The fingerprint recognition bank card market is heating up, where are the design challenges?

In July 2020, ST announced that it would jointly develop a biometric system card (BSoC) platform with Fingerprint Cards. ST will provide an STM32 general-purpose microcontroller and an ST31 microcontroller. The latter uses an Arm Secour Core SC000 core and adopts a 40nm process. ST will also launch its STPay solution, which relies on a JavaCard-based operating system to implement payment applications.

Shifting security from passwords to fingerprints

This announcement is symbolic. According to a study by ReportLinker, the global contactless biometrics market will reach $18.6 billion by 2026. The study also cited the recent COVID-19 pandemic as a driver of development, with consumers looking for safe ways to pay while maintaining a safe distance and avoiding physical contact. As a result, secure payments via contactless cards with biometric authentication are becoming increasingly popular, and BSoC solutions help improve or even eliminate today's contactless card interactions.

As BSoC becomes mainstream, obtaining accurate and relevant information becomes difficult. The core technology behind biometric payment cards is slowly filtering into other forms of identification, such as employee ID cards or identity cards. It is critical for decision makers to understand the technical challenges inherent in these emerging technologies.

The hardware build is relatively simple. There is a fingerprint sensor, a general-purpose MCU to extract the image it captures, and a secure element. The latter stores the fingerprint image after enrollment and matches it before any transaction is made in a secure environment. However, biometric systems on cards can only be successful if they overcome multiple challenges.

On-card biometric systems: the challenge of efficiency

Physical Requirements

Adding biometric features to cards is a challenge because manufacturers must meet existing thickness requirements to ensure compatibility when the card is swiped or inserted into an existing reader. The ISO/IEC 7810 standard states that all bank and ID cards must be 0.76 mm thick. Other standards also define the ability of the card to bend without damaging the connector or components. Meeting these stringent requirements means that if a company masters biometric bank cards, it can easily port their solutions to ID cards or other fingerprint recognition applications.

In addition, engineers had to address the technical challenges of power consumption and energy harvesting of the card. Therefore, ST implemented a secure element that can take power from the contactless reader and distribute it to the card. The general-purpose MCU (STM32) and ST31 have extremely low power consumption, and they can operate only with energy harvested by the magnetic coupling process. Therefore, BSoC is innovative because it uses the same NFC technology as the previous generation of contactless bank cards, but it can now power more components, such as the fingerprint sensor and the general-purpose MCU.

Storage and compute throughput

Acquiring the user's fingerprint information and storing it in the relevant template after registration necessarily requires more memory. Therefore, engineers working on card biometric systems face higher hardware requirements. The security element executes the application, protects the information (including the biometric template), and runs the algorithm that matches the fingerprint with the template to verify the user's identity. Therefore, more storage space is required for the template and matching algorithm. Similarly, a general-purpose microcontroller extracts the fingerprint from the sensor and sends it to the security unit, which has the characteristics of high computing performance and low power consumption.

Therefore, decision makers understand the importance of hardware optimization. The STM32 microcontroller has a low-power mode that significantly improves energy efficiency. Similarly, we ensure that the ST31 can run the fingerprint matching algorithm as quickly as possible. In fact, the entire transaction time including fingerprint matching must be less than 1 second. Therefore, the platform must provide all-round optimization and guarantee a perfect user experience.

On-card biometric systems: challenges of security and user experience

Ease of use

One challenge users face is the lack of standardization in the enrollment process, which must strike a good balance between overall security, performance, and user convenience. Developers are working on different enrollment mechanisms that will use a sleeve, a mobile device, or a reader with an optional LED on the card and enrollment support. Fingerprint capture must also be fast enough and meet biometric standards such as FAR (false acceptance rate) and FRR (false recognition rate) requirements, which specify biometric interactions. False positives are a serious breach of security and make the entire system unreliable. On the other hand, false negatives will produce repeated inputs that are difficult for end users to tolerate. Therefore, system teams must find the right balance between accuracy and fast recognition.

Safety

BSoC differentiates itself from current solutions by offering better biometric processing and more secure protection of assets such as sensor images and templates. Biometric cards are therefore more secure than password authentication or basic contactless solutions by providing stronger security and privacy protection. However, as we have seen in the article, designing a BSoC is a challenge. Therefore, adopting ST and fingerprint card solutions means that the team can bypass this complexity and ensure that the end user trusts the biometric system on the card. The STPay platform also guarantees fast processing times, which is crucial for a successful experience.