NFC: What, When & Why?

Abstract:
While NFC standards are open, the security required for the communication between cards, phones and readers in access control and closed loop payment applications is not. Choose your reader manufacturer wisely, as it will be supplying your institution with readers, NFC credentials and cards for a long time.

The term Near Field Communication, or NFC, was created about 10 years ago to describe a type of wireless communication between mobile phones and other devices, such as contactless readers. NFC follows the standards originally set for MIFARE and FeliCa cards and allows the phone to communicate directly, through an integrated NFC chip, to a tag or reader. Recently, the term has been used to describe any high frequency communication between contactless devices such as cards and readers, which has resulted in some confusion.  

Because contactless cards such as iCLASS, MIFARE and MIFARE DESFire are so much more expensive than cards with only mag stripes, physical access is the primary reason that universities across North America have decided to implement them. The security and convenience available with these cards has justified the additional expense. Using contactless cards at the point of sale has always been an attractive goal, but has not been a sole reason for schools to move to contactless cards, since mag stripes are still functional and cost effective for that purpose.

Point of Sale
In North America, standard credit card payment communications between contactless cards (or phones) and readers are not encrypted. Any security in those systems comes from the infrastructure, between the readers and the back end processors. Universities with closed loop payment technology can follow the credit card protocols or introduce secure and proprietary communications for their contactless or NFC technology, depending on the point of sale reader manufacturer.

Physical Access
Anticipating usage with mobile handsets in the near future, access control reader manufacturers such as HID, Schlage, XceedID and Blackboard have released contactless door readers with NFC capability. Due to the advanced security in the communication between contactless cards and readers, both cards and readers usually have to come from the same manufacturer. The same applies to NFC credentials - the credential that is stored on the phone has to be supplied by the manufacturer of the readers it will be used with. The security in the card- or phone-to-reader communication comes from the encryption of the credentials on the card or phone. 

When choosing a contactless/NFC technology, it is very important to consider physical access control readers. Once readers are hung on walls, they will probably be there for ten years. The readers will determine what type of cards or NFC credentials an institution can use and from whom they can be purchased. HID has a well-developed and very secure platform called SE, available on iCLASS SE and SEOS cards, and NFC credentials. XceedID/IR/Schlage has built their aptiQ platform for MIFARE, MIFARE DESFire EV1, and NFC. Cards and readers from both of these manufacturers are available from a wide range of distributors around the world and are used by most access control systems. Blackboard chose the FeliCa platform several years ago and has recently added MIFARE capability, both with NFC compatibility.

NFC: When?
The last question for NFC is when? Payment applications were the initial hope for NFC, but there are still very few NFC-enabled readers at merchant locations across the United States. Japan has a widespread NFC mobile payments infrastructure, but in most of the rest of the world, NFC implementations have been limited to pilots. Also, Apple has stubbornly resisted putting NFC chips in its phones. It looks like the best hopes for NFC will be commercial marketing applications, such as couponing and offer notices, and secure credentials, such as for physical access. Access control applications for NFC are complicated, as the credentials have to be securely loaded, stored and easily accessed by door readers. HID and XceedID/IR are working on this, but neither are yet ready to go live in a university setting, using native NFC apps on a wide range of existing phones. Blackboard also has a solution, but on which phones? Practical implementation in the near future would most likely require standardizing on a particular make and model of phone, or distributing external readers for the phones, which would also require a standardization of phone types.

Conclusion:
HID, XceedID/IR and Blackboard all make readers that will read NFC credentials at doors. Terminals are available that will read NFC at the point of sale. The key is selecting a door reader that is secure, readily available and cost effective. Then, the appropriate contactless cards can be used until a phone-based NFC application is available and implemented.

About ColorID, LLC
Every year, ColorID assists more than 1000 colleges and universities and their project managers personally oversee 700 custom projects each year, including many small and large recarding projects.  ColorID offers best-in-class products and solutions, including:  contactless, smart and financial cards from every major manufacturer, multiple ID printer platforms; transaction and point-of-sale software and hardware, a variety of handheld devices for identification and tracking applications and biometrics solutions, including fingerprint and iris readers. The company’s manufacturing partners include: Iris ID, HID, Fargo, Datacard, CardSmith, Gemalto, Zebra, NiSCA, Evolis, Allegion, Aptiq, Magicard, Brady People ID, Integrated Biometrics, Oberthur, NBS, Vision Database Systems and many others.

Contact ColorID at 704-987-2238 or toll free in Canada and the US at 888-682-6567. Visit ColorID on the web at: www.colorid.com or email ColorID at [email protected].

---