2007 Campus Technology Innovators: Campus Cards

• 08/01/07

TECHNOLOGY AREA: CAMPUS CARDS
Innovator: The University of Arizona

Incorporating biometrics with contactless cards to grow a new, secure solution

Considering the caliber of research projects at The University of Arizona, physical security is of paramount importance to ensure that only authorized users have access to restricted, protected, or sensitive areas. Previously, technologists tried to limit access with the CatCard (SmartCentric), the contact/magnetic-stripe card used all over campus. Recently, however, the card program was expanded to include a combination of contactless smart cards and readers with biometric capability.

Though the CatCard is a multi-application card, the new DESFire (data encryption standard fast, innovative, reliable, and secure) contactless cards (also from SmartCentric) have even more functionality and are used to gain access to two new buildings on campus: BIO5 and Medical Research (MRB).Individuals who receive the new cards are being authorized for access into specific buildings and through specific doors, as well as for specific times of day or night, depending upon need. Authorization to receive these cards is stored in a separate database and verified at the time CatCards are issued.

Individuals who require access to BIO5 and MRB present their cards within a few inches of one of the SmartID ISO 14443-4 card readers from Integrated Engineering. For level-one security, once the CatCard is read and validated using DSX access control software from Amer-X Security, access is simply granted. At the next level, the system adds a second factor of authorization, and users must enter a four-digit PIN correctly at the reader keypad, for access. For buildings and doors requiring the highest level of security, the CatCard must be read, and a corresponding finger must be placed on the Integrated Engineering SmartTouch reader, for verification prior to granting access. Importantly, a unique template associated with each fingerprint is generated by an algorithm, and it is this template alone that is enrolled and stored only on that individual's contactless DESFire card. The storage of a proprietary template—and not the actual fingerprint— provides maximum privacy protection.

This privacy is extended and amplified at other points in the process, as well. To wit: Authentication between the stored template and the fingerprint takes place at the reader and only the card number is then transmitted to the DSX software, which determines eligibility for access.

Diane Tatterfield, assistant director of the school's CatCard office, says that in every instance, the system meets current security criteria, maintaining each individual's privacy. This is important for competitive reasons as well as for personal protection. "Higher levels of security facilitate attracting and holding top researchers, faculty, staff, and students," she points out. What's more, she adds, "Card and reader replacement costs are reduced, software upgrades are accomplished without re-carding, and cardholders enjoy a truly all-in-one card."

Interestingly, Tatterfield says the contactless card technology proved to be cheaper than the old-fashioned contact/magneticstripe approach. Technologists who conducted market research prior to the trial deduced that while a magnetic-stripe door-access reader with pin pad costs more than $700, a contactless smart card door-access reader with pin pad rings in at less than $400. With this in mind, the school not only saved money by purchasing the new equipment, but also saved maintenance costs by refreshing the old equipment.

Looking ahead, the university soon will add new features and functionality to its CatCard program easily and without disruption to the campus population. By issuing a Combi smart card, UA is preparing for the eventual migration of 75,000 active cardholders to a contactless smart card (the school also will add hologram lamination and a newer, more versatile magnetic stripe). Technologists will be working with university stakeholders and vendors, to ensure a seamless campus conversion.