Increasing the security and utility of national identity programmes is one of the most pressing concerns of governments around the world, driving the evolution of advanced ID solutions and encouraging innovation across all areas of the industry. As a result, sophisticated credentials featuring layers of visual, physical and digital security have become a key component in helping governments protect their citizens and their borders and to streamline the delivery of a wide range of services.
This article attempts to outline the benefits of how the use of both on-card visual security elements, combined with in-card, chip-level security, provides protection for citizens and governments alike against counterfeited IDs and widespread identity fraud.
Identity document fraud
Over the last 20 years, there has been a global shift from attack of the document to attack of the application process. This has largely been the result of the strengthening of document security, including digital imaging, thin-film diffractive laminates, laser engraving and electronic defences. Despite this trend, document attack remains widespread and appropriate defences must continue to evolve to meet it. Figure 1 is a diagrammatic representation of the multitude of threats to ID documents.
Criminals have increasing access to the components and technologies they need to simulate or alter identity documents. Lasers, polycarbonate, specialist inks, manufacturing equipment and holographic origination systems are all available, together with more traditional printing and stamping processes.
In the war on fraud, an understanding of vulnerability in both current and next-generation documents is a vital part of creating a future-proof solution. Success requires close collaboration between all stakeholders: designers, manufacturers, issuers and document examiners such as those from immigration and police authorities.
Principles of secure document design
Although technology evolves, some principles of identity document security have been well established and unchanged over several decades:
- Documents need to be difficult to simulate and alter, and easy to verify with confidence.
- Ideal security features are easy to identify and verify, and therefore easy to train.
- Features may be overt, covert or forensic in nature. They should be distributed throughout the document: within the substrate, the security print, the personalisation and
the RFID chip.
- The overall design of the document helps to ensure that the features work together in an effective defence network. Substrates, electronic inlays, lamination plate design,
embedded diffractive devices, security print design, security inks, personalisation hardware and personalisation layout need to be considered holistically to achieve an
aesthetic identity document that is technically secure.
- Security relies on a mix of:
– novel materials with restricted availability;
– specialised engineering delivering unique structures and with precise registration of features to each other;
– secrets and knowledge – confidential know-how of the genuine manufacturing processes;
- Personalisation security features are particularly strong, defending against alteration as well as simulation. They require particularly close collaboration between document
manufacturer and personalisation technology vendor, in order to deliver high quality and consistent features that challenge the criminal.
Over recent years, increasing emphasis has been placed on the combination of technologies. This may be achieved by combining security features to improve resistance to simulation and alteration, or by including multiple technologies within the ID document. This combination philosophy has been driven by a variety of benefits for the issuer, the examiner and the user:
multifunctional documents, allowing citizens to access many government services;
- improved security, where the network of defences is strengthened by new ‘superfeatures’;
- authentication of identity in a range of scenarios: visual, machine readable, offline and online;
- improved durability, where technologies combine to optimise protection of electronics and document lifetime;
- increased return-on-investment (ROI) where documents last, and stay secure, for longer.
Concept to reality
While the concept of a multifunctional card is simple, the reality is very difficult to achieve. Considerable industry knowledge and design skills, together with technical and manufacturing expertise, must be employed to ensure that the end result conforms to international standards in terms of size, security, functionality, durability and interoperability. In addition, the multiple technologies built into the card must be complementary and not contradictory. With ever-increasing technical complexity, achieving optimal card design is not a trivial matter. Nevertheless, such cards offer a more cost-effective, efficient option than multiple single-purpose credentials, and help ensure that the highest standard of security is implemented to future-proof the document against the largely unknown attacks of the next decade.
Evolution of secure ID solutions
The security technologies available today offer different benefits to the issuer, the examiner and the user. Some enable a secure and convenient interface to government agencies, whilst others provide resistance to criminal attack. ID solutions are evolving at pace in both these areas; security and functionality.
Security features take many forms and the technologies must defend against both counterfeiting and alteration. They are typically located visibly and invisibly throughout the document:
- within the physical card:
– diffractive holographic structures (OSM, holograms, Kinegrams™)
– windows, lens structures (Changeable Laser Image)
– security print (optically variable inks, ultraviolet fluorescent inks, rainbow split fountain printing, microtext, guilloche (see Figure 2))
– personalisation features (laser microtext, ImagePerf™)
- within the smart chip
A customised combination of technologies on a single card delivers greater security and value than a multicard solution. This combination is the principle for the next generation of secure ID cards, containing microcontroller IC chips and optical security media.
Microcontroller IC chips verify and control transactions between the credential and its outside world through the reader. The chip may contain biometric, personal, or account data that individuals need to effectively process transactions. There are three types of secure IC chips that may be used on identity cards: contact, contactless and dual interface.
Optical security media
Optical security media (OSM) is a tamper-proof and counterfeit-resistant visual and physical security feature that can also display the personalised data of the credential holder, such as a facial image or other personal information. The power of optical security media comes from its instantly recognisable appearance coupled with its receptivity to laser personalisation (see Figure 3). By virtue of being very difficult to erase, duplicate, simulate or alter, yet easily verified without the need for magnification or specialist forensic devices, it provides a strong defence against the twin threats of counterfeiting and data alteration, with ultra-high resolution security patterns and images (up to 24,000 dpi), and the inclusion of a covert diffractive image.
Several cards issued for major ID programmes are using an OSM stripe, such as the Indian state vehicle registration cards supporting both ID authentication and records/payment management, and Saudi Arabia’s national ID card programme employing a combination of contact chip and optical security media. In this instance,
Delivering the multitechnology credential
One of the recent ID programme examples of using a multitech OSM card is the Ireland passport card (see Figure 4). This passport card is deployed in Europe for border crossing, and allows Irish citizens to travel across Europe without their traditional passports booklets.
With the release of the direct-bonding technology, contactless inlays can become thinner thus enabling the integration of contactless smart card technology together with OSM (see Figure 5). This brings a series of advantages, all of them offering a high ROI in the credential by combining two or more functions on a single card. Some of the key advantages include:
- a counterfeit-resistant platform for the highest level of security
- the ability to leverage a client’s existing infrastructure
- a platform for the delivery of any required application or service
- integrated technologies that improve the way in which existing public services can be provided
- rationalised resources and reduced costs for government agencies, citizens and businesses
- simplified processes and procedures for delivery
- Electronic security features of the multitech card might also include:
- different security levels for different applications on the secure cryptocontroller chip
- two-factor authentication: something you have (card) and something you know (password)
- three-factor authentication: added biometric information to verify ‘something you are’
As security concerns rise, governments are working strenuously to secure the identities of citizens, visitors, and legal residents. This requires industry partners to continually harness innovations in material science, manufacturing processes and technology.
While the power of the CPU and cryptoprocessor of the secure microcontroller alone provide multifactor authentication and security controls that could be used for access control, data storage and even payment, the addition of non-electronic security features increases the card’s visual and physical security, acknowledging that the majority of ID card inspection and examination today is visual. Non-electronic security features also deliver a forensic-level authentication capability and greatly enhance counterfeit resistance.
Nick Nugent has a degree in Applied Chemistry (Hons.) from Lanchester Polytechnic, Coventry, England and has spent more than 30 years in the secure document industry. He has worked in product development, project management and marketing, in the design, manufacture and implementation of security features and personalisation systems. Nick uses his extensive experience of the document security market to advise governments on the selection and implementation of cost-effective security for
ID documents, and is a regular contributor to this Journal. At the time of writing this article, Nick was employed with Entrust Datacard.