Data Security Systems Solutions DSSS Authentication Server

Transcription

1 Data Security Systems Solutions DSSS Authentication Server RSA SecurID Ready Implementation Guide Partner Information Last Modified: July 10, 2009 Product Information Partner Name Data Security Systems Solutions Pte Ltd Web Site Product Name DSSS Authentication Server Version & Platform Version Product Description The DSSS Authentication Server is the complete 2-factor solution providing end-to-end security for passwords & highly sensitive information to secure electronic transactions. Applications such as Internet/Phone Banking and Forex Trading require this enhanced security for protection against cryptographic and Trojan attacks. Solution features include: Product Category A powerful cryptographic engine. GUI administration. Digital signatures. A full-fledged token management system for all combinations of 2nd factor tokens, SMS, J2ME Midlet and Pin Mailer. Authentication (Authenticators)

2 Solution Summary Partner Integration Overview Authentication Methods Supported Native RSA SecurID Authentication, RADIUS List SAE Library Version Used 2.3 RSA SecurID User Specification Designated Users, All Users and Default Method RSA SecurID Protection of Administrative Users Yes Issue RSA Software Token Yes RSA Software Token and RSA SecurID 800 Automation Yes User Java Applet WebServer IVR Server RAS / VPN Gateway SSL + E2E-protected PIN Java Applet in IE / Firefox DSSS Authentication Server The DSSS Authentication Server uses RSA SecurID authentication to bring strong 2-factor authentication to enterprises, banks and government. With the support of RSA SecurID authentication, users can use RSA SecurID Tokens to authenticate with appliances like VPNs. They can authenticate against banking web portals for internet banking and other web applications like Microsoft Outlook Web Access. They can also use 2-factor authentication in phone banking systems. 2

3 Product Requirements Partner Product Requirements: DSSS Authentication Server Firmware Version RSA-SAE Module (RSA Secure Authentication Engine) 1.4 Partner Authentication Agent Configuration Before You Begin This section provides instructions for integrating the partners product with RSA SecurID Authentication. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All vendor products/components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. DSSS Product Configuration The DSSS Authentication Server supports secure 2-factor authentication with any RSA SecurID token. This section provides the configuration steps required to enable such functionality. Configuring the DSSS Authentication Server for SecurID authentication First, make sure the firmware of the DSSS Authentication Server is version and the RSA-SAE module is loaded. Uploading the RSA SecurID Token Seeds 1. On the DSSS Authentication Server, navigate to the Administration > Upload External Media > Upload RSA Media 2. Select the RSA Token XML file and input the pass phrase 3

4 Verification upon Uploading 1. On the DSSS Authentication Server, navigate to the Administration > Manage Media 2. Select [41 RSA Securid] and click on the search button Note: You will be able to see the list of RSA SecurID Tokens which you have just uploaded 4

5 Querying of RSA SecurID Media Information 1. On the DSSS Authentication Server, navigate to the Administration > Manage Media 2. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 3. Click on the search button 4. Click on the Media Info link 5

6 Issuing RSA Software Token If the seed that is uploaded into the DSSS Authentication Server is a RSA software token, you will be able to export the encrypted seed and issue to the user. 1. On the DSSS Authentication Server, navigate to the Administration > Manage Media 2. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 3. Click on the search button Note: You will be able to see the list of RSA SecurID Tokens which you have just uploaded 4. Click on the Media Info link 5. At the bottom of the window you will be able to see the Export Software Token Seed File link 6. Input a password to protect RSA software token seed 7. Click on the Export button 6

7 8. A Download Software Token Seed File link will be shown. 9. Click on the link and you will be prompted to export the token seed file. 10. Click Save to save the RSA Software Token seed file. 7

8 Configuring the Next TokenCode Mode Threshold 11. On the DSSS Authentication Server, navigate to the Administration > Manage Media 12. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 13. Click on the search button 14. Navigate to Edit > Configure Next TokenCode Threshold 15. Input the new desired Next TokenCode Threshold value and click on the update button 8

9 16. To verify the configuration, navigate to Administration > Manage Media 17. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 18. Click on the search button 19. Click on the Media Info link to display the new value for Next TokenCode Threshold 9

10 Configuring RSA Securid PIN (Input RSA Securid Token PIN) 1. On the DSSS Authentication Server, navigate to the Administration > Manage Media 2. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 3. Click on the search button 4. Navigate to Edit > Configure RSA Securid PIN 5. Input the new desired RSA Securid PIN value and click on the update button 10

11 6. To verify the configuration, navigate to Administration > Manage Media 7. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 8. Click on the search button 9. Click on the Media Info link Note: You will then see the PIN Disabled Flag is now equal to 0 11

12 Configuring RSA Securid PIN (Remove RSA Securid Token PIN) 1. On the DSSS Authentication Server, navigate to the Administration > Manage Media 2. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 3. Click on the search button 4. Navigate to Edit > Configure RSA Securid PIN 5. Leave the SecurID PIN text boxes blank and click on the update button 6. To verify the configuration, navigate to Administration > Manage Media 12

13 7. Input the serial number of the RSA SecurID Token and select [41 RSA Securid] 8. Click on the search button 9. Click on the Media Info link Note: You will then see the PIN Disabled Flag is now equal to 1 To Synchronize the RSA Securid Token of the User 1. On the DSSS Authentication Server, navigate to User Domains > Domain of the User > Manage User 2. Search for the user that has the RSA SecurID Token out of sync 3. Navigate to Token Settings > Settings > Manage Token 13

14 4. To re-synchronize the RSA SecurID Token, click on the OTP Time Sync link 5. Input the 2 OTPs (Tokencodes) to re-sync the RSA SecurID Token and click on the Synchronize button 14

15 Certification Checklist Date Tested: June 26, 2009 Certification Environment Product Name Version Information Operating System RSA Authentication Engine 2.3 Proprietary OS DSSS Authentication Server Proprietary OS Authentication Functionality New PIN Mode Force Authentication After New PIN System Generated PIN User Defined (4-8 Alphanumeric) User Defined (5-7 Numeric) User Selectable Deny 4 and 8 Digit PIN Deny Alphanumeric PIN PASSCODE 16 Digit PASSCODE 4 Digit Password Next Tokencode Mode Next Tokencode Mode Load Balancing / Reliability Testing Failover No Server available N/A N/A Administrative Functionality Server Down Client reports status message Client times out Administrative Functions Import tokens from XML file no password Import tokens from XML file with password Disable Token Assign a token Un-assign a token Issue Software Token Auditing Audit record creation Successful authentication Failed authentication Report generation BSD / PAR = Pass = Fail N/A = Non-Available Function 15