ActivIdentity -0920 v2 - ::SRIC:: · 靜態式密碼有許多弱點容易被破解,讓企業遭受損失的風險提高 Access points (如: Web, VPN, Dial-up, Wireless) 需要有比“

實現行動辦公室的資安政策

旭昇資訊股份有限公司

Agenda

企業面臨的挑戰ActivIdentity 如何協助您

Secure Windows Access 解決方案Secure Remote Access 解決方案Enterprise Access Cards 解決方案

成功案例產品線介紹Q&A

企業資訊安全與身份認證解決方案三部曲

帳號整合將所有的帳號做有效的整合, 統一的管理, 任何一個系統變動, 所有系統帳號跟著同步異動

可同步的系統可包含作業系統,資料庫, 群組軟體… 等不同的軟體

單一登錄(SSO)透過一個統一的登入界面, 將所有用戶可以使用的系統集中管理, 用戶不用重複輸入 User Name 及 Password, 只要登入一次, 便可使用所有被授權使用的系統簡單的單一登錄入口網頁,簡單的入口網站系統可結合更安全的身份識別設備(指紋辨識, Smart Card, OTP ……)

OTP (One Tome Password)動態一次性密碼

ActivIdentity Solutions

Secure Remote Access (SRA) SRA 方案

Enterprise Access CardsEAC 方案

Secure Windows Access (SWA) Local/Domain LoginProtect AD/Workstation

企業的面臨的挑戰與問題

靜態式密碼有許多弱點容易被破解,讓企業遭受損失的風險提高

Access points (如 : Web, VPN, Dial-up, Wireless) 需要有比 “ 靜態式密碼 ” 更強而有力的保護方案

安全但不易被使用或是不人性的集中控管方式都是不被企業所接受的解決方案

SWA/SRA 解決方案

什麼是 Secure Windows/Remote Access ?

VPN

企業現存的 Access 方式

ActivIdentityAAA Server

Password Authentication

Dial-Up

Wireless

Web

ActivIdentityauthentication

devices

WindowsLogin

Secure Windows/Remote Access 可以提供 ?

Authentication(確認)

Who are you?(你是誰)

Strong 2-factorUsers or devices

(使用者或設備)

Authentication(確認)

Who are you?(你是誰)

Strong 2-factorUsers or devices

(使用者或設備)

Authorization(授權)

What are your rights?(你可以作什麼)

Authorize network access(授權網路的存取權限)

Authorization(授權)

What are your rights?(你可以作什麼)

Authorize network access(授權網路的存取權限)

Accounting(記錄)

What did you do?(你作了什麼)

Billing/Audit/Logging(記錄/查核)

Accounting(記錄)

What did you do?(你作了什麼)

Billing/Audit/Logging(記錄/查核)

ActivIdentity Secure Windows 解決方案

ActivIdentity 與 AD 充份整合與公司內的 Windows 2003 AD 結合, 不同的 User 配發不同的 Token User 登入習慣與原來AD 登入一樣當 User 登入後, 輸入OTP, 透過 AAA Server 與 AD 的認證, 確保該用戶為用戶本人

當員工將加入網域的notebook帶至公司外部使用，在沒有連上網的狀態，無法使用OTP的認證狀況下, 可以改採本機登入。

Secure Remote Access 解決方案

ActivIdentity AAA Server 提供安全的認證 2-factor authentication – PIN + Device透過 RADIUS, TACACS+, 802.1X 標準溝通方式存在企業網路現有架構，不需變動可簡單管理認證設備(Authentication devices)

ActivIdentity SRA 效益輕易的強化網路/遠端存取的安全性類似競爭產品中成本較低

保留未來成長及擴充的彈性空間

Secure Remote Access Services

SecureDial-up

SecureVPN

Secure Web

SecureWireless

LAN

SecureTerminalServices

Multi-Factor Authentication Methods

SoftwareTokens

HardwareTokens

PKICertificates

USB Keys

One-TimePasswords

Smart Cards

ActivIdentity Secure Remote Access 優勢

普遍且容易使用有 “ATM” 使用者經驗的人都會用使用者都有類似的 PIN 管理習慣

加強安全性除去企業目錄服務與遠端存取資料庫同步的問題

PIN 無法從網路發送，將低外洩風險提供客戶 Customer control 來啟動/異動/註銷 OTP

容易建置與管理可在現有的企業目錄服務下管理使用者

支援標準協定 – RADIUS, TACACS+, ODBC提供集中控管功能

可透過客製化的步署方式建置 Client 端軟體平順的移轉昇級方案

簡單的從單一靜態密碼安全認證(single-function)轉換到多重安全認證(multi-function)的Remote Access 解決方案可以取代原有認證機制 (Authentication Services)透過 SSO 與 OTP 設備 (Smart Card、Token) 與集中控管機制昇級到完整的 Identity Management 架構

更佳的投資報酬提供建置 OTP 更好的解決辦法及更低的維護成本可與 LDAP 目錄服務整合減少管理者及使用者負擔可與 WLAN 安全整合

Enterprise Access Card 解決方案旭昇資訊股份有限公司

憑證的惡夢

RemoteLogin

BuildingAccess

TypicalUser

EnterpriseApplications

Mail

ERP

HRMS

MainFrame

WebApp

WebApp

ElectronicForms

DesktopLogin

Network

解決方案 : 鞏固並提高安全性

Network

RemoteLogin

BuildingAccess

DesktopLogin

TypicalUser


Mail

ERP

HRMS

MainFrame

WebApp

WebApp

ElectronicForms

用一張卡即可存取 PC、網路與應用系統

Network

RemoteLogin

BuildingAccess

DesktopLogin


Mail

ERP

HRMS

MainFrame

WebApp

WebApp

ElectronicForms

Secure User

單一的卡片可以提供安全且簡單的應用系統存取與電子簽證

RemoteLogin

BuildingAccess

Productive &Secure User


Mail

ERP

HRMS

MainFrame

WebApp

WebApp

ElectronicForms

DesktopLogin

Network

傳統常見的認證設備

Building Access Photo ID Remote Passwords PKIAccess Credentials

安全與使用性的問題— 員工需同時使用多套不同的認證設備存取— 單純用密碼作認證安全性低— PKI 認證的產生或儲存需存在於硬碟, 不夠安全且不方便攜帶— 密碼遺失風險高

後續服務成本昂貴— 多種設備的成本與重覆發放設備的作業— 高密碼重設成本

企業夢幻級的 Access Card (EAC)

單一 Access Card 可提供員工:企業員工識別卡 (Corporate Photo ID)門禁 (Building Access)安全的 Windows 及網路登入認證PC Locking (當 card 拔離 PC)安全的遠端存取機制 (VPN 及 dial-up) 安全的無線網路認證

安全的 Email, 文件及電子表單簽署安全的 Web Access 認證安全的登入機制與密碼管理系統

安全的資料儲存 (Secure Data Container)Thin Client 認證 (Citrix)可與其他生物辨識設備搭配

ActivIdentity 產品組合

Smart Card

ActivIdentityCard Management System

(CMS)

ActivClient

Badging Station

Card 發布與管理

(Security Officer)

ActivIdentityAAA Server

ActivClient

Card Usage and Updates

ActivIdentitySSO Service

(End User)

ActivIdentityApplets

(Secure Credential Storage)

與現有的 ID 環境整合

Applications

Web Servers

Mail & FileServers

Prov

isio

ning

Web

Acc

ess

Mgm

t

Single Sign-On

Password Management

Flexible Authentication

Secure Access

Strong Authentication Management

Secure Desktop Login

HRMSSystem

帳號整合

Net

wor

k A

cces

s Secure Remote Access

WLAN

Web

VPN

Remote User

Enterprise User

Application Access

Enterprise Directory

ServerServerPlatformsPlatforms

Card Card ManufacturersManufacturers

Directory Directory ServicesServices

Certificate Certificate AuthoritiesAuthorities

標準且開放的解決方案可與現行及未來的 IT 環境並存

DatabasesDatabases

ClientClientPlatformsPlatforms

成功案例

Active Duty

U.S. NavyJohnson,Jane MarieSocial Security Number Date of Birth

742-76-0064 1969JAN09Issue Date Expiration Date

1999SEP03 2003SEP01

Pay Grade Geneva Conv. Cat.

LTCOL VI

Rank

A1

Geneva Conventions Identification Card

DMDC

SAMPLE

美國國防部與 ActivIdentity

The GSA Common Access Card (CAC) Interoperability StandardIssuance of 4.3 million PKI-enabled smart cardsCard Profile

Demographic AppletEmployee IDBenefitsHealthcareUtility

PKI AppletEmailSecure Web

Space for Departmental Applets Other

Windows / Novell LoginBuilding access, financial services

Open Platform ManagementBusiness Process Re-engineering

ActivIdentity 在金融/銀行的成功案例

客戶名稱Bank of Central Asia, Indonesia

應用系統Internet Home Banking System

建置方式ActivIdentity Management SDK integrated with application layer

建置數量100,000 ActivIdentity One tokens

ActivIdentity 的利基ActivIdentity 提供完善且安全的方式讓安全認證整合於一單一平台ActivIdentity 可支援超大用戶數ActivIdentity 提供 Client 多種不同選擇及方案((token, PDA, GSM etc)

ActivIdentity 在金融/銀行的成功案例

客戶名稱DBS Bank in Singapore

應用系統Cash Management System ( Ideal System )

建置方式ActivIdentity Management SDK integrated with application layer

建置數量8000 ActivIdentity token Plus

ActivIdentity 的利基ActivIdentity 提供完善且安全的方式讓安全認證整合於一單一平台

Sun Microsystems

JavaBadge ProgramNew Smart Card-based employee ID badge for 35,000 users Building Access CardLogical Access (login, email, remote access)Replaces legacy remote access tokensGlobalPlatform management

ActivIdentity Gold deploymentNetwork Login Remote Access with dynamic passwordWeb SSO to Sun’s IntranetPlatforms: Windows, Solaris and SunRay

Why ActivIdentity GoldAttractive ROI: complete solution, cost-effective migration from tokensJava Card + GlobalPlatform management: allows leveraging Sun’s investment by adding card services over time

ActivIdentity 的客戶

各行業代表性客戶

Enterprise

Hewlett-PackardHeidlebergerRenaultKDDICarphone WarehouseBritish TelecommunicationsHoffmann LarocheMonsantoAirbus IndustriesTotalAlstomST Microelectronics

Government

U.S. Dept. of Defense Singapore DSTAU.S. Dept. of EnergyU.S. Dept. of InteriorU.S. Dept. of TreasuryDutch Ministry of WaterSpanish Ministry of Public WorksAustralian Tax OfficeVeterans AffairsUK Police ForcesFrench Ministries

Finance

Barclays Bank PLCFirst MidWest BankCrédit AgricoleM&T FinancialFiservSwedbankNordeaDanske BankPKOZaba BankSociété GénéraleDeutsche Bank Group

產品線介紹

ActivIdentity 產品線Se

rver ActivIdentity AAA Server

(RADIUS, TACACS+, 802.1x)

Clie

nt S

oftw

are

No ClientSoftware

Dev

ices

USB or Serial PCMCIA

USB KeyTokens Smart Card

No Reader

No Device

ActivIdentitySoft Tokens

PCJava Phone

PalmPocketPC

Token Reader

ActivClientClient Software

Soft Tokens

ActivIdentity AAA Server

Integration of Strong Authentication (one-time password), based on ActivIdentity’s patented algorithms, into security-critical applications

Dial-Up, Virtual Private Network, Firewall, Wireless LAN, Web, Outlook Web Access, Citrix, Novell NMAS

Complete Solution in conjunction with two-factor authentication devices

Hardware Token, Smart Card, USB Key, Software Token for PC, Software Token for mobile devices (PocketPC, Palm, J2ME Phone)

Backup User Authentication Methods in case of lost, stolen, forgotten, or damaged Two-Factor Authentication devices with

LDAP Password, Static Password, SMS phone messageStandards based

RADIUS, TACACS+, IEEE 802.1X, ANSI X9.9

Secure Remote Access Services

SecureDial-up

SecureVPN

Secure Web

SecureWireless

LAN

SecureTerminalServices

Supported Applications

VPN, Dial-Up & Firewall

Both IPSEC and SSL-based VPNsAny RADIUS or TACACS+ compatible remote access solution


Wireless LAN LAN Authentication using the Extensible Authentication Protocol (EAP)AAA Server Benefits

Mutual AuthenticationCentralized management and distribution of encryption keys (WEP Key)Centralized authorization policyOTP Authentication PKI Authentication: AAA Server provides CRL validation

N/A√√PEAP-GTCServer certificates and client passwords (OTP)

√N/A√PEAP-MSCHAP v2Server certificates and client passwords (OTP)

√√√EAP-TLSServer and client certificates

Funk OdysseyCiscoMicrosoftMutual authentication method \ Client software

802.1x


Web ServersAAA Agent for Microsoft IIS

Also supports Active Server Pages (ASP and ASP.NET)AAA Agent for SunOne

Outlook Web Access Including Forms-Based Authentication

Citrix MetaFrame Presentation Server – Web Interface AAA Agent for Citrix Presentation Server 3.0AAA Agent for Citrix Presentation Server 4.0

NovellNMAS method, for Novell Client login to eDirectory

Any Application acting as a RADIUS or TACACS+ ClientsRADIUS Server (Funk, Cisco, Nokia, Nortel, …)UNIX Logon through PAM moduleNovell Logon through RADIUS ClientIdentity Manager (IBM, Netegrity, BEA …)

Authentication Workflow

Username+ OTP

AAA Gate

UserOK?

User directory

DeviceOK?

User directory

OTPOK?

Device database

Or pass-throughto other

RADIUS server

Or pass-throughto LDAP

Authentication Methods

Primary Authentication MethodsOne-Time Password: synchronous (ActivIdentity-patented algorithm based on 3 variables)One-Time Password (synchronous) + Server-based PIN (available for Mini Token)One-Time Password: Challenge / Response X509 Certificate (EAP-TLS)Static PasswordLDAP Password

Secondary/Backup Authentication MethodsStatic PasswordLDAP PasswordSMS One-Time Password (+ an Activation Code)Credential has limited lifetime

Authentication Devices

ActivIdentity TokenActivIdentity KeyChain TokenActivIdentity Mini TokenActivIdentity Token XLActivIdentity Smart Card

With ActivClient softwareWith Solo reader

ActivIdentity USB KeyWith ActivClient software

ActivIdentity Software Token for PCActivIdentity Software Token for Mobile Devices

J2ME PhonePalmPocketPC

Authorization & Accounting Methods

AuthorizationRADIUS attributes used for Authorization purposesCheck Before Attribute

Check Before RADIUS Attributes used as additional requirements for approving an authenticationE.g. if only users connecting with PPP should be allowed access, AAA Server checks the connection method (e.g. SLIP) and denies access when the connection is not PPP (even if the OTP is correct)

Send After AttributeAAA Server sends the Send After RADIUS Attributes after the authentication, in order to provide additional information to the NASE.g. phone callback value, preferred IP address

AccountingAccounting information can be returned by the access controller to AAA Server – e.g. session time

Managed by Authorization Profile & Accounting Profile

ActivIdentity OTP 產品

Mini Token

Token One

Key Chain Token

ActivKey Display / ActivKey SIM

ActivReader Solo 2


Mini Token

Token One

Key Chain Token

ActivKey Display / ActivKeySIM

ActivReader Solo 2

簡單使用的 Token – 每按一次按鈕就會產生一筆動態的 OTP (One time password )密碼長度 - 8碼 (數字) 支援加密標準 - DES/3DES電池壽命 - 10 年


需輸入 PIN 才會產生 OTP 的Token簡單使用的 Token – 每按一次 PIN 就會產生一筆動態的 OTP (One time password )OTP 產生也可使用Response/Challenge 方式支援 PIN 改變及 PIN unlock 功能密碼長度 - 10碼 (數字)支援加密標準 -DES/3DES/Challenge Response x9.9/Message authentication電池壽命 -內含標準電池使用3年,另有備援電池可延長使用年限到 8年

Mini Token

Token One

Key Chain Token


ActivReader Solo 2


需輸入 PIN 才會產生 OTP 的Token簡單使用的 Token – 每按一次PIN 就會產生一筆動態的 OTP (One time password )OTP 產生也可使用Response/Challenge 方式支援 PIN 改變及 PIN unlock 功能密碼長度 - 10碼 (數字)支援加密標準 -DES/3DES/Challenge Response x9.9/Message authentication電池壽命 -內含標準電池使用6年

Mini Token

Token One

Key Chain Token


ActivReader Solo 2


支援 Online/Offline OTP 及 PKI認證方式使用方式 – 插入電腦的 USB Port 並讀取顯示於螢幕的 OTP 支援 ISO 7816 1-2-3 SIM Card/EMV level 1 tested/140-2 L3 for SIM Cards/ 140-2 L2 with the Applets使用壽命 – 6年

Mini Token

Token One

Key Chain Token


ActivReader Solo 2支援 Online OTP 及 PKI認證方式使用方式 – 插入電腦的 USB Port 支援 ISO 7816 1-2-3 SIM Card/EMV level 1 tested/140-2 L3 for SIM Cards/ 140-2 L2 with the Applets


手提獨立式的讀卡機使用 two-factor 認證產生OTP 或執行簽署支援部份的 Smart cardschemes密碼長度 - 10碼 (數字)支援加密標準 - EMV CAPauthentication (Visa 或Master)電池壽命 -內含標準電池 2 顆

Mini Token

Token One

Key Chain Token

ActivKey Display / ActivKeySIM

ActivReader Solo 2

EMV Authentication 範例 – 登入網路銀行帳戶

使用者登入到網路銀行 portalPortal 要求輸入 Username 及OTP;使用者插入他們的卡到 Solo Reader;使用者按下 ActivReader 上CODE 按鍵;設備會要求輸入 PIN ;當書入正確認得 PIN 後設備會回覆一組 OTP;使用者輸入正確 OTP 於網銀的OTP 欄位即可完成登入進行網銀作業 .

CODE OR SIGNENTER PIN

****

PASSCODE

12437768

ActivIdentity 的產品優勢 – 完整的產品線產品陣容齊全

Token Mini TokenToken One Key Chain

Smart Card:ActivIdentity GoldActivReader Soho

Token/Smart 二合一USB

AvtivKey SIMActivKey Display

Software Token: 手機,PDA,SMSActivIdentity Tokens 家族

低成本

電池使用壽命長不需一直重覆更換

保固期內免費更換

可自定你的 PIN 號碼 (需 Token 支援)可選擇要使用 synchronous 或 challenge/response 認證方式(需 Token 支援)

ActivIdentity 的產品優勢 – 最安全的認證機制

One Time PasswordPatented Synchronous AlgorithmChallenge ResponseX9.9 Compliant implementationUser Authentication, Host Authentication, and Message AuthenticationDES and 3DES

真正的 AAA (Authentication，Authorization 及 Accounting)支援標準 : RADIUS and TACACS+與NOVELL NDS/Microsoft ADS/SQL 的超強整合能力容易使用，管理，移動性高(SMS,TOKEN,PDA,USB ..)與認證模組的整合能力，可輕易成為認證模組的一部份不需額外的硬體或資料庫系統，易於維護及管理(ODBC Access，Oracle，SQL Server) 與業界眾多系統的整合能力

OTP 為 Identity Management 不可或缺的一環

Applications

Web Servers

Mail & FileServers

Prov

isio

ning

Web

Acc

ess

Mgm

t

Single Sign-On

Password Management

Flexible Authentication

Secure Access

Strong Authentication Management

Secure Desktop Login

HRMSSystem

帳號整合

Net

wor

k A

cces

s Secure Remote Access

WLAN

Web

VPN

Remote User

Enterprise User

Application Access

Enterprise Directory

Q & A旭昇資訊股份有限公司

Documents

ActivIdentity -0920 v2 - ::SRIC:: · 靜態式密碼有許多弱點容易被破解,讓企業遭受損失的風險 提高 Access points (如: Web, VPN, Dial-up, Wireless) 需要 有比“

ActivIdentity -0920 v2 - ::SRIC:: · 靜態式密碼有許多弱點容易被破解,讓企業遭受損失的風險提高 Access points (如: Web, VPN, Dial-up, Wireless) 需要有比“