1 HK HA or HKA (was: Executive Summary)
All changes in this version
Title changed
Before · SP 800-116
Executive Summary
After · SP 800-116 Rev. 1
ExecutiveHK SummaryHA or HKA
Control changed
Before · SP 800-116
The physical access control systems (PACS) deployed in most Federal buildings are facility- centric rather than enterprise-centric and utilize proprietary PACS architectures. Therefore, many issued identification (ID) cards operate only with the PACS for which they were issued. The technologies used in these systems may offer little or no authentication assurance, because the issued ID cards are easily cloned or counterfeited. In addition to the lack of interoperability, deployed PACS technology presents the following challenges:
+ Scalability. Some deployed systems are limited in their capability to process the longer credential numbers necessary for Government-wide interoperability.
+ Security. Deployed PACS readers can read an identifying number from a card, but in most cases they do not perform a cryptographic challenge/response exchange. Most bar code, magnetic stripe, and proximity cards can be copied easily. The technologies used in these systems may offer little or no authentication assurance.
+ Validity. Deployed PACS control expiration of credentials through an expiration date stored in a site database. There is no simple way to synchronize the expiration or revocation of credentials for a Federal employee or contractor across multiple sites.
+ Efficiency. Use of personal identification numbers (PIN), public key infrastructure, and biometrics with deployed PACS is managed on a site-specific basis. Individuals must enroll PINs, keys, and biometrics at each site. Since PINs, keys, and biometrics are often stored in a site database, they may not be technically interoperable with PACS at other sites.
Homeland Security Presidential Directive 12 (HSPD-12) sets a clear goal to improve PACS through the use of government-wide standards. [HSPD-12] Federal Information Processing Standard 201 (FIPS 201) defines characteristics of the identity credential that can be interoperable government-wide. [FIPS201] In the context of HSPD-12, the term interoperability means the ability to use any Personal Identity Verification (PIV) Card with any application performing one or more PIV authentication mechanisms. FIPS 201 defines authentication mechanisms at three E- Authentication assurance levels (SOME, HIGH, and VERY HIGH), and standardizes optional credential elements that extend trust in the PIV System to functions beyond authentication. A gap remains, however, between the concepts of authentication assurance levels and their application in a PACS environment. To close this gap, this document:
+ Discusses the different PIV Card capabilities so that the risk-based assessment can be aligned with the appropriate PIV authentication mechanism.
+ Introduces the concept of “Controlled, Limited, Exclusion” areas to employ risk-based PIV authentication mechanisms for different areas within a facility.
+ Proposes a PIV Implementation Maturity Model (PIMM) to measure the progress of facility and agency implementations.
+ Recommends to Federal agencies an overall strategy for the implementation of PIV authentication mechanisms with agency facility PACS. Since the areas accessible via different access points within a facility do not all have the same security requirement, the PIV authentication mechanisms should be selected to be consistent with, and integral to, the overall security requirements of the protected area. A given facility may need multiple authentication mechanisms. Therefore, the designation of “Controlled, Limited, Exclusion” areas, detailed in Section 7.3, is applied to the protected area. Specifically, this document recommends PIV authentication mechanisms for “Controlled, Limited, Exclusion” in terms of authentication factors as shown in Table 1-1.
Table 1-1. Authentication Factors for Security Areas
Security Areas Number of Authentication Factors Required Controlled 1 Limited 2 Exclusion 3
PIV authentication mechanisms should be implemented in accordance with Table 1-1. Figure 1-1 illustrates the innermost perimeter at which each PIV authentication mechanism may be used based on the authentication assurance level of the mechanism. The combined effect of Table 1-1 and Figure 1-1 determines exactly what mechanisms may be used. (See Section 7.3) An exhaustive list of possible uses of PIV authentication mechanisms against protected areas is provided in Appendix C. Visual (VIS), Cardholder Unique Identifier (CHUID), Biometric (BIO), Attended Biometric (BIO-A), and PIV Authentication Key (PKI) are PIV authentication mechanisms defined in FIPS 201 and described in Section 3. Card Authentication Key (CAK) is an optional PIV authentication mechanism that is described in Section 3.
PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access
Figure 1-1: Innermost Use of PIV Authentication Mechanisms A risk-based migration strategy should be planned and implemented to achieve PIV enabling. This document recommends a model that allows agencies to incrementally PIV-enable access points. The model is defined in terms of maturity levels as follows:
+ Maturity Level 1—Ad hoc PIV verification.
+ Maturity Level 2—Systematic PIV verification to Controlled areas. PIV Cards and currently deployed non-PIV PACS cards are accepted for access to the Controlled areas at this level.
+ Maturity Level 3—Access to Exclusion areas by PIV or exception only. Non-PIV PACS cards are not accepted for access to the Exclusion areas at this level.
+ Maturity Level 4—Access to Limited areas by PIV or exception only. Non-PIV PACS cards are not accepted for access to the Limited or Exclusion areas at this level.
+ Maturity Level 5—Access to Controlled areas by PIV or exception only. Non-PIV PACS cards are not accepted for access to any areas at this level.
After · SP 800-116 Rev. 1
The physical access control systems (PACS) deployed in most Federal buildings are facility- centric rather than enterprise-centric and utilize proprietary PACS architectures. Therefore, many issued identification (ID) cards operate only with the PACS for which they were issued. The technologies used in these systems may offer little or no authentication assurance, because the issued ID cards are easily cloned or counterfeited. In addition to the lack of interoperability, deployed PACS technology presents the following challenges:
+ Scalability. Some deployed systems are limited in their capability to process the longer credential numbers necessary for Government-wide interoperability.
+ Security. Deployed PACS readers can read an identifying number from a card, but in most cases they do not perform a cryptographic challenge/response exchange. Most bar code, magnetic stripe, and proximity cards can be copied easily. The technologies used in these systems may offer little or no authentication assurance.
+ Validity. Deployed PACS control expiration of credentials through an expiration date stored in a site database. There is no simple way to synchronize the expiration or revocation of credentials for a Federal employee or contractor across multiple sites.
+ Efficiency. Use of personal identification numbers (PIN), public key infrastructure, and biometrics with deployed PACS is managed on a site-specific basis. Individuals must enroll PINs, keys, and biometrics at each site. Since PINs, keys, and biometrics are often stored in a site database, they may not be technically interoperable with PACS at other sites.
Homeland Security Presidential Directive 12 (HSPD-12) sets a clear goal to improve PACS through the use of government-wide standards. [HSPD-12] Federal Information Processing Standard 201 (FIPS 201) defines characteristics of the identity credential that can be interoperable government-wide. [FIPS201] In the context of HSPD-12, the term interoperability means the ability to use any Personal Identity Verification (PIV) Card with any application performing one or more PIV authentication mechanisms. FIPS 201 defines authentication mechanisms at three E- Authentication assurance levels (SOME, HIGH, and VERY HIGH), and standardizes optional credential elements that extend trust in the PIV System to functions beyond authentication. A gap remains, however, between the concepts of authentication assurance levels and their application in a PACS environment. To close this gap, this document:
+ Discusses the different PIV Card capabilities so that the risk-based assessment can be aligned with the appropriate PIV authentication mechanism.
+ Introduces the concept of “Controlled, Limited, Exclusion” areas to employ risk-based PIV authentication mechanisms for different areas within a facility.
+ Proposes a PIV Implementation Maturity Model (PIMM) to measure the progress of facility and agency implementations.
+ Recommends to Federal agencies an overall strategy for the implementation of PIV authentication mechanisms with agency facility PACS. Since the areas accessible via different access points within a facility do not all have the same security requirement, the PIV authentication mechanisms should be selected to be consistent with, and integral to, the overall security requirements of the protected area. A given facility may need multiple authentication mechanisms. Therefore, the designation of “Controlled, Limited, Exclusion” areas, detailed in Section 7.3, is applied to the protected area. Specifically, this document recommends PIV authentication mechanisms for “Controlled, Limited, Exclusion” in terms of authentication factors as shown in Table 1-1.
Table 1-1. Authentication Factors for Security Areas
Security Areas Number of Authentication Factors Required Controlled 1 Limited 2 Exclusion 3
PIV authentication mechanisms should be implemented in accordance with Table 1-1. Figure 1-1 illustrates the innermost perimeter at which each PIV authentication mechanism may be used based on the authentication assurance level of the mechanism. The combined effect of Table 1-1 and Figure 1-1 determines exactly what mechanisms may be used. (See Section 7.3) An exhaustive list of possible uses of PIV authentication mechanisms against protected areas is provided in Appendix C. Visual (VIS), Cardholder Unique Identifier (CHUID), Biometric (BIO), Attended Biometric (BIO-A), and PIV Authentication Key (PKI) are PIV authentication mechanisms defined in FIPS 201 and described in Section 3. Card Authentication Key (CAK) is an optional PIV authentication mechanism that is described in Section 3.
PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access
Figure 1-1: Innermost Use of PIV Authentication Mechanisms A risk-based migration strategy should be planned and implemented to achieve PIV enabling. This document recommends a model that allows agencies to incrementally PIV-enable access points. The model is defined in terms of maturity levels as follows:
+ Maturity Level 1—Ad hoc PIV verification.
+ Maturity Level 2—Systematic PIV verification to Controlled areas. PIV Cards and currently deployed non-PIV PACS cards are accepted for access to the Controlled areas at this level.
+ Maturity Level 3—Access to Exclusion areas by PIV or exception only. Non-PIV PACS cards are not accepted for access to the Exclusion areas at this level.
+ Maturity Level 4—Access to Limited areas by PIV or exception only. Non-PIV PACS cards are not accepted for access to the Limited or Exclusion areas at this level.
+ Maturity Level 5—Access to Controlled areas by PIV or exception only. Non-PIV PACS cards are not accepted for access to any areas at this level.