1. Smart Card Authentication Mechanism Tim W. Baldridge, CISSP Marshall Space Flight Center Office of the Chief Information Officer

2. 2 Briefing Overview I. Background II. Process III. System Overview/Description IV. Conclusion

3. 3 Background o A Token must provide interoperable, enhanced security compared to magnetic stripe and similar serial data transmission security technologies o Token encoding must be highly tamper, counterfeit, and cloning resistant

4. 4 Process o A Token is issued to a holder by a home of record issuer in an enrollment process following the Federal Identity Credential Model o Issuer policy defines a level of assurance associating a token to a holder o The issuer manages the data structure and contents of issued tokens o The issuer maintains and does not reveal master token and application write access keys to a holder or other party

5. 5 Process (cont.) o A holder initiates an access transaction to a Physical Access Control System (PACS) application which has free read to token identification (SEIWG) and validation data (MAC) o A holder initiates a enrollment transaction to access a PACS or related support system in cooperation with or independent of the issuer according to issuer policy and token configuration *An enrollment transaction is distinct from an access transaction*

6. 6 Message Authentication Code (MAC) UID (7 bytes) Concatenation 3DES CBC SEIWG (25 bytes) Magnetic Stripe MAC (4 bytes)

7. 7 Access Transaction (enter door) Card Managed MAC List Un-Managed MAC List Door Reader Card 1. Request 2. RATS (UID) Select File Read Binary 5 No Match/Security List Exists 6 No Match 7 Authenticate Card Denied 3. Generate MAC Match 4. Check No MatchMatch No Match/ Un-managed List Exists Secured MAC FID List Denied Data Validated No Match/ No Lists Exist Data Validated Select File Read Binary Select File Read Binary

8. 8 Conclusion o This solution can be utilized by legacy systems and new systems with minor upgrades o Solution is relatively secure and can be built quickly o Validation and authentication is optional and may be performed at the reader, panel, or system o Authentication data must not interfere with PACS authorization mechanisms