What's With This Magnetic Stripe Stuff?

Why are we talking about magnetic stripe?

Another article on magnetic stripe technology? Why is it that you should spend any time looking at that? If this is your reaction to seeing an article on magnetic stripe technology then maybe you are missing the boat. Magnetic stripe technology has been around for a long time but many things are changing in the technology and many of the old reasons for not using it are no longer valid.

Where is magnetic stripe used?

Magnetic stripes are increasingly used in many areas. Some examples of the use of the technology range from the familiar credit and debit cards, transit tickets, and access control cards to some applications you may not have been aware of. Telephone debit cards have a value associated with the card which is decremented every time the card is used. This information is stored on the magnetic stripe and is changed with every phone call. The new Airline Ticket Boarding Passes have a magnetic stripe on the back. If you have a card type ticket (not the old flimsy red tickets), you probably have a magnetic stripe on the back. The stripe is used to hold information about you and your flight. The latest new use for magnetic stripe is on your drivers license. If you live in California, you already have a magnetic stripe on your license. New York and Virginia will soon follow. The stripe will allow error free identification of you when it is swiped through a terminal. This eliminates typing errors in copying from the license.

As you can see, magnetic stripe technology is all around us, everyday.

Is there something new?

 If you consider that magnetic stripes have been used since the early 1960s on transit tickets and since the 1970s for bank cards and that the same technology continues to be used on bank cards then maybe we need something new. In fact there have been several technology improvements over the years that are in use in some systems today.

The two biggest changes that come to mind are security and data permanence. Magnetic stripe has always been cited as being insecure. Today there are technologies that can provide many different degrees of security as discussed below.

The buzz word of today in magnetic stripe is high coercivity. This is a technical term used to define how easy (or difficult) it is to encode the magnetic stripe. A standard bank card has a coercivity of 300 Oersteds, high coercivity stripes range from 2700 to 4000 Oersteds.

What about security?

The major complaint about magnetic stripe technology has always been - "but it is not secure". This is true with a conventional magnetic stripe system. Many people have demonstrated over the years how to counterfeit or duplicate magnetic stripe encoding. Now there are three companies publicizing technologies that have a solution to data security. These are ValuGard® from Rand McNally, Watermark Magnetics® from Thorn Secure Science International, and XSec® from XTec, Inc.

What do these technologies buy you? They each have a means to ensure that the card or ticket being used is the original card that had the data encoded on it. They use different means - ValuGard uses the inherent signal amplitude properties of the stripe, Watermark Magnetics uses a special magnetic stripe, and XSec uses the inherent jitter properties of the stripe. What all this means is that the actual piece of magnetic stripe can be tied to the encoding to prevent fraud.

Loss of data

You may hear the word security used when someone talks about high coercivity but this is confusing. It suggests that a high coercivity stripe is harder to duplicate or counterfeit and unfortunately this is not true. What is true is that the stripe is less likely to be damaged by contact with a magnet such as on a purse clasp. Some of you may remember the big "eel skin wallet" scare of a few years ago. The story went that eel skin wallets erased magnetic stripes on credit cards. Obviously this was not true. Eel skin wallets are made from the skin of the hagfish and it has no different properties than leather or plastic. What was different about these wallets was that they usually had a magnetic clasp. The clasp was the culprit in destroying the encoding, but even today, many banks will tell you that eel skin destroys magnetic encoding. With a high coercivity stripe this would not have been a problem.

What about the other technologies? How do they compare?

Whether magnetic stripe is used rather than other technologies depends on the system being considered. Obviously for a new bank card, no-one would even consider using anything other than low coercivity magnetic stripe today. The number of cards in use, the amount of equipment in the field and the need to be compatible with everyone else is an over-riding feature. But for new systems the choice is not always so clear.

The four technologies that are often compared to magnetic stripe are: Barcode, Radio Frequency, Smart Card, and Optical Card. Each of these are important technologies, but there is a best technology to use in most applications.

As a means to help identify the best technology for any particular application, the following five comparisons can be made: Suitability, Data Storage, Ease of Use, Cost, and Security. An application can be rated against each of these in turn and a table made to show the comparison.

As an example of the rating strategy, let's take a look at one particular application, the Transit Industry, for each of the five comparisons.

Suitability

The application requires the card to identify the type of ticket; period pass, stored ride, stored value etc. For a simple period pass (monthly ticket) the application only needs to check that the ticket is valid for the current period and that it has not just been used in the equipment (to prevent a passenger handing the ticket to another passenger). This can all be done in a read only environment (serial number and valid period). For the other types of tickets, stored ride or value, the equipment will need to encode on the ticket.

From our list of technologies, we see that for a simple period pass, any of the five are suitable, but for the other types of tickets barcode is not a suitable technology as dynamic data is required and barcodes cannot be rewritten in the field. The other four technologies all allow data to be written and read in the field although the cost of writers for optical technology is prohibitive and a read/write RFID tag is not a standard "ticket" size but is a thick tag with a battery included. Advantage: Magnetic, Smart Card.

Data Storage

In this application the amount of data required is very dependent on the system requirements. At its simplest, only the serial number and a period identifier need be stored on the ticket. This could be only eight to ten bytes. Conversely, the amount of data required may be quite large. If the Transit Authority want to record the place of last use, the issue date, original value etc. the amount of data storage required can be several hundred bytes. Figure 1 shows a table of the data storage available for the different technologies and as can be seen, all have suitable amounts of data storage for the period pass. However barcode and RFID have a problem when the larger amounts of data are required.

The numbers shown are not absolutes but are meant to give a guideline to available data storage. Advantage: Magnetic, Smart Card, Optical.

* per ISO spec. - not a technology limit.

FIGURE 1: DATA STORAGE, COST, & SECURITY FOR CARD TECHNOLOGIES

Ease of use

In the transit application, ease of use also means speed. The last thing that the authority wants is a line of people trying to get on a bus or go through a turnstile. It must be possible to take the ticket, insert it in the equipment and get it back within one to one and a half seconds.

Barcode and Radio Frequency ID have an obvious advantage here, they are both non-contact technologies. The ticket could be waved over a laser scanner for barcode, or in the case of RFID it doesn't even have to be removed from the wallet (or maybe even the pocket).

Magnetic stripe, smart card, and optical all require contact to be made. A smart card with contacts requires that the card be inserted in a slot and the contacts be brought onto the ticket. The transfer of data takes place and the card is released. The optical card has to be treated in the same way. It is inserted in a slot and the read/write process takes place. The card is then returned through the same slot. The magnetic stripe card can be placed in either a swipe or motorized reader/encoder and the ticket can be read, rewritten, and verified in a fraction of a second. Advantage: Barcode, Magnetic, RFID.

Cost

This can be a big issue for an authority that is issuing hundreds of thousands or millions of tickets a year. Unlike hardware costs, the cost of tickets is ongoing and must be borne as a cost of doing business. This makes the cost a significant issue to the authority as these funds come from operating expenses rather than a government grant. Figure 1 shows the relative costs of tickets using the various technologies.

As the table shows the only viable solutions for this application from the cost perspective are barcode and magnetic stripe. At a cost exceeding several dollars per ticket for the other technologies, the cost to issue large quantities can be prohibitive. The costs above are based on a "credit card" sized ticket. They can vary a lot based on items such as quantity purchased, amount of printing, base material, etc. A barcode and a magnetic stripe can be put on paper or plastic and the price reflects the choice of material. The other technologies are more expensive initially and do not use the less expensive base materials, which gives them a cost disadvantage. Advantage: Barcode, Magnetic Stripe

Security

Although security may not be a deciding factor in the choice for a technology, it can be an important issue. Security can mean many different things, but in this case we will talk about the ability to copy or counterfeit the ticket. This is a major concern because the ticket is the equivalent of money. Figure 1 shows the security for the different technologies.

Some caveats are necessary in the above table. It is very easy to duplicate a simple barcode (photocopy), but it is possible to hide the barcode behind a panel which is transparent to infra-red but opaque to visible light. This increases the security but the barcode can still be copied (photographed using infra-red light and film). If the RFID tag is a read/write tag (as may be required by the application) the information can be easily changed unless it has some form of permanent information in the tag.

Security on a standard magnetic stripe card is poor but there are technologies available (such as Watermark Magnetics, XSec, and ValuGard) which increase the security of the magnetic stripe to near that of the Smart Card.

The Smart Card and Optical Card are both highly secure technologies. The Smart Card uses an on-board processor to increase the security, and the Optical Card has such a large amount of data storage space that many types of security can be implemented at the same time (multiple biometric identifiers, encryption algorithms etc.). Advantage: Magnetic, RFID, Smart Card, Optical

Summary

If we look at the five issues that have been discussed above, we find that magnetic stripe has advantages in all five areas. This does not mean that magnetic stripe is the answer to all our prayers, however it does show that with the correct specifications, magnetic stripe can be made to meet all the requirements. Some of these category classifications will not change from application to application but the relative importance of each will change. For example, cost may be the over-riding factor in choosing a technology and you may choose a particular technology because of that even though it does not come out best overall.

FIGURE 2: SUMMARY OF FEATURE ADVANTAGES

The items reviewed here may not be the only items you will need to look at for your particular application. These form the basis of a comparison and you can add or delete other categories as needed.

What about Standards and Specifications? Are they important?

The question is a far reaching one, and one that I get asked several times a week. The answer is not as straight forward as we would like it to be. Standards and specifications are important, they help to ensure the quality of a system, however they don't always have to be adhered to. What do I mean by this? Think of your bank cards. Where would we be if there was no global standard. At the basic level, it would mean that your credit card may work at Macy's but not at Gimball's. At the next level it may work in one area of the country and not in another, or in one country and not another. Obviously standards are a necessity in this global interchange environment. But what if you are only making an access control system for your building? Do you care if the cards don't work in your neighbor's system? No. So in this case a "standard" is not necessary.

One of the most common statements, I hear from a company looking at an ADC technology is "I can't use magnetic stripe because I need more than 37 characters on track 2 and the manufacturers say the standard is 37 numeric characters". The manufacturer is right in saying the standard (there is only one recognized standard - the banking standard) says track 2 is 37 numeric characters. But who says you have to follow the standard. The only problem with not following the standard (in a non-interchange environment) is that it may be harder to get a reader or encoder capable of reading or encoding the information you want.

Currently there is one global standard that everyone refers to. It is ISO 7811/2 (magnetic stripe standard) and 7811/4 and 7811/5 (track locations). The standard only deals with low (300 Oersted) coercivity cards in the interchange environment. These standards have recently gone through revision and review and new versions should be published very soon. They can be obtained from ANSI.

The ISO committee is now working on a similar set of standards for high coercivity cards, but the document is only in a working form at the moment and is not likely to be released for Draft Review until next year at the earliest. The committee still has many technical issues to resolve. At the recent ANSI meeting, much of the time was spent looking at the various candidates for a reference card and trying to decide on the properties required for this card.

AIM currently publishes a document called "AIM Guideline for Measurement of Effective Magnetic Parameters of Magnetic Stripes on Media". This guideline presents a means of testing a magnetic stripe on a document to determine if it meets a set of specifications. The method uses a comparison to a known good card as a means of defining good vs. bad and can be used for low or high coercivity stripes. AIM is currently working on a supplement to this to help test the immunity of the magnetic stripe to magnetic damage.

How can I get involved? What about more information?

There are several ways to find out more about standards in magnetic stripes and whether they effect you. The first is to buy the published ANSI standards (ISO 7811/2). This will give you a good understanding of the type of specifications that low coercivity stripes should adhere to. A good companion document to this is the test measurement document, ISO/IEC 10-373, which tells how to do some of the tests.

The next move, especially if your primary interest is in high coercivity is to get the AIM Guideline for Measurement of Effective Magnetic Parameters of Magnetic Stripes on Media. This document allows you to make measurements on magnetic stripes for yourself and determine if the stripe meets your requirements.

The final move is to get involved. If you are a manufacturer or consultant then join in and take part in the meetings that define magnetic stripe parameters. If you are an end user, you should consult your supplier (or consultant) to find out the latest specifications and what part they are playing in setting those standards.

CONCLUSION

As a summary on magnetic stripe, we have seen that the technology offers the ability to change data in the field, that data storage is available that will exceed most requirements, that it is easy to use, the cost is very low, and that full security is available if required. Magnetic stripe technology is a proven technology that can be applied to many different sizes and types of substrate material. This gives it a tremendous advantage over those technologies which are more closely bound to the substrate material.

We have taken a brief look at standards and specifications and talked about when we need standards and when we don't. For those of you with further questions, I invite you to contact me and we will try to answer any questions you may have.

Steve Halliday