On the road to Bandol

While writing the previous post about RFID, it reminded me of another smart card program: the fidelity program at the Nice Airport. In this program, if you travel more than 10 times a year from Nice airport, you get into a program that gives you access to a few privileges such as reserved parking, shortcuts to the security lines, and a few other things.

In order to get these advantages, you need to get a smart card, which includes biometric data. Every time you want to get an advantage, you insert your smart card, and you get a fingerprint scan. And every time you travel, you do the same, and register your travel. At first, this looks like a bit too much, just to get faster through security. Well, if you think about it, it’s not that bad:

• This program is based on how often you use a service (the airport). A very simple attack consists in sharing a card between 3 people who travel four times a year (in a family, for instance, or in a group of students). The typical security countermeasure against this attack is to authenticate the cardholder.
• Authentication could be performed by matching the card with some kind of id, or even against the boarding pass. However, this would require an airport employee to check the cards. The problem is that in a typical airport trip, we don’t get in contact with airport staff. We get airline staff, security staff, but no airport staff. In that case, automation is the only way to make the cost of the program acceptable.
• Automated strong authentication (of a person, not of a transaction) cannot be done by passwords, which can be shared just like the cards (the cardholder has no asset to protect there). Biometry remains an option, since fingerprints are harder to share (not impossible, just harder).
• At this point, we could still be using a RFID card, with fingerprints on record in a centralized database. That’s where privacy comes in. With a smart card, your fingerprint match data is stored in the card, not in a database. And this can be better for your privacy.

This kind of applications are not my specialty, but it is funny to realize that the choice of an adequate solution for an application as simple as an airport’s frequent traveler card is far from obvious if you consider a few standard security issues.