Homeland Security Insider
Now, It's Getting Personal
Security has changed over the years in more ways than we can count. From one perspective, security used to be about keeping information secret by restricting its access. Now, the focus is on verifying the identity of the person accessing that information. It's one thing to have valid credentials and another to be the person the credentials validate.
The federal government is leading the way toward better identity security through standards development. Not only is more cooperation mandated by government for other government agencies, but companies wanting to conduct business with the government have to improve security systems through recognized standards, as well. The future is now?agencies and corporations can look forward to improved security across the enterprise. For now, however, the very complexity of the security challenge makes management difficult.
Recognizing the shift towards personal identify verification during the summer of 2004, as the third anniversary of the terrorist attacks of Sept. 11, 2001, approached, the president issued Homeland Security Presidential Directive 12 (HSPD-12) entitled, "Policy for a Common Identification Standard for Federal Employees and Contractors." HSPD-12 requires the development and implementation of a government-wide standard for secure and reliable forms of identification for both physical and logical access control, and other applications as determined by the individual agencies. The goals are to increase security, reduce identity fraud and to increase efficiencies within the federal government. To achieve these goals, the directive sets guidelines and timelines for a federal standard to establish secure and reliable identification for federal employees and contractors. HSPD-12 specifically states that credentials issued must be:
- Based on sound criteria for verifying an individual's identity.
- Strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation.
- Rapidly authenticated electronically.
- Issued only by providers whose reliability has been established by an official process.
The Department of Commerce's National Institute of Standards and Technology (NIST) was tasked with producing a standard for a secure and reliable form of identification. In response, NIST issued Federal Information Processing Standard 201 (FIPS 201). FIPS 201 is comprised of two parts, Personal Identity Verification (PIV)-I, which describes the minimum requirements for a system that meets control and security objectives, and PIV-II that provides detailed technical specifications to support the control and security objectives, and the details for technical interoperability for authentication, access control and management systems across the federal government.
Subsequently, NIST issued several special publications in support of FIPS 201 to enable interoperable implementations. Additionally, NIST created a conformance test suite for personal identity verification card applications and middleware to ensure interoperability. Currently, NIST is putting together a proof of concept demonstration to show the interoperability of commercially available products that support FIPS 201.
FIPS 201 incorporates three technical publications specifying several aspects of the required administrative procedures and technical specifications that may change as the standard is implemented and used. NIST Special Publication 800-73, "Interfaces for Personal Identity Verification," specifies the interface and data elements of the PIV card; NIST Special Publication 800-76, "Biometric Data Specification for Personal Identity Verification," specifies the technical acquisition and formatting requirements for biometric data of the PIV system; and NIST Special Publication 800-78, "Cryptographic Algorithms and Key Sizes for Personal Identity Verification," specifies the acceptable cryptographic algorithms and key sizes to be implemented and used for the PIV system.
In addition, a number of guidelines, reference implementations and conformance tests have been identified as being needed to implement and use the PIV system; protect the personal privacy of all subscribers of the PIV system; authenticate identity source documents to obtain the correct legal name of the person applying for a PIV card; electronically obtain and store required biometric data (e.g. fingerprints, facial images) from the PIV system subscriber; create a PIV card that is personalized with data needed by the PIV system to later grant access to the subscriber to federal facilities and information systems; ensure appropriate levels of security for all applicable federal applications; and provide interoperability among federal organizations using the standards.
When issued, HSPD-12 contained a very aggressive timeline that has not been difficult to meet. In late December 2005, the General Services Administration (GSA) took an important step towards getting the blanket purchase agreement (BPA) in place by the target date of May 2006, when the current BPA expires. In a request for information (RFI), GSA asked commercial vendors whether they can provide systems and solutions that will meet HSPD-12's implementation requirements. Specifically, GSA asked for information on the capability of commercial vendors to deploy, operate and maintain system solutions that provide one or more of the core components detailed in FIPS 201 and NIST 800-73: registration system/services; identity management system/services; card management system/services; public key infrastructure (PKI) certification authority services; and card printing system/services.
While GSA said the RFI guarantees no request for proposals (RFP) will be issued, if this RFI follows a logical pattern, it will lead to technology demonstrations for down-selected companies/technologies that can lead to substantial long-term contracts for the successful competitors.
Some experts estimate that it will take up to a year for NIST and GSA to make sure products and services conform to technical and interoperability standards, or to the as-yet-not issued biometric standard. NIST plans to update FIPS-201 by Feb. 25.
Vendors were asked to give GSA five-year cost estimates for agencies with 100,000 to more than 1 million cardholders, and comment on the practicality of certain performance metrics, such as notification of suspension or revocation to physical or logical access control systems within 20 minutes, and whether registration per applicant can be done in 15 minutes.
In the meantime, security remains an evolutionary process. In the past, the biometric industry was populated by proprietary devices, but HSPD-12 and FIPS-201 are forcing more open standards in biometrics. That is good for both the industry and for government.