated
This will improve customer service. Customers can use secure smart cards for
fast, 24-hour electronic funds transfers over the internet
Costs are reduced: transactions that normally would require a bank employee's
time and paperwork can be managed electronically by the customer with a smart
card
Health Care
The explosion of health care data brings up new challenges to the efficiency of
patient care and privacy safeguards. Smart cards solve both challenges with
secure storage and distribution of everything from emergency data to benefits
status.
Rapid identification of patients; improved treatment
A convenient way to carry data between systems or to sites without systems
Reduction of records maintenance costs
Network Security
Business to business Intranets and Virtual Private Networks “VPNs” are enhanced
by the use of smart cards. Users can be authenticated and authorized to have
access to specific information based on preset privileges. Additional
applications range from secure email to electronic commerce.
Physical Access
Businesses and universities of all types need simple identity cards for all
employees and students. Most of these people are also granted access to certain
data, equipment and departments according to their status. Multifunction,
microprocessor-based smart cards incorporate identity with access privileges and
also store value for use in various locations, such as cafeterias and stores.
Contact Cards
The most common type of smart card. Electrical contacts located on the
outside of the card connect to a card reader when the card is inserted.
Contact Cards
The most common type of smart card. Electrical contacts located on the outside
of the card connect to a card reader when the card is inserted.
Increased levels of processing power, flexibility and memory add cost. Single
function cards are often the most cost-effective solution. Choose the right type
of smart card for your application by evaluating cost versus functionality and
determine your required level of security. All of these variables should be
weighted against the expected lifecycle of the card. On average the cards
typically comprise only 10 to 15 percent of the total system cost with the
infrastructure, issuance, training and advertising making up the other 85
percent. The following chart demonstrates some general rules of thumb;
Memory Cards
Memory cards have no sophisticated processing power and cannot manage files
dynamically. All memory cards communicate to readers through synchronous
protocols. In all memory cards you read and write to a fixed address on the
card. There are three primary types of memory cards: 1). Straight, 2).
Protected, and 3). Stored Value.
1. Straight Memory Cards
These cards just store data and have no data processing capabilities. These
cards are the lowest cost per bit for user memory. They should be regarded as
floppy disks of varying sizes without the lock mechanism. These cards cannot
identify themselves to the reader, so your host system has to know what type of
card is being inserted into a reader. These cards are easily duplicated and
cannot be tracked by on-card identifiers.
2. Protected / Segmented Memory Cards
These cards have built-in logic to control the access to the memory of the card.
Sometimes referred to as Intelligent Memory cards, these devices can be set to
write protect some or all of the memory array. Some of these cards can be
configured to restrict access to both reading and writing. This is usually done
through a password or system key. Segmented memory cards can be divided into
logical sections for planned multi-functionality. These cards are not easily
duplicated but can possibly be impersonated by hackers. They typically can be
tracked by an on-card identifier.
3. Stored Value Memory Cards
These cards are designed for the specific purpose of storing value or tokens.
The cards are either disposable or rechargeable. Most cards of this type
incorporate permanent security measures at the point of manufacture. These
measures can include password keys and logic that are hard-coded into the chip
by the manufacturer. The memory arrays on these devices are set-up as decrements
or counters. There is little or no memory left for any other function. For
simple applications such as a telephone card the chip has 60 or 12 memory cells,
one for each telephone unit. A memory cell is cleared each time a telephone unit
is used. Once all the memory units are used, the card becomes useless and is
thrown away. This process can be reversed in the case of rechargeable cards.
CPU/MPU Microprocessor Multifunction Cards
These cards have on-card dynamic data processing capabilities. Multifunction
smart cards allocate card memory into independent sections or files assigned to
a specific function or application. Within the card is a microprocessor or
microcontroller chip that manages this memory allocation and file access. This
type of chip is similar to those found inside all personal computers and when
implanted in a smart card, manages data in organized file structures, via a card
operating system (COS). Unlike other operating systems, this software controls
access to the on-card user memory. This capability permits different and
multiple functions and/or different applications to reside on the card, allowing
businesses to issue and maintain a diversity of ‘products’ through the card. One
example of this is a debit card that also enables building access on a college
campus. Multifunction cards benefit issuers by enabling them to market their
products and services via state-of-the-art transaction and encryption
technology. Specifically, the technology enables secure identification of users
and permits information updates without replacement of the installed base of
cards, simplifying program changes and reducing costs. For the card user,
multifunction means greater convenience and security, and ultimately,
consolidation of multiple cards down to a select few that serve many purposes.
There are many configurations of chips in this category including chips that
support cryptographic PKI functions with on board math co-processors or Java
virtual machine hardware blocks. As a rule of thumb - the more functions the
higher the cost.
Contactless Cards
These are smart cards that employ a radio frequency (RFID) between card and
reader without physical insertion of the card. Instead the card is passed along
the exterior of the reader and read. Types include proximity cards which are
implemented as a read-only technology for building access. These cards function
with a limited memory and communicate at 125 MHz. True read & write contactless
cards were first used in transportation for quick decrementing and re-loading of
fare values where their lower security was not an issue. They communicate at
13.56 MHz, and conform to the ISO14443 standard. These cards are often straight
memory types. They are also gaining popularity in retail stored value, since
they can speed-up transactions and not lower transaction processing revenues
(i.e. VISA and Mastercard), like traditional smart cards.
Variations of the ISO14443 specification include A, B, and C, which specify
chips from either specific or various manufacturers. A=Philips B=Everybody else
and C=Sony chips. Contactless card drawbacks include the limits of cryptographic
functions and user memory versus microprocessor cards and the limited distance
between card and reader required for operation.
Combination Cards
These are hybrids that employ both contact and contactless technology in one
card. Combi-cards can also contain two different types of chips in contrast to a
Dual-Interface card where a single chip manages both functions.
Operating Systems
The two primary types of smart card operating systems 1). Fixed File
Structure and 2). Dynamic Application System. As with card types, selection of a
card OS depends on the application the card is developed for. The other defining
difference is in the Encryption Capabilities of the OS and the Chip. These are
typically distinguished by Symmetric Key and Public Key. See the security
section of this site for more information.
1). Fixed File Structure
This type treats the card as a secure computing and storage device. Files and
permissions are set in advance by the issuer. These specific parameters are
ideal and economical for a fixed type of card structure and functions that will
not change in the near future. An example of this kind of card is a low-cost
employee multi-function badge.
2). Dynamic Application System
This type of operating system, which includes the MULTOS and JAVA card
varieties, enables developers to build, test, and deploy different applications
securely. Because the OS and applications are more separate, updates can easily
and repeatedly be made. See our software page for more information. An example
card is a SIM card for mobile GSM where updates and security are downloaded to
the phone and dynamically changed.
Smart Card Readers/Terminals
For the sake of clearly defining all of the different hardware devices that
smart cards can be plugged into, the industry has adopted the following
definitions:
The term 'reader' is used to describe a unit that interfaces with a PC for the
majority of its processing requirements. In contrast a 'terminal' is a
self-contained processing device.
Both readers and terminals read and write to smart cards. Readers come in many
form factors and in a wide variety of capabilities. The easiest way to describe
a reader is by the method of it's interface to a PC. Smart card readers are
available that interface to RS232 serial ports, USB ports, PCMCIA slots, floppy
disk slots, parallel ports, infrared IRDA ports and keyboards and keyboard wedge
readers.
Another difference in reader types is the on-board intelligence and
capabilities. Extensive price and performance differences exist between an
industrial strength intelligent reader that supports a wide variety of card
protocols and a home style win-card reader that only works with microprocessor
cards and performs all processing of the data in the PC.
The options in terminal choices are just as wide. Most units have their own
operating systems and development tools. They typically support other functions
such as magnetic-stripe reading, modem functions and transaction printing.
Smart Card Standards
Primarily, smart card standards govern physical properties, communication
characteristics, and application identifiers of the embedded chip and data.
Almost all standards refer to the ISO 7816-1,2 & 3 as a base reference.
Application-specific properties are being debated with many large organizations
and groups proposing their standards. Open system card interoperability should
apply at several levels: 1). To the card itself, 2). The card's access terminals
(readers), 3). The networks and 4). The card issuers' own systems. Open system
card interoperability will only be achieved by conformance to international
standards.
This site's sponsors are committed to compliance with ISO and ITSEC security
standards as well as industry initiatives such as EMV, MULTOS, the Open Card
Framework and PC/SC specifications.
These organizations are active in smart card standardization: The following
standards and the organizations that maintain them are the most prevalent in the
smart card industry:
ISO - International Standards Organization This organization facilitates the
creation of voluntary standards through a process that is open to all parties.
ISO 7816 is the international standard for integrated-circuit cards (commonly
known as smart cards) that use electrical contacts on the card, as well as cards
that communicate with readers and terminals without contacts, as with radio
frequency (RF/Contactless) technology. Anyone interested in obtaining a
technical understanding of smart cards needs to become familiar with what ISO
7816 and 1443 does NOT cover as well as what it does. Copies of these standards
can be purchased through ANSI American National Standards Institute. ANSI's
address and phone is: 11 West 42nd Street, New York, NY 10036 - For more
information and copies of standards, see the ISO website or call (212) 642-4900.
ISO 7816 Summary - This is a quick overview of what the 7816 specifications
cover. As these can be in revision at any time, check with ISO for the latest
updates. Some of these are frozen and some are in revision; please check with
ANSI for the most current revision. ISO 7816 has six parts. Some have been
completed; others are currently in draft stage.
ISO 7816-1: Physical Characteristics, 1987; defines the physical dimensions of
contact smart cards and their resistance to static electricity, electromagnetic
radiation and mechanical stress. It also describes the physical location of an
IC card's magnetic stripe and embossing area.
ISO 7816-2: Dimensions and Location of Contacts, 1988; defines the location,
purpose and electrical characteristics of the card's metallic contacts.
ISO 7816-3: Electronic Signals and Transmission Protocols, 1989; defines the
voltage and current requirements for the electrical contacts as defined in part
2 and asynchronous half-duplex character transmission protocol (T=0). Amendment
1: 1992, Protocol type T=1, asynchronous half duplex block transmission
protocol. Smart cards that use a proprietary transmission protocol carry the
designation, T=14. Amendment 2: 1994, Revision of protocol type selection.
ISO 7816-4: Inter-industry Commands for Interchange; establishes a set of
commands for CPU cards across all industries to provide access, security and
transmission of card data. Within this basic kernel, for example, are commands
to read, write and update records.
ISO 7816-5: Numbering System and Registration Procedure for Application
Identifiers (AID); sets standards for Application Identifiers. An AID has two
parts. The first is a Registered Application Provider Identifier (RID) of five
bytes that is unique to the vendor. The second part is a variable length field
of up to 11 bytes that RIDs can use to identify specific applications.
ISO 7816-6: Inter-industry data elements; physical transportation of device and
transaction data, answer to reset and transmission protocols. The specifications
permit two transmission protocols: character protocol (T=0) or block protocol
(T=1). A card may support either but not both. (Note: Some card manufacturers
adhere to neither of these protocols. The transmission protocols for such cards
are described as T=14).
ISO 7816-7: Inter-industry command for Structured Card Query Language (SCQL);
This document specifies the concept of a SCQL database (SCQL = Structured Card
Query Language based on SQL, see MS ISO 9075), and the related inter-industry
enhanced commands.
ISO 7816-8: Commands for Security Operation; this document codifies internal
card commands for security operations.
ISO 7816-9: Commands for Card Management; specifies a description and coding of
the life cycle of cards and related objects, a description and coding of
security attributes of card related objects, functions and syntax of additional
inter-industry commands, data elements associated with these commands, and a
mechanism for initiating card-originated messages.
ISO 7816-10: Electrical signals and answer to reset for synchronous cards; this
part of ISO 7816 specifies the power, signal structures, and the structure for
the answer to reset between an integrated circuit card(s) with synchronous
transmission and an interface device such as a terminal.
ISO 7816-11: Personal verification through biometric methods; currently a draft.
See the Bio API for more info.
FIPS (Federal Information Processing Standards) Developed by the Computer
Security Division within National Institute of Standards and Technology (NIST).
FIPS standards are designed to protect federal assets including computer and
telecommunications systems. The following FIPS standards apply to smart card
technology and pertain to digital signature standards, advanced encryption
standards, and security requirements for cryptographic modules.
FIPS 140 (1-3): The security requirements contained in FIPS 140 (1-3) pertain to
areas related to the secure design and implementation of a cryptographic module,
specifically: cryptographic module specification; cryptographic module ports and
interfaces; roles, services, and authentication; finite state model; physical
security; operational environment; cryptographic key management; electromagnetic
interference/electromagnetic compatibility (EMI/EMC); self-tests; design
assurance; and mitigation of other attacks.
FIPS 201: Currently a draft, this specification will cover all aspects of
multifunction cards used in identity management systems throughout the U.S.
government.
EMV - Europay, MasterCard and Visa formed EMV Company, LLC and created the
"Integrated Circuit Card Specifications for Payment Systems". These
specifications are related to ISO7816 and create a common technical basis for
card and system implementation of a stored value system. Integrated Circuit Card
Specifications for Payment Systems can be obtained from a Visa, MasterCard or
Europay member bank.
PC/SC - A Microsoft proposed and implemented standard for cards and readers,
called the PC/SC specification. This proposal only applies to CPU cards. They
have also built into their CryptoAPI a framework that supports many security
mechanisms for cards and systems. PC/SC is now a fairly common middleware
interface for PC logon applications. The standard is a highly abstracted set of
middleware components that allow for the most common reader card interactions.
CEN (Comite' Europe'en de Normalisation) and ETSI (European Telecommunications
Standards Institute) is focused on telecommunications, as with the GSM SIM for
cellular telephones. GSM 11.11 and ETSI300045. CEN can be contacted at Rue de
Stassart, 36 B-1050 Brussels, Belgium, attention to the Central Secretariat.
HIPAA - The Health Insurance Portability and Accountability Act adopts national
standards for implementing a secure electronic health transaction system in the
U.S. Example transactions affected by this include claims, enrollment,
eligibility, payment and coordination of benefits. Smart cards are governed by
the requirements of HIPAA pertaining to data security and patient privacy.
IC Communications Standards - these existed for non-volatile memories before the
chips were adopted for smart card use. This specifically applies to the I2C and
SPI EEPROM interfaces.
System Planning & Deployment
Smart card system design requires advance planning to be successful and to
avoid problems. It is highly recommended that you graphically diagram the flow
of information for your new system. The first question to consider is 'will the
card and system transact information, or value, or both?' If it stores keys or
value (i.e.; gift certificates or sports tickets), greater design detail is
required than in data-only systems. When you combine information types on a
single card, other issues arise. The key to success is not to overrun the system
with features that can confuse users and cause problems in management. We
recommend that you phase-in each feature set as each one is working. To properly
implement a functional smart card system you should be able to answer the
following questions. NOTE: These are only general guidelines, provided as a
basis for your individual planning. Many other steps may be involved and are not
mentioned here. For more extensive planning information regarding identity
management and national IDs we recommend that you review the GSA Smart Card
Handbook.
Basic Set-Up
Is there a clear business case? Including financial and consumer behavior
factors?
Will the system be single or multi-application?
What type of information do I want to store in the cards (ie; data or value)?
How much memory is required for each application?
If multi-application, how will I separate different types of data?
Will card data be obtained from a database? Or loaded every time?
Will this data concurrently reside on a database?
How many cards will be needed?
Are card/infrastructure vendors identified? What are the lead times?
Security Planning
What are the security requirements?
Does all, or only some of the data need to be secure?
Who will have access to this information?
Who will be allowed to change this information?
In what manner shall I secure this data i.e. encryption, Host passwords, card
passwords/PINs or all of these?
Should the keys/PINs be customer or system-activated?
What form of version control do I want?
Value Applications
Should the value in the cards be re-loadable or will the cards be disposable?
How will I distribute the cards?
How will cards be activated and loaded with value?
What type of card traceability should I implement?
What is the minimum and maximum value to store on each card?
Will there be a refund policy?
General Issuance
How many types of artwork will be included in the issuance?
Who will do the artwork?
What is needed on the card? For example signature panels, Magnetic-Stripe,
Embossing etc.
Multi-Application Card Systems
It is highly recommended that you graphically diagram the flow of information as
shown below.
Building a smart card system that stores value i.e. gift certificates, show
tickets, redemption points or cash equivalents requires an attention to detail
not necessary in other information management systems. The key to success is not
to overrun the system with features that can confuse users and cause problems in
management. We recommend that you phase-in each feature set after the first one
is working. Here is a list of some questions that are pertinent to these systems
in addition to the above questions.
Deployment
As the minimum steps in deploying a stored value or multi-application
system, establish clear achievable program objectives;
Make sure the organization has a stake in the project's success and that
management buys into the project
Set a budget
Name a project manager
Assemble a project team and create a team vision
Graphically create an information - card and funds-flow diagram
Assess the card and reader options
Write a detailed specification for the system
Set a realistic schedule with inch-stones and mile-stones
Establish the security parameters for both people and the system
Phase-in each system element, testing as you deploy
Reassess for security leaks
Deploy the first phase of cards and test, test
Train the key employees responsible for each area
Set-up a system user manual
Check the reporting structures
Have contingency plans should problems arise
Deploy and announce
Advertise and market your system
Smart Card Security
Smart cards provide computing and business systems the enormous benefit of
portable and secure storage of data and value. At the same time, the integration
of smart cards into your system introduces its own security management issues,
as people access card data far and wide in a variety of applications.
The following is a basic discussion of system security and smart cards, designed
to familiarize you with the terminology and concepts you need in order to start
your security planning.
What Is Security?
Security is basically the protection of something valuable to ensure that it
is not stolen, lost, or altered. The term "data security" governs an extremely
wide range of applications and touches everyone's daily life. Concerns over data
security are at an all-time high, due to the rapid advancement of technology
into virtually every transaction, from parking meters to national defense.
Data is created, updated, exchanged and stored via networks. A network is any
computing system where users are highly interactive and interdependent and by
definition, not all in the same physical place. In any network, diversity
abounds, certainly in terms of types of data, but also types of users. For that
reason, a system of security is essential to maintain computing and network
functions, keep sensitive data secret, or simply maintain worker safety. Any one
company might provide an example of these multiple security concerns: Take, for
instance, a pharmaceutical manufacturer:
Type Of Data
Security Concern
Type Of Access
Drug Formula
Basis of business income. Competitor spying
Highly selective list of executives
Accounting, Regulatory
Required by law
Relevant executives and departments
Personnel Files
Employee privacy
Relevant executives and departments
Employee ID
Non-employee access. Inaccurate payroll, benefits assignment
Relevant executives and departments
Facilities
Access authorization
Individuals per function and clearance such as customers, visitors, or vendors
Building safety, emergency response
All employees
Outside emergency response
What Is Information Security?
Information security is the application of measures to ensure the safety and
privacy of data by managing it's storage and distribution. Information security
has both technical and social implications. The first simply deals with the
'how' and 'how much' question of applying secure measures at a reasonable cost.
The second grapples with issues of individual freedom, public concerns, legal
standards and how the need for privacy intersects them. This discussion covers a
range of options open to business managers, system planners and programmers that
will contribute to your ultimate security strategy. The eventual choice rests
with the system designer and issuer.
The Elements Of Data Security
In implementing a security system, all data networks deal with the following
main elements:
Hardware, including servers, redundant mass storage devices, communication
channels and lines, hardware tokens (smart cards) and remotely located devices
(e.g., thin clients or Internet appliances) serving as interfaces between users
and computers
Software, including operating systems, database management systems,
communication and security application programs
Data, including databases containing customer - related information.
Personnel, to act as originators and/or users of the data; professional
personnel, clerical staff, administrative personnel, and computer staff
The Mechanisms Of Data Security
Working with the above elements, an effective data security system works with
the following key mechanisms to answer:
Has My Data Arrived Intact? (Data Integrity) This mechanism ensures that data
was not lost or corrupted when it was sent to you
Is The Data Correct And Does It Come From The Right Person? (Authentication)
This proves user or system identities
Can I Confirm Receipt Of The Data And Sender Identity Back To The Sender?
(Non-Repudiation)
Can I Keep This Data Private? (Confidentiality) - Ensures only senders and
receivers access the data. This is typically done by employing one or more
encryption techniques to secure your data
Can I Safely Share This Data If I Choose? (Authorization and Delegation) You can
set and manage access privileges for additional users and groups
Can I Verify The That The System Is Working? (Auditing and Logging) Provides a
constant monitor and troubleshooting of security system function
Can I Actively Manage The System? (Management) Allows administration of your
security system
Data Integrity
This is the function that verifies the characteristics of a document and a
transaction. Characteristics of both are inspected and confirmed for content and
correct authorization. Data Integrity is achieved with electronic cryptography
that assigns a unique identity to data like a fingerprint. Any attempt to change
this identity signals the change and flags any tampering.
Authentication
This inspects, then confirms, the proper identity of people involved in a
transaction of data or value. In authentication systems, authentication is
measured by assessing the mechanisms strength and how many factors are used to
confirm the identity. In a PKI system a Digital Signature verifies data at its
origination by producing an identity that can be mutually verified by all
parties involved in the transaction. A cryptographic hash algorithm produces a
Digital Signature.
Non-Repudiation
This eliminates the possibility of a transaction being repudiated, or
invalidated by incorporating a Digital Signature that a third party can verify
as correct. Similar in concept to registered mail, the recipient of data
re-hashes it, verifies the Digital Signature, and compares the two to see that
they match.
Authorization and Delegation
Authorization is the processes of allowing access to specific data within a
system. Delegation is the utilization of a third party to manage and certify
each of the users of your system. (Certificate Authorities).
Authorization and Trust Model
Auditing and Logging
This is the independent examination and recording of records and activities to
ensure compliance with established controls, policy, and operational procedures,
and to recommend any indicated changes in controls, policy, or procedures.
Management
Is the oversight and design of the elements and mechanisms discussed above and
below. Card management also requires the management of card issuance,
replacement and retirement as well as polices that govern a system.
Cryptography/Confidentiality
Confidentiality is the use of encryption to protect information from
unauthorized disclosure. Plain text is turned into cipher text via an algorithm,
then decrypted back into plain text using the same method.
Cryptography is the method of converting data from a human readable form to a
modified form, and then back to its original readable form, to make unauthorized
access difficult. Cryptography is used in the following ways:
Ensure data privacy, by encrypting data
Ensures data integrity, by recognizing if data has been manipulated in an
unauthorized way
Ensures data uniqueness by checking that data is "original", and not a "copy" of
the "original". The sender attaches a unique identifier to the "original" data.
This unique identifier is then checked by the receiver of the data.
The original data may be in a human-readable form, such as a text file, or it
may be in a computer-readable form, such as a database, spreadsheet or graphics
file. The original data is called unencrypted data or plain text.The modified
data is called encrypted data or cipher text. The process of converting the
unencrypted data is called encryption. The process of converting encrypted data
to unencrypted data is called decryption.
Data Security Mechanisms and their Respective Algorithms
In order to convert the data, you need to have an encryption algorithm and a
key. If the same key is used for both encryption and decryption that key is
called a secret key and the algorithm is called a symmetric algorithm. The most
well-known symmetric algorithm is DES (Data Encryption Standard).
The Data Encryption Standard (DES) was invented by the IBM Corporation in the
1970's. During the process of becoming a standard algorithm, it was modified
according to recommendations from the National Security Agency (NSA). The
algorithm has been studied by cryptographers for nearly 20 years. During this
time, no methods have been published that describe a way to break the algorithm,
except for brute-force techniques. DES has a 56-bit key, which offers 256 or 7 x
1016 possible variations. There are a very small numbers of weak keys, but it is
easy to test for these keys and they are easy to avoid.
Triple-DES is a method of using DES to provide additional security. Triple-DES
can be done with two or with three keys. Since the algorithm performs an
encrypt-decrypt-encrypt sequence, this is sometimes called the EDE mode. This
diagram shows Triple-DES three-key mode used for encryption:
If different keys are used for encryption and decryption, the algorithm is
called an asymmetric algorithm. The most well-known asymmetric algorithm is RSA,
named after its three inventors (Rivest, Shamir, and Adleman). This algorithm
uses two keys, called the private key. These keys are mathematically linked.
Here is a diagram that illustrates an asymmetric algorithm:
Asymmetric algorithms involve extremely complex mathematics typically involving
the factoring of large prime numbers. Asymmetric algorithms are typically
stronger than a short key length symmetric algorithm. But because of their
complexity they are used in signing a message or a certificate. They not
ordinarily used for data transmission encryption.
Smart Card Security (Section 3)
As the card issuer, you must define all of the parameters for card and data
security. There are two methods of using cards for data system security,
host-based and card-based. The safest systems employ both methodologies.
Host-Based System Security
A host-based system treats a card as a simple data carrier. Because of this,
straight memory cards can be used very cost-effectively for many systems. All
protection of the data is done from the host computer. The card data may be
encrypted but the transmission to the host can be vulnerable to attack. A common
method of increasing the security is to write in the clear (not encrypted) a key
that usually contains a date and/or time along with a secret reference to a set
of keys on the host. Each time the card is re-written the host can write a
reference to the keys. This way each transmission is different. But parts of the
keys are in the clear for hackers to analyze. This security can be increased by
the use of smart memory cards that employ a password mechanism to prevent
unauthorized reading of the data. Unfortunately the passwords can be sniffed in
the clear. Access is then possible to the main memory. These methodologies are
often used when a network can batch up the data regularly and compare values and
card usage and generate a problem card list.
Card-Based System Security
These systems are typically microprocessor card-based. A card, or
token-based system treats a card as an active computing device. The Interaction
between the host and the card can be a series of steps to determine if the card
is authorized to be used in the system. The process also checks if the user can
be identified, authenticated and if the card will present the appropriate
credentials to conduct a transaction. The card itself can also demand the same
from the host before proceeding with a transaction. The access to specific
information in the card is controlled by A) the card's internal Operating System
and B) the preset permissions set by the card issuer regarding the files
conditions. The card can be in a standard CR80 form factor or be in a USB dongle
or it could be a GSM SIM Card.
Threats To Cards and Data Security
Effective security system planning takes into account the need for
authorized users to access data reasonably easily, while considering the many
threats that this access presents to the integrity and safety of the
information. There are basic steps to follow to secure all smart card systems,
regardless of type or size.
Analysis: Types of data to secure; users, points of contact, transmission.
Relative risk/impact of data loss
Deployment of your proposed system
Road Test: Attempt to hack your system; learn about weak spots, etc.
Synthesis: Incorporate road test data, re-deploy
Auditing: Periodic security monitoring, checks of system, fine-tuning
When analyzing the threats to your data an organization should look closely at
two specific areas: Internal attacks and external attacks. The first and most
common compromise of data comes from disgruntled employees. Knowing this, a good
system manager separates all back-up data and back-up systems into a separately
partitioned and secured space. The introduction of viruses and the attempted
formatting of network drives is a typical internal attack behavior. By deploying
employee cards that log an employee into the system and record the time, date
and machine that the employee is on, a company automatically discourages these
type of attacks.
External attacks are typically aimed at the weakest link in a company's security
armor. The first place an external hacker looks at is where they can intercept
the transmission of your data. In a smart card-enhanced system this starts with
the card.
The following sets of questions are relevant to your analysis. Is the data on
the card transmitted in the clear or is it encrypted? If the transmission is
sniffed, is each session secured with a different key? Does the data move from
the reader to the PC in the clear? Does the PC or client transmit the data in
the clear? If the packet is sniffed, is each session secured with a different
key? Does the operating system have a back door? Is there a mechanism to upload
and down load functioning code? How secure is this system? Does the OS provider
have a good security track record? Does the card manufacturer have precautions
in place to secure your data? Do they understand the liabilities? Can they
provide other security measures that can be implemented on the card and or
module? When the card is subjected to Differential Power attacks and
Differential Thermal attacks does the OS reveal any secrets? Will the
semiconductor utilized meet this scrutiny? Do your suppliers understand these
questions?
Other types of problems that can be a threat to your assets include:
Improperly secured passwords (writing them down, sharing)
Assigned PINs and the replacement mechanisms
Delegated Authentication Services
Poor data segmentation
Physical Security (the physical removal or destruction of your computing
hardware)
Security Architectures
When designing a system a planner should look at the total cost of ownership
this includes:
Analysis
Installation and Deployment
Delegated Services
Training
Management
Audits and Upgrades
Infrastructure Costs (Software and Hardware)
Over 99% of all U.S.- based financial networks are secured with a Private Key
Infrastructure. This is changing over time, based on the sheer volume of
transactions managed daily and the hassles that come with private key
management. Private Key-based systems make good sense if your expected user base
is less than 500,000 participants.
Public Key Systems are typically cost effective only in large volumes or where
the value of data is so high that its worth the higher costs associated with
this type of deployment. What most people don t realize is that Public Key
systems still rely heavily on Private Key encryption for all transmission of
data. The Public Key encryption algorithms are only used for non-repudiation and
to secure data integrity. Public Key infrastructures as a rule employ every
mechanism of data security in a nested and coordinated fashion to insure the
highest level of security available today.
PKI-Public Key Infrastructure
Conclusions
Smart cards can add convenience and safety to any transaction of value and data;
but the choices facing today's managers can be daunting. We hope this site has
adequately presented the options and given you enough information to make
informed evaluations of performance, cost and security that will produce a smart
card system that fits today's needs and those of tomorrow. It is our sincere
belief that informed users make better choices, which leads to better business
for everybody.
Smart Card, Smartcard, Smartcards, Smart Cards, Chip Cards T=1, T=0, security chipcard, ISO7816, ISO-7816, EMV, Java Card, javacard, PKI,Public Key Infrastructure, Encryption, Smart Card Readers, Smart Card Terminals, smart card API, smart card software, POS Terminals, Prepaid Cards, Cryptography, Stored Value Systems, CryptoAPI, CAPI, PCSC,Card Operating Systems, DES Encryption, DES, Digital Signatures, Non-Repudiation,Authentication, Security Mechanisms, Smart Card Security Card OS, MPCOS, CardOS, StarCos, COS Key Exchange Systems, Certificate Authorities, , telephony, prepaid, EMV, electronic payment, fraud, government, identification, cryptographic, non-repudiation, identity, access control, enterprise security, contactless Security Threats, smart card development, Delphi, C++, visual basic, visual studio, , wireless, mobile, telecom, SIM, WAP, CDMA, USIM, Smart Badges.
ACCESS CONTROL / ACCESS CARD / ID CARDS / EMPLOYEE CARD SECURITY SYSTEM
Glossary of Access Control and Security Industry Terms
A
Access Card - An access control identification device assigned to an individual
to give that individual access rights to an access control system. Typically, it
is the size of a credit card. Each card has a unique identification code. That
identification code is used by a controller to determine through which doors and
at what times cardholders may be granted access to a secure area. See Key Tag.
Access Code - Numeric or alphanumeric data which, when entered correctly,
authorizes entry into a secure area.
Access Control - A general term describing the control, management, and
monitoring of the entrance and exit of people through secure areas.
Access Control Card - An identification card with encoded information that, when
presented to a card reader, identifies the cardholder to an access control
system, allowing that system to determine the cardholder's entrance and exit
rights.
Access Control Network - See Access Control System.
Access Control System - An interconnected set of controllers, managing the
entrance and exit of people through secure areas.
Access Group - A superset of information including Timezones and secured Doors
that is applied to cardholders. This information defines at what time-of-day and
through which doors cardholders are granted access.
Access Level - See Authorization Level.
Access Mode - The condition in which all access parameters have been met,
allowing an access control system to grant access.
Access Point - The point of entry into a secure area. This point is typically
managed by a controller using some combination of a card reader, an electric
door lock, gate, turnstile, or similar device.
Access Parameters - Programmed information that define the conditions that must
be met to grant access. Such parameters may include access codes, access groups,
authorization levels, or Timezones.
Access Request - The act of presenting the information necessary to verify a
person's identity.
Acquired Data - The data collected from an event that is used to make a
decision, or is saved for future analysis.
Active Card - A type of access control card that is dependent upon a card reader
to provide the power necessary to allow the card to transmit its data.
Actuator - A manually operated or automatically controlled switch or sensor
which initiates a signal that can be processed by an access control system.
Alarm Annunciation - The act of announcing that an alarm event has occurred.
Annunciation can be done by an audible alarm, warning lamp or LED, or a pop-up
window or message (in the case of alarm monitoring via computer software).
Alarm Disable - The ability to physically or electronically make an alarm input unaccessible to an access control system.
Alarm Enable - The ability to physically or electronically make an alarm input
accessible to an access control system.
Alarm Mask - The ability to selectively suppress the annunciation of certain
alarm conditions, but allowing all other alarm conditions to properly report.
Alarm Relay Output - a relay on the controller that changes its state upon
command by the controller. Often the alarm relay output activates an audible
alarm used to annunciate a door alarm.
Alphanumeric - A text string made up of alphabetic and numeric characters.
American Wire Gauge (AWG) - A standard for designating wire dimensions and
specifications.
AND Gate - A logic circuit that requires that all inputs must be in a high state
(logic 1) to generate a high state output (logic 1).
Annunciator - A device (such as a light or horn) that indicates an event has
occurred.
ANSI - An acronym for American National Standards Institute.
Anti Passback (APB) - a method for providing one-card, one-way access into and
then out of a secure area. It prevents someone from using a card to enter a
secure area and then passing that card back to someone else to enter that same
area.
APB - See Anti Passback.
Attended ID Station - A station where a security individual verifies the
identity of someone seeking to enter a secure area.
Audit Trail - A sequential record that accounts for all the activities of an
access control system. This record allows for the analysis of events over a
given time period.
Authorization Level - A security rating that must be met before access to a
secure area is granted.
Authorized Person - A person who has been cleared to enter a secure area.
Automatic Time Switch - A timer that turns devices on or off at pre-set times.
Auxiliary Code - A secondary code (often used on a temporary basis) that can be
used for granting access or allowing access control system operation without
revealing a primary code. See Primary Code.
Auxiliary RTE - a second input source that informs the controller that someone
has requested to exit from a secure area. See Request to Exit.
AWG - See American Wire Gauge.
B
Badge Reader - A reader used to read and interpret data encoded in an
identification badge. See Card Reader.
Badging Software - Security software that is capable of creating Photo
Identification badges.
Bar Code - A method of encoding information using lines and blank spaces of
varying size and thickness to represent alphanumeric characters.
Bar Code Card - An access control card with identification information encoded
in Bar Code format.
Bar Code Reader - A reader capable of reading and interpreting cards using bar
codes to encode data.
Barium Ferrite Card - An access control card with identification information
encoded in the card via magnetic material embedded in the card.
Barium Ferrite Reader - A reader capable of reading and interpreting cards using
barium ferrite to encode data.
Batch Programming - A method for processing data or performing tasks in which a
number of commands are collected and then processed by a controller all at one
time.
Battery Backup - A secondary energy source used to power devices in the event
the primary energy source fails. Battery Backup typically provides power for a
short period of time, allowing for immediate action, system protection, and
system shutdown before the battery reaches a drained state.
Baud - The unit of data signal transmission speed, typically expressed in bits
per second.
Bell Transformer - A small transformer used to reduce power line voltage to the
level required by low power devices (i.e. card readers)
Binary Coded Decimal (BCD) - The decimal numbers 0 through 9 expressed in a
4-bit binary format.
Biometrics - A general term for the verification of individuals using unique
biological characteristics (i.e. fingerprints, hand geometry, voice analysis,
the retinal pattern in the eye).
Biometric Access Control - Access control where the identification process is
made through biometric parameters. See Access Control, Biometrics.
Bit - An abbreviation for "binary digit" in the binary number system. A bit will
have the value of either 0 or 1.
Break Before Make - A type of switch in which one set of contacts open before
another set of contacts closes.
Bus - 1) In power systems, a solid metal or uninsulated wire connector from
which a universal type of power or ground connection is made. 2) In computer or
data transmission systems, the principal channel through which all major
sections communicate.
Byte - A group of eight binary data bits.
C
Card - An identification device assigned to an individual that identifies that
individual. Typically, it is the size of a credit card. See Access Card, Key
Tag.
Card Access - A type of access control system using encoded cards and card
readers to identify cardholders and determine if access may be granted. See
Cardholder.
Card Encoder - A device used to encode data onto an access card.
Card Reader - A device that retrieves information stored on an access card and
transmits that information to a controller.
Cardholder - An individual who has been assigned an access control card or tag.
Checksum - An additional set of information transferred with a computer program
or a data stream that is used to verify the accuracy of the data just transfered.
Chip-In-Card - See Smart Card.
Circle of Protection - A security plan in which the items to be protected are
surrounded by two or more protective zones of increasing size. For example, a
bank vault may have the heavy vault door, followed by a controlled access door
into the vault area, followed by the bank building with an alarm system.
Circuit Breaker - A switch on an incoming power circuit that opens if abnormal
circuit conditions arise (such as an overload or short circuit).
COM Port - A hardware device that allows a computer to communicate with external
devices.
Conductor - A material that readily allows electricty to flow through it. Most
metals are good conductors.
Contact - A magnetically or electrically controlled connection point that opens
or closes to interrupt or allow the flow of current.
Contact Rating - The load rating of a switch, listed by maximum voltage and/or
current accepted by the switch.
Control Center - A central location in a secure area where access and alarm
sub-systems are supervised and security personnel are located.
Control Point - An exit or entry point such as a door, turnstile, or gate, where
access is controlled.
Controller - A microprocessor based circuit board that manages access to a
secure area. The controller receives information that it uses to determine
through which doors and at what times cardholders are granted access to secure
areas. Based on that information, the controller can lock/unlock doors, sound
alarms, and communicate status to a host computer.
CSA - The CSA label on a product signifies that the product has met requirements
set by CSA International, and that the product manufacturer is authorized to use
the CSA symbol on their products.
Cypher Lock - A digital push-button combination lock.
D
Dedicated I/O Point - An input or output that is dedicated to a specific
function. Often, dedicated input points can be assigned to initiate tasks such
as an Auxiliary RTE, and a dedicated output point can be assigned to initiate
tasks such as the annunciation of Door Forced or Door Held Open alarms.
Dedicated Telephone Line - A telephone line directly connecting two points. Also
Known As - Lease Line.
Degausser - A device that creates a strong magnetic field that erases data from
magnetically encoded media such as magnetic stripe cards.
Degraded Mode - A mode of controller operation that provides a minimal
authorization level in the event of controller failure.
Distributed Access Control - Access control systems in which all control
decisions are made at the local controllers, independent from a host computer.
Local Controller events are uploaded to a host computer periodically for review
and storage.
Door - A generic term for a securable entry way. In many access control
applications a "door" may actually be a gate, turnstile, elevator door, or
similar device.
Door Forced Alarm - An alarm generated when a door is forced open, opening the
door switch contact.
Door Held Open Alarm - An alarm generated when a door is held open beyond the a
designated period of time (as programmed by access control software).
Door Held Open Time - The amount of time from when a door is opened before an
alarm is generated for the door being opened too long. This is often used to
monitor if a door is being propped open following a valid access request.
Door Switch - A switch that reflects the state of the door: if the door is open,
the switch is open -- if the door is closed, the switch is closed.
Download - Sending information from a host computer to a peripheral device in an
access control system.
Duress - Forcing a person to provide access to a secure area against that
person's wishes.
Duress Alarm - A device that generates a silent alarm signal in the event a
person is experiencing Duress. This device may be a stand alone signalling
device or it may be incorporated into a reader.
Duress Code - An alphanumeric code which, when entered into an access control
system, alerts the system to a Duress condition.
Duty Cycle - The ration of system ON time to system OFF time.
E
Earth Ground - An electrical connection point that brings all electrically
neutral lines to the earth's surface potential (essentially zero potential). A
good earth ground helps to protect electrical devices from damage caused by
transients such as power surges and lightening strikes, and drains electrical
interference from data, communication, and power lines that support these
electrical devices. See Ground.
Electric Door Lock - A remotely operated electric locking device. See Electric
Strike, Electromagnetic Lock.
Electric Strike - An electric door lock that requires power to be applied to
unlock a door.
Electromagnetic - A general term referring to the electric and magnetic fields
associated with the movement of electrons through conductors.
Electromagnetic Interference (EMI) - Excess electromagnetic energy radiated by
an electrical device that may affect the operation of other electrical devices.
Electromagnetic Lock - An electric door lock that uses an electromagnet to hold
a door closed. See Magnetic Lock.
Embossed Card - An access control card that uses a raised pattern as a means of
encoding data.
EMI - See Electromagentic Interference
Encoding - The process of writing data to a card.
Entrance Delay - See Door Held Open Time.
EPROM - An acronym for Erasable Programmable Read Only Memory.
Event - An occurrence at a controller (such as unlocking a door, requesting to
exit, forcing a door open) that generates a message stored by the controller.
Exit Alarm - A device that indicates (either audibly or silently) that a secure
door has been forced opened.
Exit Lock - A push-bar door lock that spans the width of the door, used for
emergency exit. An Exit Lock may be connected to an Exit Alarm.
Exit Reader - A reader used to control exiting from a secure area.
Exit Switch - A switch that is used to initiate a Request to Exit. See Request
to Exit.
F
Facility Code - Coded data in access control cards that identifies the location
of the access control system.
Fail-Safe Door - A fail-safe door is one that if the power should fail at that
door, the door will automatically unlock allowing exit and entrance. A fail-safe
door ensures people will be able to exit a secure area through that door in the
case of an emergency.
Fail-Safe Lockset - A lockset that is normally locked when the power is ON, and
automatically unlocks when the power fails. See Fail-Safe Door.
Fail-Secure Door - A fail-secure door is one that if the power should fail at
that door, the door will automatically lock and not allow entrance, but will
continue to allow exit. A fail-secure door ensures a secure area remains secure
regardless of the situation.
Fail-Secure Lockset - A lockset that is normally unlocked when the power is ON,
and automatically locks when the power fails. See Fail-Secure Door.
False Alarm - An alarm signal generated without an existing alarm condition.
Fingerprint Pattern Area - The identifying characteristics of a fingerprint,
consisting of the arches, loops, and whorls in the fingerprint.
Fingerprint Reader - A biometric reader that identifies a person based on the
person's fingerprint pattern.
G
Gate - Typically, a door that is outdoors.
General Protection Fault - An operating system fault that occurs whenever a
program executes a command that the operating system considers dangerous to the
operating system. When a GPF is generated, the program that generated the GPF is
closed and control is returned to the operating system.
Global Unlock - A normally-open input that, when closed, generates a signal that
unlocks all doors in the access control system.
Ground - 1) An electrical connection with a ground potential point. 2) An
electrical connection to a circuit's zero voltage reference point. See Earth
Ground.
H
Hand Geometry - A biometric access control technology that verifies a person's
identity by using the variations in hand size, finger length, and finger
thickness.
Historical Log - A chronological record of events.
Host Computer - The central controlling computer from which access control
software applications are run.
I
Identification - The act of recognizing one person as being unique from all
other people.
Identification Card - A card that stores the information necessary to verify the
identity of the cardholder.
Infrared Light - Light with a wavelength that is too low to be seen by the human
eye.
Infrared Motion Sensor - A sensing unit that detects motion based on the
disruption of infrared light waves.
Input - An electronic sensor on a controller that detects a change of state in a
device outside the controller. See Normally-Closed, Normally-Open
Insertion Card - A card that must be inserted into a reader for the reader to
retrieve the information stored on the card.
Intelligent Device - Any type of microprocessor-based input, output, or sensor
device that has free-standing logic capability. These devices can be programmed
with instructions that allow them to make their own decisions regarding granting
access and sounding alarms. They also can communicate with a host computer to
receive new instructions or to send event message logs.
J
Jumper - A plugable, movable device that allows connections to be made between
points on a circuit board.
K
Key Tag - An access control identification device assigned to an individual to
give that individual access rights to an access control system. Typically, the
tag is attached to a key ring or similar device to provide quick, convenient
access to the tag. Each tag has a unique identification code. That
identification code is used by a controller to determine through which doors and
at what times of day cardholders are granted access to a secure area. See Card
Keyless Access Control - An access control system that controls access using
something other than a key and a lock; typically some kind of reader and an
electric door lock.
Keypad - An alphanumeric grid which allows a user to enter an identification
code.
Keyswitch - A lockable switch operated by a key.
L
Latching Relay - A relay that when set (either ON or OFF depending upon the
relay configuration), locks into place until reset either manually or by a
signal.
LCD - The abbreviation for Liquid Crystal Display.
LED - The abbreviation for Light Emitting Diode.
Lease Line - See Dedicated Telephone Line.
Line Drop - The drop in voltage along a power line caused by the resistance,
reactance, and/or leakage in the line's wires.
Lock Relay Output - A relay on the controller that changes its state upon
command by the controller, locking or unlocking a secure door.
Logging - Creating and storing a permanent record of events that can be
reviewed, printed, and analyzed.
M
Magnetic Contact - A device that sends a signal when the magnetic field between
two monitored points is broken.
Magnetic Lock - A door lock made up of an electromagnet and a strike plate. The
electromagnet is mounted in the door frame; the strike plate in the door. When
power is applied to the electromagnet, the strength of the electromagnet keeps
the door locked.
Magnetic Stripe Card - An access control card with a strip of recordable
magnetic material, on which data is encoded.
Magnetic Stripe ReaderA reader capable of reading and interpreting cards using
magnetic stripes to encode data.
Master Code Card - An access control card that grants access and exit at every
card reader on the system.
Memory - The section of a host computer or a controller in which data and
instructions are stored.
Modem - A communication device that converts computer serial data to an analog
format that can be transmitted and received via telephone.
N
Network - 1) A series of controllers, all connected via a communications cable.
2) A group of computers, all connected via a communications cable.
Normally-Closed - The state of an input device that continually keeps a circuit
closed or complete until forced by an action or event to open that circuit. See
Input.
Normally-Open - The state of an input device that continually keeps a circuit
open or incomplete until forced by an action or event to close that circuit. See
Input.
O
Online Help - A reference program within most software programs that provides
basic descriptions and instructions on how to use that software program.
OR Gate - A logic circuit that requires that any input must be in a high state
(logic 1) to generate a high state output (logic 1).
Output Relay - A device that changes its state upon receiving a signal from a
controller. Typically the state change prompts an action outside of the
controller such as activating or inactivating a device.
P
Panic Bar - A quick release door lock allowing the door to be quickly opened in
the case of an emergency situation. Also Known As - Crash Bar.
Photo Badging - See Badging Software.
Personal Identification Number (PIN) - A unique numerical code used to identify
an individual.
Piggybacking - 1) More than one individual entering a secure area using one
access card. 2) Following an authorized person into a secure area. Also Known As
- Tailgating. See Anti Passback.
PIN - See Personal Identification Number.
Primary Code - The main identification information provided by an individual to
gain access to a secure area. See Auxiliary Code.
Programmable Card - A card in which data may be encoded.
Programmable Card Reader - A card reader in which instructions for granting or
denying access may be programmed.
Proximity - A method of reading a card or key tag without requiring any physical
contact between the card/tag and the reading device. Click Here for a
description of the operating principle behind proximity.
Proximity Card - A card using proximity technology to store and transmit encoded
data.
Proximity Reader - A reader capable of reading and interpreting cards using
radio frequency identification to encode data.
Push-Button Lock - A lock that opens when a set of push-buttons are pressed in
sequence or in unison.
Q
- no descriptions -
R
Radio Frequency Identification - A method of reading a card using radio
frequency energy to transmit information from the card to a reader. See
Proximity.
RAM - See Random Access Memory.
Random Access Memory (RAM) - Randomly addressable, readable and writable memory
(either volatile or nonvolatile) whose contents may be read or be altered at
will.
Reader - A device that "receives" an identification code from a card, key tag,
magnetic stripe card, bar code card, or related item.
Relay - A device that is capable of opening a normally-closed circuit or closing
a normally-open circuit. When the relay is not energized, the normally-closed
circuit is complete and the normally-open circuit is open. When the relay is
energized, it switches roles, opening the normally-closed circuit and closing
the normally-open circuit. This dual nature of a relay allows for two types of
applications: a device may be attached to the normally-closed circuit so that
the device is always on until the relay energizes to turn it off, or a device
may be attached to the normally-open circuit so that the device is always off
until the relay energizes to turn it on.
Request to Exit (RTE) - A signal that informs the controller that someone has
requested to exit from a secure area.
REX - An acronym for Request to Exit. See Request to Exit.
Read Only Memory (ROM) - Nonvolatile memory whose contents are programmed into
the ROM when the ROM is made, and therefore cannot be altered. ROM is typically
used to store programs and fixed data sets.
Real Time Command - A command that is executed immediately, with no time delay.
RFID - See Radio Frequency Identification.
ROM - See Read Only Memory.
RS-232 - A serial communication protocol used for connecting data terminal
devices. RS-232 is the most commonly used communication protocol.
RS-485 - A serial communication protocol used for multi-drop communication
applications. It is used for higher speed and longer distance communications.
RTE - See Request to Exit.
S
Secure Area - A designated area in which access into and out of is controlled
and can be monitored.
Secure Door - A door in which access through is controlled and can be monitored.
Shielding - Providing electrical isolation for a circuit, component, or wire by
enclosing or isolating the circuit, component, or wire with a metal enclosure,
plate, or foil that blocks any interfering electrical field.
Short Circuit - An unintentional connection that provides a low resistance path
between two points in a circuit or between a point in a circuit and ground. A
Short Circuit can drastically affect the operation of a circuit. If excessive
current flow results from the Short Circuit, a device may be damaged or ruined.
Shunt - 1) Deliberately shorting a portion of an electric circuit. 2) A device
for shorting an electric circuit. See Short Circuit.
Signature Verification - A biometric identification method using a person's
signature characteristics (writing speed, pen pressure, shape of loops, etc.) to
identify that person.
Spike - A voltage peak of high amplitude and short duration. See Transients.
Smart Card - An identification card or access control card with a built-in
integrated circuit chip. This gives the card microprocessor memory and
intelligence to use for storing data. Also Known As - Chip-In-Card.
Suppression - The addition of a device to an electrical circuit that minimizes
or prevents transients from affecting the proper operation of that circuit.
Switch - A device used to either connect or interrupt an electronic circuit.
T
Tailgating - 1) More than one individual entering a secure area using one access
card. 2) Following an authorized person into a secure area. Also Known As -
Piggybacking. See Anti Passback.
Telephone Entry - An access control system that allows users outside a secure
area to use a telephone to contact someone inside the secure area and request
access.
Timezone - A specified period of time in which access is allowed. A variety of
timezones may be defined to accommodate the access needs of a variety of people.
Touchpad - See Keypad.
Transients - Electrical surges or spikes conducted through power or data lines.
Transients are typically generated as electrical devices are turned on or off.
See: Suppression.
Transorb - An electrical suppression device. See: Suppression.
Turnstile - An entryway that uses a mechanical device to restrict entry to one
person at a time.
U
UL - The UL label on a product signifies that the product has met the
Underwriters Laboratories requirements and that the product manufacturer is
authorized to use the UL symbol on their products.
Upload - Sending information from a peripheral device to the host computer in an
access control system.
V
Verification - Identifying an individual based on some type of provided
information. Verification may be done using by methods such as access cards,
biometric information, PIN, etc.
Voice Recognition System - An access control system that verifies a person's
identity by comparing previously stored voice recordings key words or phrases
with the same key words or phrases spoken at the time access is requested.
W
Wiegand Card - An access control card based on the Wiegand effect. Small bits of
specially processed wire are embedded in the card in a pattern that uniquely
identifies the card. This identification information can then be decoded by a
Wiegand reader.
Wiegand Compatible Devices - A propriatary coding format for information used by
many of the suppliers of cards, key tags, proximity readers, magnetic stripe
readers, bar code readers, and related items.
Wiegand Effect - Electrical pulses generated when individual sections of
specially processed magnetic wire is passed by a pickup coil. Each section of
this magnetic wire has its own magnetic field. Depending upon the strength of
the individual magnetic fields, the pickup coil either senses a strong field or
overpowers a weak field, which generates an electrical pulse.
Wiegand Reader - A reader capable of reading the information encoded on a Wiegand card.