Security token
From Wikipedia, the free encyclopedia
 |
This article or section is written like an advertisement. Please help rewrite this article from a neutral point of view. Mark blatant advertising which would require a fundamental rewrite in order to become encyclopedic for speedy deletion, using {{db-spam}}. (February 2008) |
A security token (or sometimes a hardware token, authentication token or cryptographic token) may be a physical device that an authorized user of computer services is given to aid in authentication. The term may also refer to software tokens.
Hardware tokens are typically small enough to be carried in a pocket or purse and often are designed to attach to the user's keychain. Some may store cryptographic keys, such as a digital signature, or biometric data, such as a fingerprint. Some designs feature tamper resistant packaging, other may include small keypads to allow entry of a PIN.
Contents |
[edit] Embodiments
Some tokens are very simple, others are complex and include multiple authentication methods. There are many vendors, each using its own approach, and many of these are patented.
[edit] Digital
Trusted as a regular hand-written signature, the digital signature must be made with a private key known only to the person authorized to make the signature. Tokens that allow secure on-board generation and storage of private keys enable secure digital signatures, and can also be used for user authentication, as the private key also serves as a proof for the user’s identity.
For tokens to identify the user, all tokens must have some kind of number that is unique. Not all approaches fully qualify as digital signatures according to some national laws.[citation needed] Tokens with no on-board keyboard or another user interface cannot be used in some signing scenarios, such as confirming a bank transaction based on the bank account number that the funds are to be transferred to.
[edit] Single sign-on software
Some types of Single sign-on (SSO) solutions, like enterprise single sign-on, use the token to store software that allows for seamless authentication and password filling. As the passwords are stored on the token, users need not remember their passwords and therefore can select more secure passwords, or have more secure passwords assigned.
[edit] BestBuy Deluxe Ltd's BesToken
BesToken is USB based strong two-factor authentication device integrated with smart card and can be used for identity management and access control. It supports for Single sign-on, digital signature, network logon and PKI applications.
[edit] ePass USB Token
ePass family offered by Feitian Technologies is an easy-to-use and smart card based USB token. ePass a solution for Single sign-on and two-factor authentication or other PKI based applications.
[edit] One-time passwords
A one-time password is a password that changes after each login, or changes after a set time interval.
[edit] Mathematical-algorithm-based one-time passwords
Another type of one-time password uses a complex mathematical algorithm, such a hash chain, to generate a series of one-time passwords from a secret shared key. Each password is unguessable, even when previous passwords are known. The open source OATH algorithm is standardized, other algorithms are covered by U.S. patents.
[edit] ID CONTROL
ID Control offers easy, affordable and strong One-time password (OTP) authentication by turning your mobile phone or device (e.g. PDA, Blackberry) into an OTP based authentication token with HandyID.
[edit] VeriSign
VeriSign Unified Authentication uses the OATH standard. VeriSign Unified Authentication OEM is Aladdin Knowledge Systems.
[edit] Deepnet Security
Deepnet Security's Deepnet Unified Authentication Platform product.
[edit] Aladdin Knowledge Systems’ eToken NG-OTP
The Aladdin Knowledge Systems' eToken NG-OTP is a hybrid USB and one-time password token. It combines the functionality of smart card based authentication tokens with one-time password user authentication technology in detached mode.
[edit] ePass OTP Authentication System
ePass OTP Authentication System from Feitian Technologies Co., Ltd. involves three components: the ePass OTP token, ePass OTP Authentication Agent and ePass OTP Authentication Server. The ePass OTP Authentication System is able to create strong EVENT-BASED two-factor authentication security by using a dynamically generated one-time password, also able to combine the dynamically generated one-time password with existing static password seamlessly.
[edit] Yubico YubiKey
The YubiKey, manufactured by Yubiko, is a device that acts as a USB keyboard and provides secure authentification by a one-time password algorithm. A detailed description of the product was given in Steve Gibson's Security Now! podcast episode #143 on 2008-05-08, following a chance encounter between them at the RSA Conference in April, 2008.
[edit] Time-synchronized one-time passwords
A time-synchronized one-time passwords change constantly at a set time interval, e.g. once per minute. To do this some sort of synchronization must exist between the client's token and the authentication server. For disconnected tokens this time-synchronization is done before the token is distributed to the client, other token types do the synchronization when the token is inserted into an input device. The main problem with time-synchronized tokens is that they can, over time, become unsynchronized. Most also cannot have replaceable batteries and only last up to 3 years before having to be replaced - so there is additional cost.
[edit] Event-based Token
An event based token, by its nature, has a longer life span. They work on the one-time password principle and so once used, the next password is generated. Often the user has a button to press to receive this new code via either a token or via an SMS message. All CRYPTOCard's tokens are event-based rather than time-based.
[edit] Booleansoft
Booleansoft tokens synchronize with the authentication server when inserted into an input device like a USB input device or a CD-ROM drive. US patent pending technology.
[edit] Entrust IdentityGuard Mini Token
Entrust offers two variants of their OTP token — Entrust IdentityGuard Mini Token OE and Entrust IdentityGuard Mini Token AT. The Entrust IdentityGuard Mini Token OE provides event-based, one-time passwords using the standards-based HOTP algorithm endorsed by the Initiative for Open Authentication (OATH), providing compatibility with third-party software. The Entrust IdentityGuard Mini Token AT offers time- and event-synchronous, one-time passwords based on the stronger DES/3DES algorithm. Priced at $5 per token, the Entrust IdentityGuard Mini Token provides a dramatic contrast to the traditional high-cost offerings of the past.
[edit] RSA Security's SecurID
RSA Security's SecurID displays a number which changes at a set interval. The client enters the one-time password along with a PIN when authenticating. US patented technology.
[edit] Vasco's DigiPass
VASCO's Digipass series have either a small keyboard where the user can enter a PIN or either a single button, in addition it generates a new one-time password after a pre-set time. US patent: 4599489 and 4609777 [2]
[edit] KerPass UST
KerPass provide time synchronous OATH one time passwords on mobile phone. A new password is generated every 30 seconds. KerPass uses an exclusive server side password validation technology that makes possible using a KerPass password in the context of zero knowledge password proof algorithm like SPEKE or SRP. This combination renders password authentication insensitive to man in the middle attacks.
[edit] Secure Computing's Safeword
Secure Computing's Safeword is a hardware device that will display a passcode when pressing a button on the device. A barcode and serial number on the back of the device are used by administrators to synchronize the devices with the authentication system. The Safeword system can be event-based or time-based. Each press of the button will display a new passcode and once a passcode is used for authentication, combined with the user's PIN, it and all the passcodes generated before it can not be reused again. Time-based tokens display different tokens every 20 seconds or less depending on how the user wants it.
[edit] Smart DisplayCard
The Smart DisplayCard by ActivIdentity is a combination security token and smart card. A single button on the card displays a one time password on a small liquid crystal display when pressed. This device uses an OATH compliant event-based algorithm to generate OTPs. The embedded smart chip provides standard smart card PKI capabilities; typically email encryption and digital signatures.
[edit] Token model types
Some tokens types are disconnected; thus they don't need an input device, on the other hand, some token types need input devices. For the purchaser of a security token solution there may be hidden costs in expensive input devices.
[edit] Bluetooth
Bluetooth tokens are often combined with a USB token, thus working in both a connected and a disconnected state. Bluetooth authentication works when closer than 32 feet (10 meters). If the Bluetooth is not available, the token must be inserted into a USB input device to function.
[edit] Cellular phones
A new category of T-FA tools allows users to utilize their mobile phone as a security token. A Java application installed on the mobile phone performs the functions normally provided by a dedicated token. Other methods of using the cell phone include using SMS messaging, instigating an interactive telephone call, or using standard Internet protocols such as HTTP or HTTPS.
Such a method can simplify deployment, reduce logistical costs and remove the need for separate token devices. In the case of SMS options, there are trade-offs: users may incur fees for text messages or for WAP/HTTP services.
[edit] Disconnected tokens
Disconnected tokens are by far the most common today, VASCO's Digipass and RSA Security's SecurID are some examples. The advantage with disconnected tokens is that you don't need any input devices. On the downside, they have a relatively short estimated battery lifetime, usually only 3-5 years, which is low compared to USB tokens which may last 10 years. Some tokens, e.g. ActivIdentity's, allow the batteries to be changed after they expire, thus reducing the cost of purchasing new tokens.
[edit] PC cards
The PC card tokens are made to only work with laptops. Type II PC Cards are preferred as a token as they are half as thick as Type III.
[edit] Mykotronx Corp.
Mykotronx Corp. (a division of SafeNet) makes the Fortezza card token for laptops with a PC card.
[edit] Smart cards
Smart cards are relatively inexpensive compared to other tokens.[citation needed] There are also significant wear-and-tear on the smart cards themselves because of the friction when inserting the card, potentially shortening the lifespan of the smart card token.
[edit] Universal Serial Bus (USB)
The Universal Serial Bus has become a standard in computers today, USB tokens are therefore often a cheaper alternative than other tokens needing a special input device.
[edit] Booleansoft
Booleansoft has several types of USB tokens, some including fingerprint biometrics. Each client that requires secure authentication is supplied with a personal security token. When the USB token is inserted into an PC's USB port, a software program stored on the token (called the 'token software') is then automatically started. The token software lets the user generate new one-time passwords and digital signatures to access a remote resource for authentication purposes.
[edit] VeriSign
VeriSign's Unified Authentication provides a single, integrated platform for provisioning and managing all types of two-factor authentication credentials.
[edit] Smart Card Based USB tokens
Smart-card-based USB tokens which contain a smart card chip inside provide the functionality of both USB tokens and smart cards. They enable a broad range of security solutions and provide the abilities and security of a traditional smart card without requiring a unique input device. From the computer operating system's point of view such a token is a USB-connected smart card reader with one non-removable smart card present.
[edit] Other types
Some use a special purpose interface (e.g. the crypto ignition key deployed by the United States National Security Agency). Tokens can also be used as a photo ID card. Cell phones and PDAs can also serve as security tokens with proper programming. Booleansoft provides CD tokens, some the size of a standard credit cards.
[edit] Related technologies
[edit] Enterprise single sign-on
Some Enterprise single sign-on (E-SSO) solutions uses security tokens.
[edit] Two-factor authentication (T-FA)
Security tokens provide the "what you have" component in two-factor authentication and multi-factor authentication solutions.
[edit] Usage
The simplest security tokens do not need any connection to a computer. The client enters the number displayed on his or her token, usually along with a PIN, when asked to do so. Others connect to the computer using wireless techniques, such as Bluetooth. Still others plug into the computer. For these one must:
- Connect the token to the computer using an appropriate input device
- Enter the PIN if necessary
Depending on type of the token the computer OS will now either
- read the key from token and perform cryptographic operation on it or
- ask the token's firmware to perform this operation
A related application is the hardware dongle required by some computer programs to prove ownership of the software. The dongle is placed in an input device and the software accesses the I/O device in question to authorize the use of the software in question.
[edit] See also
[edit] References
- ^ PKCS -- The RSA standards PKCS#11 and PKCS #15 define software interfaces.
- ^ Specification for Integrated Circuit(s) Cards Interface Devices
