See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/269629982

A Proposal for a Unified Identity Card for Use in an Academic Federation

Environment

Conference Paper · September 2014

DOI: 10.1109/ARES.2014.42

CITATIONS READS

2 9,770

3 authors:

Felipe Coral Sasso Ricardo Moraes

Federal University of Santa Catarina Federal University of Santa Catarina
1 PUBLICATION 2 CITATIONS 95 PUBLICATIONS 768 CITATIONS

SEE PROFILE SEE PROFILE

Jean Everson Martina

Federal University of Santa Catarina
69 PUBLICATIONS 347 CITATIONS

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

PhD. Project - Verification o Multicast based Security Protocols View project

Blockchain View project

All content following this page was uploaded by Felipe Coral Sasso on 16 December 2014.

The user has requested enhancement of the downloaded file.

 2014 9th International Conference on Availability, Reliability and Security

A Proposal for an Unified Identity Card for Use in

an Academic Federation Environment

Felipe Coral Sasso, Ricardo Alexandre Reinaldo de Moraes and Jean Everson Martina
Departamento de Informática e de Estatı́stica
Universidade Federal de Santa Catarina
Florianópolis - SC - Brazil - 88040-900
Email: [email protected], {ricardo.moraes,jean.martina}@ufsc.br

Abstract—A lot of effort has been made recently to build or access to certain shared-use physical environments within
academic federations. However some issues are still open. The the hosting institution may not require such real-time checks.
first is off-line authentication. Today’s model of federation re-
quires systems to work on-line and synchronously, what limits its Identities provided by the federation require the use of
use for some applications. Second, the data federated institutions computers for their verification. Thus, the use of identity
make available is only for computer systems and not for people. credentials is restricted to the context of computer systems,
This makes it difficult for humans involved to assess such making their use difficult or almost impossible for human
credentials. Finally, the federation has numerous technical and agents. Clearly, the use of credentials verified by a human
legal issues for the provision of private data such as biometric agent can help in various scenarios where identification is ordi-
parameters. Even tough, these would bring a much stronger
authentication process. Therefore this research proposes to model
nary and necessary. This also applies to agents that are not even
an identity card based on ICAO 9303 standard for usage in part of the federation but choose to accept a provided form of
academic federated environments. This proposal enables off-line identification. An example is the identification requirements for
authentication, assessment of credentials by human agents and discounted tickets in box offices from cinemas and theatres.
allow the usage of private biometric data in a secure manner.
In addition, some data is considered private, confidential
Keywords—Federations, Identity Management, Digital Docu- and for restricted use. In this sense, the home institution
ments, Biometric Data through its identity provider cannot share it. Thus, it is
important to act carefully with this data, otherwise the involved
I. I NTRODUCTION institutions can suffer legal sanctions for any privacy breach.
An example of such data is the biometric information for an
The use of federations as a method to centralise authentica-
authentication processes. It can be very useful as a second
tion, is now a reality in academic environments. In an academic
authentication factor, but its collection, storage and transmis-
context, each participating institution in a federation can make
sion are very sensitive to privacy issues in these federated
available credentials from its users. These credentials can be
environment activities.
used in services offered by the federation, taking away from
each system the responsibility of storing credentials. Thus, To sort these problems out, it is necessary to conceive
when an academic visit another institution, he can use services an off-line authentication method, thus minimizing the real-
offered by the hosting institution just proving his authentication time communication between institutions. It is also necessary
credentials from his home institution. As an example of such equip human agents with the possibility of verifying such
federation we can mention the Incommon1 U.S., where more identity credentials without the help of computers. Moreover,
than 400 higher education institutions are participating, as it is mandatory that the user controls his private data, such as
well as several research centres and companies. Even with all biometric information, and how it will be saved, transmitted
these implemented and running, federations in general are still and used. A standard that already address these problems and
limited in the use of their credentials. is commonly used for credential transmission, evaluation and
A federation consists in two main entities: Service checking is the Machine Readable Travel Document standard
Providers (SPs) and Identity Providers (IdPs). IdPs are respon- (MRTD).
sible for managing the user’s authentication credentials and MRTD is a standard specified by International Civil Avi-
their personal information, while SPs offer services in which ation (ICAO) and laid down by the ICAO 9303 document
these users can access through the IdP credentials [1]. In this series[2]. This standard is the one used in passports, therefore,
way, services do not need to maintain users information and it is already well understood, either in terms of software as
users do not need to memorise several credentials. in terms of hardware requirements. The ICAO 9303 document
Federations require both, resources and identity providers, series details specifications such as the mandatory and optional
to be available on-line. Thus, both, the identity provider at data that need to be present in such documents, how to access
the home institution, as well as, the service providers must it and how to verify the authenticity of such data. Furthermore,
somehow communicate in real time so that the users can access MRTD specifies different levels of service, including one with
a given service. Some applications such as the lending of books an integrated circuit (IC). In this IC, biometric information,
such as finger prints and iris can be safely stored. Thus, this
1 http://www.incommon.org/ paper aims to propose a unified identity card for the usage

978-1-4799-4223-7/14 $31.00 © 2014 IEEE 265

DOI 10.1109/ARES.2014.42
in academic federated environments, which is based on the • Printing visible under UV light
ICAO 9303 standard, but addresses specificities of academic
federations. • Tactile printing in some places

A detailed analysis of ICAO documents, including their • An integrated security thread including the document
data structure, how they can be read and authenticated is number and the card holder’s name
given in Section III; definition for federations, including its • A changeable laser image on the back showing either
importance and use in academic environments are provided the ID card’s validity or the card holder’s portrait
in Section IV; our proposal for an identity card with detailed depending on the viewing angle
information about the required modifications relative to ICAO
documents is done in V; applications for the proposed identity • The eID card can be used only in combination with a
card are given in Section VI; concluding remarks and further card reader. For this reason it is impossible to retrieve
work are discussed in Section VII. data remotely

II. R ELATED WORK

• Only persons holding the ID card and knowing the
PIN can authorize the transmission of data. Your
A student card is a document that ensures to the student personal data are protected against misuse on the
the right to pay a lower price at concerts, cinema, theatres Internet
and another activities in certain places around the world. Some
shops also offer discounts in products and services for students The card also has the integrated eID Function, which can
who present a valid card. This card can also help a large be used to identify users on the Internet at vending machines,
quantity of students by providing transportation allowances [3]. in an automated and secure way [12]. The card also stores a
passport photograph and fingerprints to match the ID card its
Nowadays United Nations Educational, Scientific and Cul- card holder.
tural Organization (UNESCO) recognizes the International
Student Identity Card (ISIC) as the only international proof Besides Germany and Italy, Belgium also has an identity
that a person is a student [4]. The ISIC card has been endorsed card following the recommendations of the International Civil
by the UNESCO since 1968 [5]. ISIC is also supported by Aviation Organization. The Belgian identification card allows
the European Council on Culture and the Andean Community its holder to use an authentic signature. [13].
of Nations. The card is recognised by universities, academic
institutions, student unions, national governments, financial As seen in [14] Belgian identity card has three 1024-
institutions and ministries of education around the world [5]. bit RSA encryption: one to authenticate the citizen, one for
Nevertheless, ISIC card can not be used to solve the problems non-repudiation signatures, and one to identify the card itself
previously mentioned. These problems consists in the need towards the Belgian government. The first two key pairs are
for real-time communications between Identity Providers and accompanied by certificates that are issued to the citizen: one
Service Providers, private data can not be shared and the card authentication certicate for use in client authentication, e.g.,
does not store the student personal information. It also does with SSL/TLS.
not solve the problems posed to other user in the academic Thus, it was seen two things. First, there is already an
federated environment that are not students. academic card that can be used globally, but has few electronic
There are also deployments of identity cards based on the security properties, as previously said. Second, some coun-
standard of passports , such as the Carta d’Identit Elettronica, tries are successfully using identity cards following the 9303
in Italy. As seen in [6], the electronic identity card is an recommendations of the documentation provided by ICAO.
instrument of personal identification and authentication for Therefore, we believe it is possible that an academic card can
access to the web services provided by public administration. also be created following the recommendations of ICAO. This
The technical specifications for the document were presented card can be adapted to the actual need and requirements of a
at the Ministerial Decree on November 8, 2007 [7]. The card truly globalised academic .
contains stored on a microchip and an OCR personal data,
number of residency, citizenship, numeric code of the city of
III. ICAO 9303
issue, date of issue and expiry, beyond the photograph and
signature of the holder band. However, it is noteworthy that The ICAO 9303 standard is a series of documents created
after 10 years of experiment, the electronic card is limited by the International Civil Aviation Organization (ICAO), which
to a few counties and online resources have not yet been aims to describe the specifications for a Machine Readable
implemented [8]. Travel Documents.
Germany also has an identity based on an ePassport. As described in ICAO’s website[2] work on machine-
The Personalausweis der Bundesrepublik Deutschland [9] was readable travel documents began long before the appearance of
instituted on November 1, 2010, has the form of a smartcard the 9303 Document, with the establishment of the ICAO Panel
and has some interesting security features such as [10] [11] : on Passport Cards in 1968. They prepared recommendations
to standardise machine-readable documents, thus accelerating
• Complex security printing with multi-colour line
the process of releasing passengers at passport controls. Later,
structures
the specifications were published in the first edition of 9303
• The German eagle as a three-dimensional and latent Document and today, it is used as a guide all over the world
image for issuing travel documents[2].

266
A. Machine readable zone (MRZ)
The MRTDs that follow the 9303 standard use a machine-
readable zone (MRZ) to facilitate the inspection of documents.
The MRZ provides data elements formatted to be readable
by machines that use the MRTD standard. These data must
be readable both by machines and visually by humans. As
a solution to meet these requirements, an Optical Character
Recognition (OCR) scheme was specified in Doc 9303 as the
way to store and collect data from the MRZ [15]. The data
contained in MRZ can be seen in the figure 1.

Fig. 2. Data groups [16]

Fig. 1. Construction of the machine-readable zone[16] • DG7: Used to store signature or usual mark;
• DG11 (Additional Personal Detail): Personal informa-
In the MRZ are contained key information about the tion such as address, occupation, name of parents and
document holder. In the first row are data that indicate which phone numbers are stored;
type of document is being described, the issuing state, and • DG12 (Additional Document Details): Information
document number. In the second row are user data, such as about the issuer of the passport is stored;
date of birth, sex, nationality, besides the expiry date of the
document. The third row is the name of the document holder. • DG16 (Person(s) to notify): Informations about per-
sons to be notified in case of emergency
B. Logical Data Structure
The LDS also contains a header and a Data Group Presence
An MRTD document nowadays has alsdo a contactless Map, that are stored in a EF.COM file. This header must have
Integrated Circuit (IC). The Logical Data Structure (LDS) the information that allows the location and decoding of the
describes how the data is written in the IC and how it is data groups and data elements. Confirmation of authenticity
formatted, ensuring global interoperability for machine reading and integrity of recorded data is made by the Security Object.
[16]. Each data group is represented in this object, which is recorded
in an EF.SOD file, known as Security Object. These two files
To meet the requirements, LDS has some mandatory and are mandatory with all other Data Elements being optional
optional data elements. These data are grouped into Data [16].
Groups (DG), depending on where they have been recorded: by
the issuing entity or by the receiving one. Figure 2 illustrates 1) Data authentication: An MRTD that uses contactless
the data and groups stored in the LDS. IC is vulnerable to some attacks. For example, the data can
be electronically read without authorisation within a distance
Among all these data, the mandatory are the ones that of several metres. Therefore, the use of Basic Access Control
belong to DG1 and DG2. The biometric information, such (BAC) is recommended, although not required [16].
as data for face recognition, fingerprint and iris are stored in
groups 2, 3 and 4 respectively. The Basic Access Control mechanism only allows access
to the contactless IC only if the receiving end proves that
In addition to these groups, the IC also contains other it is authorised to access the LDS. This is provided by a
groups where important information is stored, such as: challenge-response protocol, where the receiving end proves

267
it has access to the Document Basic Access Keys, which Several countries now have their own academic federation,
is derived from MRZ. These keys can be provided by an like:
MRZ reader machine or manually. In order to improve the
security, after the authentication, the MRTD must encrypt the • United States (Incommon): InCommon serves the U.S.
communication channel with the receiving end [16]. education and research communities, supporting a
common framework for trusted shared management
The challenge-response is as follow:
of access to on-line resources. Through InCommon,
1) The receiving end gives some MRZ information, Identity Providers can give their users single sign-
which is the concatenation of Document Number, on convenience and privacy protection, while online
Date of Birth and Date of Expiry. This data is printed Service Providers control access to their protected
at the document and can be collected using either an resources [18];
OCR reader or manually;
• Ireland (Edugate): The Edugate provides a single
2) Both the MRTD’s contactless IC and the receiving
access mechanism that can enable access to online
end generate session keys;
resources supporting alliances, research collaboration,
3) A successful authentication process is executed, and
consortia and shared services. Now users can use
after that, the data is sent by a secure channel.
the credentials issued by their institution to access
There is another optional access control mechanism called Edugate enabled web sites and benefit from a person-
Extended Access Control (EAC). It is similar to the Basic alized and persistent experience, with privacy features
Access Control, however, in addition to the access keys already that put the user in control [19];
used by BAC, another key is required. This key is called
• Italy (IDEM): IDEM has the aim of setting up and
Document Extended Access Key and is defined by the State
supporting a common framework for Italian education
that issued the document. Usually this key is necessary to
and research institutes to manage accesses to on-line
access DGs with privacy requirements, such as biometric data.
resources. To achieve this goal IDEM encourages the
The LDS has a Document Security Object (SOD), which development of a community based on mutual trust.
is signed by the issuing party and contains the LDS contents In this way, it will be easier for participants to take
hash. Anyone with the public key of the document signer can right decisions on access control matter, based on
verify the integrity of SOD, and consequently the integrity of information provided by the participants themselves
LDS. This process is called passive authentication (PA). This [20];
process proves the authenticity and integrity of data, but it does
not prevent chip substitution or the copy of content. • Australia (Australian Access Federation): The Aus-
tralian Access Federation provides the means for
The alternative way to prevent chip substitution is using allowing a participating institution and/or a service
the Active Authentication (AA). This is possible due to a provider to trust the information it receives from an-
challenge-response protocol between receiving end and con- other participating institution. This provides seamless
tactless IC [16]. access to resources and secure communication by
removing most of the roadblocks to collaboration and
IV. F EDERATION sharing at both the institutional and end user levels.
Organizations will benefit from the AAF as it allows
According to Moreira et al. [17], an academic federation researchers to use their home institution Login to
involves educational and research institutions. It allows people access a growing number of participating services and
linked to these institutions to share information and resources resources [21].
and access restrict services, using the institutional bond as a
basic criterion for these operations. The academic federations • Brazil (CAFe): CAFe allows each user to have a single
aims to minimize the maintenance of databases and accounts account at their institution of origin, valid for all
from the service providers and users. The information about a services provided to federation, eliminating the need
person is maintained in a single place, managed by his home for multiple passwords and registration processes. The
institution. Service providers trust the identity management of trustworthy relationship between participating institu-
the institutions. They offer their services for users from those tions of the Federation allows the user to authenticate
institutions, thus creating the principle of federated identity. only in its origin institution, which provides guaran-
Federated Identity is a mechanism used for authenticating tees of authenticity and credibility necessary to the
users from partner organizations, allowing the sharing of others [22].
identity information between security domains. In the last
years, academia and governments adopted the use of Identity There are other federations in several other countries such
Management by the use of federations in their e-Government as France (RENATER2 ), Japan (GakuNin3 ), Canada (CAF4 ),
services. among others. In addition to these nation wide projects, we
can also cite as an example the Eduroam project, which bond
With the use of federated identity management, security, most of the above mentioned federations.
usability and efficiency of systems increase. Organisations
have several benefits, for example, the reduce of administrative 2 http://www.renater.fr/
costs, improvement in data quality and security as well as the 3 http://www.gakunin.jp/

simplification of users’ identities management. 4 http://www.canarie.ca/

268
A. Eduroam having the validation digit. Optional data in the first row, there
will be the acronym of the institution, which will separate
Eduroam (education roaming) is a European project devel- document number by a single character fill (<). The figure 3
oped by TERENA [23] that aims to provide network access shows our proposal for the MRZ in an academic card.
for the education community. It allows students, researchers
and staff from partner institutions to obtain Internet access
when visiting other partner institutions by providing the
home-institution credentials [24] [25]. The credentials used
to authenticate the users can be stored in LDAP directories.
Furthermore, each institution have to ensure the credibility of
their users’ credentials. Thus, Eduroam uses a trust relation
between institutions through the federation concept [26].
1) How eduroam works: The eduroam service is based on
the use of international standard Remote Authentication Dial
User Service (RADIUS), published by the Internet Engineering
Task Force (IETF).
The RADIUS servers are responsible for: Fig. 3. MRZ in Academic card

• Receive connection request. Briefly explaining the proposed MRZ, we will have:
• Authenticate users. In the first line:1 to 2: The characters must be IS (Student
Id) or IA (Id Academic) to designate that this is a document
• Returning all configuration information necessary for of identification. 3 to 5: The three-letter code to indicate the
the client to provide connectivity to a user. state of the issuing institution.
• It can act as a proxy client to other authentication 6 to 30: Identification Number and size miscellaneous digit
servers. validator together with Acronym University. The identification
must be separated from the acronym for character fill (<).
The network infrastructure required to provide the service In the second line:1 to 6: Holder’s date of birth in format
uses wireless access points supporting IEEE 802.11 and IEEE YYMMDD. 7: Check digit on date of birth. 8: Sex of holder.
802.11i standard to provide secure access mechanisms [26]. 9 to 14: Date of expiry of the document in format YYMMDD.
15: Check digit on date of expiry. 16 to 18: Nationality of the
V. P ROPOSAL FOR AN U NIFIED ACADEMIC I DENTITY holder represented by a three-letter code. 18 to 29: Optional
C ARD data at the discretion of the institution. 30: Overall, check digit
for upper and middle machine-readable lines.
Our proposal is to bind together these two different ideas of
machine readable documents and federations. To sort out some In the third line1 to 30:Holders name.
of the issues present in the federated environment, such ans
The name consists of primary and secondary identifiers,
the one mentioned at our introduction we plan to adapt the the
which shall be separated by two-filler characters (<<). A
standard from ICAO 9303 to address the specific academic-
single filler character shall separate components within the
federated environment’s needs.
primary or secondary identifiers (<).
A. MRZ in Academic Card When the name of the document holder has only one part,
it shall be placed first in the character positions for primary
As already described, the MRTD uses OCR, thus enabling identifier, filler characters (<) being used to complete the
the document to be read by any machine that follows the stan- remaining character positions of the MRZ.
dard MRTD. Compared with the original MRZ, an amendment
was made in the first row. Originally, the first line contains two B. Inspection Zone in Academic Card
digits for the document type, three for Issuer State, nine for
document number, one to Validation Digits and fifteen digits All data contained in the MRZ, except for validators digits
for optional information. Some of this information is irrelevant are also printed on the document, allowing the visual reading.
in the academic context, while some of the space could be The figure 4 demonstrates how to be ahead of their academic
better used. card.
Beyond OCR, the academic card also has a QR Code,
Our proposal for an MRZ for an academic card is that, the
which will contain all the MRZ data. This will allow uni-
number of digits for the Document Type, and State Issuer, to
versities to develop their own applications to read the QR
be maintained. There will be two types of document Id Student
Code. Thus, universities have the option to avoid increased
(IS) or Id Academic (IA). This will allow the document to be
spending on purchases of passport readers, which have a
assessed by human peer to identify student for their discount
high cost, and are complicated to manage. There are some
rates when provided. In the Positions of Issuer State , we will
Open Source Android Applications for reading and extracting
have the country of the institution that issued the card. This
data from passports, like the aJMRTD 5 and andromex 6 , for
will allow any machine reading to route its connection to the
correct national federation for the electronic assessment of the 5 http://sourceforge.net/projects/ajmrtd/

credential. The document number will variable size, besides 6 https://code.google.com/p/androsmex/

269
Fig. 4. Front

creating passports. With this, each university may change the

application as you like.

Fig. 5. Back
Fig. 6. LDS in academic card

C. LDS in Academic Card

• Identification of degree, department, year of start and
The LDS has fields that can be used for biometric authen- end of the course,
tication such as Encoded Face, Encoded Finger and Encoded
Eyes. Some fields of LDS were changed to match the MRZ • Delegation of authority.
academic card. Where the Issuing State or Organization was
Each institution assumes the responsibility for issuing this
stored, it is now stored the state of the issuing institution. In
certificate, which can be written in the academic card at the
place of the Optional Data we now store the acronym of the
time of creation and securely. In practice, an academic with
institution. The LDS will also include a field for authorization,
the present card would prove his identity and the attribute
which may be stored attributes certificates for access control
certificate, ensure your student bond and any other optional
among other things.
data not standardised by our proposal.
Figure 6 shows how the LDS of Academic Card was
designed. In bold, the differences from the original version. E. Technologies
The academic card will contain the Java Card and Mifare
D. Use of Attribute Certificates
technology.
An attribute certificate (or authorization certificate) is an
1) MIFARE: MIFARE technology is a contactless smart
electronic document that contains a set of attributes that relate
card developed by Phillips in 2006. Consists of a card with
to the holder. Their format and syntax are defined by the X.509
a chip small capacity of memory and an internal antenna that
standard [27], the same standard used for digital certificates.
senses the approach of the reader through the magnetic field
The attribute certificate has no public key. It is digitally
identified by the frequency of the card (RFID). The working
signed by a trusted authority (called the Attribute Certificate
frequency of a MIFARE card is 13.56MHz. MIFARE products
Issuer Entity). It may be used alone or in conjunction with a
comply with the international standard ISO/IEC 14443, which
digital certificate. Thus, the attribute constants in the certificate
is used in more than 80% of all contactless smart cards today
attributes can be changed or even revoked without involving
[28].
the revocation of digital certificates. It is possible use the
attributes certificate to store this on the Authorization Fields. Some examples of using the MIFARE technology in a
Within the academic card, the Attributes Certificates can be Academic Card[29]:
used for many different purposes:
• Physical access to university and student home build-
• Better characterisation of the academic, ings
• Authorisation information, • Access to services such as copy machines

270
 • Micro payment for student restaurants card reader. Thus, the system could, through facial recognition
and the use of the academic card with facial information,
• Logical access to PCs and services execute a continuous authentication. It would compare the
2) Java Card: Java Card technology enables smart cards portrait in the card with the image of the student who is doing
and other devices with very limited memory to run small the course. It would guarantee authentication and exclusive
applications, called applets, that employ Java technology. It dedication to the computer screen. In this way, it is easier to
provides smart card manufacturers with a secure and interop- evaluate the performance of this student.
erable execution platform that can store and update multiple 3) Access to controlled places: The student can also access
applications on a single device. Java Card technology is another controlled places beyond the classroom using the
compatible with existing smart card standards [30]. academic card such as the university restaurant, where the card
Smart card vendors and issuers benefit from several unique could storage its tickets or credits to be used there. Another
features of Java Card technology, which is [30]: idea is using this card to access conferences, events, libraries
and so on.
• Interoperability
4) Digital certificates issuance: Another area of applica-
• Security tion is an automated issuance of certificates using the card.
• Multi-Application-capability This process consists of generating a certificate request by
extracting the user’s credentials from the card. This is possible
• Dynamic because the institution already verified them when he was
registered in the federation. These certificates can be used for
• Compatible with Existing Standards
short-term, as in conferences for access to wireless networks.
It can also be used for more classical applications, as authen-
F. Incremental Deployment tication of students and staff in the various academic systems.
Following this proposal, it is possible that even entities with
limited financial resources can adhere to standard. Following VII. F INAL R EMARKS
the proposal historically laid down by ICAO, the entities will
have three options for issuing the proposed academic card. In this paper we presented a proposal for an academic
They are listed below: card based on ICAO standard contributing to the concept of
federation. Our proposal can authenticate users in an off-line
• Only VIZ: If an entity has limited financial resources, way, allow for biometric authentication and enable human
it can issue the academic card with the Visual Inspec- beings to assess the validity of federated credentials.
tion Zone (VIZ) without the MRZ and LDS, allowing
only visual inspection by humans. In order to show that the idea is feasible, we presented a
detailed study about each field of a document that follows the
• VIZ, MRZ and QR Code: To entities who want ICAO standard, suggesting appropriate modifications to meet
an academic card that can be read by humans and the academic needs. We also presented potential applications
machines. In this scheme a series of validation can to the academic card, as presence control, authentication in
already be imposed in the electronic forms of the Massive Open Online Courses, access to controlled places and
document. digital certificates issuance.
• Full Functionality: To entities that want a fully func- In order to improve our proposal, we are moving towards a
tional card with VIZ, MRZ and LDS, where it can real implementation of this card in the academic environment.
enjoy biometric authentication and the features of the With the deployment of the actual card we will be able to
proposal. assess even more details regarding its usability and feasibility.

VI. A PPLICATIONS IN ACADEMIC ENVIRONMENTS

R EFERENCES
Several applications for standardised academic cards can be
[1] R. Baldoni, “Federated identity management systems in e-government:
listed, as presence control, automated issuance of certificates the case of italy,” EG, vol. 9, no. 1, pp. 64–84, 2012.
and authentication in online courses. [2] Mrtd history. International Civil Aviation Organization. [Online].
1) Attendance control: Is something easy to be applied in Available: http://www.icao.int/Security/mrtd/Pages/MRTDHistory.aspx
an academic environment. The university can use contacless [3] Benefits. ISIC Association. [Online]. Available:
http://www.isic.org/benefits/
readers to control the presence of academics who have a card
[4] O que a carteira mundial do estudante. Carteira Mundial do Estudante.
following the proposal. The student only need to swipe their [Online]. Available: http://www.carteiradoestudante.com.br/saiba-tudo-
card in the reader. The biometry in embedded in the card can carteira-mundial.aspx
be used as a proof of presence signed by the card. [5] About isic. ISIC Association. [Online]. Available:
http://www.isic.org/about-us/
2) Using Academic Cards for authentication in MOOCs:
As shown in Haggard [31] Massive Open Online Courses [6] Carta d’identit elettronica - cie. Ministero Dell’Interno. [Online].
Available: http://www.interno.gov.it/mininterno/site/it/temi/
(MOOCs) is the term that emerged in 2008 for a particular type servizi demografici/scheda 006.html
of open online course format. MOOCs have quickly gained [7] Decreto 8 novembre 2007. Ministero Dell’Interno. [Online]. Available:
popularity, expanded, and evolved. An example of how to use http://www.interno.gov.it/mininterno/site/it/sezioni/servizi/legislazione
for authentication MOOCs would the student have at hand a /enti locali/0997 2007 11 08 Decreto 8 novembre 2007.html

271
 [8] Che fine ha fatto la carta d’identit elettronica? Wired It. [Online]. [31] S. Haggard. (2013) The maturing of the mooc. [Online]. Available:
Available: http://daily.wired.it/news/politica/2011/05/13/carta-identita- https://www.gov.uk/government/uploads/system/uploads/attachment data/
digitale.html file/240193/13-1173-maturing-of-the-mooc.pdf
[9] Neue anwendung fr die online-ausweisfunktion.
Der Neue Personalausweis. [Online]. Available:
http://www.personalausweisportal.de/DE/Home/home node.html
[10] Security and data protection. Der Neue Personalausweis. [Online].
Available: http://www.personalausweisportal.de/EN/Citizens/Security/
security node.html
[11] Features. Der Neue Personalausweis. [Online]. Avail-
able: http://www.personalausweisportal.de/EN/Citizens/The-New-
Identity-Card/Features/Features node.html
[12] Electronic identification with the new german national
identity card. Der Neue Personalausweis. [Online]. Avail-
able: http://www.personalausweisportal.de/EN/Citizens/Electronic-
Identification/Electronic-Identification node.html
[13] The id card. City of Brussels. [Online]. Available:
http://www.brussels.be/artdet.cfm/4827
[14]
[15] (2008) Part 3 - machine readable official travel documents. volume 1 -
mrtds with machine readable data stored in optical character recognition
format. International Civil Aviation Organization. [Online]. Available:
http://www.icao.int/publications/Documents/9303 p3 v1 cons en.pdf
[16] (2008) Part 3 - machine readable official travel doc-
uments. volume 2 - specifications for electronically en-
abled mrtds with biometric identification capability. In-
ternational Civil Aviation Organization. [Online]. Available:
http://www.icao.int/publications/Documents/9303 p3 v2 cons en.pdf
[17] Moreira, E.Q., Everton Didone Foscarini, da Silva Junior, G.C., Alixan-
drina, L.A.O., Neto, L.P.V., Rossetto, S., Federao CAFe Implantao do
Provedor de Identidade. Rede Nacional de Ensino e Pesquisa - RNP.
Rede Nacional de Ensino e Pesquisa, 2011.
[18] About incommon. InCommon. [Online]. Available:
http://www.incommon.org/about.html
[19] About edugate. Edugate. [Online]. Available:
http://www.edugate.ie/content/about-us
[20] About idem. Italian identity federation of universities and research
institutes for authentication and authorization. [Online]. Available:
https://www.idem.garr.it/en/about
[21] About australian access federation. Australian Access Federation.
[Online]. Available: http://aaf.edu.au/about/
[22] The federated academic community. Rede Nacional de Ensino e
Pesquisa. [Online]. Available: http://portal.rnp.br/web/servicos/cafe-en
[23] About terena. Trans-European Research and Education Networking
Association. [Online]. Available: http://www.terena.org/about/
[24] About eduroam. Trans-European Research and Education Networking
Association. [Online]. Available: https://www.eduroam.org/
[25] K. Wierenga and L. Florio, “Eduroam: past, present and future.”
in TNC, O. Martin, R. Barbera, A. Binczewski, D. Chadwick,
T. Hanss, J. Kanner, K. Meynell, J. Nabrzyski, V. Reijs,
D. A. Robertson, K. Wierenga, T. C. Schmidt, A. Sundstrm,
and S. Williams, Eds. TERENA, 2005. [Online]. Available:
http://dblp.uni-trier.de/db/conf/tnc/tnc2005.html
[26] Débora C. Muchaluat Saade, Ricardo Campanha Carrano, Edelberto
Franco Silva, Eduroam: Acesso sem fio seguro para a Comunidade
Acadêmica Federada. Rede Nacional de Ensino e Pesquisa, 2013.
[Online]. Available: http://www.scribd.com/doc/125531184/Eduroam-
Acesso-sem-Fio-Seguro-para-Comunidade-Academica-Federada
[27] Itu-t rec. x.509 iso/iec 9594-8. International Telecom-
munication Union. [Online]. Available: http://www.itu.int/ITU-
T/recommendations/rec.aspx?rec=9590
[28] About mifare. Mifare. [Online]. Available:
http://www.mifare.net/en/aboutmifare/
[29] Applications. Mifare. [Online]. Available:
http://www.mifare.net/en/applications/
[30] About java card technology. Oracle. [Online]. Available:
http://www.oracle.com/technetwork/java/javame/javacard/overview/
about/index.html

272

View publication stats