HID Global’s pivCLASS Registration Engine provides the VA Financial Services Center with a single, PIV-compliant access control credential. The Financial Services Center in Austin, Texas is an organization of the U.S. Department of Veterans Affairs that offers a range of financial and accounting products and services to both the VA and other government agencies. When the Financial Services Center and its 300 employees moved into a brand new facility it needed to implement an access control and credentialing system that would both enable it to manage the access of its employees and also comply with FIPS-201, which requires a common identification standard for Federal employees and contractors as mandated by the government thanks to HSPD-12, Homeland Security Presidential Directive 12. Secured government buildings With few reference points within the U.S. Department of Veterans Affairs, the VA Financial Services Center would enter unchartered territory as it began the process to implement Personal Identity Verification (PIV) cards as its credentialing solution for all of its employees and contractors. VA Financial Services Center needed to implement a solution, verify the cardholder’s identity, and then harvest the data for use The project was one of the first of its kind where a government facility planned to use the full capabilities of the PIV card for its employees and contractors to gain physical and logical access to secured government buildings and computer resources, according to Royce Cox, account manager at Tech Systems’ local Austin office. Tech Systems served as the systems integrator for the Financial Services Center project. To use the full capabilities of the PIV card, the VA Financial Services Center needed to implement a solution that could validate each employee’s PIV credential, verify the cardholder’s identity, and then harvest the data for use with a physical access control system. Effective access control The VA Financial Services Center turned to HID Global’s pivCLASS Registration Engine software, to provide a solution with the ability to receive, store, recall and send information in a secure fashion from each PIV card to the physical access control system. pivCLASS Registration Engine, a software-based solution, is used in conjunction with the Software House C•CURE 800/8000 physical access control system to allow the VA Financial Services Center to use the PIV card as a single card access control solution facility-wide. Card holders use the PIV ID card to gain access into the building and verify privileges once inside the facility. “This system allows us to automate the entry of PIV badge information into the physical security system, ensuring effective access control. Additionally, it allows us to easily grant limited access (areas within the building and time access) to VA employees visiting from other stations, which eliminates the need for visitors to wait for daily passes,” said Howard Harrison, VA Financial Services Center Facility Manager. “Also once in the system, as long as there is not a badge change we can grant access on an as visit basis.” Revocation status of the cardholder If at some time in the future it finds that a certificate has been revoked, it can go in to the C•Cure system and suspend the card as well" In addition to using the PIV cards for internal facility and logical security access purposes, the Financial Services Center continuously checks the revocation status of the cardholder of the FIPS 201 compliant card on an ongoing basis. “After registering the PIV cards in the VA’s C•Cure 800 access control system via pivCLASS Registration Engine, our software revalidates all the certificates that we know about each day,” said Geri Castaldo, vice president of Business Development, Federal Identity with HID Global. He further added, “If at some time in the future it finds that a certificate has been revoked, it can go in to the C•Cure system and suspend the card as well as send an email to a distribution list and say that it found a revoked card.” Results Today, the Financial Services Center uses its PIV cards to manage the access of employees and contractors at its Austin, Texas facility. In addition, employees also use their PIV cards to log onto their computers, providing for a more secure environment within the facility.
The Port of Wilmington, which opened in 1923 and handles nearly 400 vessels and 4 million tons of cargo each year is the busiest port on the Delaware River, and the leading North American importation site for fresh fruit, bananas and juice concentrate. It was also the first seaport to use the Transportation Worker Identification Credential (TWIC) card, beginning with the TWIC Technology Phase pilot program in October 2003. TWIC is designed to add a layer of security at ports by ensuring that workers in secure areas have received a background check and do not pose a national security threat. As the TWIC program expanded as part of the Maritime Security (MARSEC) criteria, so did the need for a software program that could read and record information from both the existing TWIC protype cards used with the port’s physical access control system and the latest TWIC cards. In addition, it was important to find a solution that would allow the port to access the Transportation Security Administration’s (TSA) ‘TWIC Cancelled Card List’, a real-time database of unauthorised TWIC users, so port security personnel can quickly identify those with revoked rights. Port officials chose HID Global’s pivCLASS Registration Engine software, which drives the Datastrip mobile readers and also resides on a desktop enrolment workstation in the port’s main office pivCLASS Registration Engine software Recognising this need, Port of Wilmington officials began exploring their options for software that could work with their existing Honeywell security management platform, Pro-Watch and work on mobile card readers to deploy the enrolment process throughout the facility. Port officials chose HID Global’s pivCLASS Registration Engine software, which drives the Datastrip mobile readers and also resides on a desktop enrolment workstation in the port’s main office. An additional license for certificate management allows the port to re-validate TWICs each day, once they are enrolled with the Honeywell system. Operational with Datastrip’s DSV2+Turbo mobile card readers Before the Port of Wilmington became a pilot site for the TWIC smart card program, it relied on 125kHz proximity cards and readers for worker identification. With the advent of TWIC compliance standards, port officials needed a way to register TWIC cards with their existing Honeywell Pro-Watch physical access control system and enter cardholder data into their database that would merge both TWIC and existing ID cards. With this merger, the port would need only one card for the access control system. It was also important to be able to enrol TWIC cardholders at the various access points to the port, which spans 307 acres of land. Therefore, the software needed to be functional with rugged mobile card readers, such as Datastrip’s DSV2+Turbo. TWIC credentials are required for entry to the port by anyone requiring frequent, unescorted access to the facility that is entirely designated as a secure and restricted area Finally, Port Security wanted the ability to access the TSA TWIC Cancelled Card List and match it against those being enrolled in the Port’s database as well as those using their TWIC cards. This would allow Security to take the appropriate steps when necessary, such as suspending a card, identifying people who were already enrolled in the Port’s database and not double enrolling them, or spotting a potential terrorist. TWIC Credentials for entry to the port By using pivCLASS Registration Engine, which was deployed on mobile Datastrip readers as well as a desktop computer, port officials are now able to register TWIC holders throughout the port and transmit that information to the Pro-Watch system. These cards can then be read at the fixed card readers located at various entrances and access points throughout the port. TWIC credentials are required for entry to the port by anyone requiring frequent, unescorted access to the facility that is entirely designated as a secure and restricted area. These include longshoremen, truck drivers, surveyors, agents, chandlers, port chaplains and labourers who access secure areas. Tenants who have their offices at the port, such as produce giants Chiquita and Dole, are also required to be enrolled in TWIC. Integrated with existing access control system Patrick Hemphill, retired Manager, Port Security and Facility Security Officer at the Port of Wilmington who lead this project said the mobile readers have been taken to local union halls to enrol longshoremen before they arrive at the port. “This saved us a lot of time,” explained Hemphill. “We met with union leaders and set aside two, two-hour periods on pay days. The members were made aware of the need to know their PIN and we were able to enrol the majority of (union) members during those two days without interrupting their work schedule.” After seeing a demo of the software, and its ability to read TWIC card information, Floyd-Kennard recognised it as a possible solution that could be integrated with the port’s existing access control system pivCLASS Registration Engine first came to the attention of Port of Wilmington’s Director of Human Resources, Sylvia Floyd-Kennard during an American Association of Port Authorities conference. After seeing a demo of the software, and its ability to read TWIC card information, Floyd-Kennard recognised it as a possible solution that could be integrated with the port’s existing access control system. Testing the software in-house Eric Schaeffer, President of Advantech Inc., the port’s systems integrator on the TWIC project, said one of the deciding factors in using this software was the ability to test the software in-house before making a commitment. He wanted to ensure that it would integrate with the existing Pro-Watch system. “Some companies have reservations about testing before buying,” Schaeffer noted, “but HID Global was confident in their product and were comfortable with us testing it.” Since this was one of the first implementations of pivCLASS Registration Engine software integrated with the Honeywell Pro-Watch system, Schaeffer said HID Global worked alongside Advantech to make sure everything worked as planned. Registering TWIC FASC-N number and expiration date For a major facility such as the Port of Wilmington, being able to enrol TWIC holders and verify their information anywhere using a mobile card reader results in a savings of security personnel, time and effort. Personnel can go where the enrolees are, rather than requiring everyone to come to a central location. The port is also able to continue to leverage its legacy physical access control system while adding in the important TWIC component. The pivCLASS Registration Engine software allows the port to register TWIC information, such as the TWIC FASC-N number and expiration date, into the existing PACS cardholder record" “The pivCLASS Registration Engine software allows the port to register TWIC information, such as the TWIC FASC-N number and expiration date, into the existing PACS cardholder record,” said Geri Castaldo, vice president of Business Development, Federal Identity with HID Global. “If a new person is added, Pro-Watch automatically creates a brand-new cardholder record using the information from the TWIC such as first name, last name, FASC-N, expiration date and photo.” pivCLASS Certificate Manager Checking against the TSA TWIC Cancelled Card List is a key benefit with the addition of HID Global’s pivCLASS Certificate Manager. The pivCLASS Certificate Manager goes out to the TSA list and re-validates the TWIC card status daily or on a user-defined schedule, so security personnel can see what has changed and react to the status of cardholders. In the case of an elevated threat level, HID Global’s software is able to provide the additional authentication piece that would be required. If the threat level at the port is raised under the three-level MARSEC system, it can the use required use of a fixed readers with a biometric component.
Christopher Columbus and his Spanish colonisers brought sugarcane into the Dominican Republic at the end of the 15th century. Today, agriculture is one of the most important sectors of the Dominican Republic’s national economy and sugarcane is the country’s most important agricultural product. The processing of the sugarcane stalk produces sucrose, the main product of sugarcane. Cane accounts for about 80 percent of the world’s sugar produced, while most of the remaining percentage is made from sugar beets. Named after the man who is credited with bringing the crop into the Dominican Republic, Cristobal Colon is the second largest producer of sugarcane in the country based in San Pedro de Macoris, 45 miles east of Santo Domingo. Getting compensated accurately The company produces sugarcane in two regions of the Dominican Republic with the second site about 30 miles west of Santo Domingo. While 95 percent of the company’s revenue comes from sugarcane, Cristobal Colon also produces meats and fruits, including mangos and pineapples. Overall, Cristobal Colon owns about 23,000 hectares (or around 57,000 acres) of land, on which approximately 3,500 migrant personnel work during the harvesting season between December and May. Off-season, the company continues to employ about 1,000 people on its plantations. With such a busy harvesting season and employees that are paid in cash, Cristobal Colon was having difficulty making sure that its workers were getting compensated accurately. The company, like many others that have large amounts of migrant workers, was relying on ID cards and management’s visual verification of each person to make sure that the correct individuals were receiving their cash wages. Sometimes workers did not have their ID cards with them, and they were using another individual’s ID card to collect wages that were not their own. Espinal and his team began researching for a fail-proof way to better identify workers for cash payments out in the field Biometrically authentication “It’s a very weak way to identify people; sometimes we just had to trust that the co-worker was identifying himself correctly,” said Edgar Espinal, information technology manager at Cristobal Colon. A few years ago, Espinal and his team began researching for a fail-proof way to better identify workers for cash payments out in the field. A previous failed attempt with one software developer left Espinal searching the Internet for a software company that could help, which is how he came upon HID Global and its credential verification software development division in the United States. Cristobal Colon asked HID Global to develop a custom product that would allow them to biometrically authenticate their employees before handing them their wages, without the use of cards or certificates. Rather than a one-to-many match process to verify if a person has certificates or access to a particular site, Cristobal Colon needed a way to identify a person one-to-one, to ensure they were who they said they were. Development of the software Managers out in the field needed to know if the person giving them his fingerprint was in fact the exact person he claimed to be. “Our basic need is to know who the person giving us their fingerprint is,” said Espinal. “It took about four months to fully develop.” HID Global relied upon the expertise of employee Miriam Celi, a software engineer whose native language is Spanish To develop the solution for Cristobal Colon, HID Global relied upon the expertise of employee Miriam Celi, a software engineer whose native language is Spanish. Celi developed the software to meet the sugarcane producer’s specific needs, and wrote the program in Spanish, which included all of the manuals and graphical displays. “When we received the call from Edgar at Cristobal Colon, we knew this was going to be a unique project,” said Geri Castaldo, vice president, Business Development, Federal Identity with HID Global. “Not only was it an interesting use case for biometric software, but it’s the first time we’ve developed a solution in Spanish.” Handheld mobile readers Once HID Global developed the software to be used without cards for identification, Cristobal Colon’s IT staff built an interface with the company’s human resources and payment systems. They tied it together using handheld mobile readers from Intermec with Edgeline Technologies’ PIV endcap, which includes a Sagem compact biometric module. “It is of great importance to know we are paying the right people, regardless of whether they have a personal ID with them or not,” said Espinal. Employees are first enrolled on a desktop computer at the company’s headquarters by taking their fingerprints and making sure there are no duplicates in the system. The fingerprints are stored in the company’s HR database along with a PIN for each person. Espinal and his team were worried that the system would run into problems identifying people, since many of the workers have worn out fingerprints Problems identifying people That data is pushed to Intermec handheld devices equipped with Edgeline fingerprint accessories for use in the field. Managers on the plantation sites then use the handheld devices to scan fingerprints and PIN numbers before paying the employee. If both steps are exact matches, the worker receives their wages. Initially, Espinal and his team were worried that the system would run into problems identifying people, particularly since many of the workers have worn out fingerprints or calluses on their hands from manual labour. “We were expecting violations and a lower rate of positive ID because of the nature of them working with their hands,” Espinal explained. “We have had a few people try to misidentify themselves, but it hasn’t been possible. We have had 100% validation with no false positives or non-validations. It has exceeded our expectations.” Streamlining business practices The sugarcane producer began with 10 mobile devices and soon after increased its count to 30. Most recently, Cristobal Colon added eight more mobile devices, and more tablet PCs and desktop stations running the software to keep up with new applications that its IT staff continues to develop. One of those new applications that Cristobal Colon has found useful is tying the biometric information it has for employees into its cafeteria payment system. “Employees validate themselves with their fingerprints in the cafeteria and it goes directly into our payroll system,” Espinal explained. “We are very excited about that and it’s something that the software made possible for us to do.” As Cristobal Colon’s needs have expanded, the sugarcane company has found more possibilities to use its HID Global biometric verification software that go beyond paying workers in the field, and they continue to look for ways to use the software to simplify and streamline business practices even further. Company wants to have a way to ensure they are providing the appropriate people with their allotted number of services Expanding biometric enrolment Cristobal Colon is currently in the process of gearing up to use the software to develop a Census application, which will expand biometric enrolment into the company’s database to include family members of employees and people living in the community. The company provides a number of services to community members, such as sanitary services, education and medical services and the company wants to have a way to ensure they are providing the appropriate people with their allotted number of services, as well as making sure services are not duplicated. “We want to know every one’s biometric signatures, and better track what services are being used and who is getting the services,” Espinal said. “These are all things that we couldn’t have developed without the right partner. HID Global really worked with us to find a unique solution for our market that we couldn’t find anywhere else, and together, we developed a terrific product.”