CoreStreet provides the critical Public Key Infrastructure certificate validation technology behind the DOD’s Robust Certificate Validation Service. The DOD implemented the CoreStreet Validation Authority as a solution for cost effective and scalable validation services for all 3.5 million service members and contractors.

With the CoreStreet PIVMAN Solution, DOD facilities can now perform electronic validation of identity and associated attributes, automatic updates when a connection is available, and capture of activity information for auditing purposes. Extending beyond the DoD, the CoreStreet PIVMAN Solution also enables validation of any federal, state or local credentials issued from FIPS-201 compliant or interoperable infrastructures, and of legacy credentials such as drivers’ licenses.

Applications that currently use this infrastructure include smart card logon, digitally signed email, access to secure web portals and authentication within web services architectures. The CoreStreet PIVMAN Solution provides the ability to extend the infrastructure supporting these logical access control functions to also support physical access control processes.

Bell ID’s ANDiS4FIPS201 offers U.S. government agencies a card and application management system enabling them to manage the lifecycle of the card and the PIV application it holds. The ten different containers on the card are managed individually by ANDiS, enabling items with different lifecycles to be held on the same card. In addition, ANDiS4FIPS201 supports open source interfacing, which allows for swift and seamless integration with other components of the PIV card-issuing infrastructure.

NIST tested smart cards–10 with a 128-byte-long key and seven using the more secure 256-byte key–passed the security and timing test using wireless data transmissions. On the accuracy side, one batch of cards met the criteria set by NIST and two others narrowly missed. More tests with additional cards are planned soon.

According to HSPD-12, most federal employees and contractors will be using federally approved PIV cards to authenticate their identity when seeking entrance to federal facilities. In 2006 NIST published a standard for the credentials that specifies that the cards store a digital representation of key features of the bearer’s fingerprints for biometric identification.

Currently, anyone entering a biometrically-controlled access point would insert his or her PIV smart card into a slot and place their fingers on scanner. The cardholder then enters a PIN that enables his fingerprint information to be read from the card and the card reader matches the stored data against the scanned image of the cardholder’s fingerprints.

In the recent tests, NIST evaluated the match-on-card process in which biometric data from the fingerprint scanner is sent to the PIV smart card for matching by a processor chip embedded in the card. The stored data never leave the card. The advantage of this type of validation is that, if the card is lost or stolen, the fingerprint template on the card cannot be copied.

NIST sought answers to two questions: whether the smart cards’ electronic keys can keep the wireless data transmissions between the fingerprint reader and the cards secure and execute the match operation all within 2.5 seconds; and second, whether the match-on-card operation will produce as few false acceptance and false rejection decisions as traditional match-off-card schemes that require more computer power.

“The eight agencies we reviewed—the Departments of Agriculture, Commerce, Homeland Security, Housing and Urban Development, the Interior, and Labor; the Nuclear Regulatory Commission; and the National Aeronautics and Space Administration—had generally completed background checks on most of their employees and contractors and established basic infrastructure, such as purchasing card readers. However, none of the agencies met OMB’s goal of issuing PIV cards by October 27, 2007, to all employees and contractor personnel who had been with the agency for 15 years or less. In addition, for the limited number of cards that had been issued, agencies generally had not been using the electronic authentication capabilities on the cards and had not developed implementation plans for those authentication mechanisms.”

The GAO recommends:

• “OMB establish realistic milestones for full implementation of the infrastructure needed to best use the electronic authentication capabilities of PIV cards in agencies.
• “OMB require each agency to develop a risk-based, detailed plan for implementing electronic capabilities.
• “OMB require agencies to align the acquisition of PIV cards with plans for implementing the cards’ electronic authentication capabilities. In response, OMB stated that HSPD-12 aligns with other information security programs. While OMB’s statement is correct, it would be more economical for agencies to time the acquisition of PIV cards to coincide with the implementation of the technical infrastructure necessary for enabling electronic authentication techniques. This approach has not been encouraged by OMB, which instead measures agencies primarily on how many cards they issue.”

Check back later for more information on the hearing.

• Opening Remarks
  Tim Baldridge, NASA

  MP3: click here

• Credentialing Interoperability in DHS Programs
  Tom Lockwood, DHS

  PDF: click here

  MP3: click here

• Backend Attribute Exchange
  Chris Louden

  PDF: click here

  MP3: click here

• Results of Winter Blast Exercise
  Craig Wilson, DHS/FEMA

  PDF: click here

  MP3: click here

• Status of NASA HSPD-12 Implementation
  Tim Baldridge, NASA

  PDF: click here

  MP3: click here

• TWIC Update
  Maurine Fanguy, TWIC PM

  PDF: click here

  MP3: click here

• SP 800-116 Strategy for use of PIV Credentials in PACS
  Bill MacGregor, NIST

  PDF: click here

  MP3: click here

• Closing Remarks
  Tim Baldridge, NASA

  MP3: click here

But funding is an obstacle. Half of respondents believe Congress should provide more funding to agencies to develop and implement identity management systems. Some 49% says it should require greater planning and collaboration among federal agencies and state and local governments. Forty-seven percent say that funding will increase over the next five years.

Other survey findings include:

• Fifty-nine percent of city, county and municipal government I.T. professionals are “very concerned” about compromised critical public infrastructure compared to 45% of federal officials or 38% of state officials;

• Some 56% of government I.T. professionals have either personally seen or heard about someone violating their organization or agency’s security protocols;

• National security is more of a priority for 53% of respondents even if Americans’ personal privacy is negatively impacted.

The survey, conducted by Pursuant Inc. in January, polled 474 respondents made up of U.S. federal, state, local and municipal government I.T. decision makers.

Participants include Temple University Hospital in Philadelphia, Crozer-Chester Medical Center in Chester, Pennsylvania, the George Washington University Hospital and the Department of Veterans Affairs Hospital, both in Washington DC.

Interoperable identity credentials for the Winter Blast demonstration are being issued using Probaris ID. The credentials are compliant with federal standard Federal Information Processing Standard (FIPS) 201 to remove the burdens associated with first responder identification and the lifecycle management of credentials.

The CoreStreet PIVMAN software for handheld devices and related backend servers will manage the credential validation and privilege attribution for nearly 200 participants of the Winter Blast demonstration.