Product Information. bi-cube SSO Comprehensive Overview. T e c h n o l o g i e s S o l u t i o n s T r e n d s E x p e r i e n c e

Transcription

1 Product Information bi-cube SSO T e c h n o l o g i e s S o l u t i o n s T r e n d s E x p e r i e n c e

2 Table of contents 1 SUMMARY BI-CUBE SSO: REQUIREMENTS AND INITIATED SCENARIOS Intrinsic Safety Availability GINA Integration bi-cube SSO in the Terminal Environment DOES SSO LEAD TO ANOTHER SECURITY PROBLEM? Dual Authentication Active Authentication Four-eye Principle with Biometrics Logon Manager BENEFITS OF BI-CUBE SSO Increased Convenience for the User Cost Reduction, most of all for the User Help Desk (UHD) Significant Increase of Security IMPORTANT FUNCTIONS OF BI-CUBE SSO Quick User Change Registration of an Existing System Authorization in bi-cube Definition of Own Applications Configuration (freely) of the bi-cube SSO-Client Using Special Hot Keys Latent SSO Logon Technologies Identification via Teams Central User Management via Admin Tools Automatic Update of the Application Profile (SSOUPD) Additional Optional Functions of bi-cube SSO Special Documentation Software Distribution Reaction of LAN Availability and Network Speed Extended Log Ability via bi-cube SSO Event Management PASSWORD MANAGEMENT info@secu-sys.de Web: Seite 2 von 23

3 6.1 Methods of Password Management Password Synchronization and bi-cube SSO Cluster bi-cube SSO Version Cluster BI-CUBE SSO VERSUS FEDERATED IDENTITY USP info@secu-sys.de Web: Seite 3 von 23

4 1 Summary This document summarizes experiences of Single Sign-On (SSO) projects and highlights requirements to be followed in complex IT structures (and only those rely on SSO solutions), if the SSO project is to be successful. These requirements flow into a new category of SSO solutions which is here described as bi-cube SSO. 2 bi-cube SSO: Requirements and Initiated Scenarios The necessity to get involved with the subject Single Sign-On results from the aspect of security requirements, the operation of different systems and applications, each with its own authorizations management. In such a variety of systems a user must go through at least 3 to 6 different logon processes with several parameters (user ID and password, according to the rules) and memorize them. This may become unmanageable and the user starts looking for help measures, which usually go against security policies. bi-cube SSO combines or optimizes the different options of account management with the goal to provide an easy logon for the user. At the same time the security of IT system is increased. bi-cube SSO assumes the initial logon for the user to the sub systems for which no other system s password- synchronization or identity transfer exists. Picture 1: bi-cube SSO in combination with additional Identity Management options Another negative result of this system environment is determined at the UHD (User Help Desk) each Monday or after a longer period of absence, (e.g. vacation or illness) when the number of passwordreset requests have increased. IT admins often promise a planned portal development with which everything supposed to be resolved in one step. But even if this aspect is the realization (when ever), more logons or info@secu-sys.de Web: Seite 4 von 23

5 authentications (LAN, mail, not portal compatible applications etc.) remain. bi-cube SSO is a wise addition even if a portal is the target architecture. The introduced requirements are related to bi-cube SSO, which is to increase the security as well as the usability of the IT recourse with diverse cross-platform added functions. The concrete solution clearly stands above other trials which offer, by this acronym, additional functions of standard systems (SAP, Microsoft, Novell etc.); but often only implement a synchronization of accounts within the platform. Furthermore bi-cube SSO fulfils diverse other requirements and additional functions. In an existing heterogeneous environment of LAN basis w2k / XP / AS by Unix and Host, bi-cube SSO offers a bi-cube SSO-Client which integrates all essential applications. Essential are those applications, available to at least 80 % of users. bi-cube SSO is useful in the cumulative occurring terminal server environment (Citrix, Microsoft). To guarantee the highest measure of security it is possible to use biometrics in the terminal server environment with the support of a special service (Logon Manager). bi-cube SSO includes functions of an Application Launcher 1, ICS (Internal control system)-function, the four-eye principle and diverse additional functions, e.g. speedy user switching or user self registration (USR). Besides the primary (central) profile, the user can create his own personalized profile with bi-cube SSO. Herewith, systems not really SSO-relevant to the company can be imported by the user. One bi-cube SSO functionality is the off-line ability of the bi-cube SSO-Client. This is required if the bi-cube Server or its services (ismzamserver) are not available. It is also important that the field staff can use the functions and the convenience of the bi-cube SSO-Client. The bi-cube SSO-Client recognizes each system environment and displays them separately. Of course bi-cube SSO has a high intrinsic safety and availability. 2.1 Intrinsic Safety A complete security concept is within the entire bi-cube SSO, e.g. authorizations management of administration, data storage, the transfer of logon data to the Client, etc. 1 Application Launcher: A functionality to protect the data in the active application environment info@secu-sys.de Web: Seite 5 von 23

6 2.2 Availability The availability of the bi-cube SSO functionality is of great value, considering that the user cannot remember his password after it has been automatically generated, or he uses the bi-cube SSO- Client but then quite simply forgets his password. This functionality is achieved by clustering the bi-cube Server with load balancing, applications- Cluster, local storage of the bi-cube SSO profile and a stable Client software (bi-cube SSO- Client). Picture 2: SSO architecture with high availability info@secu-sys.de Web: Seite 6 von 23

7 2.3 GINA Integration bi-cube SSO logs on to a system with its own GINA component (ism GINA Stub). The function of the GINA (Graphical Identification and Authentication) and bi-cube SSO-Client are in bi-cube SSO optimally co-coordinated with each other. Usually an ism GINA Stub is included in bi-cube SSO. This is of importance for the in this document described security issue eliminations. A GINA-integration is NOT obligatory if the workstation is being used by several users; however a dual authentication against the bi-cube SSO-Client is required. By including the Logon Manger to the ism GINA, all functionalities of the Logon Manager can be used by the GINA. For example: different authentication methods as well as the linking with logical operators. Pictures 3: ism GINA & Logon Manager info@secu-sys.de Web: Seite 7 von 23

8 2.4 bi-cube SSO in the Terminal Environment More and more companies work within the terminal operation. bi-cube SSO can be used at the Citrix as well as at the Microsoft (RDP) environment. It does not matter if the company works within the terminal environment or the so called mixed environment. For the mixed operation the Windows Client is available and for the Terminal environment, for each the bi-cube SSO-Client. For both environments only one profile is offered. The Client is able to identify its environment and the available applications provided in bi-cube SSO. It can be freely defined whether available applications should be displayed or not. Picture 4: bi-cube SSO in the Terminal environment Web: Seite 8 von 23

9 3 Does SSO lead to another Security Problem? A SSO solution is often rejected since it may generate a new security problem. At different accounts (user ID and password) the risk of a cracked access is usually limited to one concrete system and not all systems (of the bi-cube SSO-Client) at the same time. bi-cube SSO offers an adequate solution! This solution consists of the following components: 3.1 Dual Authentication bi-cube SSO creates a safe access to the bi-cube SSO-Client. The different steps are summarized in the term highly secure authentication. This includes all types of dual authentication, especially in conjunction with biometrics. 3.2 Active Authentication The biometrics has the advantage of an active authentication. At any time the direct presence of the user is demanded, which is not so with some other dual authentication procedures. A dual procedure is not proficient if it can be activated at absence of the user (e.g. query of a memory card). The active authentication in the secure bi-cube SSO should be activated through modeling prior to each specially saved application. This means that the launch of such an application in the bi-cube SSO-Client first requires the active authentication of the user. The user must at the start be present in person and must either conduct a biometric authentication or enter his LAN password before the actual logon begins. 3.3 Four-eye Principle with Biometrics With the use of biometrics and bi-cube SSO technologies, requirements can be added after additional release during a business process (e.g. release of a large payment) without intervening to the application. The releasing person uses a biometric device which then determines in bi-cube the password for the approval. This password is, with the logon technology bi-cube SSO written to the logon input field without the releasing person needing to know the password. Picture 5: Four-eye principle with Biometrics info@secu-sys.de Web: Seite 9 von 23

10 3.4 Logon Manager The Logon Manager is used for the authentication/identification of the user in the bi-cube SSO. With the support of different methods it is possible to implement the logon to Windows and the bi- Cube SSO-Client as well as an additional authentication for each application. The Logon Manager includes several logical operators (AND/ OR). With these operators a high level of security is given, since the different methods can be combined with each other. Example: Biometrics (with fingerprint) or with the memory/rfid card. The following methods are currently used by the Logon Manager in bi-cube SSO: - Biometrics (with fingerprint) - Memory-/RFID card - Windows password - Token Picture 6: Logon Manager methods The Logon Manager is an additional component of the bi-cube SSO. This component makes it possible to swap logon data between the Terminal Server und the Client. The logon to a Terminal Server can be made by a fingerprint or a memory-/rfid card. Also extra security for individual applications within the bi-cube SSO-Client can be protected easy and safe. info@secu-sys.de Web: Seite 10 von 23

11 4 Benefits of bi-cube SSO 4.1 Increased Convenience for the User This effect proves to be undisputed and is, with a secure functioned SSO greatly accepted by the user. 4.2 Cost Reduction, most of all for the User Help Desk (UHD) This factor is offered as a primary effect by all providers. The indication of cost reduction at UHD differs between 30% and 60%. With bi-cube SSO an essential reduction in UHD-calls is attained. This effect is greatly enhanced with the combination of bi-cube SSO and bi-cube IPM (IPM = Identity and Provisioning Management). This includes mainly: procedure of password self service refresh, triggered by the server of local profiles no details of the user at software assignment (start account) User s losses of working hours, due to failed system access, are eliminated with bi-cube SSO. This also improves the availability of the overall IT infrastructure. bi-cube SSO can also significantly reduce the license cost. 4.3 Significant Increase of Security bi-cube SSO (including the above aspects of intrinsic safety, etc. taken into account) leads to a great increase in security levels. The user does not have to violate against password rules. The policy of passwords for each system can be set high, since the user no longer needs to memorize them. The generally known security gap (at delivering initial-passwords via or phone) is completely eliminated. info@secu-sys.de Web: Seite 11 von 23

12 5 Important Functions of bi-cube SSO Besides the mentioned functional requirements (e.g. mixed environment at Citrix) the following functions are included with bi-cube SSO: 5.1 Quick User Change The waiting period of a quick user change (log on, log off) to the operating system can be avoided. A selected person has to log on to the bi-cube SSO-Client and a not personified user logs on to the operating system. It is required that the application does not need a personal directory. This necessity arises for example when used in hospitals and in banks. Picture 7: Quick User Change in the bi-cube SSO info@secu-sys.de Web: Seite 12 von 23

13 5.2 Registration of an Existing System Authorization in bi-cube The registration of an existing system authorization allows the user to assign applications (accessible by him) to himself, but which are not explicitly assigned to him at SSO. This procedure can be used for minor migration of accounts into the bi-cube SSO. It is often the only solution to announce the password of the user to bi-cube SSO. The user selects a system which is managed by bi-cube SSO. With entry of his user ID and password bi-cube SSO executes an automated logon (on behalf of the user). After a successful logon, the logon data is set to valid and is available to be used at the bi-cube Server. Picture 8: bi-cube SSO-Client and registration of a existing system authorization info@secu-sys.de Web: Seite 13 von 23

14 5.3 Definition of Own Applications With the bi-cube SSO Wizard the can user define applications, not centrally distributed. These are available for the user, after successfully scanned to the bi-cube SSO-Client. Even self defined applications are saved in own local profiles and have no relation to the central profile. Picture 9: bi-cube SSO Wizard Logon to and Scanning of Applications It is possible to scan Web (HTML, Java, ), Windows (Java, ) or Host applications with the bi- Cube SSO Wizard. Applications with a variety of window titles and multi step logon procedures can easily be scanned and managed. The application launch can be executed by the user in different ways. He can activate the application directly from the bi-cube SSO-Client, from the Desktop, or Start menu. The logon is executed with the bi-cube SSO-Client and the logon data is written to the input fields. Intelligent functions of bi-cube SSO are able to identify a double URL or identical logon windows. 5.4 Configuration (freely) of the bi-cube SSO-Client With the help of an adm file (administrative template) it is possible to predefine the Client and therewith deactivate or change certain default functionalities. Some examples are the use of the bi- Cube SSO Wizard, the definition of hot keys, the locking of the workstation after inactivity or closing of the bi-cube SSO-Client. info@secu-sys.de Web: Seite 14 von 23

15 5.5 Using Special Hot Keys Hot keys can be configured in different ways. The administration defines hot keys at registry, or the user can define hot keys at the bi-cube SSO-Client. The advantage of hot keys is that some actions are easily activated without multiple execution steps. Even challenging applications can be used by SSO hot key definition (e.g. logon). 5.6 Latent SSO Sometimes required authentications must be conducted (with the latent SSO) during the use of an application. It is not to launch the application by an automatic logon support, but to execute required authentications within an application. This can be obligatory and often varies in applications. With Lotus Notes the user can lock his desktop by pressing the F 5 key and to unlock he must enter a password. In most cases the user has forgotten this password. The bi-cube SSO-Client then assumes this actions. 5.7 Logon Technologies The following logon technologies with bi-cube SSO are available for the administrator: Windows Capturing Due to the Windows Capturing it is possible to fill Windows (Java) applications with the bi-cube SSO-Client. Keyboard Simulation The keyboard simulation is a Windows Capturing function. It simulates the keyboard strokes and can therewith operate the program window. Security Token With its own authorizations management the Security-Token (also called: certificate) is an easy and secure method of automated logon of the user to a system. The SSO-Client generates a one time password which includes other encrypted parameters like, User ID, time stamp, system ID of the system which activates. This token is only valid 5 minutes (standard) and is fragmented to its individual parameters and checked by the target system. The token is rejected after the validity has expired or in case the system is not known to the target system. Logon via API This technology of automated user logon is safe and perhaps the one to choose. The application offers a program interface which enables the user logon as well as to manage logon data in the target system. Typical examples are SAP and info@secu-sys.de Web: Seite 15 von 23

16 5.8 Identification via Teams bi-cube SSO offers several methods to logon to a system or a program. One of them is the identification by team. With this procedure a team file with a defined number of users is created. The team members can now logon to their assigned working station without using their user name or password. The user is clearly identified by his team and logs on with his profile. 5.9 Central User Management via Admin Tools bi-cube SSO offers besides the bi-cube SSO-Client a great variety of other important and very useful tools. One of the most important admin tools which are used every day is the bi-cube User Manager and the bi-cube Object Manager. With these tools it is possible to perform the entire administration. The bi-cube User Manager manages all users and their authorizations. At the bi-cube Object Manager all systems are defined and special properties assigned, like password rules. Also Roles and Teams are defined at the bi-cube Object Manager. Picture 10: bi-cube User Manager & Object Manager info@secu-sys.de Web: Seite 16 von 23

17 5.10 Automatic Update of the Application Profile (SSOUPD) After a profile change at the bi-cube database, a message is sent to the bi-cube SSO-Client to update the application profile. If the user has not activated the bi-cube SSO-Client, a notification is put on hold. Security transmission of start accounts to the user is therewith unnecessary Additional Optional Functions of bi-cube SSO a) A maximal session duration can be defined in bi-cube SSO, b) different validity of the password for each system, c) system specific validity of local logon without connection to the server (important for field staff), d) system specific indication if a system in bi-cube SSO-Client should be used via auto boot, e) for each system it can be specified, from which system the password is inherited, f) separation of systems according to system environment (Application Launcher) 5.12 Special Documentation bi-cube SSO offers besides user documentation, system documentation and online help, also special documentation for administrators. This particular documentation is a guide on how bi-cube SSO can be set up and configured. All documentation is always up to date in German as well as in the English language. The bi-cube SSO-Client Help option is also available in Spanish. All documentation is created in Windows chm Standard. With this form it is possible to quickly and easily find the Help answers. The search can be executed by index or key words and favorites can be saved. Picture 11: bi-cube SSO Online help info@secu-sys.de Web: Seite 17 von 23

18 5.13 Software Distribution It does not matter with what software bi-cube SSO is distributed in the company. bi-cube SSO is completely compatible to any software Reaction of LAN Availability and Network Speed The availability of the bi-cube Server is tested when the bi-cube SSO-Client is launched. When the server is not available, a query follows of which application profiles (personal or local) are to be used. This test is repeated at manual update and if necessary the online condition is restored. If the network speed is reduced (e.g. at VPN) the time consuming actions like, test of existence/files or reading of icons, is skipped Extended Log Ability via bi-cube SSO Event Management With the extended Log it is possible to log the start of the bi-cube SSO-Client to the database and the activation of applications included in the bi-cube SSO-Client. The data records are listed and analyzed by the report and can be used for e.g. License Optimization. The bi-cube SSO-Client offers the following functions for the Event-Management: 1. Logging of bi-cube SSO-Client logon or log off 2. Logging of logon periods to a system (for License Optimization) Picture 12: bi-cube SSO Log file info@secu-sys.de Web: Seite 18 von 23

19 The events can be activated depending of analyzed target: Launching the bi-cube SSO-Client Exit the bi-cube SSO-Client Update the bi-cube SSO-Client Launching an application via the bi-cube SSO-Client Picture 13: Setting options for the Event Logging Standard evaluation can be executed as follows: Analyze by number of user, or user which did not use the system more than x days. Average utilization rate (x times in 30 days) of a system and its roles. info@secu-sys.de Web: Seite 19 von 23

20 6 Password Management The main quality of a Q-SSO is the Password Management which is needed because some users do not remember their password. The Password Management is useful if the password in SSO and the password in the target system do not match. This may not be prevented if the user can change his password in the target system. In this case the user should be able to execute synchronization between the target system and SSO. SSO-Synchronization allows the user to pass on his changed password to the bi-cube SSO. The last solution is to reset the password through a bi-cube SSO functionality. The Password Management is also required for systems which command a password change and if the function cannot be ignored or canceled. As far as possible the Password Management is supported by bi-cube SSO. Thus the bi-cube SSO takes over the user s password change (in defined time periods). The password management is marked primarily through the specificity of each system, and thereby quite complex in terms of a comprehensive implementation. bi-cube SSO offers a wide range of technical options for password management. 6.1 Methods of Password Management Manual Change (Method 0) The user himself changes his password in the application client of the target system. If the password change was successful, the new password must be registered to bi-cube via the bi-cube SSO- Client. This method might not be very practical but is available for each application. Manual Password Change with Automated Registration to bi-cube (Method 1) The bi-cube SSO-Client recognizes the appearance of the password change window and automatically saves the user's entry (the new password) and registers the new password in bi- Cube. Decentralized Password Change (Method 2) The bi-cube SSO-Client monitors the password validity. In case a password is about to expire, the bi-cube SSO-Client triggers the password change request. A new password is created and the user s action is simulated in the application client of the target system. Decentralized Password Change via API (Method 3) This method is similar to method 2, but here a new password is entered via API of the application. The API offers the most security. To be allowed to execute the function of the password change, sometimes the client must communicate with the application in a system-context. info@secu-sys.de Web: Seite 20 von 23

21 Central Password Change (Method 4) The password is changed by the central Password Manager. The change is executed in the target application via the bi-cube message room and an adequate output-connector. After confirmation by the program, the new password is written to bi-cube or set to valid and can therefore be used by the bi-cube SSO-Client. Usually it is not required to inform the user about the change. Required is an output-connector for the target application, which is able to execute a password change. The validity in bi-cube IPM must be set so that the Password Manager reacts prior to the password expiration or the validity is canceled in the application. This method characterizes the bi-cube SSO because it is safe and user-friendly. It is executed if the user is logged on or not. However this option is only possible in systems with an integrated IPM-SSO architecture approach. Currently this is offered only by ism s bi-cube solution. 6.2 Password Synchronization and bi-cube SSO Cluster Basically a general password synchronization instead of the bi-cube SSO solution is inadequate due to security reasons. Within the bi-cube SSO solution, system clusters can be built, which can be executed in between a password synchronization (e.g. between all components of a product family, subject to the same password rules). The IPM-philosophy is the center solution. This means, a system in the cluster is the leading system in which the password is changed in bi-cube SSO. This change is then passed on to all other devices. This principle has proven itself also in clusters from different accounts of the same application. A special feature of this category arises when the user is identified in several applications of other systems (e.g. UNIX). Each application has its own password. bi-cube SSO implements internally the inheritance of passwords of the leading system. 6.3 bi-cube SSO Version Cluster A special variant of a bi-cube SSO Cluster is when one application can be managed and assigned in various versions. One example is Lotus Notes which exists in several releases and versions of different languages and can be assigned to the user. This can only be controlled by a close integration of bi-cube SSO with the bi-cube IPM solution. Lotus Notes is defined as a system and the versions / variants are defined as applications in the IPM. The account is linked to the system and the password distribution complies with the application. The modeling as a cluster always ensures the correct logon and allows the version change without changing the account data. info@secu-sys.de Web: Seite 21 von 23

22 7 bi-cube SSO Versus Federated Identity An SSO solution is basically a temporary solution for the lack of unitary architecture concepts, which provide a unique and standardized authentication of all applications. (compare with picture 1). For certain areas and application groups (e.g. SAP) a centralized identity (internally) is provided and used by all applications who acknowledge this identity. At the level above, always a range of other applications remain (at least for a foreseeable time) which are consolidated by SSO only for the logon. From this perspective two options and partially also two objectives for SSO and Federated Identity remain. Picture 14: Comparison of the function of SSO and Federated Identity info@secu-sys.de Web: Seite 22 von 23

23 8 USP SSO Default Functions in bi-cube bi-cube Single Sign-On can flexibly be configured for existing customer system. All sensitive data is protected from unauthorized access by sophisticated encryption mechanisms. At system start, the SSO-Client requests a valid profile which includes all required information. The security and comfort for the user is increased by logging on to the workstation with one password and an additional authentication. It is possible to use a SSO solution in a terminal environment with e.g. a memory-/rfid card. By minimizing the effort in the daily process, costs can be reduced and thus a faster return on investment can be achieved. Due to the additional component Password-Self-Service, the User Help Desk is quite relieved. The separate Logon Manger provides a combination of different authentication methods which allows a secure logon. The security level for the logon can be personified by e.g. a dual authentication. For each SSO target system, separate passwords and nomenclatures can be defined for the logon name. Prior to activation, critical applications can request a separate active additional authentication by the SSO. Simple management of employees in the organizational structure of the company and easy assignment of applications. Additional Functions for SSO in bi-cube (Installation of IPM components is required) Connectors provided by IdM enable a secure management of accounts in the target system (PW-Management). The automatic connection to each HR system enables the activation of corresponding processes (e.g. lock user). If required, already some standard processes of IdM can be used in the SSO. For example, automatic assignment of certain applications to new users. Recertification of critical applications. info@secu-sys.de Web: Seite 23 von 23