8 - 4
ForeRunner ATM Switch Network Configuration Manual
Security
8.1.1.2.2
SecurID
Passcode
This authentication method provides a high level of security because the SecurID passcode
that allows access to the protected switches is comprised of two parts:
•
a secret, memorized personal identification number (PIN)
•
the current code generated by the user’s assigned SecurID token
8.1.1.2.2.1
PIN
Number
The PIN is known only by the user. It can be either alpha-numeric or strictly numerical, and
can be either a fixed or variable length from 4 - 8 characters, depending on how the system
administrator configures the server.
8.1.1.2.2.2
SecurID
Tokens
The second part is a unique code from the SecurID token that only the user possesses and
which cannot be counterfeited. Each authorized user on a protected system is assigned a
SecurID token to use when accessing a protected switch. SecurID tokens are small, hand-held
devices that use microprocessors to calculate and display random codes. These codes change
at a specified interval, which is usually once every minute. The random code displayed on a
user’s token is the same code the server software has generated for that moment.
8.1.1.2.3
SecurID
Server
The server can run on a UNIX system or on a Windows NT system. Each FORE switch has a
defined set of authorized users. (See the AMI Configuration Commands Reference Manual for
more information.) When a user is designated as someone who has SecurID authorization,
that user is not permitted access to that switch until his or her identity is validated based on
the scenarios listed in Table 8.1.
When a user attempts to login with a SecurID passcode, the SecurID software running on the
switch verifies the passcode with the server; verifies the authenticity of the server so that no
other machine can pretend to be the server in order to capture security data; and encrypts and
decrypts messages sent between the switch and the server.
8.1.1.2.3.1
Slave
Server
A backup, or slave server can be installed to ensure that authentication services are not inter-
rupted, even if the server goes down. When the slave detects that the master has failed, the
slave takes over authentication services. This failover is transparent to the user.
8.1.1.2.3.2
Server
Database
The server’s database includes records for all tokens, a list of switches to be protected, an
audit trail of SecurID and administrative activity, and a list of users who are authorized to
access each switch.
Summary of Contents for forerunner series
Page 6: ......
Page 16: ...TOC 10 ForeRunner ATM Switch Network Configuration Manual Table of Contents ...
Page 20: ...LOF 4 ForeRunner ATM Switch Network Configuration Manual List of Figures ...
Page 22: ...LOT 2 ForeRunner ATM Switch Network Configuration Manual List of Tables ...
Page 30: ...viii ForeRunner ATM Switch Network Configuration Manual Preface ...
Page 144: ...3 58 ForeRunner ATM Switch Network Configuration Manual Configuring an Emulated LAN ...
Page 180: ...6 12 ForeRunner ATM Switch Network Configuration Manual ATM Forum PNNI ...
Page 220: ...9 6 ForeRunner ATM Switch Network Configuration Manual Configuring Timing ...
Page 300: ...D 24 ForeRunner ATM Switch Network Configuration Manual Configuring FramePlus Modules ...
Page 308: ...Acronyms 8 ForeRunner ATM Switch Network Configuration Manual Acronyms ...
Page 346: ...Glossary 38 ForeRunner ATM Switch Network Configuration Manual Glossary ...
Page 352: ...Index 6 ForeRunner ATM Switch Network Configuration Manual Index ...