1. Department of Defense Biometrics Management Office 1 Department of Defense (DoD) Common Access Card (CAC) and Biometrics Integration (CBI) Overview http://www.biometrics.dod.mil Phone: (703) 604-2096 Fax: (703) 604-3031 DSN: 761-2096 biometricsoffice@hqda.army.mil Min Chong ISS Program Manager Department of Defense Biometrics Management Office mchong@iss-md.com Spring 2004 ADP IT and Acquisition Training Conference 27-29 April 2004

2. Department of Defense Biometrics Management Office 2 To provide an overview of the CAC-Biometric Working Group (CAC-BWG) efforts in pursuing the inclusion of biometrics technology with the CAC Purpose

3. Department of Defense Biometrics Management Office 3 Agenda 1. Background 2. CAC-Biometrics Technology Demonstrations 3. Road Ahead

4. Department of Defense Biometrics Management Office 4 Biometrics Biometrics is the automated recognition of a person using distinguishing characteristics 1. Background

5. Department of Defense Biometrics Management Office 5 Biometrics and DoD Changes in today’s military…  Global operations  Distributed working & warfighting scenarios  Increased reliance on information technology  Dependence on extensive electronic situational awareness in the battle space …require a paradigm shift in identity assurance.  Connect identity to biometrics  Link actions with identity  Employ a “human-centric” approach

6. Department of Defense Biometrics Management Office 6 Biometrics Addresses the Gap Claimed Identity  “Official” Documents  Tokens & Keys  PINs & Passwords Status Quo 100% Identity Management  Biometrics  Enterprise Solution Objective Deficiencies in  Identity Authentication  Access Control The Gap

7. Department of Defense Biometrics Management Office 7 Personnel Identification Replaces the “ID” Card Personnel Identification Replaces the “ID” Card Building Access Systems & Network Access with PKI Application Provides: - Digital Signature - Data Encryption Issue Date 1999SEP03 Geneva Conventions Identification Card Army Active Duty Parker IV, Christopher J. Rank LTCOL Pay Grade O5 Expiration Date 2002SEP01 Armed Forces of the United States SAMPLE Common Access Card CAC is a Smart Card that serves as…

8. Department of Defense Biometrics Management Office 8 1. Coordinate and analyze requirements for CAC-Biometrics. 2. Seek commonality and interoperability in applications. 3. Assist combatant commands, Services, Agencies, and Functional Community Panels. 4. Evaluate biometrics alternatives. 5. Develop and recommend a CAC-Biometrics integration solution. 6. Recommend related CAC-biometrics hardware and software. 7. Recommend related CAC-biometrics policy and legal Issues. 8. Develop the business case. 9. Develop the roadmap for successful integration of biometrics with the CAC. “ CAC-BWG Objectives” Smart Card Senior Coordinating Group (SCSCG) Establishes the CAC-Biometrics Working Group (CAC-BWG) Identity Management Senior Coordinating Group (26 Sept 2001)

9. Department of Defense Biometrics Management Office 9  The strategy to achieve a DoD Enterprise CAC- Biometrics solution is a two-phased approach –Phase I: Technology Demonstrations –Phase II: Demonstrate suitable Enterprise Solution  The three Technology Demonstration Concepts are: 1.CAC-A: Biometrics/PIN 2.CAC-B: Template on CAC Application 3.CAC-C: Contactless with CAC Inclusion of Biometrics Technology 2. CAC-Biometrics TD

10. Department of Defense Biometrics Management Office 10  Four scenario proof-of- concept: 1.Store on Server-Match on Server 2.Store on PC-Match on PC 3.Store on CAC-Match on server 4.Store on CAC-Match on CAC  Phase I of CAC-A has two distinct parts: –Part 1: develop biometrics solutions –Part 2: DMDC develops an applet (“Access Control Applet”) that supports a generic PIN/key solution Technology Demonstration CAC-A (Biometric/PIN) Rank LTC Armed Forces of the United States Army Active Duty Parker IV, Christopher J. SAMPLE Pa y Gr ad e O 5 Issue Date 1999SEP03 PIN Access to CAC CAC-A Biometrics as an Alternative to the PIN

11. Department of Defense Biometrics Management Office 11 Access the CAC  Next Generation CAC –64k smart cards –Contactless capability (TBD) –Version 2 Applet –Utilizes the Access Control Applet (ACA) –Set Access Control Rules to access the CAC  Current Status –Version 1 Applet –Must utilize the PIN –Users often forget their PIN –Interim CAC PIN Reset (CPR) Solution Issue Date 1999SEP03 Geneva Conventions Identification Card Army Active Duty Parker IV, Christopher J. Rank LTCOL Pay Grade O5 Expiration Date 2002SEP01 Armed Forces of the United States SAMPLE Integrated Circuit Chip (ICC)

12. Department of Defense Biometrics Management Office 12  CAC-B is a follow on effort from CAC-A Scenario 3  CAC-B focuses on placing the Biometric Attribute Certificate on the CAC –Logical Access 1.Log on to Windows 2000 2.Secure Website –Physical Access 1.CAC + Biometric 2.Biometric + PIN Technology Demonstration CAC-B (Template on CAC Application) Rank LTC Armed Forces of the United States Army Active Duty Parker IV, Christopher J. SAMPLE Pa y Gr ad e O 5 Issue Date 1999SEP03 Biometric On CAC CAC-B Logical Physical The CAC as a carrier for the Biometrics

13. Department of Defense Biometrics Management Office 13  CAC-C focuses on three biometrics contactless solution: –Physical Access System –Portable Physical Access System –Physical Access System that uses a turnstile  Provide an interoperable contactless physical security solution  Evaluation in progress Technology Demonstration CAC-C (Contactless with CAC) Rank LTC Armed Forces of the United States Army Active Duty Parker IV, Christopher J. SAMPLE Pa y Gr ad e O 5 Issue Date 1999SEP03 Contactless CAC-C Mifare and DESFire Contactless Technology

14. Department of Defense Biometrics Management Office 14 Proposed CAC-A /B Phase II Efforts  Merge CAC-A and CAC-B into one Phase II effort  CAC-A/B Phase II effort is a two parts process: –Part 1: Concept Refinement –Part 2: Technology Development 3. Road Ahead

15. Department of Defense Biometrics Management Office 15 Part 1: Concept Refinement  Focus the scope and evaluate two distinct capabilities –Store Biometrics on Card and perform Match-On-Card Capability –Store Biometrics on Card and perform Match-Off-Card Capability  Coordinate the Match-On-Card development effort between the CAC-BWG and the DMDC-West  Conduct further analysis and study to determine the optimal capability for DoD

16. Department of Defense Biometrics Management Office 16 Part 2: Technology Development  Leverage the results and lessons learned from the CAC-Biometrics Phase I efforts  Develop prototype capability that reflects the optimized CAC-Biometrics solution for DoD –Identify operational and security requirements –Demonstrate the business process and systems architecture –Recommend appropriate standards

17. Department of Defense Biometrics Management Office 17 Summary  Biometrics on or with the CAC may open the door to enterprise use of biometrics throughout the DoD  The use of CAC with the biometrics authentication capability is vital to achieving a secure Information Assurance posture for the Defense Information Infrastructure

18. Department of Defense Biometrics Management Office 18 Questions ?

19. Department of Defense Biometrics Management Office 19 Department of Defense Biometrics Management Office Biometrics Fusion Center http://www.biometrics.dod.mil/ BFC Help Desk: (304) 842-0730 x 2233 helpdesk@dodbfc.army.mil