Attachment_3_-_GSA_FICAM_compliant_System_Overview_-_Rev_2_0-_3dec21.pdf

GSA Compliant Reader (FICAM Reader category)

* Passes APDUs between PAM and smart card

* Passes responses to APDUs back to PAM

* Displays LCD prompts generated by PAM

* Varies LED color, based on commands from PAM

* Supports CAK, PKI + PIN, PKI + BIO

Application Server

Firewall

Internet

Access

OCSP/SCVP

Responder

Certificate

Authority(s)

HTTPS://

- Windows Server 2016 / 2019

- Symmetry v9.3-HSE (Enterprise or Professional)

Symmetry Professional

- Limited to SQL Express

- Limited to 512 readers

- Limited to nine (9) Thick Clients

- Requires added DATA-CONNECT license

Symmetry Enterprise

- Requires licensed SQL instance

- no software limit on readers count

- no software limit on thick clients

- Includes DATA-CONNECT license

Database Server (Optional)

- Windows Server 2016 / 2019

- Microsoft SQL 2017 / 2019

- Requires Symmetry Enterprise

Certificate Manager Server

Required if compliant reader count is above ten (10)

- Windows Server 2016 / 2019

- Microsoft SQL 2017 / 2019

- HID pivCLASS Certificate Manager v 5.12 or above

Optional

Credential Enrollment Workstation(s) minimum of 1 per system

Required to authenticate and validate federal credentials during enrollment

- Windows 10 Enterprise

- Symmetry Client license

- pivCLASS Registration Engine license

Symmetry Client Workstation(s) User interface to Symmetry

- Windows 10 Enterprise

- Symmetry Client license

M2150-Node(s)

M4000-Node(s)

See M2150 Node Architecture drawing for details

See M4000 Node Architecture drawing for details

3dec21 – tph rs485

The M2150 LAN chain can support up to

32 individual nodes, each with 16 readers, on one LAN connection rs485

AMAG Technology Symmetry 9.3 with HID pivCLASS

GSA FRTC 1.3.3 compliant solution

FICAM / HSPD-12 / FRTC 1.3.3 / FIPS 201-1, FIPS 201-2, FIPS-201-3

Head End / LAN / Controller Architecture pivCLASS Certificate Manager (Validation System and PACS Infrastructure component)

* Deactivates (de-provisions) credentials in PACS based on PD-VAL results

* Activates credentials when certificate revocation status transitions from unknown to known.

Symmetry SMS (PACS Infrastructure component)

* Maps PIV/PIV-I credential data elements to PACS database fields for provisioning/de-provisioning as well as activating and deactivating PACS credential records

* communicates to M2150 / M4000 controllers

- One (1) M4000-DBB (intelligent controller)

- One (1) M4000-DEC4

M4000-DDC

3dec21 – tph

M4000-DDC

rs

Each M4000 Node requires a dedicated LAN connection

M4000 nodes cannot be configured using a LAN chain

- Four (4) reader expansion board

- up to four (5) Five can be supported form one (1) M4000-DBB

M4000-DEC4

- Adding large Input / Output expansion boards DOES NOT impact reader capacity

HID

P.A.M

HID

P.A.M

- Support two (2) Readers

- Requires LAN connection

- Requires pivCLASS certificate Manger

HID pivCLASS Authentication Module (PAM)

W ie g a n d

W ie g a n d rs485 rs485

Reader 1

Reader 2 rs485 rs485

Reader 3

Reader 4

M4000-DEC4

AMAG Technology Symmetry 9.3 with HID pivCLASS

GSA FRTC 1.3.3 compliant solution

FICAM / HSPD-12 / FRTC 1.3.3 / FIPS 201-1, FIPS 201-2, FIPS-201-3

Field Hardware - M4000 Node Architecture

Supports up to 4 readers

M4000

DBB

The Federal M4000 controller series can support up to twenty (20) readers per Node

HID

P.A.M

HID

P.A.M

W ie g a n d

W ie g a n d rs485 rs485

Reader 5

Reader 6 rs485 rs485

Reader 7

Reader 8

M4000-DEC4

NOT SHOWN

Three additional M4000-DEC4 boards six Additional HID PAM modules support for a total of twenty GSA compliant readers, per M4000 node rs485 Full Duplex rs485 Full Duplex

Reader 9

Reader 10 rs485 Full Duplex rs485 Full Duplex

Reader 11

Reader 12 rs485 Full Duplex rs485 Full Duplex Reader 14 rs485 Full Duplex rs485 Full Duplex

Reader 15

Reader 16

Reader 13 rs485 Full Duplex rs485 Full Duplex Reader 18 rs485 Full Duplex rs485 Full Duplex

Reader 19

Reader 20

Reader 17

Please reference

COMPLIANT READERS page for GSA approved readers and reader connection details

LAN

M4000-DBB

M4000-DEC4

TCP / IP

Up to Four (4) M4000-DEC4 boards can be connected to the Host board ( 20 total readers)

Up to 4 Readers per M4000-DEC4

M4000-DEC4

M4000-DEC4

M4000-DEC4

M4000-DEC4

AMAG Technology Symmetry 9.3 with HID pivCLASS

GSA FRTC 1.3.3 compliant solution

FICAM / HSPD-12 / FRTC 1.3.3 / FIPS 201-1, FIPS 201-2, FIPS-201-3

Field Hardware - M4000 - Power

Sub boards can be up to 2000' from host controllers -with proper cabling and local controller power

M4000 / HID PAM Power

The M4000-DBB draws power from its host controller, and is NOT included in power budget calculation's

All Power budget calculations are listed at full draw (inrush)

• Each M4000-DEC4 and M4000-IOC20/16 requires 2amps @ 12vdc

• HID PAM modules require 2amps @ 12vdc.

• Each M4000-IPS (Intelligent Power Supply) provides 6.25 Amps @

12vdc

M4000-IOC20/16

M4000-IOC20/16

M4000-IOC20/16

M4000-IOC20/16

In this configurations, Add-On Input Output boards (20 inputs / 16 outputs per board)

REQUIRES added power supplies

To Host Controller

HID

P.A.M

(2)

(1) M4000-IPS

HID

P.A.M

(2)

(1) M4000-IPS

HID

P.A.M

(2)

(1) M4000-IPS

HID

P.A.M

(2)

(1) M4000-IPS

HID

P.A.M

(2)

(1) M4000-IPS

One M4000-IPS can support a combination of up to three (3) local M4000

Control boards or HID PAM modules

3dec21 – tph

HID - RKBCL40

924NPRTEK00504

Insert Card, enter card PIN

Assurance Level 2

HID – RKCL40

923NPRTEK0032V

Veridt – Stealth Dual

900W2036 series

Veridt – Stealth BIO

900W2030 series

Assurance Level 3

Insert Card, enter card PIN, verify Fingerprint

AMAG Technology Symmetry 9.3 with HID pivCLASS

GSA FRTC 1.3.3 compliant solution

FICAM / HSPD-12 / FRTC 1.3.3 / FIPS 201-1, FIPS 201-2, FIPS-201-3

Compliant Reader options rs485 rs485 rs485 rs485

Symmetry Application Server

Database Server

Certificate Manager Server

Optional

Credential Enrollment Workstation(s)

Symmetry Client Workstation(s)

M2150-Node(s)

0 M4000-Node(s) pivCLASS Authentication

Module(s)

8 Up to 16 Compliant Readers

Up to 16 Compliant Readers

Up to16 Compliant Readers

One LAN drop for each PAM

One LAN drop for each PAM

One LAN drop for each PAM

Up to 16 Compliant Readers8

One LAN drop for each PAM

Up to 20 Compliant Readers10 One LAN drop for each PAM

Up to 20 Compliant Readers10 One LAN drop for each PAM

Up to 20 Compliant Readers10 One LAN drop for each PAM

Up to 20 Compliant Readers10 One LAN drop for each PAM

Communication between

M2150 Nodes

Wiegand Data

(controller to PAM) rs485 Data

(PAM to reader)

Legend

AMAG Technology Symmetry 9.3 with HID pivCLASS

GSA FRTC 1.3.3 compliant solution

FICAM / HSPD-12 / FRTC 1.3.3 / FIPS 201-1, FIPS 201-2, FIPS-201-3

Example of larger system (144 readers)

System Components

• Application Server (1)

• SQL Server (1)

• Certificate Manager Server (1)

• Credential Enrollment Station (1)

• Symmetry Client (1)

• Lan Architecture (as needed)

• M2150-EN-DBU-xxK-MK2-HSE(4)

• M2150-4DC-F-HSE (16)

• M4000-DBB (3)

• M4000-DEC4 (15)

• HID PAM Modules (62)

• Card Readers (144)

Not Listed

• LAN Components

• Symmetry Software & Licensing

• Microsoft Operating System software

• Microsoft SQL

• Full instance if using Symmetry Enterprise

• Full instance for HID Certificate Manager

• Credential Enrollment hardware

• controller and PAM:

• Power supplies

• Enclosures

• Cabling

• Misc conduit etc