6.2.6 Authentication Using PIV Visual Credentials (VIS) (Deprecated) (was: Authentication Using PIV Visual Credentials (VIS))
All changes in this version
Title changed
Before · FIPS 201-2
Authentication Using PIV Visual Credentials (VIS)
After · FIPS 201-3
Authentication Using PIV Visual Credentials (VIS) (Deprecated)
Control changed
Before · FIPS 201-2
Visual authentication of a PIV cardholder shall be used only to support access control to physical facilities and resources. The PIV Card has several mandatory topographical features on the front and back that support visual identification and authentication, as follows:
• Zone 1F – Photograph;
• Zone 2F – Name;
• Zone 8F – Employee Affiliation;
• Zone 10F – Agency, Department, or Organization;
• Zones 14F and 19F – Card Expiration Date;
• Zone 15F – Color-Coding for Employee Affiliation;
• Zone 1B – Agency Card Serial Number (back of card);
• Zone 2B – Issuer Identification Number (back of card).
The PIV Card may also bear optional components, some of which are:
• Zone 11F – Agency Seal;
• Zone 5B – Physical Characteristics of Cardholder (back of card);
• Zone 3F – Signature.
When a cardholder attempts to pass through an access control point for a Federally controlled facility, a human guard shall perform visual identity verification of the cardholder, and determine whether the identified individual should be allowed through the control point. The following steps shall be applied in the visual authentication process:
• The guard at the access control entry point determines whether the PIV Card appears to be genuine and has not been altered in any way.
• The guard compares the cardholder’s facial features with the picture on the card to ensure that they match.
• The guard checks the expiration date on the card to ensure that the card has not expired.
• The guard compares the cardholder’s physical characteristic descriptions to those of the cardholder. (Optional)
• The guard collects the cardholder’s signature and compares it with the signature on the card. (Optional)
• One or more of the other data elements on the card (e.g., name, employee affiliation, agency card serial number, issuer identification, agency name) are used to determine whether the cardholder should be granted access.
Some characteristics of the visual authentication mechanism are as follows:
• Human inspection of card, which is not amenable for rapid or high volume access control and is susceptible to human error.
• Some resistance to use of unaltered card by non-owner of card.
• Low resistance to tampering and forgery.
• Does not provide protection against use of a revoked card.
• Applicable in environments with and without card readers.
After · FIPS 201-3
Visual authentication of a PIV cardholder shallas a stand-alone authentication mechanism has been deprecated in this version of the Standard. The mechanism provides little or no assurance of the cardholder’s identity and SHOULD NOT be used. onlyIt tois supportexpected accessthat controlthe stand-alone use of visual authentication will be removed from this Standard in a future revision.
41 The PIV authentication certificate or car d authentication certificate may be leveraged instead of the CHUID to physicalverify facilitiesthat andthe resourcescard is not expired. The PIV Card has several mandatory topographical features on the front (see Section 4.1.4.1) and back (see Section 4.1.4.2) that support visual identification and authentication, as follows:• Zone 1F – Photograph;• Zone 2F – Name;• Zone 8F – Employee Affiliation;• Zone 10F – Agency, Department, or Organization;• Zones 14F and 19F – Card Expiration Date;• Zone 15F – Color-Coding for Employee Affiliation;• Zone 1B – Agency Card Serial Number (back of card);• Zone 2B – Issuer Identification Number
In (backaddition, ofany card)available security features described in Section 4.1.2 SHOULD be checked in a visual inspection to provide additional assurance that the PIV Card is genuine and unaltered.
The PIV Card may also bearhave several optional components, someon ofthe whichfront are(see Section 4.1.4.3) and back (see Section 4.1.4.4) that support visual identification and authentication, such as:•Zone 3F Signature
Zone 11F – Agency Seal;• Zone 5B – Physical Characteristics of Cardholder (back of card);• Zone 3F – Signature.When a cardholder attempts to pass through an access control point for a Federallyfederally controlled facility, a human guard shallSHALL perform visual identity verification of the cardholder, and SHALL determine whether the identified individual should be allowed through the control point. The following steps shallSHALL be applied in the visual authentication process:
• The guard at the access control entry point determines whether the PIV Card appears to be genuine and has not been altered in any way.
• The guard compares the cardholder’s facial features with the picturephotograph on the card to ensure that they match.
• The guard checks the expiration date on the card to ensure that the card has not expired.
• The guard compares the cardholder’s physical characteristic descriptions to those of the cardholder. (Optional)
• The guard collects the cardholder’s signature and compares it with the signature on the card. (Optional)
• One or more of the other data elements on the card (e.g., name, employee affiliation, agency card serial number, issuer identification, agency name) are used to determine whether the cardholder should be granted access.
Some characteristics of the visual authentication mechanism areinclude asthe followsfollowing:
• Humanhuman inspection of the card, which
• isdoes not amenable forprovide rapid or high volumehigh-volume access control and is,
• susceptible to human error.,
• Somesome resistance to the use of an unaltered card by non-owner ofa card.non-owner,
• Lowlow resistance to tampering and forgery., and
• Doesdoes not provide protection against the use of a revoked card.
• Applicable in environments with and without card readers.