This is a research about Biometric Smart Cards conducted from January through December 2017. The data presented have been collected through various means, including interviews with company representatives, shareholders, researchers, developers, and people involved professionally in the smart card and biometric industry. The views and opinions expressed in this research are those of the authors and do not necessarily reflect the official policy or position of the mentioned companies or organizations. The authors are neither sponsored nor paid by any of the companies mentioned in this work.
This work is licensed under a Creative Common Attribution-NonCommercial 4.0 International License. This means you can share and use part of, mentioning the original work, and that cannot be used entirely or partially for commercial use.
In this research I will reference to a smart card that embeds a fingerprint sensor using the terms ‘Biometric Card’, ‘Biometric Smart Card’ or ‘BSC’. FPC is also an abbreviation of ‘Fingerprint Card’ but I am not going to use it because it’s often used in the biometric industry to identify the Swedish company Fingerprint Cards.
The entire research in PDF format can be downloaded here:
In this research, I will reference to a smart card that embeds a fingerprint sensor using the terms ‘Biometric Card’, ‘Biometric Smart Card’ or ‘BSC’. FPC is also an acronym of ‘Fingerprint Card’ but I am not going to use it because it’s often used in the biometric industry to identify the Swedish company Fingerprint Cards.
Nowadays unlocking our smartphone with our finger it’s kind of spontaneous gesture despite the fact that just few years back it was all very different. I think that the current wide consumers acceptance of the fingerprint as mean to authenticate and access began in year 2013 with the launch of the Apple iPhone 5S. Soon after the Apple launch several other smartphone makers follow suit making the process of utilizing a finger to unlock their phone or to authenticate part of our daily life.
A Biometric Smart Card is a smart card where the processes of fingerprint enrollment, template creation, template storage, template matching is completely performed within the card. As general rule when we reference to a biometric card means that all acquired, processed, computed biometric data and associated templates shall never leave the card.
The electronic representation of the fingerprint is called Template and is it actually a file that can be stored either into the Secure Element (SE) or in a Secure Flash. Most of current implementations of BSC store the Template in the SE.
The Matching process is the operation that compare the acquired fingerprint data with the stored Template. This is a key step of biometric authentication process and this is the reason most of the current implementations perform this in the secure environment of the SE.
Smart cards have been already used in the past with various degree of success to store biometric credentials. There are currently three systems to use smart cards as secure token within the biometric authentication process: Template-On-Card (TOC), Match-On-Card (MOC) and BSoC (Biometric System on Card). In a TOC scheme the enrollment is performed at a standalone fingerprint scanner device, the device itself (or the system where the fingerprint sensor is part of) perform the creation of the template that is then stored in the smart card. During the Matching process the Biometric Terminal extract the reference template from the smart card and it perform a match with the template generated from the user fingerprint. This system is potentially subject to Man-in-the-middle attack because during both enrollment and matching there is transit of secret/sensitive data over a – potentially – non-secure channel.
Match-On-Card system is an evolution of TOC where the matching process is performed within the smart card. The step up is practically the fact that the reference template it never leaves the smart card. Nevertheless, there is a potential risk of man-in-the-middle attach when the reference template is created and when the matching template/acquired image is sent to the card.
A Biometric-System-on-Card do offer higher standards of security when it comes to potential external attacks because the acquired fingerprint image, the template creation, its storage, the matching process is entirely performed within the card.
A Biometric Smart Card includes all electronics, firmware and embedded software needed to carry out the Enrollment, Template Creation, Template Storage and Template Matching.
In the vast majority of the existing current implementations, the Template is stored in the SE. Modern Card Operating Systems allow also possibility to program self-destruction of the Template file if tampering attempts are being detected.
There are however few solutions were the Template is stored in a secure flash, outside the SE.
In a BSoC, specific electronic is programmed to process and extract the biometric features from a raster gray scale image generated by the fingerprint sensor. The extracted features are then converted into a digital template that is stored into a secure memory. Upon user verification a matching algorithm gets as input the stored template (the rightful card owner) and the current template extracted from a live image of the person is trying to authenticate. If the two templates match, the card is authenticated and some features of the cards are then unlocked. Typical examples of successful authentication do allow the card to communicate with a smart card reader for access control or to perform a payment transaction.
Operatively, most BSC are programmed in a way that when the card is powered on, the fingerprint reading starts immediately, so the user shall perform the following steps:
- User get BSC on his/her hand.
- User place finger on fingerprint sensor.
- Authentication / Verification process can be started.
Enrolment is the process to acquire user fingerprint data and store it on the Biometric Smart Card.
Several different enrolment schemes are being explored right now:
- Secure Kiosk: the user interacts with a self-service kiosk, normally installed in a secured environment, e.g. bank branch or government building. Once the fingerprint image has been acquired, the extracted template is loaded into the BSC via contact or NFC.
- Secure Tablet: the user interacts with a tablet assisted by an operator. The operation is normally happening in a secured environment, e.g. bank branch or government building. The fingerprint can be either acquired on the tablet built-in fingerprint reader or on the BSC that communicate to tablet by means of NFC.
- NFC POS: the user interacts with a POS assisted by an operator. The operation in normally happening in the establishment of the card issuer, e.g. casino, shop. The fingerprint can be either acquired on the POS built-in fingerprint reader or on the BSC that communicate to tablet by means of NFC.
- Card Reader: the user interacts with the BSC without any assistance. The operation is normally happening in a non-secured environment, e.g. home, office. The card reader can be:
- Connected to a PC, trough USB cable. In this case there is normally a specific application to guide the user through the enrolment process.
- Self-powered Card Reader: the card reader does have an internal battery and the user interact with the BSC only. BSC feedback can be visual, audio or both. I think this can be a very successful solution for issuance of Payment Cards.
- Smartphone: the user interacts with the BSC that communicate with a smartphone via NFC. The operation is normally happening in a non-secured environment, e.g. home, office.
- Standalone BSC: the user interacts with the BSC only. The BSC shall have its own source of power such as internal battery. BSC feedback can be visual, audio or both.
Considerations on Enrolment Schemes
- Enrolment is probably the most critical and costly part of each BSC project.
- The quality of the reference template generated at enrolment will determine the efficiency of the card during its life cycle.
- Enrolment, when possible, shall be done in a secure environment:
- To identify the rightful owner of the BSC.
- To ensure good quality fingerprint scanning.
- To limit potential attacks.
- Shall be done assisted by trained staff.
- Self-enrolment will probably become popular for non-critical applications.
A BSoC is basically an enabler of Multi Factors Authentication (MFA) where the evidence is represented by the Card = something you have, Fingerprint = something you are and – optionally – a PIN = something you know.
Among the many uses of the Biometric Cards I think are worth to mention:
- To reduce Card-Present-Fraud in Payment Cards
- For identification in Logical and Physical Access Control
- As proof-of-life for ID Cards / Government Cards / Subsidy Cards
- As mean to e-Sign Government documents
Generally speaking Biometric Cards can be practically used in most of the current smart card application as additional level of security or anywhere is necessary to establish a unique link between the card and its rightful owner.
- Solve CPF (Card Present Fraud) in Payment industry
- Combined with Dynamic CVV would allow to solve Card-Present (CP) and Card-Not-Present (CNP) fraud
- Enabler of financial cards use to elderly people with reduced vision
- Enabler of financial cards use to elderly people that have difficulty to remember PIN (and tend to write them down on paper)
- Allow identification of genuine card holder (eID, Driving License Card, Healthcare Card) by Law Enforcement Agencies / Hospital staff / Border Control officials
- Reduce fraudulent physical access to sites protected by card-enabled access control systems
- Reduce fraudulent logical access to systems and IT infrastructure
- Distribution of asylum seekers / migrants / refugees / displaced cash aids by NGOs as secure alternative to mobile payments
This is a generic representation of a Payment Biometric Card with some of the elements that can be present on it that I will use as sample to explain how is made.
This is an exploded view of a reference Biometric Card, starting from back to front we have:
- Back Side Overlay: this is the normal transparent overlay present in most of common PVC
- Back Side Layer: this is the normal backside printed side of the card. It can contain magnetic stripe, signature panel, hologram and other elements.
- Inlay: this is the core of the Biometric Card that it contains all the additional components to add the biometric functions to the smart card.
- Front Side Layer: this is the normal frontside printed side of the card. Notice the additional cavity for the fingerprint sensor.
- Front Side Overlay: this is the normal transparent overlay present in most of common PVC
- Micro module: this is a common smart cart micro module that contain the gold-plated microconnector with the microcontroller attached.
- Fingerprint Sensor: this is the fingerprint area sensor (the other kind of sensor also used for BSC is caller Swipe or Sweep Sensor) that is physically bonded to the inlay.
- Sensor Bezel: this is the conductive bezel that is normally placed on top of the fingerprint sensor. Not all BSC have the bezel.
The core of a Biometric Smart Card is a flexible printed circuit board called FPCB or Inlay. The inlay is developed by the Biometric Solution Providers, manufactured by specialized companies (EMS) and is sold to Card Manufacturers for embedding into their cards.
In the illustration are depicted some of the elements that can be present on a Biometric Smart Card Inlay:
- Micromodule Contact Pad: this is where the smart card micromodule is embedded. Each Biometric Smart Card Solution Provider pre-approve one or more smart card chips to be compatible with their platform.
- Fingerprint Sensor Contact Pad: this is where the fingerprint sensor is going to be embedded. Some suppliers deliver inlays with sensors already mounted on the FPCB.
- Battery or Supercapacitor: used to supply power to the fingerprint sensor and the MCU.
- Status LED: one or more status / operational LEDare present in most Biometric Smart Cards.
- Antenna: for contactless or dual interface Biometric Smart Card a printed antenna is present on the inlay.
- Buzzer: for audio feedback of operations.
- LCD or e-Paper display.
- Passive components: resistors, condensers and few small SMDcomponents are normally present on the flex PCB.
- Test Pads: this is the connection to perform automatic electrical check of the FPCB after the components have been mounted.
Most of the inlays currently in the market are slightly smaller than a card size in order to facilitate their fusing between the front and back side layers.
BSC inlays have different designs and shapes. The key rule is anyhow trying to make them as smaller as possible in order to contain costs.
In the illustration a sample design for a contact-only BSC and for a dual interface BSC
Some Biometric Card developers have realized that they shall have more than one sensor suppliers and therefore have developed a sensor module FPCB that includes:
- Passive components for sensor power supply and management
- An interface
Doing so they can have a common base FPCB inlay and offer them to the market with several sensors. When they want to implement a new sensor they have to make only the small sensor flex dramatically reducing cost and time to market.
The illustration depicts a sample cross section of a BSC. The flexible inlay is fused into the laminated card body.
The Fingerprint Sensor can be on the same level of card surface but most Biometric Card Solution Providers prefer to have its outer sensing surface slightly recessed in order to reduce its wear and tear.
The sensor is often bonded to the inlay using the same technology used for the smart card chip. For more information on the smart card manufacturing process refer to the article How a Smart Card is Made published on Embedded Security News website.
The layers of a Biometric Smart Cards are bonded together with an industrial process called Lamination. More specifically we can have Hot Lamination or Cold Lamination
- Hot Lamination: the layers are collated together and a specific machine apply pressure at various temperature to let the layers to bond together. This is by far the most common process to make standard smart cards and I would expect to become also popular for making Biometric Smart Cards. This process is normally cheaper if compared with Cold Lamination. This process cannot be used for cards that includes batteries, displays or buttons into their design.
- Cold Lamination: the inner layers of the sheets are coated with a pressure activated adhesive and a mechanical press binds them together. The card bodies can be obtained by injection moldings or mechanical punching. This process is complex and only very few companies managed to setup a fully automated process. From the information I was able to get it seems that most of Eastern Asia players have in place processes with some manual labor steps. Cold lamination is the only viable choice when the card it contains temperature-sensitive components such as batteries, displays, buzzers and buttons.
- World standard manufacturing process for all standard non-powered cards. Billion of cards made every year with Hot Lamination
- Use existing production process
- Need additional Milling + Implanting + Embedding modules and custom cutting tool (to detach the sensor from film)
- Additional step for FPS cavity making
- Cannot be used for cards with batteries and displays and other temperature-sensitive components
- Done at different temperature ranges according to layers materials and components to embed
- Allow making large lamination stacks (e.g. 32 or 64 cards per sheet)
- Only suitable process for cards that have batteries, LCD, e-paper display, dynamic magnetic stripes and buttons
- Process automation very complex, most players make use of manual labour
- Popular in Taiwan / South Korea / Thailand
- Normally more expensive than Hot Lamination
- Sheets need highly precise collation to avoid gaps between sensor and card surface
- Injection moulding OK for prototypes, practically not used for mass production
- Possible only small lamination stacks (e.g. 8 or 16 cards per sheet stacks)
As of today, there are no standards about how the fingerprint authentication shall interact with the smart card chip so each Biometric Card Solution Provider have developed their own solution.
Among the most popular operative strategies I think are worth to mention the following:
- IC Power Supply: the default state of the card is not powered so if the user try to use the card for a transaction or to gain access the card does not produce the ATR even if a power supply is applied to the micromodule contacts. After a successful user authentication, the card is powered up and working normally.
- APP Status: the default state of one or more applications loaded into the smart card chip is Disabled so when the card terminal try to select a specific application the card won’t allow the operation. After successful user authentication the status flag of the APP (or the APPs) is set to Enabled and it can be selected.
- Double ATR: upon warm reset the card send the ATR that is received by the terminal. The terminal start counting a predefined number of clock cycles monitoring for a second ATR. If a second ATR is sent within a maximum number of clock cycles the terminal ‘understand’ that user authentication has been performed successfully else it stops communicating with the card (or send to cards commands to initiate the PIN request). I don’t have specific detailed information about this method, however it seems to me that it can become difficult to be implemented in timing-sensitive scenarios like, for example contactless payments.
A Biometric Smart Card need power supply to operate. The power can be obtained by a battery, harvested wireless from the contactless card reader or supplied through the micromodule contacts.
Biometric Smart Cards types with Batteries:
- With no rechargeable battery: when the internal battery is exhausted the card need to be exchanged with a new one.
- With rechargeable battery + Chip contact: they get power from the smart card chip contact pads. This can be complex to be implemented because frequent recharge cycles can kill the batteries.
- With rechargeable battery + Energy Harvesting: they get power from the energy harvested trough the contactless antenna.
- With replaceable battery: this is possible only for Biometric Cards for Access Control application where the energy supplied by the terminal isn’t enough to power the card.
Biometric Smart Cards types without Batteries:
- No Battery + Chip Contact: the card is powered through the smart card chip contacts. It immediately switch off when the card is removed from the card reader. Potentially possible, not really practical for most of common application. For sure this is the cheapest implementation of Biometric Smart Card.
- No Battery + Energy Harvesting: the card is powered by the energy harvested trough the contactless antenna. This is a very popular method for powering dual interface payment biometric smart cards.
- No Battery + Supercapacitors: the card is powered by a supercapacitor, a device that can be considered something between an electrolytic capacitor and a rechargeable battery. Their use is limited by the high device cost.
Flexibles Lithium-ion batteries are very popular in Biometric Smart Card design, however:
- In some countries are subject to certification process.
- Can be subject to transport limitations by couriers and airlines.
This is the reason why most Biometric Smart Card Solution Providers are trying to reduce if not eliminate them. Supercapacitors are a viable – but costly – alternative to rechargeable batteries offering short-term energy storage (that is exactly what is needed for a fingerprint authentication), rapid charge cycle (card does not stay within the electromagnetic field of a contactless reader for hours) and availability in very compact and flexible packaging.
Multi-function powered cards, example OTP cards with biometric fingerprint sensor are normally available with battery only. Batteries are also used in all those BSC applications where there is the need to verify the cardholder identity without any other device.
A Biometric Smart Card without battery or supercapacitor needs a terminal to execute the enrollment or the verification process.
A biometric card must have an additional cavity where the fingerprint sensor is exposed. The cavity can be made with several processes:
- Sheet Punching: the cavity is created by mechanical punching of the Front Side Layer after the color press printing. The punching is performed on the standard 24 / 48 cards PVC This process is suitable for mass production.
- Mechanical Milling: the cavity is created by mechanical milling on a single card with the same equipment used for micromodule milling and embedding process. To use this process the card manufacturer shall add a milling station and an embedding station to its equipment. To use this process the area sensor shall be delivered on reel. This process is suitable for mass production.
- Laser Milling: some trials have been performed using a laser for milling the fingerprint sensor cavity. Results were very good on PC, not so good on PVC. I don’t believe this technology will have much future.
- Injection Moulding: the fingerprint sensor and the micromodule cavities are created with the Injection Mouldingtechniques that is popular for making SIM Cards. This process, that as main material uses ABS, creates the two halves of the card and the back side of the card (sometime the front too) is recessed in order to host the Biometric Card Inlay. This process does produce smooth and clean cavities and do not produce PVC The card is then assembled by Cold Lamination. The disadvantage of this process is that the cards must be printed individually before micromodule and sensor implanting. The process does require some manual labor and it’s currently used with different degree of success by several card manufacturers in Asia Pacific. Personally I don’t believe this process can be effectively used for mass production.
Nearly all first prototypes/version of biometric cards had a swipe sensor, that was the most easily available in the sensors market. Swipe sensors output a large bitmap image of the fingerprint offering a high-quality input to the minutia generation algorithm. The problem was that in order to achieve a good quality fingerprint image the user had to follow a precise procedure for the finger swiping. Tests conducted among test users showed that people with no familiarity with the finger swiping process struggled to understand how to use the sensor or used the sensor producing very low-quality images. Companies soon understood that despite its quality, the swipe sensor was not an optimal choice for a consumer product. So, the research turned to the area sensors that offered simplicity and extremely short learning curve. Here others problem arises because most of the area sensors available during the years 1998-2002 were based on a silicon substrate therefore rigid and not ideally suitable for the semi-flexible nature of the smartcard. Nevertheless, many prototypes carrying rigid area sensors were produced laying the ground for the following generation of area sensor with polymer-based flexible sensing area and separated controller chip that is nowadays the standard. The communication channel between the fingerprint sensors and its controller IC might be considered a weakness of the system this is why most sensor manufacturers use a fully encrypted data & control interface between them.
A typical Area Sensor is made of thin flexible polymer and most of them have the following features:
- Ability to scan a fingerprint at a resolution of 500 DPI. Sensors with smaller resolution compensate with a larger sensing area.
- Almost all of them do have several ways to mitigate ESD and avoid components burning.
- The outer surface is often coated with a very thin protective layer and most of them are declared to withstand at least 1 million of touches.
- Ability to sense when the finger is put on the sensor and sending wake-up signal to the card to initiate the fingerprint acquisition process.
- They produce an 8 bit (256 gray scale levels) image that is sent to the sensor MCUor ASIC for processing.
- Most of them are currently delivered to customer on trays and this make their assembly into the card or card inlays pretty complex. I expect that most of the sensor makers will migrate to 35mm or Super 35mm reel format that is the most commonly used within the Smart Card Manufacturing Industry. As far as I know the first company of the industry that will ship area sensors on reel is Fingerprint Cards.
- Some area sensors include into their design the bezel in form of a continuous or dotted frame along the borders of the sensor.
There are several technologies employed to embed an Area Sensor into a BSC. I believe is worth to mention the Flexible Bump technology (patent of the German company Mühlbauer) were a conductive epoxy resin is dosed between the FPCB and the sensor and is acting as flexible connection between the two parts.
Given the restricted power supply environment of a BSC is critical that the sensor shall not be power-hungry. Even more important in a dual interface BSC architecture were the energy is wirelessly harvested from the terminal. The recently announced FPC1300-Series T-Shape from Fingerprint Cards offers sensors optimized for contactless BSC application. Key values of the series:
|Power consumption @ capture||<5||mA||(@ 1.8V)|
|Power consumption @ sleep||<1||µA||(@ 1.8V)|
The bezel is a thin frame made of metal or other conductive material, that run along the fingerprint sensor border that have the main function to:
- Electrically drive the fingertip during the fingerprint sensing process
- Provide liveness detection (a synthetic “finger” do not conduct electricity as a real finger).
- Providing ESD
- When no epoxy resin is used on sensor embedding, Act as “sealing gasket” between the external environment and the card inlay.
The bezel can also have aesthetic functions helping to cover the soldering point of the fingerprint sensor and/or cover the fingerprint sensor cavity.
In reference to Biometric Smart Cards we can have several types of bezel:
- Bezel supplied as external element that the Card Manufacturer shall apply on the top of the Fingerprint Sensor;
- Bezel supplied as integral part of the Fingerprint Sensor;
- Fingerprint Sensors with no bezel at all.
When present the bezel become integral part of the Biometric Smart Cards and therefore shall be flexible enough to comply with ISO/IEC 10373-1 and CQM TM-408: Bending stiffness.
The MCU communicate with the Fingerprint Sensor Driver IC and the Smart Card Secure Elements using SPI or I2C interfaces. Some vendors encrypt the communication from/to Smart Card IC and the Fingerprint Sensor. The communication network of the MCU, the Smart Card IC, the Secure Flash and the Fingerprint Sensor is a sensitive topic for the security qualification of the product because it’s where external attacks can most likely take place.
The MCU can perform several tasks, including:
- Trigger a system wake-up upon touch of the sensor
- Perform readout image processing (optimization, rotation)
- Compute minutia extraction
- Create template file
- Encryption / Decryption of communication data on the Sensor bus
- Encryption / Decryption of communication data on the SE bus
- Perform minutiae match, when this is not done by the SE
The RF IC is another key component of the Biometric Smart Card Inlay because, when present, can have various functions including:
- Harvest the power from the RFIDexcitation field.
- Regulate the power distributed to inlay components.
- Generate and Regulate the clock.
- Generate the Reset signal.
- Manage the collision that can happen when two or more contactless readers try to interact with the card.
- Charge the rechargeable battery or the supercapacitor.
The DC voltage regulation can also be performed using an electronic component known as Low-Dropout or LDO Regulator.
The clock of the BSC can also be generated by a separate electronic oscillator mounted on the FPBC.
Most of Biometric Cards include into their design one or more elements for user feedback. Those are typically LEDs, buzzer or a LCD/epaperdDisplay and used to communicate with the user:
- Card On / Off.
- Enrolment status (successful / failed).
- Fingerprint verification status (successful / failed).
- Battery status.
- OTP. A biometric card with OTP function is a patent registered by CardLap ApS and QuardLock ApS.
Cards with at least one feedback mean are compliant with ISO/IEC 17839-1:2014.
A Biometric Smart Card can be enabled with one or more contactless interfaces including the popular ISO 14443 Type A, B, C, NFC or Bluetooth LE. Biometric Card focusing on Access Control application can be enabled with one or more interfaces among the following:
- HID 125 kHz / HID iClass
- Mifare Classic / DESFire EV1
- Legic Advant
- Atmel 5577
The Flexible PCB (FPCB) is manufactured by companies specialized in flexible electronics under specification from the Biometric Card Solution Provider. This industrial process output:
- FPCB Inlays mounted on 8 / 16 / 24 / 48 prelam sheets. In this case the assembly is called FPCA (Flexible Printed Circuit Assembly).
- Individual FPCB Inlays, without fingerprint sensor, usually delivered in trays.
- Individual FPCB Inlays with fingerprint sensor mounted, usually delivered in trays.
The manufacturing process for a Biometric Smart Card might vary according to the inlay delivery format decided by the Biometric Card Solution Provider:
- PVCsheets are printed with the usual CMYK / screen press process.
- If the inlays are delivered with fingerprint sensor already embedded, the front side sheet is punched and the fingerprint sensor cavities are created.
- The layers of the cards, typically back side overlay + printed back side + inlay + printed front side + front side overlay, are collated, aligned and put between the lamination plates.
- The sheets are laminated.
- The laminated sheet goes through a punch machine that detach the cards from the sheet.
- The produced cards are aligned in the same orientation, gathered and stacked.
- An automated machine performs the mechanical milling of the micromodule cavity.
- An automated machine embeds the micromodule into the card body.
- If sensor is not already embedded on inlay: a machine creates the fingerprint sensor cavity by mechanical milling.
- If sensor is not already embedded on inlay: the embedding machine apply conductive epoxy on the contacts pads.
- If sensor is not already embedded on inlay: the embedding machine apply adhesive epoxy on the walls of the cavity.
- If sensor is not already embedded on inlay: the embedding machine embeds the sensor in the cavity.
- If the sensor does not include the bezel into its design, the embedding machine apply the bezel on the top of the fingerprint sensor.
This is a reference process and is subject to variations according to the process in place at card manufacturer site.
- As of today only Fingerprint Cards offer sensors delivered in a reel package (they call T-Shape) able to be embedded after lamination.
- Companies are investing into making standalone FPS modules:
- Jinco Universal > allow them to use a common base inlay with several sensors from different vendors
- Next Biometrics > allow them to offer a complete module for easy integration to card manufacturers and BSC developers
- Some sensors (embedded on inlay) can also be placed under the overlay:
- Can be aesthetically very pleasant (flat)
- Provide additional scratch resistance to sensing area
- Does not help user experience, because won’t be any tactile reference neither guidance for the acquisition
Biometric Smart Cards can be personalized with most common personalization equipment; however, it shall be taken into consideration two main facts:
- The card includes a flexible electronic circuit board so anything that impact on the inner layer of the card shall be avoided;
- The fingerprint sensor shall be left exposed.
That said, the most popular (and safest) personalization technologies used for Biometric Cards are Laser engraving and Inkjet printing.
Direct to Card and Retransfer printers can also be used but preliminary tests are necessary to make sure the card can pass freely within the printer transport mechanism. Some Biometric Smart Card have a raised bezel that can jam into the card transport mechanism or/and damage the thermal printhead.
Rear Indent, the technology typically used to imprint the security code on the back of financial cards can be possibly done if no components are present in that specific area of the inlay.
Mechanical Embossing and Front Indent shall not be performed because of the very high risk of damaging the delicate electronic inlay.
Card overlaminates with secure elements such as holograms or security printing inks that cover the whole front surface of the card are highly discouraged because normally cover the whole sensor area making the card unusable. Security overlaminates can be applied on the back side of the card.
Because most of BSC ere thicker than standard ISO smartcards (0.76 mm – 1/32 in) it’s always recommended to try to personalize a single card before launching the mass process.
This section about core technology of fingerprint sensors is curated by Mr. Jean-François Mainguet, better known as the inventor of the sweep fingerprint sensor. Anyone interested to learn more about fingerprint sensor technology is invited to visit Mr. Mainguet website at biometric.mainguet.org.
Two main type of fingerprint sensors are available in the market today:
- Area Sensor:
- Static acquisition
- Working mechanism: the user just touches the sensing area
- Ergonomics: almost no training required
- Image size: smaller than Sweep Sensor
- Cost: normally cost more than Sweep Sensor
- Sweep (Swipe) Sensor:
- Dynamic acquisition
- Working mechanism: the user sweeps their finger across the sensing area
- Ergonomics: some training required
- Image size: normally larger than Area Sensor
- Cost: normally cheaper than Area Sensor
Fingerprint Sensors are manufactured with different substrates:
- When thinned became flexible
- Cost directly linked to sensor area
- Currently used for BSC
- Not flexible
- Require an external silicon chip as driver
- Currently not used for BSC
- Require an external silicon chip as driver
- Currently used for BSC
Types of fingerprint sensing technologies available in the market:
- Reflection FTIR
- Direct Image:
- Structured Light
- Active (RF Field)
- Conductive membrane
- Tactile (MEMS)
- Emissive polymer
A Passive Capacitive fingerprint work on the measurement of the capacitance between the skin and the sensing pixel.
– Ridge: skin is touching the coating, there is only the coating capacitance.
– Valley: the capacitance between skin and coating is in series with the coating capacitance, so a lower capacitance.
To provide enough sensitivity, the coating must be as thin as possible: a few microns is better, but some companies proposes hundreds of microns at the cost of a lower resolution (blurred images).
A significant drawback is the sensitivity to external electrical fields, the most dangerous being ESD (Electro-Static Discharge).
Active capacitance sensing is using a RF signal that goes through the capacitance between the skin and the pixel. The main advantage is the ability to adjust the signal level, at the cost of a connection to the skin.
The sensor measures heat capacity. A low power heat pulse is applied to each sensor pixel over a short period of time and a response is measured.
- valley: the air is very thermally resistive, and so the heat stays inside the sensing element, the final temperature is high
- Ridge: the skin is pumping the heat, final pixel temperature is lower
Find a compromise:
A sensing type: swipe or area?
- Swipe: larger image but ergonomic may be a problem
- Area: easier to use but costly than Swipe
A sensing technology: active capacitance & thermal are the most common for smart cards
A sensor substrate:
- A silicon substrate sensor must be small because of the cost and the flexibility requirements, so with lower accuracy
- A plastic substrate is less expensive, flexible and will be larger, but requires some silicon drivers anyhow
The Biometric Card Solution Provider is primarily a holder of IPs on process and technologies that allows Card Manufacturers to produce Biometric Smart Cards. Only very few Card Manufacturers have capability to fully develop, industrialize and produce a Biometric Smart Card totally in-house.
The Biometric Card Solution Provider deliver a biometric solution to the Card Manufacturers that is made of:
- Flexible Inlays / prelaminated sheets.
- Fingerprint Sensors (embedded on inlay or as separate component).
- API for MCU/ ASIC interface with Smart Card Chip.
- Development tools that includes prototyping / testing / production / personalization tools.
- Enrolment software package or API / Windows drivers.
- Licenses for components / applications / matching algorithm and industrial processes.
The fingerprint templates matching algorithm can be licensed by third parties but can also be developed by the Biometric Card Solution Provider or by the Fingerprint Sensor vendor.
We are experiencing the beginning of new business model for the inlays that does not includes embedded fingerprint sensors. When this is happening the Card Manufacturer can manage the supply of the fingerprint sensor independently from the Biometric Card Solution Provider (as long as they purchase the sensor compatible with the selected inlay).
The Sensor Solution Provider is a company having IPs on:
- Sensor technology
- Sensor assembly
- Sensor manufacturing
- Sensor module
- ASIC design
The delivery to the Biometric Card Solution Providers can be made of:
- Sensor Module
- Sensor ASIC or MCU
- Biometric Engine licenses
- Development tools
- Production tools
- Testing tools
This is a map of the key trials and pilots made with Biometric Smart Cards in the last four years:
Year 2014 – Sparebanked DIN – Norway
This was a joint pilot Zwipe – MasterCard and probably world first Biometric Payment Cards endorsed by a large card processor. The smart card EMV chip was supplied by Oberthur.
Year 2015 – Danske Bank- Denmark
This was a joint pilot Zwipe – MasterCard had with selected customers of the Danish Danske Bank. The smart card EMV chip was supplied by Oberthur.
Year 2015 – Battistolli – Italy
This was a pilot done in Italy using Card Tech Biometric Cards and customized POS terminals by Ingenico. The Biometric Cards were used for identification and access of personnel working at secure logistic company Gruppo Battistolli, specialized in transporting cash, jewelry and other kind of valuables.
Year 2016 – Bundesdruckerei – Germany
This was a pilot made with Bundesdruckerai Biometric Smart Card called GoID, used as company ID among its employees. The GoID card is made of hard-wearing fibre composite and it includes a 12 keys pinpad and a lanyard hole.
Year 2017 – Pick n Pay – South Africa
This was a Biometric Payment Card pilot run by Oberthur and Mastercard at the leading South African supermarket retailer operator Pick n Pay.
Year 2017 – Absa Bank – South Africa
This was a Biometric Payment Card pilot run by Oberthur and Mastercard at Absa Bank, a wholly-owned subsidiary of the Barclays Africa Group.
Year 2017 – Pleinair Casino – France
This pilot – that is still ongoing at Plenair Casino La Ciotat in France – uses 7000 MeReal Biometrics V2 Biometric Smart Card. The cards were launched initially to be used by employees to grant access to private back-of-house and privileged areas, as well as provide record-keeping for time and attendance. It’s expected that the group will add more applications for Access and Payments in the future for employees and for its 1 million VIP players who currently carry a contactless loyalty cards.
It’s worth to mention that the Chairman of the Supervisory Board of the Groupe Partouche, the casino’s owner, Mr. Patrick Partouche is MeReal Co-Founder and shareholder.
Year 2017 – United Nations – Switzerland
The United Nations in Geneva is testing 500 Biometric Cards loaded with physical and logical access applications. The tender for the cards was won by Korea Smart ID that developed the Biometric Smart Card using an Elan Microelectronics fingerprint sensor and an inlay made by Jinco Universal.
Year 2017 – AirPlus International – Germany
The Korean company Kona I is deploying their Biometric Smart Card to AirPlus International, a leading international provider of solutions for the management of business travel. The card – that have payment and loyalty features enabled – feature a Fingerprint Cards sensor. As far as I know the cards have been not delivered yet to the customer.
Year 2017 – Instanbul Municipality – Turkey
The Korean company KSID won a tender for the supply of Biometric Smart Cards to be used as authentication token for the official taxi drivers of Istanbul Municipality.
Year 2017 – Woori Bank – South Korea
KSID won a tender for the supply of Biometric Smart Cards to Woori Bank for bidding at the South Korea National Market Agency of the Public Procurement Service.
The year 2018 will be a crucial year for the development of the BSC market. In fact, I think is during the next year that the market will take shape with more precise identification of whom will lead the market in the years ahead.
Among the many planned projects for the year 2018 I think that the most realistic will be:
Cartes Bancaires: the French banking group, which in 2016 represented turnover of €465.6 billion in card payment is going to test BSC from Idemia (MasterCard) and Gemalto (Visa) for an undisclosed quantity. Given the current state of industrialization I won’t be surprised if the cards delivered for the initial launch will be contact-only.
Bank of Cyprus: The Cyprus-based banking group, is the largest bank in Cyprus by market penetration. They are going to trial one of the first Visa branded BSC in the market with cards supplied by Gemalto.
United Nation: It’s expected that they will complete the ongoing trial and start the deployment of the BSC for logical and physical access control to their employees in most locations worldwide.
JCB – Japan: I expect the payment scheme to launch several BSC commercial deployment to major Japanese banks.
The development on Biometric Smart Cards by the tier-one card vendors is the following:
- Gemalto: industrialization for a payment-focused BSC is currently undergoing at their R&D centers and plants in France and I would expect them to have the product ready by end of the year and first delivery for pilots by Q2/Y2018.
- Idemia(former OT-Morpho): is the first company among the first-tier card vendors to have completed the industrialization and is already selling Biometric Smart Cards for various small trials and projects worldwide. They are currently offering two products:
- BSC with area sensor from IDEX with the Biometric Authentication Engine developed by the Morpho team (now integral part of Idemia). The current battery-powered BSC is claimed to be able to operate for approx. 3000 payments or 3 years.
- BSC dual interface energy-harvesting with area sensor from FPC.
- G&D: as of time of writing I am not aware of any product offered by the German company.
- Korea Smart ID: it’s the company that by far shipped the largest number of Biometric Smart Cards. Among the several projects won, are worth to mention:
- Logic and Access Control Card for United Nations.
- Taxi Drivers ID License Card for Istanbul Municipality.
- E-Procurement Platform Access Card for Woori Bank.
- Kona I: the leading South Korean company have launched in the market a full fledged portfolio of BSC. See later for details.
Basically, all card processing schemes are somehow involved into the definition and/or implementation of work related to BSC.
Mastercard has been the first company to focus and invest in BSC starting from the earlier trial with Zwipe cards and their CQM Approval Scheme has been updated to support BSCs.
Visa started only recently to work on the subject of BSC. In fact, the first public appearance of a Visa-branded payment BSC happened only last October at Bloomberg Next event in Washington, DC. Several sources reported that Visa has setup a specific partnership on BSC with Gemalto.
China UnionPay is currently testing several China domestic-made BSC and it seems that the first products that pass their qualification are an MCU and an Area Sensor made by Datang.
The Japanese scheme JCB is currently promoting BSC at several domestic Japanese banks. I would expect several trials during the year 2018.
- Identification and related documents
- Security devices associated with their use in inter-industry application and international exchange.
The ISO/IEC 17839-1:2014 – Biometric System-on-Card – Part 1: Core requirements define two type of cards:
- Type S1:
- Type S2:
The ISO/IEC 17839-1:2014 – Biometric System-on-Card – Part 2: Physical characteristics specify the key characteristics of the biometric acquisition element on card:
- For Area Sensors:
- They shall have a minimum active area of 169 mm2(13 x 13 mm or 0.152 x 0.152 in)
- For Swipe Sensors:
- They shall have a linear acquisition element measuring minimum 13 mm (0.512 in)
- Allows presence on card of other electronic elements able to acquire voice (microphone), facial image (camera) or card user signature (signature input pad).
As of time of writing, only the Next Biometrics area sensor NB-0610-S2 reach 201.11 mm2 and is therefore compliant within the minimum area specified of 169 mm2.
The ISO/IEC 17839-3:2016 – Biometric System-on-Card – Part 3: Logical information interchange mechanism covers the main commands, protocols and procedures to coordinate the biometric enrollment/verification with the smart card microcontroller and the terminal:
- Commands and data structure
- Internal Enrollment and External Enrollment
- Initiation of verification
- Status feedback
- Processing time management and extension
- Capability discovery mechanism
Other ISO TS / TR related to Biometric Cards includes:
- ISO/IEC 24787: 2010 – On-card biometric comparison
- ISO/IEC TR 30117: 2014 – Guide to on-card biometric comparison standards and applications
- ISO/IEC 18584: 2015 – Conformance test requirements for on-card biometric comparison applications
Mastercard Card Quality Management (CQM) is a program that involve Personalization bureaus, Card manufacturers and suppliers of the card manufacturers (chip, modules, inlays, etc.) to self-assess MasterCard EMV cards (ID1 card format) against specifications of Quality Management and Product Quality. Self-assessment is controlled by on-site audits where certified auditors can issue a full approval or indicate the corrective actions to be performed.
The list of certified companies is updated monthly and published at www.mastercardconnect.com.
Biometric Smart Cards are tested under the Product Program called Card Structure Integrity and Security.
EMVCo is currently working on the 2nd Generation Specifications that will include Biometric Cards. The specifications on the terminal side have been completed while those of the cards are still ongoing. In November 2017 the working group will meet in Paris also to discuss and potentially finalize the specifications for the Biometric Card.
The latest 3D Secure version 2.0 use token-based and biometric authentication, instead of static passports.
Visa, MasterCard and American Express have updated their Payment Applets specs in order to be biometric-compliant introducing the possibility to use card holder Fingerprint verification as alternative to PIN.
The European Union, on 25 November 2015 have issued the directive 2015/2366 on payment service in the so called “internal market”.
The Directive, that is currently in force provide the legal foundation for the further development of a better integrated internal market for electronic payments within the EU and, among the several new recommendations, it introduce the requirements for “Strong User Authentication”.
Strong User Authentication requires the use of at least two independent elements among:
- Knowledge category > example the PIN
- Possession category > example the card
- Inherence category > example the fingerprint
Development of biometric authentication at ICAO working groups is still ongoing. As of time of writing there is still no specific reference to Biometric Systems on Cards.
Biometric Smart Cards are set to enjoy wide acceptance because of the following key factors:
- Consumers familiarity with Smart Cards and smartphones.
- Relatively slow consumer adoption of mobile payments.
- Strong need to solve the skimming / shimming of payment cards.
- Payment industry need to reduce Card-Present frauds.
- Improve verification and authentication processes that in some context doesn’t work anymore, even with smart cards. Just think of a classical Access Control implementation where a thief can steal someone else badge and gain physical or logical access to facilities and/or systems containing sensitive data.
- Low implementation cost. Apart from the cost related to acquisition of new cards and the initial user enrollment, on the terminal side minor or no changes are required.
- New local, regional, national, trans-national legal framework / recommendations / laws on management of biometric data are being published and updated; in most of them is indicated that biometric data (either raw or processed) cannot be stored in a centralized database. This is a major shift of paradigm toward many current implementations were biometric data are stored in a single large database.
- Last, but not least the elimination of risks associated to infection transmission with standalone fingerprint scanners.
Further development of Biometric Smart Cards can he hampered by several factors:
- Rejection due to personal reasons.
- Cultural incompatibility, due to certain religion believes, for examples.
- Lack of respective biometric feature, example people born with the rare genetic disorder called Adermatoglyphia, where the person have no fingerprints. Dermatitis can also cause inflammation of the skin and temporarily leave the individual unable to leave fingerprints. The autoimmune disease Sclerodermacan also create a condition where the person fingerprint is extremely light and sometime impossible to be recorded by a fingerprint scanner.
- Criminal organizations might develop techniques to enroll/verify fake or artificially built fingers avoiding the liveness detectors and other technologies on board of the fingerprint scanners.
- Hacking of biometric data from commercial weak BSC could create a strong negative media campaign. The real problem is that biometric data, unlike PINs is persistent: we carry it with us for life. Any security breach resulting in leakage of this information is likely to have much more serious consequences than a theft of a PIN: after all we can change a weak PIN but we can’t change a compromised fingerprint.
- World leader in the field of ID technology and banknote printing
- Owned by The Federal Republic of Germany
- Producer of Germany National ID Cards and ePassports
- Developed GoID, multifunctional Contactless ID BSC:
- Use capacitive sensor
- Thick 2.5mm (Format ISO S2)
- Made of hard-wearing fibre composite
- Energy harvesting
- Can have display, keypad and lanyard hole
- Some components made with 3D printing process
CardLab is a Danish private company founded in 2003. They have a very solid portfolio of patents on powered smart cards and offer a flexible platform where customers can choose the elements to be included in the cards.
CardLab was one of the first company to make Biometric Smart Cards in Europe and – as many of the early adopters – using a swipe fingerprint sensor. The company new manufacturing plant is located in Bangkok, Thailand where they plan to produce also Biometric Smart Cards using a fully automated custom-made Lamination process.
CardLab new Biometric Smart Card is currently under industrialization and it should be ready for mass launch early 2018. This card will feature Fingerprint Cards FPC 1321 fingerprint sensor.
Among their products worth to mention a FIPS compliant BSC featuring the swipe sensor FPC1080A that is expected to be launched during Q2 Y2018.
CardTech is an Italian private company founded in 2006 by Mr. Fabrizio Borracci. The company launched their first Biometric Smart Card embedding a swipe sensor then migrated to an area sensor. So far, the company have invested in excess of 6M€ of private funds into the development of their Biometric Solution also thanks to strategic cooperation with key players into EMS and flexible electronic design and manufacturing.
As of time of writing, the company it uses almost exclusively area sensors from IDEX that are embedded in the inlay at the end of the manufacturing stage of the flexible electronics.
CardTech is supported by a tier-one card vendor, by several 2nd tier card manufacturers and is cooperating with a leading payment scheme.
CardTech propose an architecture where the template matching is performed by the Smart Card Chip and the main product marketed today is a contact-only Biometric Smart Card. A Dual Interface version is under development.
The company is currently delivering products to make a contact BSC that will go live in a bank on Q1/2018.
The key target markets of the company are Payment and ID.
- Chinese professional card manufacturer specialized in PKI and Strong ID products
- Y2016 revenue 338.47
- Offering Mobile Payment Terminals, OTP Tokens, Card Readers, Software Protection Tokens, Card OS licensing, ID and EMV Cards
- Developing BSC with Idex area sensor
First Biometrics is an American private company founded in 2015.
Their development is based upon several biometric-related patents, some acquired, others filed by themselves.
The company focus development of their first battery-based contact BSC using a large area flexible sensor from Next Biometrics and SE supplied by multiple tier-1 vendors. Production is going to take place in East Asia and US.
Although they produce their own Biometric Smart Card they have specific partnership with KSID Korea (IC Chip OS + Card Manufacturing) and Elan Microelectronics (Fingerprint Sensors). Together they have participated and won the United Nations tender for the Biometric Cards trial.
They do have few patents on Biometric Cards and their manufacturing process is almost entirely focusing on Cold Lamination technology.
They do offer Contactless Biometric Cards with rechargeable battery, dual interface energy harvesting Biometric Cards and dual interface biometric cards with rechargeable battery plus dynamic magnetic stripe and display. As optional contactless interface is also available the Sony Felica RC-SA01 transponder chip.
- South Korea largest manufacturers of smart cards
- Strong Card OS and manufacturing know-how
- Supplier to Visa for trial BSCs
- Sensors from FPC
- Own developed BSC inlay
- Offer a full range of BSC:
- Non-rechargeable or rechargeable Battery
- e-paper display
- PKI engine
- World-class provider of component-based solutions for the security & identity market, shipped more than 90 Billion connectors since its founding.
- Cooperation with FPC on the T-Shape packaging
- Developer of OEM inlay technology, powered by Contact, Antenna or Battery, supporting several components:
- Contact Plate
- RF Antenna / Battery
- South Korean start-up working on several IT solutions:
- M-Cube: Indoor Location Service
- MobiTalk: Messaging solution
- Red POS: POS solution
- The Card: battery-powered wallet card – up to 200 cards – with Fingerprint sensor.
- First prototype publicly demo at Trustech 2017 was with sensor under overlay
- Currently working on area sensor from FPC
MeReal Biometrics is a private company based in Hong Kong founded in 2009 and is led by Patrick Partouche and Philippe Blot. Mr. Partouche other being chairman of MeReal Biometric is also Chairman of the Supervisor Board of Groupe Partouche. Mr. Blot is CEO and Chairman of UINT, a French company specialized in powered smart cards.
The Biometric Smart Card platform offered by MeReal Biometrics make use of rechargeable batteries and among their product range there is also a compact portable contactless battery charger.
First version of their Biometric Smart Cards used swipe sensor, lately switched to area sensor. Trials are currently ongoing among Partouche Group employees. Partouche Group is an industrial group active in casino, hotel, restaurants and spa businesses.
Morix is a Japanese private company founded in year 2005 and is one of the oldest company operating in the field of Biometric Smart Cards.
Morix have co-developed with ASD an area sensor for Smart Card that is used in their product and also sold as standalone device.
The key product of the company is a Biometric Smart Card with non-rechargeable battery while a dual interface NFC Biometric Smart Card is currently under development.
On October 31, 2017, NXP announced to be working with Fingerprint Cards on a BSC solution. No details where give. I can only speculate that it will be something like depicted in the above illustration.
- However, if it will be like expected, will be a disruptive innovation with consequences:
- Extremely simplify the task of inlay development, because it will carry simply an antenna with two wiring to sensor (SPI and VDD) plus sensor bonding pads
- Drastic reduction of Inlay cost
- Combined with FPC T-Shape sensor, will allow 2nd tier card manufacturers to enter into the BSC business using the production process that they already in place for financial cards (Hot Lamination + Milling + Embedding)
- Will pose an extremely serious threat to companies such as Card Tech, Zwipe and others that have heavily invested into own BSC inlay development and are without differentiating factors (e.g. own card OS, e-paper displays, acoustic authentications, batteries, dynamic CVV).
- SmartDisplayer is a Taiwanese company specialized in design and manufacturing of powered cards such as Display Cards, OTP Cards, Dynamic CVV Cards and All-in-one cards
- Delivered to market > 8M Display Cards including 600.000 All-in-one Cards
- HQ, R&D and Production unit in Taiwan
- Battery-powered BSC with area sensor under development
Tactilis is a private company founded in Singapore in 2009 run by smart card industry seasoned professionals led by Michael Gardiner (CEO), Adriano Canzi (CTO) and David Martin (CFO). The manufacturing base is located in Penang, Malaysia.
Their core product is a dual interface, energy harvesting Biometric Smart Card with large area sensor from Next Biometrics. Their Biometric Smart Card is powered by the popular Cortex M4 and they offer secure flash storage up to 4 GB, opening the door to several advanced applications. The card is assembled using a patented process.
The product is available as complete card or as flexible inlay on OEM license.
- BSC developed by Toshiba Infrastructure Systems & Solutions Corp.
- First product targeting mainly ID applications
- Main specs of first BSC launched in the market:
- Contact only, no battery
- Enrolment performed on USB fingerprint scanner
- Minutiae extraction and template creation done by App on PC, then transferred to SE
- Uses a Morix FPSF105AU Area Sensor, 8 x 8mm, 160 x 160 pixels
- Hot laminated card body
Zwipe is a private Norwegian company founded in 2009 by Kim Kristian Humborstad that is currently the company CEO.
Zwipe is invested since 2015 by Kuang-Chi Group (深圳光啟集團) a Chinese diversified technology conglomerate that develops and invests in telecommunication, aerospace, artificial intelligence, metamaterial, smart-city and digital health technologies. Kuang-Chi is also majority shareholder of a JV setup in 2016 with Zwipe to promote biometric products in China.
Zwipe have the largest IP portfolio of the Biometric Smart Cards industry with more than 50 patents filed.
Main products by Zwipe includes:
- Dual interface, energy harvesting BSC with focus on payment applications.
- Contactless, energy harvesting BSC with focus on ID applications.
- Clam shell design, rigid, non-ISO, access control BSC powered by a replaceable battery. This is the first commercial product of the company and is currently available worldwide through a network of selected partners.
This table summarize the main type of Biometric Smart Cards offered by the companies introduced in the research. Jinco Universal is the only company in the market able to offer the complete range of Biometric Smart Cards variants.
Datang Microelectronics Co.
Datang Microelectronics Technology Co., Ltd (DMT), chinese name 大唐微电子技术有限公司, formerly the IC center of China Academy of Telecommunications Technology (CATTIC), is a holding subsidiary of Datang Telecom Technology Co., Ltd (DTT, 600198. SH), a State owned 3.3B$ industrial group. As one of the largest IC design companies in China, DMT has established Asia’s largest, highly complete and sophisticated smart card chip production line. The company develop, produce and distribute ICs for smart cards, micromodules, fingerprint sensors and flexible PCB inlays.
Datang key products are:
- Contact Biometric Smart Card with rechargeable battery.
- Dual Interface Biometric Smart Card with rechargeable battery.
- Clam shell Biometric Smart Card (non ISO) with rechargeable battery.
- Capacitive sensor DMT-FS-PB4F
- MCU DMT-FAC-CG4Q
Elan Microelectronics Corp.
- Company listed on Taiwan Stock Exchange with $750M Market Cap.
- Y2016 revenue of $218M
- HQ in Taiwan, offices also in China and USA, >1000 employees, >55% in R&D
- Products: FPS, Smart Human Interface, Notebook Input Device, MCU
- Hold multiple patents on sensors, registered in Taiwan, China and USA
- Partner on BSC cards with Jinco (FPCB + Lamination) and KSID (SE)
- Cards with Elan sensor currently under test at United Nations
- Low-power Area Sensor for Battery-Less BSC under development (target Q2/Y2018)
- Key BSC Products:
- eFSA160S-H701Z Area Sensor, 160 x 160 pixel, 8 x 8 mm
Fingerprint Cards AB
- Biometric company, focus on sensors, algorithms, software and packages
- Listed in Nasdq Stockholm, Y2016 revenue €678M, 39% operating margin
- 550 employees on 13 offices in Sweden, USA, India, China, Korea, Japan, Denmark
- Strong player in fingerprint sensors for mobile
- Offering capacitive silicon-based area and swipe sensors optimized for smart cards
- Most recent area sensors are delivered in LGA or T-Shape packaging
- Developed FPC1300-Serie optimized for smart card application:
- FPC1320, 508dpi
- FPC1321, 508dpi, smaller and lower power consumption than FPC1320
- FPC 1080A, swipe sensor, FIPS compliant
- The Fingerprint Cards T-Shape is a packaging option for the FPC 1300 series
- Optimized for hot lamination + milling + embedding process
- Company listed on Oslo Stock Exchange with NOK 2.739B ($ 336M) Market Cap.
- Biometric company, focus on fingerprint imaging and fingerprint recognition technology
- >120 employees, with offices in Norway, UK, USA, China
- Offer silicon and polymer sensors for mobile, IoT and smart card applications
- Patented Off-Chip technology where MCU and Sensor controller are integrated under the polymer-base sensing area
- Main offering of off-chip sensors optimized for smart cards:
- IDX3010, sensing area 8.9 x 8.9 mm, 130 x 129 pixel, 373 dpi
- IDX3200, sensing are 9.5 x 9.5 mm, 132 x 131 pixel, 350 dpi
- Larger sensor under development, release expected during Y2018
Infinity Electronic Biotech (IFE)
- Subsidiary of Super Wings International Ltd, an Hong Kong company operating in Textile and Biometrics.
- Specialised in silicon-based capacitive fingerprint sensors
- Offering BSC-optimized sensor IFE338:
- capacitive area sensor
- 192 x 192 pixel @ 508 dpi
- I/F UART or GPIO
- Module with integrated MCU
- Module size 13.5 x 26 x 0.61 mm (W x L x T)
- In-house Fingerprint Matching algorithm development
- Key specs of BSC optimized FPSF 105 AU fingerprint sensor:
- Capacitive area sensor 8 x 8 mm, 508 dpi, 160 x 160 pixels
- Built-in 8 bit ADC
- Finger present detection
- SPI Interface
- Power consumption:
- Standby mode 1.5 mA
- During fingerprint scan 7 mA
New Imaging Technologies
- French company pioneer in Wide Dynamic Range solutions
- Developer of optic-less high resolution, up to 2000 dpi, fingerprint sensors
- At least two BSC developers are working to integrate NIT sensors into their products
Next Biometric Groups AS
- Company listed on Oslo Stock Exchange with $80M Market Cap.
- HQ in Oslo, offices in Czech Rep., USA, Taiwan and China, 60 employees
- Core business design and commercialize flexible fingerprint sensors
- Fingerprint sensing through patented Active Thermal principle
- Manufacturing partnership with Innolux Taiwan
- Sensor used in Tactilis, and First Biometrics (under development) BSC
- Only supplier offering an ISO-Compliant area sensor (11.9 x 17.9 = 201 mm2)
- Key BSC Products:
- NB-0610-S2, 11.9 x 9 mm, 385 dpi,
- NB-4410-S2/I2 (sensor + flexible inlay module)
- Offer flexible platform based on high performance organic thin-film transistor (OTFT)
- Company platform enables flexible, thin, robust displays
- Key solutions for BSC:
- Capacitive fingerprint sensor
- Optical fingerprint sensor with vein sensing capability
- FlexEnable business model:
- IPs license
- Prototypes making
- Technology transfer
Several companies are active in the development of biometric engines optimized for the -low-resource environment of a smart card. Few more information in the below table:
|Innovatrics||Slovak Republic||Biometric Solutions||Yes|
|Id3||France||RF, RFID, Biometric Solutions||Yes|
|Fulcrum Biometrics||USA||Biometric Software & Solutions||Yes|
|Neuro Technology||Lithuania||Biometric Algorithm & Software||Yes|
|Precise Biometrics||Sweden||Biometric Software||Yes|
For year 2017 I expect a global combined volume of shipped Biometric Smart Cards below 1M units.
Year 2018 will mark the beginning of mass deployment for Biometric Smart Cards with a global volume that will stay around 55M units.
By the end of year 2018 new Inlay ASICs will be ready and optimized fingerprint sensors will be available at lower cost generating a new, larger wave of issuance that might likely reach at least 180M of Biometric Cards during the Year 2019.
Biometric Smart Cards will eventually become part of most card vendors portfolio and the cards will reach a pricing level that will enable new applications. Isn’t an easy call making a forecast for the year 2020, let’s say that with the indicators available today I would put that number around 320M cards shipped globally.
In terms of type of applications, I would most volumes will be in Payment, followed by ID and Access Control.
Current ASP of a personalized Biometric Smart Card without battery is between 25 and 30USD. Pricing for very low volume, e.g. hundreds of cards can double or multiply by four the price. This is happening because product industrialization has been just completed or is under completion thus we can’t enjoy yet the pricing given by the economy of scale.
Pricing for battery-powered Biometric Smart Card are normally higher of those without and clamshell biometric cards for access control cost even more because of the molded rigid shells and manual labor for its assembly.
Kindly note that the provided forecast is purely indicative and will be surely subject to significant variation mainly due to:
- Variation in price of the fingerprint sensors.
- New ASICs integrating MCU+ RF IC + Fingerprint Sensor driver IC + Secure Flash. If the market will become significantly relevant I would expect smart card chip manufacturers to power up their IC design integrating all is needed to fully power and control a Biometric Smart Card. This last hypothesis will require a highly coordinated effort between chip manufacturers, sensor manufacturers, biometric authentication algorithm developer and smart card vendors.
- Market demand: a strong market pull will drive pricing down.
- Popularity wave created by Card Issuers.
- Ability of Card Manufacturers and Biometric Solution Providers to optimize the industrialization process.
The industrial process of making flexible PCB is well established, so I only expect slight reduction in FPCB cost when Biometric Cards shipping volumes will go up.
Given the very fast pace of today technology, it won’t be easy to predict what will happen in the future. However, I will provide my very personal view of what might be happen in the next 3-5 years from now:
- Fingerprint Sensors will extend existing liveness detection with vein sensing capability, blood flow and heartbeat detection.
- In terms of electronics I foresee a drastic reduction of components on the flexible PCB:
- Y2018-2019 – Two main chips on board: Smart Card Microcontroller + M4-like MCU.
- Y2019-2020 – Two main chips on board: Smart Card Microcontroller + custom ASIC.
- Y2020 onward – All electronics embedded into the Smart Card Microcontroller. NXP have made announcement of an integrated SE for biometric card on Oct 2017. Still unsure what is this including and when will be commercially available.
- Fingerprint sensors will be able to operate under a layer of conductive plastic. This means no more fingerprint sensor cavity and cost reduction due to simplified manufacturing.
- Behavioral biometric meaning a system comprised of fingerprint and additional sensors able to “learn”, “record” and “detect” user finger behavior in terms of speed, approach point on sensor, rotation on sensor, pressure on sensor and other user behavioral patterns.
- Contactless fingerprint sensors where the user fingerprint is read without need of physical contact with the sensing surface. Nice in theory, in practical life it open the door to a new category of finger skimming.
- Development of compact DNA sequencer able to fit into a smart card format.
- More user physical features will be extracted such as vein pattern of finger temperature and those data will be associated with the fingerprint template.
- Idex ASA working on a new polymer-based area sensor and innovative solution for self-enrollment
- Toshiba launched contact-only BSC with Morix area sensor
- SmartDisplayer have started development of BSC with area sensor
- Elan is developing a low power consumption area sensor optimized for battery-less BSC
- G&D is evaluating possibility to develop a BSC.
- Idemia and JCB announced launch F-Code card in Japan. Not sure if this announcement can have any effect on the ongoing partnership between Idemia and MasterCard.
- IDEX officially announced their partnership with MasterCard
- Germany company Mühlbauer involved in customization of equipment for Milling + Embedding of fingerprint area sensors onto cards.
- NXP Semiconductors showcased its new fingerprint-on-card solution at Money 20/20 in Las Vegas made in cooperation with Fingerprint Cards.
- Fingerprint Cards has been appointed as executive member of Eurosmart and head of the Biometric Committee.
- Daon (daon.com) selected as supplier of Biometric Authentication Service for “Visa ID Intelligence” platform. Not sure if and how this is related to BSC.
- TheTrustChain, an ING ACT sponsored initiative launched Citi’zen Card to address identity violation and theft. More info at http://www.thetrustchain.net/
Thank you to the following people for all their contribution, effort, motivation provided to me during this work: Ondřej Adámek, Rouzet Agaiby, Massimo Edoardo Baumgartner, Paolo Bean, Fred Benkley, Luca Bertoletti, Fabrizio Borracci, Adriano Canzi, Laszlo Csercsa, James Chuang, Renato Comelli, Thomas Decker, Pascal Dufour, Ritu Favre, Sebastian Gallschütz, Michael Gardiner, Franck Germain, Kim Kristian Humborstad, Min-ki Jung, Ariyuki Kishimoto, Charlotte Knudsen, Henrik Knudzon, Julien Larsonneur, Ted Lin, Joe Lo, Christopher A Ludden, Hemant Mardia, Giovanni Memoli, Anne McAleer, Chuck Milligan, Marc Muller, Robert Mueller, Henning Bonde Nielsen, Francesco Pesenti Barili, Michel Roig, Frank Sandeløv, Michele Scarlatella, Stan Swearingen, Mindy Tan, Luca Tenzi, Enrico Vainieri, David B. Walshak, David Wyatt, Jin Yiwen.
Finally, to my caring, loving, and supportive wife, Tina: my deepest gratitude. Your encouragement when the times got rough are much appreciated and duly noted. My heartfelt thanks.
Struif, B.: Use of Biometrics for User Verification in Electronic Signature Smartcards. In: Attali, S., Jensen, T. (eds.) E-smart 2001. LNCS, vol. 2140, pp. 220–227. Springer, Heidelberg (2001)
Murdoch, S.J., Drimer, S., Anderson, R., Bond, M.: Chip and PIN is broken. In: 2010 IEEE Symposium on Security and Privacy (2010)
Biometric Application Programming Interface (API) for Java Card, NIST/Biometric Consortium Biometric Interoperability, Assurance, and Performance Working Group, version 1.1 (August 2002)
Henniger O., Nikolov D. (2013) Extending EMV Payment Smart Cards with Biometric On-Card Verification. In: Fischer-Hübner S., de Leeuw E., Mitchell C. (eds) Policies and Research in Identity Management. IDMAN 2013. IFIP Advances in Information and Communication Technology, vol 396. Springer, Berlin, Heidelberg
Privacy-preserving biometric authentication: challenges and directions, Elena Pagnin, Aikaterini Mitrokotsa Chalmers University of Technology Gothenburg, Sweden (2017)
“EMV integrated circuit card speciﬁcations for payment systems – Book3: Application speciﬁcation,” Version 4.2, June 2008.
Encyclopedia of Biometrics, Stan Z., Anil K. Jain, Springer Reference, ISBN: 978-3-642-27733-7
Anil K., Arun A. Ross – Introduction to Biometrics, Springer, ISBN: 978-0387773254
Nicholas M. Orlans John D. Woodward Jr., Peter T. Higgins – Biometrics, McGraw Hill Professional, ISBN: 978-0072222272
ISO/IEC 7816-4:2013 Identification cards – Integrated circuit cards – Part 4: Organization, security and commands for interchange
ISO/IEC 7816-11:2014 Identification cards – Integrated circuit cards – Personal verification through biometric methods
ISO/IEC 9797-2:2011 Information technology – Security techniques – Message Authentication Codes (MACs) – Part 2: Mechanisms using a dedicated hash-function
ISO/IEC 17839-1:2014 Biometric System-on-Card: Core requirements
ISO/IEC 17839-2:2015 Biometric System-on-Card: Physical characteristics
ISO/IEC 17839-3:2016 Biometric System-on-Card: Logical information interchange mechanism
ISO/IEC 18033-2:2006 Information technology – Security techniques – Encryption algorithms – Part 2: Asymmetric ciphers
ISO/IEC 18033-3:2010 Information technology – Security techniques – Encryption algorithms – Part 3: Block ciphers
ISO/IEC 19092:2008 — Financial services — Biometrics — Security framework
ISO/IEC 19785-3 Information technology – Common Biometric Exchange Formats Framework – Patron format specifications
ISO/IEC 19794-1:2011 – Information technology — Biometric data interchange formats — Part 1: Framework
ISO/IEC 19794-2:2011 – Information technology –- Biometric data interchange formats –- Part 2: Finger minutiae data
ISO/IEC 19794-2:2011/Cor 1:2012 – XML encoding and clarification of defects
ISO/IEC 19794-2:2011/Amd 1:2013 – Conformance testing methodology and clarification of defects
ISO/IEC 19794-2:2011/Amd 2:2015 – Conformance testing methodology and clarification of defects
ISO/IEC 19794-3:2006 – Information technology — Biometric data interchange formats — Part 3: Finger pattern spectral data
ISO/IEC 19794-4:2011 – Information technology — Biometric data interchange formats — Part 4: Finger image data
ISO/IEC 19794-5:2011 – Information technology — Biometric data interchange formats — Part 5: Face image data
ISO/IEC 19794-6:2014 – Information technology — Biometric data interchange formats — Part 6: Iris image data
ISO/IEC 19794-7:2014 – Information technology — Biometric data interchange formats — Part 7: Signature/sign time series data
ISO/IEC 19794-8:2011 — Information technology — Biometric data interchange formats — Part 8: Finger pattern skeletal data
ISO/IEC 19794-9:2011 — Information technology — Biometric data interchange formats — Part 9: Vascular image data
ISO/IEC 19794-10:2007 — Information technology — Biometric data interchange formats — Part 10: Hand geometry silhouette data
EMV® Specification Bulletin No. 185 – First Edition March 2017 – Biometric Terminal Specification
CA 02581230 C Apparatus for fingerprint sensing and other measurements
CN 2010 20665177 非接触式包含指纹辨识的电子智能卡片 (Non-contact intelligent
electronic card comprising fingerprint identification )
CN 2010 20671893 非接触式电子式智慧卡片 (Non-contact electronic smart card )
CN 2015 20355127 智慧卡片指纹按压装置 (Wisdom card fingerprint press device)
CN 2016 02176914 U Fingerprint identification smart card
DE 2002 10257111 A1 Chipcard and method for production of a chipcard
DE 2016 10101609 A1 Authentifikationsvorrichtung, Authentifikationsdokument
und Verfahren zur Authentifizierung einer Person
DE 2016 10201976 B3 Vorrichtung und Verfahren zur Bearbeitung eines Substrats
GB 2012 00019750 D0 Enrolling fingerprints by combining image strips to obtain
GB 2013 00004639 D0 Fingerprint sensor
GB 2015 00022870 D0 Biometric smartcard with multiple modes of operation
GB 2015 00008294 D0 Biometric enrolment authorisation
GB 2015 00008296 D0 Contactless biometric identification device allowing
GB 2016 00000892 D0 Low thickness biometric card
GB 2016 00003099 D0 One-time password device
GB 2016 00004138 D0 Apparatus for testing a battery-powered device
GB 2016 00009572 D0 Smartcard and method for controlling a smartcard
GB 2016 00014998 D0 Biometric smartcard for providing feedback to a user
GB 2017 00004847 D0 Calibration method
GB 2017 00006460 D0 Biometric smartcard
IT 2006 UD00028 A1 Carta Elettronica Universale Personale
IT 2006 UD00046 A1 Metodo Per Realizzare Una Scheda Personale Sicura E Suo
Processo Di Funzionamento
IT 2006 UD00075 A1 A method for making a secure personal card and its working
JP 2011 0105750 A ic card with fingerprint authentication
JP 2014 0529123 A Biometric authentication available smart card
JP 2016 0115098 A 指紋認証付スマートカードとこれを用いた決済方法
(Smart card with fingerprint authentication and settlement
method using the same)
KR 2014 0164109 B1 RF Smart Combi-card Of Fingerprint Type And Dealing Method
KR 2015 0056437 RF Smart Card Of Fingerprint Type With Battery
KR 2015 0180446 B2 Smart Card Integrated With Thermoelement And Fingerprint
Verification Chip As Laminated Structure
KR 2016 0064133 A Smart Card Comprising Fingerprint Detecting Device And
Method For Driving The Same
KR 2016 0090633 A Smart Card And A Fingerprint Recognition System Using
KR 2016 0125877 A RF Smart Card of Fingerprint Type with Battery
KR 2016 0129832 B1 Fingerprint Smart Card Having A Prevention Function
TW 2010 0009718 A Method of manufacturing secure personal card and
manufacturing processes thereof
TW 2016 0029842 A Fingerprint press device for smart card
TW 2016 0202811 U Switch structure of electronic module
US 1983 4621190 A Card with an IC module
US 1999 6325285 B1 Smart card with integrated fingerprint reader
US 2004 0129787 A1 Secure biometric verification of identity
US 2005 0178827 A1 Flexible fingerprint sensor arrays
US 2005 0212657 A1 Identity verification system with self-authenticating card
US 2006 0000892 A1 Method for biometric security using a smartcard
US 2006 0000899 A1 Method and system for dna recognition biometrics on a
US 2006 0113381 A1 Batteryless contact fingerprint-enabled smartcard that
enables contactless capability
US 2007 0223179 A1 Fingerprint recognition smart card
US 2007 0228154 A1 System and method for sensing biometric and non-biometric
smart card devices
US 2008 0164325 A1 Universal Smart Card
US 2008 0054875 A1 Biometric sensor and sensor panel
US 2008 0040615 A1 Biometric embedded device
US 2009 0084858 A1 Method For Making A Secure Personal Card And Its Working
US 2012 0241524 A1 Activation and indication of an RF field on a device
including a chip
US 2013 0036463 A1 Biometric-enabled smart card
US 2013 0320464 A1 Integrally molded die and bezel structure for fingerprint
sensors and the like
US 2015 0049925 A1 Method of manufacturing an electronic card
US 2015 0286855 A1 Fingerprint matching algorithm
US 2015 0371077 A1 Fingerprint recognition for low computing power applications
US 2015 0379250 A1 Secure biometric verification of identity
US 2017 0161528 A1 Smart card systems comprising a card and a carrier
US 2017 0213097 A1 Flexible Card with Fingerprint Sensor
US 2017 0213122 A1 Document with Sensor Means
US 2017 0228631 A1 Smartcard and method for controlling a smartcard
US 2017 0262692 A1 Capacitive Fingerprint sensing Device and Methon for
Capturing a fingerprint using the sensing device
USD 0693874 S1 Electronic payment card with biometric verification means
USD 0776664 S1 Smart card
USD 0786355 S1 Smart card with a chip and finger-print sensor
USD 0788847 S1 Smart card with a chip and finger-print sensor
USD 0791772 S1 Smart card with a fingerprint sensor
WO 1998 0052735 A1 Method of making smart cards
WO 2011 0083241 A1 Multiple application chip card having biometric validation
WO 2006 0080929 A1 Method of making a memory card by injection molding
WO 2013 0155040 A1 Smart connect devices for the interconnectivity of data cards
with computing devices to enable the performance of various
functions upon authentication by a user’s fingerprint
and/or a user’s photograph
WO 2013 0160011 A1 Method of manufacturing an electronic card
WO 2016 0016129 A1 Multi-layer composite for a security and/or value document
and method for producing same
WO 2016 0055660 A1 Contactless Biometric Identification Device Allowing Multiple
WO 2016 0055661 A1 Biometric enrolment authorisation
WO 2016 0055662 A1 Power load management
WO 2016 0055663 A1 Power harvesting in a passive rfid device
WO 2016 0055665 A1 Self-contained fingerprint identification device
WO 2016 0160816 A1 Smart data cards that enable the performance of various
functions upon activation/authentication by a user’s
fingerprint, oncard pin number entry, and/or by
facial recognition of the user, or by facial recognition of a
user alone, including an automated changing security number
that is displayed on a screen on a card’s surface
following an authenticated biometric match
WO 2016 0190678 A1 Smart Card Including Fingerprint Detection Device And Driving
WO 2017 0017085 A1 Smart card with main application and persistence application
WO 2017 0025479 A1 Security protected passive rfid device
WO 2017 0025481 A1 Power optimization
WO 2017 0064097 A1 Multiple finger fingerprint authentication device
WO 2017 0081268 A1 Value or security document made of a fiber composite
material, and method for producing the value or security
WO 2017 0089216 A1 Identification document and method for identifying an
WO 2017 0093514 A1 Fingerprint card
WO 2017 0093516 A1 Biometric card
WO 2017 0102699 A1 Id token having a protected microcontroller
WO 2017 0102984 A1 Device
WO 2017 0109173 A1 Biometric device
2FA Two-Factors Authentication
3FA Three-Factors Authentication
ASIC Application-specific integrated circuit
AOC Authentication On Card
ASP Average Selling Price
BSC Biometric Smart Card
BSoC Biometric System on Cards
CBEFF Common Biometric Exchange File Format
CNP Card Not Present Fraud
COF Chip On Film
CQM Card Quality Management
CP Card Present
FPC Fingerprint Card
FPCA Flexible Printed Circuit Assembly
FPCB Flexible Printed Circuit Board
FPS Fingerprint Sensor
FTIR Fourier-transform infrared spectroscopy
JV Joint Venture
LDO Low-Dropout Regulator
MEMS Microelectromechanical systems
MCU Micro Controller Unit
NFC Near field communication
OTP One Time Password
OCT Optical Coherence Tomography
PETG Polyethylene terephthalate
PII Personally Identifiable Information
PSD2 Payment Service Directive
PVC Polyvinyl chloride
RFID Radio-frequency identification
SE Secure Element
The entire research in PDF format can be downloaded here:
Antonio D’Albore and Jean-François Mainguet are making any representation or warranty, expressed or implied, as to the accuracy, reliability or completeness of the information in the research, and neither Embedded Security News or Antonio D’Albore or Jean-François Mainguet will have any liability to you or any other persons resulting from your use of the information in this research. Antonio D’Albore and Jean-François Mainguet undertakes no obligation to publicly update or revise any forward-looking information or statement in this research.
All brands and product names are the property of their respective holders.
© 2017 Antonio D’Albore / Jean-François Mainguet / Embedded Security News
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.