DISA looks into CAC options

The Defense Information Systems Agency is looking at alternatives to the common access card that would work better with modern computing devices, said Steve Wallace, technical director at DISA’s Development and Business Center.

CAC has been a viable credential for years, "and we don’t see it going away,” Wallace said. “However, with the advent of mobile devices, tablets, newer desktops that don’t necessarily have card readers, we need an alternative form factor to carry the credentials around.”

First developed nearly 20 years ago, today’s CAC has an embedded chip that holds employees' cryptographic credentials that the Defense Department uses to identify the holders as they move around the network -- a form of multifactor identification. Now, the agency is testing handsets with new chipsets that use a person’s physical attributes for identification. It received the first five of 75 devices at the beginning of June.

“We’re not moving away from using cryptography to identify the user,” Wallace said. “What we’re specifically focused on" is the CAC form factor.

The team at the Development and Business Center began looking into alternatives about two years ago, and the number of sensors on mobile devices resonated with them. Last August, DISA contracted with a vendor that manufactures chipsets used primarily in Android handheld devices, such as smartphones. The agency’s goal was to have what it calls a low-power island on the commercially available chipset that could be used to continuously identify users as they go about their day -- “things like their gait, the way that they walk, [or] potentially how they hold the device. We could use the gyroscope for how they hold the device,” Wallace said.

Later, how users interact with the device's keypads and built-in GPS function could also serve as identifying factors, he added.

“As the user moves about and the sensors are triggered, we’re continuously generating a [confidence] score about the user,” Wallace said. “There’s a certain threshold … and as long as that user stays within that confidence score, they’ll have access to their credentials.”

By comparison, users unlock the CAC, a physical card that must be inserted into machines, with a six-digit personal identification number. “If you share that PIN number with someone, all bets are off, and they can effectively assume your identity,” he said. “In this case, we’re trying to use attributes that are so uniquely about you that it’s hard or nearly impossible replicate.”

Challenges that are still being worked include what happens when something affects, say, gait measurements, such as switching shoes, phone placement or an ankle sprain. Wallace expects the remaining 70 test units to arrive between now and October, and testing to conclude at year’s end.

“Why we wanted to do it at the hardware level instead of just loading an app within the operating system is we wanted to avoid any of the pitfalls that come with the use of the operating system,” Wallace said. “We wanted something lower down in the stack, more tightly bound to the device, to the physical device.”

Additionally, none of the data collected for DOD’s identification purposes leaves the device. “What we wanted to avoid was the potential for that data to get centralized and potentially be stolen,” he said. “The idea is all that processing and [data] is retained on that device, so you have to work through an enrollment process every time you get a new device or the device is wiped.”

If a device is lost or stolen, DOD can use its existing mobile device management capabilities to track and remotely wipe it.

Although Wallace didn’t name the vendor, one possibility is Qualcomm, which announced in January that it was awarded a contract for a pilot test of an actionless authentication system. Samsung has also published blog posts recently about the CAC’s incompatibility with mobile technology.

Meanwhile, DISA has also been testing a way to monitor a worker’s interaction with a keyboard and mouse to authenticate identification. Wallace and his team do not log keystrokes, but rather dwell times on keys and flight times between keys to find patterns. “The idea there was to use that in addition to the common access card as another factor of authentication,” he said.

Beyond mobile devices, DISA is also looking at wearables, Wallace added. “As the technology progresses and it gets further miniaturized and it gets cheaper, we’ll look at other devices,” he said.