Contactless Card System

Shoie

Hi

Hope this is in the right place.

I have been asked by an Association my wife is a member of about new ways to keep the membership data base and an easy way to get details of Training and Courses each member attends.

National Secretary currently issues business card type ID with only a membership number on it. The system I am thinking of is having an SQL Database on a secure server with limited access where the National and Regional Secretaries can update it as needed.

I want a contactless card system that we can print onto plastic cards and these can be kept for life with the Association Logo, Text and members photo. The cards then can be used to register and study evenings, training courses and conference ran by the association to reduce administrative burden. Hopefully the laptop at the event will have an offline version of the database that can by synchronised later with the live one.

What I need to start is 1 card writer, 1 reader, box of cards to start a feasibility test. Eventually, if feasible, we will need 2 writers, 8 readers, cards and card printer. Can anyone point me in the right direction of a company that could supply the above?

Thanks

NeverSayDie

Gemalto is one big company I know of supplying smartcards and readers, HID would be another US one - I have one of their contactless readers sitting beside me here in fact. Re the reading and writing, that's done through the same device, usually just called a "card reader". Readers come in various forms, but normal ones are USB-based and plug into a Windows or other PC. They're relatively cheap, maybe 50-100 apiece for contactless ones in small quantities (contact gear is cheaper). Smartcards (contactless and otherwise) come in various forms, for small amounts, prices might vary between a euro or so and 10-20 euro per card, depending on what kind you go for. Card printers are a bit more expensive, few hundred to a few thousand euro, off the to of my head. A company called DataCard make various models, though there's probably lots of others too. You can also pay printing firms to print cards for you, AFAIK, though that may not be economic for small amounts.

Bear in mind, buying all this gear is no use unless you know how to write the software to use it, which is a non-trivial task. It is quite doable given time and expertise though, through the standard Windows APIs for talking to smartcard drivers and the manufacturer's SDKs and info re how to interact with the specific chip on the card - prime it and load files onto it, read and write from it, perform various crypto operations, etc. There are common standards for talking to smartcards, they all work in a (somewhat) standard way - ISO 7816 for contact ones, some similar thing for contactless. Some of them are Java based internally - you write the code for the card chip itself in a version of Java, using the JavaCard standard.

Otherwise, there are various companies who produce software to run smartcard systems for ID/security, payments, transport, ticketing, financial services, etc etc. Gemalto do some of that themselves too I think, don't know much about it though. Google search will probably turn up various folks in that business (I work for one myself as it happens, but I'd sooner not get into that here, and I mostly work with backends anyway, not the cards themselves so much). Unless you're planning to get into writing the card software yourself, I'd recommend looking for someone with a pre-packaged solution.

Also worth bearing in mind that in addition to a full contactless smartcard, you may be able to run this using simple barcodes printed on the card, or "proxy cards" (a very basic type of non-contact card that just stores and transmits a number, and is used for parking/door locks, etc). They don't have the same security and functionality as a smartcard of course, but they may be cheaper and simpler in turn. That effectively just involves an ID number on the card that can be read by a PC or other gadget. What the number means and what gets done with it is up to the software on the PC, as is any security involved. Smartcards on the other hand would store information of whatever kind you want, support biometrics, have PINs and a host of internal security measures, etc. That all comes with more cost and complexity though.

Shoie

NeversayDie, thanks for yout detailed response. We only need the card to store a membership number and then use that to read the SQL Database. I was thiinking the reader/writer would come with the software and plug into the PC/Laptop via USB. The reader software accepting the number and passing to the database.

Could you PM me your company details and we can talk further by email.


Thanks again.

NeverSayDie

I don't think the systems we do would be suitable tbh Shoie - we generally do heavier weight stuff where there's applications on the card for secure storage of IDs, payments and money storage, biometric security, PC/software logins, all that sort of thing.

From what you're describing, I'd look towards the barcode or proxy card systems I mentioned - similar to what libraries or basic parking systems use. Should be a good deal cheaper and simpler than smartcards when you just want to store an ID on the card and do the rest in regular PC-based software. If you have the photo and such like printed on the card, that should presumably suffice for user verification (PINs and biometrics would be two options for that with full smartcards).

mwrf

http://www.tds.ie/

do what you are looking for.

Shoie

Thanks for all the help on this. I have taken the advise and I am going with a bar code option. I have sourced a reconditioned printer and barcode scanners for a lot less that I was expecting the project to run to.

Thanks guys.

NeverSayDie

That's probably your best bet Shoie, in terms of cost and hassle. Obviously security is a potential issue, as barcodes are trivial to copy, but it doesn't sound like that's likely to be a problem for you. If nothing else, there's no great incentive to mess with the system and not much potential loss on your part, from what you've described of its use. As long as the owner's picture is on the card, and their corresponding picture in your database displays for the operator whenever you scan the barcode, you should be reasonably OK for verification (determining that the guy using the card is the guy you issued it to). Beyond that, presumably there's not much incentive for someone to hack their way into one of your study evenings