2007 Campus Technology Innovators: Campus Cards
TECHNOLOGY AREA: CAMPUS CARDS
Innovator: The University of Arizona
Incorporating biometrics with contactless cards to
grow a new, secure solution
Considering the caliber of research projects at The University
of Arizona, physical security is of paramount importance to
ensure that only authorized users have access to restricted, protected,
or sensitive areas. Previously, technologists tried to limit
access with the CatCard (SmartCentric), the contact/magnetic-stripe card used all over campus.
Recently, however, the card program was expanded to include
a combination of contactless smart cards and readers with
biometric capability.
Though the CatCard is a multi-application card, the new DESFire
(data encryption standard fast, innovative, reliable, and
secure) contactless cards (also from SmartCentric) have even
more functionality and are used to gain access to two new buildings
on campus: BIO5 and Medical Research (MRB).Individuals
who receive the new cards are being authorized for access
into specific buildings and through specific doors, as well as for
specific times of day or night, depending upon need. Authorization
to receive these cards is stored in a separate database and
verified at the time CatCards are issued.
UA is preparing for the eventual migration of 75,000
active cardholders to a contactless smart card.
Individuals who require access to BIO5 and MRB present
their cards within a few inches of one of the SmartID ISO
14443-4 card readers from Integrated Engineering. For level-one security, once the CatCard is read
and validated using DSX access control software from Amer-X
Security, access is simply granted. At the
next level, the system adds a second factor of authorization, and
users must enter a four-digit PIN correctly at the reader keypad,
for access. For buildings and doors requiring the highest level
of security, the CatCard must be read, and a corresponding finger
must be placed on the Integrated Engineering SmartTouch
reader, for verification prior to granting access. Importantly, a
unique template associated with each fingerprint is generated
by an algorithm, and it is this template alone that is enrolled and
stored only on that individual's contactless DESFire card. The
storage of a proprietary template—and not the actual fingerprint—
provides maximum privacy protection.
This privacy is extended and amplified at other points in the
process, as well. To wit: Authentication between the stored
template and the fingerprint takes place at the reader and only the card number is then transmitted to the DSX software,
which determines eligibility for access.
Diane Tatterfield, assistant director of the school's CatCard
office, says that in every instance, the system meets current
security criteria, maintaining each individual's privacy. This is
important for competitive reasons as well as for personal protection.
"Higher levels of security facilitate attracting and holding
top researchers, faculty, staff, and students," she points
out. What's more, she adds, "Card and reader replacement
costs are reduced, software upgrades are accomplished without
re-carding, and cardholders enjoy a truly all-in-one card."
UA'S CATCARD TEAM
implemented contactless
smart cards and readers
with
biometric capability to
meet security criteria while
maintaining individual privacy.
Interestingly, Tatterfield says the contactless card technology
proved to be cheaper than the old-fashioned contact/magneticstripe
approach. Technologists who conducted market research
prior to the trial deduced that while a magnetic-stripe door-access
reader with pin pad costs more than $700, a contactless smart card door-access reader with pin pad rings in at less than
$400. With this in mind, the school not only saved money by
purchasing the new equipment, but also saved maintenance
costs by refreshing the old equipment.
Looking ahead, the university soon will add new features
and functionality to its CatCard program easily and without disruption
to the campus population. By issuing a Combi smart card, UA is preparing for the eventual migration of 75,000 active
cardholders to a contactless smart card (the school also will add
hologram lamination and a newer, more versatile magnetic
stripe). Technologists will be working with university stakeholders
and vendors, to ensure a seamless campus conversion.