3.1.2 PIV Issuance and Management Subsystem (was: PIV Card Issuance and Management Subsystem)
All changes in this version
Title changed
Before · FIPS 201-2
PIV Card Issuance and Management Subsystem
After · FIPS 201-3
PIV Card Issuance and Management Subsystem
Control changed
Before · FIPS 201-2
The identity proofing and registration component in Figure 3-1 refers to the process of collecting, storing, and maintaining all information and documentation that is required for verifying and assuring the applicant’s identity. Various types of information are collected from the applicant at the time of registration.
The card issuance and maintenance component deals with the personalization of the physical (visual surface) and logical (contents of the ICC) aspects of the card at the time of issuance and maintenance thereafter. This includes printing photographs, names, and other information on the card and loading the relevant card applications, biometrics, and other data.
The key management component is responsible for the generation of key pairs, the issuance and distribution of digital certificates containing the public keys of the cardholder, and management and dissemination of certificate status information. The key management component is used throughout the lifecycle of PIV Cards—from generation and loading of authentication keys and PKI credentials, to usage of these keys for secure operations, to eventual reissuance or termination of the card. The key management component is also responsible for the provisioning of publicly accessible repositories and services (such as PKI directories and certificate status responders) that provide information to the requesting application about the status of the PKI credentials.
After · FIPS 201-3
The identity proofingregistration and registrationissuance componentactivities in Figure 3-1 refers tostart thewith processidentity ofproofing collecting,and storingregistration, andduring maintainingwhich all information and documentation thatrequired for enrollment are collected, stored, and maintained. The collected information is requiredsubsequently forused verifyingto personalize and assuringissue the applicant’sPIV identity.Card, Variousas typeswell ofas informationto arebind collectedand fromissue thederived applicantPIV atcredentials theas timeadditional ofPIV registrationauthenticators.
The cardPIV Card is issued to the applicant when all identity proofing, registration, and issuance processes have been completed. Derived PIV credentials might also be bound, issued, and maintenancemanaged componentafter dealsthese withprocesses are complete.
The PIV Card issuance process focuses on the personalization of the physical (visual surface) and logical (contents of the ICC) aspects of the card at the time of issuance and maintenance thereafter. This includes printing photographs, names, and other information on the card and loading the relevant card applications, biometricsbiometric data, and other data.TheCard keywriters, managementwhich componentare issimilar responsibleto forcard readers, personalize and initialize the generationinformation ofstored keyon pairsPIV Cards. Card writers may also be used to perform remote PIV Card updates (see Section 2.9.2). The data to be stored on PIV Cards includes cardholder information,
20 For more information on the issuanceterms “som ething you know,” “something you have,” and distribution“something ofyou digitalare,” certificatessee containing[SP 800-63]. 21 Alternatively, a biometric on-card one-to-one comparison can be used to activate the publicPIV keysCard. ofcertificates, cryptographic keys, the cardholderPIN, and managementbiometric anddata. disseminationBiometric capture devices are also part of certificatethe statusidentity information.proofing and registration process that support the PIV Issuance and Management Subsystem.
The keyPKI managementcomponent provides services for PKI-based PIV credentials. This component is used throughout the lifecycle of PIV Cards and PKI-based derived PIV credentials—from generation and loading of authenticationasymmetric keys and PKI credentials, to usage of these keys for secure operations, to eventual reissuance or termination of the cardPIV Card and associated PKI-based derived PIV credentials. TheAt keythe managementpersonalization phase, the PKI component isissues alsoand responsibledistributes the digital certificates for the provisioningkeys ofgenerated publiclyon-card accessibleand repositorieskeys andgenerated servicesfor (suchPKI-based asderived PIV credentials. During use of the PIV credentials at authentication, the PKI directoriescomponent andprovides the requesting application with the certificate status respondersinformation of the PKI credentials requesting access.
The enterprise IDMS serves as the central repository for the cardholder’s digital identities. It is where the relevant cardholder identity attributes are maintained. The IDMS creates the PIV identity account and associates the cardholder’s PIV Card and derived PIV credentials with the account. The account is maintained throughout the cardholder’s employment with the department or agency. Various Identity, Credential, and Access Management (ICAM)-related thatsystems connect to the IDMS to request or update cardholder attributes. For example:
• A security office may provide updated background investigative information to the requestingIDMS.
• applicationAn aboutHR thesystem may relay hiring status updates.
• The IDMS may serve as the Identity Provider (IdP), authenticating the cardholder on behalf of a Relying Party (RP) and issuing assertions of attributes relating to the PKIPIV identity account to the RP.
Different functions of the IDMS might be provided by different components within the department or agency, or outsourced to a shared service provider. For example, card management functions and recordkeeping may be provided by a different component from the component handling HR records or the component serving as an IdP. Regardless of how these components are implemented, they are collectively responsible for managing the identities of federal employees and contractors who are issued PIV credentials. It is ultimately the responsibility of the issuing department or agency to ensure that the relevant identity attributes, credentials, and records stored across these components are maintained properly and in a timely manner, preferably using technical means and automation whenever possible.