RSA Authentication Manager 7.1 Administrator's Guide - IT Services ...

RSA Authentication Manager 7.1 Administrator’s Guide
Token Types
There are two kinds of SecurID tokens, hardware tokens and software tokens:
• Hardware tokens are usually key fobs or USB keys that display the tokencode.
• Software tokens and their accompanying application are installed on devices such
as Palm Pilots and BlackBerries. Once installed in a device, the application can be
used to display the tokencode.
While the two types of tokens perform the same function, the situations in which you
use them can be very different.
For example, suppose your organization has internal users who must authenticate with
a SecurID token when they log on to their desktop computer, as well as a remote sales
force whose members must authenticate with a SecurID token when they log on to
their laptop computers.
You might choose to distribute hardware tokens to your internal users. Because they
generally log on at their desktop machine each day, the internal users are less likely to
lose their tokens than someone who travels frequently. Many users choose to attach
the key fob to their keychain, so that as long as they have their car keys, they have
their token.
You might choose to distribute software tokens to your remote sales force. Your sales
force is on the go constantly, and with a software token installed directly on a PDA or
cell phone, they will be less likely to leave it at home, or lose it in an airport. As long
as they have their PDA, they have their token.
Tokencode Delivery Methods
When a user authenticates with a token, Authentication Manager matches the
tokencode entered by the user to the tokencode maintained within Authentication
Manager. When the two tokencodes match, authentication is successful.
Hardware and software tokens deliver their tokencodes in one of two ways:
time-based or event-based. The tokencode delivery dictates how Authentication
Manager verifies the tokencode and authenticates the user:
Time-based. A time-based token displays a tokencode that automatically changes
at a set interval, typically every 60 seconds.
For time-based tokens, the tokencodes are kept synchronized with Authentication
Manager based on their internal “clocks” or time. So when the tokencode
advances every 60 seconds, the corresponding tokencode in Authentication
Manager advances as well. When a user authenticates, Authentication Manager
matches the tokencodes based on time.
76 3: Protecting Network Resources with RSA SecurID