Attachment B ISP Livescan Connection Requirements_V0~1.pdf

1 Illinois State Police Live Scan Connection

Guidelines and Protocol

Illinois State Police, Bureau of Identification

1.1 Scope

The Illinois State Police are committed to ensuring that all criminal justice information is secure and adheres to State and FBI CJIS security requirements. The recent upgrade of the State’s ABIS allows for the ability to meet current and future guidelines associated with criminal justice information. It is important for all criminal justice and non-criminal justice vendors, who submit criminal justice information to the State, adhere to the proper requirements ensuring that all information is appropriately protected. This document outlines the technical and policy requirements that are to be followed in order to continue to provide criminal justice services that require partnership with the State

ABIS.

1.1.1 ABIS SFTP Connection

This section contains the specifications on how input devices submit NIST data to the ABIS AMF workflow. The discussion is limited to software and procedural considerations. Specifications for network hardware and physical connections are discussed elsewhere.

The term “input device” refers to live scan or card scan.

Each live scan device will submit National Institute of Standards and Technology (NIST) format text and images to the NEC STC (Submission Transaction Controller) using the SSH File Transfer Protocol

(sometimes referred to as Secure File Transfer Protocol or via it’s commonly known acronym SFTP).

Device ID

Group ID

Unique User ID

Unique Password

TCP/IP address

Name of the Host to access

When these data items are obtained, the live scan device will use the following procedure each time it initially connects to the network:

• On initial connection, the live scan device will be delivered into the live scan’s home directory. The live scan device will then proceed to navigate to the path provided by the

Illinois State Police after appending the sending device DID to the root path.

• Verify that it has the latest versions of any environment files, tables, validation files, forms or data sets by examining files found in the common partition and copying newer files to the proper location on the live scan device. It shall be the responsibility of the live scan device to look for and copy file updates from the common partition.

• Read an environment file in the common partition that contains the name of a root path partition to which submissions will be sent.

• Mount the submission partition named in the environment file after appending the sending device DID to the root path.

For each submission the live scan device will:

• Write the NIST data to the live scan device id directory.

• Write a signal file to a predefined directory.

1.1.2 CJIS Guidelines

All devices that are used to transmit, store or receive CJI require encryption in accordance with: (a)

Federal Information Processing Standard Publication (FIPS) 140-2; (b) National Institute of Standards and Technology (NIST) Special Publication 800-57 Recommendation for Key Management – Part 1:

General (Revision 3); (c) NIST Special Publication 800-57 Recommendation for Key Management – Part

2: Best Practices for Key Management Organization; and (d) NIST Special Publication 800-111 Guide to Storage Encryption Technologies for End User Devices. Advanced Encryption Standard (AES) with cipher strength of 256-bit is minimally required.

1.1.3 Connection Security Requirements

The Landing Server that the ABIS employs is utilizing SSH-2.0-OpenSSH_7.2. Any connections made to this server must be compatible with the specifications outlined in Table 1. If not the connections will not be able to be properly authenticated and submit data.

Table 1: Technical Requirements

SUPPORTED ALGORITHMS

KEX ALGORITHMS SUPPORTED

ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521

HOST KEY ALGORITHMS SUPPORTED

ssh-rsa ecdsa-sha2-nistp256

ENCRYPTION ALGORITHMS SUPPORTED

aes128-ctr aes192-ctr

SUPPORTED ALGORITHMS

aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com

MAC ALGORITHMS SUPPORTED

hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com hmac-sha1-etm@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha1 mailto:aes128-gcm@openssh.com mailto:aes256-gcm@openssh.com mailto:hmac-sha2-256-etm@openssh.com mailto:hmac-sha2-512-etm@openssh.com mailto:hmac-sha1-etm@openssh.com