5.3 Authentication Capability
All changes in this version
Title changed
Before · SP 800-116
Authentication Capability
After · SP 800-116 Rev. 1
Authentication Capability
Control changed
Before · SP 800-116
Deployed PACS readers use proximity or magnetic stripe technology to interface with identity cards and use proprietary protocols to communicate data. Some of these proprietary protocols employ cryptography, but their use is limited to the local site. FIPS 201 specifies identity credentials that could be used for a new generation of identity management technology for building access. FIPS 201 and its supporting special publications define the credential data model and the card-to-reader interface, and also provide requirements for implementing the digital certificates. FIPS 201 added a standardized contactless and contact interface, biometric fingerprint, and cryptography to the credential that could be used to attain a higher level of identity authentication assurance. The capability to perform bi-directional data communication is fundamental to the deployment of secure building access. Adding cryptography to the credentials permits agencies to validate the data objects on the card and authenticate the cardholder. Adding credential expiration and on-line credential validation requirements also strengthens access control decisions. At the same time, FIPS 201 provided the opportunity to migrate building access systems from LITTLE OR NO confidence assurance levels to VERY HIGH confidence assurance levels. Existing PACS may need upgrades to take advantage of these features and functions, in coordination with the following guidelines and authorities:
+ FIPS 201 assurance levels
+ Department of Justice Vulnerability Assessment Report of Federal Facilities
+ OMB M-04-04, E-Authentication Guidance for Federal Agencies. [M-04-04]
FIPS 201 redefines the requirements for building access in a fundamental way: instead of each facility issuing an access card solely for that facility’s defined PACS architecture, a facility relies on the PIV Card that was issued by the same, or a different, agency certified by the Federal government. The facility still has control over the user’s access privileges, but the technology has been standardized to optimize inter-agency interoperability and the credential has been issued to the user as part of the FIPS 201 identity management process.
After · SP 800-116 Rev. 1
Deployed PACS readers use proximity or magnetic stripe technology to interface with identity cards and use proprietary protocols to communicate data. Some of these proprietary protocols employ cryptography, but their use is limited to the local site. FIPS 201 specifies identity credentials that could be used for a new generation of identity management technology for building access. FIPS 201 and its supporting special publications define the credential data model and the card-to-reader interface, and also provide requirements for implementing the digital certificates. FIPS 201 added a standardized contactless and contact interface, biometric fingerprint, and cryptography to the credential that could be used to attain a higher level of identity authentication assurance. The capability to perform bi-directional data communication is fundamental to the deployment of secure building access. Adding cryptography to the credentials permits agencies to validate the data objects on the card and authenticate the cardholder. Adding credential expiration and on-line credential validation requirements also strengthens access control decisions. At the same time, FIPS 201 provided the opportunity to migrate building access systems from LITTLE OR NO confidence assurance levels to VERY HIGH confidence assurance levels. Existing PACS may need upgrades to take advantage of these features and functions, in coordination with the following guidelines and authorities:
+ FIPS 201 assurance levels
+ Department of Justice Vulnerability Assessment Report of Federal Facilities
+ OMB M-04-04, E-Authentication Guidance for Federal Agencies. [M-04-04]
FIPS 201 redefines the requirements for building access in a fundamental way: instead of each facility issuing an access card solely for that facility’s defined PACS architecture, a facility relies on the PIV Card that was issued by the same, or a different, agency certified by the Federal government. The facility still has control over the user’s access privileges, but the technology has been standardized to optimize inter-agency interoperability and the credential has been issued to the user as part of the FIPS 201 identity management process.