CSCIP Module 4, Smart Card Usage Models – Mobile and NFC
Total Page:16
File Type:pdf, Size:1020Kb
Module 5: Smart Card Usage Models – Identity, Security and Access Control Smart Card Alliance Certified Smart Card Industry Professional Accreditation Program Smart Card Alliance © 2015 CSCIP Module 5 - Identity and Security FINAL - Version 5 - May 7, 2015 1 For CSCIP Applicant Use Only About the Smart Card Alliance The Smart Card Alliance is a not-for-profit, multi-industry association working to stimulate the understanding, adoption, use and widespread application of smart card technology. Through specific projects such as education programs, market research, advocacy, industry relations and open forums, the Alliance keeps its members connected to industry leaders and innovative thought. The Alliance is the single industry voice for smart cards, leading industry discussion on the impact and value of smart cards in the U.S. and Latin America. For more information please visit http://www.smartcardalliance.org. Important note: The CSCIP training modules are only available to LEAP members who have applied and paid for CSCIP certification. The modules are for CSCIP applicants ONLY for use in preparing for the CSCIP exam. These documents may be downloaded and printed by the CSCIP applicant. Further reproduction or distribution of these modules in any form is forbidden. Copyright © 2015 Smart Card Alliance, Inc. All rights reserved. Reproduction or distribution of this publication in any form is forbidden without prior permission from the Smart Card Alliance. The Smart Card Alliance has used best efforts to ensure, but cannot guarantee, that the information described in this report is accurate as of the publication date. The Smart Card Alliance disclaims all warranties as to the accuracy, completeness or adequacy of information in this report. Smart Card Alliance © 2015 CSCIP Module 5 - Identity and Security FINAL - Version 5 - May 7, 2015 2 For CSCIP Applicant Use Only TABLE OF CONTENTS 1 INTRODUCTION ................................................................................................................................. 6 2 SMART CARD DRIVERS AND BENEFITS FOR IDENTITY AND SECURITY APPLICATIONS ................................................................................................................................................................. 7 2.1 HOW TODAY'S IDENTIFICATION SYSTEMS CAN FAIL......................................................................... 7 2.2 WHAT MAKES AN IDENTIFICATION SYSTEM SECURE ........................................................................ 8 2.3 SMART CARD BENEFITS FOR IDENTIFICATION SYSTEMS ................................................................... 9 2.3.1 Support for Physical and Digital Identity ........................................................................ 10 2.3.2 Authenticated and Authorized Information Access .......................................................... 10 2.3.3 Strong ID Card Security ................................................................................................... 10 2.3.4 ID Credential Security ..................................................................................................... 10 2.3.5 System Component Authentication ................................................................................... 10 2.3.6 Smart Card Support for Privacy Requirements ................................................................ 10 2.3.7 Smart Card Support for Strong Authentication ................................................................ 11 2.3.8 Smart Cards and Biometrics ............................................................................................ 11 2.3.9 Enhanced Business Case with Multiple Applications....................................................... 11 2.3.10 Enhanced Convenience for Users .................................................................................... 11 2.3.11 Ease of Integration and Deployment in Information Technology Systems ....................... 11 2.3.12 Improved Life Cycle Management ................................................................................... 12 2.3.13 Flexible Support for Migration Using Multiple Technologies ......................................... 12 2.3.14 Support for Multiple Form Factors .................................................................................. 12 2.3.15 Interoperable, Standards-Based Technology ................................................................... 12 2.4 SUMMARY ....................................................................................................................................... 12 3 IDENTITY CARDS AND TOKENS .................................................................................................. 15 3.1 IDENTITY CARDS ............................................................................................................................. 15 3.1.1 Security Printing Features ............................................................................................... 16 3.1.2 Security Devices ............................................................................................................... 17 3.2 USB TOKENS .................................................................................................................................. 17 3.3 ONE-TIME PASSWORD TOKENS ....................................................................................................... 18 3.4 MOBILE DEVICES AND IDENTITY AUTHENTICATION AND ACCESS CONTROL APPLICATIONS .......... 19 3.5 STANDARDS FOR IDENTITY APPLICATIONS ON SMART CARDS ........................................................ 19 4 EPASSPORTS ..................................................................................................................................... 21 4.1 EPASSPORT FEATURES AND SPECIFICATIONS .................................................................................. 21 4.1.1 Contactless Chip .............................................................................................................. 21 4.1.2 Biometrics ........................................................................................................................ 21 4.1.3 Logical Data Structure ..................................................................................................... 22 4.1.4 ePassport Security Measures ........................................................................................... 22 4.2 EPASSPORT VALIDITY AND ICAO PUBLIC KEY DIRECTORY ........................................................... 23 4.3 U.S. EPASSPORT SECURITY MEASURES AND USE ............................................................................ 24 5 PHYSICAL ACCESS .......................................................................................................................... 26 5.1 PACS COMPONENTS ....................................................................................................................... 26 5.2 PHYSICAL ACCESS CONTROL PROCESS (NON-U.S.-FEDERAL GOVERNMENT USE) ......................... 27 5.2.1 The ID Credential ............................................................................................................ 29 5.2.2 The Card Reader .............................................................................................................. 29 5.2.3 The Control Panel ............................................................................................................ 30 5.2.4 Access Control Server ...................................................................................................... 30 5.3 PHYSICAL ACCESS CONTROL SYSTEM DATA FORMATS .................................................................. 31 5.4 OPERATIONAL RANGE ..................................................................................................................... 31 5.5 SECURITY CONSIDERATIONS ........................................................................................................... 31 Smart Card Alliance © 2015 CSCIP Module 5 - Identity and Security FINAL - Version 5 - May 7, 2015 3 For CSCIP Applicant Use Only 5.5.1 Card Security ................................................................................................................... 32 5.5.2 Data Protection ................................................................................................................ 32 5.5.3 Card and Data Authentication ......................................................................................... 32 5.5.4 Card to Card Reader Communications ............................................................................ 33 5.5.5 Card Reader to Control Panel Communications ............................................................. 33 5.6 RECENT TRENDS IN SYSTEM ARCHITECTURES ................................................................................ 34 6 LOGICAL ACCESS ............................................................................................................................ 36 6.1 OVERVIEW OF LOGICAL ACCESS AUTHENTICATION TECHNOLOGIES .............................................. 37 6.1.1 Passwords ........................................................................................................................ 37 6.1.2 Biometrics ........................................................................................................................ 41 6.1.3 Public Key Cryptography ................................................................................................