Challenge

In airports there are many security areas that are not accessible to passengers, but for a wide variety of different people working at the airport. This places special demands on an access solution that can not only serve the people permanently working at the airport, but also external persons such as suppliers, craftsmen, airline personnel and also federal police. Previously used, time-limited badges with a personal picture or time-limited special badges without a personal picture – both in the form of a smart card (RFID) fulfill this purpose, but do not stand for a secure identification of a person. To close this security gap, a biometric solution should now be used with the existing badges as additional protection for special security zones.

The individual biometric information should not be stored centrally, but on the smart card.

Approach

The solution under consideration is based on a smart card on which the individual biometric pattern is stored during the registration process. This “ID card” can therefore only be used by the person biometrically recorded for this card. If loss or theft, the card cannot be used by “strangers”, and it is also impossible to intentionally pass it on to another person so that they can use the card. The biometric pattern stored on the card is only a hash value, and can also not be abused. The palm vein technology used is non-contact (hygienic), insensitive to dirty, damp, or dry hands, and it is hidden inside the body. It works extremely precisely and quickly.

Thus, the system requirements were fulfilled: increased security, 2-factor authentication, high system performance, and high usability.

Lessons learned

Here we had to modify and extend an existing solution so that the parameters specified by the airport operator were met. Security in an airport has other determining factors than security in a company. Different companies work together on such a solution, and they all have to cooperate with each other to achieve success. We are also talking about a solution that has to run 24×7 continuously, so even a simple operating system update (carried out in the background), which simply brings the solution to a shutdown, can still be a problem. This case represent a completely different “challenge” – but even this was mastered in the end.

Success model

Here, too, it is important to first bring the decision makers to the table. Of course, you have to be clear in advance how the solution looks like, which requirements have to be met on the customer side and on the hard- and software side of the card supplier.

This forms the framework of the first important discussion, followed by a discussion about costs and time frame before the “technical implementers” can start their work.

The decision – as so often – is to carry out a “proof of concept” traditionally on site. This eliminates errors in the subsequent production system, just as it should already give the customer and its users a good and secure feeling.