Features Nikkei Electronics Asia -- June 2009
TFTs Used as Fingerprint Sensors for Smart Cards
Jun 17, 2009 16:30
Nikkei Electronics Asia
An extremely thin and flexible fingerprint sensor, only 0.2mm thick, has been developed by e-Smart Technologies Inc of the US (Fig 1). Estimates indicate that the volume production price will be no more than US$2.00/unit. The firm commented that conventional thin fingerprint sensors run between US$8.00 and US$20.00 apiece. The new sensors can be mounted on non-contact smart cards with functions including employee identification, credit cards and electronic money, providing a method for implementing user authentication. This would minimize the risk of unauthorized use in the event that a card is lost. The flexible structure also means it could be mounted in soft materials such as passports, opening up a wide range of other possible applications.
New LCD Application
The developed fingerprint sensor consists of a sheet of pressure-sensitive material on top of a thin-film transistor (TFT) made of amorphous or poly-crystalline silicon, with a thin stainless steel substrate. The design detects the ridges in the fingerprint using pressure-sensing technology. e-Smart chief technical officer (CTO) Tamio Saito explains, "It's an application of LCD panel technology. With amorphous silicon TFTs we can volume-produce for no more than US$2.00 apiece."
The dimensions of the sensing elements, equivalent to the pixels in the liquid crystal display (LCD), are 75um square. e-Smart's Saito continues, "We used the largest size we could and still recognize fingerprints, to keep costs down. We hope to reduce size down to about 57um square to be able to recognize children's fingerprints, too." The company is also developing a sensor to judge paper quality, using the same technology.
e-Smart has already commercialized a non-contact smart card with a different type of fingerprint sensor. It has been used in the Ubiquitous Security Service Project currently being trialed in Gwangju and other Korean cities, providing non-contact smart cards for use as resident registration cards*, electronic money, etc. The card uses a capacitance* fingerprint sensor on a glass substrate, manufactured by sensor manufacturer BMF Corp of Japan.
Even in that volume, though, Saito admits that the capacitance sensor still costs between US$8.00 and US$20.00. In search of a thinner, cheaper design, e-Smart and BMF jointly developed this new fingerprint sensor on a flexible substrate. They are now developing a design using a plastic substrate instead of stainless steel.
Wireless Authentication
e-Smart has introduced a number of proprietary technologies in the non-contact smart card mounting the sensor, too (Fig 2; Note 1).
For example, one technology has eliminated the need to mount a battery on the smart card to drive the sensor. Sensor power is instead transmitted via radio during communication between the non-contact smart card and the card reader.
This was not a simple task, explains Saito, because "Under the ISO14443* communications standard for non-contact smart cards, the card can only be supplied with a maximum of 50mW. This is much less than the 120mW needed to drive the fingerprint sensor." They resolved the problem by adopting a high-Q antenna in the card, boosting received power. He says, "We made use of magnetic resonance to draw the card reader magnetic field to the smart card."
The data used to authenticate identity is stored in the card, which also handles comparison processing. "The reference fingerprint data could be stolen if stored in the card reader, but because authentication is handled inside the card itself, this isn't a worry. The data requires only a small amount of memory to store," adds Saito.
The company revealed that a Japanese hospital is very close to adopting the cards as patient identification cards, but Saito believes that electronic money is the most promising application. "This fingerprint sensor makes a safe electronic money card possible, because even if the user drops it, it can't be used by anyone else," he explains. e-Smart is already marketing the idea as electronic money under the name Global Market Exchange (GME).
by Tetsuo Nozawa
* Resident registration card: All citizens are required to carry an ID card in Korea at all times. The owner's fingerprint is clearly visible on the card
* Capacitance method: Capacitors are fabricated in each TFT cell, etc, making it possible to measure fingerprint ridges and valleys based on the strength of external magnetic fields.
Note 1: The card is also provided with wired communication functionality, utilized for reference fingerprint data registration and other tasks.
* ISO14443: A standard for RFID communication, with a working range of about 2cm. Two versions are defined: Type A (equivalent to the MIFARE technology developed by NXP Semiconductors of the Netherlands), and Type B (developed by Motorola of the US, and utilized in Japan's "taspo" authentication card required to purchase cigarettes from a vending machine, etc). e-Smart says their technology will work with both, just by swapping the chip.
* Resident registration card: All citizens are required to carry an ID card in Korea at all times. The owner's fingerprint is clearly visible on the card.
* Capacitance method: Capacitors are fabricated in each TFT cell, etc, making it possible to measure fingerprint ridges and valleys based on the strength of external magnetic fields.
Note 1: The card is also provided with wired communication functionality, utilized for reference fingerprint data registration and other tasks.
* ISO14443: A standard for RFID communication, with a working range of about 2cm. Two versions are defined: Type A (equivalent to the MIFARE technology developed by NXP Semiconductors of the Netherlands), and Type B (developed by Motorola of the US, and utilized in Japan's "taspo" authentication card required to purchase cigarettes from a vending machine, etc). e-Smart says their technology will work with both, just by swapping the chip.
http://techon.nikkeibp.co.jp/article/HONSHI/20090527/170835/
Monday, October 19, 2009
Sunday, August 23, 2009
Monday, June 1, 2009
AIRPORT BIOMETRIC FINGERPRINTING TECHNOLOGY MAKES TRAVELERS SICK:
BIOMETRIC FINGERPRINTING TECHNOLOGY:
Biometrics technology is used for either identification or authentication purposes. Among all the biometric techniques, fingerprint-based identification is the oldest method (its history is going back as far as at least 6000 BC), which has been successfully used in various applications. A fingerprint pattern is a pattern made by the ridges and furrows (valleys) on the surface of the finger. Just as every Zebra has a unique black and white stripe pattern, every human has a unique set of fingerprints.
HUMAN HAND, A HIGHWAY FOR DISEASE TRANSMISSION:
Though every hand carries a unique set of fingerprints, it also can carry bacteria, pathogens, and viruses that cause diseases. Thus, the hand that feeds a person could also make the person and others sick if proper care is not taken like washing hands frequently etc. So, it is very important that people realize this fact and become hygiene cautions for benefit of themselves and others.
AIRPORT, A MAJOR HUB FOR DISEASE TRANSMISSION:
In an airport people from different parts of the world fly in and out and they don’t travel alone but infectious germs also hitchhike with them. A large portion of the travelers are not hygiene cautions, for example, a recent American Society for Microbiology study found that almost a third of people who use public restrooms while passing through international airports fail to wash their hands.
Infectious diseases are the leading cause of death and disease worldwide, and the third leading cause of death in the United States. The diseases that can spread due to this carelessness of people range from the common cold or influenza up to more serious diseases such as hepatitis and severe acute respiratory syndrome (SARS), the current swine flu and more.
MIGRATION OF INFECTIOUS GERMS DURING IMMIGRATION:
Fingerprint-based identification has been extensively used at airports and has become an inseparable part of the immigration process all around the world including USA. Few reasons for this popularity of biometric fingerprinting systems are that fingerprint biometric systems are:
· Easy to use
· Cheap
· Small size
· Low power
· Non-intrusive
· Large database already available
Inspite of all these advantages, one of the drawbacks in the current biometric fingerprinting systems is they act as point of transmission of infection from one person to another. The other drawbacks of biometric fingerprinting systems, such as their vulnerability to attack by fake finger, information leakage etc are discussed in the following articles:
http://globalbiometriccommittee.blogspot.com/2009/05/illegal-immigration-authentication.html
http://globalbiometriccommittee.blogspot.com/2009/05/air-france-biometric-boarding-pass.html
A step-by-step explanation of how current fingerprinting technology helps in spreading of disease among people is as follows:
In an airport people congregate from different parts of the world and many of them carry microorganisms/pathogens on their fingers.
During fingerprinting at the immigration/security check the traveler places his finger on the fingerprint scanner, thus transferring the microbes from his/her skin to the sensor surface.
Part of the transferred microbes on the sensor surface may die but the others survive.
The next traveler who places his finger on the sensor picks up some of the microbes left behind on the sensor by the previous traveler.
When a traveler touches his/her nose, mouth or eyes with the germ clad fingers, he/she can get infected with disease and further spread it around.
The paper “Biometric Fingerprinting for Visa Application: Device and
Procedure Are Risk Factors for Infection Transmission” gives a detailed analysis of the health hazards that current biometric fingerprinting systems can cause.
Related Link: http://www.kuleuven.be/rega/mvr/pdf/19006507.pdf.
The above research paper acknowledges the fact that Transmission risk exists for (but not limited to) enteric viruses (rotavirus, norovirus, and hepatitis A virus), respiratory viruses (respiratory syncytial virus, rhinovirus, influenza virus, etc.), and enteropathogenic bacteria with low infectious doses ( Shigella dysenteriae , Enterohemorrhagic Escherichia coli , etc.). According to the article the transmission of human rotavirus is estimated at 191 [95% credible intervals (CI) 0 – 289] per million fingerprint-capturing procedures.
OVERVIEW OF SOME OF THE PATHOGENS THAT CAN BE TRANSMITTED VIA FINGERPRINT SENSOR:
1. ROTAVIRUS:
Rotavirus is the most common cause of severe diarrhoeal disease in infants and young children globally. Rotaviruses are estimated to be responsible for approximately 530,000 deaths each year in many developing countries. In the U.S., rotavirus is responsible for approximately 5 to 10 percent of all episodes of diarrhea among children younger than 5 years of age. Each year in the U.S., rotavirus is responsible for more than 400,000 doctor visits; more than 200,000 emergency room visits; 55,000 to 70,000 hospitalizations; and between 20 and 60 deaths. Rotavirus leads to about $1 billion in health care costs and lost productivity per year in the U.S.
Related Link:
http://www.cdc.gov/vaccines/vpd-vac/rotavirus/dis-faqs.htm
2. NOROVIRUS:
The Norovirus causes approximately 90% of epidemic non-bacterial outbreaks of gastroenteritis around the world. Norovirus affects people of all ages. The viruses are transmitted by faecally contaminated food or water and by person-to-person contact. In the United States, norovirus infections are estimated to cause 23 million illnesses a year and may cause up to 50% of all foodborne outbreaks. Seroprevalence studies in the Amazon, southern Africa, Mexico, Chile, and Canada have shown that norovirus infections are common throughout the world, and most children will have experienced at least one infection by the age of 5 years. Infection can occur year round.
Related Links:
http://en.wikipedia.org/wiki/Norovirus
http://wwwn.cdc.gov/travel/yellowbook/ch4/norovirus.aspx
3. HEPATITIS A VIRUS:
The Hepatitis A virus (HAV) infects liver cells causing inflammation of the liver (hepatitis). Hepatitis A has a worldwide distribution occurring in both epidemic and sporadic fashions. About 22,700 cases of hepatitis A representing 38% of all hepatitis cases (5-year average from all routes of transmission) are reported annually in the U.S. In developing countries, the incidence of disease in adults is relatively low because of exposure to the virus in childhood. Most individuals 18 and older demonstrate an immunity that provides lifelong protection against reinfection. In the U.S., the percentage of adults with immunity increases with age (10% for those 18-19 years of age to 65% for those over 50). Hepatitis A virus (HAV) infection is rarely fatal except in patients with chronic liver disease.
Related Link:
http://www.foodsafety.gov/~mow/chap31.html
The following article analyzes death of a traveler due to hepatitis A virus.
http://jcm.asm.org/cgi/reprint/46/11/3850.pdf
4. RESPIRATORY SYNCYTIAL VIRUS:
Respiratory syncytial (sin-SISH-uhl) virus, or RSV, is a respiratory virus that infects the lungs and breathing passages. Most otherwise healthy people recover from RSV infection in 1 to 2 weeks. However, infection can be severe in some people, such as certain infants, young children, and older adults. In fact, RSV is the most common cause of bronchiolitis (inflammation of the small airways in the lung) and pneumonia in children under 1 year of age in the United States. In the United States, approximately 50% of infants and young children become infected with RSV each winter season. RSV causes about 90,000 hospitalizations and 4,500 deaths per year in children under age 5 years. In addition, RSV is more often being recognized as an important cause of respiratory illness in older adults.
Related Article:
http://www.dhpe.org/infect/rsv.html
4. RHINOVIRUS:
Rhinoviruses are the most common viral infective agents in humans, and a causative agent of the common cold. Human rhinovirus is a leading cause of respiratory infections in adults and children. Adults, on average, get infected with the virus once per year. Lung transplant patients, with impaired immune systems due to drugs to halt rejection, are at potentially higher risk from the virus. In fact the rhinovirus struck two immunosuppressed lung transplant patients, leading to progressive respiratory failure, graft dysfunction and finally death.
Related Link:
http://www.bio-medicine.org/biology-news/Common-cold-virus-leads-to-death-in-lung-transplant-patients-3945-1/
5. INFLUENZA VIRUS:
Influenza, commonly known as "the flu," is a highly contagious viral infection of the respiratory tract caused by influenza viruses. It can cause mild to severe illness, and at times can lead to death. Every year in the United States, on average, 5% to 20% of the population gets the flu; more than 200,000 people are hospitalized from flu-related complications; and about 36,000 people die from flu-related causes. There are three types of influenza viruses: A, B, and C. Major outbreaks of influenza are associated with influenza virus type A or B. Infection with type B influenza is usually milder than type A. Type C virus is associated with minor symptoms.
The recent (2009) flu in humans, known as "swine flu", is due to a new strain of influenza A virus subtype H1N1 that contains genes closely related to swine influenza. The origin of this new strain is unknown. However, the World Organization for Animal Health (OIE) reports that this strain has not been isolated in pigs. This strain can be transmitted from human to human, and causes the normal symptoms of influenza. The Swine flu has been compared to other similar types of influenza virus in terms of mortality and it appears that in the US for every 1000 people who get infected, about 40 people need admission to hospital and about one person dies.
Related Links:
http://www.cdc.gov/flu/keyfacts.htm
http://en.wikipedia.org/wiki/Swine_influenza
CONCLUSION:
The current biometric fingerpring system that intended to protect one’s identity is highly insecure when it comes to protecting one’s health, as the system aids in the spread of diseases among travelers. It is beyond the control of airport authorities worldwide to counsel/babysit all travelers to make them hygiene concious, but at the same time some kind of control needs to be implemented so that others don’t have to pay the price for someones negligence. Thus, the biometric fingerprinting system needs to be changed such that it provides security to both one’s identity and health.
SOLUTION:
The e-Smart technology match-on-card biometric fingerprinting system not only overcomes the drawbacks of the existing fingerprinting system when it comes to protecting one’s identity, but also provides medical security to its travelers. In the e-Smart security system every traveler will have a personal fingerprint sensor integrated in into the travel document. Also, the travel document would contain a fingerprint template of the person that is secured through encryption. During authentication at immigration the traveler would place his finger on the sensor integrated in the travel document. Thus, there is no fear of transfer of pathogens from one traveler to another via sensor, as every one will have their own personal sensor.
ADDITIONAL REFERENCES:
http://www.joe.org/joe/2009february/rb7.php
http://preventdisease.com/home/weeklywellness146.shtml
http://dhs.wisconsin.gov/communicable/factsheets/Handwashing.htm
Biometrics technology is used for either identification or authentication purposes. Among all the biometric techniques, fingerprint-based identification is the oldest method (its history is going back as far as at least 6000 BC), which has been successfully used in various applications. A fingerprint pattern is a pattern made by the ridges and furrows (valleys) on the surface of the finger. Just as every Zebra has a unique black and white stripe pattern, every human has a unique set of fingerprints.
HUMAN HAND, A HIGHWAY FOR DISEASE TRANSMISSION:
Though every hand carries a unique set of fingerprints, it also can carry bacteria, pathogens, and viruses that cause diseases. Thus, the hand that feeds a person could also make the person and others sick if proper care is not taken like washing hands frequently etc. So, it is very important that people realize this fact and become hygiene cautions for benefit of themselves and others.
AIRPORT, A MAJOR HUB FOR DISEASE TRANSMISSION:
In an airport people from different parts of the world fly in and out and they don’t travel alone but infectious germs also hitchhike with them. A large portion of the travelers are not hygiene cautions, for example, a recent American Society for Microbiology study found that almost a third of people who use public restrooms while passing through international airports fail to wash their hands.
Infectious diseases are the leading cause of death and disease worldwide, and the third leading cause of death in the United States. The diseases that can spread due to this carelessness of people range from the common cold or influenza up to more serious diseases such as hepatitis and severe acute respiratory syndrome (SARS), the current swine flu and more.
MIGRATION OF INFECTIOUS GERMS DURING IMMIGRATION:
Fingerprint-based identification has been extensively used at airports and has become an inseparable part of the immigration process all around the world including USA. Few reasons for this popularity of biometric fingerprinting systems are that fingerprint biometric systems are:
· Easy to use
· Cheap
· Small size
· Low power
· Non-intrusive
· Large database already available
Inspite of all these advantages, one of the drawbacks in the current biometric fingerprinting systems is they act as point of transmission of infection from one person to another. The other drawbacks of biometric fingerprinting systems, such as their vulnerability to attack by fake finger, information leakage etc are discussed in the following articles:
http://globalbiometriccommittee.blogspot.com/2009/05/illegal-immigration-authentication.html
http://globalbiometriccommittee.blogspot.com/2009/05/air-france-biometric-boarding-pass.html
A step-by-step explanation of how current fingerprinting technology helps in spreading of disease among people is as follows:
In an airport people congregate from different parts of the world and many of them carry microorganisms/pathogens on their fingers.
During fingerprinting at the immigration/security check the traveler places his finger on the fingerprint scanner, thus transferring the microbes from his/her skin to the sensor surface.
Part of the transferred microbes on the sensor surface may die but the others survive.
The next traveler who places his finger on the sensor picks up some of the microbes left behind on the sensor by the previous traveler.
When a traveler touches his/her nose, mouth or eyes with the germ clad fingers, he/she can get infected with disease and further spread it around.
The paper “Biometric Fingerprinting for Visa Application: Device and
Procedure Are Risk Factors for Infection Transmission” gives a detailed analysis of the health hazards that current biometric fingerprinting systems can cause.
Related Link: http://www.kuleuven.be/rega/mvr/pdf/19006507.pdf.
The above research paper acknowledges the fact that Transmission risk exists for (but not limited to) enteric viruses (rotavirus, norovirus, and hepatitis A virus), respiratory viruses (respiratory syncytial virus, rhinovirus, influenza virus, etc.), and enteropathogenic bacteria with low infectious doses ( Shigella dysenteriae , Enterohemorrhagic Escherichia coli , etc.). According to the article the transmission of human rotavirus is estimated at 191 [95% credible intervals (CI) 0 – 289] per million fingerprint-capturing procedures.
OVERVIEW OF SOME OF THE PATHOGENS THAT CAN BE TRANSMITTED VIA FINGERPRINT SENSOR:
1. ROTAVIRUS:
Rotavirus is the most common cause of severe diarrhoeal disease in infants and young children globally. Rotaviruses are estimated to be responsible for approximately 530,000 deaths each year in many developing countries. In the U.S., rotavirus is responsible for approximately 5 to 10 percent of all episodes of diarrhea among children younger than 5 years of age. Each year in the U.S., rotavirus is responsible for more than 400,000 doctor visits; more than 200,000 emergency room visits; 55,000 to 70,000 hospitalizations; and between 20 and 60 deaths. Rotavirus leads to about $1 billion in health care costs and lost productivity per year in the U.S.
Related Link:
http://www.cdc.gov/vaccines/vpd-vac/rotavirus/dis-faqs.htm
2. NOROVIRUS:
The Norovirus causes approximately 90% of epidemic non-bacterial outbreaks of gastroenteritis around the world. Norovirus affects people of all ages. The viruses are transmitted by faecally contaminated food or water and by person-to-person contact. In the United States, norovirus infections are estimated to cause 23 million illnesses a year and may cause up to 50% of all foodborne outbreaks. Seroprevalence studies in the Amazon, southern Africa, Mexico, Chile, and Canada have shown that norovirus infections are common throughout the world, and most children will have experienced at least one infection by the age of 5 years. Infection can occur year round.
Related Links:
http://en.wikipedia.org/wiki/Norovirus
http://wwwn.cdc.gov/travel/yellowbook/ch4/norovirus.aspx
3. HEPATITIS A VIRUS:
The Hepatitis A virus (HAV) infects liver cells causing inflammation of the liver (hepatitis). Hepatitis A has a worldwide distribution occurring in both epidemic and sporadic fashions. About 22,700 cases of hepatitis A representing 38% of all hepatitis cases (5-year average from all routes of transmission) are reported annually in the U.S. In developing countries, the incidence of disease in adults is relatively low because of exposure to the virus in childhood. Most individuals 18 and older demonstrate an immunity that provides lifelong protection against reinfection. In the U.S., the percentage of adults with immunity increases with age (10% for those 18-19 years of age to 65% for those over 50). Hepatitis A virus (HAV) infection is rarely fatal except in patients with chronic liver disease.
Related Link:
http://www.foodsafety.gov/~mow/chap31.html
The following article analyzes death of a traveler due to hepatitis A virus.
http://jcm.asm.org/cgi/reprint/46/11/3850.pdf
4. RESPIRATORY SYNCYTIAL VIRUS:
Respiratory syncytial (sin-SISH-uhl) virus, or RSV, is a respiratory virus that infects the lungs and breathing passages. Most otherwise healthy people recover from RSV infection in 1 to 2 weeks. However, infection can be severe in some people, such as certain infants, young children, and older adults. In fact, RSV is the most common cause of bronchiolitis (inflammation of the small airways in the lung) and pneumonia in children under 1 year of age in the United States. In the United States, approximately 50% of infants and young children become infected with RSV each winter season. RSV causes about 90,000 hospitalizations and 4,500 deaths per year in children under age 5 years. In addition, RSV is more often being recognized as an important cause of respiratory illness in older adults.
Related Article:
http://www.dhpe.org/infect/rsv.html
4. RHINOVIRUS:
Rhinoviruses are the most common viral infective agents in humans, and a causative agent of the common cold. Human rhinovirus is a leading cause of respiratory infections in adults and children. Adults, on average, get infected with the virus once per year. Lung transplant patients, with impaired immune systems due to drugs to halt rejection, are at potentially higher risk from the virus. In fact the rhinovirus struck two immunosuppressed lung transplant patients, leading to progressive respiratory failure, graft dysfunction and finally death.
Related Link:
http://www.bio-medicine.org/biology-news/Common-cold-virus-leads-to-death-in-lung-transplant-patients-3945-1/
5. INFLUENZA VIRUS:
Influenza, commonly known as "the flu," is a highly contagious viral infection of the respiratory tract caused by influenza viruses. It can cause mild to severe illness, and at times can lead to death. Every year in the United States, on average, 5% to 20% of the population gets the flu; more than 200,000 people are hospitalized from flu-related complications; and about 36,000 people die from flu-related causes. There are three types of influenza viruses: A, B, and C. Major outbreaks of influenza are associated with influenza virus type A or B. Infection with type B influenza is usually milder than type A. Type C virus is associated with minor symptoms.
The recent (2009) flu in humans, known as "swine flu", is due to a new strain of influenza A virus subtype H1N1 that contains genes closely related to swine influenza. The origin of this new strain is unknown. However, the World Organization for Animal Health (OIE) reports that this strain has not been isolated in pigs. This strain can be transmitted from human to human, and causes the normal symptoms of influenza. The Swine flu has been compared to other similar types of influenza virus in terms of mortality and it appears that in the US for every 1000 people who get infected, about 40 people need admission to hospital and about one person dies.
Related Links:
http://www.cdc.gov/flu/keyfacts.htm
http://en.wikipedia.org/wiki/Swine_influenza
CONCLUSION:
The current biometric fingerpring system that intended to protect one’s identity is highly insecure when it comes to protecting one’s health, as the system aids in the spread of diseases among travelers. It is beyond the control of airport authorities worldwide to counsel/babysit all travelers to make them hygiene concious, but at the same time some kind of control needs to be implemented so that others don’t have to pay the price for someones negligence. Thus, the biometric fingerprinting system needs to be changed such that it provides security to both one’s identity and health.
SOLUTION:
The e-Smart technology match-on-card biometric fingerprinting system not only overcomes the drawbacks of the existing fingerprinting system when it comes to protecting one’s identity, but also provides medical security to its travelers. In the e-Smart security system every traveler will have a personal fingerprint sensor integrated in into the travel document. Also, the travel document would contain a fingerprint template of the person that is secured through encryption. During authentication at immigration the traveler would place his finger on the sensor integrated in the travel document. Thus, there is no fear of transfer of pathogens from one traveler to another via sensor, as every one will have their own personal sensor.
ADDITIONAL REFERENCES:
http://www.joe.org/joe/2009february/rb7.php
http://preventdisease.com/home/weeklywellness146.shtml
http://dhs.wisconsin.gov/communicable/factsheets/Handwashing.htm
Thursday, May 21, 2009
Stop! No More ID Stealing!
JoongAngDaily
Input : May 22, 2009 1:10:38 A.M.
Even with the leakage of passwords or resident registration numbers, a verification method which makes it impossible for others to be accessed will be applied to the main website of Gyeonggi English Village for the first time beginning at the end of this month. Fingerprint verification smartcard (picture above) developed by e-Smart Korea recognizes cardholder’s fingerprint through fingerprint sensor on the card. Currently, the card is being used in Advanced Broadcasting Media Technology Research Center of Korea Aerospace University as student ID card for attendance check by connecting to a system developed by Cobalt Ray Co., Ltd., and is planned to be applied to credit cards and IDs in the future.
Seung-shik Choi
Wednesday, May 20, 2009
Air France Biometric Boarding Pass Technology:
INTRODUCTION:
Air France has implemented the use of smartcard based boarding pass (on trial basis until the end of the year) for its frequent flyer programme members on flights between Paris Charles de Gaulle and Amsterdam Schipol. This new boarding pass contains an encrypted version of forefinger and thumb prints of passengers. During boarding the passenger would scan their forefingers and thumb prints on a fingerprint scanner (installed at the gate) that would then be compared with those stored in the card and upon successful verification the passenger would be allowed to board.
ISSUING OF AIR FRANCE BOARDING PASS:
It consists of the following steps:
Step1: Verification of identity based on documents like passport etc.
Step2: After verification fingerprints would be scanned using sensor (mostly optical) that would be stored in the boarding pass.
Step3: Collect the card.
OPERATION OF AIR FRANCE BOARDING PASS:
Step1: Insert the card into the boarding pass terminal and flight details will be printed on back of the card. The card can be reused at least 500 times because during next use the existed information will be erased and new flight information will be printed on it. Thus, the passenger holds on to the boarding pass even after travel.
Step2: Proceed to boarding terminal based on the information printed on the card.
Step3: The boarding terminal reader will check the flight information stored in the chip.
Step4: Once the flight information is read the passenger will be prompted to get his fingerprints scanned at the fingerprint scanner located at the terminal.
Step5: Fingerprint information stored in card is compared with the scanned fingerprint information. If both the fingerprint information matches then the boarding gate would open, allowing the person to board the flight.
WHAT MAKES THE AIR FRANCE BOARDING PASS SECURITY RELIABLE?
The answer to this question is NOTHING. The boarding pass technology just mimics the current e-passport and credit card technology, which suffer from many flaws.
DRAWBACKS OF THE AIR FRANCE BIOMETRIC BOARDING PASS SYSTEM:
Air France Biometric Boarding pass system suffer from the same drawbacks of e-passports and credit cards that are as follows:
1. Boarding Pass can be cloned:
Similar technology based e-passports and credit cards have been successfully cloned. This means that all the personal information stored in the boarding pass would be transferred to the cloned card including the passenger’s fingerprint. Following are some articles that show how easily e-Passports and credit cards can be cloned:
· http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece (Fake-proof e-passports cloned in minutes)
· http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/ (US Homeland Security passports successfully cloned with no problem)
· http://nepalinirelandnews.blogspot.com/2008/05/dublin-shop-workers-bribed-to-help-in.html (Dublin lasercard bank fraud).
2. Fingerprint scanner can be fooled:
The fingerprint scanner used is similar to the ones used at immigration i.e. optical fingerprint scanner. There are numerous evidence online that these scanners can be easily fooled by using fake finger. Making fake finger is not very difficult and lot of information is available on the web that teaches a person how to make a fake finger. For example the following link shows how easily latent fingerprint (fingerprint left behind on some object by the potential victim) can be lifted and used as a stencil to make fake finger.
http://www.ccc.de/biometrie/fingerabdruck_kopieren.xml?language=en (Tutorial to make fake finger)
Following are few articles that show how the contemporary optical fingerprint readers can be fooled easily with fake finger.
http://www.securityfocus.com/news/6717 (German hackers fool fingerprint scanners).
http://software.silicon.com/security/0,39024655,11033437,00.htm (Japanese man fools biometric sensor with fake finger)
http://www.asiaone.com/Travel/News/Story/A1Story20090101-111750.html (South Korean woman fools Japanese fingerprint sensor)
3. Vulnerable to skimming or eavesdropping:
The fingerprint information stored in the card is transmitted to the reader, which compares the information with the passenger’s scanned fingerprints. This is major drawback because the authentication is done by the system, so while transmission the data could be intercepted and stolen.
A skimming attack is when someone attempts to read the passport chip simply by beaming power at the passport. At normal power ranges, contactless smart card readers must be relatively close to the card within a few inches or at most a few feet. However, that range can be extended if the reader broadcasts power at illegally high levels. A skimming attack could be done to facilitate identity theft or to trace the movements of an individual.
An eavesdropping attack can occur, if the contactless smart card is actively communicating with a legitimate reader. RF emanations from both the smart card and the reader have been shown in tests to be readable at distances up to 30 feet (9 meters).
Once the fingerprint information is stolen it is easy for criminal to make a fake finger of the passenger. Also, by lifting fingerprints left by the passenger in various objects can be used to make fake finger.
Related links:
http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/
http://www.theregister.co.uk/2009/02/02/low_cost_rfid_cloner/
4. Boarding Pass can make travelers sick or even worse kill:
Another rising concern amongst people during travel is spread of contagious diseases like swine flu, SARS etc. Since ever traveler has to touch a coomon fingerprint sensor there is a possibility of disease spreading. Infections like swine flu etc spread easily and can result in death too. One may say that touching a door handle in the airport can infect travelers too, but our point is the verification system should not contribute in the spreading of disease. Suppose even if a person takes good precaution wearing gloves etc, he will have to expose his finger to get his fingerprint scanned by the sensor. Person does not have to remove gloves to touch door handle.
CONCLUSION:
Current Air France boarding pass is just eyewash to make people feel secure. Air France should consider using a system confers real security. A truly secure boarding pass is one that:
- cannot be fooled by a replica of person’s biometric details like fingerprint, face etc.
- hard to forge or counterfeit.
- provides a secure communication between the reader and travel document. In other words not vulnerable to skimming or eavesdropping.
- does not contribute in the spreading of disease.
E-SMART SOLUTION TO THE PROBLEM:
e-Smart Technologies Inc. creates an authentication environment that would overcome the above drawbacks. Let us analyze each drawback above and see e-Smart solution to overcome it.
1. Can fake finger fool the e-Smart Boarding Pass system?
NO, because the each boarding pass will have a fingerprint scanner that is foolproof. E-Smarts innovative match-on-card/ boarding pass technology and fingerprint matching algorithm together can easily detect latex finger, gummy finger by analyzing the changes in electrical characteristics and other properties.
2. Can e-Smart Boarding Pass be reliably cloned?
NO. Cloning e-Smart card doesn’t make sense because the cloned card would store the fingerprint information pertaining to the owner. The thief will not be able to authenticate the e-Smart boarding pass using either his finger or a fake finger.
3. Can the fingerprint information be stolen from the card?
NO, because the fingerprint matching is done in the card and not in a central system so personal data remains in the card. Thus, in e-Smart Boarding Pass authentication there is no question of vulnerability to data intercepting attacks, such as eavesdropping and skimming.
4. Would e-Smart Boarding Pass contribute in the spreading of contagious diseases?
NO, because the each boarding pass will have a fingerprint scanner for a personal touch. Where there is personal touch there is no possibility of getting infected (at least not because of boarding pass verification process).
Air France has implemented the use of smartcard based boarding pass (on trial basis until the end of the year) for its frequent flyer programme members on flights between Paris Charles de Gaulle and Amsterdam Schipol. This new boarding pass contains an encrypted version of forefinger and thumb prints of passengers. During boarding the passenger would scan their forefingers and thumb prints on a fingerprint scanner (installed at the gate) that would then be compared with those stored in the card and upon successful verification the passenger would be allowed to board.
ISSUING OF AIR FRANCE BOARDING PASS:
It consists of the following steps:
Step1: Verification of identity based on documents like passport etc.
Step2: After verification fingerprints would be scanned using sensor (mostly optical) that would be stored in the boarding pass.
Step3: Collect the card.
OPERATION OF AIR FRANCE BOARDING PASS:
Step1: Insert the card into the boarding pass terminal and flight details will be printed on back of the card. The card can be reused at least 500 times because during next use the existed information will be erased and new flight information will be printed on it. Thus, the passenger holds on to the boarding pass even after travel.
Step2: Proceed to boarding terminal based on the information printed on the card.
Step3: The boarding terminal reader will check the flight information stored in the chip.
Step4: Once the flight information is read the passenger will be prompted to get his fingerprints scanned at the fingerprint scanner located at the terminal.
Step5: Fingerprint information stored in card is compared with the scanned fingerprint information. If both the fingerprint information matches then the boarding gate would open, allowing the person to board the flight.
WHAT MAKES THE AIR FRANCE BOARDING PASS SECURITY RELIABLE?
The answer to this question is NOTHING. The boarding pass technology just mimics the current e-passport and credit card technology, which suffer from many flaws.
DRAWBACKS OF THE AIR FRANCE BIOMETRIC BOARDING PASS SYSTEM:
Air France Biometric Boarding pass system suffer from the same drawbacks of e-passports and credit cards that are as follows:
1. Boarding Pass can be cloned:
Similar technology based e-passports and credit cards have been successfully cloned. This means that all the personal information stored in the boarding pass would be transferred to the cloned card including the passenger’s fingerprint. Following are some articles that show how easily e-Passports and credit cards can be cloned:
· http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece (Fake-proof e-passports cloned in minutes)
· http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/ (US Homeland Security passports successfully cloned with no problem)
· http://nepalinirelandnews.blogspot.com/2008/05/dublin-shop-workers-bribed-to-help-in.html (Dublin lasercard bank fraud).
2. Fingerprint scanner can be fooled:
The fingerprint scanner used is similar to the ones used at immigration i.e. optical fingerprint scanner. There are numerous evidence online that these scanners can be easily fooled by using fake finger. Making fake finger is not very difficult and lot of information is available on the web that teaches a person how to make a fake finger. For example the following link shows how easily latent fingerprint (fingerprint left behind on some object by the potential victim) can be lifted and used as a stencil to make fake finger.
http://www.ccc.de/biometrie/fingerabdruck_kopieren.xml?language=en (Tutorial to make fake finger)
Following are few articles that show how the contemporary optical fingerprint readers can be fooled easily with fake finger.
http://www.securityfocus.com/news/6717 (German hackers fool fingerprint scanners).
http://software.silicon.com/security/0,39024655,11033437,00.htm (Japanese man fools biometric sensor with fake finger)
http://www.asiaone.com/Travel/News/Story/A1Story20090101-111750.html (South Korean woman fools Japanese fingerprint sensor)
3. Vulnerable to skimming or eavesdropping:
The fingerprint information stored in the card is transmitted to the reader, which compares the information with the passenger’s scanned fingerprints. This is major drawback because the authentication is done by the system, so while transmission the data could be intercepted and stolen.
A skimming attack is when someone attempts to read the passport chip simply by beaming power at the passport. At normal power ranges, contactless smart card readers must be relatively close to the card within a few inches or at most a few feet. However, that range can be extended if the reader broadcasts power at illegally high levels. A skimming attack could be done to facilitate identity theft or to trace the movements of an individual.
An eavesdropping attack can occur, if the contactless smart card is actively communicating with a legitimate reader. RF emanations from both the smart card and the reader have been shown in tests to be readable at distances up to 30 feet (9 meters).
Once the fingerprint information is stolen it is easy for criminal to make a fake finger of the passenger. Also, by lifting fingerprints left by the passenger in various objects can be used to make fake finger.
Related links:
http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/
http://www.theregister.co.uk/2009/02/02/low_cost_rfid_cloner/
4. Boarding Pass can make travelers sick or even worse kill:
Another rising concern amongst people during travel is spread of contagious diseases like swine flu, SARS etc. Since ever traveler has to touch a coomon fingerprint sensor there is a possibility of disease spreading. Infections like swine flu etc spread easily and can result in death too. One may say that touching a door handle in the airport can infect travelers too, but our point is the verification system should not contribute in the spreading of disease. Suppose even if a person takes good precaution wearing gloves etc, he will have to expose his finger to get his fingerprint scanned by the sensor. Person does not have to remove gloves to touch door handle.
CONCLUSION:
Current Air France boarding pass is just eyewash to make people feel secure. Air France should consider using a system confers real security. A truly secure boarding pass is one that:
- cannot be fooled by a replica of person’s biometric details like fingerprint, face etc.
- hard to forge or counterfeit.
- provides a secure communication between the reader and travel document. In other words not vulnerable to skimming or eavesdropping.
- does not contribute in the spreading of disease.
E-SMART SOLUTION TO THE PROBLEM:
e-Smart Technologies Inc. creates an authentication environment that would overcome the above drawbacks. Let us analyze each drawback above and see e-Smart solution to overcome it.
1. Can fake finger fool the e-Smart Boarding Pass system?
NO, because the each boarding pass will have a fingerprint scanner that is foolproof. E-Smarts innovative match-on-card/ boarding pass technology and fingerprint matching algorithm together can easily detect latex finger, gummy finger by analyzing the changes in electrical characteristics and other properties.
2. Can e-Smart Boarding Pass be reliably cloned?
NO. Cloning e-Smart card doesn’t make sense because the cloned card would store the fingerprint information pertaining to the owner. The thief will not be able to authenticate the e-Smart boarding pass using either his finger or a fake finger.
3. Can the fingerprint information be stolen from the card?
NO, because the fingerprint matching is done in the card and not in a central system so personal data remains in the card. Thus, in e-Smart Boarding Pass authentication there is no question of vulnerability to data intercepting attacks, such as eavesdropping and skimming.
4. Would e-Smart Boarding Pass contribute in the spreading of contagious diseases?
NO, because the each boarding pass will have a fingerprint scanner for a personal touch. Where there is personal touch there is no possibility of getting infected (at least not because of boarding pass verification process).
Tuesday, May 12, 2009
Social Security, A Cause For Social Insecurity
SSN Fraud annually $50B, could be eliminated by e-Smart’s I AM Card, the offer by e-Smart was interrupted. The amount is the same range of Madoff Fraud, the claim against which had been interrupted too.
Who is responsible for the damage to innocent and good citizens, $100B ??
SOCIAL SECURITY, A CAUSE FOR SOCIAL INSECURITY:
1. INTRODUCTION:
Social security act and purpose:
The primary objective of the social security number (SSN) is to track individuals for tax purposes, but unfortunately it does more than that. SSN has become an identifier for individuals in the United States. It is used on many transactions like purchasing car or house, opening a bank account, applying for a loan, applying for credit card etc.
Understanding the SSN:
The SSN is a nine-digit number that is not randomly generated, but follows a pattern. The first three numbers (area number) refer to the state in which the number was issued. The next two (group numbers) indicate the order in which the SSN was issued in each area. The last four (serial numbers) are randomly generated. Thus a SSN can reveal an individual's relative age and place of origin1.
2. SSN AND IDENTITY THEFT:
Identity theft is defined as the process of using someone else’s personal information for your own personal gain. This personal gain may be in terms of employment (illegal immigrant assuming false identity), finance (applying for loan, credit card or opening bank account) etc.
Identity theft has become a major concern in the United States with nearly 10 million American victims losing $48 billion in 2008. The number of victims rose 22% to a record 9.9 million in 2008 from 8.1 million a year earlier, with about one in 23 U.S. adults becoming victims2.
A main cause for identity theft is insecurity in the SSN. When one’s SSN falls into wrong hands, it can be used to get personal information about that person and use it for various crimes.
For example, identity thieves can use someone’s SSN number and credit to apply for more credit in the person’s name. Then, they use the credit cards and do not pay the bills creating a negative impact on the persons credit history. Also, compromised SSN’s are sold at a price and from which a Social Secirty Card can be fabricated. A lot of illegal immigrants buy such fake Social Security Cards to get jobs, open bank accounts etc. to survive in United States.
3. FACTS AND FIGURES ON IDENTITY THEFT:
Following are some facts and figures on Identity Theft:
Fake Social Security Cards and other ID’s
5. DISCUSSION:
Currently for opening credit card account etc people give their SSN over the phone or over the internet that can be easily overheard or hacked. Also, many criminals pose as they are from a bank and get personal information such as SSN from people over phone. Once the criminal knows someone’s SSN he can go to bank and open account and the bank people don’t check social security card for verification. To reduce identity theft the SSN should be always be used along with social security card. Since SSN has become a national identifier for individuals in the United States it is very important information and should be well protected. SSN in the current social security card is like precious jewels in a transparent plastic bag. The government is realizing this fact and proposals are being made for use of a biometric smartcard based social security card4.
Unfortunately this biometric smartcard technology has been used in creditcards and e-passports that have been successfully clones in minutes5,6 . Using such clone-able technology based social security card to protect SSN is not sufficient. If United States really wants to reduce identity theft then the technology used in the social security card should be fake-proof and imposter proof (incase stolen the card should be unresponsive to fake biometrics).
6. e-SMART SOLUTION FOR REAL SOCIAL SECURITY:
e-Smart Technologies Inc., a pioneer in developing biometric security systems, has developed a unique biometric fingerprint match-on-card. In this match-on-card the fingerprint template of the person is secured through encryption and never leaves the card during authentication process. Thus there is no risk of fingerprint to be stolen from the card by electronic eavesdropping or skimming etc. Also the card is dummy/fake finger proof because it can judge presence of fake finger electrically and via software.
7. REFERENCES:
http://epic.org/privacy/ssn/
http://money.cnn.com/2009/02/09/news/newsmakers/identity_theft.reut/index.htm
http://unheardnomore.blogspot.com/2009/03/social-security-cards-for-sale-fake.html
http://www.secureidnews.com/2008/02/14/biometric-smart-card-for-social-security-proposed
http://nepalinirelandnews.blogspot.com/2008/05/dublin-shop-workers-bribed-to-help-in.html (Dublin lasercard bank fraud).
http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece (Fake-proof e-passports cloned in minutes)
Who is responsible for the damage to innocent and good citizens, $100B ??
SOCIAL SECURITY, A CAUSE FOR SOCIAL INSECURITY:
1. INTRODUCTION:
Social security act and purpose:
The primary objective of the social security number (SSN) is to track individuals for tax purposes, but unfortunately it does more than that. SSN has become an identifier for individuals in the United States. It is used on many transactions like purchasing car or house, opening a bank account, applying for a loan, applying for credit card etc.
Understanding the SSN:
The SSN is a nine-digit number that is not randomly generated, but follows a pattern. The first three numbers (area number) refer to the state in which the number was issued. The next two (group numbers) indicate the order in which the SSN was issued in each area. The last four (serial numbers) are randomly generated. Thus a SSN can reveal an individual's relative age and place of origin1.
2. SSN AND IDENTITY THEFT:
Identity theft is defined as the process of using someone else’s personal information for your own personal gain. This personal gain may be in terms of employment (illegal immigrant assuming false identity), finance (applying for loan, credit card or opening bank account) etc.
Identity theft has become a major concern in the United States with nearly 10 million American victims losing $48 billion in 2008. The number of victims rose 22% to a record 9.9 million in 2008 from 8.1 million a year earlier, with about one in 23 U.S. adults becoming victims2.
A main cause for identity theft is insecurity in the SSN. When one’s SSN falls into wrong hands, it can be used to get personal information about that person and use it for various crimes.
For example, identity thieves can use someone’s SSN number and credit to apply for more credit in the person’s name. Then, they use the credit cards and do not pay the bills creating a negative impact on the persons credit history. Also, compromised SSN’s are sold at a price and from which a Social Secirty Card can be fabricated. A lot of illegal immigrants buy such fake Social Security Cards to get jobs, open bank accounts etc. to survive in United States.
3. FACTS AND FIGURES ON IDENTITY THEFT:
Following are some facts and figures on Identity Theft:
Source: http://www.mysecurecyberspace.com/articles/statistics-trends/how-much-of-a-threat-is-identity-theft.html
Source: http://www.fraudwatchinternational.com/identity-theft/idtheft-types/
Source: http://www.fraudwatchinternational.com/identity-theft/idtheft-types/
Source: http://www.fraudwatchinternational.com/identity-theft/idtheft-types/
Source: http://www.fraudwatchinternational.com/identity-theft/idtheft-types/
Source: http://www.fraudwatchinternational.com/identity-theft/idtheft-types/
Source: http://www.fraudwatchinternational.com/identity-theft/idtheft-types/
(Credit: FTC) NOTE: Identity Theft Ranks # 1 on FTC Complaint
Source: http://www.ftc.gov/opa/2009/02/2008cmpts.shtm
Identity Fraud Trends
Source: http://www.ftc.gov/opa/2009/02/2008cmpts.shtm
Identity Fraud Trends
Source: http://www.idsafety.net/Javelin2009IdentityFraudSurveyPressRelease.pdf
Source: http://vaperforms.virginia.gov/indicators/govtCitizens/consumerProtection.php
In 2007, credit card fraud (23%) was the most common form of reported identity theft followed by phone or utilities fraud (18%), employment fraud (14%) and bank fraud (13%). Other significant categories of identity theft reported by victims were government documents/benefits fraud (11%) and loan fraud (5%).
Source: http://www.idtheftawareness.com/docs/WhatIsIdTheft.php
Source: http://reports.celent.com/Japanese/PressReleases/20030121/CreditCardFraud.htm
Incidents of identity theft relative to the size of each banking institution
Source: http://vaperforms.virginia.gov/indicators/govtCitizens/consumerProtection.php
In 2007, credit card fraud (23%) was the most common form of reported identity theft followed by phone or utilities fraud (18%), employment fraud (14%) and bank fraud (13%). Other significant categories of identity theft reported by victims were government documents/benefits fraud (11%) and loan fraud (5%).
Source: http://www.idtheftawareness.com/docs/WhatIsIdTheft.php
Source: http://reports.celent.com/Japanese/PressReleases/20030121/CreditCardFraud.htm
Incidents of identity theft relative to the size of each banking institution
Source: http://www.concurringopinions.com/archives/category/privacy-id-theft
4. SOCIAL SECURITY CARD FACILITATES IDENTITY THEFT:
Security of citizens is dependent on social security number, which is printed on a social security card. Ironically the social security card is the most insecure card but it purpose is to provide social security.
Picture shows an identity thief taking Social Security Card from wallet.
NOTE: 36 percent of Americans age 18-49 and 43 percent of Americans age 50-plus carry their Social Security card in their wallet.
Also, the social security card can be faked easily. Fake ID’s that include social security card are common among illegal immigrants. Social security cards and other fake ID’s sold in flea market3.
4. SOCIAL SECURITY CARD FACILITATES IDENTITY THEFT:
Security of citizens is dependent on social security number, which is printed on a social security card. Ironically the social security card is the most insecure card but it purpose is to provide social security.
Picture shows an identity thief taking Social Security Card from wallet.NOTE: 36 percent of Americans age 18-49 and 43 percent of Americans age 50-plus carry their Social Security card in their wallet.
Also, the social security card can be faked easily. Fake ID’s that include social security card are common among illegal immigrants. Social security cards and other fake ID’s sold in flea market3.
Fake Social Security Cards and other ID’s5. DISCUSSION:
Currently for opening credit card account etc people give their SSN over the phone or over the internet that can be easily overheard or hacked. Also, many criminals pose as they are from a bank and get personal information such as SSN from people over phone. Once the criminal knows someone’s SSN he can go to bank and open account and the bank people don’t check social security card for verification. To reduce identity theft the SSN should be always be used along with social security card. Since SSN has become a national identifier for individuals in the United States it is very important information and should be well protected. SSN in the current social security card is like precious jewels in a transparent plastic bag. The government is realizing this fact and proposals are being made for use of a biometric smartcard based social security card4.
Unfortunately this biometric smartcard technology has been used in creditcards and e-passports that have been successfully clones in minutes5,6 . Using such clone-able technology based social security card to protect SSN is not sufficient. If United States really wants to reduce identity theft then the technology used in the social security card should be fake-proof and imposter proof (incase stolen the card should be unresponsive to fake biometrics).
6. e-SMART SOLUTION FOR REAL SOCIAL SECURITY:
e-Smart Technologies Inc., a pioneer in developing biometric security systems, has developed a unique biometric fingerprint match-on-card. In this match-on-card the fingerprint template of the person is secured through encryption and never leaves the card during authentication process. Thus there is no risk of fingerprint to be stolen from the card by electronic eavesdropping or skimming etc. Also the card is dummy/fake finger proof because it can judge presence of fake finger electrically and via software.
7. REFERENCES:
http://epic.org/privacy/ssn/
http://money.cnn.com/2009/02/09/news/newsmakers/identity_theft.reut/index.htm
http://unheardnomore.blogspot.com/2009/03/social-security-cards-for-sale-fake.html
http://www.secureidnews.com/2008/02/14/biometric-smart-card-for-social-security-proposed
http://nepalinirelandnews.blogspot.com/2008/05/dublin-shop-workers-bribed-to-help-in.html (Dublin lasercard bank fraud).
http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece (Fake-proof e-passports cloned in minutes)
Wednesday, May 6, 2009
ILLEGAL IMMIGRATION AUTHENTICATION:
-How Current Immigrations System is Broken and Weak-
Illegal immigration is one of the major problems faced by many countries in this world. Usually people illegally immigrate into another country to lead a better lifestyle, to evade criminal charges in their original country, or to perform criminal activities in the country they plan to enter. Illegal immigrants usually enter a country with help of fake documents. Fake documents are not necessarily forged/counterfeit documents that look like genuine documents, but they could be genuine documents that were stolen and the theft disguises himself/herself to look like the person in document. The later case is more difficult to spot since the documents are genuine so the immigration officer will allow the person to enter unless he or the system is smart enough to detect that the person is an imposter.
Let us concentrate on illegal immigration into the USA and what the country has done so far to prevent/ minimize illegal immigration. After the 9/11 terror incident USA government realized that paper immigration documents are easy to forge so the government has replaced regular paper passports with electronic passports or e-passports, and implemented special LaserCard technology for making its permanent residency card (commonly known as Green Card) and Border Control Card (commonly known as Laser Visa). In addition to documents the immigration officials scan the fingerprint of the arriving person to make sure if he is not a criminal or previously deported person. The question is that do these new technologies used in the immigration documents reliably stop illegal immigration. Let us look at each of these technologies one by one:
1. Examining Fingerprint of a person:
The optical fingerprint readers used at the airports can be easily fooled by fake finger. Fake finger means that the person can put some kind of thin tape/covering that contains fingerprint of someone else over his finger. Since the optical fingerprint reader just takes an image of the persons fingerprint and compares it with the database, the fake fingerprint on the tape would be compared with the database. Even though the USA immigration presently scans all 10 fingerprints of a person, it is not foolproof. One may say that although possible to make one fake fingerprint, it is not easy to make fake fingerprints for all fingers; but there is sufficient evidence in the web that teaches one how to easily create a fake finger. For example the following link shows how easily latent fingerprint (fingerprint left behind on some object by the potential victim) can be lifted and used as a stencil to make fake finger.
http://www.ccc.de/biometrie/fingerabdruck_kopieren.xml?language=en (Tutorial to make fake finger)
Following are few articles that show how the contemporary optical fingerprint readers can be fooled easily with fake finger.
· http://www.securityfocus.com/news/6717 (German hackers fool fingerprint scanners).
· http://software.silicon.com/security/0,39024655,11033437,00.htm (Japanese man fools biometric sensor with fake finger)
· http://www.asiaone.com/Travel/News/Story/A1Story20090101-111750.html (South Korean woman fools Japanese fingerprint sensor)
e-Passports:
Since paper passports can be forged without much difficulty, e-passports have been introduced. e-passports are similar to the regular passports except for a small contactless RFID chip embedded in the back cover that is supposed to make it more secure than regular passport. The only personal information stored on the chip is the same information that is printed on the data page of the passport, including a digital version of the photograph.
Do e-passports actually provide the security they are intended for? Unfortunately NO since current e-passports are vulnerable to skimming or eavesdropping attacks by hackers. A skimming attack is when someone attempts to read the passport chip simply by beaming power at the passport. An eavesdropping attack is when someone intercepts the communication between the e-passport and reader and steals data. The owner of the e-passport will not even be aware that his information has been compromised.
Once the information is compromised the RFID chip can be cloned and rest is to make a fake passport based on the information in the chip.
Following links show evidence of how easily the information in the e-passport’s RFID can be attacked and cloned.
http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece (Fake-proof e-passports cloned in minutes)
http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/ (US Homeland Security passports successfully cloned with no problem)
http://www.theregister.co.uk/2007/03/06/daily_mail_passport_clone/ (Cloning of e-passports when in mail)
Also, proposals are being made for a person’s fingerprint information to be stored in the e-passport chip, rendering added security. If a hacker manages to obtain the digitized fingerprint information from the e-passport chip then he can make fake finger using that information.
Lasercard Technology for making Green Card and Laser Visa:
Just like regular paper passports, greencard and border crossing cards can be forged without much difficulty. To solve this issue of forgery new greencards and border crossing cards (also known as Laser Visa) that are backed by Lasercard technology are issued. Lasercard is basically an optical memory card that can contain the optical digitized image of the owner’s photo and fingerprint. Though claims are made that the lasercard data cannot be altered and are hard to counterfeit some articles mention the sale of fake new greencards in Tijuana, Mexico for $500 a piece.
Already it has been proven in the Dublin bank fraud case that lasercard technology is not imposter-proof or fake-proof. In Dublin bank case the bank lasercards were cloned and PIN numbers were obtained from shopkeepers who were paid to observe the customer while he/she was entering the PIN. The cloned card was used to withdraw money.
Related link:
http://nepalinirelandnews.blogspot.com/2008/05/dublin-shop-workers-bribed-to-help-in.html (Dublin lasercard bank fraud).
Like PIN is the authenticating factor in laser bankcard, fingerprint matching of person and visual comparison of face is authenticating factor in travel documents. Lasercards that contain the optical digitized image of the owner’s photo and fingerprint can be dangerous when stolen because stolen lasercards are government issued cards and so no headach of forging. The immigration officer will not object to the stolen card’s authenticity. All that the thief needs to do is to look like the victim and also have matching fingerprints. As we already know it is not hard to fake fingerprint and people leave their fingerprints everywhere, which can be stolen be any watchful hacker.
Actually looking at the current border-crossing scenario the illegal immigrant (who could be a criminal) doesn’t have much to do. Many articles mention that the border-crossing officers just ask a few questions and don’t even care to verify the biometric information stored in the card.
Related Article:
· http://www.themonitor.com/onset?id=2429&template=article.html (Expensive authentication technology wasted)
From the article above we can see that authentication using lasercard technology is person (i.e. immigration officer) dependent. The officer makes the decision whether to verify biometrics in the card or not. On a busy day the officer may be too lazy to verify all information, and the country may have to pay the price for his laziness. We should also not overlook the fact that the officer could be bribed.
CONCLUSION: USA (and also the world) needs “change” in Current immigration authentication systems:
Looking at the drawbacks in the current immigration authenticating system we need a system that:
- cannot be fooled by a replica of person’s biometric details like fingerprint, face etc.
- hard to forge or counterfeit.
- is independent of human control. Authentication should be done by the system automatically and not done as per discretion of immigration officer.
- Provides a secure communication between the reader and travel document. In other words not vulnerable to skimming or eavesdropping.
-IS THERE ANY SOLUSION?-
How can e-Smart Technologies Inc. bring about this “change” in the immigration system?
e-Smart Technologies Inc. claims it can create an authentication environment that would overcome the above drawbacks. Let us ask e-Smart Technologies Inc.’s CTO and Sr. Vice President, Mr. Tamio Saito, to get more knowledge on e-Smart technology.
Interviewer: Can you please briefly explain how e-Smart authentication system works and what makes it unique in terms to security when compared to contemporary systems?
e-Smart CTO: e-Smart authentication is made on the card and fingerprint template is secured in the card through encryption. So, there is no change for anyone to change the fingerprint. Current system, employee can change the fingerprint data base and hacker can do also. And the biggest risk is if someone stole the fingerprint, no way to recover, because no one can change their finger contrasting to passwords. There are so many crime that employee to sell data base for small cash. Spy can change the fingerprint VERY EASILY by paying small money to employee, such near bankruptcy because of investment loss, alcoholic, etc.
Interviewer: Can the e-Smart authentication system be fooled using a fake finger? If not why?
e-Smart CTO: Fingerprint detection system can find out copied paper finger very easily, gummy finger by electrical way and software way. Current Optical sensor, using CCD or MOS device can be easily faked by copied fingerprint. It cannot read wet finger. Under Sunshine or strong back light, it may cause the problem. But e-Smart sensor has no such issues.
Interviewer: Is the e-Smart’s RFID chip vulnerable to skimming and eavesdropping attacks and subsequent cloning of the chip? If no, please explain what make it so special that it cannot be cloned. If yes, would the clone would it work reliably for the imposter?
e-Smart CTO: Our design is to use Biometric related key for encryption from the finger touched on the sensor in the card. Current and legacy system, being used is using just generic CHIP off the self having no unique data comes from the person who holds the card.
Interviewer: Is the e-Smart authentication technology human dependent? In other words is the verification of biometric information dependent on the discretion or mood of the immigration officer who may be lazy or busy to verify all biometric information in e-passport?
e-Smart CTO: Current system, the person entering the border can bribe, threat, collaborates the immigration officer to cheat the system. They are NOT FAIL SAFE SYSTEM. It depends on immigration officers. However, e-Smart card can be activated only when finger print of card holder matches to the data in the card. It is automatic and immigration officer independent.
Illegal immigration is one of the major problems faced by many countries in this world. Usually people illegally immigrate into another country to lead a better lifestyle, to evade criminal charges in their original country, or to perform criminal activities in the country they plan to enter. Illegal immigrants usually enter a country with help of fake documents. Fake documents are not necessarily forged/counterfeit documents that look like genuine documents, but they could be genuine documents that were stolen and the theft disguises himself/herself to look like the person in document. The later case is more difficult to spot since the documents are genuine so the immigration officer will allow the person to enter unless he or the system is smart enough to detect that the person is an imposter.
Let us concentrate on illegal immigration into the USA and what the country has done so far to prevent/ minimize illegal immigration. After the 9/11 terror incident USA government realized that paper immigration documents are easy to forge so the government has replaced regular paper passports with electronic passports or e-passports, and implemented special LaserCard technology for making its permanent residency card (commonly known as Green Card) and Border Control Card (commonly known as Laser Visa). In addition to documents the immigration officials scan the fingerprint of the arriving person to make sure if he is not a criminal or previously deported person. The question is that do these new technologies used in the immigration documents reliably stop illegal immigration. Let us look at each of these technologies one by one:
1. Examining Fingerprint of a person:
The optical fingerprint readers used at the airports can be easily fooled by fake finger. Fake finger means that the person can put some kind of thin tape/covering that contains fingerprint of someone else over his finger. Since the optical fingerprint reader just takes an image of the persons fingerprint and compares it with the database, the fake fingerprint on the tape would be compared with the database. Even though the USA immigration presently scans all 10 fingerprints of a person, it is not foolproof. One may say that although possible to make one fake fingerprint, it is not easy to make fake fingerprints for all fingers; but there is sufficient evidence in the web that teaches one how to easily create a fake finger. For example the following link shows how easily latent fingerprint (fingerprint left behind on some object by the potential victim) can be lifted and used as a stencil to make fake finger.
http://www.ccc.de/biometrie/fingerabdruck_kopieren.xml?language=en (Tutorial to make fake finger)
Following are few articles that show how the contemporary optical fingerprint readers can be fooled easily with fake finger.
· http://www.securityfocus.com/news/6717 (German hackers fool fingerprint scanners).
· http://software.silicon.com/security/0,39024655,11033437,00.htm (Japanese man fools biometric sensor with fake finger)
· http://www.asiaone.com/Travel/News/Story/A1Story20090101-111750.html (South Korean woman fools Japanese fingerprint sensor)
e-Passports:
Since paper passports can be forged without much difficulty, e-passports have been introduced. e-passports are similar to the regular passports except for a small contactless RFID chip embedded in the back cover that is supposed to make it more secure than regular passport. The only personal information stored on the chip is the same information that is printed on the data page of the passport, including a digital version of the photograph.
Do e-passports actually provide the security they are intended for? Unfortunately NO since current e-passports are vulnerable to skimming or eavesdropping attacks by hackers. A skimming attack is when someone attempts to read the passport chip simply by beaming power at the passport. An eavesdropping attack is when someone intercepts the communication between the e-passport and reader and steals data. The owner of the e-passport will not even be aware that his information has been compromised.
Once the information is compromised the RFID chip can be cloned and rest is to make a fake passport based on the information in the chip.
Following links show evidence of how easily the information in the e-passport’s RFID can be attacked and cloned.
http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece (Fake-proof e-passports cloned in minutes)
http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/ (US Homeland Security passports successfully cloned with no problem)
http://www.theregister.co.uk/2007/03/06/daily_mail_passport_clone/ (Cloning of e-passports when in mail)
Also, proposals are being made for a person’s fingerprint information to be stored in the e-passport chip, rendering added security. If a hacker manages to obtain the digitized fingerprint information from the e-passport chip then he can make fake finger using that information.
Lasercard Technology for making Green Card and Laser Visa:
Just like regular paper passports, greencard and border crossing cards can be forged without much difficulty. To solve this issue of forgery new greencards and border crossing cards (also known as Laser Visa) that are backed by Lasercard technology are issued. Lasercard is basically an optical memory card that can contain the optical digitized image of the owner’s photo and fingerprint. Though claims are made that the lasercard data cannot be altered and are hard to counterfeit some articles mention the sale of fake new greencards in Tijuana, Mexico for $500 a piece.
Already it has been proven in the Dublin bank fraud case that lasercard technology is not imposter-proof or fake-proof. In Dublin bank case the bank lasercards were cloned and PIN numbers were obtained from shopkeepers who were paid to observe the customer while he/she was entering the PIN. The cloned card was used to withdraw money.
Related link:
http://nepalinirelandnews.blogspot.com/2008/05/dublin-shop-workers-bribed-to-help-in.html (Dublin lasercard bank fraud).
Like PIN is the authenticating factor in laser bankcard, fingerprint matching of person and visual comparison of face is authenticating factor in travel documents. Lasercards that contain the optical digitized image of the owner’s photo and fingerprint can be dangerous when stolen because stolen lasercards are government issued cards and so no headach of forging. The immigration officer will not object to the stolen card’s authenticity. All that the thief needs to do is to look like the victim and also have matching fingerprints. As we already know it is not hard to fake fingerprint and people leave their fingerprints everywhere, which can be stolen be any watchful hacker.
Actually looking at the current border-crossing scenario the illegal immigrant (who could be a criminal) doesn’t have much to do. Many articles mention that the border-crossing officers just ask a few questions and don’t even care to verify the biometric information stored in the card.
Related Article:
· http://www.themonitor.com/onset?id=2429&template=article.html (Expensive authentication technology wasted)
From the article above we can see that authentication using lasercard technology is person (i.e. immigration officer) dependent. The officer makes the decision whether to verify biometrics in the card or not. On a busy day the officer may be too lazy to verify all information, and the country may have to pay the price for his laziness. We should also not overlook the fact that the officer could be bribed.
CONCLUSION: USA (and also the world) needs “change” in Current immigration authentication systems:
Looking at the drawbacks in the current immigration authenticating system we need a system that:
- cannot be fooled by a replica of person’s biometric details like fingerprint, face etc.
- hard to forge or counterfeit.
- is independent of human control. Authentication should be done by the system automatically and not done as per discretion of immigration officer.
- Provides a secure communication between the reader and travel document. In other words not vulnerable to skimming or eavesdropping.
-IS THERE ANY SOLUSION?-
How can e-Smart Technologies Inc. bring about this “change” in the immigration system?
e-Smart Technologies Inc. claims it can create an authentication environment that would overcome the above drawbacks. Let us ask e-Smart Technologies Inc.’s CTO and Sr. Vice President, Mr. Tamio Saito, to get more knowledge on e-Smart technology.
Interviewer: Can you please briefly explain how e-Smart authentication system works and what makes it unique in terms to security when compared to contemporary systems?
e-Smart CTO: e-Smart authentication is made on the card and fingerprint template is secured in the card through encryption. So, there is no change for anyone to change the fingerprint. Current system, employee can change the fingerprint data base and hacker can do also. And the biggest risk is if someone stole the fingerprint, no way to recover, because no one can change their finger contrasting to passwords. There are so many crime that employee to sell data base for small cash. Spy can change the fingerprint VERY EASILY by paying small money to employee, such near bankruptcy because of investment loss, alcoholic, etc.
Interviewer: Can the e-Smart authentication system be fooled using a fake finger? If not why?
e-Smart CTO: Fingerprint detection system can find out copied paper finger very easily, gummy finger by electrical way and software way. Current Optical sensor, using CCD or MOS device can be easily faked by copied fingerprint. It cannot read wet finger. Under Sunshine or strong back light, it may cause the problem. But e-Smart sensor has no such issues.
Interviewer: Is the e-Smart’s RFID chip vulnerable to skimming and eavesdropping attacks and subsequent cloning of the chip? If no, please explain what make it so special that it cannot be cloned. If yes, would the clone would it work reliably for the imposter?
e-Smart CTO: Our design is to use Biometric related key for encryption from the finger touched on the sensor in the card. Current and legacy system, being used is using just generic CHIP off the self having no unique data comes from the person who holds the card.
Interviewer: Is the e-Smart authentication technology human dependent? In other words is the verification of biometric information dependent on the discretion or mood of the immigration officer who may be lazy or busy to verify all biometric information in e-passport?
e-Smart CTO: Current system, the person entering the border can bribe, threat, collaborates the immigration officer to cheat the system. They are NOT FAIL SAFE SYSTEM. It depends on immigration officers. However, e-Smart card can be activated only when finger print of card holder matches to the data in the card. It is automatic and immigration officer independent.
Thursday, April 16, 2009
Secure OS Forum 2009 Conference in Korea 2009
There was a conference of OS Forum for Security held at COEX in Seoul, Korea.
e-Smart was one of the companies who provided the demonstration models for this event as e-Smart product will be the standard of the nation.
e-Smart was one of the companies who provided the demonstration models for this event as e-Smart product will be the standard of the nation.
Monday, April 13, 2009
E-Passport Security Issues and an e-SMART solution:
Background:
The realization that paper-based passports can be too easily altered or falsified is driving a worldwide move to electronic passports. The large number of lost or stolen passports—more than 300,000 in the United States alone in recent years—meant there was a huge pool of paper-based passports potentially available to counterfeiters.
After the destructions of WTC on the United States on September 11, 2001, Congress legislated that all countries participating in the Visa Waiver Program with the United States must issue passports with integrated circuits (chips) to add digital security features that prevent counterfeiting and positively confirm the bearer of the passport with a biometric, such as a digital copy of the photograph printed on the cover.
An e-passport contains a chip that implements the ICAO standard for Machine Readable Travel Documents (MRTD's). The only personal information stored on the chip is the same information that is printed on the data page of the passport, including a digital version of the photograph.
However, having Chip does not mean passport holder is the right person and impossible to prove it.
Because there is no direct relationship between Chip and passport holder. .It is NOT clone proof, hack proof, fake proof or not temper proof. The most important requirement is clone proof and fake proof. That means there is no technology to identify individual by the passport by itself, we can say all of current passports, maybe little bit better than paper, are old fashioned, legacy, stone age architect but not meaningful or effective modality to identify invividual at all. There are already so many proved fake or weakness there as below. We can say 9-11 tirggerd some business or benifit to low teck companies or related entities, but MicroChip can not prevent any tragedy like 9-11. We need to figure out WHO IS RESPONSBLE for implementing NON SECURED PASSPORT.
e-Passports Security:
The e-passports are protected by a digital signature which, when altered, are supposed to be rejected by the reader. The validation of the signatures on e-passports requires the exchange of PKI certificates between the authorities of the issuing countries or the use of ICAO's PKD (Public Key Directory) system.
The ICAO standard chip contains following files (“Elementary Files”, EFs):
– EF.DG1: personal information (required)
– EF.DG2: picture, JPG/JPG2000 (required)
– EF.DG[3-14,16]: finger prints, iris scans and other files for future use (optional)
– EF.DG15: anti-cloning crypto (optional)
– EF.SOD: safeguarding integrity of DGs (required)
– EF.COM: index of available files (required)
The ICAO standard requirements comprises of two authentication features (passive authentication and active authentication) and one confidentiality feature (Basic Access Code).
PASSIVE AUTHENTICATION (required):
Here information stored on the e-passport’s contactless smart card chip is digitally signed by the issuing country and the digital signature is checked before use. Passive authentication safeguard integrity of data stored in the chip. EF.SOD stores hashes of EF.DG[1-16] and a public key The hashes are digitally signed with a private key. If the attacker tried to change the hash to assume false identity, then the digital signature verification would fail, and the attack would be detected.
Flaws in Passive Authentication:
Unfortunately passive authentication is not highly reliable because it has the following drawbacks:
1. Passive authentication verifies data integrity but not chip integrity, which means no way to verify if chip data was stolen and cloned.
2. For passive authentication an inspection system must check the public key in the chip (part of EF.SOD) against a list of trusted certificates. This list comprises of "Country Signing CA Certificates (CCSCA)” and “ICAO Public Key Directory (PKD)”. Only ten of the forty-five countries with e-passports have signed up to the ICAO PKD code system (not all of them are currently using it) and the remaining can use their own CCSCA codes. Since there is no universally accepted key code system for authentication, criminals could always use fake e-passports from countries that do not share the ICAO PKD codes, which would then go undetected at passport control.
3. Passive authentication there is no protection against skimming or eavesdropping attack by outsiders.
A skimming attack is when someone attempts to read the passport chip simply by beaming power at the passport. At normal power ranges, contactless smart card readers must be relatively close to the card within a few inches or at most a few feet. However, that range can be extended if the reader broadcasts power at illegally high levels. A skimming attack could be done to facilitate identity theft or to trace the movements of an individual.
An eavesdropping attack can occur, if the contactless smart card is actively communicating with a legitimate reader. RF emanations from both the smart card and the reader have been shown in tests to be readable at distances up to 30 feet (9 meters).
Thus, the attacker could also clone e-passport of a country that implements the ICAO PKD if he managed to steal chip data information through skimming or eavesdropping. So, countries (including USA) that are just relying on passive authentication for e-passport verification are putting the identity of their e-passport holders in a great risk.
Examples of attacking Passive Authentication:
Example1: Osama technically becomes a citizen of Britain.
Jeroen van Beek, a computer researcher at the University of Amsterdam, has shown in some tests conducted for The Times that the new micro-chipped passports, introduced in UK to protect against terrorism and organized crime, can be easily cloned. Jeroen cloned the chips on two British passports and implanted digital images of Osama bin Laden and a suicide bomber.
The cloned chips were regarded as genuine by the Golden Reader, which is the standard passport reader software used by the UN agency setting standards for e-passports and which is also recommended for use at airports. The cloning operation took less than an hour.
Related Articles:
http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece
http://www.edri.org/edrigram/number6.16/clone-epassports
Example 2: US Homeland Security passports successfully cloned.
The current EPC Gen 2 RFID tags used in the wallet-sized Homeland Security passports use no encryption, and are unable to selectively transmit any data. Instead, the RFID tags broadcast sensitive information, enabling anyone with the proper equipment to collect information that could potentially be used for identity theft, or other nefarious purposes.
An intrepid data security researcher named Chris Paget devised a simple method of collecting and absorbing RFID passport information for the illumination of his peers at the ShmooCon hacker convention (held in Washington, D.C.). Chris devised a fairly inexpensive method of tracking and reading the passports. He bought a $250 RFID scanner on eBay to do the actual card-reading. Then he purchased a cheap, simple antenna to boost his range of the scanner. Then, he went driving in San Fransisco. Chris said that the passport card is a real radio broadcast, so there is no real limit to the read range. It's conceivable that these things can be tracked from 100 meters -- a couple of miles. Chris had no trouble collecting -- and copying -- information from the RFID passports of six people, in a half-hour of driving around.
Related Article:
http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/
http://www.theregister.co.uk/2009/02/02/low_cost_rfid_cloner/
BASIC ACCESS CONTROL (Optional):
Basic Access Control is an optional confidentiality feature that could be used to overcome the drawback of passive authentication, i.e. skimming and eavesdropping, however it has drawbacks of its own.
Basic Access Control requires that the initial interaction between the embedded microchip in the passport and the border control reader include protocols for setting up the secure communication channel. The reader first acquires the MRZ information from the data page of the passport, generally via a connected OCR scanner. This MRZ information is used for computing the encryption and message authentication keys used for the “secure” exchange of the session keys. After authentication data is encrypted (3DES).
The realization that paper-based passports can be too easily altered or falsified is driving a worldwide move to electronic passports. The large number of lost or stolen passports—more than 300,000 in the United States alone in recent years—meant there was a huge pool of paper-based passports potentially available to counterfeiters.
After the destructions of WTC on the United States on September 11, 2001, Congress legislated that all countries participating in the Visa Waiver Program with the United States must issue passports with integrated circuits (chips) to add digital security features that prevent counterfeiting and positively confirm the bearer of the passport with a biometric, such as a digital copy of the photograph printed on the cover.
An e-passport contains a chip that implements the ICAO standard for Machine Readable Travel Documents (MRTD's). The only personal information stored on the chip is the same information that is printed on the data page of the passport, including a digital version of the photograph.
However, having Chip does not mean passport holder is the right person and impossible to prove it.
Because there is no direct relationship between Chip and passport holder. .It is NOT clone proof, hack proof, fake proof or not temper proof. The most important requirement is clone proof and fake proof. That means there is no technology to identify individual by the passport by itself, we can say all of current passports, maybe little bit better than paper, are old fashioned, legacy, stone age architect but not meaningful or effective modality to identify invividual at all. There are already so many proved fake or weakness there as below. We can say 9-11 tirggerd some business or benifit to low teck companies or related entities, but MicroChip can not prevent any tragedy like 9-11. We need to figure out WHO IS RESPONSBLE for implementing NON SECURED PASSPORT.
e-Passports Security:
The e-passports are protected by a digital signature which, when altered, are supposed to be rejected by the reader. The validation of the signatures on e-passports requires the exchange of PKI certificates between the authorities of the issuing countries or the use of ICAO's PKD (Public Key Directory) system.
The ICAO standard chip contains following files (“Elementary Files”, EFs):
– EF.DG1: personal information (required)
– EF.DG2: picture, JPG/JPG2000 (required)
– EF.DG[3-14,16]: finger prints, iris scans and other files for future use (optional)
– EF.DG15: anti-cloning crypto (optional)
– EF.SOD: safeguarding integrity of DGs (required)
– EF.COM: index of available files (required)
The ICAO standard requirements comprises of two authentication features (passive authentication and active authentication) and one confidentiality feature (Basic Access Code).
PASSIVE AUTHENTICATION (required):
Here information stored on the e-passport’s contactless smart card chip is digitally signed by the issuing country and the digital signature is checked before use. Passive authentication safeguard integrity of data stored in the chip. EF.SOD stores hashes of EF.DG[1-16] and a public key The hashes are digitally signed with a private key. If the attacker tried to change the hash to assume false identity, then the digital signature verification would fail, and the attack would be detected.
Flaws in Passive Authentication:
Unfortunately passive authentication is not highly reliable because it has the following drawbacks:
1. Passive authentication verifies data integrity but not chip integrity, which means no way to verify if chip data was stolen and cloned.
2. For passive authentication an inspection system must check the public key in the chip (part of EF.SOD) against a list of trusted certificates. This list comprises of "Country Signing CA Certificates (CCSCA)” and “ICAO Public Key Directory (PKD)”. Only ten of the forty-five countries with e-passports have signed up to the ICAO PKD code system (not all of them are currently using it) and the remaining can use their own CCSCA codes. Since there is no universally accepted key code system for authentication, criminals could always use fake e-passports from countries that do not share the ICAO PKD codes, which would then go undetected at passport control.
3. Passive authentication there is no protection against skimming or eavesdropping attack by outsiders.
A skimming attack is when someone attempts to read the passport chip simply by beaming power at the passport. At normal power ranges, contactless smart card readers must be relatively close to the card within a few inches or at most a few feet. However, that range can be extended if the reader broadcasts power at illegally high levels. A skimming attack could be done to facilitate identity theft or to trace the movements of an individual.
An eavesdropping attack can occur, if the contactless smart card is actively communicating with a legitimate reader. RF emanations from both the smart card and the reader have been shown in tests to be readable at distances up to 30 feet (9 meters).
Thus, the attacker could also clone e-passport of a country that implements the ICAO PKD if he managed to steal chip data information through skimming or eavesdropping. So, countries (including USA) that are just relying on passive authentication for e-passport verification are putting the identity of their e-passport holders in a great risk.
Examples of attacking Passive Authentication:
Example1: Osama technically becomes a citizen of Britain.
Jeroen van Beek, a computer researcher at the University of Amsterdam, has shown in some tests conducted for The Times that the new micro-chipped passports, introduced in UK to protect against terrorism and organized crime, can be easily cloned. Jeroen cloned the chips on two British passports and implanted digital images of Osama bin Laden and a suicide bomber.
The cloned chips were regarded as genuine by the Golden Reader, which is the standard passport reader software used by the UN agency setting standards for e-passports and which is also recommended for use at airports. The cloning operation took less than an hour.
Related Articles:
http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece
http://www.edri.org/edrigram/number6.16/clone-epassports
Example 2: US Homeland Security passports successfully cloned.
The current EPC Gen 2 RFID tags used in the wallet-sized Homeland Security passports use no encryption, and are unable to selectively transmit any data. Instead, the RFID tags broadcast sensitive information, enabling anyone with the proper equipment to collect information that could potentially be used for identity theft, or other nefarious purposes.
An intrepid data security researcher named Chris Paget devised a simple method of collecting and absorbing RFID passport information for the illumination of his peers at the ShmooCon hacker convention (held in Washington, D.C.). Chris devised a fairly inexpensive method of tracking and reading the passports. He bought a $250 RFID scanner on eBay to do the actual card-reading. Then he purchased a cheap, simple antenna to boost his range of the scanner. Then, he went driving in San Fransisco. Chris said that the passport card is a real radio broadcast, so there is no real limit to the read range. It's conceivable that these things can be tracked from 100 meters -- a couple of miles. Chris had no trouble collecting -- and copying -- information from the RFID passports of six people, in a half-hour of driving around.
Related Article:
http://www.neoseeker.com/news/9787-insecurity-of-homeland-security-rfid-passports-shown-by-researcher/
http://www.theregister.co.uk/2009/02/02/low_cost_rfid_cloner/
BASIC ACCESS CONTROL (Optional):
Basic Access Control is an optional confidentiality feature that could be used to overcome the drawback of passive authentication, i.e. skimming and eavesdropping, however it has drawbacks of its own.
Basic Access Control requires that the initial interaction between the embedded microchip in the passport and the border control reader include protocols for setting up the secure communication channel. The reader first acquires the MRZ information from the data page of the passport, generally via a connected OCR scanner. This MRZ information is used for computing the encryption and message authentication keys used for the “secure” exchange of the session keys. After authentication data is encrypted (3DES).
Basic Access Control Process
The MRZ information used for basic authentication is the passport serial number, the holder’s date of birth and the expiration date of the passport. Basic access control should be effective against simple skimming attacks. However with a little effort the key biometric passport is relatively easy to identify/crack since it is not random, but consists of passport number, the passport holder's date of birth and the passport expiry date. For example birth date for 10 year time period has 10*365 = 3650 values, expiry date within 5 years: 5*365 = 1825 values and passport numbers are typically issued in sequence, so low entropy, and strongly correlated with expiry date
.
Flaws in Basic Access Code:
i. Weak authentication key since it is based on passport issue date, passport expiry date and passport number.
ii. Does not detect cloned passport.
Example of Basic Access Control Authentication Attack:
Example: Cloning of biometric e-passports while they are still in the mail bag
For example there is an article that talks about successful attack on e-passports when they were in the mail sent by the passport office to the applicant. Perhaps more easier to crack in mail as the issue date of new passport would be within a few days and expiry date would be 10 years from the issue date. It relatively easy to identify the holder's date of birth. The passport number consists of a number of predictable elements, including an identifier for the issuing office, so effectively a significant part of the key can be reconstructed from the envelope and its address label. No proof of identity was required when the passport was delivered. Because it's feasible to steal the data without detection in the mail, it's perfectly possible that insiders could intercept large numbers of the millions of new passports delivered every year.
Related Article:
http://www.theregister.co.uk/2007/03/06/daily_mail_passport_clone/
Basic Access Code substituted by Faraday’s cage in US e-passports:
As a substitute to Basic Access Code, Faradays cage protects US e-passports. This cage is setup by covering the passport with an aluminum foil. However creating a Faraday’s cage can prevent skimming (when passport is closed) but not eavesdropping.
ACTIVE AUTHENTICATION (optional):
The optional active authentication feature further strengthens the Basic Access Code confidentiality feature. Active authentication lets the inspecting system know if the e-passport is genuine or a clone. For active authentication an asymmetric key pair is stored in the chip, one public key and one private. The public key is accessible in DG15 (i.e. integrity protected by PA). The private key does not leave the chip, no way to read the key, but possible to verify whether the chip can access the private key. RSA is used for active authentication. The steps involved in active authentication are as follows:
Step1: Reader reads signed passport public key
Step2: Reader sends challenge to passport
Step3: Passport encrypts challenge with secret RSA key
Step4: Reader gets encrypted response from passport
Step5: Reader verifies response using the public key from DG15
Active Authentication
Thus, the optional active authentication together with the mandatory passive authentication feature together should provide both data integrity and chip integrity.
Flaws in Active Authentication:
However the active and passive authentication combination is not impenetratable and can be cracked.
a). Manipulating the index file:
Any system (or security feature) is as strong as its weakest link. Even with active authentication enabled e-passports the attacker can manipulate the index file (EF.COM) such that Active Authentication check might be skipped.
Manipulation of the Index File
If the inspecting system is made to think that the DG15 file is not there then it will not check for active authentication, in other words not check for cloning. This attack strategy is also applicable to all other optional security features.
Related Article:
http://freeworld.thc.org/thc-epassport/
http://www.cs.ru.nl/~erikpoll/talks/Makerere/ePassport.ppt
b.) Side-channel attacks:
Side-channels provide unintended means to analyze or manipulate the behavior of cryptographic implementations. Common side channel analysis methods are:
i. Time analysis:
Here process duration is used to reveal secrets. After analyzing RSA trace, and noting the distance variations between higher and lower parts, the key can be derived from a single observation.
Time-Power Analysis of RSA
ii. Power Analysis:
Here power consumption pattern to reveal secrets. Collect many (>1000) RSA power traces and compute average energy per modular operation. Small variations reveal key bits. More advanced correlation analysis is also possible.
Statistical power analysis of RSA (2)
iii. Electro-Magnetic analysis:
Here EM radiation is used to reveal secrets
iv. Power glitching:
This involves the use power interruptions to inject computational faults.
Steps involved in cloning passport through side-channel attack:
Step1: Read personal data (Cloning requires physical access to victim passport)
Step2: Perform multiple active authentications (RSA)
Step3: Retrieve private key by (statistical) analysis
Step4: Load new chip with personal data and RSA keys
Step5: Attach chip to passport document with same identity
! Cloned e-passport chip ready to use!
Related Article:
http://wiki.whatthehack.org/images/2/28/WTH-slides-Attacks-on-Digital-Passports-Marc-Witteman.pdf
EXTENDED ACCESS CONTROL (Optional):
Extended Access Control is confidentiality feature defined by the European Union to allow authorized Inspection system (system used to read e-passport) to read sensitive biometric data such as fingerprints from e-passports. Extended Access Control is not a part of the ICAO standard.
In Extended Access Control the passport reader is required to obtain a digital certificate from the issuing country before it could access the fingerprint file on the passport chip. The certificate is supposed to be valid for only a short period of time so that no reader can access the fingerprint on a passport chip once that time period has expired.
Extended Access Authentication facilitates chip authentication and terminal authentication.
Chip Authentication by Extended Access Control:
replaces the active authentication feature to authenticate the chip and prove that the chip is genuine (not cloned);
establishes strongly secured communication channel (stronger than the one established by Basic Access Code mechanism)
Terminal Authentication by Extended Access Control:
· extra PKI for reader is used to determine whether the Inspection System is allowed to read the sensitive data from the e-passport.
Flaws in Extended Access Control:
i. Though the digital certificate obtained by the reader is supposed to be of short duration the passport chip contains no clock so that it can't know when the time period has passed and determine if a certificate is no longer valid. If the reader equipped with valid electronic certificate is stolen then the passport data can be accessed later and thief can access all biometric information of the person
ii. Another challenge for chips is to maintain an up-to-date list of PKIs belonging to those countries that have signed the appropriate agreement to access privacy-sensitive data. So far, readers must help e-passports figure out whether their countries have been granted access through an as-yet-unspecified protocol.
iii. The reader can read the SOD without passing through Extended Access Control. Someone who, say, knows most of the content of data group can try to access the chip data by brute force.
Related Links:
http://blog.wired.com/27bstroke6/2007/12/authorities-hit.html
http://infoscience.epfl.ch/record/115087/files/Vaudenay-epassport.pdf
Key features of e-Smart technology to overcome current e-passport security issues:
The key features of e-Smart powered Biometric e-passport are:
· e-Smarts proprietary match-on-card technology can be used to verify legitimacy of the person carrying the e-passport even if the passport is subjected only to passive authentication (lowest but mandatory requirement for authentication by ICAO).
· Fingerprint of the individual is used to reliably authenticate person. In e-Smart match-on-card system the biometric fingerprint information would not leave the card/e-passport but is matched within card/e-passport. So the hacker will not get access to to biometric fingerprint data.
· only the biometric template or co-ordinates of the fingerprint is stored within chip from which finger information cannot be extract. Thus, no risk of theft of person’s fingerprint data.
The MRZ information used for basic authentication is the passport serial number, the holder’s date of birth and the expiration date of the passport. Basic access control should be effective against simple skimming attacks. However with a little effort the key biometric passport is relatively easy to identify/crack since it is not random, but consists of passport number, the passport holder's date of birth and the passport expiry date. For example birth date for 10 year time period has 10*365 = 3650 values, expiry date within 5 years: 5*365 = 1825 values and passport numbers are typically issued in sequence, so low entropy, and strongly correlated with expiry date
.
Flaws in Basic Access Code:
i. Weak authentication key since it is based on passport issue date, passport expiry date and passport number.
ii. Does not detect cloned passport.
Example of Basic Access Control Authentication Attack:
Example: Cloning of biometric e-passports while they are still in the mail bag
For example there is an article that talks about successful attack on e-passports when they were in the mail sent by the passport office to the applicant. Perhaps more easier to crack in mail as the issue date of new passport would be within a few days and expiry date would be 10 years from the issue date. It relatively easy to identify the holder's date of birth. The passport number consists of a number of predictable elements, including an identifier for the issuing office, so effectively a significant part of the key can be reconstructed from the envelope and its address label. No proof of identity was required when the passport was delivered. Because it's feasible to steal the data without detection in the mail, it's perfectly possible that insiders could intercept large numbers of the millions of new passports delivered every year.
Related Article:
http://www.theregister.co.uk/2007/03/06/daily_mail_passport_clone/
Basic Access Code substituted by Faraday’s cage in US e-passports:
As a substitute to Basic Access Code, Faradays cage protects US e-passports. This cage is setup by covering the passport with an aluminum foil. However creating a Faraday’s cage can prevent skimming (when passport is closed) but not eavesdropping.
ACTIVE AUTHENTICATION (optional):
The optional active authentication feature further strengthens the Basic Access Code confidentiality feature. Active authentication lets the inspecting system know if the e-passport is genuine or a clone. For active authentication an asymmetric key pair is stored in the chip, one public key and one private. The public key is accessible in DG15 (i.e. integrity protected by PA). The private key does not leave the chip, no way to read the key, but possible to verify whether the chip can access the private key. RSA is used for active authentication. The steps involved in active authentication are as follows:
Step1: Reader reads signed passport public key
Step2: Reader sends challenge to passport
Step3: Passport encrypts challenge with secret RSA key
Step4: Reader gets encrypted response from passport
Step5: Reader verifies response using the public key from DG15
Active Authentication
Thus, the optional active authentication together with the mandatory passive authentication feature together should provide both data integrity and chip integrity.
Flaws in Active Authentication:
However the active and passive authentication combination is not impenetratable and can be cracked.
a). Manipulating the index file:
Any system (or security feature) is as strong as its weakest link. Even with active authentication enabled e-passports the attacker can manipulate the index file (EF.COM) such that Active Authentication check might be skipped.
Manipulation of the Index File
If the inspecting system is made to think that the DG15 file is not there then it will not check for active authentication, in other words not check for cloning. This attack strategy is also applicable to all other optional security features.
Related Article:
http://freeworld.thc.org/thc-epassport/
http://www.cs.ru.nl/~erikpoll/talks/Makerere/ePassport.ppt
b.) Side-channel attacks:
Side-channels provide unintended means to analyze or manipulate the behavior of cryptographic implementations. Common side channel analysis methods are:
i. Time analysis:
Here process duration is used to reveal secrets. After analyzing RSA trace, and noting the distance variations between higher and lower parts, the key can be derived from a single observation.
Time-Power Analysis of RSA
ii. Power Analysis:
Here power consumption pattern to reveal secrets. Collect many (>1000) RSA power traces and compute average energy per modular operation. Small variations reveal key bits. More advanced correlation analysis is also possible.
Statistical power analysis of RSA (2)
iii. Electro-Magnetic analysis:
Here EM radiation is used to reveal secrets
iv. Power glitching:
This involves the use power interruptions to inject computational faults.
Steps involved in cloning passport through side-channel attack:
Step1: Read personal data (Cloning requires physical access to victim passport)
Step2: Perform multiple active authentications (RSA)
Step3: Retrieve private key by (statistical) analysis
Step4: Load new chip with personal data and RSA keys
Step5: Attach chip to passport document with same identity
! Cloned e-passport chip ready to use!
Related Article:
http://wiki.whatthehack.org/images/2/28/WTH-slides-Attacks-on-Digital-Passports-Marc-Witteman.pdf
EXTENDED ACCESS CONTROL (Optional):
Extended Access Control is confidentiality feature defined by the European Union to allow authorized Inspection system (system used to read e-passport) to read sensitive biometric data such as fingerprints from e-passports. Extended Access Control is not a part of the ICAO standard.
In Extended Access Control the passport reader is required to obtain a digital certificate from the issuing country before it could access the fingerprint file on the passport chip. The certificate is supposed to be valid for only a short period of time so that no reader can access the fingerprint on a passport chip once that time period has expired.
Extended Access Authentication facilitates chip authentication and terminal authentication.
Chip Authentication by Extended Access Control:
replaces the active authentication feature to authenticate the chip and prove that the chip is genuine (not cloned);
establishes strongly secured communication channel (stronger than the one established by Basic Access Code mechanism)
Terminal Authentication by Extended Access Control:
· extra PKI for reader is used to determine whether the Inspection System is allowed to read the sensitive data from the e-passport.
Flaws in Extended Access Control:
i. Though the digital certificate obtained by the reader is supposed to be of short duration the passport chip contains no clock so that it can't know when the time period has passed and determine if a certificate is no longer valid. If the reader equipped with valid electronic certificate is stolen then the passport data can be accessed later and thief can access all biometric information of the person
ii. Another challenge for chips is to maintain an up-to-date list of PKIs belonging to those countries that have signed the appropriate agreement to access privacy-sensitive data. So far, readers must help e-passports figure out whether their countries have been granted access through an as-yet-unspecified protocol.
iii. The reader can read the SOD without passing through Extended Access Control. Someone who, say, knows most of the content of data group can try to access the chip data by brute force.
Related Links:
http://blog.wired.com/27bstroke6/2007/12/authorities-hit.html
http://infoscience.epfl.ch/record/115087/files/Vaudenay-epassport.pdf
Key features of e-Smart technology to overcome current e-passport security issues:
The key features of e-Smart powered Biometric e-passport are:
· e-Smarts proprietary match-on-card technology can be used to verify legitimacy of the person carrying the e-passport even if the passport is subjected only to passive authentication (lowest but mandatory requirement for authentication by ICAO).
· Fingerprint of the individual is used to reliably authenticate person. In e-Smart match-on-card system the biometric fingerprint information would not leave the card/e-passport but is matched within card/e-passport. So the hacker will not get access to to biometric fingerprint data.
· only the biometric template or co-ordinates of the fingerprint is stored within chip from which finger information cannot be extract. Thus, no risk of theft of person’s fingerprint data.
Wireless Fingerprint Matching Passport
Only when fingerprint matches to the passport holder, passport can communicate with passport reader. Passport get power wirelessly and no battery. Fingerprint encripted data of card holder resides inthe passport.
OTHER REFERENCES:
http://blog.wired.com/sterling/2006/11/arphid_watch_fi.html
http://news.zdnet.com/2100-1009_22-149117.html
http://www.cs.ru.nl/~erikpoll/talks/Makerere/ePassport.ppt
http://en.wikipedia.org/wiki/RFID
http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-180779
http://www.homelandstupidity.us/2006/08/03/your-new-e-passport-can-be-cloned/
http://www.homelandstupidity.us/2006/08/15/us-rfid-passports-now-arriving/
http://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-vanBeek/BlackHat-Japan-08-Van-Beek-ePassports.pdf
http://domino.watson.ibm.com/library/CyberDig.nsf/papers/751B6341BFB9015485256FDB005DB216/$File/RC23575.pdf
http://www.law.ed.ac.uk/ahrc/SCRIPT-ed/vol4-3/hornung.asp
OTHER REFERENCES:
http://blog.wired.com/sterling/2006/11/arphid_watch_fi.html
http://news.zdnet.com/2100-1009_22-149117.html
http://www.cs.ru.nl/~erikpoll/talks/Makerere/ePassport.ppt
http://en.wikipedia.org/wiki/RFID
http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-180779
http://www.homelandstupidity.us/2006/08/03/your-new-e-passport-can-be-cloned/
http://www.homelandstupidity.us/2006/08/15/us-rfid-passports-now-arriving/
http://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-vanBeek/BlackHat-Japan-08-Van-Beek-ePassports.pdf
http://domino.watson.ibm.com/library/CyberDig.nsf/papers/751B6341BFB9015485256FDB005DB216/$File/RC23575.pdf
http://www.law.ed.ac.uk/ahrc/SCRIPT-ed/vol4-3/hornung.asp
Thursday, April 9, 2009
Microchip ID- Doggy Technology
There looks like some countries disregarding human dignity, downgrading human to be dogs. That plan is to implant microchip in the human body just like for dog.
As this technology is too old fashioned, anyone can transfer such capsule to god or cat or motorcycle or what so ever moving entity. Let Government keep track some capsule. Someone may give you copied one or better one, like all copies of Mr. President. This happens because there is no biometrical relationship between capsules to human.
Implantation to DOGs.
Our future, implanting to our body, if not using I AM card.
Farther more, the wireless frequency microchip for pet is 125 kHz ( ISO 11784/117785) and 134.2 kHz (11784/85, 134.2 kHz )and the photo looks very similar to capsule for pet, coil winding around ferrite core, cannot be even closer to the range of 1 GHz, how this can communicate with Satellite???? Toll gate at highway is 2-5 GHz with around 100 feet at back scattering. In much higher frequency range, Body acts as conductive body and thus very difficult have long range of communications. We cannot see any battery in the capsule, so communication distance is further limited.
Our future, if not using I AM card.
People can shield wireless communication by putting coin or aluminum foil on that and can put on faked on the top. If any those who want use this, recommended to eat dog food. There are some concern reported that implanted MicroChip caused CANCER. (http://www.nakedcapitalism.com/2007/09/microchip-implants-may-cause-cancer.html). What is interesting even a owner of this company is not ready to implant it.
e-Smart card, contracting to Legacy doggy technology, human possess and card holder’s irreversibly encrypted fingerprint is stored in the card, which can be only used by the card holder under ISO 14443A/B, of course no battery wireless power and fingerprint matching system on card. This is the technology for human and not for dogs. Korea start using this now.
As this technology is too old fashioned, anyone can transfer such capsule to god or cat or motorcycle or what so ever moving entity. Let Government keep track some capsule. Someone may give you copied one or better one, like all copies of Mr. President. This happens because there is no biometrical relationship between capsules to human.
Easily replaceable, easily copy-able, easily shield-able, legacy, low level, Dark Age technology for DOGs.
Implantation to DOGs.
Our future, implanting to our body, if not using I AM card.
Farther more, the wireless frequency microchip for pet is 125 kHz ( ISO 11784/117785) and 134.2 kHz (11784/85, 134.2 kHz )and the photo looks very similar to capsule for pet, coil winding around ferrite core, cannot be even closer to the range of 1 GHz, how this can communicate with Satellite???? Toll gate at highway is 2-5 GHz with around 100 feet at back scattering. In much higher frequency range, Body acts as conductive body and thus very difficult have long range of communications. We cannot see any battery in the capsule, so communication distance is further limited.
Another way to make capsle undetectable is to make LC circuit tuned to the carrier frequency ant put neaby the embedded capsle.
Actually the video shows the distance is few inches, nevertheless talking about GPS(???): Introduced as BARD CODE people (not hair bar code) , http://video.google.com/videoplay?docid=1969277708432444041&ei=wAnfSajHC4jIwgO_prS6Dw&q=microchip&hl=ja. For searching DOG, GPS is attached to the body not in the capsule as shown in the Photo. Do you want to be like this?
Our future, if not using I AM card.
People can shield wireless communication by putting coin or aluminum foil on that and can put on faked on the top. If any those who want use this, recommended to eat dog food. There are some concern reported that implanted MicroChip caused CANCER. (http://www.nakedcapitalism.com/2007/09/microchip-implants-may-cause-cancer.html). What is interesting even a owner of this company is not ready to implant it.
e-Smart card, contracting to Legacy doggy technology, human possess and card holder’s irreversibly encrypted fingerprint is stored in the card, which can be only used by the card holder under ISO 14443A/B, of course no battery wireless power and fingerprint matching system on card. This is the technology for human and not for dogs. Korea start using this now.
No injection needed.
Subscribe to:
Posts (Atom)
