Becoming FIPS 201 compliant is a challenge

How AMAG Technology helped the DoD become PIV compliant


The US Department of Defense (DoD) issues Common Access Cards (CAC) to over 4 million military, retried military and contractors throughout the world. DoD was tasked with complying with the Federal Information Processing Standards (FIPS) Publication 201. FIPS 201 is a federal government standard that specifies Personal Identity Verification (PIV) requirements for Federal employees and contractors.

AMAG Technology partnered with the DoD to upgrade an existing smartcard based access control system. AMAG Technology manufactures intelligent networked solutions scaled to manage security management challenges from small, remote facilities to multi-national organizations. Various groups within the DoD have AMAG Technology's existing Symmetry Security Management Systems that have been in place for as long as 10 years. The fully upgraded integrated system would address physical access control system (PACS) considerations in the DoD's mission to become Homeland Security Presidential Directive (HSPD) -12 compliant and utilize the next generation FIPS-201 compliant, DoD Common Access Cards.

The Symmetry Security Management System had to support the existing and the next generation FIPS 201 complaint Common Access Cards. Users would be issued their next generation Common Access Card when their older card expired, therefore there would be a number of years over which both versions of the card would be active.

AMAG Technology's Symmetry Common Access Card Reader with Symmetry Homeland Security Management System was chosen to implement the transition. The dual technology reader allowed the DoD to continue using their current access card (a contact chip smartcard with no contactless component) while upgrading to the FIPS compliant card that contains both contact and contactless interfaces.

"The system was originally designed before HSPD-12 using the SEWIG-012 Data Model, and it needed to move to the FIPS model," said AMAG Technology, Mid-Atlantic and Federal Regional Sales Manager, Walter Coady. "AMAG committed to the DoD that we would follow the evolution of FIPS 201 and manufacture a fully compliant reader."

Readers designed and manufactured prior to FIPS 201 were flashed to work. Using the Symmetry Common Access Card reader provided a cost effective solution due to its ability to be flash upgraded in the field. The reader offered the unique ability to read multiple smartcard technologies eliminating the need for an expensive hardware upgrade once all cards were FIPS-201/HSPD-12 compliant, and thus future-proofing the product.

Challenges

The DoD was an early adopter of using smartcards for physical access control. However, staying on top of ever-changing standards remained a challenge. AMAG has worked with the DoD and other Federal Government customers to support developing smartcard implementation guidance. In the Federal Government, standards often precede product availability. AMAG developed the Symmetry smartcard reader to meet customer demand.

Working through the process of developing a dual technology reader supporting both the earlier Common Access Card and the FIPS 201 compliant version was difficult. AMAG was developing the Symmetry reader at the same time the new cards were being developed, therefore there were no sample cards to work from. Understanding how the card was going to operate and how it would look was learned through trial and error.

The current security system needed to remain compliant and operational throughout the entire transition. Every time a card was swiped, the system had to work. Downtime was not an option. AMAG's engineering and product development team provided the migration path to full compliance with all of the specifications met.

This content continues onto the next page...