antonio d’albore editor-in-chief embedded security … rise of biometric cards ... cavity milling...

The Rise of Biometric Cardsstate of the art and future challenges for card manufacturers

Antonio D’AlboreEditor-In-ChiefEmbedded Security News

5-6 October 2017

Milan - Italy

Agenda

• Fingerprint Consumer Acceptance Timeline

• What is a Biometric Smart Card?

• Template-On-Card

• Match-On-Card

• Biometric System-on-Card

• Biometric Card Applications

• Anatomy of a BSC

• Fingerprint Card Key Manufacturing Steps

• Fingerprint Card Personalization

• Fingerprint Cards Value Chain

• Key Trials / Pilots

• Key Companies

• The Offer

• Global BSC Shipment Forecast Y2017-2020

• Global BSC ASP Forecast Y2017-2020

• Normative References

• Fingerprint Cards Acceptance Factors

• Fingerprint Cards Potential Blocking/Risk Factors

• The Future

• Q&A

5-6 October 2017

Milan - ItalyThe Rise of Biometric Cards | state of the art and future challenges for card manufacturers | by Antonio D’Albore | Embedded Security News 2

Fingerprint Consumer Acceptance Timeline

Siemens and Triodata develop phone prototype with fingerprint sensor.

1998 2000

Sagem launch MC 959 ID, phone with STM fingerprint sensor

2011

Apple file Patent “Devices and Methods for Providing Access to Internal Components” (US20120258773A1)

2012

Apple buys AuthenTec for $356M

2013

Apple launch iPhone 5S

5-6 October 2017


What is a Biometric Smart Card?

A Biometric Smart Card (BSC), Fingerprint Card orBiometric System-on-Card (BSoC) is a Smart Card where:

• Biometric sample capture (enrolment / verification)

• Minutiae Template extraction• Template storage• Templates matching

is performed within the card.

A BSoC shall never transfer any biometric sample and biometric reference data to any external terminal.

5-6 October 2017


PotentialMan-in-the-Middle

Attach

Matching

FingerprintAcquisition

BiometricTerminal

Transfer toMatchingSystem

MatchResult


Attach

Enrolment

Transfer toSmart Card

Template Stored in Secure Element


TemplateCreation

Template-On-Card (TOC)

5-6 October 2017



Attach

Enrolment


TemplateCreation


Template Stored in Secure Element


Attach

Match-On-Card (MOC)

5-6 October 2017


Matching


BiometricTerminal


MatchResult

Enrolment

Fingerprintacquisition

In-Card templatecreation

Template stored in Secure Elementor Secure Flash

Matching

Fingerprintacquisition

In-Cardtemplatecreation

Match result

In-Card templatesmatching

Biometric-System-on-Card (BSoC) (1/2)

5-6 October 2017


Extract

Measurement

QueryTemplate

Biometric-System-on-Card (BSoC) (2/2)

5-6 October 2017


CapturePre-

ProcessingFeature

ExtractionTemplate Creation

Reference template

Compare Matching

Adaptive Score

decision

Authenticate

Enrolment

Authentication

Biometric Card Applications• Identity Verification

• Proof of life• Government Ration/Subsidy Card• Driving License• Loyalty / Membership

• Secure Access• Door entry• System Login

• Online transaction• Online Gaming• Online Voting

• Healthcare & Insurance• Government Healthcare cards• Health Insurance Cards

• Financial• Debit / Credit Cards• eCommerce

Enabler of three-factors (3FA) authentication

Something I haveCARD

Something I knowPIN

Something I amFINGERPRINT

5-6 October 2017


Anatomy of a Biometric Smart Card (BSC)

5-6 October 2017


Back Side Overlay

Anatomy of a BSC: the components

Back Side Layer

Inlay

Front Side Layer

Front Side Overlay

Micro module

Fingerprint sensor

Sensor Bezel

5-6 October 2017


Anatomy of a BSC: Card Body

Card bodyConstruction

- Industry’s choice for mass production- Use existing production process- Additional step for FPS cavity making

Hot LaminationNon-Moulded

card body

Cold Lamination

Mouldedcard body

Non-Moulded card body

- Ok for prototyping / small volumes- Can be manual labour intensive- Popular in Taiwan / South Korea- Not necessarily cheaper than HL

5-6 October 2017


Anatomy of a BSC: The Inlay

SE Contacts Pad

Antenna

Status LEDs

FPS Contacts Pad

Display Driver IC

Display

Battery / SC

Buzzer

Power Button

Passive Components

MCU / ASIC

RF IC

FPS Controller IC

Secure FlashFlexible PCB

5-6 October 2017


Inlay size is 1 – 2 mm (0.04 - 0.07 in) smaller than card W / HSome BSC Integrators deliver inlays with FPS already embedded

Anatomy of a BSC: Operative Strategies


IC Power Supply

Power is supplied to SE only after successful fingerprint verification. No successful verification = no ATR.


APP Status

The terminal check APP status. Default APP state = Disabled. After successful fingerprint verification APP state = Enabled.


ATR ATR

Double ATR

Terminal checks for a 2° ATR to occur within a predefined number of clock cycles. If Fingerprint verification after the first ATR fails, then the second ATR is not sent.

5-6 October 2017


Anatomy of a BSC: Power Supply (1/2)

With Replaceable Battery

With Rechargeable Battery+

Energy Harvesting

With Rechargeable Battery+

Chip Contact

With Non Rechargeable Battery

With Battery

No Battery+

Energy Harvesting

No Battery+

Chip Contact

Without Battery

No Battery +

Supercapacitor (SC)

In some contexts SC are considered Rechargeable Batteries

5-6 October 2017


Anatomy of a BSC: Power Supply (2/2)

• Flat, printed Lithium Ion batteries are easy to implement but can create issues:

• Card heating

• Transport issues (Air, Courier)

• In some countries, treated as “Dangerous Goods”

• In some countries, subject to certification

• Supercapacitors (SC) often used in Energy Harvesting BSC for short-term energy

storage.

• BSC without battery requires card reader / NFC reader for enrolment.

• Replaceable batteries used in Non-ISO card (thickness) for Access Control applications.

5-6 October 2017


Anatomy of a BSC: FPS Cavity Making

5-6 October 2017


Suitable for mass production

Require modification to chip cavity milling equipment

Mechanical Milling

Most popular method for cavity making

Color change issue with PVC / PETG

Good results on PC

Technique under development

Laser Milling

Very precise

Smooth and clean cavity

No debris removal

Injection Moulding

Complex industrialization for mass production

Chip and FPS sensor cavity are created during injection

Cavities punched out from PVC sheet

Operation performed after sheet printing

Sheet Punching

Requires precise alignment of lamination sandwich

Suitable for mass production

Anatomy of a BSC: Swipe vs Area Sensors

Generate large Image

Problematic torsion/bending testSwipe

Sensors

Unreliable in many applications

Significant learning curveSmall footprint

Easy bonding to FPCB

AreaSensors

Accurate Subject to scratches

Large footprintEasy to use

Flexible are ideal for smart cards

5-6 October 2017


Anatomy of a BSC: Key Sensor Makers

Elan Microelectronics Fingerprint Cards Flexenable

IDEX Infinity Electronic Biotech Innolux Next Biometrics

5-6 October 2017


Datang Microelectronics

Anatomy of a BSC: Area Sensors

• Average thickness ~ 0,3 mm (0.011 in)

• Full fingerprint scan ~ 1 sec

• 1.8 ÷ 3.3 V operations

• Resolution ≥ 500 dpi (sensors with lower resolution compensate with larger active area)

• Output 8 bit, 256 grey scale values

• Wakeup upon touch (few ms wait)

• Read fingerprint from any angle

• Protective coating to increase durability

• ESD Protection ±15 kV (IEC 61000-4-2)

• Durability ≥ 1 M touches

• Some models include Bezel into their design

• For mass production shall be delivered in Super 35 mm Tape format

5-6 October 2017


Anatomy of a BSC: Bezel

Cover sensor bonding pads

Aesthetic

Cover sensor cavity walls

Bezel, when present, have Operative and Aesthetic functions:

Must be flexible enough to comply with dynamic torsional stress of ISO/IEC 10373-1

5-6 October 2017


Electrically drive the fingertip during the sensing process

Help keep sensor in place

Operative

ESD protection

Protect sensor from environment

*

*For bezel not embedded into sensor design

Anatomy of a BSC: Cross Section

Card bodyFingerprint Area Sensor

5-6 October 2017


Gap between card front surface and sensor active surface:

• Reduce FPS wear & tear• Avoid contact with plate during lamination

For sensors mounted on Inlay before lamination

*

*FPS Bezel

Bezel should not extend over card surface to avoid scratches

Anatomy of a BSC: MCU / ASIC

• ARM Cortex M4, 32bit RISC de facto standard as general purpose MCU

• Perform Template Match when this is not done by SE

• Coordinate/control BSC components

• Most BSC makers are designing their own ASIC:

• Integrate FPS IC + MCU + Flash + RF IC.

• Cheaper when manufactured in volume.

• Easier to integrate (less components).

• Will drive inlay cost down.

• Can be done only when product with generic MCU

reach maturity.

• Time-to-Market 18-24 months.

5-6 October 2017


Anatomy of a BSC: RF IC

• The RF IC perform multiple tasks:

• Harvest power from RFID excitation field

• Voltage Regulator

• Clock Generator / Clock Regulator

• Reset Generator

• Anti-collision mechanism

• Distribute power supply to both SE + BSC MCU/ASIC + FPS

• When present, charge Rechargeable Battery or

Supercapacitor

5-6 October 2017


Anatomy of a BSC: Led / Buzzer / LCD

Other elements that can be present on a Biometric Card:

LED

Buzzer

Flexible LCD / e-paper

Ensure compliance with ISO/IEC 17839-1:2014 - Biometric System-on-Card --Part 1: Core requirements

5-6 October 2017


BSC Contactless Interfaces / Transponders ICs

ISO 14443 Type A, B, C

NFC

Bluetooth

HID 125 kHz / HID iClass

Mifare Classic / DESFire EV1

Legic Advant

Atmel 5577

Popular on BSoC Access Cards

5-6 October 2017


Anatomy of a Fingerprint Card: Making of FPCBFPCB

Copper Plating

Laser Drill

Line Formatting

AOI & PSR

Gold Plating

Marking

SMD / COF

Solder Paste

Mount

Reflow

Prelam / Packaging

Placement on Template

Inlays Packing

Sensor mount on Inlay

Sheets Packing

Prelam sheets making

Inlays Packing* *Delivery also possible as prelam Sheets

5-6 October 2017


Flexible PCB often made of polyimide

Bonding

Single steps when bezel is integrated into FPS design

Fingerprint Card Key Manufacturing Steps

Sheets PrintingSheet FPS Cavity

PunchingLayers Collation

Sheets Lamination

Sheet Punching

Cards GatheringMicromoduleCavity Milling

MicromoduleEmbedding

FPS Cavity MillingAnisotropic

conductive epoxy on contact pads

cavity walls coated with

adhesive epoxyFPS Embedding Bezel Placement

5-6 October 2017


FPS embeddedafter lamination

FPS embeddedbefore lamination

Fingerprint Card Personalization

EmbossLaser engraving Direct-To-Card

Overlaminate

Overlay

Sensor bezel / card thickness can potentially create interference / jam in personalization equipment

Inkjet

Rear Indent

Front Indent

5-6 October 2017


Retransfer

Fingerprint Cards Value Chain

BIOMETRIC CARDSOLUTIONPROVIDER

IPs

The Biometric Card Solution Provider can design Biometric Engine, ASIC and Inlay in house.

SensorManufacturer

ASICFoundry

SensorDesigner

Inlay Manufacturer

ASICDesigner

BiometricEngine Designer

MCU / RF ICs Supplier

5-6 October 2017


Inlays / Prelams

Sensors

APIs

Dev. Tools

Test Tools

Enrolment SW

Delivery

CardManufacturer

IP Licenses

Key Trials / Pilots2014Sparebanken DINNorwayZwipe + MasterCard

Payment 2017Pick n PaySouth AfricaOT-Morpho + MasterCard

2017Absa BankSouth AfricaOT-Morpho + MasterCard

2016BundesdruckereiGermany

Access Control

2015Danske BankDenmarkZwipe + MasterCard

2017Woori BankSouth KoreaKorea Smart ID

Online Authentication

2017Instanbul MunicipalityTurkeyKorea Smart ID

Applications

2017Bulbank BankBulgariaOT-Morpho + MasterCard

2015BattistolliItalyCard-Tech + IngenicoIdentification

5-6 October 2017


2017Pleinair CasinoFranceMeReal Biometrics

2017United NationsSwitzerlandKSID + Elan + Jinco

2017AirPlusGermanyKona I + FPC

Key Companies: CardLab ApS

2003

Founded

Denmark

HQ

Private

Type

Frank Sandeløv

CEO

• Strong IP Portfolio focusing on Powered Smart Cards• Partnership with QuardLock for development of a OTP BSoC• 50K€ funding by EU under Horizon 2020 project• Own development of minutiae algorithm• Trials in USA and UAE• Hot laminated products under industrialisation (Thailand), expected launch Q1/Y2018• Key Products:

• Non-rechargeable battery dual interface BSC inlay and cards• Non-rechargeable battery contactless NFC BSC inlay and cards• Inlays with multiple items: fps + display + dynamic magstripe + led

Cardlab.com

WEB

5-6 October 2017


Key Companies: Card-Tech S.r.l.

2006

Founded

Italy

HQ

Private

Type

Fabrizio Borracci

CEO

• PinKey Smart, BSoC with swipe sensors, launched Cartes Y2014• Holds patents on In-Card biometric verification• Manufacturing partnership with top-tier card vendor• Partnership with IDEX for sensors, sensor embedded on inlay• No bezel• Template Matching on smart card chip• Key Products:

• Contact BSC inlay• Dual Interface Energy Harvesting BSC inlay (under development)

card-tech.it

WEB

5-6 October 2017


Key Companies: Datang Microelectronics

1996

Founded

China

HQ

Private

Type

Yanhui Yang (杨延辉)

CEO

• Belonging to Datang Telecom Technology, a State owned 3.3B$ industrial group• China largest design house + foundry for Smart Card ICs• In-house development + production of Capacitive Area and Swipe sensors• In-house development + production of MCU + RF Chip• In-House development + production of flexible BSC inlays• China strongest company in smart card-related development• Key Products:

• Contact BSC with rechargeable battery• Dual Interface BSC with rechargeable battery• Access Control BSC (rechargeable battery)

dtm.com.cn

WEB

5-6 October 2017


Key Companies: Jinco Universal Co. Ltd.

HQ Type CEO

• Asia’s strongest OEM/ODM of customized powered smart cards / inlays• Partnership with Korea Smart ID (KSID) for Card Production• Partnership with Elan Microelectronics for sensors• Strong promotion in South Korea / China / Taiwan / South East Asia• Specific patents on BSoC• Working on retina recognition smart card (patented)• Key Products:

• Contactless BSC with rechargeable battery• Dual Interface, energy harvesting BSC• Dual Interface, rechargeable battery BSC with dynamic magstripe and display

WEB

5-6 October 2017


Founded

2005 Taiwan Private Ted Lin (林武旭) Jinco.com.tw

Key Companies: Mereal Biometrics Ltd.

2009

Founded

Hong Kong

HQ

Private

Type

Philippe Blot

CEO

• Investment by French Groupe Partouche (Casino, Hotel, Events)• Co-founded by Philippe Blot (UINT CEO)• Patented Acoustic / RFID OTP transmission to terminal• Sales & Marketing base in Hong Kong• UINT Limoges (France) engineering & manufacturing plant• Current production capacity ~250K cards / month• Key Products:

• Dual Interface, rechargeable battery BSC with Swipe Sensor• Dual Interface, rechargeable battery BSC with Area Sensor from FPC• Contactless Portable Charger

merealbiometrics.com

WEB

5-6 October 2017


Key Companies: MoriX Co., Ltd.

2005

Founded

Japan

HQ

Private

Type

Morihiko Kubota(久保田守彦)

CEO

• Partnership with Toshiba Solutions Corp.• Selling Cards & Fingerprint Sensors• In-house Fingerprint Matching algorithm development• COF Sensor Co-developed with ASD: 508 dpi, 9.4 x 11 mm active area• NFC BSC under development• Key Products:

• BSC contact with non-rechargeable battery• BSC contact with display and non-rechargeable battery• Fingerprint Sensor module

morix-ic.com

WEB

5-6 October 2017


Key Companies: Tactilis Pte

2014

Founded

Singapore

HQ

Private

Type

Michael Gardiner

CEO

• Firm founded by industry seasoned professionals• Privately funded• Exclusive, patented manufacturing process• Fully equipped plant in Penang, Malaysia• Offering BSC Inlays & complete cards• Supporting a tier-one card vendor• Integrate secure flash up to 4GB• Low profile communication strategy• Key Products:

• Dual interface, energy harvesting, BSC with large area sensor card + inlay

tactilisltd.com

WEB

5-6 October 2017


Key Companies: Zwipe AS

2009

Founded

Norway

HQ

Private

Type

Kim Kristian Humborstad

CEO

• Strongest IP Portfolio for Biometric solutions with >50 patents• Kuang-Chi Group partner for China JV and 20.1% stake• First company to have trials with MasterCard• Inlay-based solution tailored for card manufacturers• Sensor agnostic solution, currently delivering FPC FPS• Ongoing development of custom ASIC to reduce components + costs• Key Products:

• Access Control BSC (non-ISO, replaceable battery) • Contactless Energy harvesting BSC (ID) • Dual Interface Energy Harvesting BSC inlay (Payment)

zwipe.no

WEB

5-6 October 2017


The Offer: Whom is Offering What

5-6 October 2017


Non-Rechargeable

Battery

Rechargeable Battery

+Chip Contact

Rechargeable Battery

+Energy

Harvesting

No Battery+

Chip Contact

No Battery+

Energy Harvesting

Replaceable Battery

CardLab ✓ ✓

Card Tech ✓ ✓

Datang Microelectronics ✓ ✓ ✓

Jinco Universal ✓ ✓ ✓ ✓ ✓ ✓

MeReal Biometrics ✓

Morix

Tactilis ✓

Zwipe ✓ ✓ ✓

The Offer: Tier 1 Company Developments

5-6 October 2017


Gem

alto •Ongoing

Industrialization in France & Germany R&D / plants

•Marketing activity started

•Expected Launch Q1/2018

Idem

ia •First among top card vendors to have completed industrialization

•BSC in production

•Leverage Morphoexpertise in biometric

•Active joint promotion with MasterCard

• In-house inlay production, no OEM sell

•Current solution with non-rechargeable battery

G+D

•Not aware of any development

•Could continue development of BundesdruckereiGoID! fibrecomposite card if migrated to Veridosportfolio

Ko

rea

Smar

t ID

(K

SID

) •So far, KSID is the company with the largest quantity of Biometric Cards produced

•Key Customers:

•UN

• InstanbulMunicipality

•Woori Bank

Global BSC Shipment Forecast Y2017-2020

0

100

200

300

400

2017 2018 2019 2020

18

90

250

400M

illio

n o

f ca

rds

Source: ABI Research, Fingerprint Cards, Gartner, HIS, Nilson Report, Precise Biometrics, Statista, Carnegie Research, Strategy Analytics, Swedbank, Antonio D’Albore estimates.

5-6 October 2017


Global BSC ASP Forecast Y2017-2020 (K pieces)

5-6 October 2017


$-

$2

$4

$6

$8

$10

$12

$14

$16

$18

$20

2017 2018 2019 2020

Clamshell BSC

Battery BSC

No battery BSC

Normative References

Standards developed by Technical Committee ISO/IEC JTC 1/SC 17 Cards and personal identification

The current area of work for JTC 1/SC 17 consists of: • Identification and related documents • Cards, and • Security devices associated with their use in inter-industry

applications and international interchange

Details at https://www.iso.org/committee/45144.html

5-6 October 2017


https://www.iso.org/committee/45144.html


Type S1 “conventional”

Dimensions ID-1 as ISO/IEC 7810

Torsion and bending as ISO/IEC 7816-1

Contact interface as specified in ISO/IEC 7816-3

USB interface as specified in ISO/IEC 7816-12

Contactless interface as specified in ISO/IEC 14443

Type S2 (ID-T) “ticker” – NEW FORMAT

Card is 2.5 mm (0.098 in) thick

2.5 mm thick card cannot be inserted in card slot by mistake

Width / height as an ISO/IEC 7810 card

Need not conform to ISO/IEC 7816-1 flexibility

Supports only ISO/IEC 14443 contactless interface

Regardless of S1 or S2, a BSC must have some form of feedback mechanism such as LCD display, LED or buzzer

ISO/IEC 17839-1:2014 - Biometric System-on-CardPart 1: Core requirements

5-6 October 2017



The minimum size of an area sensor shall be 169mm2

(13 × 13 mm or 0.512 × 0.512 in)

Allows fingerprint sensor, voice microphone, camera for facial image, signature input pad

In the case of a swipe sensor, the effective area of fingerprint capture is bigger than the sensor size. A swipe sensor shall have a minimum width of 13 mm (0.512 in)

ISO/IEC 17839-1:2014 - Biometric System-on-CardPart 1: Core requirements

5-6 October 2017



ISO/IEC 17839-3:2016 covers:• Commands and data structures• Internal Enrollment and External Enrollment• Initiation of verification• Status feedback• Processing time management and extension• Capability discovery mechanism

ISO/IEC 17839-3:2016 - Biometric System-on-Card --Part 3: Logical information interchange mechanism

5-6 October 2017



• ISO/IEC 24787:2010 - On-card biometric comparison

• ISO/IEC TR 30117:2014 - Guide to on-card biometric comparison

standards and applications

• ISO/IEC 18584:2015 - Conformance test requirements for on-

card biometric comparison applications

Other ISO TS / TR

5-6 October 2017



Focus on EMV® 2nd Generation Specifications

• EMV 2nd Generation Specifications in progress:

• Biometric Terminal effective from Jan 1, 2018

• Biometric Card in progress, next meeting Paris Nov. 2017

• EMV 3-D Secure 2.0

• Specifies use of multiple options for step-up authentication, including biometrics

Visa, MasterCard and Amex have updated their Payment Applet specs

allowing Fingerprint Verification to be used as PIN alternative.

5-6 October 2017



Payment service (PSD2) – Directive (EU) 2015/2366

• It provides the legal foundation for the further development of a better integrated internal market for electronic payments within the EU.

• It puts in place comprehensive rules for payment services with the goal of making international payments (within the EU) as easy, efficient and secure as payments within a single country.

• Requires Strong Customer Authentication, using at least two independent elements categorized as:

5-6 October 2017


Something I haveCARD

Something I knowPIN

Something I amFINGERPRINT

INHERENCEPOSSESSIONKNOWLEDGE


ICAO Doc Series 9303 – Machine Readable Travel Documents

• ICAO – Doc 9303 – Part 9: Deployment of Biometric Identification and Electronic Storage

of Data in eMRTDs

• ICAO – Doc 9303 – Part 10: Logical Data Structure (LDS) for Storage of Biometrics and

Other Data in the Contactless Integrated Circuit (IC)

Focus on storage / format / interoperability of biometric data into eMRTD.

No references to BSoC.

5-6 October 2017


Fingerprint Cards Acceptance Factors

CONSUMERS

Familiarity with smart cardsFamiliarity with smartphones

Increasing acceptance for new technologiesSlow acceptance of mobile payments

LEGAL

Compliant with most regional / national legal frameworks demanding biometric data not to be

stored in public DB.EU GDPR effective May 2018 prohibits processing

of “Biometric Data”

INDUSTRY

Need to reduce Card-Present FraudImprove Identification / Verification processes

Growing focus on Safety/Security of physical assetsMinor or no infrastructure upgrade cost

Rising immigration control & MRTD verification

HEALTH

Risk of infection transmission with standalone Fingerprint scanner (rotavirus, norovirus, hepatitis

A virus, respiratory syncytial virus, rhinovirus, influenza virus, Shigella dysenteriae,

Enterohemorrhagic Escherichia coli, etc.)

5-6 October 2017


Fingerprint Cards Potential Blocking/Risk Factors

• Rejection due to personal reasons.

• Cultural incompatibility.

• Absence of respective biometric feature.

• Insufficient characteristics of the respective biometric feature.

• Abnormal characteristic of the respective biometric feature.

• Criminal organizations might develop techniques to fool fingerprint sensor (liveness

detector, blood detector, etc.).

• Because Biometric features are static, stolen (capture, cloned, forged) biometric cannot

be revoked or changed.

• Challenge to get product working in Hot / Dry / Dirty environment.

• Competing mobile payment technology may impact the smart card market.

5-6 October 2017


The Future

• Vein sensing capability• Blood flow / heartbeat detection• FPS IC + RF IC + MCU integrated into Smart Card Chip• FPS under conductive plastic• Contactless fingerprint• Behavioural biometric• DNA scanner

5-6 October 2017


Thanks!

Antonio D’Albore

Editor-in-Chief

Embedded Security News

[email protected]

+39 392 5198737

@AndongESN

@embedded.sec.news

embeddedsecuritynews.com

56

mailto:[email protected]

References- http://coe.int/en/web/conventions/full-list/-/conventions/treaty/005- http://dhl.it/en/express/shipping/shipping_advice/lithium_batteries.html- http://dmt.com.cn/product/aqkz/zwsb/529.html- http://ec.europa.eu/justice/policies/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf- https://en.wikipedia.org/wiki/Biometrics- https://en.wikipedia.org/wiki/Data_Protection_Directive- https://en.wikipedia.org/wiki/General_Data_Protection_Regulation- https://en.wikipedia.org/wiki/Fingerprint_recognition- https://en.wikipedia.org/wiki/Personally_identifiable_information- https://en.wikipedia.org/wiki/Supercapacitor- http://fingertec.com/download/tips/whitepaper-01.pdf- http://www.gemalto.com/govt/biometrics/biometric-data- http://heritage.org/homeland-security/report/biometric-technologies-security-legal-and-policy-implications- http://horizon2020projects.com/special-reports/technical-information-card-fraud-identity-theft-protection-

technologies/- http://iata.org/whatwedo/cargo/dgr/Pages/lithium-batteries.aspx- https://www.icao.int/Meetings/a38/Documents/WP/wp094_en.pdf- https://www.icao.int/publications/pages/publication.aspx?docnum=9303

5-6 October 2017


https://en.wikipedia.org/wiki/Fingerprint_recognition








https://en.wikipedia.org/wiki/Personally_identifiable_information

https://en.wikipedia.org/wiki/Supercapacitor

http://fingertec.com/download/tips/whitepaper-01.pdf

http://www.gemalto.com/govt/biometrics/biometric-data

http://heritage.org/homeland-security/report/biometric-technologies-security-legal-and-policy-implications

http://horizon2020projects.com/special-reports/technical-information-card-fraud-identity-theft-protection-technologies/

http://iata.org/whatwedo/cargo/dgr/Pages/lithium-batteries.aspx

https://www.icao.int/Meetings/a38/Documents/WP/wp094_en.pdf

https://www.icao.int/publications/pages/publication.aspx?docnum=9303

References- https://www.icao.int/publications/Documents/9303_p9_cons_en.pdf- https://www.icao.int/publications/Documents/9303_p10_cons_en.pdf- http://www.mainguet.org/- https://ncbi.nlm.nih.gov/pubmed/19006507- http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf- http://patentexaminer.org/wp-content/uploads/2011/09/SmartMetric.MC_.2.Complaint_small.pdf- http://patentexaminer.org/wp-content/uploads/2011/09/SMME_v_MasterCard_1.pdf- http://prba.org/wp-content/uploads/IATA-Lithium-Battery-Guidance-2017-1.pdf- https://www.sec.gov/Archives/edgar/data/1301991/000114420415058083/v421136_ex10-8.htm- https://scribd.com/doc/316791717/Special-Report-Biometrics-and-Border-Security- https://uni-kassel.de/fb07/fileadmin/datas/fb07/5-Institute/IWR/Hornung/isse_2004_47-

57_biometric_identity_cards.pdf- https://ups.com/media/news/en/ca/intl_lithium_battery_regulations.pdf- https://www.youtube.com/watch?v=jw_4uaRNsBA&t=1228s- https://www.youtube.com/watch?v=VESg5mPWk34&t=21s

5-6 October 2017


https://www.icao.int/publications/Documents/9303_p9_cons_en.pdf

https://www.icao.int/publications/Documents/9303_p10_cons_en.pdf

http://www.mainguet.org/

https://www.ncbi.nlm.nih.gov/pubmed/19006507

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf

http://patentexaminer.org/wp-content/uploads/2011/09/SmartMetric.MC_.2.Complaint_small.pdf

http://patentexaminer.org/wp-content/uploads/2011/09/SMME_v_MasterCard_1.pdf

http://www.prba.org/wp-content/uploads/IATA-Lithium-Battery-Guidance-2017-1.pdf

https://www.scribd.com/doc/316791717/Special-Report-Biometrics-and-Border-Security

https://www.scribd.com/doc/316791717/Special-Report-Biometrics-and-Border-Security

https://www.uni-kassel.de/fb07/fileadmin/datas/fb07/5-Institute/IWR/Hornung/isse_2004_47-57_biometric_identity_cards.pdf

https://ups.com/media/news/en/ca/intl_lithium_battery_regulations.pdf

https://www.youtube.com/watch?v=jw_4uaRNsBA&t=1228s

https://www.youtube.com/watch?v=VESg5mPWk34&t=21s

ReferencesStruif, B.: Use of Biometrics for User Verification in Electronic Signature Smartcards. In: Attali, S., Jensen, T. (eds.) E-smart 2001. LNCS, vol. 2140, pp. 220–227. Springer, Heidelberg (2001)

Murdoch, S.J., Drimer, S., Anderson, R., Bond, M.: Chip and PIN is broken. In: 2010 IEEE Symposium on Security and Privacy (2010)

Biometric Application Programming Interface (API) for Java Card, NIST/Biometric Consortium Biometric Interoperability, Assurance, and Performance Working Group, version 1.1 (August 2002)

Henniger O., Nikolov D. (2013) Extending EMV Payment Smart Cards with Biometric On-Card Verification. In: Fischer-Hübner S., de LeeuwE., Mitchell C. (eds) Policies and Research in Identity Management. IDMAN 2013. IFIP Advances in Information and Communication Technology, vol 396. Springer, Berlin, Heidelberg

Privacy-preserving biometric authentication: challenges and directions, Elena Pagnin, Aikaterini Mitrokotsa Chalmers University of Technology Gothenburg, Sweden (2017)

“EMV integrated circuit card specifications for payment systems – Book3: Application specification,” Version 4.2, June 2008.

Encyclopedia of Biometrics, Stan Z., Anil K. Jain, Springer Reference, ISBN: 978-3-642-27733-7

Anil K., Arun A. Ross – Introduction to Biometrics, Springer, ISBN: 978-0387773254

Nicholas M. Orlans John D. Woodward Jr., Peter T. Higgins – Biometrics, McGraw Hill Professional, ISBN: 978-0072222272

5-6 October 2017


SpecsISO/IEC 7816-4:2013 Identification cards – Integrated circuit cards – Part 4: Organization, security and commands for

interchange

ISO/IEC 7816-11:2014 Identification cards – Integrated circuit cards – Personal verification through biometric methods

ISO/IEC 9797-2:2011 Information technology – Security techniques – Message Authentication Codes (MACs) – Part 2:

Mechanisms using a dedicated hash-function

ISO/IEC 17839-2:2015 Biometric System-on-Card: physical characteristics

ISO/IEC 18033-2:2006 Information technology – Security techniques – Encryption algorithms – Part 2: Asymmetric ciphers

ISO/IEC 18033-3:2010 Information technology – Security techniques – Encryption algorithms – Part 3: Block ciphers

ISO/IEC 19092:2008 -- Financial services -- Biometrics -- Security framework

ISO/IEC 19785-3 Information technology – Common Biometric Exchange Formats Framework – Patron format specifications

ISO/IEC 19794-1:2011 - Information technology -- Biometric data interchange formats -- Part 1: Framework

ISO/IEC 19794-2:2011 - Information technology –- Biometric data interchange formats –- Part 2: Finger minutiae data

ISO/IEC 19794-2:2011/Cor 1:2012 - XML encoding and clarification of defects

ISO/IEC 19794-2:2011/Amd 1:2013 - Conformance testing methodology and clarification of defects

ISO/IEC 19794-2:2011/Amd 2:2015 - Conformance testing methodology and clarification of defects

ISO/IEC 19794-3:2006 - Information technology -- Biometric data interchange formats -- Part 3: Finger pattern spectral data

ISO/IEC 19794-4:2011 - Information technology -- Biometric data interchange formats -- Part 4: Finger image data

ISO/IEC 19794-5:2011 - Information technology -- Biometric data interchange formats -- Part 5: Face image data

ISO/IEC 19794-6:2014 - Information technology -- Biometric data interchange formats -- Part 6: Iris image data

ISO/IEC 19794-7:2014 - Information technology -- Biometric data interchange formats -- Part 7: Signature/sign time series

data

ISO/IEC 19794-8:2011 -- Information technology -- Biometric data interchange formats -- Part 8: Finger pattern skeletal

data

ISO/IEC 19794-9:2011 -- Information technology -- Biometric data interchange formats -- Part 9: Vascular image data

ISO/IEC 19794-10:2007 -- Information technology -- Biometric data interchange formats -- Part 10: Hand geometry silhouette

data

EMV® Specification Bulletin No. 185 - First Edition March 2017 - Biometric Terminal Specification

5-6 October 2017


Patents (1/5)CA 02581230 C Apparatus for fingerprint sensing and other measurements

CN 2010 20665177 非接触式包含指纹辨识的电子智能卡片 (Non-contact intelligent electronic card comprising

fingerprint identification )

CN 2010 20671893 非接触式电子式智慧卡片 (Non-contact electronic smart card )

CN 2015 20355127 智慧卡片指纹按压装置 (Wisdom card fingerprint press device)

CN 2016 02176914 U Fingerprint identification smart card

DE 2016 10101609 A1 Authentifikationsvorrichtung, Authentifikationsdokument und Verfahren zur

Authentifizierung einer Person

DE 2016 10201976 B3 Vorrichtung und Verfahren zur Bearbeitung eines Substrats

GB 2012 00019750 D0 Enrolling fingerprints by combining image strips to obtain sufficient width

GB 2013 00004639 D0 Fingerprint sensor

GB 2015 00022870 D0 Biometric smartcard with multiple modes of operation

GB 2015 00008294 D0 Biometric enrolment authorisation

GB 2015 00008296 D0 Contactless biometric identification device allowing multiple configurations

GB 2016 00000892 D0 Low thickness biometric card

GB 2016 00003099 D0 One-time password device

GB 2016 00004138 D0 Apparatus for testing a battery-powered device

GB 2016 00009572 D0 Smartcard and method for controlling a smartcard

GB 2016 00014998 D0 Biometric smartcard for providing feedback to a user

GB 2017 00004847 D0 Callibration method

GB 2017 00006460 D0 Bionetric smartcard

IT 2006 UD00028 A1 Carta Elettronica Universale Personale

IT 2006 UD00046 A1 Metodo Per Realizzare Una Scheda Personale Sicura E Suo Processo Di Funzionamento

IT 2006 UD00075 A1 A method for making a secure personal card and its working process

5-6 October 2017

Milan - Italy61The Rise of Biometric Cards | state of the art and future challenges for card manufacturers | by Antonio D’Albore | Embedded Security News

Patents (2/5)JP 2011 0105750 A ic card with fingerprint authentication

JP 2014 0529123 A Biometric authentication available smart card

JP 2016 0115098 A 指紋認証付スマートカードとこれを用いた決済方法(Smart card with fingerprint authentication and settlement method using the same)

KR 2014 0164109 B1 RF Smart Combi-card Of Fingerprint Type And Dealing Method Thereof

KR 2015 0056437 RF Smart Card Of Fingerprint Type With Battery

KR 2015 0180446 B2 Smart Card Integrated With Thermoelement And Fingerprint Verification Chip As Laminated

Structure

KR 2016 0064133 A Smart Card Comprising Fingerprint Detecting Device And Method For Driving The Same

KR 2016 0090633 A Smart Card And A Fingerprint Recognition System Using Thereof

KR 2016 0125877 A RF Smart Card of Fingerprint Type with Battery

KR 2016 0129832 B1 Fingerprint Smart Card Having A Prevention Function Forged Fingerprint

TW 2010 0009718 A Method of manufacturing secure personal card and manufacturing processes thereof

TW 2016 0029842 A Fingerprint press device for smart card

TW 2016 0202811 U Switch structure of electronic module

5-6 October 2017


Patents (3/5)US 1983 4621190 A Card with an IC module

US 1999 6325285 B1 Smart card with integrated fingerprint reader

US 2004 0129787 A1 Secure biometric verification of identity

US 2005 0178827 A1 Flexible fingerprint sensor arrays

US 2005 0212657 A1 Identity verification system with self-authenticating card

US 2006 0000892 A1 Method for biometric security using a smartcard

US 2006 0000899 A1 Method and system for dna recognition biometrics on a smartcard

US 2006 0113381 A1 Batteryless contact fingerprint-enabled smartcard that enables contactless capability

US 2007 0223179 A1 Fingerprint recognition smart card

US 2007 0228154 A1 System and method for sensing biometric and non-biometric smart card devices

US 2008 0164325 A1 Universal Smart Card

US 2008 0054875 A1 Biometric sensor and sensor panel

US 2008 0040615 A1 Biometric embedded devicer

US 2009 0084858 A1 Method For Making A Secure Personal Card And Its Working Process

US 2012 0241524 A1 Activation and indication of an RF field on a device including a chip

US 2013 0036463 A1 Biometric-enabled smart card

US 2013 0320464 A1 Integrally molded die and bezel structure for fingerprint sensors and the like

US 2015 0049925 A1 Method of manufacturing an electronic card

US 2015 0286855 A1 Fingerprint matching algorithm

US 2015 0371077 A1 Fingerprint recognition for low computing power applications

US 2015 0379250 A1 Secure biometric verification of identity

US 2017 0161528 A1 Smart card systems comprising a card and a carrier

US 2017 0213097 A1 Flexible Card with Fingerprint Sensor

US 2017 0213122 A1 Document with Sensor Means

5-6 October 2017


Patents (4/5)US 2017 0228631 A1 Smartcard and method for controlling a smartcard

US 2017 0262692 A1 Capacitive Fingerprint sensing Device and Methon for Capturing a fingerprint using the

sensing device

USD 693874 S1 Electronic payment card with biometric verification means

USD 776664 S1 Smart card

USD 786355 S1 Smart card with a chip and finger-print sensor

USD 788847 S1 Smart card with a chip and finger-print sensor

USD 791772 S1 Smart card with a fingerprint sensor

WO 1998 052735 A1 Method of making smart cards

WO 2011 083241 A1 Multiple application chip card having biometric validation

WO 2006 080929 A1 Method of making a memory card by injection molding

WO 2013 155040 A1 Smart connect devices for the interconnectivity of data cards with computing devices to

enable the performance of various functions upon authentication by a user's fingerprint

and/or a user's photograph

WO 2013 160011 A1 Method of manufacturing an electronic card

WO 2016 016129 A1 Multi-layer composite for a security and/or value document and method for producing same

WO 2016 055660 A1 Contactless Biometric Identification Device Allowing Multiple Configurations

WO 2016 055661 A1 Biometric enrolment authorisation

WO 2016 055662 A1 Power load management

WO 2016 055663 A1 Power harvesting in a passive rfid device

WO 2016 055665 A1 Self-contained fingerprint identification device

5-6 October 2017


Patents (5/5)WO 2016 160816 A1 Smart data cards that enable the performance of various functions upon

activation/authentication by a user's fingerprint, oncard pin number entry, and/or by

facial recognition of the user, or by facial recognition of a user alone, including an

automated changing security number that is displayed on a screen on a card's surface

following an authenticated biometric match

WO 2016 190678 A1 Smart Card Including Fingerprint Detection Device And Driving Method Therefor

WO 2017 017085 A1 Smart card with main application and persistence application

WO 2017 025479 A1 Security protected passive rfid device

WO 2017 025481 A1 Power optimization

WO 2017 064097 A1 Multiple finger fingerprint authentication device

WO 2017 081268 A1 Value or security document made of a fiber composite material, and method for producing

the value or security document

WO 2017 089216 A1 Identification document and method for identifying an individual

WO 2017 093514 A1 Fingerprint card

WO 2017 093516 A1 Biometric card

WO 2017 102699 A1 Id token having a protected microcontroller

WO 2017 102984 A1 Device

WO 2017 109173 A1 Biometric device

5-6 October 2017


Acronyms2FA Two-Factors Authentication

3FA Three-Factors Authentication

ASIC Application-specific integrated circuit

AOC Authentication On Card

ASP Average Selling Price

BSC Biometric Smart Card

BSoC Biometric System on Cards

CBEFF Common Biometric Exchange File Format

COF Chip On Film

FPC Fingerprint Card

FPCB Flexible Printed Circuit Board

FPS Fingerprint Sensor

JV Joint Venture

MOC Match-on-Card

MCU Micro Controller Unit

NFC Near field communication

OTP One Time Password

PC Polycarbonate

PETG Polyethylene terephthalate

PII Personally Identifiable Information

PSD2 Payment Service Directive

PVC Polyvinyl chloride

RFID Radio-frequency identification

SC Supercapacitor

SE Secure Element

SW Software

TOC Template-On-Card

5-6 October 2017
