Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 10: Setting Up Authentication
Authentication overview
Hardware
authenticators
Software
authenticators
276
Strong authentication
A basic premise of security is to positively identify who is accessing your
networks. Strong user authentication performs this function and is generally
desired for external-to-internal proxy connections. An authentication server,
such as Secure Computing’s SafeWord PremierAccess, typically resides in the
internal network burb. When a user attempts to log in, the authentication server
displays a passcode prompt for the user.
A passcode is a unique, one-time response that is generated for the user via a
hardware or software authenticator known as a token. Because the token
generates a unique passcode for each log in attempt, they are immune to
passcode sniffing or theft. Because the passcodes are generated by a
cryptographic algorithm, they are essentially impossible to guess.
When tokens are PIN-protected, this strong authentication method is known as
two-factor authentication. That is, authentication is based on something the
user knows (a PIN that allows access to the token) and something the user has
(a token that generates unique passwords).
The Sidewinder G2 coordinates the passcode prompt and response process
between the authentication server and the user. The authentication server
maintains detailed information about user accounts and connection times.
A hardware authenticator is a small, hand-held device that looks similar to an
ordinary calculator. The hardware authenticator displays the proper log in
response on a digital display. A hardware authenticator is platformindependent
and can be used from any PC or workstation equipped for
network communications.
In contrast, a software authenticator is installed directly on the user’s PC or
workstation. It automates the response process, requiring the user only to
enter a personal identification number (PIN). A valid PIN unlocks the software
authenticator, which then calculates and returns the proper log in response. An
example of a supported software authenticator is the SafeWord PremierAccess
SofToken-II.