March 24, 1997 10:00 AM ET
Smart cards move to head of class
Florida State University embraces technology; spawns separate business to sell services
By Scott Berinato

Corporate America could take a lesson from Florida State University when it comes to implementing smart card technology. Early last year, Bill Norwood, the executive director of card application technology at FSU, embarked on a mission to uproot its campuswide magnetic stripe card system and replace it with more versatile smart card technology. The goals were many: to provide a higher level of security for its network computer while lowering its management cost, to offer students more applications on a single card and to give them ubiquitous access around the campus. The infrastructure, which has taken about 10 months to complete, includes a single PC server, various security software and service applications, 700 card readers scattered throughout the campus, 35,000 smart cards, and several hundred vending machines. However, assembling the technology proved hardly a challenge compared with the chore of marshaling extremely proprietary vendors--a key detractor for many IS managers tempted to use smart cards. "We called six or eight companies in and said, 'You've been doing this independently. We need it all from one card. How do you do it?' " said Norwood, at FSU's Card Technology Center, in Tallahassee, Fla. Ten months later, FSU is operating one of the largest smart card trials in the United States. The implementation proved so successful that Norwood's group recently spun off into a private systems integrator. Known as CyberMark LLC, the group will sell its services and expertise to other universities and interested corporations to help deploy scalable smart card systems. "I think corporations will really start buying into this," Norwood said. "A corporate campus isn't a whole lot different than we are, except some of our 'employees' are just a bit younger here." Smart cards house their data in an embedded chip rather than the magnetic stripe of common credit cards. Because of their enhanced intelligence, smart cards are being viewed by many as enablers for more secure computing and online commerce. Vendors such as Microsoft Corp., Netscape Communications Corp. and Hewlett-Packard Co. have each become active in creating standards for the technology to foster growth. The bare-bones technology of the FSU smart card system incorporates cards from Gemplus Corp., a legacy 100MHz Pentium server outfitted to handle 4,000 concurrent smart card sessions, readers from several companies including Debitek Inc., V-One Inc. and Verifone Inc., and security applications from V-One. Nearly 35,000 people, including students, professors and university staff, have been given 1KB chip cards for a multitude of applications. The cards are authentication and encryption engines, stored value "purses," and bus passes in one. The cost for building the smart card infrastructure was about $750,000, including donated equipment for beta purposes. The 1KB cards cost $4 each, but that price is dropping. The card readers for PCs are about $40 each. In comparison, readers for vending machines can run up to $700. The main benefit to FSU is faster, safer transactions, all of which have led to higher productivity. All told, Norwood expects the initial investment to pay itself off in three years. Applications and hardware Among the applications on the FSU card is SmartCat, a token authentication and 64-bit encryption engine from V-One. Users who want access to information on the university's intranet, whether it be student financial records or shared faculty documents, must first insert their cards and enter a pass code. The card communicates with the firewall and determines the level of access due to the client. Without the card's token, access is prohibited. The SmartCat client software also allows users to encrypt parts or all of a notebook's hard drive. Decryption can happen only with the proper smart card. This feature, Norwood said, will have corporations champing at the bit. The cards also let users store money in "purses." Currently, the FSU card can store cash in four purses: one for vending machines, copiers and washer/dryers; another for the bookstore; a third for the cafeteria; and one for which the use has yet to be determined. What is unique about the purse is that the cash in each purse can be used only for its specific purpose. For instance, students could not buy a hamburger with money in their book purse. Corporations deem this feature very attractive as a budget control mechanism. "[Purses] would be a huge development for corporations," said Karen Epper, an analyst at Forrester Research Inc., in Cambridge, Mass. "It's a great way to track spending. It's the kind of incentive, the kind of compelling reason a company will need to justify using smart cards." On the hardware front, FSU also has installed smart card readers at administrative buildings, so students can access confidential records. Conversely, without the proper smart card authenticating the transaction, employees cannot access a student's data. Next week, Norwood will attach external readers from V-One to more than 300 library computers to extend public-area access to secure information. Portable readers from Verifone, called the Omni 1250 (formerly code-named Nevus), also are being used for stadium purchases, but Norwood sees cash-on-delivery applications fitting well with Nevus, too. Going private The employees of the Card Technology Center will be melded into CyberMark LLC this week. CyberMark was formed by the Student Loan Marketing Association, The Battelle Institute and Huntington Bank Shares. The amazing response to FSU's infrastructure provided the impetus for the companies to turn a developmental division into a smart card company offering end-user services. Copyright(c) 1997 Ziff-Davis Publishing Company. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Ziff-Davis Publishing Company is prohibited. PC Week and the PC Week logo are trademarks of Ziff-Davis Publishing Company. PC Week Online and the PC Week Online logo are trademarks of Ziff-Davis Publishing Company. Send mail to PC Week