Vasco Personal aXsGUARD, Product Manual

Page: 100 / 143

aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
DIGIPASS
17 DIGIPASS
17.1 Overview
All DIGIPASS instances need to be registered in the aXsGUARD Identifier with relevant data for the aXsGUARD
Identifier to support authentication requests which use One Time Passwords generated from the DIGIPASS.
Some DIGIPASS settings are pre-programmed into the DIGIPASS devices during manufacture, some are assigned
to DIGIPASS through policies and others can be assigned specifically to a DIGIPASS using the DIGIPASS records.
Both policies and DIGIPASS records are configurable in the Administration Web Interface.
The Administration Web interface supports DIGIPASS management including:
Importation of DIGIPASS records
Assignment of DIGIPASS records to User Accounts
Searching for DIGIPASS records
Various DIGIPASS actions, and viewing of runtime information
In this section, we introduce some key DIGIPASS properties, explain the DIGIPASS management possibilities, the
DIGIPASS assignment options and finally, Backup Virtual DIGIPASS options.
We strongly recommend that you read section 3 first, to better understand DIGIPASS management.
17.2 DIGIPASS Properties
17.2.1 DIGIPASS Client PIN
A DIGIPASS (client) PIN is a digit-based secret, known by the User, which needs to be entered into the DIGIPASS
device for a One Time Password (OTP) to be generated. This implies 2-factor authentication: the person logging in
must be in possession of the DIGIPASS device (something you have) and know the DIGIPASS PIN (something you
know) to generate an OTP.
This option requires a DIGIPASS device with a keypad for the PIN to be entered, and is therefore not possible with
one-button DIGIPASS models. An alternative solution for 2-factor authentication with a one-button DIGIPASS
model is explained in the next section.
PIN change can be offered to users through pre-programmed PIN modification settings (see specific DIGIPASS
model User Guides):
An Initial PIN can be set for a DIGIPASS device. The PIN must then be sent to the User of the DIGIPASS,
typically separate from the DIGIPASS delivery.
First Use PIN Modification requires PIN change from the User on first use of the DIGIPASS device.
© 2009 VASCO Data Security 100