Smart cards, occasionally called chip cards or integrated circuit cards (IC or ICC), are a broad family of physical electronic authentication devices. More practically, they’re physically-secured microprocessors used to control access to resources.
From ID cards to security keys, smart cards are used the world over in a wide variety of applications. In fact, you probably have more than a few smart cards within arm’s reach right now – there’s one in your phone, your laptop, in each of your ATM cards, probably your ID card, and in lots of other places.
This article will explain smart card examples, features, applications, and deployment methods – mostly from a cybersecurity standpoint.
What are Smart Cards used for?
Smart cards are deployed for a broad range of applications, most of them related to Identity and Access Management (IAM). In essence, they’re useful for communicating who (either which person or which device) is attempting to access a resource. The “resource” could be just about anything: your savings account, the door to your apartment complex, Wi-Fi access on your work computer, or maybe your health insurance information.
Common smart card applications include:
- ATM cards (debit and credit cards)
- ID cards
- Passports
- PIV/CAC cards
- SIM cards
- Bus passes
- Access badges
- Electronic wallets
- Security tokens
- Hardware security keys
- Multi-factor authentication (MFA)
- Single sign-on (SSO)
Smart Cards for MFA
In a broader sense, many smart cards are used to provide a physical factor of authentication. In an era where people are 20x more likely to be a victim of cybercrime than a robbery, it’s fair to say that the “keys” you keep on your person are a lot safer than the ones stored on your computer or in a random ecommerce company’s CRM database.
Smart cards have been critical for the push towards multi-factor authentication since a physical device satisfies the “something you have” factor of authentication, which is more or less impossible with digital authentication methods.
In fact, some smart card devices like the Yubikey can be used for several factors of authentication without needing to be supplemented:
- Biometrics (“something you are”)
- A requirement for physical touch to authenticate (proves “something you have”)
- A number of cryptographic functions like one-time passwords, PIN/PUK, digital certificates (the device stores multiple credentials or key pairs to satisfy “something you know” on your behalf).
In the future, we may see GPS-enabled smart cards that will allow authentication based on location, or the “somewhere you are” factor.
How to View Certificates on a Smart Card
Given the variety of forms a smart card can take, it’s difficult to offer exact instructions that fit everyone’s use case. For Windows 10 users that want to inspect a smart card connected to their computer, the easiest method to view certificates is with the Certutil command line utility from Microsoft.
The command to view certificates on a smart card is :
certutil -scinfo
Types of Smart Cards
“Smart card” itself is a bit of a vague term, since it can be applied to several devices with different form factors. Here are some different classifications of smart cards:
Types of Smart Card Chips
Memory card – A type of smart card that can read, write, and store very small amounts of data (which typically can’t be overwritten or edited). These are usually found in disposable or single-use products, so they are not particularly robust or complex.
Microprocessor – Typically what people think of when they hear “smart card”, a microprocessor is basically a very small computer with limited features. Many smart cards are specialized cryptoprocessors with additional cryptographic functions so that they can be used for advanced authentication methods like MFA or digital certificates.
Types of Smart Card Interface
In addition to chip-type, the physical communication interfaces of smart cards can also differ:
Contact – Most smart cards you encounter have a gold-plated metal contact pad like the one on your credit card. When inserted into a smart card reader, like an ATM, the contact pad transfers electricity to power the smart card (since they, as a rule, do not have batteries). It also sends data across the contact pad interface.
Contactless – You’ve seen “contactless” payment options at the grocery store checkout – that’s what this is. Contactless smart cards are functionally identical to contact smart cards, except that they communicate via Near Field Communication (NFC) and have a particularly clever method of harvesting electricity from ambient energy created by the communication process.
Hybrid – Has the functionality of both contact and contactless smart cards in one device, but each interface is connected to separate chips with independent modules.
Dual Interface – Similar to the hybrid in that it has both contact and contactless options, but they both support a single smart card with shared storage and modules. Most modern debit and credit cards fall under this category.
USB – Many smart cards are made with USB interfaces to circumvent the need for a smart card reader device. Hardware security keys, like the Yubikey, are an example of USB smart cards.
Certificate-Based Authentication with Smart Cards
Smart cards are ubiquitous because of their powerful authentication security and identity assurance, that is, smart cards are useful because they enable you to know who is logging into what application using which device.
The capacity for identity-driven authentication is extremely important for Identity and Access Management, a core part of every security strategy. However, credentials like passwords can’t provide identity validation – everyone can (and does) share passwords. You can’t know if ‘John’ is actually the person using John’s credentials to access your accounting software.
That’s less than ideal.
The solution is 802.1X digital certificates. Just a certificate alone is sufficient identity assurance in most scenarios, but using them in combination with smart cards enables a host of robust authentication security options, especially in workplaces with managed devices.
SecureW2’s Yubikey Certificate Management Solution (CMS) was developed to facilitate the process of automatically equipping smart card devices with digital certificates. Our onboarding software guides end-users through a foolproof enrollment process, and then our intuitive, single-pane management portal manages the lion’s share of the certificate lifecycle while still giving admins ample insight and control over the process.
SecureW2 is a leader in certificate-based authentication and multi-factor security, but we have affordable options for organizations of all sizes. Click here to see our pricing.
