Fore Systems forerunner series, Руководство по настройке

Страница: 204 / 352

8 - 4
ForeRunner ATM Switch Network Configuration Manual
Security
8.1.1.2.2 SecurID Passcode
This authentication method provides a high level of security because the SecurID passcode
that allows access to the protected switches is comprised of two parts:
• a secret, memorized personal identification number (PIN)
• the current code generated by the user’s assigned SecurID token
8.1.1.2.2.1 PIN Number
The PIN is known only by the user. It can be either alpha-numeric or strictly numerical, and
can be either a fixed or variable length from 4 - 8 characters, depending on how the system
administrator configures the server.
8.1.1.2.2.2 SecurID Tokens
The second part is a unique code from the SecurID token that only the user possesses and
which cannot be counterfeited. Each authorized user on a protected system is assigned a
SecurID token to use when accessing a protected switch. SecurID tokens are small, hand-held
devices that use microprocessors to calculate and display random codes. These codes change
at a specified interval, which is usually once every minute. The random code displayed on a
user’s token is the same code the server software has generated for that moment.
8.1.1.2.3 SecurID Server
The server can run on a UNIX system or on a Windows NT system. Each FORE switch has a
defined set of authorized users. (See the AMI Configuration Commands Reference Manual for
more information.) When a user is designated as someone who has SecurID authorization,
that user is not permitted access to that switch until his or her identity is validated based on
the scenarios listed in Table 8.1.
When a user attempts to login with a SecurID passcode, the SecurID software running on the
switch verifies the passcode with the server; verifies the authenticity of the server so that no
other machine can pretend to be the server in order to capture security data; and encrypts and
decrypts messages sent between the switch and the server.
8.1.1.2.3.1 Slave Server
A backup, or slave server can be installed to ensure that authentication services are not inter-
rupted, even if the server goes down. When the slave detects that the master has failed, the
slave takes over authentication services. This failover is transparent to the user.
8.1.1.2.3.2 Server Database
The server’s database includes records for all tokens, a list of switches to be protected, an
audit trail of SecurID and administrative activity, and a list of users who are authorized to
access each switch.