Security Device Modes and Profiles

In standalone mode, smart cards and keys are not centrally managed. Users have full access to all functionalities provided by the device via ActivClient. Devices in this mode are delivered with applets A small, subordinate application on the token designed to perform specific tasks. configured with a default standalone profile.

Initialization (Personalization)

• Users can personalize their device and set a PIN and a PIN unblock key (PUK PIN Unblock Key. A code used to reset the personal identification number (PIN) in devices after they have been locked due to multiple incorrect PIN entries.).

Unblocking

• Users can unblock their device using the static PUK provided during personalization and set a new PIN.

Recycling (Resetting)

• Users can recycle their device using the PIN.

Card Update

• Not available

If security devices are managed through HID Credential Management System (CMS), they may be delivered with or without applets, depending on the device model.

Initialization (Personalization)

• Security devices are initialized and managed by HID CMS HID Credential Management System (formerly known as ActivID Credential Management System) is a web-based, smart card, credential and application lifecycle management system. HID CMS augments and works in concert with an enterprise’s primary identity management infrastructure components, including popular directory, database, and PKI components., including applet A small, subordinate application on the token designed to perform specific tasks. loading and the loading of user credentials such as certificates.

Unblocking

• Users can unblock their security devices:

  • Online using the HID CMS Self-Service Portal

  • Via ActivClient Console using the challenge/response mechanism

    Note: This method is available only with some device profiles. For further information, refer to the HID CMS documentation.

  • Via the native Windows unblock screen using the challenge/response mechanism

    Note: This method is available only with some device profiles. See Unblock PIN via the Windows Unblock Screen for more information.

Recycling (Resetting)

• Security devices can be recycled using HID CMS.

This mode refers to:

• PIV (Personal Identity Verification) and PIV-I (PIV-Interoperable) cards compliant with NIST Special Publication 800-73-4

• CIV (Commercial Identity Verification) and PIV-like cards (PIV interface, with additional flexibility in terms of card content and policies)

ActivClient uses PIV devices in read-only mode for usage operations (PKI services and demographic data), in compliance with the PIV specifications.

In addition, the Change PIN functionality is supported.

Initialization (Personalization) and Issuance

• Security devices can be issued via HID Credential Management System (CMS) (PIV-compliant) or other smart card management systems.

Unblocking

• Per the FIPS 201 specification, unblocking a device (referred to as a "PIN Reset") must be performed in the presence of an Issuance Officer with biometric verification of the cardholder.

• The PIN unblock functionality in ActivClient is not available for PIV devices; however, PIN unblocking can be performed using HID CMS HID Credential Management System (formerly known as ActivID Credential Management System) is a web-based, smart card, credential and application lifecycle management system. HID CMS augments and works in concert with an enterprise’s primary identity management infrastructure components, including popular directory, database, and PKI components..

Recycling (Resetting)

• Security devices can be recycled using HID CMS.

Card Update

• The Card Auto-Update feature in ActivClient allows users to securely update the content of their security devices (applets and credentials) using the HID CMS Self-Service Portal.