# Presentation: 224431

## Your Total PKI Solution

**ACES**
- Access Certificates for Electronic Service

## What is ACES?

**Access Certificates for Electronic Services (ACES) provides the American Public secure electronic access to privacy related Federal Government information and services through the use of public key technology.**

- Authentication
- Access Control
- Data Integrity
- Technical Non-Repudiation

## A Full Service Public Key Infrastructure Solution

- ACES provides a Government-wide public key infrastructure with strong authentication using identity-based digital signature certificates.  The ACES PKI offers:
- Identity Proofing
- Certificate Issuance
- On-Line Validation
- Certificate Management
- Optional Hardware Tokens
- Supplemental PKI Services

## For whom?

*For whom?*

- Relying Parties

- US Federal Agencies

- Clients

- US Public &
- Trading Partners

**ACES**

## Building Trust

***Government***

*Building Trust*

***Independent Source ***
***Databases***

- On Line Registration
- Verify Identity Exists
- Verify Requestor owns Identity
- Verify Affiliation

- Identity Proofing may be provided by the Industry Partner or by the Government at the Agency’s discretion.

- Identity
-   -based
- Certificate

***Applicant***

## Defining Need

**Application and Transfer of Benefits**
**Application and Administration of Grants**
**Submission of Reporting or Filing Requirements**
**Exchange of Personal/Private/Proprietary Information**
**Procurement Actions**

**Five categories of Government to Public communications have been identified by OMB that could require this strong authentication.**

**Agencies should consider the need for such strong authentication when deciding which on line applications need ACES protection.**

*Defining Need*

## Why ACES?

**Provides a Government-wide Public Key Infrastructure.**
**Provides a Complete Solution for PKI Needs**
**Reduces overall costs by aggregating Government requirements.**
**Allows individual agencies to leverage off each other’s requirements**
**User friendly - Clients can have one certificate to do business with multiple agencies**

## Task order based competition
CLINS 2-7 
Certificate issuance for users
Industry partner identity proofing
Government identity proofing
Economical, Cost effective

Transaction-based validation pricing 
Set by contract
Common across all awardees
Transaction costs are volume banded
Higher use = lower rates
$1.20 to $.40 per transaction
Pay as you go

**CLINS 2-7 **
**Certificate issuance for users**
**Industry partner identity proofing**
**Government identity proofing**
**Economical, Cost effective**
**Transaction-based validation pricing**** **
**Set by contract**
**Common across all awardees**
**Transaction costs are volume banded**
**Higher use = lower rates**
**$1.20 to $.40 per transaction**
**Pay as you go**

*Economical*

**Notes:**
  There are two types of pricing schemes in use in ACES:

  Certificate Issuance is task order based and competed among industry partners.

 Discounts for Government provided ID proofing.

  Transaction validations costs are set by the contract and are volume banded.

  Each industry partner charges the same rates for validations.

  Volumes are aggregated across government

  Low volume - $1.20 per validation

  High volume - $0.40 per validation (cost of a stamp?)

## Flexible

**Each Agency determines its requirements**
**Services available a la carte**
**Supplemental PKI Services include:**
**Needs analysis**
**Risk Assessment**
**Application Development**
**System Integration (PKI Integration)**
**Hardware Tokens for Agencies**

## Agency Control

- Agency determines access based on certificate status and identity
- Good guy lists
- Agency binds certificate identity to specific record data through second level proofing
- First time or every time
- Agency retains the right to deny access at any time

*Agency Control*

**Notes:**
  Agencies are in control of the process:

  They ultimately decide who may have access.

  First visit requires “second level proofing,” determined by agency, to tie common name in certificate to specific record in the agency database.

Agencies can deny access at any time for any reason. 

  Cannot revoke certificates, only deny access.

  Revocation can only be done by certificate owner or issuing authority.

## Agency Responsibilities

**Assess Current Capability**
**Determine Requirements**
**Define Application**
**Identify Constituency**
**Is there overlap with another application/requirement/agency**
**Estimate Certificate Usage Factor**
**Develop Statement of Work**
**Include Implementation Strategy**
**Foster Culture Change**

## Industry Partners

**Keren Cummins****	****kcummins@digsigtrust.com**
**301-921-5977****	****www.acesaccess.com**

**Daniel Turissini****	****turissd@orc.com**
**703-535-5301****	****aces.orc.com**

**Tim Hurr****	****	****timhurr@att.com**
**703-691-5352****	****www.att.com/aces**

*Industry Partners*

## Contact Information

- Steve Duncan	202-708-7626     Stephen.Duncan.@gsa.gov

*ACES Contracting Officer*

- Jon Faye	202-708-6099     jon.faye@gsa.gov

*Business Development*

- Helen Chapman   202-708-9639   Helen.Chapman@gsa.gov

*www.gsa.gov/aces*

*Contact Information*