The Dawning of Next Generation Government Electronic IDs (Part II of II)

The use of RFID in government documents will make identification easier, but will also have potential security risks. In the second of two articles, Joseph Pearson, Government Identification Marketing Manager, RFID Systems for Texas Instruments, discusses how technological breakthroughs will protect individuals and their private data.

Access Control and Security

Ever-increasing security demands place pressure on government agencies to deploy stronger levels of security in government-issued credentials. Although large-scale issuance of e-passports began in 2006, preparations are underway to increase security. To accommodate higher levels of security, smart ICs (integrated circuits) contained in these IDs need to scale to hold more data and must have fast transaction speeds to write and read this data.

BAC and EAC in Electronic Passports

The RF-based contactless smart card IC in today's e-passports has a number of security features. One measure is a short reading distance of 10 cm (4 inches) or less between the chip and reader. All current e-passports have Basic Access Control (BAC) security, a criteria developed by the International Civil Aviation Authority (ICAO). The information stored on chips with BAC is the same as on the printed data page, plus the digital photo. BAC requires that the machine readable zone on the data page be read electronically by the reader first to unlock the chip. Once the chip is unlocked, it then transmits the passport's number, individual's birth date and photo to the reader. The data is sent via encrypted communication, minimizing the risk of eavesdropping  intercepting the electronic information that moves between the chip and reader  and skimming, or obtaining data from the passport holder surreptitiously.

Efforts are underway to increase e-passport security, ensuring the passport holder is the credential owner. This requires more sensitive information than a photo, such as fingerprint or iris biometrics, be added to the chip. ICAO recommends the use of Extended Access Control (EAC) to protect fingerprints and other sensitive biometric data such as iris scans. As of November 1, 2007, Germany became the first European Union country to begin rolling out second generation e-passports with fingerprint data. The new e-passports will incorporate two fingerprint images on the chip. European Commission regulation EC 2252/2004 calls for the incorporation of fingerprint data on European Union e-passports by June 28, 2009.

EAC performs BAC, plus smart IC authentication and terminal authentication. Smart IC authentication is the act of proving the smart IC is genuine to protect e-passports from cloning, while terminal authentication is the act of proving that a reader is a genuine reader, ensuring the e-passport's chip will not provide its information to an unauthenticated reader.

The complexity of the infrastructure to support secondstage biometric data and EAC places greater demands on smart ICs; they need increased memory capability, faster processing power and new levels of security. The amount of data required for EAC will have an impact on productivity when e-passports are personalized. Personalization time for EAC will increase using chips with electronically erasable programmable read-only memory (EEPROM) and Flash memory, as almost twice the data will need to be written to the chip for two fingerprints. The chip must be read to verify the data after it is initially written, further adding to increased production time. In addition, doubling the amount of data read from the IC to authenticate the e-passport holder's identity will increase inspection times at border checkpoints.

Government IDs Require Smart ICs

First generation e-passports marked the beginning of the migration away from a paper-based document. Future versions, with fast write and read times and more memory, could efficiently employ additional functionality such as entry/exit location information and electronic visas, which can be written to the IC on the fly. This electronic-based data provides increased protection at the border by giving inspectors access to an instantaneous history of where the person has been, or flagging them if a person's visa is expired. Data on an e-passport, when properly secured, has the advantage of being less susceptible to fraud than hand stamping, and using a capable secure smart IC will not slow border inspection.

National citizen and governmental agency ID cards may hold multiple applications. After credentials are issued, linking additional applications requires new data be written to them. For example, if the health services agency issues a smart card to an individual and later the pension agency wants that person to use the same card, then the pension agency will write its application data to that credential. To prevent a lengthy wait to upload the application, the smart IC needs fast writing speeds to reduce processing time. If applications are automatically written or removed at a consumer terminal or kiosk, faster chip speeds can cut queue lengths and wait times.

Today, ID cards have multiple uses for physical and logical access control, but because they are contactbased, biometric data cannot be transferred via RF communication. More efficient smart ICs could handle the additional security for contactless biometric data transmission while enabling quicker personalization and card issuance. As with e-passports, electronic location stamping can be incorporated, using the fast processing speed of new smart IC technology.

Another capability being evaluated for government ID credentials is biometric match-on-card security. Match-on-card technology uses biometrics as a Personal Identification Number (PIN) replacement in access solutions by performing the actual fingerprint match within the secure smart IC card environment. This removes the uncertainty of matching the fingerprint to a database, via a network-connected device, or external server, typically considered weak links in the chain of security. Privacy concerns can be addressed by having the user control the association of his or her biometric information to the credential.

While next generation smart ICs will enable new applications, improve document production efficiency, and ease wait times at borders, the greatest benefit to all citizens is the enhanced safety and privacy this new technology offers. Preserving the privacy of personal information and guarding the security all countries and people are the prime directives of next generation government electronic IDs.


More Information:
The Dawning of Next Generation Government Electronic IDs: Part I