Driver's License and ID Card System RFP - Attachments B and C.pdf
PDF 5 MB Posted
- Solicitation number
- RFP-171-200000002245-4
- Issued by
- Michigan
About this file
This file contains attachment documents showing current Michigan driver's license and ID card layouts as well as network diagrams for the Michigan Department of State's (MDOS) Legacy Modernization system. The attachments detail the layouts for standard adult and minor cards with both REAL ID compliant and non-compliant indicators, enhanced cards that are REAL ID and WHTI-compliant, and a salvage vehicle agent card format. The network diagrams illustrate the technical infrastructure for the production environment, interfaces, E-Services, and AAMVA connectivity.
The documents provide detailed technical specifications showing card security features, layout standards, and data elements for each type of credential issued by MDOS. The network architecture diagrams map out the micro-segmented environments (PRES, APP, DATA), zones, firewalls, servers, and connectivity between systems including external interfaces with payment processors, verification services, and other government systems. Security classifications and protocols are indicated throughout the network diagrams, demonstrating the complex infrastructure required to support credential issuance and verification services.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment B Current Card Layouts
CURRENT STANDARD CARDS
Standard card formats are identical except each card has either a compliant REAL ID indicator or the non-compliant REAL ID indicator “Not for Federal Identification” printed on the front. (5 Adult and 6 Minor Formats)
Standard Adult Cards with REAL ID Compliant Indicator (5 Formats)
Standard Minor Cards with REAL ID Compliant Indicator (6 Formats)
Standard Adult Cards with REAL ID Non-Compliant Indicator (5 Formats)
Standard Minor Cards with REAL ID Non-Compliant Indicator (6 Formats)
CURRENT ENHANCED CARDS
All Enhanced Cards have the REAL ID compliant indicator and are WHTI-compliant.
(5 Adult Formats and 6 Minor Formats)
Enhanced Adult Cards (5 Formats)
Enhanced Minor Cards (6 Formats)
CURRENT SALVAGE VEHICLE AGENT CARD LAYOUT
Salvage Vehicle Agent cards are not REAL ID compliant. (1 format)
NGDI Micro-Segment APP NGDI Micro-Segment DATA Zone 3 Enterprise
Zone 3 AgencyZone 2
NGDI Micro-Segment PRES
Zone 1.49
Zone 1sZone 1Zone 0
Firewalls
= Nano-Segment
= Service Block
NOTES:
• Arrow Direction – drawn from initiator to responder
• User Groups – all uniquely identified/labeled
• Servers – update Hostname and IP (once known), as well as select SecCat
• Nodes – all labeled with unique letter
• Connections – all labeled with unique #
X# = existing connection/FW Rule
LEGEND:
Zone 2p
H M L
= Updated
= VLAN
WW
Attachment C - Network Diagram - MDOS Legacy Modernization Prod
F5 LB
ASM
F5 LB
ASM
F5 LB
ASM G
dsvs.sos.state.mi.us
F5 LB
ASM G
dsvs.sos.state.mi.us
HTTPS TCP 443
SCP TCP 2222 , 2223
HTTP 8080
HTTPS TCP 443 Future
SMB/CIFS-3 TCP445,139 UDP137,138
SMTP TCP 25
389, 88 TCP/UDP LDAP Kerberos D
Users
D
Users
ISILON
N iZone: TBD
SecCat: H M L
ISILON
N iZone: TBD
SecCat: H M L
COREOSMTP
Q
DNS Name TBD
IP x.x.x.x
COREOSMTP
Q
DNS Name TBD
IP x.x.x.x
X2
X4
O
NGDI LDAP
O
NGDI LDAP
R Central Print Center
CPCVIP9.state.mi.us
R Central Print Center
CPCVIP9.state.mi.us P
FTS
migate.state.mi.us
P
FTS
migate.state.mi.us
S
LDAPS
IP:x.x.x.x
S
LDAPS
IP:x.x.x.x
K Gateway
To
Gateway
K Gateway
To
Gateway
LDAPS 636
E
Branch Office Users
PC attached with Scanner and CC Reader
E
Branch Office Users
PC attached with Scanner and CC Reader
F
SOM
Outstate
WAN
(CBDS)
F
SOM
Outstate
WAN
(CBDS)
CEPAS
(FDGS)
api.thepayplace.com apiuat.thepayplace.com
Z
FTPS TCP 21 Data channel 990, 5000-5050
AA
FTPS
F5
2008-118_V24
AA
FTPS
2008-118_V24
FTPS TCP 21 Data channel 6000-6100
X1
MDOS Vendors
X1
MDOS Vendors
L1 VINtelligence https:// vintelligence.ihsmarkit.c om/vindecoder/
VinDecoderService.wsdl
L1 VINtelligence https:// vintelligence.ihsmarkit.c om/vindecoder/
VinDecoderService.wsdl
MSSQL 5905 5906
FF
FTPS
2013-136_V3
FF
FTPS
2013-136_V3
LL
MSP LEIN
HCS551LEINPA002
2011-037_v3
LL
MSP LEIN
HCS551LEINPA002
2011-037_v3
X
Branch Office Users
UAP: #
AM: #
X
Branch Office Users
UAP: #
AM: #
X2 MDOS Vendors
STS
X2 MDOS Vendors
STS
HTTPS TCP 60443
42a
W1 MDOSWeb
EASA# 2018-166
W1 MDOSWeb
EASA# 2018-166
LL
*Firewall Dest
SQLSQLSQL
M
A-A
*Firewall Dest
SQL
M
A-A
W2 FIleNet
EASA# 2012-124
W2 FIleNet
EASA# 2012-124
HTTPS TCP 9447
42b
• Scanner and Credit
Card reader connect the
PC through USB
• P2P encryption uses to communicate with
CEPAS
• localhost URL need to whitelist at PC on port
8080 to communicate with Scanner and Credit
Card reader
• Only outbound traffic allowed
• Investigate using loopback address
• Enable windows firewall
• Enterprise logging:
either FireEye or
QRADAR
• MDOS accept risk
D1
Users
PC attached with
Scanner and CC Reader
D1
Users
PC attached with
Scanner and CC Reader
L1 AppDynamics
L1 AppDynamics
N https://
Environments.gentax .com/Fast/Services/
N https://
Environments.gentax .com/Fast/Services/
G Gateway
To
Gateway
G Gateway
To
Gateway
Attachment C - Network Diagram - MDOS Legacy Modernization PROD Interface
NGDI Micro-Segment APP NGDI Micro-Segment DATA Zone 3 Enterprise
Zone 3 AgencyZone 2
NGDI Micro-Segment PRESZone 1sZone 1Zone 0
Firewalls
= Nano-Segment
= Service Block
NOTES:
• Arrow Direction – drawn from initiator to responder
• User Groups – all uniquely identified/labeled
• Servers – update Hostname and IP (once known), as well as select SecCat
• Nodes – all labeled with unique letter
• Connections – all labeled with unique #
X# = existing connection/FW Rule
LEGEND:
Zone 2p
F5 LB
ASM
F5 LB
ASM
F5 LB
ASM F
DNS Name :dsvsstg.sos.state.mi.us
F5 LB
ASM F
DNS Name :dsvsstg.sos.state.mi.us
H M L
= Updated
= VLAN
HTTPS TCP 443
G Gateway
To
Gateway
G Gateway
To
Gateway
X1
MDOS Vendors
X1
MDOS Vendors
WW
EASA# 2018-066_v6
C Capture Workstation
In SOS Test Lab
EASA# 2013-072_v6.1
C Capture Workstation
In SOS Test Lab
EASA# 2013-072_v6.1
SFTP TCP 22
I
Image Server-FTP
EASA# 2008-118_v26
I
Image Server-FTP
EASA# 2008-118_v26
X2
Image server
X2 "Hard Card" Vendor
Image server
U
UCC
EASA# 2015-169_v8
U
UCC
EASA# 2015-169_v8
C1 Contact Center -
NICEinContact
IPS: TBD
EASA# 2018-013_v5
C1 Contact Center -
NICEinContact
IPS: TBD
EASA# 2018-013_v5
I2Ignition Interlock / DAIS
EASA# 2015-037
I2Ignition Interlock / DAIS
EASA# 2015-037
X3
AAMVA-CSTIMS
https://cstims2.aamva.org/Cstims/
Prod
X3
AAMVA-CSTIMS
https://cstims2.aamva.org/Cstims/
Prod
X4
AAMVA-USPVS
https://verificationservices.aamva.org:18886/
X4
AAMVA-USPVS
https://verificationservices.aamva.org:18886/
X5
SAVE
https://preview.uscis.gov/save/
X5
SAVE
https://preview.uscis.gov/save/
HTTPS TCP 18886
M Medical Marijuana
EASA# 2013-058_v6
M Medical Marijuana
EASA# 2013-058_v6
17X6X6 "Hard Card" Vendor
Printing Factory
Attachment C - Network Diagram - MDOS Legacy Modernization E Services Prod
Zone 3 AgencyZone 2
NGDI Micro-Segment PRES
UTNet
Zone 1sZone 1Zone 0
Firewalls
= Nano-Segment
= Service Block
NOTES:
• Arrow Direction – drawn from initiator to responder
• User Groups – all uniquely identified/labeled
• Servers – update Hostname and IP (once known), as well as select SecCat
• Nodes – all labeled with unique letter
• Connections – all labeled with unique #
X# = existing connection/FW Rule
LEGEND:
Zone 2p
H M L
= Updated
= VLAN
HTTPS TCP 443
RDP 3389
SCP TCP 2222
MSSQL 5905
HTTPS 8080
SMB/CIFS-3 TCP445,139 UDP137,138
F5 LB
ASM
F5 LB
ASM
F5 LB
ASM C
dsvsesvc.sos.state.mi.us
F5 LB
ASM C
dsvsesvc.sos.state.mi.us
DD
ISILON
S iZone: TBD
SecCat: H M L
ISILON
S iZone: TBD
SecCat: H M L
B
Citzen
B
Citzen
MDOSCARSPR
ODADMIN
VPN
J
MDOSCARSPR
ODADMIN
VPN
J
MDOSCARSP
RODDBUsers
VPN
H
MDOSCARSP
RODDBUsers
VPN
H
MDOSCARSPR
ODDBA
VPN
I
MDOSCARSPR
ODDBA
VPN
I
A
Users
UAP: #
AM: #
A
Users
UAP: #
AM: #
W
COREOSMTP
Q
DNS Name TBD
IP x.x.x.x
COREOSMTP
Q
DNS Name TBD
IP x.x.x.x
SMTP TCP 25
X2
X4
CEPAS
(FDGS)
api.thepayplace.com
F5 LB
ASM
F5 LB
ASM
F5 LB
ASM
dsvs.sos.state.mi.us
MDOS Prod
G
X
SST
EASA 2010-140_v1
X
SST
EASA 2010-140_v1
Y MiLogin
Internal Prod
Y MiLogin
Internal Prod
Z MiLogin
External Prod
Z MiLogin
External Prod
L1 VINtelligence https:// vintelligence.ihsmarkit.co m/vindecoder/
VinDecoderService.wsdl
L1 VINtelligence https:// vintelligence.ihsmarkit.co m/vindecoder/
VinDecoderService.wsdl
24 *Firewall Dest
SQLSQLSQL
M
A-A
*Firewall Dest
SQL
M
A-A
L2
MILogin PROD
L2
MILogin PROD
L2
CEPAS API
Https://api.thepayplace.com/ epay/epaywebservice.asmx
L2
CEPAS API
Https://api.thepayplace.com/ epay/epaywebservice.asmx
Zone 3 AgencyZone 2
NGDI Micro-Segment PRES
Zone 1.49
Zone 1sZone 1Zone 0
Firewalls
= Nano-Segment
= Service Block
NOTES:
• Arrow Direction – drawn from initiator to responder
• User Groups – all uniquely identified/labeled
• Servers – update Hostname and IP (once known), as well as select SecCat
• Nodes – all labeled with unique letter
• Connections – all labeled with unique #
X# = existing connection/FW Rule
LEGEND:
Zone 2p
H M L
= Updated
= VLAN
Attachment C - Network Diagram - MDOS Legacy Modernization AAMVA Prod
HTTP/HTTPS TCP 80,443
MSSQL 5906
U UNI Servers
SecCat: M
U UNI Servers
SecCat: M
M
SQL
M
SQL
T
AAMVA
Primary TEST and
Backup PROD
69.60.148.64
T
Primary TEST and
Backup PROD
69.60.148.64
V
AAMVA
Primary PROD and
Backup TEST
69.60.144.64
V
Primary PROD and
Backup TEST
69.60.144.64
AAMVANet
J
AAMVANet
J
LL
x5
HTTPS TCP 2003
x6 x8 x7
TCP/IP 9630, 9631
F5 LB
ASM
F5 LB
ASM
F5 LB
ASM C
dsvs.sos.state.mi.us
F5 LB
ASM C
dsvs.sos.state.mi.us
HTTPS TCP 443
FASTFORMDOSPOWERUSER
MDOSCARSSTAGADMIN
MDOSCARSPRODADMIN
MDOSCARSPRODDBUSERS
VPN
M
FASTFORMDOSPOWERUSER
MDOSCARSSTAGADMIN
MDOSCARSPRODADMIN
MDOSCARSPRODDBUSERS
VPN
M
File details come from the government source that posted it. Updated .