IRM - EMC Community Network

CertificatesCertificate authentication takes advantage of digital certificates and public key cryptography. As part of adding acertificate domain, you can add LDAP authentication and authorization capabilities to the domain. You may want todo this if your organization has users that log in to their computers using a certificate, but you also have an LDAPdirectory service defining users and groups.If you choose to authenticate users with certificates, the IRM Server uses public key cryptography to ensure theidentity of users, where public key cryptography is based on an asymmetric model of encryption.The IRM Server supports X.509 format certificates. To authenticate using a certificate, the certificate must to beavailable from the Windows certificate store on the client system. For example, if an end user adds a certificateusing the Firefox browser, the user may need to export the certificate to Internet Explorer, if the certificate is notalready in the IE store. The same is true for fob and SmartCard certificates.RSA SecurIDA SecurID is a card (token) initialized by a SecurID (RSA) server containing a number that dynamically changes atspecific intervals of time. In addition to having a username, the SecurID server assigns you a PIN. When you log into the IRM Server, you enter your passcode. This is either the PIN followed by the number that appears at thatmoment in time on the SecurID card, or the number that appears on your card after you enter the PIN on it. The IRMServer contacts the SecurID server and uses the passcode to verify your identity and that you have access to the IRMServer.Session SecuritySSL (outer)Application-level encryption (inner)Document KeyThe IRM Server grants an encryption key to a remote client based on policy when the client connects and requests it.This connection and communication is done via an encrypted communications session. This session is protectedusing two levels of encryption.When a client establishes a connection to the server, an SSL session is negotiated just like connecting to an httpssite. (SSL V3.0 for the IRM Server instances in non-FIPS mode, and TLS V1.0 (aka SSL V3.1) for IRM Serverinstances in FIPS mode.) IRM uses SSL server side authentication to authenticate the communicating parties and togenerate a session encryption key. The actual operation of SSL is beyond the scope of this document, but isdiscussed on Netscape‘s developer Web site 3 . The random session key that is generated is a 168-bit key that usesstandard encryption for the SSL tunnel. This key protects all of the client/server communications.3 Introduction to SSL - http://wp.netscape.com/eng/ssl3/Overview of Technical Architecture Page 14