United States Department of Agriculture (USDA) eGovernment Program

#########  {#section .unnumbered}

***eAuthentication Assurance Levels Document***

***DRAFT***

September, 2003

![](media/image1.jpeg){width="1.75in" height="1.2666666666666666in"}

**Table of Contents**

[Revision History ii](#revision-history)

[Previous Change History ii](#previous-change-history)

[Document Sign-off ii](#document-sign-off)

[1 Introduction 1](#introduction)

[2 Assurance Level Definitions 1](#assurance-level-definitions)

[2.1 Assurance Level Factors 1](#assurance-level-factors)

[2.2 Level 1 2](#level-1)

[2.3 Level 2 2](#level-2)

[2.4 Level 3 2](#level-3)

[2.5 Level 4 3](#level-4)

[3 Assurance Level Examples 3](#assurance-level-examples)

[3.1 Level 1 Assurance- No-risk Applications
3](#level-1-assurance--no-risk-applications)

[3.2 Level 2 Assurance- Routine Transactions
4](#level-2-assurance--routine-transactions)

[3.3 Level 3 Assurance- Sensitive Applications and Information
4](#level-3-assurance--sensitive-applications-and-information)

[3.4 Level 4 Assurance -- Extremely Confidential Applications
4](#level-4-assurance-extremely-confidential-applications)

#   {#section-1 .unnumbered}

# Revision History {#revision-history .unnumbered}

## Previous Change History {#previous-change-history .unnumbered}

Table a -- Previous Change History

  ----------------------- -------------------- ---------------------- --------------------------
  [Version]{.smallcaps}   [Date]{.smallcaps}   [Author]{.smallcaps}   [Comment]{.smallcaps}

  1.1                     09/02/03             Ria Karim              With edits from Jennifer
                                                                      Combs

                                                                      

                                                                      
  ----------------------- -------------------- ---------------------- --------------------------

## Document Sign-off {#document-sign-off .unnumbered}

Table b -- Document Sign-off

  -------------------- ---------------------- -------------------------------------
  [Date]{.smallcaps}   [Name]{.smallcaps}     [Title]{.smallcaps}

                                              
  -------------------- ---------------------- -------------------------------------

# Introduction

eAuthentication is the remote identification of individual people over a
network, for the purpose of electronic government and commerce. In
eAuthentication an individual remotely authenticates his or her identity
to a Federal IT system.

In order to ensure the security of the USDA personnel and information
posted on USDA Agency websites, applications will be assigned a level of
Assurance between 1 and 4 and only those users who receive a
corresponding Assurance Level may gain access to the desired
application. The Assurance Levels are defined in terms of the
consequences of the authentication errors and misuse of credentials.
Each Level therefore corresponds to the degree of confidence the IT
system can have in the asserted identity of the user of the application,
based on the registration process and the form of credential provided
for identity-proofing. Each user will be able to access only those
sites, documents and transactions associated with his Assurance level.

The purpose of this document is to guide Agencies in recommending
Assurance Levels for their portal applications. The following sections
clearly define the four Assurance Levels and provide examples of portal
applications which may be associated with each Level.

# Assurance Level Definitions

The four Assurance Levels indicate the degree of confidence an
individual application must have in the asserted identity of the user.
Assurance Levels are also applied to user credentials by looking at the
strength of the registration process and the actual credential (e.g.
password, PIN, certificate, biometric etc.). In this way, applications
can be matched with the appropriate level of user credential, and users
with lower Assurance Level credentials are refused admittance to the
application.

## Assurance Level Factors

Assurance Levels are determined by assessing the impact associated with
the misuse of a user's credentials. That is, when answering the
GSA-based questions to determine Assurance Level, an application owner
should consider only the results of a login error. There are several
common areas of confusion in assessing this impact:

-   Data accessed through other processes is not considered while
    assessing Authentication Assurance Levels. For example, if an
    application collects user data and stores it in a database that is
    accessed by employees through a database interface, the security of
    the data in the database is unrelated to the application
    authentication. Instead, the risk and protection of this database
    should be considered separately during the application design.

-   Data that is verified independently of the application is not
    impacted by an authentication error. For example, if an application
    collects information for the purposes of disbursing loan money, but
    the money is submitted to a pre-defined bank account, then the money
    is not at risk due to the application authentication. Instead, risks
    and protection of this bank account information collection should be
    assessed during the process design.

-   Authentication, if identity is verified independently, does not pose
    any risk. That is, if a user submits data for which identity must be
    verified, and there is a subsequent process of verifying the user's
    identity, there is no impact of an incorrect login. This is because
    the data submitted is not considered "true" until the user's
    identity is confirmed through an alternate process.

-   Both traditional methods and electronic methods of identification
    can be used outside the authentication process to reduce the impact
    of an authentication error.

    -   Traditional methods; ink signatures, EFT's, long standing
        relationship, etc

    -   Electronic Methods; Cryptography, etc.

## Level 1

Applications assigned Level 1 Assurance require no real validation of
the user's identity. Users self register online at the USDA website and
may access general and informational websites with Level 1 Assurance.
Authentication to Level 1 applications requires low-level password.

## Level 2 

> Applications assigned Level 2 Assurance require validation of the
> identity of the user before information and websites may be accessed.
> Level 2 identity proofing provides sufficient assurance for routine
> transactions. In order to obtain Level 2 credentials, the user must
> have his identity verified in-person (using a government issued ID) by
> a Local Registration Authority (LRA). Additional guidance will be
> coming, in early FY 04, from NIST regarding alternative methods to
> "in-person" identity proofing. For example, in-person may be waived in
> the event that the person has maintained a known relationship with the
> USDA LRA for more than 1 year. A second alternative, available in a
> later phase of eAuthentication, is for the user to provide enough
> personal information to enable an "online identity-proofing" using
> various databases and a probability algorithm to determine the
> probability of the user's valid identity. Authentication to Level 2
> applications requires a secure password.

## Level 3 

Applications assigned Level 3 Assurance contain information and
transactions that are considered highly sensitive. Misuse of credentials
or authentication errors at this Level present significant risk to
company information and/or personnel and lead to inconvenience,
financial loss, distress, civil or criminal violations, risk of personal
safety. Users attempting to access Level 3 applications must have their
identities verified in person by a Local Registration Authority and
their physical address or phone number of record must be confirmed.
Authentication to Level 3 applications requires a PKI certificate

## Level 4

Applications assigned Level 4 Assurance contain information and
transactions that are considered extremely sensitive and confidential.
Misuse of credentials or authentication errors at this Level present
extreme risk to company information and/or personnel. Users attempting
to access Level 4 applications must have their identities verified in
person by a Local Registration Authority and their physical address or
phone number of record must be confirmed. In addition, a biometric of
the user (e.g. fingerprint or photograph) must be taken and retained in
the records. Authentication to Level 4 applications requires a PKI
certificate and a "hard" token, that is, a physical device that must be
present to accomplish authentication such as a smart card.

# Assurance Level Examples

This section contains examples of portal applications that may be
assigned to each Assurance Level.

## Level 1 Assurance- No-risk Applications 

Applications at this level require no validation of the user's identity.
Examples of Applications with Level 1 Assurance requirements:

1.  Agency surveys to be filled out by users and submitted for
    informational purposes. The user, in this case, poses no threat to
    the Agency's information or personnel.

2.  Applications providing users with general information - example:
    Agency calendar of events, newsletters, listservs etc.

3.  Personalization of website- example: when the user John Doe logs on
    to the USDA website, the welcome message "Welcome John" is displayed
    and user is then taken to pages of interest and relevant access such
    as market climate information, weather and stock market updates etc.

4.  Applications for which no user information needs to be verified, but
    an ongoing contact is required - example: a user requests a plant
    inspection but by law, the inspection must take place in person, and
    therefore all user data is confirmed by in-person inspection.

5.  Any other on-line service where no official transaction is conducted

## Level 2 Assurance- Routine Transactions 

Applications at this Level require evidence that the user is who he
claims to be. Examples of Applications with Level 2 Assurance
requirements:

1.  A loan application that requires an address to which confidential
    information and documents (e.g. check or money order) must be sent.

2.  Loan application- loan officers must access applicants' confidential
    personal information. The officer's identity must therefore be
    verified prior to accessing the loan application and applicant
    information.

3.  Farmers' periodic reports of product yields and production.

4.  Related to example 4 in section 3.1 above -- access to the results
    of these applications (if published electronically and not simply
    mailed to the individual's address.

5.  Any other on-line service where an official transaction is conducted
    AND where traditional means of asserting the identity of the person
    doing the electronic transactions. As discussed in Section 2.1,
    either identity or data may be confirmed outside of the user
    authentication process.

## Level 3 Assurance- Sensitive Applications and Information

Applications at this level require validation of user's identity. Misuse
of credentials may pose a significant risk to company information and/or
personnel. Examples of Applications with Level 3 Assurance requirements:

1.  Research materials and reports that either are not yet protected by
    Intellectual Property Agreements (patents, copyright)

2.  Applications that rely on the electronic identity of the user to be
    able to continue USDA's mission, for example if Farm Aid was only
    disbursed based on the electronic permission of the Secretary rather
    than traditional means (paper signature, verbal permission etc.) --
    in this case, the electronic identity of the user (the Secretary) is
    critical to USDA's mission.

3.  Applications that make information available that can affect market
    profits and losses -- for example an application allows Internet
    access to agricultural marketing predictions.

## Level 4 Assurance -- Extremely Confidential Applications

Applications at this Level require in-person identity proofing as well
as a biometric for records. Misuse of credentials may pose extreme risk
to company information and/or personnel. Examples of Applications with
Level 4 Assurance requirements:

1.  Applications through which food inspectors certify that food
    imported into the US is free from disease or contamination.

2.  Applications through which scientists request permission to handle
    and/or order hazardous biological substances for R&D purposes (for
    example, a person may need permission to obtain certain dangerous
    strains of bacteria for testing on meat and produce.)

##   {#section-2 .unnumbered}