3.3 Connections Between System Components

Before · FIPS 201-2

After · FIPS 201-3

Connections Between System Components

Before · FIPS 201-2

After · FIPS 201-3

To perform authentication for logical or physical access using a PIV Card or a derived PIV credential directly, the credential is verified and attributes from the PIV identity account are provided to the relying subsystem. The connections and data flows between these components are shown in Figure 3-3.

While it is possible to directly accept a PIV Card issued by another agency, the recommended interoperability mechanism for most agencies is to use a federation protocol, as discussed in Section 7. In this method, the PIV cardholder authenticates to their IdP, which is part of the PIV Issuance and Management Subsystem, using their PIV Card or derived PIV credential. The IdP verifies the credential and determines the attributes associated with the PIV identity account. The IdP then creates an assertion that is sent to the relying subsystem. The RP validates the assertion from the IdP, but the RP never sees the credential or authentication at the IdP. The connections and data flows between these components are shown in Figure 3-4.

While this Standard makes no requirements on when to apply direct or federated authentication mechanisms, there are some natural mappings. For example, physical access systems tend not to use federation protocols and instead rely on direct authentication. Also, many derived PIV credentials can only be verified by their issuer and are therefore better suited for use as part of a federation protocol. PIV Issuance and Management Subsystem

Authentication Verification Issuance Attributes

PIV Front-End Subsystem ******

PIV Relying Subsystem

Figure 3-3. PIV System Connections

PIV Issuance and Management Subsystem

Identity Provider (IdP)

Authentication Assertion
• Verification
• Attributes

PIV Front-End Subsystem ******

PIV Relying Subsystem

Figure 3-4. PIV System Federation Connections