DSS ITSEC Conference 2012 - VASCO - Tech 2.0

© 2012 - VASCO® Data Security

Strong Authentication … … in details

Kuznetsov Alexander Technical Account Manager


VASCO Core Activities


3

DIGIPASS Go Range

DIGIPASS for Mobile

DIGIPASS for Web

DIGIPASS E-signature DIGIPASS Reader

DIGIPASS Nano Virtual DIGIPASS

DIGIPASS PKI DIGIPASS for Windows

Overview DIGIPASS

http://www.vasco.com/products/digipass/digipass_go_range/digipass_go.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_for_mobile.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_for_web.aspx

http://www.vasco.com/products/digipass/digipass__e-signature/digipass_esignature.aspx

http://www.vasco.com/products/digipass/digipass_readers/digipass_readers.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_nano.aspx

http://www.vasco.com/products/digipass/digipass_software/virtual_digipass.aspx

http://www.vasco.com/products/digipass/digipass_pki/digipass_pki_keys/digipass_pky_keys.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_for_windows.aspx


Federal Reserve Briefing 4

Evolution of Authentication Devices S

ec

uri

ty L

ev

el

Virtual

keyboards

Time-based

OTP Phishing

Pharming

Counter-based

OTP

Meaningful

user prompts

WYSIWYS

MitM with Social Engineering

Sophistication Level of Attacks

Electronic

signature

MitM

Keyloggers

Static

Passwords


Evolution of Authentication platforms

5

Security

Ease

of

Use

Flexibility

Cost


6

DIGIPASS Go Range

DIGIPASS for Mobile

DIGIPASS for Web

DIGIPASS E-signature DIGIPASS Reader

DIGIPASS Nano Virtual DIGIPASS

DIGIPASS PKI DIGIPASS for Windows

VASCO Software DIGIPASS

http://www.vasco.com/products/digipass/digipass_go_range/digipass_go.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_for_mobile.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_for_web.aspx


http://www.vasco.com/products/digipass/digipass_readers/digipass_readers.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_nano.aspx

http://www.vasco.com/products/digipass/digipass_software/virtual_digipass.aspx

http://www.vasco.com/products/digipass/digipass_pki/digipass_pki_keys/digipass_pky_keys.aspx

http://www.vasco.com/products/digipass/digipass_software/digipass_for_windows.aspx


Market leader: Digipass for Mobile 4.0

Focus: Strong Security!

Weak PIN detection, Device Binding, Time+Event Based

Dedicated authentication application in your mobile device


DP 4 Mobile: why?

Easy to integrate

Included web samples

Easy to deploy

Three provisioning options

Easy to use

Intuitive graphical user interface

Easy to customize

Use your own colors and logos

for Mobile

8


Supported Mobile Platforms

Android OS 2.2 and later

iOS 4.1 and later

BlackBerry OS 5.0 and later

MIDP2 compatible devices

Windows Mobile / Phone

9


DP 4 Mobile Editions

Standard

Fully customizable

Customer responsible for provisioning process

Enterprise

Not customizable

Only authentication

3DES, Time Based, Decimal 2

VASCO responsible for provisioning process

10


Step 1: Software Package Download

Enterprise Server

+ HTTP download

+ Local Install

+ HTTP download

+ Local Install

HTTP download

+ Local Install

11


Step 2: Activation Modes

Offline activation

QR code activation

Online activation

12


Offline Activation

DIGIPASS Serial Number

Activation Code

Reactivation Password

DIGIPASS Serial Number

Activation Code (21 Digits)

Reactivation Password

+ Local Password

13


QR Activation

14


Online Activation

Identifier

Authorization Code

Activation Password

AAL2GenActivationCodeXErc

Encrypted Full Activation Data =

(Encrypted with activation password)

Static Vector

+ Serial Number Suffix

+ Activation Code

+ Reactivation Counter

+ Nonce

3 4

Identifier

+ Autorization Code

+ Nonce

1

AAL2GenActivationDataRndKey

2 Generate Nonce

5 Activate with

activation

password

15


AAL2VerifyPassword

Step 3: OTP Post Activation

2 1

Response

OTP

16


Post Activation Device Binding

AAL2DeriveTokenBlobs

3 2

Response

Serial Number

+ Derivation Code

Platform

Finger

Print

1

17

Can also be done offline


Full Picture

18


DP4Mobile – Challenge/Response


DP4Mobile - QR Challenge/Response


Customization: Mobile Provisioning

…

21


Customization: Post Activation

22


Customization: Mobile Settings

23


Customization: Multilanguage

One XML file per language

\CustomizationTool\input\xml

Can also be used for #looks

24


Test your Digipass for Mobile

Already now, go get your DIGIPASS at:

http://dp4mobile.demo.vasco.com/dp4mobile/








DIGIPASS SDK: Software engine

DIGIPASS SDK

J2ME (Java, BlackBerry)

iPhone OS (Objective C)

WindowsMobile 5.0+ / Windows Phone

Symbian OS (2nd to 5th editions)

Android

Integration partners

Clear2pay, Monext, Lemonway

mFoundry

FundTech …

Banking applications

HSBC

GarantiBank

Alfa-Bank

26


DIGIPASS: The building blocks

27

DIGIPASS

Encryption

Algorithm

Storage

By VASCO

A Generated code

Secret

Secret

That changes

Time Event Challenge User

Interface

Time

Is Protected

Encryption Algorithm

Human Readable

Truncation

Parameters


DIGIPASS

Encryption

Algorithm

Storage User

Interface

Time

By VASCO

Parameters

Secret

DIGIPASS

Encryption

Algorithm

Storage User

Interface

Time

By VASCO

Parameters

Secret

Platform

X

Application

Core

The same concept on a different platform

28

Communication

Interface

Storage

Time

Time Shift

Encryption

Algorithm

Storage

Secret

Parameters Static Vector

Dynamic Vector

User

Interface

DIGIPASS

SDK

User

Interface

Time


Software DIGIPASS: Secure Platform

29


Software DIGIPASS: Platform Scoring

30

Jail broken?

Infected?

Location?

Behavior?


Software DIGIPASS: Application Security

31

Device Binding

Application Signing & Obfuscation

External Audit

True Random Key generation

Slow Encryption Function

Secure Key provisioning


Software DIGIPASS: Native Integration

32


DIGIPASS NANO: Secure Component

33


Digipass Nano

34

Test your DPNANO sample at

http://dpnano.demo.vasco.com

More Security

More Convenience

SIM Toolkitmenu


Intel IPT: Integrated DIGIPASS in your PC

35 Federal Reserve Briefing


Intel IPT drivers

Hardware security level

Regular password logon experience

No shipping!

Central provisioning

Large penetration potential

36


Digipass for Web + Intel IPT

37

DP4Web applet:

• Activation through VASCO

• Generate OTP

• Generate e-signature

• Supported by all VASCO server solutions


VASCO Server Side offering

38


VASCO Identikey Server

Single point of Authentication

Hardware

Software

Smart

Cards

Custom web applications

Citrix, OWA, etc.

VPN, SSLVPN, Firewall, etc.


Functional architecture

Front-End Integration

PostgreSQL

Back-End Authentication

Web-based Administration • User & DIGIPASS

Administration

• Reporting

SOAP

SEAL

RADIUS

SOAP IIS Web Applications

Customer Web Applications

RADIUS Client RADIUS LDAP via Windows API via Custom API

Database

Apache Tomcat Webserver

ODBC

Directory

AD

LDAP/LDAPS

Command Line TCL

Active Directory Users & Computers

SEAL

Domain Login

SEAL

http://rds.yahoo.com/_ylt=A9gnMiemhbdELlUBF2GJzbkF;_ylu=X3oDMTBjMzRvMDBnBHBvcwM5BHNlYwNzcg--/SIG=1gvtt756r/EXP=1152964390/**http:/images.search.yahoo.com/search/images/view?back=http://images.search.yahoo.com/search/images?p=laptop&ei=UTF-8&fr=FP-tab-web-t376&x=wrt&w=277&h=206&imgurl=gizmodo.com/images/2006/04/acer_9500.jpg&rurl=http://gizmodo.com/gadgets/laptops/acer-aspire-9800-to-be-second-laptop-to-eventually-have-an-hd-dvd-drive-165793.php&size=9.5kB&name=acer_9500.jpg&p=laptop&type=jpeg&no=9&tt=980,167&ei=UTF-8&src=p

http://rds.yahoo.com/_ylt=A9gnMiemhbdELlUBEWGJzbkF;_ylu=X3oDMTBjcXBoZjEwBHBvcwMzBHNlYwNzcg--/SIG=1e2k7q8do/EXP=1152964390/**http:/images.search.yahoo.com/search/images/view?back=http://images.search.yahoo.com/search/images?p=laptop&ei=UTF-8&fr=FP-tab-web-t376&x=wrt&w=600&h=450&imgurl=www.osnews.com/img/8761/laptop.jpg&rurl=http://www.osnews.com/story.php?news_id=8780&size=32.5kB&name=laptop.jpg&p=laptop&type=jpeg&no=3&tt=980,167&ei=UTF-8

http://www.baber.com/baber/products/mediumtower_cases.htm

http://rds.yahoo.com/_ylt=A9gnMiE4gLdEheYAXNyJzbkF;_ylu=X3oDMTBjdmNoOTVjBHBvcwMyBHNlYwNzcg--/SIG=1ffkob5tg/EXP=1152963000/**http:/images.search.yahoo.com/search/images/view?back=http://images.search.yahoo.com/search/images?p=computer&ei=UTF-8&fr=FP-tab-web-t376&b=1&w=650&h=650&imgurl=www.web-audience.net/beta/images/COMPUTER_BROKERAGE_C.jpg&rurl=http://www.web-audience.net/beta/images?D=A&size=30.8kB&name=COMPUTER_BROKERAGE_C.jpg&p=computer&type=jpeg&no=2&tt=10,941,105&ei=UTF-8



Identikey Server features

Authentication and e-signature validation Server

Strong authentication validation

Transaction data signing – e-Signature

DIGIPASS Family ready (including SMS)

Policy based authentication

Different policy for each application

Automatic creation of users

Auto-assigning of the DIGIPASS to the User

Easy to Integrate in your front-end application

RADIUS protocol (Authentication)

SOAP protocol – Web-services

SAML protocol – Federation authentication

High-availability and scalability model

Load balancing (primary and backup servers)

DB availability control service

41


Identikey Server features

Centralized Web-based administration interface

DIGIPASS & User management

Domains & Organizational units

Policy management

Application management

System management

Delegated administration

> 80 Different administrative priveleges

Reporting capabilities

28 standard reports available

Custom reports

Admin access can be protected by OTP

System and performance monitoring capabilities

Fully PCI-DSS compliant

42


DIGIPASS Authentication for Windows Logon

• DAWL features:

• Offline authentication (up to 30 days)

• Force OTP

• Password Randomization

• PSM – Password Synchronization Manager

• DCR – Dynamic Client Registration

• DNS reverse Lookup

• Terminal Server authentication

`


`

Windows

LDAP

SEAL-SSL

Windows

SEAL

+ PSM

DAWL – Architecture


What is DIGIPASS as a Service


Supported Types of Authenticators


API vs Web Interface


Availability


MYDIGIPASS.COM

49


MDP: concept

50

End-user Website

Validation ok

Validation

DIGIPASS as a

Service

Front-end

Back-end

1 2

3


MDP: Launch pad & Marketplace

51


MDP: available today

3 types of DIGIPASS Hardware DP GO6

Software Mobile DP

Software DP4Web with Intel IPT

QR-code autologin

52


DEMO

List of valid time-based OTP’s

Additional digits

Speeds up verification of an OTP

Optional

Used for first OTP validation

Time granularity Standard 32 seconds

Interval between 2 successive time

units

List of valid counter-based OTP’s

Generated by host

Randomly

Sent to user


Thank You

Alex Kuznetsov Technical Account Manager EE-CIS

[email protected]


Copyright

2011 VASCO Data Security. All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, or

transmitted, in any form or by any means, electronic, mechanical, photocopying,

recording, or otherwise, without the prior written permission of VASCO Data

Security.

Trademarks

VASCO®, VACMAN®, IDENTIKEY®, aXsGUARD®, DIGIPASS® and the ®

logo are registered or unregistered trademarks of VASCO Data Security, Inc.

and/or VASCO Data Security International GmbH in the U.S. and other countries

Disclaimer of Warranties and Limitations of Liabilities

This Report is provided on an 'as is' basis, without any other warranties, or

conditions.

Copyright & Trademarks

55

Technology

DSS ITSEC Conference 2012 - VASCO - Tech 2.0