For decades, we have carried our identities around on magnetic stripe (magstripe) and smart cards, but in today’s mobile world, we now have the opportunity to embed them on a variety of portable devices. This will enable us to use products like smart phones, USB tokens, memory sticks and microprocessor-based SmartMX cards to open doors, buy tickets and execute other secure transactions. In order for this to work, however, we need a new way to securely provision identity and embed it into these portable devices.
There has been considerable news recently about mobile commerce developments, including reports that Microsoft is adding Near Field Communications (NFC) short-range wireless communication technology to its Windows Phone mobile operating system, and that Google, RIM and Apple are all preparing mobile payment and wallet systems. Similarly, the ISIS coalition (AT&T Mobility, T-Mobile USA and Verizon Wireless) has announced plans for the first pilot mobile commerce network using smart phone and NFC technology. Juniper Research has estimated that half a billion people worldwide will use their mobile devices as travel tickets on metros, subways and buses by 2015.
These and other initiatives will enable us to load our mobile devices with credentials that provide various levels of facility access, eliminating the need to carry a card, while making it easier for security managers to control who is entering and exiting monitored access points. It will also be possible to use these portable credentials to make other contactless transactions as well, such as cashless payment and transit ticketing, data transfers including electronic business cards, and gaining access to online digital content. Users will also be able to have multiple virtual credentials on a single device. For example, it will be possible to use a portable device to access a secure facility and also make cashless payments at the facility’s canteen.
NFC Pilot Takes Flight
One early example of these applications is the first hotel pilot of NFC technology at Clarion Hotel Stockholm in Sweden. The hotel worked with HID Global parent ASSA ABLOY, Choice Hotels Scandinavia, TeliaSonera, VingCard Elsafe and Venyon, a fully owned subsidiary of Giesecke & Devrient, to replace the hotel’s room keys with NFC-enabled mobile phones. The technology makes it possible for hotel guests to check-in and out using their mobile phones. The goal of the pilot is to get feedback from guests and employees using the NFC phones for a variety of services.
In the Clarion Hotel application, guests check into the hotel and receive a room key directly onto their mobile phones before arriving at the hotel. They book their rooms the usual way, receive confirmation on their phones, and can also check-in on their phones before arrival at the hotel. When check-in is complete, the digital hotel room keys are delivered to the mobile phone. On arrival at the hotel, guests may then skip the check-in line, go directly to their room, and gain entry by holding the mobile phone close to the door lock.
Guests can also access other services via the mobile phone and, on leaving the room, check out using their mobile phone. The doors lock automatically.
NFC is one technology for presenting portable identities in these and other access control and mobile commerce applications, but there are many more. All of these technologies share the common need to operate within a new, more robust access control infrastructure.
Moving Beyond the Traditional Smart Card Model
Over the last 20 years, 125 kHz RFID proximity (or Prox) cards and readers have become a de facto standard for physical access control. They offer customers the optimum in cost and convenience, but are less secure than the contactless technology that subsequently emerged in the early 2000s.