Utah National Guard solution illustrates potential of smartcard market.

In 2004, the White House issued Homeland Security Presidential Directive 12, which set new security standards, including the use of Common Access Card "smart cards" by federal workers who use networked devices. In the years since, the various services within the Defense Department have been among the leaders in adopting CACs for networked PCs.

More recently, security managers are becoming increasingly intent on providing access controls for networked MFPs, scanners, and printers. The Utah Army National Guard is among the DOD's leaders in this area, and its state headquarters now runs four CAC-enabled networked Canon MFPs.

A reader mounted on the side of the units accepts the CACs that every National Guard member is required to use. The CAC solution was developed by eCopy Inc., a vendor of software for capturing paper-based information on MFPs and network scanners and moving the electronic documents into business processes or storage repositories.

"We didn't have lot of problems with the installation," says Sgt. First Class Collin Johnson, chief of administrative services. "eCopy came out and helped set up [the application] Also, the eCopy software offers a lot of flexibility. We have regulations and policies that often need to be updated and changed, and we're able to do that electronically." The CAC solution cost the Utah National Guard about $5,000 per machine.

Broader Application
Although the CAC directive applies directly to the federal government, applications like the Utah National Guard's are pointing the way for security solutions that will become important for the commercial sector. "For enterprises, it's really about the network--the intranet versus the Internet," says Tom Codd, Hewlett-Packard's director of marketing for LaserJet Business. "Solutions are going to be focusing more on how you provide secure capture and retrieval of documents through MFP devices using [smartcard] solutions."

In addition to document previews and other scanning capabilities, eCopy's ShareScan software controls access to printing and imaging devices through user authentications. The company adopted the latter capability to comply with CAC technology now used across the federal government to control access to PCs and other networked devices.

The DOD and others see CACs as a more sophisticated and easier-to-manage alternative to user IDs and passwords. CACs rely on a combination of public and private encryption "keys," software programs that exchange security tokens with a trusted third party to authenticate users on the network. Federal workers also use the personal and medical information held on CACs for some types of government transactions.

"We already had existing customers in the Department of Defense that were in the process of implementing a CAC solution, largely for their PCs. So there's an infrastructure that already exists," says Bill DeStefanis, director of product management for eCopy. "The extension of that was to look at a networked MFP device. It scans, it has to authenticate users, and it touches backend computing resources. So MFPs also need a common access card implementation."

eCopy modified ShareScan to authenticate users with information from the cards and to transmit that information to the trusted third party.

"The infrastructure was in the Department of Defense. The challenge was we didn't have the infrastructure here to replicate the DOD's environment. So we had to do a lot of on site work with various DOD agencies," DeStefanis says. Prototyping to beta testing took about three months, he adds.

Service Offering
Last spring, eCopy introduced a services offering for implementing the CAC solution. Currently, the company has distribution agreements with eight MFP vendors: Canon, HP, Konica Minolta, Lanier, Ricoh, Savin, Sharp, and Toshiba.

"Our software is sold through VARs, and this enables them to have a CAC-enabled solution for their various MFP devices," DeStefanis says. "VAR can work with an authorized reseller of eCopy applications to service that component of the RFP."

Although deployment currently is low for similar types of security smartcards in the private sector, DeStefanis expects the market to grow in the years ahead. "Our software is ready to adapt to those systems as well," he says.