Written by By Peter Stampka, Andreas Karl, Dr. Detlef Houdeau, Infineon Technologies
Market requirements for National eID card programs EU policy for 2010
In spring 2005, the European Commission (under EC 14351 / 2005), published a recommendation for the minimum security framework of National eID card programs. EU refers, in this document, to the ICAO 9303 documents.
The reasons are:
• EC does not have the mandate to publish regulations on National eID card programs. Some member states do not have National ID cards in use, such as the UK;
• Citizens typically use their National ID card document for travel within the EU;
• Infrastructure for IT, PKI and data capturing are in place for the biometric passport programs.
The realization of modern government services in Europe is one of the key pillars of the European Union. The program is called ‘i2010’ and addresses eID / eGovernment services. Within this program the authentication and identification of the citizen play important role, as according to various studies from KPMG, Ernst &Young and McKinsey, eID could reduce corruption, increase transparency, increase services and reduce administration costs.
Today eight of the 27 member states currently have an eID card in use, namely Spain (2006), Portugal (2007), Italy (2006), Belgium (2005), Austria (2004), Finland (2002), Sweden (2005) and Estonia (2004).
A new group of standards were deployed under CEN TC 224, called European Citizen Card (ECC), with CEN 15480 and CEN 14980 in spring 2003. These standards define all relevant elements of IAS (identification, authentication and signing). France [Amin08] and Germany have announced that their new National eIDprograms that start in 2010 will be compliant with these standards. Other member states, like Poland, UK, Bulgaria, Romania and Czech Republic will follow.
Basic requirements for National eID Cards
The following requirements for National eID cards are common in all running and planned programs:
• Lifetime: To last a minimum of ten years in most EU member states;
• Card interface: ISO / IEC 14443 is mandatory for travel functions and biometrics according to ICAO 9303, contact-based ISO / IEC 7816 or contactless ISO / IEC 14443 for eGovernment services according to CEN TC 224;
• Memory: Size dependant on data sets between 32KB and 160 KB EEPROM.Data needs to be compliant with ICAO biometrics and -MRZ, CEN 15480 andCEN 14980 IAS, including keys, certificates and PIN. Examples are Belgium, start 2004 with 32k EEPROM, Sweden 2005 with 64k EEPROM, Portugal 2007 with 68kEEPROM, Czech Republic expected mid of 2010 with 144k EEPROM and Franceexpected 2nd half of 2010 with 160k EEPROM;
• Packaging: Thin, robust and uniform in quality according to the card specification,the application profile and the card production process;
• Connection between the chip module and antenna: Must be qualified to last ten years.
Three smart card configurations are used:
• Dual Interface, hybrid: In Sweden since 2005; to be expected in France and Poland in 2010;
• Contact-based: Belgium, Austria, Estonia, Finland, Spain, Portugal and Italy in use; to be expected in Czech Republic in 2010;
• Contactless: Germany will start the issuance in 2010.
Implementation requirements for ID schemes
Standards are fundamental.
International standards are the reference for requirements, which component and card developershave to meet in most of the request for proposals (RFPs) and tenders around the world.
Technical standards are as follows: ISO / IEC 14443, ISO / IEC 7816 amongst others. Application standards are as follows: ICAO 9303, CEN 15480, ISO / IEC 18013 amongst others. Test standards include ISO / IEC 10373, amongst others.
Evolution of technology and the value chain for eID schemes.
The applications for Smart Cards in National ID schemes have spread worldwide in the last five tosix years. The technology has evolved from contact based National ID Card projects, to contactless Driver License solutions and ePassports, as well as dual interface and hybrid National ID cards.This evolution of ID applications has an impact upon the whole value chain that is involved in the production of eID documents.
Additional mandatory requirements
In addition to the international standards, card manufacturers, test institutes and system integratorshave their own individual specifications, which are derived from experience and special cultural and national circumstances. The diagram below provides an overview of these additional mandatory requirements.
Optical quality
The optical quality relates to contactless inlays that are visible in the final document, such as aNational ID card or Passport. Passport manufacturers often use complete covers equipped withelectronics, otherwise known as the ‘eCover’. These combine a contactless inlay with chipmodule and antenna, with a conventional passport cover sheet. The optical quality of the eCovermust be the same as with the conventional cover, without the embedded electroncis. However, new processes in eCover production, such as roll-to-roll instead of sheet-by-sheet, inhibit the screening of sheets according to optical quality.For that reason, keeping the optical quality of a long known product with the new requirementfor integration of electronics can provide new tasks for contactless inlay developers. In the area of ID cards, you can find the requirement for thin, white contactless inlays. The reason behindit is the design of the card itself, as the card top layers are often transparent to allow the introductionof new security elements in the card. In addition, the contactless inlays need to fulfill very high expectations regarding the surface quality and cleanliness, to allow a clean card design.
Mechanical robustness
The components for passports and ID cards must be very robust in order to survive ten years in a ‘hostile’ environment. The strength is evaluated by the simulation of mechanical, thermal,climatic and chemical stress according to the experience of the card or passport manufacturer.Conventional packages with metal lead frame and plastic molded chip encapsulation meet these requirements today, but the combination with rather conventional contactless inlay processes pushes this technology close to its limits regarding long lifetime in eID applications. Therefore, package developers are working hard on new module designs and materials to increase the lifetime of modules for use in eID cards and passports. Package developers must close the gap between conflicting directions: minimal thickness and robustness.
Minimal thickness of package / contactless inlay
This requirement covers two wishes of card and passport manufacturers:
• The card surface has a better quality, and passports with electronic covers further resemble conventional documents;
• It enables the integration of innovative security and personalization features in ID cards.
This requirement interferes with the demand for high mechanical robustness but it helps to improve optical quality.
Minimum warpage
This requirement refers mainly to electronic passport production. To enable a smooth passportproduction process, eCovers need to be as flat as conventional paper or fabric-based covers.However, a laminate made from several layers, with drastically different properties can show curling or ‘warpage’ dependant upon the environmental conditions (e. g. temperature, humidity).For instance, the combination of plastic foils, metal antenna, cotton cover material and coatingwith acrylic resins is quite challenging in terms of the demand for a flat eCover.
SolutionsDual Interface – redundant system
To increase the mechanical stability of eID cards, the redundant electrical connection between the chip and ISO- contacts of the module has been introduced. The effectiveness of this technology has been proven over 10 million times in the field. The development of this product was a major milestone in order to meet customer requirements for high-end applications with very low number of field failure rates.
Thin and robust contactless package FTM8
The FTM8 package is today’s solution to achieve a thin and mechanically robust packagefor a lifetime of ten years and beyond. Due to its design and materials, it is possible to reducethe package thickness to 260μm and at the same time increase its robustness compared to conventionalsolutions, such as lead frame and mould packages.
The FTM8 overcomes the limitations of existing packages with a flexible carrier tape, round mould body and ultrathin ICs. It is adapted to the requirements for a highly robust and ultra thin package and contactless inlay.
Hybrid cards
A dual interface function can also be realized with a hybrid solution. This means the contactless and the contact-based IC is separately integrated in one card.
There are several advantages by using a hybrid system:There are several advantages by using a hybrid system:
• Proven technologies;
• High assembly yield;
• Easy process integration by using standard equipment;
• Stronger interconnect from contactless module to antenna (e.g. welding) compared to the interconnect technology dual interface module.
Package innovation for the future
With the increasing daily use of contactless chips in ID applications, card users and issuersare becoming more aware of quality and lifetime issues. This is also a driver for the developmentand integration of additional security features into chip cards. So what is the benefit of even smaller and thinner modules?
As a response to the market needs, a contactless ID package was created – C.I.S. (Chip inSubstrate). The C.I.S. is an ultra thin, but highly robust package which also meets the demand for a 10 year lifetime and beyond. Though having a thickness of only 150 – 180μm (50 % of today’sstate-of-the-art modules), the robustness of the module is increased to an extent that exceeds today’s standards. Because of the very small dimensions, C.I.S. improves the optical imageof the card and allows more flexibility in card design and graphics. The extremely low resultingprelam thickness allows the use of additional layers for thicker foils or security features. C.I.S. is a package that meets the requirement for ‘invisible’ electronic components.