3.1.1 PIV Front-End Subsystem
All changes in this version
Title
PIV Front-End Subsystem
Control changed
Before · FIPS 201-2
The PIV Card will be issued to the applicant when all identity proofing, registration, and issuance processes have been completed. The PIV Card has a credit card-size form factor, with one or more embedded integrated circuit chips (ICC) that provide memory capacity and computational capability. The PIV Card is the primary component of the PIV system. The holder uses the PIV Card for authentication to various physical and logical resources.
Card readers are located at access points for controlled resources where a cardholder may wish to gain access (physical and logical) by using the PIV Card. The reader communicates with the PIV Card to retrieve the appropriate information, located in the card’s memory, to relay it to the access control systems for granting or denying access.
Card writers, which are very similar to the card readers, personalize and initialize the information stored on PIV Cards. Card writers may also be used to perform remote PIV Card updates (see Section 2.9.2). The data to be stored on PIV Cards includes personal information, certificates, cryptographic keys, the PIN, and biometric data, and is discussed in further detail in subsequent sections.
PIN input devices can be used along with card readers when a higher level of authentication assurance is required. The cardholder presenting the PIV Card must type in his or her PIN into the PIN input device. For physical access, the PIN is typically entered using a PIN pad device; a keyboard is generally used for logical access. The input of a PIN provides a “something you know” 17 authentication factor that activates 18 the PIV Card and enables access to other credentials resident on the card that provide additional factors of authentication. A cryptographic key and certificate, for example, provides an additional authentication factor of “something you have” (i.e., the card) through PKI-based authentication.
Biometric readers may be located at secure locations where a cardholder may want to gain access. These readers depend upon the use of biometric data of the cardholder, stored in the memory of the card, and its comparison with a real-time biometric sample. The use of biometrics provides an additional factor of authentication (“something you are”) in addition to entering the PIN (“something you know”) and providing the card (“something you have”) for cryptographic key-based authentication. This provides for a higher level of authentication assurance.
After · FIPS 201-3
The PIV CardFront-End willSubsystem bein issuedFigure to3-1 theconsists applicantof whencredentials alland identitydevices proofing,that registration,are used during authentication and, issuanceas processesdescribed havein beenSection completed3.1.2, for PIV issuance and management. The PIV Card has atakes creditthe card-sizephysical form factorof the [ISO 7816] ID-1 card type (i.e., traditional payment card) with one or more embedded integratedIntegrated circuitCircuit chipsChips (ICC) that provide memory capacity and computational capability. The PIV Card is the primary component of the PIV system. The holdercardholder uses the PIV Card for authentication to access various physical and logical resources.Card readers are located at accessAdditionally, pointsderived forPIV controlledcredentials resourcesincreasingly whereplay aan cardholderimportant mayrole wishas tosupplemental gainauthenticators, accessespecially (physicalin andenvironments logical)where byuse usingof the PIV Card. The readeris communicatesnot witheasily thesupported. PIVThese CardAAL2 toand retrieveAAL3 theauthenticators appropriateare information,not locatedembedded in the card’sPIV memory,Card tobut, relayrather, itare tostand-alone theor accessintegrated controlin systemsa forvariety grantingof ordevices denyingand accessplatforms.
Cardwriters,Card whichreaders are very similar to the card readers,located personalizeat andaccess initializepoints thefor informationcontrolled storedresources onto PIVallow Cards.a Cardcardholder writersto maygain alsophysical beor usedlogical toaccess performusing remotethe PIV Card updates (see Section 2.9.2). The data toreader becommunicates storedwith ona PIV Cards includesCard personalto information,perform certificates,the cryptographicauthentication keys,protocol theand PIN,relay andthat biometricinformation data,to andthe isaccess discussedcontrol insystems furtherfor detailgranting inor subsequentdenying sectionsaccess.
PIN input devices can be used along with card readers when a higher level of authentication assurance is required. The cardholder presenting the PIV Card must type in his ortypes hertheir PIN into the PIN input device. For physical access, the PIN is typically entered using a PIN pad device; a keyboard is generally used for logical access. The input of a PIN provides a “something you know” 1720 authentication factor that activates 1821 the PIV Card and enables access to other credentials resident on the card that provide additional factors of authentication. A cryptographic key and certificate, for example, providesprovide an additional authentication factor of “something you have” (i.e., the card) through PKI-basedPKI- based authentication.
Biometric readerscapture devices may be located at secure locations where a cardholder may want to gain access. These readersdevices depend upon the use of the biometric data of the cardholder, stored in the memory of the card, and its comparison with a real-time captured biometric sample. The use of biometricsbiometric characteristics provides an additional factor of authentication (“something you are”) in addition to entering the PIN (“something you know”) and providing the card (“something you have”) for cryptographic key-based authentication. This provides for a higher level of authentication assurance.