IDGo 5000 Bio Solution for Windows Release Notes

Transcription

1 IDGo 5000 Bio Solution for Windows Release Notes Doc Ref : D A 20th June 2014

2 Contents Minidriver... 3 IDGo 500 Credential Provider - What s New?... 3 Now Supported... 3 IDGo 500 Credential Provider - What s Old?... 4 IDGo 5000 Bio Solution - What s New?... 4 Supported Operating Systems... 4 IDGo 5000 Solution - What s Old?... 5 Revision History... 5 IDGo 5000 Solution -What s In?... 6 Supported Operating Systems... 6 Supported Cards... 6 Supported Applications... 7 Supported Readers... 8 Fingerprint Readers and Sensors... 8 IDGo 5000 Solution - What s Up? Known Issues Product Limitations Troubleshooting Where s the Doc?... 13

3 3 These release notes provide particular details about the IDGo 5000 Bio Solution V IDGo 5000 is the name of the solution that groups together the following in the same installation package: the IDGo 500 Credential Provider (for Windows 7 and 8) the IDGo 5000 Biometric Solution (for Windows 7 and 8) Each of these components is discussed separately in its own section. In each section, the release notes describe all the differences between this release and the previous one. Minidriver Previous versions of IDGo 5000 included the IDGo 500 minidriver component. This has now been superseded by the IDGo 800 minidriver. The IDGo 800 minidriver is not included as one of the IDGo 5000 components, but is a pre-requisite. It must be already installed on the computer before installing IDGo For instructions on how to install the IDGo 800 Minidriver, please refer to the IDGo 800 Minidriver for Windows User Guide. It can be installed using Windows Update. IDGo 500 Credential Provider - What s New? The IDGo 500 Credential Provider (CP) has been developed as a wrapper around the minidriver in order to provide a GUI that enables you to manage the IDPrime.NET PINs. Although a CP existed in Vista and XP, the IDGo 500 CP is greatly enhanced and has been designed to manage the multiple PIN feature in Windows 7, 8 and 8.1 (and Update 1), where each user PIN has its own PIN policy. Now Supported Operating Systems The IDGo 500 Credential Provider (CP) now supports Windows 8.1 and Windows 8.1 Update 1.

4 4 IDGo 500 Credential Provider - What s Old? Improvements in Credential Provider in V2.0.6 of IDPrime.NET Solution (since V2.0.3) New Name The IDGo 500 Credential Provider was previously referred to simply as Gemalto s Credential provider. Now Supported The IDGo 500 Credential Provider (CP) now supports Windows 8 and Windows Server 2012, in addition to Windows 7 and Windows Server 2008 R2. Improvements in Credential Provider in V2.0.3 of.net Solution (since V2.0.2) Evolution Since V2.0.2 of the.net solution for Windows 7, the Credential Provider has been updated to include the latest.net Bio components. Corrected Problems It is now possible to perform a single sign on (SSO) logon with the Gemalto credential provider, whereby the user does not need to logon again to start a new session as long as the.net card had not been withdrawn. There was a problem where the Credential Provider would try to detect the fingerprint sensor and sometimes it could not because the fingerprint sensor had not finished initializing. Now the Credential Provider allows sufficient time for the fingerprint sensor to initialize before trying to detect it. IDGo 5000 Bio Solution - What s New? The current version of the IDGo 5000 Solution middleware is Supported Operating Systems Windows 8.1 Windows 8.1 Update 1

5 5 IDGo 5000 Solution - What s Old? This section describes what has been removed in this current release (2.0.7) and provides a history of the changes made in previous releases Revision History Improvements in IDGo 5000 in V2.0.6 of IDPrime.NET Solution (since V2.0.4) New Name The IDGo 5000 Solution was previously called.net Bio Solution (for Windows 7). Now Supported The IDGo 500 Credential Provider (CP) now supports Windows 8 and Windows Server 2012, in addition to Windows 7 and Windows Server 2008 R2. Improvements in.net Bio in V2.0.4 of.net Solution (since V2.0.3) Supported Operating Systems The Windows Vista version of the.net Bio solution is no longer supported. Evolutions The latest version of the.net Bio middleware supports both the new.net Bio card (that is now common to Windows XP and Seven), and the previous.net Bio card for Windows 7. Gemalto recommends that you check that you have the latest version of the Minidriver using Microsoft Update. In Windows 7 this is done automatically for you the first time you connect your.net or.net Bio card. You can access Microsoft Update at the following URL The Minimum number of fingerprints is now 1 by default. This is true for both the Windows XP version and the Windows 7 version. Supported Readers The following readers are now supported for the.net Bio Solution: Precise Sense series (Swipe and flatbed biometric sensors and smart card reader) AuthenTec (ex UPEK) Eikon Series (swipe and flatbed biometric sensors only) AES2501 fingerprint sensors (AuthenTec) have been replaced by AES2550 sensors. AES2810 fingerprint sensors (AuthenTec) such as laptop-integrated sensors are no longer supported. Precise 250 MC fingerprint readers (Precise) are no longer supported.

6 6 IDGo 5000 Solution - What s In? This section provides a full list of hardware, operating systems, peripherals and software that are supported by Gemalto for use with the IDGo 5000 Solution application. Supported Operating Systems The version of IDGo 5000 that is an optional installation component is supported by the following versions of Windows: Windows XP Professional 32-bits only (up to SP3) Windows 7 Windows Server 2008 R2 Windows 8 Windows Server 2012 Windows 8.1 Windows 8.1 Update 1 Supported Cards Gemalto s IDGo IDPrime.NET 5500 cards.

7 7 Supported Applications The following table provides a full list of all the applications supported by this current version of IDGo To see if further applications have been added since the release of this product, please go to Gemalto s.net Bio web site at Application Supported Browsers Microsoft Internet Explorer 8 Microsoft Internet Explorer 9 Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Microsoft Outlook Express 6 (up to SP 3) Microsoft Outlook 2003 (up to SP1), Microsoft Outlook 2007 Microsoft Outlook 2010 Microsoft Outlook 2013 Microsoft Windows Live Mail NO NO Other Applications Adobe Acrobat 9.x Adobe Acrobat 10.x Adobe Acrobat 11.x Microsoft applications supporting Windows Smart Card Framework (SCF), such as Microsoft Office 2007, Microsoft Office 2010 and Microsoft Office 2013 Third-party applications supporting Windows Smart card Framework.

8 8 Supported Readers The smart card reader may be integrated with the user s PC or it can be an external device that is connected via USB. The solution is compatible with any certified Chip Card Interface Device (CCID), USB class or embedded smart card reader; for example Gemalto s IDBridge K30 and IDBridge CT30. The solution is compatible with any PC/SC / ISO 7816 compliant smart card reader. You will need to install the corresponding driver for the reader. For Gemalto smart card readers, these drivers can be downloaded from Fingerprint Readers and Sensors On Windows 7 and later, the IDGo 5000 solution should work with any third-party biometric fingerprint readers that are compliant with Windows Biometric Framework (WBF). This section provides a list of readers that are supported for the IDGo 5000 Solution and where possible information on where to download the latest drivers. Important Note: The readers in this list are those that Gemalto has successfully tested with its IDGo 5000 Solution. However, this does not mean that readers not present in the list are not supported, just that have not yet been tested by Gemalto. Specific compatibility tests can be done on request to the Product Manager. Fingerprint Reader / Sensor Precise Biometrics fingerprint readers: Precise 200 MC: flatbed biometric sensors and smart card reader Precise Sense series: Swipe and flatbed biometric sensors and smart card reader Drivers: Note: Make sure for Windows 7 and later that you download the WBF-compliant drivers. AuthenTec (ex UPEK) Readers AuthenTec (ex UPEK) Eikon Series: swipe and flatbed biometric sensors only Readers using the following UPEK Sensors Reference implementations of UPEK flatbed sensors TCS1 and TCS2 Reference implementations of UPEK swipe sensors TCS3 and TCS4, such as laptop-integrated sensors Drivers: See Product Limitations OS Supported Windows 7 & 8 Windows 7 & 8 (MC and MC-S also 8.1 & 8.1 Update 1) Windows 7 & 8 (Eikon TCRD4C & Eikon Touch TCRF1C also supported in 8.1 and 8.1 Update 1) Windows 7 & 8 Grayscale fingerprint image readers with sufficient image quality Windows 7, 8, 8.1, 8.1 Update 1 Fingerprint capture devices that conform to the FBI s Integrated Automated Fingerprint Identification System (IAFIS) Image Quality Specifications (IQS) Windows 7, 8, 8.1, 8.1 Update 1 Other biometric readers can be tested on special request.

9 If you have any questions regarding the choice of fingerprint sensors, please do not hesitate to contact your Gemalto representative. 9

10 10 IDGo 5000 Solution - What s Up? The following table provides a list of the known issues at the time of this current release and also of the limitations of the product. Known Issues The following table lists known issues that exist. indicates the issue is present for Windows 7 and 8, 8.1 and 8.1 Update 1 and Windows Server 2008 R2 and Server Issue Description: It is not possible to perform an SSL authentication using Fingerprints with Internet Explorer in protected mode and the web site is trusted. Solution: It is possible using the Metro interface of Windows 8.1 Update 1 Description: As previous issue, but in the case of IE 11 with Windows 8.1 Update 1 a message saying that no fingerprints are enrolled when in fact there are. Solution: It is possible using the Metro interface of Windows 8.1 Update 1 Description: The first time you use IDGo 5000, the IDGo 500 Credential Provider does not display the Biometric options (i.e. the IDPrime.NET Card or.net Bio Card tile). This is normal because the machine needs to be rebooted to take the newly installed software into account. Solution: Reboot your machine Description: The Remove Your Fingerprint Data function in the Control Panel does not work. This means you cannot delete all the fingerprint data for the user currently logged on to the PC. Solution: Delete the fingerprints individually or delete the fingerprints for all users of the PC as described in the Installation and Administration Guide. Description: If a FIM (Forefront Identity Manager) enrollment fails when you are in UVM2 or UVM4, the Minidriver should detect the mode, change it to UVM1 and perform the enrollment. Unfortunately this is not working. Solution: None for this version. Description: In Windows Server 2008 R2 and Windows Server 2012 only, if you try to enter the FMA using a card configured with administrator rights in admin mode, the first authentication fails, even if correct. Solution: You are obliged to perform another authentication. The second one (if correct) succeeds. Description: Biometric authentication in UVM4 only. If the user blocks his or her PIN during smart card logon, the unblock PIN screen is displayed. If the user unblocks the PIN correctly, a message appears even so to say The system could not log you on. An incorrect PIN was presented to the smart card. Solution: Click OK to remove the message. Description: The SSO feature works in UVM1 mode only. Solution: Use UVM1 if you want to use the SSO feature. 7, 8, 8.1 & 8.1 Update 1 7, 8, 8.1 & 8.1 Update 1 Server 2008 R2 and Server 2012 only

11 11 Product Limitations The following table lists limitations that exist. indicates the issue is present for Windows 7 and 8, 8.1 and 8.1 Update 1 and Windows Server 2008 R2 and Windows Server Issue Only one IDPrime.NET 5500 card can be connected at any one time. The IDGo 5000 Solution is only available in English. Gemalto recommends that you do not enroll fingerprints for more than one person on a smart card, even if the card has more than one certificate. It is not possible to enroll a fingerprint for more than one person in the same fingerprint location. It is not possible to change the UVM in the non-pki version. The UVM for this version is UVM1 (PIN only) by default. For optimum performance of the Match on Card feature, you should enroll one or two fingerprints only. The more fingerprints you add, the slower the performance of the MoC. If the fingerprint sensor is installed incorrectly, it is impossible to manage the fingerprints and change the UVM. For maximum card performance, Gemalto recommends that you save 25 KB of memory free after loading the PKI certificates and fingerprints (FP) images. The size of a certificate varies between 1 KB and several KB (typical size of a 2,048-bit certificate = 3 KB). The size of a FP varies between 1 KB and 2 KB. If the OTP assembly is present, the size of free memory is 36 KB. If the OTP assembly is not present, the size of free memory is 53 KB. By default,.net Bio cards from the Gemalto webstore do not have the OTP assembly inside. Certain applications support the Windows Smart Card Framework, but only in silent mode. Such applications manage user authentication themselves and will present their own PIN prompt to capture the PIN which is passed to the CSP. This is true even if the IDPrime.NET 5500 card is in biometric (fingerprint) mode. See Warning! Warning: This means that in such cases biometric authentication is not performed. If the Active UVM is UVM2 (FP only) or UVM 4 (PIN and FP), the user is not authenticated as a correct PIN is not in itself sufficient.

12 12 Troubleshooting Problem: The Biometric Devices panel indicates that the fingerprint sensor is unavailable. Description This applies to Windows 7 and 8 (and Server 2008 R2 and Server 2012) only. The Biometric Devices panel claims that the sensor is unavailable even though all the drivers are correctly installed. Figure 1: Unavailable Fingerprint Sensor in Biometric Devices Panel Solution The smart card must be inserted before opening the Biometric Devices panel. In this case make sure the smart card is inserted into your reader, click on the back button (upper left corner) and select the Biometric Devices panel again. Problem: Application freezes when enrolling fingerprints with Precise 200 MC reader. Description The application freezes when trying to enroll fingerprints with this reader. Other applications that subsequently try to access the card also freeze. Solution 1. Install the following Microsoft Knowledge Base hotfix: 2. Reboot the computer. The enrollment then works normally.

13 13 Where s the Doc? This section describes the documentation that is provided with the IDGo 5000 Bio Solution and where to find it: Documentation Document Location Description IDPrime.NET Smart Cards Integration Guide IDGo 800 Minidriver for Windows User Guide IDGo 5000 Bio Solution for Windows 7 & 8 Installation & Administrator Guide IDGo 5000 Solution for Windows 7 & 8 Release Notes (this document) EULA In the Gemalto Product Catalog at the URL below In the Gemalto Product Catalog at the URL below In the ZIP file containing the IDGo 5000 Bio Solution for Windows file In the Gemalto Product Catalog at the URL below In the ZIP file containing the IDGo 5000 Bio Solution for Windows file Appears during installation when asked to accept terms and conditions Describes the main concepts behind.net cards, the.net API and APDU Encoding. Provides overview of Minidriver and describes its installation Describes the architecture and configurable parameters and describes the main tasks to perform with the solution. Describes the new features and cards/readers/applications supported, added since the previous release as well as known limitations. Describes the End User License Agreement the terms and condition of use for IDGo 5000 Bio Solution for Windows Product Catalog: