BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3 Terminology

NIST PIV and digital identity SP 800-116
All changes in this version
first version loaded 3 Terminology

Title

Terminology

Control

The following terms are used in this document and are not defined in FIPS 201. Access Control: A function or a system that restricts access to authorized persons only. Access Control List: A list of (identifier, permissions) pairs associated with a resource or an asset. As an expression of security policy, a person may perform an operation on a resource or asset if and only if the person’s identifier is present in the access control list (explicitly or implicitly), and the permissions in the (identifier, permissions) pair include the permission to perform the requested operation. Assurance Level (or E-Authentication Assurance Level ) : A measure of trust or confidence in an authentication mechanism defined in OMB Memorandum M-04-04 and NIST Special Publication (SP) 800-63, in terms of four levels: [M-04-04]
• Level 1: LITTLE OR NO confidence
• Level 2: SOME confidence
• Level 3: HIGH confidence
• Level 4: VERY HIGH confidence Authentication: A process that establishes the origin of information, or determines an entity’s identity. In this publication, authentication often means the performance of a PIV authentication mechanism. Authentication in Context: Authentication in context is a concept in which PACS may benefit from previous authentication within nested areas in a facility. The PACS may use information from previous access control decisions (“context”) when making a new access control decision. Authorization: In this publication, a process that associates permission to access a resource or asset with a person and the person’s identifier(s). Authenticator: A memory, possession, or quality of a person that can serve as proof of identity, when presented to a verifier of the appropriate kind. For example, passwords, cryptographic keys, and fingerprints are authenticators. BIO or BIO-A: A FIPS 201 authentication mechanism that is implemented by using a Fingerprint data object sent from the PIV Card to the PACS. Note that the short-hand “BIO (-A)” is used throughout the document to represent both BIO and BIO-A authentication mechanisms. Biometric: An authenticator produced from measurable qualities of a living person. Building Security Committee: A committee consisting of representatives of Federal tenants in a facility, and possibly the building owner or management. The committee is responsible for building-specific security issues and approval of security policies and practices. Card Authentication Key (CAK ) : A PIV authentication mechanism (or the PIV Card key of the same name) that is implemented by an asymmetric or symmetric key challenge/response protocol. The CAK is an optional mechanism defined in NIST SP 800-73. [SP800-73] NIST strongly recommends that every PIV Card contain an asymmetric CAK and corresponding certificate, and that agencies use the asymmetric CAK protocol, rather than a symmetric CAK protocol, whenever the CAK authentication mechanism is used with PACS. See Section 7.1.4. Cardholder Unique Identifier (CHUID): A FIPS 201 authentication mechanism that is implemented by transmission of the CHUID data object from the PIV Card to PACS, or the PIV Card data object of the same name. Certificate: A data object containing a subject identifier, a public key, and other information, that is digitally signed by a Certification Authority. Certificates convey trust in the relationship of the subject identifier to the public key. Cloning: In this publication, a process to create a verbatim copy of a PIV Card, or a partial copy sufficient to perform one or more authentication mechanisms as if it were the original card. Contact Reader: A smart card reader that communicates with the Integrated Circuit chip in a smart card using electrical signals on wires touching the smart card’s contact pad. The PIV contact interface is standardized by International Organization of Standards / International Electrotechnical Commission (ISO/IEC) 7816-3. [ISO/IEC7816] Contactless Reader: A smart card reader that communicates with the Integrated Circuit chip in a smart card using radio frequency (RF) signaling. The PIV contactless interface is standardized by ISO/IEC 14443. [ISO/IEC14443] Controller (or Control Panel, or Panel ) : A device located within the secure area that communicates with multiple PIV Card readers and door actuators, and with the Head End System. The PIV Card readers provide cardholder information to the Controller, which it uses to make access control decisions and release door locking mechanisms. The Controller communicates with the Head End System to receive changes in access permissions, report unauthorized access attempts and send audit records and other log information. Most modern controllers can continue to operate properly during periods of time in which communication with the Head End is disrupted and can journal transactions so that they can be reported to the Head End when communication is restored. Counterfeiting: In this publication, the creation of a fake ID card that can perform one or more authentication mechanisms, without copying a legitimate card (see Cloning ). Credential: In this publication, a collection of information about a person, attested to by an issuing authority. A credential may be a physical artifact (e.g., a PIV Card ) or a data object (e.g., a certificate ). One or more data object credentials may be stored on the same physical memory device (e.g., a smart card). Credential Validation: The process of determining if a credential is valid , i.e., it was legitimately issued, its activation date has been reached, it has not expired, it has not been tampered with, and it has not been terminated, suspended, or revoked by the issuing authority. Digital Signature: A data object produced by a digital signature method, such as Rivest, Shamir, Aldeman (RSA) or the Elliptic Curve Digital Signature Algorithm (ECDSA), that when verified provides strong evidence of the origin and integrity of the signed data object. Federal Agency Smart Credential Number (FASC-N): As required by FIPS 201, the primary identifier on the PIV Card for physical access control. The FASC-N is a fixed length (25 byte) data object, specified in [TIG SCEPACS], and included in several data objects on a PIV Card. FASC-N Identifier: The FASC-N shall be in accordance with [TIG SCEPACS]. A subset of FASC-N, a FASC-N Identifier, is a unique identifier as described in [TIG SCEPACS]. Section 2.1, 10 th paragraph of [TIG SCEPACS] states “For full interoperability of a PACS it must at a minimum be able to distinguish fourteen digits (i.e., a combination of an Agency Code, System Code, and Credential Number) when matching FASC-N based credentials to enrolled card holders.” Also, Section 6.6, 3 rd paragraph of [TIG SCEPACS] states, “The combination of an Agency Code, System Code, and Credential Number is a fully qualified number that is uniquely assigned to a single individual”. The Agency Code is assigned to each Department or Agency by Special Publication 800-87, Codes for the Identification of Federal and Federally-Assisted Organizations [SP800-87]. The subordinate System Code and Credential Number value assignment is subject to Department or Agency policy, provided that the FASC-N Identifier (i.e. the concatenated Agency Code, System Code, and Credential Number) is unique for each card. Head End System (or Access Control Server ) : A system including application software, database, a Head End server, and one or more networked personal computers. The Head End server is typically used to enroll an individual's name, create a unique ID number, and assign access privileges and an expiration date. The server is also used to maintain this information and refresh the Controller(s) with the latest changes. Identifier (or Unique Identifier ) : In this publication, a data object, assigned by an authority, that unambiguously identifies a person within a defined community. For example, a Driver License number identifies a licensed driver within a State. The authority registers people and guarantees assignment of each identifier to a unique person. Identity Credential: A credential that contains one or more identifiers for its subject, a person. In this publication, an identity credential is designed to verify the identity of its subject through authentication mechanisms , either manually (see VIS ) or electronically (see CHUID , CAK , PKI , BIO , and BIO-A ). Infrastructure: Distributed substructure of a large-scale organization that facilitates related functions or operations, e.g., telecommunications infrastructure. With regard to PACS, components include conduit, cabling, power supplies, battery backup, electrified door hardware, door position switches, and remote exit devices, as well as connectivity with other life safety systems that will ensure egress in the event of an emergency. Interoperability: In this publication, the quality of allowing any government facility or information system to verify a cardholder’s identity using the credentials on the PIV Card, regardless of the PIV Card Issuer (PCI). Issuance (or Credential Issuance ) : The process by which an issuing authority obtains and verifies information about a person, assigns one or more unique identifiers to the person, prepares information to be placed in or on a credential, produces a physical or data object credential, and delivers the finished credential to its subject. In the case of PIV Cards, issuance is performed only by accredited PCIs. Multi-Factor Authentication: Authentication based on more than one factor. In some contexts, each factor is a different authenticator. In other contexts, each factor is one of “something you know, something you have, something you are” (i.e., memorized fact, token, or biometric) and thus the number of factors is 1, 2, or 3. PACS Registration: The process of authenticating, validating, and verifying information about the PIV cardholder prior to entering the information into a PACS server. The information added during registration is then utilized to perform authentication and authorization of an individual at an access point. Path Validation (or Trust Path Validation ) : The process of verifying the binding between the subject identifier and subject public key in a certificate, based on the public key of a trust anchor, through the validation of a chain of certificates that begins with a certificate issued by the trust anchor and ends with the target certificate. Successful path validation provides strong evidence that the information in the target certificate is trustworthy. Personal Identification Number (PIN): Typically, a short numeric password (4 to 8 digits) used as an authenticator with a bank card, ID card, or other personal security device. Personal Identity Verification (PIV) Card: The identity credential mandated by HSPD-12 and defined by FIPS 201 as an end-point PIV Card. A PIV Card is a smart card with contact and contactless communication capability, and eleven defined data objects for interoperability, five mandatory and six optional. PIV Implementation Maturity Model (PIMM): PIMM is a PIV implementation maturity model that can be used to measure the progress of a facility or an agency towards accepting PIV Card. PIV System: A system comprised of components and processes that support a common (smart card-based) platform for identity authentication across Federal departments and agencies for access to multiple types of physical access environments. Physical Access Control System (PACS): An electronic system that controls the ability of people or vehicles to enter a protected area, by means of authentication and authorization at access control points. PKI: For this document, a PIV authentication mechanism that is implemented by an asymmetric PIV authentication key challenge/response protocol. Private Key: A cryptographic key used with a public key cryptographic algorithm, which is uniquely associated with an entity, and not made public; it is used to generate a digital signature; this key is mathematically linked with a corresponding public key. Public Key: A cryptographic key used with a public key cryptographic algorithm, uniquely associated with an entity, and which may be made public; it is used to verify a digital signature; this key is mathematically linked with a corresponding private key. Reader: A device that interfaces with a PIV Card and a Controller to execute or support execution of one or more PIV authentication mechanisms.

Relying Party: In this publication, an entity, such as a PACS, that depends upon the trust model of the PIV System to correctly produce the results of authentication, i.e., the identity of the cardholder. Revocation: The process by which an issuing authority renders an issued credential useless. For example, a Certification Authority may revoke certificates it issues. Typically, a certificate is revoked if its corresponding private key is known to be, or suspected to be, compromised, or if the certificate’s subject affiliation is changed. Secret Key: A key used by a symmetric key algorithm to encrypt, decrypt, sign, or verify information. In a Symmetric Key Infrastructure (SKI), the sender and receiver of encrypted information must share the same secret key. Skimming: Surreptitiously obtaining data from a contactless smart card, using a hidden reader that powers, commands, and reads from the card within the maximum read distance (reported as about 25 cm with ISO/IEC 14443 smart cards like the PIV Card). [SKIMMER] Sniffing: Surreptitiously obtaining data from a contactless smart card, using a hidden reader that receives RF signals from a legitimate reader and smart card when they perform a transaction. Sniffing is a form of electronic eavesdropping. Sniffing is possible at greater distances than skimming. Social Engineering: A process or technique, similar to a confidence game, used to obtain information from a person without raising suspicion. Termination: In this publication, the action of an identity credential issuer that causes the credential to become invalid. Trust Anchor: A named entity producing digital signatures, and a corresponding certificate that a relying party has decided to trust, i.e., if a digital signature is verified using the public key within the certificate, the signature is trusted to have been made by the entity named in the certificate. VIS: A FIPS 201 authentication mechanism in which the visual identity verification of a PIV Card is done by a human guard. Validation: In this publication, the process of determining that an identity credential was legitimately issued and is still valid, i.e., has not expired or been terminated. Verification: The process of determining if an assertion is true, particularly the process of determining if a data object possesses a digital signature produced by the purported signer. Wiegand: With regard to deployed PACS, a one-way communication protocol consisting of a formatted bit string used from the access reader to the Controller. It can be used with any media, including proximity, bar code, magnetic stripe, and smart cards.