1. San Francisco International Airport
Access Control and Biometrics Case Study
Kim Dickie, Asst Deputy Airport Director, - Aviation Security

2. Background Access Control System (ACS) MDI
and Ingersoll Rand Hand Geometry
installed 1991
Serve 20,000 airport ID badged employees
Terminal 2 Renovation Project
New domestic terminal w/ 14 gates
Select a new ACS and Biometric system
Identify need for migration plan for all terminal facilities
Smart Card Technology
Comply with new industry standards
Terminal closed since Opening in January No impact to opening date. Opportunity to identify new ACS and Biometric, SMART CARD. Completed an upgrade from an 0S2 to a Windows version, very challenging. No longer service needs of airport.

3. ACS and Biometric System - Current
Approximately 1500 airfield access portals
ACS Card Reader transactions
—over 200,000 / day
200+ access portals equipped with Card/ Hand Geometry Readers
Hand Geometry Reader transactions
—can exceed 35,000 / day
Deployed at all Airport controlled access portals leading directly to the Secured Area

4. Access Control System - Current
Turnstile Vestibule, Card
Reader/Hand Geometry, Access Portal

5. Biometric Technology – Current
How it works……………
Over 90 distinct hand measurements taken including:
Length
Width
Thickness
Surface area
3-D image acquired
9 byte template is generated

6. Biometric Technology - Current
Hand Geometry Facts
Easy to use
Low failure to enroll rate
2 out of 70,000
Fast verification
2 – 3 second average
Low false rejection rate—.1%
probability an authorized user is rejected
Hand Geometry Reader reliability
— greater than 99.9%

7. Biometric Technology - Future
Lumidigm™ fingerprint readers to replace infrared hand geometry readers
Multispectral imaging technology used to collect fingerprint information from below the surface of the skin
Avoids conventional fingerprint reader pitfalls:
Worn fingertips
Overly moist or dry skin
Soft press against reader
Susceptibility to fraudulent, artificial fingertips

8. Access Control System - Future
ACS system – Lenel OnGuard
HID iClass Elite “contactless” Card
Fingerprint, Hand Geometry, Mag stripe, proximity card
Space for a contact chip

9. Airport Badging/Credentialing Process – Current

10. CA DOJ Pre-Enroll Forms & Pre-Checks CHRC Manual Setup Enroll
Time for completion Not Controlled by Airport - CA
DOJ
CHRC
Manual
Setup
Enroll
Fingerprinting
Manual
Verification – inconsistent return rate – 3 places to check for approval
“No-Fly” List
Manual
Setup
Airport Security Training
Conduct
Document
Archiving
Manual
Filing
Badging & Card Issuance
Manual
Results
End Enroll
Audit
Manual Audit
Reports
FORMS AND PRE CHEKCS – Paper intensive process. First integration phase - In 2007 migrated majority of databases into a single database developed locally by a consultant called SAO database. Second integration phase - We were able to integrate the Identix LiveScan to the SAO database. When individual’s fingerprints and information are captured, populate the SAO database automatically. Third integration phase – audit of physical metal keys during re-badging process, eliminate auditing as a separate process.
FINGERPRINTING - In 2009, the Badging Office started conducting the CAL DOJ fingerprint submission. Previously, airport employee would have to go to downtown in the city to conduct this step of the background check in addition to the required TSA CHRC/STA. Badging Office was capturing two sets of fingerprints for the background check.
SECURITY TRAINING – In 2008, migrated from a video to CBT platform. Currently, still a separate database maintaining all training records for both safety/security classes.
BADGING AND CARD ISSUANCE – Paper process for filing all documents. Conducting Annual ID Audit as a manual process that takes months to complete.
PACS – Access is selected by badging clerk.
Manual
Physical Access
Privileges
Physical
Access
Manual Data
Reconciliation
Provision

11. Airport Badging/Credentialing Process – Future

12. Badging, Card, Key, Issuance
Automate
Data Input
Capture
Fingerprints
“No-Fly” &
“Selectee” list
CHRC
Background Check
Upload &
Verification CA
DOJ
Web Paper Forms
Pre-Enroll
Airport Security
Training
Document
Archiving
Conduct
Automate
Doc Mgmt
Automate Training
Registration
Badging, Card, Key, Issuance
End Enroll
Automate Result Upload
However by Automating the Processes:
 Reduce decision time. Improve processing time. Operational efficiency. Higher level of Security. Capability to create new rules.
WEB PAPER FORMS - Forms will be printed w/ a barcode, signed by employer, and when employee goes to Badging Office, the bar code will be used by the clerk to populate the database. Creating a web portal for Authorized Signers to access the start the process. Automated process for access requests and is pre-determined by position.
FINGERPRINTS - The enrollment record containing the biometric and biographic information for vetting required by federal agencies via BASIC concept. Information (like fingerprints, driver’s license, passport information, etc.), are captured and stored, in an electronic format on a centralized document management system, and mbedded in the enrollment software. Capture all biographic and biometric information for both TSA and City background process (CAL DOJ).
SECURITY TRAINING - Automate Training requirements by sending a URL to the Authorized Signatory validating completion of training prior to credential issuance. Identify all training requirements to obtain ID badge. Re-enforces policy of required training before issuance of ID.
BADGE ISSUANCE – All prior steps completed, wSAFE will allow clerk to issue ID Badge to employee. Continue to capture Fingerprint and Hand Geometry biometric. Issue new HID iClass Elite card w/ mag stripe and contactless chip.
PACS – SAFE boards both MDI and Lenel OnGuard at same time. Privleges are the same. Two ID numbers, Unique identifer on front and an airport number on back of card.
Audit
Automate Data
Reconciliation
Automate Audit
Reports
Physical
Access Privileges
Provision
Automate
Provisioning &
Role-based Access Privileges

13. Identity Management System (IDMS)
External
Processes
AAAE/TSC
(BASIC, CATSA)
No-Fly
Physical
Security
Documents
PACS
Biometrics
Smartcard
Third Parties
Background Check/ No-fly List
Vetting
Credential Check
Vehicle/Parking
Access Control
Biometric, Smart Cards
Document Mgmt
Be prepared to modify their processes and adjust to new regulations, policies and technology and to adhere to the BASIC concept of operations when finalized . By deploying the Airport IDMS system, the airport is positioned to adjust and change to all processes recommended by AAAE and the BASIC task force.
Rules based system allowing to create requirements. Manage Identities w/ airport policy. Added Safety/Security Enforcement Program, for example three citations, you lose your privileges, all agencies involved in Enforcement Program (Operations, Communications) would have ability to view history. Identify when an employee may lose privileges based on number of infractions.
Position airport to be able to participate in new initiatives, BASIC pilot, PKI applications, etc. Have left room on new HID card to add a contact chip. Eventually, E-Form will be authenticated by Authorized Signatory using PKI and barcode and printing of application goes away and is replaced w/ all electronic transactions
IDMS solution connects siloed systems into a common framework

14. IDMS – Automated Workflow
E-Form Credential Application
Eliminates duplicate data entry
Streamlines manual enrollment of biographic data
Badge creation is only allowed when:
STA & CA DOJ is approved
Role-based badge template selection
Twice Daily – SAFE is looking for STA
Setup alert for company-authorized designee,
Deactivate Card within 48 hours
Automatic Notification Process
Creates Authorized Signatory or Employer correspondence
Automated Compliance of TSA regulations
Audit process
Authorized designee training mandatory
SAFE Applies
Pre-Defined Rules
Other Policies that SFIA is using their IdM application to facilitate and automate include things like:
1. E-FORM Employers are responsible for the data entry for new employees through the entry into a web form that produces a barcode form. The barcode form that the employee submits to the Credentialing Office will auto populate the database, so as to alleviate fat-finger errors and labor hours. Steamlines manual enrollment
2. BADGE CREATION IS ONLY ALLOWED WHEN: Ensures compliance w/ background checks being completed prior to being able to issue a badge SAFE is checking twice daily to see if background checks have been approved. This still a manual process of checking for the return but now the credentialing officer merely checks off in SAFE and it triggers notifications to the actual badge creation office to go ahead and issue a badge.
3. Badge creation is only allowed once all background checks and approvals have been checked off within the system. Also, role based template selection makes it easy for a badging officer to determine the proper template as it is preselected by SAFE based upon identity attributes during the enrollment process. This ensures NO credentials are issued without complying.
4. SAFE monitors all cards, keys and passes that are provisioned to each individual so that if the individual is terminated there is a Failure to Return flag raised and communicated to the proper authorities to ensure outstanding cards and keys are returned. Notication sent to employere (Authorized )
5. Automatic revocation of access privileges based upon expiration date, training expiration and infraction record.
6. Alerts are sent to employers and Airport Security for lack of badge use in 90 days.
7. Multiple employers per identity – assigning a unique Person Id # to each employee for life, so that when they leave and if they come back their UID remains constant and their history can be traced.

15. BASIC Pilot Program SFO to BASIC : XML Web Services - HTTP, SOAP 1.1
Phase 1 – Biographic information completed
5-15 Day Exercise (Design, Test, Deploy)
Initial round of integration testing complete
Testing conducted remotely
Phase 2 – Biometric and Biographic in work
Integrate SAFE to Identix LiveScan – Fall 2009
Allow SFO to connect to BASIC
SAFE had passed the integration testing with BASIC and will conduct Biographic data exchange and STA security assessment, but are waiting for BASIC to get a “green light” on conducting the CHRC so we can exchange biometric.

16. Lessons learned so far……..
Identify IDMS requirements and opportunities
Phased approach - operational pilot
•        Create integration for Lenel to airports CAD system, Integraph. Was identified later in the process and ultimately became a critical path item. Public Dispatch managed by another department.
•        Created an operational test room, capability to also conduct acceptance test and training for clerks.
•       Work closely to identify network path multiple interfaces
Clearly define your current processes to identify potential cost savings
Evaluate Network system to identify requirements
Perform ROI - Metrics