Developments in security features for chipcards are accelerating. These cards are used in security-sensitive applications like authorization, health, phone, and money cards. Other applications take advantage of their cryptographic features as well. This functionality significantly increases their security level when asymmetric algorithms like the public key are used, compared to standard controllers.
Smartcards are simply chipcards with controllers or cryptocontrollers on the same chip. Today, the largest smartcard application is Groupe Speciale Mobile (GSM) phones, which account for about 80% of the smartcard market. "There is an evolution from 8- to 16-bit controllers, and there will be 32 bits very soon," says Jean Paul Thomasson, director of marketing at STMicroelectronics' Smartcard Division. "Because people want to use these terminals with many more services like wireless Internet applications, the demand for smartcards with a 32-bit controller will soon increase."
Java cards are the hottest segment of the chipcard sector. "There is a trend towards Java," reports Karsten Ottenberg, business line manager for identification ICs at Philips Semiconductors. "However, there are no dominant Java orders yet. On the other hand, Java is the platform where applications, e.g., in the GSM area, are implemented."
The key feature of Java cards is their ability to download applications—via the GSM network, for example—if the card is installed in a GSM phone. By definition, a smartcard is portable. The downloaded application can be used in the offline mode when the smartcard is removed from the phone. In the future, travellers may use a Java card to download tickets for public transportation in London while they are still in New York. Tickets are downloaded and paid for via the Internet. By using the Java card, tickets can be read offline by the access control gate in London.
STMicroelectronics' Java card—the SmartJ—offers 30 to 40 MIPS of computing power. That's about the performance of a 486 processor incorporated on less than 16 mm2 of silicon. In terms of design-ins, Java generally offers the highest flexibility because it can handle more software, more applications, and multiple services. "Whenever I don't know what the market is going to demand, I choose flexibility, which means that I'm going to use this virtual-machine concept named Java," Thomasson says. "What makes a Java card good or not good is how the consumer will be able to use it the way he or she wants."
Perhaps the biggest advantage of Java and Java-like smartcards is the fact that every engineer with a Java system is able to develop applications that can be used worldwide. According to Ottenberg, Philips doesn't offer a Java-specific hardware solution yet. Infineon Technologies, meanwhile, provides a Java version of chipcards. The chip is optimized not only for use with Java, but for open platforms in general. The company says it has to make devices supporting all platforms because the market will finally decide which one wins out.
Infineon will soon introduce its new 88 series Java controller. This 32-bit version can be used in smartcards. It offers a memory-management unit for partitioning applications to enable separate processing of individual applications. Furthermore, a fingerprint sensor that makes PIN codes obsolete can be integrated into the card. A small foil keypad can be integrated, too.
A battery for just such a solution is already available from Varta of Hannover, Germany. This lithium cell is less than 0.5 mm thick, and it has a capacity of 25 mAh (see the figure). It not only fits into a chipcard, it's also can survive integration processes because it is suitable for a standard lamination process at 120°C for 20 minutes. The cell delivers 2.8 V from −10°C to 70°C. Additionally, it fulfills all of the mechanical requirements for chipcard integration.
When it comes to smart Internet cards, one of the hottest developments is the CashMouse terminal from Giesecke & Devrient (G&D) of Munich, Germany. G&D is known for officially printing banknotes. It's now getting involved in secure but anonymous micropayments via the Internet.
CashMouse uses the chip within the Eurocheque card, a bankcard that's statistically available in every household in Germany. With several modifications, the system may be extended to credit cards. The chip on the Eurocheque card can store approximately $200, which can then be used for offline payments. One precaution is in order, though. Losing a card is like losing a bank note: once it's lost, the money is gone. The Eurocheque functionality is called Geldkarte (money card). It can be downloaded from almost every ATM.
Internet payment via CashMouse and Geldkarte is simple. The Geldkarte communicates with a cipher box located at the Internet provider or at the owner of an Internet mall. Communication is conducted via the CashMouse terminal, according to the 1546 CEN standard, using RSA algorithms.
Bernhard Buettner, project manager for payment and security systems at G&D, says that "the entire payment process remains anonymous. This means there is no way to track down where the money in the payment file comes from. And in contrast with eavesdropping on credit-card data, there is no chance of reusing already transmitted information because every session uses its own session code for encryption."
For more details, point your browser to www.st.com and www.infineon.com. Also, see www.semiconductors.philips.com and www.gdm.com.