View source for Card reader

{{Short description|Data input device}}
{{about|the data input device|the fortune-telling or divination using a deck of cards|Cartomancy}}
{{Refimprove|date=October 2010}}
A '''card reader''' is a data [[input device]] that reads data from a card-shaped [[Storage medium#Recording medium|storage medium]] and provides the data to a computer. Card readers can acquire data from a card via a number of methods, including: [[optical reader|optical scanning]] of printed text or [[barcodes]] or holes on [[punched card]]s, electrical signals from connections made or interrupted by a card's punched holes or embedded circuitry, or electronic devices that can read [[plastic card]]s embedded with either a [[Magnetic stripe card|magnetic strip]], [[Integrated circuit|computer chip]], [[Radio-frequency identification|RFID]] chip, or another storage medium.

Card readers are used for applications including [[Identity document|identification]], [[access control]] and [[bank card|banking]], [[data storage]], and [[data processing]].

== Mechanisms ==
=== Magnetic card readers ===
{{see also|Magnetic stripe card}}
Magnetic stripe technology, usually called mag-stripe, is so named because of the stripe of magnetic oxide tape that is laminated on a card.  There are three tracks of data on the magnetic stripe.  Typically the data on each of the tracks follows a specific encoding standard, but it is possible to encode any format on any track.  A mag-stripe card is cheap compared to other card technologies and is easy to program.  The magnetic stripe holds more data than a barcode can in the same space.  While a mag-stripe is more difficult to generate than a bar code, the technology for reading and encoding data on a mag-stripe is widespread and easy to acquire.  Magnetic stripe technology is also susceptible to misreads, card wear, and data corruption. These cards are also susceptible to some forms of skimming where external devices are placed over the reader to intercept the data read.{{citation needed|date=January 2024}}

=== Smart card readers ===
Smart card readers use an electrical current to read data from embedded circuitry or magnetic features in a card. A contact smart card must physically touch contacts on a reader to connect a circuit between them. A contactless smart card uses radio waves or a magnetic field to transmit information to a reader remotely (though most readers have a range of {{convert|20|in|cm|abbr=on}} or less).{{citation needed|date=January 2024}}

==== Contact smart card readers ====
{{See also|Smart card|EMV}}
[[Image:Gnome-dev-smartcard.svg|120px|right|thumb|Smart card reader]]
A contact smart card reader is an electronic device that physically connects to an integrated circuit in a [[smart card]], supplies the circuit in the card with electricity, and uses [[communications protocol]]s to read data from the card. Smart card readers used for banking or identification may be connected to a keyboard to allow verification with a [[personal identification number]] (PIN).  

{| class="wikitable"
|+Communication protocols
!Name
!Description
|-
|T=0
|Asynchronous half-duplex byte-level transmission protocol, defined in [[ISO/IEC 7816]]-3
|-
|T=1
|Asynchronous half-duplex block-level transmission protocol, defined in ISO/IEC 7816-3.
|-
|T=2
|Reserved for future use.
|-
|T=3
|Reserved for future use.
|-
|Contactless
|APDU transmission via contactless interface [[ISO/IEC 14443]].
|}
If the card does not use any standard transmission protocol, but uses a custom/[[Proprietary software|proprietary]] protocol, it has the communication protocol designation T=14.<ref>[http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=38770 ISO/IEC 7816-3:2006 ''Identification cards &mdash; Integrated circuit cards &mdash; Part 3: Cards with contacts &mdash; Electrical interface and transmission protocols''], clause 8.2.3</ref>

The latest{{which|which version?|date=April 2011}} [[PC/SC]] [[CCID (protocol)|CCID]] specifications define a new smart card [[Software framework|framework]]. This framework works with [[Universal Serial Bus|USB]] devices with the specific device class <code>0x0B</code>. Readers with this class do not need [[device driver]]s when used with PC/SC-compliant operating systems, because the [[operating system]] supplies the driver by default.{{Citation needed|date=April 2011}}

[[PKCS11|PKCS#11]] is an [[Application programming interface|API]] designed to be [[Computing platform|platform]]-independent, defining a generic [[Interface (computing)|interface]] to [[Cryptographic#Modern cryptography|cryptographic]] tokens such as smart cards. This allows [[Application software|applications]] to work without knowledge of the reader details.

Smartcard readers have been targeted successfully by criminals in what is termed a [[supply chain attack]], in which the readers are tampered with during manufacture or in the supply chain before delivery.  The rogue devices capture customers' card details before transmitting them to criminals.<ref>{{cite news|author=Henry Samuel|title=Chip and pin scam 'has netted millions from British shoppers'|url=https://www.telegraph.co.uk/news/newstopics/politics/lawandorder/3173346/Chip-and-pin-scam-has-netted-millions-from-British-shoppers.html|archive-url=https://web.archive.org/web/20081011200604/http://www.telegraph.co.uk/news/newstopics/politics/lawandorder/3173346/Chip-and-pin-scam-has-netted-millions-from-British-shoppers.html|url-status=dead|archive-date=2008-10-11|access-date=2008-10-13|date=2008-10-10|work=[[The Daily Telegraph|The Telegraph]]}}</ref>

==== Contactless smart card readers ====
A contactless smart card uses high frequency radio waves (13.56&nbsp;MHz instead of 125&nbsp;kHz), which allows the transfer of more data, and communication with several cards at the same time. A contactless card does not have to touch the reader or even be taken out of a wallet or purse.<!--this is a serious security consideration, conveniently glossed over here--> Most access control systems only read serial numbers of contactless smart cards and do not utilize the available memory. Card memory may be used for storing biometric data (i.e. fingerprint template) of a user. In such case a biometric reader first reads the template on the card and then compares it to the finger (hand, eye, etc.) presented by the user. In this way biometric data of users does not have to be distributed and stored in the memory of controllers or readers, which simplifies the system and reduces memory requirements.{{citation needed|date=January 2024}}<!-- retained from previous version of the article, as there is some useful information here, but it needs citations and better organiziation. -->

===== RFID card readers =====
{{Main|Radio-frequency identification#Readers}}
[[File:RFkey.jpg|thumb|Electronic key for RFID based lock system]]
{{See also|Contactless smart card|RFID}}

===== Proximity card readers =====
{{Infobox media
| name = Access control
| image = KeyPadReader.jpg
| caption = Proximity reader with keypad
| use = access control
| owner = 
| extended from =
| extended to =
}}
A  reader radiates a 1" to 20" electrical field around itself. Cards use a simple [[LC circuit]]. When a card is presented to the reader, the reader's electrical field excites a coil in the card. The coil charges a [[capacitor]] and in turn powers an [[integrated circuit]]. The integrated circuit outputs the card number to the coil, which transmits it to the reader.

A common proximity format is 26-bit Wiegand. This format uses a facility code, sometimes also called a site code. The facility code is a unique number common to all of the cards in a particular set. The idea is that an organization will have their own facility code and a set of numbered cards incrementing from 1. Another organization has a different facility code and their card set also increments from 1. Thus different organizations can have card sets with the same card numbers but since the facility codes differ, the cards only work at one organization. This idea worked early in the technology, but as there is no governing body controlling card numbers, different manufacturers can supply cards with identical facility codes and identical card numbers to different organizations. Thus there may be duplicate cards that allow access to multiple facilities in one area. To counteract this problem some manufacturers have created formats beyond 26-bit Wiegand that they control and issue to organizations.

In the 26-bit Wiegand format, bit 1 is an even parity bit. Bits 2–9 are a facility code. Bits 10–25 are the card number. Bit 26 is an odd parity bit. 1/8/16/1. Other formats have a similar structure of a leading facility code followed by the card number and including parity bits for error checking, such as the 1/12/12/1 format used by some American access control companies.

1/8/16/1 gives as facility code limit of 255 and 65535 card number

1/12/12/1 gives a facility code limit of 4095 and 4095 card number.

Wiegand was also stretched to 34 bits, 56 bits and many others.

===== Wiegand card readers =====
<!-- Was this first developed by the [[Cardkey]] company? -->
[[Wiegand effect|Wiegand]] card technology is a patented technology using embedded [[ferromagnetic]] wires strategically positioned to create a unique pattern that generates the identification number. Like [[magnetic stripe]] or [[barcode]] technology, this card must be swiped through a reader to be read. Unlike the other technologies, the identification media is embedded in the card and not susceptible to wear. This technology once gained popularity because it is difficult to duplicate, creating a high perception of security. This technology is being replaced by proximity cards, however, because of the limited source of supply, the relatively better [[tamper resistance]] of proximity readers, and the convenience of the touch-less functionality in proximity readers.

Proximity card readers are still referred to as "Wiegand output readers", but no longer use the Wiegand effect. Proximity technology retains the [[Wiegand interface|Wiegand upstream data]] so that the new readers are compatible with old systems.{{citation needed|date=January 2024}}

=== Memory card readers ===
{{Main|Memory card reader}}
[[Image:SanDisk-memory-card-reader.jpg|thumb|right|A USB card reader like this one will typically use the [[USB mass storage device class]].]]
A [[memory card reader]] is a device for accessing the data on a [[memory card]] such as a [[CompactFlash]] (CF), [[Secure Digital card|Secure Digital]] (SD) or [[MultiMediaCard]] (MMC). Most card readers also offer write capability, and together with the card, this can function as a [[pen drive]]. Memory card readers can be built in to laptop computers or computer peripherals, or use a [[Universal Serial Bus|USB]] interface to transfer data to and from a computer.

=== Punched card readers ===
{{main|Punched card input/output}}
==== The Jacquard machine ====
The earliest example of a punched card reader, the [[Jacquard machine]], physically pressed [[punched cards]] against rows of mechanical control rods to convert the data on the cards into physical positions of the loom's hooks. A hole in the card would allow the rod to pass through and remain unmoved; if there was no hole the rod would be pushed, moving its hook out of position.
==== Electrical punched card readers ====
Beginning with the [[Tabulating machine]] in 1890, data was read from punched cards by detecting whether a hole in the card allowed an electrical circuit to connect or an unpunched section of card interrupted that circuit.
[[File:Blue-punch-card-front-horiz.png|thumb|An IBM 80-column punched card of the type most widely used in the 20th century]]
The earliest punched card readers used pins that would dip into tiny cups of mercury when passing through a punched hole, completing an electrical circuit; in the late 1920s, IBM developed card readers that used metal brushes to make electrical contact with a roller wherever a hole passed between them.<ref>{{cite web |title=Early Punched Card Equipment, 1880 - 1951 |url=https://ethw.org/Early_Punched_Card_Equipment,_1880_-_1951 |website=Engineering and Technology History Wiki |date=9 January 2015 |access-date=25 January 2024}}</ref>

==== Optical punched card readers ====
By 1965, punched cards were read using [[photoelectric]] sensors. The [[IBM 2501]] is an example of an early optical punched card reader.

A photoelectric punched card reader patent was issued in 1971.<ref>{{cite patent
| country	= US
| number	= US3553435A
| inventor	= James L Pike
| title		= Photoelectric punched card and document reader
| gdate	    = 1971
| url		= https://patents.google.com/patent/US3553435A/en
}}</ref>

=== Other optical card readers ===
==== Business card text scanners ====
A business card reader is a portable [[image scanner]] device or [[mobile app]] that uses [[optical character recognition]] to detect specific data fields on a [[business card]] and store that data in a contact database or 'electronic [[rolodex]]'. <ref>{{cite web |title=Reading Business Cards |url=https://how-ocr-works.com/BCR/BCR.html |website=How OCR Works |access-date=25 January 2024}}</ref>

==== Barcode readers ====
{{main|Barcode reader}}
Simple data, such as an ID number, name, or address, can be encoded onto a card with a [[barcode]] and read from the card with an optical [[barcode reader]].

[[File:ZA Smart ID Reverse.png|thumb|upright|The reverse of a South African Smart ID card, which uses both 1D and 2D barcodes]]

== Uses ==
=== Identification and access control ===
Card readers are often used to read identification cards for the purposes of physical or electronic [[access control]] or to read data from an [[Identity document|identity card]].

[[Access control]] card readers are used in [[physical security]] systems to read a [[credential]] that allows physical access through access control points, typically a locked door. They can also be used in [[information security]] systems to control access to data. An access control reader can be a [[magnetic stripe]] reader,  a [[bar code]] reader, a proximity reader, or a [[smart card]] reader.

{{Infobox media
| name = IP access control
| image = [[Image:BioEntryPlus.jpg|180px]]
| caption = IP fingerprint reader
| type = [[Internet Protocol]]
| capacity = 10000 templates
| use = fingerprint identification, access control
}}
Readers may compare the data collected from the card, or data stored in the reader, to a [[biometric]] identification: [[fingerprint reader|fingerprint]], [[hand geometry]], [[iris recognition|iris]], Voice Recognition, and [[Facial recognition system|facial recognition]].{{Citation needed|date=April 2011}}<!-- this conveniently glosses over the new problems biometrics introduce, like damaged fingerprints (and before that a 20% failure rate in reading) and then the inability to recover from successful forgery. fingerprint forgery is amazingly easy. See http://cryptome.org/gummy.htm and refs there-->

A card reader with a biometric system compares the [[Template (file format)|template]] stored in memory to the scan obtained during the process of identification. If there is a high enough degree of [[probability]] that the template in the memory is compatible with the live scan (the scan belongs to the authorized person), the ID number of that person is sent to a [[Control panel (computer)|control panel]]. The control panel then checks the permission level of the user and determines whether access should be allowed. The communication between the reader and the control panel is usually transmitted using the industry standard [[Wiegand interface]]. The only exception is the intelligent biometric reader, which does not require any panels and directly controls all [[Door furniture|door hardware]].

Biometric templates may be stored in the memory of readers, limiting the number of users by the reader memory size (there are reader models that have been manufactured with a storage capacity of up to 50,000 templates). User templates may also be stored in the memory of the smart card, thereby removing all limits to the number of system users (finger-only identification is not possible with this technology), or a central [[Server (computing)|server]] PC can act as the template host. For systems where a central server is employed, known as "server-based [[Authentication|verification]]", readers first read the biometric data of the user and then forward it to the main computer for [[Process (computing)|processing]]. Server-based systems support a large number of users but are dependent on the reliability of the central server, as well as [[Telecommunication|communication lines]].

1-to-1 and 1-to-many are the two possible modes of operation of a biometric reader:
* In the 1-to-1 mode a user must first either present an ID card or enter a PIN. The reader then looks up the template of the corresponding user in the database and compares it with the live scan. The 1-to-1 method is considered more secure and is generally faster as the reader needs to perform only one comparison. Most 1-to-1 biometric readers are "dual-technology" readers: they either have a built-in proximity, smart card or keypad reader, or they have an input for connecting an external card reader.
* In the 1-to-many mode a user presents biometric data such as a fingerprint or retina scan and the reader then compares the live scan to all the templates stored in the memory. This method is preferred by most end-users, because it eliminates the need to carry ID cards or use PINs. On the other hand, this method is slower, because the reader may have to perform thousands of comparison operations until it finds the match. An important technical characteristic of a 1-to-many reader is the number of comparisons that can be performed in one second, which is considered the maximum time that users can wait at a door without noticing a delay. Currently most 1-to-many readers are capable of performing 2,000–3,000 matching operations per second.

=== Banking ===
{{main|Chip Authentication Program}}
[[Image:Barclays Pinsentry 5920.jpg|right|thumb|150px|The [[Barclays]] PINsentry [[Chip Authentication Program]] device]]

Some banks have issued hand-held smartcard readers to their customers to support different electronic payment applications:

* [[Chip Authentication Program]] (CAP) uses [[EMV]] banking cards to authenticate online transactions as a [[phishing]] countermeasure.
* [[Geldkarte]] is a German [[electronic purse]] scheme where card readers are used to allow the card holder to verify the amount of money stored on the card and the details of the last few transactions.

=== Data tabulation ===
{{main|Unit record equipment}}

Throughout the 20th century, punched card readers were used to tabulate and process data including census data, financial data, and government contracts.<ref>{{cite web |title=The IBM punched card |url=https://www.ibm.com/history/punched-card |website=IBM Heritage |access-date=25 January 2024}}</ref> [[Voting_machine#Punched_card_voting|Punched card voting]] was widely used in the United States from 1965 until it was effectively banned by the [[Help America Vote Act]] of 2002.

== See also ==
* [[Access control]]
* [[Credential]]
* [[Iris recognition]]
* [[Jacquard machine]]
* [[Glossary of computer hardware terms]]
* [[Memory card]]
* [[Physical security]]
* [[Punched card]]
* [[Punched card input/output]]
* [[Tabulating machine]]
* [[Unit record equipment]]

== References ==
{{Commons category|Card readers}}
{{Reflist}}

{{Memory Cards}}

{{DEFAULTSORT:Card Reader}}
[[Category:Computer storage devices]]
[[Category:Smart cards]]
[[Category:Solid-state computer storage media]]
[[Category:USB]]