What's With This Magnetic Stripe
Stuff?
Why are we talking about magnetic
stripe?
Another article on magnetic stripe
technology? Why is it that you should spend any time looking at that? If this is
your reaction to seeing an article on magnetic stripe technology then maybe you
are missing the boat. Magnetic stripe technology has been around for a long time
but many things are changing in the technology and many of the old reasons for
not using it are no longer valid.
Where is magnetic stripe used?
Magnetic stripes are increasingly
used in many areas. Some examples of the use of the technology range from the
familiar credit and debit cards, transit tickets, and access control cards to
some applications you may not have been aware of. Telephone debit cards have a
value associated with the card which is decremented every time the card is used.
This information is stored on the magnetic stripe and is changed with every
phone call. The new Airline Ticket Boarding Passes have a magnetic stripe on the
back. If you have a card type ticket (not the old flimsy red tickets), you
probably have a magnetic stripe on the back. The stripe is used to hold
information about you and your flight. The latest new use for magnetic stripe is
on your drivers license. If you live in California, you already have a magnetic
stripe on your license. New York and Virginia will soon follow. The stripe will
allow error free identification of you when it is swiped through a terminal.
This eliminates typing errors in copying from the license.
As you can see, magnetic stripe
technology is all around us, everyday.
Is there something new?
If you consider that magnetic
stripes have been used since the early 1960s on transit tickets and since the
1970s for bank cards and that the same technology continues to be used on bank
cards then maybe we need something new. In fact there have been several
technology improvements over the years that are in use in some systems today.
The two biggest changes that come to
mind are security and data permanence. Magnetic stripe has always been cited as
being insecure. Today there are technologies that can provide many different
degrees of security as discussed below.
The buzz word of today in magnetic
stripe is high coercivity. This is a technical term used to define how easy (or
difficult) it is to encode the magnetic stripe. A standard bank card has a
coercivity of 300 Oersteds, high coercivity stripes range from 2700 to 4000
Oersteds.
What about security?
The major complaint about magnetic
stripe technology has always been - "but it is not secure". This is
true with a conventional magnetic stripe system. Many people have demonstrated
over the years how to counterfeit or duplicate magnetic stripe encoding. Now
there are three companies publicizing technologies that have a solution to data
security. These are ValuGard® from Rand McNally, Watermark Magnetics® from
Thorn Secure Science International, and XSec® from XTec, Inc.
What do these technologies buy you?
They each have a means to ensure that the card or ticket being used is the
original card that had the data encoded on it. They use different means -
ValuGard uses the inherent signal amplitude properties of the stripe, Watermark
Magnetics uses a special magnetic stripe, and XSec uses the inherent jitter
properties of the stripe. What all this means is that the actual piece of
magnetic stripe can be tied to the encoding to prevent fraud.
Loss of data
You may hear the word security used
when someone talks about high coercivity but this is confusing. It suggests that
a high coercivity stripe is harder to duplicate or counterfeit and unfortunately
this is not true. What is true is that the stripe is less likely to be damaged
by contact with a magnet such as on a purse clasp. Some of you may remember the
big "eel skin wallet" scare of a few years ago. The story went that
eel skin wallets erased magnetic stripes on credit cards. Obviously this was not
true. Eel skin wallets are made from the skin of the hagfish and it has no
different properties than leather or plastic. What was different about these
wallets was that they usually had a magnetic clasp. The clasp was the culprit in
destroying the encoding, but even today, many banks will tell you that eel skin
destroys magnetic encoding. With a high coercivity stripe this would not have
been a problem.
What about the other technologies?
How do they compare?
Whether magnetic stripe is used
rather than other technologies depends on the system being considered. Obviously
for a new bank card, no-one would even consider using anything other than low
coercivity magnetic stripe today. The number of cards in use, the amount of
equipment in the field and the need to be compatible with everyone else is an
over-riding feature. But for new systems the choice is not always so clear.
The four technologies that are often
compared to magnetic stripe are: Barcode, Radio Frequency, Smart Card, and
Optical Card. Each of these are important technologies, but there is a best
technology to use in most applications.
As a means to help identify the best
technology for any particular application, the following five comparisons can be
made: Suitability, Data Storage, Ease of Use, Cost, and Security. An application
can be rated against each of these in turn and a table made to show the
comparison.
As an example of the rating
strategy, let's take a look at one particular application, the Transit
Industry,for each of the five comparisons.
Suitability
The application requires the card to
identify the type of ticket; period pass, stored ride, stored value etc. For a
simple period pass (monthly ticket) the application only needs to check that the
ticket is valid for the current period and that it has not just been used in the
equipment (to prevent a passenger handing the ticket to another passenger). This
can all be done in a read only environment (serial number and valid period). For
the other types of tickets, stored ride or value, the equipment will need to
encode on the ticket.
From our list of technologies, we
see that for a simple period pass, any of the five are suitable, but for the
other types of tickets barcode is not a suitable technology as dynamic data is
required and barcodes cannot be rewritten in the field. The other four
technologies all allow data to be written and read in the field although the
cost of writers for optical technology is prohibitive and a read/write RFID tag
is not a standard "ticket" size but is a thick tag with a battery
included. Advantage: Magnetic, Smart Card.
Data Storage
In this application the amount of
data required is very dependent on the system requirements. At its simplest,
only the serial number and a period identifier need be stored on the ticket.
This could be only eight to ten bytes. Conversely, the amount of data required
may be quite large. If the Transit Authority want to record the place of last
use, the issue date, original value etc. the amount of data storage required can
be several hundred bytes. Figure 1 shows a table of the data storage available
for the different technologies and as can be seen, all have suitable amounts of
data storage for the period pass. However barcode and RFID have a problem when
the larger amounts of data are required.
The numbers shown are not absolutes
but are meant to give a guideline to available data storage. Advantage:
Magnetic, Smart Card, Optical.
|
Technology |
Bytes |
Cost |
Security |
|
Barcode |
25 |
$0.01-$0.10 |
Poor-Moderate |
|
Radio Frequency |
8 |
>$2.50 |
Moderate-Good |
|
Magnetic Stripe |
226* |
$0.01-$0.40 |
Poor-Good |
|
Smart Card |
1,000 |
>$5.00 |
Good |
|
Optical |
4,000,000 |
>$3.00 |
Good |
*
per ISO spec. - not a technology limit.
FIGURE 1: DATA STORAGE, COST,
& SECURITY FOR CARD TECHNOLOGIES
Ease of use
In the transit application, ease of
use also means speed. The last thing that the authority wants is a line of
people trying to get on a bus or go through a turnstile. It must be possible to
take the ticket, insert it in the equipment and get it back within one to one
and a half seconds.
Barcode and Radio Frequency ID have
an obvious advantage here, they are both non-contact technologies. The ticket
could be waved over a laser scanner for barcode, or in the case of RFID it
doesn't even have to be removed from the wallet (or maybe even the pocket).
Magnetic stripe, smart card, and
optical all require contact to be made. A smart card with contacts requires that
the card be inserted in a slot and the contacts be brought onto the ticket. The
transfer of data takes place and the card is released. The optical card has to
be treated in the same way. It is inserted in a slot and the read/write process
takes place. The card is then returned through the same slot. The magnetic
stripe card can be placed in either a swipe or motorized reader/encoder and the
ticket can be read, rewritten, and verified in a fraction of a second. Advantage:
Barcode, Magnetic, RFID
Cost
This can be a big issue for an
authority that is issuing hundreds of thousands or millions of tickets a year.
Unlike hardware costs, the cost of tickets is ongoing and must be borne as a
cost of doing business. This makes the cost a significant issue to the authority
as these funds come from operating expenses rather than a government grant.
Figure 1 shows the relative costs of tickets using the various technologies.
As the table shows the only viable
solutions for this application from the cost perspective are barcode and
magnetic stripe. At a cost exceeding several dollars per ticket for the other
technologies, the cost to issue large quantities can be prohibitive. The costs
above are based on a "credit card" sized ticket. They can vary a lot
based on items such as quantity purchased, amount of printing, base material,
etc. A barcode and a magnetic stripe can be put on paper or plastic and the
price reflects the choice of material. The other technologies are more expensive
initially and do not use the less expensive base materials, which gives them a
cost disadvantage. Advantage: Barcode,
Magnetic Stripe
Security
Although security may not be a
deciding factor in the choice for a technology, it can be an important issue.
Security can mean many different things, but in this case we will talk about the
ability to copy or counterfeit the ticket. This is a major concern because the
ticket is the equivalent of money. Figure 1 shows the security for the different
technologies.
Some caveats are necessary in the
above table. It is very easy to duplicate a simple barcode (photocopy), but it
is possible to hide the barcode behind a panel which is transparent to infra-red
but opaque to visible light. This increases the security but the barcode can
still be copied (photographed using infra-red light and film). If the RFID tag
is a read/write tag (as may be required by the application) the information can
be easily changed unless it has some form of permanent information in the tag.
Security on a standard magnetic
stripe card is poor but there are technologies available (such as Watermark
Magnetics, XSec, and ValuGard) which increase the security of the magnetic
stripe to near that of the Smart Card.
The Smart Card and Optical Card are
both highly secure technologies. The Smart Card uses an on-board processor to
increase the security, and the Optical Card has such a large amount of data
storage space that many types of security can be implemented at the same time
(multiple biometric identifiers, encryption algorithms etc.). Advantage:
Magnetic, RFID, Smart Card, Optical
Summary
If we look at the five issues that
have been discussed above, we find that magnetic stripe has advantages in all
five areas. This does not mean that magnetic stripe is the answer to all our
prayers, however it does show that with the correct specifications, magnetic
stripe can be made to meet all the requirements. Some of these category
classifications will not change from application to application but the relative
importance of each will change. For example, cost may be the over-riding factor
in choosing a technology and you may choose a particular technology because of
that even though it does not come out best overall.
|
|
Barcode |
Magnetic Stripe |
RFID |
Smart Card |
Optical |
|
Suitability |
|
X |
|
X |
|
|
Data Storage |
|
X |
|
X |
X |
|
Ease of use |
X |
X |
X |
|
|
|
Cost |
X |
X |
|
|
|
|
Security |
|
X |
X |
X |
X |
FIGURE 2: SUMMARY OF FEATURE
ADVANTAGES
The items reviewed here may not be
the only items you will need to look at for your particular application. These
form the basis of a comparison and you can add or delete other categories as
needed.
What about Standards and
Specifications? Are they important?
The question is a far reaching one,
and one that I get asked several times a week. The answer is not as straight
forward as we would like it to be. Standards and specifications are important,
they help to ensure the quality of a system, however they don't always have to
be adhered to. What do I mean by this? Think of your bank cards. Where would we
be if there was no global standard. At the basic level, it would mean that your
credit card may work at Macy's but not at Gimball's. At the next level it may
work in one area of the country and not in another, or in one country and not
another. Obviously standards are a necessity in this global interchange
environment. But what if you are only making an access control system for your
building? Do you care if the cards don't work in your neighbor's system? No. So
in this case a "standard" is not necessary.
One of the most common statements, I
hear from a company looking at an ADC technology is "I can't use magnetic
stripe because I need more than 37 characters on track 2 and the manufacturers
say the standard is 37 numeric characters". The manufacturer is right in
saying the standard (there is only one recognized standard - the banking
standard) says track 2 is 37 numeric characters. But who says you have to follow
the standard. The only problem with not following the standard (in a
non-interchange environment) is that it may be harder to get a reader or encoder
capable of reading or encoding the information you want.
Currently there is one global
standard that everyone refers to. It is ISO 7811/2 (magnetic stripe standard)
and 7811/4 and 7811/5 (track locations). The standard only deals with low (300
Oersted) coercivity cards in the interchange environment. These standards have
recently gone through revision and review and new versions should be published
very soon. They can be obtained from ANSI.
The ISO committee is now working on
a similar set of standards for high coercivity cards, but the document is only
in a working form at the moment and is not likely to be released for Draft
Review until next year at the earliest. The committee still has many technical
issues to resolve. At the recent ANSI meeting, much of the time was spent
looking at the various candidates for a reference card and trying to decide on
the properties required for this card.
AIM currently publishes a document
called "AIM Guideline for Measurement of Effective Magnetic Parameters of
Magnetic Stripes on Media". This guideline presents a means of testing a
magnetic stripe on a document to determine if it meets a set of specifications.
The method uses a comparison to a known good card as a means of defining good
vs. bad and can be used for low or high coercivity stripes. AIM is currently
working on a supplement to this to help test the immunity of the magnetic stripe
to magnetic damage.
How can I get involved? What about
more information?
There are several ways to find out
more about standards in magnetic stripes and whether they effect you. The first
is to buy the published ANSI standards (ISO 7811/2). This will give you a good
understanding of the type of specifications that low coercivity stripes should
adhere to. A good companion document to this is the test measurement document,
ISO/IEC 10-373, which tells how to do some of the tests.
The next move, especially if your
primary interest is in high coercivity is to get the AIM Guideline for
Measurement of Effective Magnetic Parameters of Magnetic Stripes on Media. This
document allows you to make measurements on magnetic stripes for yourself and
determine if the stripe meets your requirements.
The final move is to get involved.
If you are a manufacturer or consultant then join in and take part in the
meetings that define magnetic stripe parameters. If you are an end user, you
should consult your supplier (or consultant) to find out the latest
specifications and what part they are playing in setting those standards.
CONCLUSION
As a summary on magnetic stripe, we
have seen that the technology offers the ability to change data in the field,
that data storage is available that will exceed most requirements, that it is
easy to use, the cost is very low, and that full security is available if
required. Magnetic stripe technology is a proven technology that can be applied
to many different sizes and types of substrate material. This gives it a
tremendous advantage over those technologies which are more closely bound to the
substrate material.
We have taken a brief look at
standards and specifications and talked about when we need standards and when we
don't. For those of you with further questions, I invite you to contact me and
we will try to answer any questions you may have.
Steve Halliday
steve@hightechaid.com
|
