The security of mass transport ticketing systems

Abstract

Mass transport ticketing systems in most developed countries are making a rapid transition from 'traditional' paper or carton-based ticketing systems towards a con tactless 'smart card' based approach. This article discusses the main IT security aspects of mass transport ticketing systems (metro, bus, etc). We introduce the standards that emerged over the years, and we outline the core functionality of the IT aspects of a mass transport ticketing system. We discuss some examples, and subsequently we address security and anti-fraud aspects. We also put some security breaches related to the use of the Philips/NXP Mifare family in perspective. We describe an alternative approach such as proposed by Calypso, and formulate conclusions and lessons learnt. © 2009 Vieweg+Teubner | GWV Fachverlage GmbH, Wiesbaden.