New Tools Build Security Into Smart Cards

NTRU Cryptosystems Inc. Monday unveiled a set of tools for building security into chips, readers, and applications associated with smart cards. The cards, which contain microprocessor chips, can store ID data, such as an individual's photo, address, and fingerprints, and are becoming important security tools for the military and airports.

NTRU GenuID includes the GenuID Hardware Core, Software for Chip Cards, and toolkits for building applications that can communicate with the cards. Hardware Core is code that a chipmaker would embed in its smart-card chips to deploy NTRU security and communicate with applications built with its toolkits. The process targets so-called fixed-logic cards that hold data but can't run applications. Software for Chip Cards is an application that runs on 8-bit, 16-bit, or 32-bit microprocessors, providing security. The toolkits let developers build applications that can run in a reader or an application server, which can process information from the smart card. With the exception of the toolkits, Hardware Core and Software for Chip Cards are sold to chipmakers under original equipment manufacturer licensing agreements. The toolkits start at $50,000.

For security, NTRU uses a public key infrastructure. Data is encrypted in transmission and digital certificates and signatures are used for identification and authentication of the cardholder. PKI isn't usually used in smart cards because it requires too much memory, but NTRU has written its own algorithms to implement a PKI within the limited resources of a smart card. "It allows a PKI on much smaller chips than has been true of the past," Summit Strategies analyst Warren Wilson says. Besides use in identification cards, NTRU's security technology is applicable for using smart cards as debit cards. "You can do secure transaction processing," he says.

Because of the technology they contain, smart cards are far more expensive than metal-strip credit and debit cards, making them an impractical replacement. However, in the wake of the Sept. 11 terrorist attacks, the cards have attracted interest among government agencies and business for identification purposes. The Federal Aviation Administration is working on standards and mandates for airport security using smart card, PKI, and biometric technologies. The Department of Defense is planning to roll out more than 4 million smart cards to U.S. military personnel and contractors over the next two years.