7.3 Selection of PIV Authentication Mechanisms
All changes in this version
Title changed
Before · SP 800-116
Selection of PIV Authentication Mechanisms
After · SP 800-116 Rev. 1
Selection of PIV Authentication Mechanisms
Control changed
Before · SP 800-116
A risk-based approach should be used when selecting appropriate PIV authentication mechanisms for physical access to Federal government buildings and facilities. Determining risk to the facility is beyond the scope of this document; however, an agency may use a Facility Security Level (FSL) Determination to derive the FSL for its facilities. There is no simple one-to-one mapping between the FSL and the authentication mechanism(s) that should be employed. An FSL I campus facility may have a need for nested perimeters due to localized high-value assets. An FSL III facility may not have any high-value assets but may be larger in population. An FSL V facility may need the highest level of authentication assurance at all access points except the public entrance to a visitor center. For these reasons, it is recommended that authentication mechanisms be selected on the basis of protective areas established around assets or resources. This document adopts the concept of “Controlled, Limited, Exclusion” areas as defined in [PHYSEC]. Procedurally, proof of affiliation is often sufficient to gain access to a Controlled area (e.g., an agency’s badge to that agency’s headquarters’ outer perimeter). Access to Limited areas is often based on functional subgroups or roles (e.g., a division badge to that division’s building or wing). The individual membership in the group or privilege of the role is established by authentication of the identity of the cardholder. Access to Exclusion areas may be gained by individual authorization only. Federal government facilities can be identified and categorized in these areas and correspond
9 PKI + BIO(-A) also achieves three-factor authentication, but is not present in Table 7-1 because three factors are predicted by the sum of the HKA vectors of PKI and BIO(-A). For all combined mechanisms not in the table, the sum of the HKA vectors correctly predicts the number of factors achieved. generally to LOW (for Controlled), MODERATE (for Limited), and HIGH (for Exclusion) impact assets or resources [FIPS 199]. This document recommends that Table 7-2 be used to determine the minimum number of authentication factors needed to satisfy security requirements of the area.
Table 7-2. Authentication Factors for Security Areas
Security Areas Number of Authentication Factors Required Controlled 1 Limited 2 Exclusion 3
Figure 7-1 illustrates the innermost perimeter at which each PIV authentication mechanism may be used based on the authentication assurance level of the mechanism. Table 7-2 and Figure 7-1 both express constraints on the authentication mechanism that may be selected. The combined effect of Table 7-2 and Figure 7-1 determines exactly what mechanisms may be used. An exhaustive list of possible uses of PIV authentication mechanisms against protected areas is provided in Appendix C.
PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access
Figure 7-1: Innermost Use of PIV Authentication Mechanisms The figure should be interpreted with the following notes: Note 1. “CHUID + VIS” means a combined authentication mechanism performing visual inspection of the PIV Card and CHUID authentication at the same access point. “CAK + BIO(-A)” means a combined authentication mechanism performing CAK and BIO or CAK and BIO-A at the same access point, both using the contact interface of the PIV Card. The term “combine” means that more than one independent authentication mechanisms must successfully authenticate the presenting person, at the same access point, before access is permitted. Note 2. Authentication mechanisms shown at a perimeter in Figure 7-1 may also be used alone at a perimeter farther out, subject to the requirements in Table 7-2, but not the reverse. If authentication mechanisms are combined in ways not shown in Figure 7-1, at least one of the combined mechanisms must be allowed by Figure 7-1 at the perimeter of use. For example, “BIO and CHUID” could be used at access points A or B, but not at access point C. Note 3. In a particular facility, a single perimeter may separate areas with a difference of more than one impact level. A single perimeter may allow access from Unrestricted to Limited, Unrestricted to Exclusion, or Controlled to Exclusion areas, and in these cases, the PIV authentication mechanisms should be combined to achieve necessary authentication factors to enter the innermost area. Note 4. Within a Controlled or Limited area, an access point to an adjacent area at the same impact level may employ any of the authentication mechanisms shown in Figure 7-1, as well as the CHUID authentication mechanism without VIS. Note 5. Within an Exclusion area, an access point to an adjacent area at the same impact level should use two or three-factor authentication. Note 6. In most cases, Figure 7-1 and these notes allow flexibility in the selection of specific authentication mechanisms. A decision should be made based on the local security policy and operational considerations. Note (1) ensures that the CHUID mechanism is combined with VIS where impact level escalation occurs, mitigating the risks described in Section 4. Notes (3) and (5) ensure that two-factor authentication is always employed to enter Limited areas, and three-factor authentication is employed to enter Exclusion areas. It also ensures that credential validation is done in either case. Notes (4) and (5) add some flexibility in the case of discretionary access control among areas at the same impact level. The authentication mechanisms in Figure 7-1 apply at all Threat Condition levels. At Threat Conditions Green, Blue, and Yellow, the facility should use the authentication mechanisms at each perimeter as shown. At Threat Condition Orange, the facility should use two or three-factor authentication at the Controlled perimeters. When the Threat Condition level increases, some access points may be closed. Access points that remain open should be capable of the required authentication mechanisms at the elevated Threat Condition level. PIV authentication mechanisms can be mapped to perimeter crossings in many ways, provided that the requirements of this section are met. Figure 7-2 below provides some examples of mapping PIV authentication mechanisms to the perimeter crossings within a facility. Access Controlled area Limited area Exclusion area
Access A Access
CAK CHUID + VIS PKI + BIO(-A)
BIO-A PKI
PKI
1 1 3
After · SP 800-116 Rev. 1
A risk-based approach should be used when selecting appropriate PIV authentication mechanisms for physical access to Federal government buildings and facilities. Determining risk to the facility is beyond the scope of this document; however, an agency may use a Facility Security Level (FSL) Determination to derive the FSL for its facilities. There is no simple one-to-one mapping between the FSL and the authentication mechanism(s) that should be employed. An FSL I campus facility may have a need for nested perimeters due to localized high-value assets. An FSL III facility may not have any high-value assets but may be larger in population. An FSL V facility may need the highest level of authentication assurance at all access points except the public entrance to a visitor center. For these reasons, it is recommended that authentication mechanisms be selected on the basis of protective areas established around assets or resources. This document adopts the concept of “Controlled, Limited, Exclusion” areas as defined in [PHYSEC]. Procedurally, proof of affiliation is often sufficient to gain access to a Controlled area (e.g., an agency’s badge to that agency’s headquarters’ outer perimeter). Access to Limited areas is often based on functional subgroups or roles (e.g., a division badge to that division’s building or wing). The individual membership in the group or privilege of the role is established by authentication of the identity of the cardholder. Access to Exclusion areas may be gained by individual authorization only. Federal government facilities can be identified and categorized in these areas and correspond
9 PKI + BIO(-A) also achieves three-factor authentication, but is not present in Table 7-1 because three factors are predicted by the sum of the HKA vectors of PKI and BIO(-A). For all combined mechanisms not in the table, the sum of the HKA vectors correctly predicts the number of factors achieved. generally to LOW (for Controlled), MODERATE (for Limited), and HIGH (for Exclusion) impact assets or resources [FIPS 199]. This document recommends that Table 7-2 be used to determine the minimum number of authentication factors needed to satisfy security requirements of the area.
Table 7-2. Authentication Factors for Security Areas
Security Areas Number of Authentication Factors Required Controlled 1 Limited 2 Exclusion 3
Figure 7-1 illustrates the innermost perimeter at which each PIV authentication mechanism may be used based on the authentication assurance level of the mechanism. Table 7-2 and Figure 7-1 both express constraints on the authentication mechanism that may be selected. The combined effect of Table 7-2 and Figure 7-1 determines exactly what mechanisms may be used. An exhaustive list of possible uses of PIV authentication mechanisms against protected areas is provided in Appendix C.
PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access PKI BIO-A
CAK CHUID + VIS CAK + BIO(-A)
BIO
Access A Access C
Access
Figure 7-1: Innermost Use of PIV Authentication Mechanisms The figure should be interpreted with the following notes: Note 1. “CHUID + VIS” means a combined authentication mechanism performing visual inspection of the PIV Card and CHUID authentication at the same access point. “CAK + BIO(-A)” means a combined authentication mechanism performing CAK and BIO or CAK and BIO-A at the same access point, both using the contact interface of the PIV Card. The term “combine” means that more than one independent authentication mechanisms must successfully authenticate the presenting person, at the same access point, before access is permitted. Note 2. Authentication mechanisms shown at a perimeter in Figure 7-1 may also be used alone at a perimeter farther out, subject to the requirements in Table 7-2, but not the reverse. If authentication mechanisms are combined in ways not shown in Figure 7-1, at least one of the combined mechanisms must be allowed by Figure 7-1 at the perimeter of use. For example, “BIO and CHUID” could be used at access points A or B, but not at access point C. Note 3. In a particular facility, a single perimeter may separate areas with a difference of more than one impact level. A single perimeter may allow access from Unrestricted to Limited, Unrestricted to Exclusion, or Controlled to Exclusion areas, and in these cases, the PIV authentication mechanisms should be combined to achieve necessary authentication factors to enter the innermost area. Note 4. Within a Controlled or Limited area, an access point to an adjacent area at the same impact level may employ any of the authentication mechanisms shown in Figure 7-1, as well as the CHUID authentication mechanism without VIS. Note 5. Within an Exclusion area, an access point to an adjacent area at the same impact level should use two or three-factor authentication. Note 6. In most cases, Figure 7-1 and these notes allow flexibility in the selection of specific authentication mechanisms. A decision should be made based on the local security policy and operational considerations. Note (1) ensures that the CHUID mechanism is combined with VIS where impact level escalation occurs, mitigating the risks described in Section 4. Notes (3) and (5) ensure that two-factor authentication is always employed to enter Limited areas, and three-factor authentication is employed to enter Exclusion areas. It also ensures that credential validation is done in either case. Notes (4) and (5) add some flexibility in the case of discretionary access control among areas at the same impact level. The authentication mechanisms in Figure 7-1 apply at all Threat Condition levels. At Threat Conditions Green, Blue, and Yellow, the facility should use the authentication mechanisms at each perimeter as shown. At Threat Condition Orange, the facility should use two or three-factor authentication at the Controlled perimeters. When the Threat Condition level increases, some access points may be closed. Access points that remain open should be capable of the required authentication mechanisms at the elevated Threat Condition level. PIV authentication mechanisms can be mapped to perimeter crossings in many ways, provided that the requirements of this section are met. Figure 7-2 below provides some examples of mapping PIV authentication mechanisms to the perimeter crossings within a facility. Access Controlled area Limited area Exclusion area
Access A Access
CAK CHUID + VIS PKI + BIO(-A)
BIO-A PKI
PKI
1 1 3