Government-issued Identification Credentials: Issues and Opportunities Facing the Government ID Marketplace

1
Government-issued Identification
CredentialsIssues and Opportunities Facing the
Government ID Marketplace

• Randy Vanderhoof, Executive Director, Smart Card
  Alliance

RFID Security Workshop Johns Hopkins
University January 23, 2008
2
Who we are

• Smart Card Alliance mission
• To stimulate the understanding, adoption, use
  and widespread application of smart card
  technology through educational programs, market
  analysis, advocacy, and industry relations . . .
  .in the United States and Latin America.
• Over 180 members, including participants from
  financial, retail, government, corporate, and
  transit industries and technology providers to
  those users
• Major activities
• Conferences, symposia, web seminars
• Educational workshops and on-line training
• Web-based resources white papers, reports,
  industry product and services
• Industry and Technology Councils
• Identity Council
• Contactless Payments Council
• Healthcare Council
• Physical Access Council
• Transportation Council

• e-Passport
• Federal Government ID
• Identity Best Practices
• Privacy Security

3
My role is
4
Common Requirements for Identity Credentialing in
the U.S.

• Secure identity credentialing process for
  issuance
• Validation of source documents
• Trusted agents for enrollment and issuance
• Process for digital keys and certificate
  management
• Process for rapid revocation
• Authenticate individual and credential
• Common Machine Readable Technology (MRT) present
• MRT links to physical characteristics
  (biometrics)
• Security features to protect the physical
  credential and the data elements in the MRT
• Security and Privacy must be Baked In for
  cardholders to accept credential and use it

5
Identification Technologies and Applications Vary
by Use Case

• Identity credentials comes in a variety of
  shapes, card types and capabilities

6
Passports, IDs, Drivers Licenses
7
ePassport in the United States

• 1 million e-Passports
• issued every month
• 15 million issued to date
• As of June, all passports issued are
  e-passports

• Currently, 82 million passports in the USA,
  expected to exceed 100 million by 2010
• New travel rules for US, Canada, and Caribbean
• Preferred ID lasts 10 yrs

8
U.S. ePassport Security Technologies

• Most secure level of chip technology used
• RF shielding in cover
• Basic Access Control
• Derived key from MRZ
• Key unlocks chip data
• Reader accepts data
• Randomized chip number
• No fingerprint biometrics stored

9
Government ID Badges

• HSPD 12 (PIV) Card
• All Federal employees
• Dual interface 64K chip
• Fingerprint biometrics
• First Responder (FRAC)
• Federal and state issued
• Uses Federal FIPS 201 standard
• Voluntary program lead by DHS
• Port Security ID (TWIC)
• Federal ports central issuance
• Fingerprint and background check
• Contactless for access

10
Drivers Licenses

• Issues
• Drivers License is de facto National ID
• Must show government photo ID to travel
• No federal standards for issuance or card
• No longer valid for re-entry to U.S. at borders
• REAL ID Legislation Goals
• New standards for who, what, and how
• MRT chosen is 2D Barcode, no Chip
• Estimated cost 3.3 billion over 7 years

11
Identity Technology VariesWhich is the right one
to use?
ePassport
Federal ID Badge
Security features added as usage requirements
change

• Security
• Secure contactless chip
• Encryption
• Biometrics facial image
• MRZ data with Basic Access Control
• RF Shielding
• Secure printing

Citizen Border ID- PassCard ?

• Security
• Secure dual interface chip
• Encryption
• Biometrics - fingerprint
• (4) Digital Certificates
• Secure printing

Drivers License

• Security
• RFID Tag
• Database match
• MRZ data
• Secure printing

• Security
• 2D Barcode
• Secure printing

12
Education Needed for Identity Technology Options
-Which is the right one to use?
13
Major Issues Effecting Government-issued Identity
Credentials

• Emerging standards and policies
• Who sets the standards of the machine readable
  technology
• Who sets the policies for issuance
• Who enforces the rules governing usage
• Defining standards/policies in the context of the
  usage model
• Technology and issuance choices
• Secure smart cards vs. RFID vs. Other
  technologies
• Centralized issuance vs. local distribution
• Evolving access infrastructure standards
• Physical access systems migration
• Logical access identity, assurance levels
• Privacy concerns
• Preparing for unforeseen attack threats
• Funding concerns

14
Thank you . .

• Randy Vanderhoof, Executive Director, Smart Card
  Alliance
• 191 Clarksville Rd. Princeton Junction, NJ
  08550
• rvanderhoof_at_smartcardalliance.org
  Phone [phone]
• www.smartcardalliance.org