The Future of Smart Cards

• By Michael Fickes
• 10/01/00

Smart cards are wising up. In the past, smart cards have failed again and again to find wide application. The trouble is, they arrived too late. Magnetic stripe cards not only appeared first, they proved effective and economical for application after application.

Why complicate things by introducing a costly chip-carrying card requiring new readers and other expensive infrastructure? Until smart cards can answer that question, magnetic stripe cards will rule.

But an answer is coming Ñ from some of the nation’s largest universities. At Pennsylvania State University, students, faculty and staff carry some 100,000 smart cards that provide a variety of services for their holders. The cards identify their owners, purchase soft drinks from vending machines, operate washers and dryers, pay for meals, access locked buildings and rooms, and even pay for merchandise at nearly 500 area stores.

Why not use mag-stripe cards? "Penn State has 26 campuses and thousands of vending sites," says Jack Mapes, director of campus solutions for Schlumberger Smart Cards & Terminals in Moorestown, N.J., which provided the Penn State system. "To wire all those sites back to a host computer for a 75-cent can of soda wasn't cost effective. But smart cards work well with off-line technology."

In practice, a smart card reader on a vending machine can deduct a charge from a cash account recorded on a smart card chip. Later, when the machine is refilled, the service technician can download payment information and send it to the accounting office.

But vending sites are just the beginning. A host of other universities have begun to explore smart card applications related to information security. Wake Forest University in Winston-Salem, N.C., the University of Texas at El Paso, the University of Texas Medical Branch and the University of Illinois in Champaign-Urbana are all developing programs to apply smart cards to the information-age needs of their communities.

The University of Illinois and Schlumberger have been working together on a smart-card pilot project for about a year. Still in the early stages, the program aims to explore ways to move the university’s I-Card services to a smart card. Currently, the mag-stripe I-Card handles 28 services. "We do contracts, assignments, dining services, building and parking lot access, almost everything with the I-Card," says Gary Brinkley, Ph.D., director of business systems analysis for the University of Illinois. "The pilot program was designed to see if it would be possible to use a smart chip to take the I-Card to another level.

"In particular, we want to see if it can take on applications that require security. Can we use these cards to handle digital signatures that will enable a user to sign on-line contracts? Can we use smart cards to enable patients to interact with medical facilities in a secure manner? Can we use this technology to protect distance learning systems from unauthorized access?"

As work proceeded on the pilot, the team concluded that the project had too many parts and postponed the distance learning pilot. "We've decided to focus on medical applications of smart cards for now," Brinkley says. "That project has many elements to it and will allow us to test digital signatures, medical records applications and other uses."

Digital signatures appear to hold the key to expanded uses for smart cards. Before 2000, digital signatures did not carry the force of law. This year, however, Congress enacted a Digital Signature Act, which makes a digital signature as binding as a signature made with a pen. All 50 states have also authorized electronic signatures. Now that lawmakers have dealt with the problem, application developers can proceed without fear that the rules will change.

That's important, considering the complex issues involved in setting up a digital signature system, called PKI or Public Key Infrastructure. "PKI is one of the most secure on-line connections in the industry," Maps says. "At the University of Illinois, we are working to combine PKI with the I-Card." Once that system has been worked out, the project team will integrate a variety of secure medical services with the smart card. Eventually, these services may allow patients to make appointments on-line and even to swipe a smart card at the hospital office to deliver health coverage information.

True smart card benefits will arise when cards begin to offer multiple services. If the University of Illinois pilot bears fruit, for example, a student enrolling for classes would receive a smart I-Card with a photo and a mag-stripe. Some of the existing 28 services currently handled by the mag-stripe would move over to the smart chip. "These would include services that require tighter security," Brinkley says.

Room assignments, for example, involve signing a contract. By moving that function to the smart chip, students would be able to get their room assignment on-line and also to add their digital signatures to the contracts.

The real key to success for smart cards involves the ability to integrate many services onto the cards. Smart cards can cost as much as $15 each, according to Brinkley. Hence, a smart card providing only one or two functions would probably prove too costly for practical use.

A college or university provides an ideal environment for multiapplication smart cards, according to Mapes. "On a grand scale, putting driver's licenses, social security numbers, financial information, medical data and other applications on one smart card would require wide support for a single card," he says. "But on a campus, there's a smaller scale. You have a closed community where costs can be controlled."

The University of Illinois pilot program is taking this a step further, in the hopes that smart cards will not only offer a variety of services, but offer them better.

In short, the university's goal is to teach smart cards a thing or two.