Transportation Worker Identification Credential (TWIC)...TWIC = “secure and reliable form of identification” Linear 1D Barcode Contactless Chip 17 Steve Parsons July 2005 Transportation

Transportation Worker Identification Credential (TWIC)

Steve ParsonsDeputy Program Manager, TWIC

July 27, 2005

2Steve Parsons July 2005Transportation Worker Identification Credential (TWIC)

Who Am I? How do you know?


TWIC Program

VisionA high-assurance identity credential that is trusted and used across all transportation modes for unescorted physical access to secure areas and logical (cyber) access to systems.

Goals

• Improve security

• Enhance commerce

• Protect personal privacy


Strong focus on identity assertion• Establish and maintain the integrity of the chain of trust for identity

management• Bind: cardholder-credential-biometric-threat assessment-valid issuer• If it’s printed on the card, it’s on the chip(s)

Drive excellence in use of biometrics for physical access solutions• ICAO/ANSI/ISO standard photograph• ANSI standard fingerprint minutia• ANSI standard fingerprint pattern• ANSI standard IRIS

TWIC Priorities


• An original type, form, or instance serving as a basis or standard for later stages.

• An original, full-scale, and usually working model of a new product or new version of an existing product.

• An early, typical example.

Source: Dictionary.com (Copyright © 2005, Lexico Publishing Group, LLC. All rights reserved).

Prototype


TWIC Phase III: Issuance Locations


Prototype Phase Workflow


Lessons Learned

• Functional• Technical• Programmatic


Functional

- Trusted Agents- Enhance identity vetting- Standard Operating Procedures essential- Adjudication requirements- Sponsorship- User Acceptance / Functional Qualification Testing


Technical• Technical standards / specifications / guidelines• Maximize Commercial Off The Shelf (COTS) components • Biometrics

– Standards– Conforming products– Alternatives

• Common topology– Document Security Alliance

• Physical Access Control System (PACS)– Integration

• Readers• Infrastructure readiness• Legacy Cardholder Conversion


Programmatic- Personnel transition/turnover- MOAs- GFE/P must be ready- Independent Verification / Validation (IV&V)- Privacy (independent assessment)- Volunteer participants- Physical presence / frequent communication- Plan for system demos and presentations- Conformance to HSPD-12—glad we did


TWIC Process

Employee1:n biometric search

Name-BasedTerrorist-Focused Risk Assessment

1:n biometric search

Name-BasedTerrorist-Focused Risk Assessment

Database QueriesDatabase Queries

EnrollmentCenters

Identity Management

System (IDMS)

Card Production Facility

Local Facilities

1

23

4

56

7

8

Numbers Indicate Workflow Order

Employee

Employers

* Future CHRC


Summary• TWIC is a high-assurance identity credential (“above the

line”)• TWIC was used as reference model during development of

FIPS 201 (implements HSPD-12)• Scalable - able to serve multiple communities of interest• Local facilities grant/deny access (i.e., “below the line”)• Biometrics can help protect personal privacy / improve

security• Reliance on open, standards-based technologies improve

opportunities for interoperability


For additional information…

Look at the TWIC Website at:

http://www.tsa.gov/public(click on “Industry Partners”)

AND

E-mail the TWIC Program at

[email protected]


Magnetic stripe with FASC-N**Federal Agency Smart Credential Number

PDF-417 with Name, GUID**Global Unique IDIntegrated Circuit Chip (ICC)

Prototype CredentialTWIC = “secure and reliable form of identification”

Linear 1D Barcode

Contactless Chip


Overt Security Features


Covert Security Feature

UltravioletImage


GUID

FASC-N

Digital Photograph

Additional post issuance information...

Operational biometric 2 ...

Operational biometric 1

PKI Encryption

PKI Signature

Operational biometric directory

Security object

Reference biometric

Cardholder Unique ID (CHUID) - PACS

General information

Card information

IssuerIdentityAssertion

Mandatory issuer controlled data Post issuance optional

Last name

Middle name

First name

ANSI standard right index fingerprint template

ANSI standard left index fingerprint template

CBEFF headers

Issuer asymmetric signature

Issuer public key information

Hash table

“Killer apps” (e.g., First Responders, Armed LEOs)

Training/Qualifications

Issuance Counter

Issuer ID

Card Type

Expiration Date

Issue Date

Contact Chip Data Model


GUID

FASC-N

Security object

Reference biometric

Cardholder Unique ID (CHUID) -PACS

General information

Card information

IssuerIdentityAssertion

Mandatory issuer controlled data Post issuance optional

Last name

Middle name

First name

Card type

Expiration Date

Issue Date

Issuance Counter

Issuer ID

Digital photograph - ANSI/ICAO standard

Both index fingerprints - ANSI standard pattern

Both index fingerprints - ANSI standard minutia

All containers use CBEFF

Issuer asymmetric signature

Issuer public key information

Hash table

“Killer apps”

Training/QualificationsCurrent solution = DESfire

Contactless Chip Data Model


HSPD-12: Secure and Reliable Forms of Identification

• Issued based on sound criteria for verifying an individual employee's identity

• Strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation

• Can be rapidly authenticated electronically• Issued only by providers whose reliability has been

established by an official accreditation process.

TWIC KioskProvides:

- Pre-enrollment and printing locator/appt. card- Any other web-based functionality (e.g. card status, lost

card reporting, etc.)

Mobile Enrollment Workstation

Documents

Transportation Worker Identification Credential (TWIC)...TWIC = “secure and reliable form of identification” Linear 1D Barcode Contactless Chip 17 Steve Parsons July 2005 Transportation