# Presentation: 379442

## Federal Identity Management and Smart Cards

***Federal Smart Card Project Managers Meeting***

**John G Moore**
**Chair Federal Smart Card Project Managers**
**Government Services Administration **
**johng.moore@gsa.gov **

- Wednesday March 9 2005
- 09:30 to Noon
- DC Renaissance Hotel
- At 4th Annual Smart Card Alliance Conference

**Notes:**
Prepared 2002 0319 1900 Tue
GSA Logo in a blue box

## Federal Smart Card Project Managers Meeting

- An Historic Moment
**A Standard for an interoperable Federal ID Smart Card **
**“****A nation’s talented people assume the burden of their country.”**
**“****How hard they must work!”**
- 	Mencius
- IAB team worked so hard, great results, but more to be done
- You’ll hear from speakers who’ve have been actually doing the work
- All speakers here deserve the credit, but not all are here who do
- This work is a great example of public private partnership

- Source: John G Moore, GSA, Mar 2005

## Federal Smart Card Project Managers Meeting

**You will hear speakers talking about the elements of HSPD12**
**HSPD12 ****– **Common ID Standard for Federal Employees & Contractors
**FIPS 201 ****– **Personal ID Verification of Federal Employees & Contractors
**SP 800-73 ****– **Interfaces for PIV (including Smart Cards) Card Edge PIV
**SP 800-76 ****– **Biometrics
**SP 800-78 ****– **Crypto (proposed)
-              Personal Identity Verification (PIV) of Federal Employees and Contractors
**The new Federal ID Smart Card SP 800-73 (scheduled to be published next week)**
**PIV 1 – October 27 2005**
**PIV 2 – October 27 2006**
**FY07 Budget**
-        Note –GSA Federal ID Management Handbook – Ralph Billeri of BearingPoint
**I anticipate questions about Agency Implementation Plans and Lessons Learned**
-       Note –Treasury’s request for Agency get together on planning – Trung Nguyen
-                                _http://csrc.nist.gov/piv-project/_

- Source: John G Moore, GSA, Mar 2005

## Homeland Security Presidential Directive HSPD12 Issued August 27 2005 

- Policy for a Common Identification Standard for Federal Employees & Contractors = FIPS 201** **
**             **Next challenges – Biometrics – Then Implementation Plans
- “Agency Implementation plans 4 months later”
**“****strongly resistant to identity fraud”**
**“****rapidly authenticated electronically”**
**“****issued only by *****authenticated *****providers”**
**“****physical access to Federally controlled facilities and logical access to Federally controlled information systems”**
- _http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html_

- Source: John G Moore, GSA, Dec 2004

- DONE Feb 25 2005

## Late Breaking NewsNIST SP 800-73 2nd draft released for public comment 

- NIST Special Publication for Interface for Personal Identity Verification (PIV) draft 2 has been released for public comment.
-      Responses are due back to NIST by 5:00pm EST March 22, 2005. (Exactly two weeks from today.) This document in conjunction with FIPS PUB 201 defines the federal identity or PIV card.
**         **_**http://csrc.nist.gov/publications/drafts/SP800-73-2ndDraft.pdf**_
**"Baldridge, Tim W. (MSFC-IS05)" <tim.w.baldridge@nasa.gov>**
- 03/08/2005 06:28 PM

- Source: John G Moore, GSA, Mar 2005

**Notes:**
Yellow Lightning Bolt

## Tying Together ID Management Components

_**Tying Together ID Management Components**_

**??? Vendor Community ???**

**Federal Agencies +**
**Private Sector**
**Electronic **
**Authentication**
**Partnership**
**(EAP)**

**Federal Agencies **
**(FICC)**

**Federal Agencies**
**with DOD **
**(FIXS)**

**2004**

**2005**

**Federal Agencies + Private Sector**
**Government Smart Card (GSCIAB)**
**Physical and Logical Access **

**DOD**
**(DCIS)**

**2006++**

- Source: John G Moore, GSA, Dec 2004

**Info Security **

**Physical Security **

**Human **
**Resources**

**eAuth PKI**

**Enterprise management **

**Privacy **

**Notes:**
Chart title = Timeline of eAuthentication Components
Chart displays overlapping circles show the relationship among the following organizations from 2004 to 2006+  

EAP	Electronic Authentication Partnership
DCIS	Defense Cross-Credentialing Interoperability System
FIXS	Federated Identity Cross-Credentialing System
FICC	Federal Identity Credentialing Committee
GSCIAB	Government Smart Card Interagency Advisory Board

Graphic art:
- School building with teacher opening front door for running children to enter
- Woman with gold earrings looking at monitor

## Goal of Smart Card Credential Interoperability

**Fitting the Pieces of**_** **_
_**SC Interoperability**_

_**Interoperability Components**_
**PHYS ****	****Physical/authentication/ID**
**LOGL ****	****Logical/Crypto/PKI**
**BIOM ****	****Biometric Templates**
**ARCH Architecture **
**BSI ****	****Basic Service Interface **
**API ****	****Application Profile Interface**
**TEST ****	****Conformance Testing**

**Getting agencies to **
**read and process cards**
**from different vendors**

**Card makes major impact **
**toward E-Gov and  E-Commerce **
**with access to buildings, internet,**
**transport, purchases, authorizations,**
**email and e-documents.**

_**Challenge – Fitting the Pieces Together**_

- Source: John G Moore, GSA, Dec 2004

**Notes:**
Smart Card with picture of American Flag, the Capital, a gold smart chip, and some clouds on a blue sky
Different colors making up a puzzle, each different color has an acronym associated with it:
ARCH, BSI, API, PHYS, LOGL, BIOM, TEST

## HSPD12 with IAB and FICC Working Groups

**FICC**
**Federal Identity **
**Credentialing Committee**

**SEIWG/FIC-N**
- Physical
- Access

**PAIIWG**
**Physical Access**
**Interagency**
**Interoperability**
**Working Group**

**DMWG**
**Data Model**
**Working **
**Group**

**CHUID**
- Cardholder
- Unique ID

**PWG**
**Policy**
**Working **
**Group**

**Policy**
- Smart Card
- Policy

**CTWG**
**Card Topology**
**Working **
**Group**

**Topology**
- Card
- Topology

**BIOM**
**Biometrics **
**Working **
**Group**

**BIOM**
- Personnel
- Identity

- Philip S. Lee – Smart Card Solutions, Inc. and John Moore GSA Dec 2004

**NIST**
- FIPS 201
- SP 800-73

**AWG**
**Architecture**
**Working **
**Group**

**IA**
- Identity
- Assurance
- Wk Group

**IA**
- Sources &
- Background

**HSPD12 with IAB and FICC Working Groups**

_**Sulak, Mike STATE**_

_**Finberg, Jack GSA**_

_** **__**Zok, Jim TRANS**_

_**White, M OPM**_

_**Broghamer, Joe DHS**_
_**Dray, Jim NIST**_

**Smart Card Interoperability **
**Reference Implementation**

**INCITS & ISO**

**HSPD12 PIV Project OMB/NIST**

_**Homeland Security Presidential Directive 12 Personal Identity Verification (PIV) of Federal Employees and Contractors**_

**GSC IAB**
**Government Smart Card**
**Interagency Advisory Board**

_**New**_

_**Thornton, Jeanette  OMB**_

_**Barker, Curt  NIST**_

_**Moore, John GSA**_

_**Parsons, Steve TSA**_

**TWG**
**Technical Working **
**Group (Industry)**

_** **__**Donelson, Bob Interior**_

_** **__**Spencer, Judith GSA**_

_**Baldridge, Tim NASA**_

**Notes:**
Chart title =Federal Credentialing Working Groups
This is an organizational chart showing the relationship of the Government Smart Card Interagency Advisory Board to the Federal Identity Credentialing Committee, the Electronic Authentication Partnership and the following work groups:
PAIIWG – Physical Access Interagency Interoperability Working Group
DMWG Data Model Working Group
AWG Architecture Working Group
CTWG Card Topology Working Group
IICPWG Interagency ID & Credentialing Policy Working Group
BIOM Biometrics Working Group

## Key Websites for HSPD12

- HSPD12 Homeland Security Presidential
- Directive 12 for Personal Identity Verification
- (PIV) of Federal Employees and Contractors
- 		_http://csrc.nist.gov/piv-project_
- Federal Smart Card Project Manager (GSA)
- 		_http://www.smart.gov/_ – under What’s New
- Federal Identity Credentialing Committee
- 		_http://www.cio.gov/ficc _
- Smart Card Alliance
- 		 _http://__www.smartcardalliance.org_

- Source: John G Moore, GSA, Dec 2004

## Key Websites for Federal Identity Smart Card Credentialing and Electronic Authentication

**Key Websites for Federal Identity Smart Card Credentialing and Electronic Authentication**

**• ****GSA Government Smart Card Handbook****	**
**	****	**_**http://www.smart.gov/smartgov/whats_new.cfm**_
**• ****Smart Card Handbook (in MS Word format)****	**_**http://www.smart.gov/smartgov/information/smartcardhandbook.doc**_
**• ****Smart Card Handbook (in Adobe Acrobat format) ****	**_**http://www.smart.gov/smartgov/information/smartcardhandbook.pdf**_
**Note – This Handbook complements the latest version of Policy Issuance regarding Smart Card Systems for Identification and Credentialing of Employees and provides more detailed guidance.**
**• ****Credentialing of Employees Policy Issuance****	**_**http://www.smart.gov/smartgov/information/scpfinal2004.doc**_
**	****(full title is **_***Policy Issuance regarding Smart Card Systems for Identification and Credentialing of Employees)***_
**• ****GSA Survey of Federal Smart Card Projects ****	**_**http://www.smart.gov/smartgov/information/smartcardhandbook.doc**_
**• ****e-Authentication ****	**
**	****	**_**http://www.cio.gov/eauthentication**_
**• ****Federal Bridge Certification Authority **
**	****	**_**http://www.cio.gov/fbca**_
**• ****Federal Identity Credentialing Committee **
**	****	**_**http://www.cio.gov/ficc**_
**• ****Federal PKI Policy Authority **
**	****	**_**http://www.cio.gov/fpkipa**_
**• ****Federal PKI Steering Committee **
**	****	**_**http://www.cio.gov/fbisc**_** **

- Source: John G Moore, GSA, Dec 2004

## Meeting Agenda 9:00 to 10:30

**09:30****	****Welcome to Meeting and Speaker Introduction**
**  ****John Moore – GSA Chair of Federal Smart Card Project Managers**
**09:45****	****Review of NIST Activities, Timetable, Objectives and Progress**
**  ****Jim Dray – Chief Smart Card Scientist for NIST**
**10:00****	****DOD and Technical Team Review of FIPS 201 and SP 800.73**
**Bob Gilson – DOD Contact Card Office and IAB Technical Team Leader **
**10:15****	****Coordination with OMB & Fed ID Management Handbook**
**  ****Judy Spencer – GSA Chair of Federal Identity Credentialing Committee**
**10:30****	****Networking Break **

- Source: John G Moore, GSA, Mar 2005

## Meeting Agenda 11:00 to Noon

**11:00****	****DHS View of FIPS 201 and SP 800.73 Activities **
**  ****Kevin Crouch – DHS Chief, Security Training & Technical Support**
**11:15****	****TSA Transportation Worker and Biometrics Update **
**  ****Steve Parsons – DHS TSA Deputy Program Manager of TWIC Program **
**11:30****	****A Review of IAB Activities and Timetable **
**  ****Tony Cieri – Representing IAB, Former Senior Leader of DOD Navy Smart Card Program **
**12:00****	****Adjournment**

- Source: John G Moore, GSA, Mar 2005

## End

**John G Moore **
**Chair, Federal Smart Card Project Managers Group **
**GSA Office of Electronic Government **
**1800 F St NW Room 2013**
**Washington DC 20405**
**202.208.7651****	**_**JohnG.Moore@gsa.gov**_** **

**End**

## Mainframes to Smart Cards

- Source: Ralph Billeri, BearingPoint, Dec 2004

**Notes:**
Photos of:
computer room with a computer operator sitting at a desk with a console on it, mainframes in the background
Locked cabinet on an elevated floor in a computer room
Keyboard, PC, and Monitor
Smart card that is blue with butterflies, gold smart chip, and the phrase Simera Classic

## What is a Smart Card?

- Credit card sized plastic card
- Integrated circuit chip that enables storage and processing of information.
- Contact interface
- Inserted into contact reader – makes physical contact with the reader.
- Contactless interface
- Embedded antenna - communication with the reader without physical contact.
- Multi-technology cards can have both.
- Note ** It is not just the card, but the infrastructure

- Source: Ralph Billeri, BearingPoint, Dec 2004

**Notes:**
This slide is meant to demonstrate the potential of smart cards in general.  Though no US implementations that I’m aware of take full advantage of this potential, it does exist, and as the technology and its infrastructure matures, we hope to see more and more people using it for multiple applications.

## What is Smart Card for Government?

_**Authen**_

_**tication Architecture**_

_**Encryption, Compression**_

_**Uses**_

**Pre-paid Money, Credit, Debit, **

**Authorizations, ID, Certificate**
**Secure eMail, eForms, Digital signature **

*** ****Proximity**** / Combi Chip are imminent - combining **
**       ****smart card and radio frequency into one chip**

*** RF indicates Radio Frequency Chip**

**A Multi-Application, Multi-Tech Proximity Smart Card**_**A Hybrid / Composite Card**_

- Source: John G Moore, GSA, 1994

**Notes:**
Smart card that is blue, with black magnetic stripe, a barcode, a place holder for a smart card chip and a digital photo
A dollar sign underneath the smart card, and stacked dollar bills

## Provides Cardholders with

- Portability, allowing users to carry their own identification information and to encrypt and decrypt sensitive data
- Access to buildings, information networks, and systems
- Higher level of assurance for secure email and e-transactions
- Increased security of information (magnetic stripe)
- A cost-effective and secure way to carry:
- PKI credentials
- Unique passwords/PINs
- Biometric identifiers
- Other Data (healthcare, financial)

- Source: Ralph Billeri, BearingPoint, Dec 2004

**Notes:**
This slide is meant to demonstrate the potential of smart cards in general.  Though no US implementations that I’m aware of take full advantage of this potential, it does exist, and as the technology and its infrastructure matures, we hope to see more and more people using it for multiple applications.

## Smart Card Applications

**Identity**
**Management**

**Ticketless Travel**
**Loyalty Programs**

**Building Security/Area Access**

**Secure**
**Network Access**
**Information Security**

**Healthcare**

**Debit/Credit Card**
**Electronic Purse**
**Mass Transit**

**Time and Attendance**
**Administration**

**Training Management**
**Qualification**
**Certification**
**Distance Learning**

**Mobile Communications**

**Drivers License**
**Work/Entry Permits**
**Parking**

- Source: Ralph Billeri, BearingPoint, Dec 2004

**Notes:**
This slide is meant to demonstrate the potential of smart cards in general.  Though no US implementations that I’m aware of take full advantage of this potential, it does exist, and as the technology and its infrastructure matures, we hope to see more and more people using it for multiple applications.

A spoke and wheel of graphic art.  The spoke is a white smart card that contains on it a female ID picture, barcode, gold smart chip, the females name (Mary) and her companies name (BearingPoint). The wheel consists of the following graphic art: smart card (Identity Management), skyscaper with a key entering a lock (Building Security/Area Access), red/white/blue credit card (Debit/Credit Card, Electronic Purse, Mass Transit), driver license (Drivers License, Work/Entry permits), a mans body stretching out in a circle (Healthcare), two PCs networked together (Secure Network Access Information Security), diploma and school books (Training Management, Qualification, Certification, Distance Learning), clock and time card being punched in (Time and Attendance Administration), airplane flying thru the clouds (Ticketless Travel, Loyalty Programs)

## Opportunity in the US

-  100
-  180
-    70
-  920
-  100
-   18
-  290
-   20+

- million mobile phone subscribers
- million Internet subscribers
- million wireless Internet subscribers
- million financial issued cards
- million Pay TV subscribers
- million Fortune 200 employees
- million tax paying American citizens
- millions of hardworking Government employees

- Source: Ralph Billeri, BearingPoint, Dec 2004

## Biometrics

- Biometric systems are essentially pattern recognition systems.
- Electronic, optical sensors or scanning devices capture images, or measurements that are later compared:
- Facial, fingerprint, iris, retina
- Hand geometry, signature, voice, odor, gait

- Source: Ralph Billeri, BearingPoint, Dec 2004

## Interoperability

-  Any card in any device for any application
-     _and why it’s important_
-  Remove potential barriers to adoption
-  Broaden acceptance and increase use and functionality
-  Bring smart cards to mainstream
-  Convenience and security for end-users

- Source: Ralph Billeri, BearingPoint, Dec 2004

## Federal Policy Convergence of SC, FICC and EAP Smart Card, Federal ID Credential & Elec. Authentication Partnership

-  **Transition of Electronic Authentication**
** ****From Federal to Federated**
-  **Implications on IT Architecture**
** ****Significant impact to bring legacy software up-to-date for full benefits **
**Draft Federal Identity Credential Smart Card Policy on** _www.smart.gov_ **is now official policy****, i.e. Presidential Directive**
** ****Issuance of Government Smart Card Handbook and Survey of Federal Smart Card Projects on **_**www.smart.gov**_
** ****Emergence of  Electronic Authentication Partnership and Federal Identity Credentialing Committee**
** ****Project to develop Federal Identity Credential Reference Guidebook (was targeted December 2004, ****now April 2005****)**

- Source: John G Moore, GSA, Dec 2004

**Notes:**
Chart Title = Federal Policy Convergence of FICC and EAP (Federal Identity Credential & Electronic Authentication Partnership)
 Transition of Electronic Authentication 
 From Federal to Federated
 Implications on IT Architecture 
 Significant impact to bring legacy software up-to-date to realize full benefits 
 Issuance of Government Smart Card Handbook and Survey of Federal Smart Card Projects on www.smart.gov
 Draft Federal Identity Credential Smart Card Policy on www.smart.gov
 Emergence of  Electronic Authentication Partnership and Federal Identity Credentialing Committee
 Project to develop Federal Identity Credential Reference Guidebook (targeted October 2004)

## Federal Identity Credential Smart Card Interoperability (and Operability)

- Interoperability definition - Any card / any reader / common application interface to basic card services
- Architecture - Card / Reader / Host / Software
- Physical Access, Authorization, ID Issuance
- Logical Access, Crypto / Public Key Infrastructure (PKI), Basic Services Interface
- Biometric Templates for multiple biometrics
- NIST-supported Conformance Test Suite
- Cross-credentialing backend to backend

- Source: John G Moore, GSA, Dec 2004

**Notes:**
Chart title = Federal Identity Credential Smart Card Interoperability(and Operability)
Interoperability definition - Any card / any reader / common application interface to basic card services 
Architecture - Card / Reader / Host / Software 
Physical Access, Authorization, ID Issuance
Logical Access, Crypto / Public Key Infrastructure (PKI), Basic Services Interface 
Biometric Templates for multiple biometrics
NIST-supported Conformance Test Suite
Cross-credentialing backend to backend

## CBNL Capabilities

-  Certificate Based Network Logon CBNL Novell COTS-based solution
-  (demonstrates an actual approach to logical access requirements)
-  Supports authentication to Local Area Networks (LAN) with CAC and DoD PKI Certificates per DoDI 8500.2 and 8520.2.
- Operating System Independent
-  Addresses all Limitations/Deficiencies inherent with Microsoft Smart Card Logon Solution
-  All DoD PKI Certificates are Supported, including software certificates
-  Strong, rigid passwords are managed by the CBNL “daily”
-  Temporary Smart Cards for those who “Forget Their CAC”
-  Can skew/extend the “validity period” of a CRL or disable CRL checking altogether eliminating the dependency on CRL availability
-  Supports Disconnected Mode Authentication
-  Supports Biometric authentication

- Borrowed from Novell Jim Thompson Dec 2004

## Progression of US Smart CardWhere are we now?

**1987 - FMS Electronic Cert Smart Card ****	****	****	****Pilot**
**1989 – Agric. Smart Card Food Stamp****	****	****	****Pilots**
**1991 - CardTech / SecurTech (CTST) Conf****	****	****	****Association **
**1993 - Smart Card Forum (SCF) Founded****	****	****	****Association**
**1994 - Ohio Statewide Food Stamp SC****	****	****	****Ltd Rollout**
**1995 – GSA Smart Pay Smart Card - Travel - Purchase Cards ****	****Contract**
**1996 - Treasury FMS pilots E-Cash - E-Check - E-Payments ****	****Pilots**
**1996 - Federal Smart Card Project Managers ****	****	**** Association**
**1999 - GSA Willow Wood Smart Card Pilot****	****	****	****Big Pilot**
**2000 - GSA Government Smart Card Contract****	****	****Contract**
**2000 - Defense Rollout****	****	****	****	****	****Big Rollout**
**2002 - Defense Rollout + others****	****	****	****	****Big Rollout**
**2003 - Defense Rollout + State Department + others****	****	****Big Rollout**
**2004 - Defense Rollout + NASA, Interior, GSA, VA****	****	****Big Rollout**
**2004 - Federal Identity Credentialing Committee (FICC) ****	****Policy Convergence**
**2004 - Presidential Directive of ****Common Fed’l ID Standard****	****Common Standard **
**2005+ Transportation Worker(TWIC), Transit, Passport, Visit****	****Expansion**

- Source: John G Moore, GSA, Dec 2004

**Notes:**
Big aqua colored arrow

## Issues and Outlook

- IAB work groups actively on-going
- IAB technology recommendations by 12.23.2004
- FIPS 201 by 02.25.2005
- _Issues_
- Interoperability
- Backward compatibility
- Don’t move too fast too soon
- _Outlook_
-  A common Federal Identity Credential standard that interoperates among agencies with all minimum capabilities declared, and allowing for the advance in technologies
- There will be net savings available if sought

- Source: John G Moore, GSA, Dec 2004

## Continuing Federal Activities 

-  We’ve come this far without the required charter and structure – this kind of structure is needed as we proceed
- Increased deployment of Federal Identity Credential Smart Cards by Federal Agencies
- Quasi-Governmental Federal Agencies such as Transportation Worker Identification Credential broadens scope to 16 million
- There is an effort for Federal acquisition contracts to change to allow State Governments will be able to buy these cards and infrastructure

- Source: John G Moore, GSA, Dec 2004