5

NEWS

November/December 2008 Card Technology Today

The principle is similar to existing e-bank-ing procedures: a customer wishing to make a purchase online inserts their credit card into the reader and enters the four-digit PIN associated with the card (the same PIN used in stores or at ATMs). If the PIN is correct, the card gener-ates a unique eight-digit number (also known as the SecureCode) which the customer can see on the device’s display. By entering this dynamic SecureCode in place of a static password in the SecureCode window, the transaction can then be validated and payment made. The eight-digit code is specific to the particular transaction and cannot be used any further.

According to MasterCard, by making online bank card payments convenient and as easy as online banking, Chip and Pin credit cards have the potential to give internet sales a further boost. (Internet sales in Europe have already shown considerable growth in the past years, doubling year on year in both 2006 and 2007.).

card technology

Visa announces trials of card with in-built display

Visa Europe has announced that a range of banks will take part in

pilots of a new ISO-compliant credit card that has the ability to generate a one-time code and display it via a built-in alpha numeric display.

The four banks include MBNA (Bank of America company in the UK), Cornèr Bank in Switzerland, Cal in Israel and IW Bank in Italy.

The Visa card allows banks to authenticate consumers through an alpha-numeric display and a 12-button keypad built into a conven-tional credit, debit or prepaid card. The card

I N B R I E F

• The government of Botswana has awarded a contract to Giesecke & Devrient (G&D) for the manufacture and delivery of 150 000 ePassports. G&D will also supply the data acquisition and personalization systems for the travel documents and deliver Botswana’s border control system with card readers. The data will be acquired and processed at 20 local registration points and other mobile stations all over the country. It will take two years to implement the system, with passports sched-uled for issue to the citizens of Botswana from 2010. The contract is worth approximately EUR15 million.

• SMARTRAC has unveiled a range of new products. The new UHF Gen2 card inlay is a ‘Long Range Card Inlay’ which combines the benefits of a durable PRELAM card inlay with the long reading distance of UHF, extending up to several metres. The company has also devel-oped new versions of Durable Dual Interface (DDI) inlays. Merging a contact-based and a contactless interface on one device, these inlays can combine several applications on one card. These new versions are available for highly secure applications such as ID cards, driving licences and social security cards. Other prod-uct developments include an ePassport cover that comes with Chip Activation Protection (CAP) and a thin PC ID-1 inlay. With a strength of 300 microns, the SMARTRAC RFID inlay is suitable for smart ID cards for national use such as ID cards.

• Hypercom has announced that it has pro-vided contactless-enabled payment devices for the successful consumer trial launched recent-ly at Melbourne’s Docklands in Australia. The program allows consumers to make pur-chases by waving their NFC-enabled mobile phones over contactless readers integrated with Hypercom’s Optimum T4200 family of devices. The Australian trial includes 12 merchants and 200 consumers who have configured their phones to support contactless payments by remotely downloading a soft-ware application on their SIM card. The trial will continue for several more months, and is expected to show a high level of consumer acceptance for this means of payment.

• XIRING has presented its latest strong authen-tication solution for online banking and e-commerce. The company claims that, at just 3.5 mm thick and a bank card size, the Xi-Sign 4900 is the slimmest bank card reader currently available on the market. Based on XIRING’s standard technical platform, the Xi-Sign 4900 has the same functionality as all other products in the Xi-Sign range and supports the existing software for the Xi-Sign range.

MasterCard has launched MasterCard Advanced Authentication for Chip - a new EMV authentication solution, for the hundreds of millions of EMV cards in the market that are currently not personalized for the MasterCard Chip Authentication Program.

This new authentication method allows two-factor authentication on the numerous EMV cards already issued in EMV markets, in addition to functions already available for cards which are personalized according to the MasterCard Chip Authentication Program (CAP). Issuers who decide to make strong authentication accessible to their cardholders no longer need to reissue their cards.

Additionally, says MasterCard, the new Advanced Authentication for Chip solution supports issuers in markets where PIN is not used to verify cardholders by making sure that the card is genuinely issued and authenticated through the MasterCard network.

The new product ensures that:

• Standard EMV cards already issued, with or without off-line PIN, are supported regardless of the presence of explicit CAP personalization;

• The large base of EMV cards in issuance without offline PIN can now be strongly authenticated in remote environments;

• Advanced Authentication for chip readers also support cards personalized with CAP ensuring backwards compatibility with implementa-tions already active in the marketplace.

Advanced Authentication for Chip is operated by the cardholder inserting an EMV card into a personal card reader. Once inserted, the personal card reader will perform specific card checks. If the card does not support offline PIN, the reader will immediately display a one-time password. Otherwise cardholders will first be prompted to enter their PIN. Similar to CAP, this one-time password can then be submitted over the internet, phone, and other channels to the issuing bank for verification. The reader can also be used to respond to presented challenges and create unique signatures incorporating transaction data.

The specification underlying Advanced Authentication for Chip governs how the personal card readers will deal with different EMV card profiles and ensures the widest possible acceptance.

In this way, banks that have EMV cards with PIN in the field can now introduce the security of two-factor authentication using chip cards without having to make any changes to their legacy cards. For EMV cards without PIN the solution offers full authentication of the card. This means that EMV cardholders in many more markets can benefit from more secure transactions in e-commerce, ebanking, telephone banking, telephone orders and other interaction points with their banks.

MasterCard launches advanced authentication for chip – negates the need to reissue cards

6

NEWS

Card Technology Today November/December 2008

contains a battery designed to last three years and is the brainchild of EMUE technologies.

Visa Europe says that cardholders will be protected by a secure solution for online shop-ping, when ordering over the telephone or for online banking. When used with Verified by Visa (VbV) the consumer would not need to register or remember usernames and passwords, instead they would enter their PIN into the card which creates a unique code for a specific purchase or transaction.

The card is designed to help in the fight against card-not-present (CNP) fraud in two ways. Firstly, as the one-time code gener-ated is for a specific transaction, once used it cannot be used again by anyone. Secondly a fraudster would need to be able to get hold of a card and know the persons PIN in order to commit fraud.

Sandra Alzetta, SVP, Head of Innovation and New Products at Visa Europe, comments: “The interest in this solution in the industry has been overwhelming and we look forward to working with the banks involved in the pilots to gain greater insights into how effective this solution can be in the longer term.”

The process of validating the transaction is done in three simple steps:

• When shopping online or logging in to an online banking service, the consumer acti-vates the authentication process by pressing the appropriate option button on the card’s keypad;

• When prompted the consumer inputs their standard PIN into the keypad embedded in the card;

• A unique one-time-only code appears on the card’s display panel, which is then used by the consumer to authenticate the transaction

chip

NXP sells 100 millionth ePassport chip

Dutch semiconductor firm NXP claims to have shipped its 100 mil-

lionth ePassport chip in Q3 2008. This landmark was achieved through its participation in more than 80 percent of all ePassport schemes, with 55 out of the 67 countries using its SmartMX chip technology.

In 2005, NXP was the first silicon supplier to have a contactless security chip, the P5CD072, compliant with the BAC (Basic Access Control) requirements from the International Civil

Aviation Organization (ICAO) for ePassports and certified to the Common Criteria (CC) certification level EAL5+ by the German Federal Office of Information Security. In 2007 the company launched a new IC into the SmartMX family, the P5CD080, which became the first EAL5+ certified chip in the industry fully supporting the EAC (Extended Access Control) specification from ICAO.

In September this year, NXP launched its SmartMX P5CD081, in an effort to answer criti-cisms of slow chip performance, especially with more arduous Extended Access Control (EAC) requirements. According to NXP, the chip can now run Extended Access Control (EAC) ePass-port operations with the complete citizen dataset, including fingerprints, in as little as 3.5 seconds.

The new SmartMX also features Secure Fetch Technology, which is designed to enhance the chip hardware security. In particular it protects against attack scenarios with light and lasers (so-called fault attacks).

NXP’s smart chip technology is used in the fol-lowing ePassport schemes (although this is not an exhaustive list due to commercial sensitivities):

• Austria • New Zealand• Bahamas • Lithuania• Belgium • Singapore• Cambodia • Serbia• Czech Republic • Slovenia• France • Spain• Germany • Senegal• Greece • Thailand• Hungary • Turkey• Italy • USA• Macedonia • United Kingdom• Maldives

company news

sQuidcard announces new partnership

SQuidcard has announced a new partnership with Uniwell

Systems (UK). The link up means that Uniwell’s customers are able to accept low cost cashless transactions for the first time, using the sQuid eMoney platform.

“There is a big demand from our customers particularly in the catering, business & indus-try, education and retail sectors to encourage the replacement of cash. Up to now, the bank schemes have not had much impact, but with sQuid we can provide a much better customer experience, deliver improved management infor-

I N B R I E F

• STMicroelectronics has introduced two new product families for cellular-phone SIM cards. The ST32 and ST33 smart card processor families use the ARM Cortex-M3 32-bit processor architecture, and its SC300 secure version, combined with large embedded-Flash memory capacities. All the new devices use ST’s 90 nm embedded Flash technology, delivering increased capa-bilities and smaller chip dimensions. All of the new devices meet industry standards for SIM card interfaces and communication, including ISO 7816-3.

• A display card capable of being manufac-tured on a high-volume industrial scale has been launched by Giesecke & Devrient (G&D). The six-digit display is incorporated in the card during the normal hot-lamina-tion process, thereby augmenting its resist-ance to mechanical wear. G&D’s GDC4000 display card can be used to display one-time passwords (OTPs) for secure authentication during access to IT networks, or transaction numbers (TANs) for online banking. G&D has chosen Aveso to supply the display tech-nology. The finished card corresponds to the standard ISO ID1 format and is not thicker than usual types of credit card.

• The French public printing office, Imprimerie Nationale, has selected Gemalto’s person-alization solution for France’s new biometric passports. The Coesys Issuance personaliza-tion solution prepares the data that will be incorporated into the biometric pass-port and generates the security keys directly at Imprimerie Nationale’s premises. The Gemalto solution also handles the secure loading of all individual data into each pass-port and performs complete management of this data. Five pilot regions (Nord, Oise, Aube, Gironde and Loire-Atlantique) will start issuing the new biometric passports this year. Imprimerie Nationale, which currently issues around 3 million passports per year, will gradually replace existing documents.

• ICICI Bank, India’s largest private sector bank, has awarded a contract to Bell ID to provide its smart card management software to manage globally issued EMV cards and multi-application cards. The bank expects to benefit from a system that will include the issuance of multi-application cards, post issuance personalisation, loading of added value card applications and dynamic EMV risk management on cards (EMV script-ing). e-Smart Systems, Bell ID’s partner in India, will provide the implementation and offer support services locally.