Will feds trust nonfederal ID card for contractors and agency partners?

Responding to private-sector demand for identity credentials that the government can trust, the CIO Council has established specifications for PIV Interoperability for nonfederal issuers, and the first commercial vendors have received certification to issue the cards.

PIV Interoperability — or PIV-I — remains a work in progress, said the General Services Administration’s Deborah Gallagher, co-chairwoman of the CIO Council’s Identity, Credential and Access Management subcommittee. “But it is working.”

CertiPath and VeriSign have been certified that they meet requirements of the Federal Bridge Certification Authority for issuing the interoperable cards, and some cards have been issued and are undergoing compliance testing, Gallagher said Feb. 3 at a conference on identity management held in Washington by the Digital Government Institute.

Related  coverage:

ID management’s weakness: ‘There is no demand’

NIST: National ID is not part of 'identity ecosystem'

The Homeland Security Presidential Directive 12 mandated the Personal Identity Verification card to establish a common, interoperable smart ID credential for executive branch employees and contractors. Technical standards for the card are set out in Federal Information Processing Standard 201.

PIV-I addresses a continuing problem of identity management: the need for interoperable credentials that can be verified electronically in the online and physical worlds.

“This isn’t a new story,” said Dan Turissini, chief technology officer of Widepiont and board member of the Federation for Identity and Cross-Credentialing Systems, a nonprofit industry group. “It’s still the same thing we’ve been trying to figure out for some time” — that is, how to make a card that multiple entities can trust while producing strong credentials that can be cost-effective and simple to use. “We have the technology; we’re just not using it.”

At the Defense Department, a Defense Installation Access Control working group is standardizing access control requirements for worldwide DOD facilities. A national architecture is being designed to share identity information and allow standard physical access control systems to authorize credentials. The scheme would use electronic authentication and could accept compliant nongovernment cards,such as PIV-I, said Air Force Lt. Col. Mark DiCarlo.

“The technology exists” to enable the scheme, DiCarlo said. “It’s a matter of policy.”

With the creation of the PIV card, nonfederal governments and the private sector also wanted cards that could interoperate with federal PIV systems and be trusted by federal agencies. But the FIPS 201 PIV standard is limited to federal use and has some requirements specific to the federal community, so some guidance was needed for nonfederal issuers.

The CIO Council released the first guidance on PIV Interoperability for nonfederal issuers in May 2009 and updated it last year. The guidance provides a set of minimum requirements for trusted nonfederally issued identity cards and addresses four barriers to trusted interoperability that the CIO Council identified.

• Common terminology for identity cards: A lexicon for differentiating a federal PIV card from a nonfederally issued identity card seeking PIV system interoperability must be developed.
• Technical requirements: For nonfederally issued identity cards to interact with federal infrastructure, basic technological requirements must be met.
• Identifier name space: Effective use of identity cards requires an identifier that is unique across all cards.
• Trusted identity: The fundamental purpose of an identity card is to establish the identity of the card holder. Therefore, an identity card must be issued in a manner that the federal government can trust.

PIV-I cards must meet not only technical specifications but also policies and procedures for vetting the identity of recipients and securely issuing cards. Commercial providers must cross-certify with the Federal Bridge Certification Authority to provide PIV-I credentials. A revised X.509 Certificate Policy for the Federal Bridge Certification Authority was published addressing PIV-I issuing procedures and addresses cross-certification.

Several nonfederally issued cards already have been developed, including the First Responder Authentication Credential, Transportation Worker Identity Credential and Airport Credential Interoperability Solution. PIV-I would enable general availability of a card that could be used with government.

Although PIV-I cards are intended to be fully interoperable with government PIV systems, agencies are not required to accept the cards. The program only provides minimum requirements for enabling trust. Each organization will make its own decision on whether to trust the cards. They may not be used in place of PIV cards if those government-issued cards are required, and they will not replace First Responder Authentication Cards, Transportation Worker Identification Credentials, Aviation Credential Interoperability Solution cards or other industry-specific credentials.