RSA SecureID is in use from long time, I think even before GPS. It uses two factor authentication mechanism. **RSA SecurID**, formerly referred to as **SecurID**, is a mechanism developed by Security Dynamics (later RSA Security and now RSA, The Security Division of EMC (RSA Security)) for performing two-factor authentication (Two-factor authentication) for a user to a network resource.
RSA secureID generates token which is then transmitted to the server where it is matched against the stored value in the server database. to understand it clearly we need to go through one use case and i hope that will make things pretty clear. This token can be transmitted using USB port or directly by user input. so 2 type of device is being used.
John Smith joins a new company, According to new company's information security policy John is instructed to use RSASecureID to authenticate himself in corporate network. From the companies IT infrastructure department he got his brand new RSASecureID
This RSASecureID has a serial number in the back. This serial ID is stored in the server database and mapped to the John's email address and few other attributes which are unique to Mr. Smith. This will be used later to match againt the input of John Smith while logging into the corporate network.
Is this the only values stored in the Server ? obviously not !
So how is works -
There is 128 bit key which is stored in the server mapped to the serial number and user id of John Smith. This Key id often called as Seed. Point to make note is, this seed is also hardcoded in the RSASecureID. so up untill this point we know that the Seed value is constant and is available both in RSASecureID device and server. This Seed value and the timestamp is passed in to the algorithm as input which genates long length output and 8 digit hash is calculated from this long length encrypted value.
Important point to make note is the clock in the server side and in RSASecureID is synched. There are some additional intellegence built into the server, if the values does not match server calculates this by adjusting the clock to plus or minus one minite.
In the server side same process gets repeated and generated hash is compared against the one which comes from the user, if the match is successful then users gets authenticated without any issues.
How John Smith Uses it-
John open the authentication portal and propmted to enter the username and password. His username is his email (could be anything, but lets take email for simplifying this) and password is combination of his password and the hash generated in the RSASecureID devive. This value is then transfered to server securely.
Server finds the serial number mapped to his ID and from there it picks the seed value. Server goes on to generate the encrypted value by taing the timstamp and seed. It genrates the hash and append it to the John Smith password. It will then compare it with the entered value, if the match is success then Mr. Smith is authenticated.
Comments
Post a Comment