3.1 Functional Components
All changes in this version
Title
Functional Components
Control changed
Before · FIPS 201-2
An operational PIV system can be logically divided into the following three major subsystems:
• PIV Front-End Subsystem —PIV Card, card and biometric readers, and PIN input device. The PIV cardholder interacts with these components to gain physical or logical access to the desired Federal resource.
• PIV Card Issuance and Management Subsystem —the components responsible for identity proofing and registration, card and key issuance and management, and the various repositories and services (e.g., public key infrastructure (PKI) directory, certificate status servers) required as part of the verification infrastructure.
• PIV Relying Subsystem —the physical and logical access control systems, the protected resources, and the authorization data.
The PIV relying subsystem becomes relevant when the PIV Card is used to authenticate a cardholder who is seeking access to a physical or logical resource. Although this Standard does not provide technical specifications for this subsystem, various mechanisms for identification and authentication are defined in Section 6 to provide consistent and secure means for performing the authentication function preceding an access control decision.
Figure 3-1 illustrates a notional model for the operational PIV system, identifying the various system components and the direction of data flow between these components. The boundary shown in the figure is not meant to preclude FIPS 201 requirements on systems outside these boundaries. Key Management Card Issuance & Maintenance Identity Proofing & Registration Authorization Data
PIV Front-End Subsystem PIV Card Issuance and Management Subsystem PIV Relying Subsystem
PIV Cardholder Authorization Data PKI Directory & Certificate Status Responder
PIV Card I&A Authorization Logical Access Control Physical Access Control
Card Reader / Writer
PIN Input Device Biometric Reader Physical Resource
Logical Resource
LEGEND I&A Authorization
I&A - Identification & Authentication
Direction of Information Flow
PIV Card Issuance and Management Subsystem PIV Relying Subsystem Processes
Components Shapes
Shading
PIV Front-End Subsystem
Figure 3-1. PIV System Notional Model
After · FIPS 201-3
An operational PIV system can be logically divided into the following three major subsystems:• PIV Front-End Subsystem —The PIV Card, card andreaders, biometric readerscapture devices, and PIN input devicedevices, as well as any derived PIV credentials used by the PIV cardholder. The PIV cardholder interacts with these components to gain physical or logical access to the desired Federalfederal resource.• PIV Card Issuance and Management Subsystem —theThe components responsible for identity proofing and registration, card and key issuance and management, and the various repositories and services (e.g.,required publicas keypart of the verification infrastructure, such as Public Key Infrastructure (PKI) directory,directories and certificate status servers). requiredThis assubsystem partalso ofmanages the verificationbinding, infrastructureissuance, and termination of derived PIV credentials as described in Section 2.10.• PIV Relying Subsystem —theThe physical and logical access control systems, the protected resources, and the authorization data.
ThePIV relying subsystem becomesWhen relevantdiscussed whenin the PIV Card is used to authenticate a cardholder who is seekingcontext accessof toanother aexternal physicalsystem or logical resource. Although this Standardprocess, doesthe notrelying providesubsystem technicalis specificationssometimes foralso thisreferred subsystem,to variousas mechanismsthe forrelying identificationsystem; andthese authenticationterms are defined inequivalent Sectionwithin 6this tospecification. providePIV consistentIssuance and secureManagement meansSubsystem
• forCard performingReader
• theBiometric authenticationCapture
• functionPIN precedingInput anRegistration accessand controlIssuance decision.ActivitiesFigure 3-1• illustratesIdentity aProofing
• notionalBiometric modelEnrollment
• forCredential theIssuance/Binding
• operationalMaintenance IDMS
PIV system, identifyingIdentity theAccount
• variousIdentity systemAttributes
• componentsPIV andCredentials
• theDerived directionPIV ofCredentials
PIV dataFront-End flowSubsystem
• betweenPIV theseCard
• components.Derived ThePIV boundaryCredentials shownPIV inRelying theSubsystem
Logical figureAccess
• isWebsite
• notComputer
• meantMobile toDevice
Physical precludeAccess
• FIPSAccess 201Point
• requirementsFacility onGate systems****** outsideReaders/Input theseDevices boundaries.Public Key Management Card Issuance & Maintenance Identity Proofing & Registration Authorization DataInfrastructurePIV• Front-EndCertification SubsystemAuthority
• PIVRegistration CardAuthority
• IssuanceCertificate andStatus ManagementResponder
Figure Subsystem3-1. PIV RelyingSystem SubsystemOverviewPIVFigure Cardholder3-1 Authorizationillustrates Dataa PKInotional Directorymodel &for Certificatethe Statusoperational ResponderPIV Card I&A Authorizationsystem, Logicalidentifying Accessthe Controlvarious Physicalsystem Accesscomponents. ControlThe
CardReaderboundary /shown Writerin
PINInputthe Devicefigure Biometricis Readernot Physicalmeant Resourceto
LogicalResourcepreclude
LEGENDI&AFIPS Authorization201
I&A-requirements Identificationon &systems Authenticationoutside of
DirectionInformation Flowthese
PIVCardboundaries. IssuanceSee andSection Management3.3 Subsystemfor PIVinformation Relyingabout Subsystemdata Processesflow
ComponentsShapesand
Shading
PIVFront-Endconnections Subsystembetween
Figure3-1components. PIV System Notional Model