Managed Security Services

Beyond Passwords: Implementing The Vision — continued

by Lisa Phifer VP Core Competence, Inc. [April 5, 2005]

4. Smart Cards
With the advent of USB tokens, the division between Smart Cards and tokens has become somewhat fuzzy. But traditional Smart Cards are what you no doubt picture—a plastic card, the same size as most credit cards, with an electronic microchip embedded right into the card. The chip contains information about the card holder that can be read only by a card reader. Although Smart Cards have many possible uses—for example, as pseudo-cash card to make point-of-sale payments, or as a badge to enter a secure facility—they can also be used for network authentication. In particular, the microchip can store the card holder's digital certificate and key pair.

For example, below we show the VASCO Digipass Go2, a card reader that accepts various compatible Smart Cards. Note that some bank credit cards issued today are, in fact, Smart Cards. To use this device, the user inserts his card and enters a PIN into the reader. Thereafter, the reader can respond to Digipass Authentication Server prompts on behalf of the user, until the card is removed from the reader.

Smart Card readers don't have to be standalone devices. Below, we show the ActivCard PCMCIA Reader, which is capable of reading the information embedded in the microchip on the adjacent ActivCard Corporate Access Smart Card. If you can insert your Smart Card into a PCMCIA slot, why not a USB port? And that is, in fact, what many USB Keys are: Smart Cards in a USB form factor.

Form factor matters quite a bit to end users, so you'll want to choose carefully when deciding what kind(s) of hardware credentials to issue with a premium authentication service. Consider where and how users work, devices they carry, and credential portability (for example, is there need to authenticate from a public PC). From a security perspective, carefully consider which factors any given Smart Card is capable of supporting, the security of the token/card/reader and associated client/server software, and compatibility with the network services and applications to be accessed.