Smart cards reshuffled

Smart cards are moving closer and closer to the day when no one can leave home without one.

GemPlus, the world's largest manufacturer of the credit-card sized devices with an embedded computer chip, yesterday became the second licensee of the Java Card application programming interface from the JavaSoft unit of Sun Microsystems.

The announcement is a major boost for efforts to consolidate the fragmented smart card market around common standards and could speed the day when smart cards come into everyday use in the United States.

GemPlus and Schlumberger, which licensed the Java Card APIs shortly after they were unveiled in October, also announced they will move to a common operating system based on the Java Card API. This is another important step towards making smart cards interoperable.

Smart cards have been hampered by lack of a common standard; as many as 30 smart card schemes have sprung up from different vendors, but for most of them a card from one company won't work with the readers from another.

The two giant manufacturers, which make 70 percent of the world's smart cards, also formed the Java Card Forum, which would promote the Java Card programming interface and share technical information among manufacturers, users, and software vendors.

"You've gained maybe two years of time to bring products to market," said Rod Kuckro, editor in chief of the Report on Smart Cards newsletter, adding that a common operating system had been expected but its timing uncertain. "This is more than a smart card story. This is about accelerating the change of how people are going to conduct basic commerce in this country, both online and in person."

Jupiter Communications analyst Scott Smith said that smart cards are becoming more attractive as consumers become more familiar with other forms of electronic commerce. "Smart cards can provide a bridge between offline and online use," he said, such as moving data, monetary value, or cryptographic keys from an Internet application to a handheld device like an electronic wallet.

"Even competing entities agree that where new technologies are concerned, industrywide efforts are required to bring workable infrastructures and to develop compatible, interoperable, multiuse systems," GemPlus and Schlumberger said in a statement. "This cannot be accomplished on any meaningful scale by individual players acting alone."

Added Kuckro: "People don't care if the standard is Java or anything else as long as one company's card works in another company's card reader."

JavaSoft lauded the Java Card Forum as a body to exchange technical information but bridled at the suggestion that the user organization would have a formal role in how the Java API evolves in future versions.

"JavaSoft doesn't need the Forum to get on with the evolution of the Java Card API," said JavaSoft's David Spenhoff, director of product marketing. "The evolution of the Java Card API is separate from the Java Card Forum." JavaSoft will continue to consult individually with licensees and smart card vendors.

But Tom Lebsack, director of marketing and business development for Schlumberger Smart Cards & Systems, North America, sees a role for the Java Card Forum in standardizing on the Java Card API and influencing future versions of the API.

"JavaSoft needs to work with people in the [smart card] industry to standardize," said Lebsack. "Schlumberger and GemPlus, the largest two companies, are saying, 'Here's the club, the group that's going to move the specification along to standardize it.'"

Kuckro thinks the Java Card Forum will, by default, do standards. "It is, in effect, the only standard body that exists today." JavaSoft's resistance to that notion appears to be based on its desire to own the standard.

"It's still JavaSoft's call," Lebsack said, "but I'm sure they will include what the Java Card Forum comes up with."

The Java Card programming interface is an early Sun effort to get other devices to use Java, a compact programming language deemed suitable for low-memory devices. A full specification of how to use Java in network computers exists, and Sun is working with manufacturers of smart telephones, TV set-top boxes, and handheld devices like PDAs (personal digital assistants). But smart cards are the only device other than NCs with a specific Java interface.

Lebsack said Java's initial impact will be in more costly multiuse smart cards, rather than the disposable cards now being used for prepaid long distance service in some parts of the United States. Multiuse cards can be reprogrammed or used for more than one application.

"This opens up [the capability] to be able to load applications in the field and to update applications," said Lebsack. "So if an issuer wanted to add an additional feature, they could do it after the card was issued," something difficult to do today.

The Java API will reduce the time to move an application from one manufacturer's smart card to another from 9 to 12 months down to 3, he predicted. Lebsack also thinks the manufacturers will move quickly.

"I would suggest we have to have products out the door, multiapplication cards, within one year," he added, saying he expects work on the next Java Card API spec to begin by midyear. "That's our intention. The industry can't afford to have all the proprietary systems out there."