BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.1.3 PIV Relying Subsystem

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 3 PIV System Overview part of 3.1

Title

PIV Relying Subsystem

Control changed

Before · FIPS 201-2

The PIV relying subsystem includes components responsible for determining a particular PIV cardholder’s access to a physical or logical resource. A physical resource is the secured facility (e.g., building, room, parking garage) that the cardholder wishes to access. The logical resource is typically a network or a location on the network (e.g., computer workstation, folder, file, database record, software program) to which the cardholder wants to gain access.

The authorization data component comprises information that defines the privileges (authorizations) possessed by entities requesting to access a particular logical or physical resource. An example of this is an access control list (ACL) associated with a file on a computer system.

The physical and logical access control system grants or denies access to a particular resource and includes an identification and authentication (I&A) component as well as an authorization component.

17 For more information on the terms “something you know,” ”something you have,” and “something you are,” see [SP 800-63]. 18 Alternatively, on-card biometric comparison can be used to activate the PIV Card. The I&A component interacts with the PIV Card and uses mechanisms discussed in Section 6 to identify and authenticate cardholders. Once authenticated, the I&A component passes information to the authorization component which in turn interacts with the authorization data component to match the cardholder information to the information on record. Access control components typically interface with the card reader, the PIN input device, the biometric reader, supplementary databases, and any certificate status service.

After · FIPS 201-3

The PIV relying subsystem in Figure 3-1 includes components responsible for determining a particular PIV cardholder’s access to a physical or logical resource. 22 A physical resource is the secured facility (e.g., building, room, parking garage) that the cardholder wishes to access. The logical resource is typically a network or a location on the network (e.g., computer workstation, folder, file, database record, software program) to which the cardholder wants to gain access.

The authorizationrelying datasubsystem componentdepends compriseson informationauthorization mechanisms that definesdefine the privileges (authorizations) possessed by entities requesting to access a particular logical or physical resource. An exampleExamples of this isinclude an accessAccess controlControl listList (ACL) associated with a file on a computer system and a secure E-PACS control panel within a facility.

The physicalPIV andrelying logicalsubsystem accessbecomes controlrelevant systemwhen grantsthe PIV Card or deniesderived accessPIV credential is used to authenticate a particularcardholder resourcewho andis includesseeking anaccess identificationto anda authenticationphysical (I&A)or componentlogical asresource. wellAlthough asthis anStandard authorizationdoes component.

17not Forprovide moretechnical informationspecifications onfor thethis termssubsystem, “somethingvarious youmechanisms know,”for ”somethingauthentication youare have,”defined andin “somethingSection you6 are,”for seePIV Cards and in [SP 800-63800-157]. 18for Alternatively,derived on-cardPIV biometriccredentials comparisonto canprovide beconsistent usedand tosecure activatemeans for performing the PIVauthentication Card.function preceding an access control decision.

The I&Arelying componentsubsystem interactsidentifies and authenticates cardholders either by interacting with the PIV Card and usesusing mechanisms discussed in Section 6 toor identifyby andcommunicating authenticatewith cardholders.an OnceIdP authenticated,through thea I&Afederation componentprotocol passesas informationdiscussed toin theSection authorization7. componentOnce whichauthenticated, inauthorization turnmechanisms interactsthat withsupport the authorization data componentrelying tosubsystem matchgrant theor cardholderdeny informationaccess to theresources informationbased on record. Access control componentsthe typicallyprivileges interfaceassigned withto the cardcardholder.

22 reader,The thecardholder PINmay inputauthenticate device,with the biometric reader, supplementaryPIV databases,Card andor anya certificatederived statusPIV servicecredential.