Feb 16, 2003Feb. 17, 2003 -- Employees working at the worldwide headquarters of American Express in New York don't need to be reminded about the importance of security. They work across from the site where the World Trade Center once stood.
Amex has taken steps to secure its own building in the wake of the terrorist attack. The financial-services company has installed a new access-control system that relies on fingerprint templates stored on RFID smart cards.
Employees wave their card in front of a proximity reader and place their finger on a fingerprint reader. If the fingerprint on the reader matches the encrypted template stored on the card, a unique ID stored on the card is sent to the company's central security system, and they are given access to the building or secure areas within the building.
"Following the events of Sept. 11, 2001, there was clearly a concern about their old badge," says Julia Webb, VP of global sales and marketing at Bioscrypt, the Toronto company that supplied the readers and fingerprint recognition technology. "It could be lost or stolen, and then someone could get access to the building by impersonating an American Express employee."
A template of each employee's fingerprint is stored on a contactless smart card with Philips Semiconductors' MIFARE integrated circuit. MIFARE conforms to the ISO standard 14443 for contactless smart cards.
One benefit of having the template stored on the chip in the card is it affords employees a level of privacy, since there is no danger of someone stealing their fingerprint off of a server somewhere. (There are laws in New York State that prohibit companies from storing biometrics data for just that reason.) It also makes the system easier to administer, according to Webb.
"There's a clear advantage because the card becomes a portable database," she says. "If an employee is traveling, they can use their card at any location worldwide and gain access to corporate offices with their fingerprint. And it alleviates the administrative issues related to storing the template on a backend server."
Bioscrypt has installed more than 45,000 readers worldwide, according to Webb. She says that more and more companies are deploying the technology because they want the additional level of security that comes with adding biometrics to a smart card. Many companies are also using RFID cards because of the convenience for the end user.
It typically takes less than a second for the system to verify a match between the template on the card and the live fingerprint scan. The system has to be tied into a company's central security system, so there are backend integration issues. Amex has been working with Bioscrypt for more than a year on the project.
