advertisement
SafeNet MobilePASS 8.4.3 for Windows
Desktop by Gemalto
User Guide
Technical Manual Template
Release 1.0, PN: 000-000000-000, Rev. A, March 2013, Copyright © 2013 SafeNet, Inc. All rights reserved.
1
Document Information
Product Version
Document Part Number
Release Date
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto
007-013228-001 , Rev. A
8 July 2015
Trademarks
All intellectual property is protected by copyright. All trademarks and product names used or referred to are the copyright of their respective owners. No part of this document may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, chemical, photocopy, recording, or otherwise, without the prior written permission of SafeNet, Inc.
Disclaimer
SafeNet makes no representations or warranties with respect to the contents of this document and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Furthermore, SafeNet reserves the right to revise this publication and to make changes from time to time in the content hereof without the obligation upon SafeNet to notify any person or organization of any such revisions or changes.
We have attempted to make these documents complete, accurate, and useful, but we cannot guarantee them to be perfect. When we discover errors or omissions, or they are brought to our attention, we endeavor to correct them in succeeding releases of the product.
SafeNet invites constructive comments on the contents of this document. These comments, together with your personal and/or company details, should be sent to the address or email below.
Contact Method Contact Information
SafeNet, Inc.
4690 Millennium Drive
Belcamp, Maryland 21017, USA
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 , Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
2
Contents
Contents
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
3
CHAPTER 1
Overview
About SafeNet MobilePASS by Gemalto
Password theft is the method used most frequently by thieves and hackers to steal identities and gain unauthorized access to computer networks. While they have many ways to steal a password, success depends on the stolen password being valid, in much the same way that credit card theft relies on the card being usable until you report it missing.
SafeNet MobilePASS prevents the stolen password being used to log on to the protected network, even if you and your company’s security professionals are unaware that it has been stolen, because immediately after logging on, the generated one-time passcode (OTP) stops being valid. Any attempt to logon by reusing the OTP will fail, and will alert your network security professionals to the possibility that your identity has been stolen.
SafeNet MobilePASS allows secure remote access to corporate and web-based applications. As a SafeNet
MobilePASS for Windows Desktop user, you can generate one-time passcodes (OTPs) on your computer and use those passcodes to authenticate to SafeNet-protected applications.
An integrated support feature allows your company’s system administrator to manage SafeNet MobilePASS directly from an authentication management system.
Getting Started with SafeNet MobilePASS
You must complete the self-enrollment process before you can use your SafeNet MobilePASS token. Self-enrollment is the process of activating your token. You will receive a self-enrollment email from your company that contains a link to the SafeNet MobilePASS self-enrollment website, along with instructions for installing, enrolling, and activating your MobilePASS token.
If you have not received your self-enrollment email, contact your system administrator.
After installing MobilePASS on your computer, you can use the application to generate an OTP. You may be required to enter a PIN before generating the OTP.
Your token will be able to generate OTPs until it is revoked by your security administrator or deactivated after exceeding the permitted number of failed login attempts.
Benefits of Using SafeNet MobilePASS
SafeNet MobilePASS enables you to access corporate and web-based resources securely. It will also reduce or eliminate the need to remember or periodically change you logon passwords, as your token will do this for you.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
4
Protecting Your Security PIN
If your SafeNet MobilePASS token is configured to use a PIN, protect it as you would the PIN for your credit card.
Never share it with anyone. Your network security administrator and help desk will never ask for your PIN and you should never reveal it to them. Never write down your PIN.
If you forget your PIN, contact your company’s help desk. They will verify your identity and reset your PIN.
Unlocking a Locked Token
A token is locked when there have been attempts to generate OTPs using an incorrect PIN. Contact your help desk to unlock a locked token.
Token Logon Issues
The most common cause of failed token logon is entering an incorrect OTP. Ensure that you enter the code exactly as displayed on the token, including any punctuation, uppercase and lowercase letters. Never attempt to reuse an OTP.
Your account will automatically lock for a period if you exceed the allowed number of consecutive failed logon attempts. You must wait the required period before your account becomes active again. Contact your company’s help desk to resolve logon issues.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
5
CHAPTER 2
Installation
Installing SafeNet MobilePASS 8.4.3 for Windows Desktop
1. Double-click SafeNet MobilePASS.msi. The SafeNet MobilePASS Installation Wizard opens.
2. Click Next. The License Agreement window opens.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
6
3. Read the license agreement carefully, select I accept the license agreement, and click Next.
The Destination Folder window opens, displaying the path to the installation folder.
4. If necessary, click Browse to select a different destination folder, and then click Next. The Ready to Install the
Program window opens.
5. To activate manual enrollment, select Enable Manual Enrollment. If not selected, you will be able to use automatic enrollment only.
6. If required, select Enable Auto Detect Proxy – the client will look for a proxy on the network, in addition to searching locally.
NOTE: The Manual Enrollment and Auto Detect Proxy setting can also be changed by running the Repair setup.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
7
7. Click Install. The installation process starts.
On completion of the installation process, the InstallShield Wizard Complete window opens.
8. Click Finish to complete the process.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
8
CHAPTER 3
Creating and Enrolling SafeNet MobilePASS
Enrollment Options
After creating your SafeNet MobilePASS token, you are required to enroll your SafeNet MobilePASS token. The enrollment procedure varies according to which authentication management platform your company uses.
Automatic enrollment:
• Gemalto’s SafeNet Authentication Service (SAS) Cloud - see Automatic Enrollment (SAS) on page 10
• Gemalto’s SafeNet Authentication Service (SAS) PCE/SPE - see Automatic Enrollment (SAS) on page 10
• Gemalto’s SafeWord Premier Access (SPA) - see Automatic Enrollment (SAM, SAMx, SPA) on page 16
Manual enrollment:
• Gemalto’s SafeNet Authentication Manager (SAM) - see Manual Enrollment (SAM, SAMx, SPA) on page 19
• Gemalto’s SafeWord Premier Access (SPA) - see Manual Enrollment (SAM, SAMx, SPA) on page 19
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
9
Automatic Enrollment (SAS)
Token Assignment
Your system administrator will assign you a token and you will receive a self-enrollment notification email.
You can perform Automatic Enrollment using one of the following two methods:
• Automatically copy and paste the Activation String into the Auto Enrollment window by clicking the Enroll your
Pasting the Activation String” on page 10.
• Copy the Activation String manually. Use this option if you experience difficulties with the automatic copy and
paste. See “Auto-Enrolling SafeNet MobilePASS by Copying the Activation String Manually” on page 13.
Auto-Enrolling SafeNet MobilePASS by Copying and Pasting the Activation String
Automatically
To Enroll SafeNet MobilePASS by copying and pasting the activation string automatically:
1. Click the https:// link in the email. The Self-Enrollment page is displayed.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
10
2. If you have not downloaded SafeNet MobilePASS for Windows Desktop, click the icon to download and install.
3. Click the Enroll your MobilePASS token link.
NOTE: The default token name is displayed in the Create New Token window, as it has not yet been enrolled. For the first token enrollment, the token name is derived from your SAS user name.
4. In the Create New Token window, enter a token name of more than four characters and click Activate.
5. If your token is PIN protected, the Set a Token PIN window appears. Enter the PIN and click Continue.
NOTE: The required number and type of characters required for the PIN depends on the configuration of your system.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
11
6. Re-enter the PIN and click Continue.
Your Passcode is displayed on your SafeNet MobilePASS window.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
12
Auto-Enrolling SafeNet MobilePASS by Copying the Activation String Manually
To auto-enroll SafeNet MobilePASS by copying the activation string manually:
1. Click the https:// link in the email.
2. The SafeNet Authentication Service – Self Enrollment page opens.
3. If you have not downloaded SafeNet MobilePASS for Windows Desktop, click the icon to download and install.
4. Copy the activation string
NOTE: Ensure that you select the entire string.
5. Run the SafeNet MobilePASS application.
6. On the Welcome screen click Add
7. In the Create New Token window, enter a token name of more than four characters and click Activate.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
13
8. If your token is PIN protected, the Set a Token PIN window appears. Enter the PIN and click Continue.
NOTE: The required number and type of characters required for the PIN depends on the configuration of your system.
9. On the Token Enrollment window, click Auto Enrollment.
10. On the Auto Enrollment window, the copied Activation String is automatically pasted into the Enrollment String field.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
14
11. Click Continue.
12. If your token is PIN protected, the Set a Token PIN window is displayed. Enter the PIN in the Token PIN field, confirm and then click Continue.
NOTE: The required number and type of characters required for the PIN depends on the configuration of your system. The requirement could be between four and eight digits, and be either numeric or alphanumeric.
Your passcode is displayed in the SafeNet MobilePASS window.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
15
Automatic Enrollment (SAM, SAMx, SPA)
To Enroll SafeNet MobilePASS automatically:
1. Open the SafeNet MobilePASS application.
2. On the Welcome to MobilePASS screen, click Continue.
3. In the Create New Token window, enter a token name of more than four characters and click Activate.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
16
4. Click Auto Enrollment
5. Enter the URL of your authentication management system portal (SAS, SAMx, or SPA) and click Continue.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
17
6. In the User ID field, enter the username you use to log on to your authentication management platform (SAM,
SAMx, SPA)
7. In the User Password field, enter your enrollment password and click Continue.
NOTE: The enrollment password is provided by your system administrator via email or SMS message. It can be used only once.
8. If your token is PIN protected, enter PIN in the OTP PIN field, and then click Continue.
Your SafeNet MobilePASS token is enrolled.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
18
Manual Enrollment (SAM, SAMx, SPA)
To enroll SafeNet MobilePASS manually:
1. Open the SafeNet MobilePASS application.
2. On the Welcome to MobilePASS screen, click Continue.
3. In the Create New Token window, enter a token name of more than four characters and click Activate.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
19
4. In the Token Enrollment window, click Manual Enrollment.
5. In the Management Enrollment window, enter your Token Policy String.
NOTE: Obtain the Token Policy String form your SAM, SAMx or SPA portal.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
20
6. If your token is PIN protected, the Enter a Token PIN window is displayed. Enter the PIN in the Token PIN field, and then click Continue.
The Activation Code is displayed.
7. Enter the Activation Code in the portal of your authentication management platform (SAM, SAMx, or SPA).
8. If required enter the Token PIN, click Continue.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
21
9. Re-enter Token PIN and click Continue.
10. The Your Passcode window is displayed.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
22
CHAPTER 4
Creating and Changing the Token PIN
Creating a Token PIN
NOTE: The Creating a Token PIN option is available only if your SafeNet
MobilePASS token has been configured for PIN protection.
SafeNet MobilePASS supports both simple numeric protection PINs and more complex, stronger alphanumeric protection PINs. The numeric keypad is the default keyboard option.
To create a token PIN:
1. On the Set a Token PIN window, enter a PIN in the Token PIN field, and then click Continue.
NOTE: The required number and type of characters required for the PIN depends on the configuration of your system. The requirement could be between four and eight digits, and be either numeric or alphanumeric.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
23
2. Re-enter the PIN in the Re-enter Token PIN field, and then click Continue.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
24
Changing a Token PIN
NOTE: The Change Token PIN option is available only if your SafeNet
MobilePASS token has been configured for PIN protection.
To change the PIN:
1. Select the token name from the token list, and then enter your PIN to authenticate.
2. Click Change Token PIN
3. On the Change Token PIN window, enter the PIN in the Current Token PIN field, and then click Continue.
NOTE: You are allowed only a certain number of failed attempts to enter the correct PIN (depending on how many permitted retries your administrator has defined). If you exceed the number of allowed retries, your token must be reactivated.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
25
4. Enter the new token PIN.
5. Re-enter the PIN in the Re-enter your new PIN field, and then click Continue.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
26
6. Click Continue on the Change Token PIN window.
The Your Password window opens.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
27
CHAPTER 5
Generating Passcodes
Generating a Passcode with Time-based Tokens
If you are using a time-based token, the OTP is automatically generated after the specified time interval has elapsed.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
28
Generating Passcodes with Challenge-Response Tokens
To generate a passcode with a challenge-response token:
1. Enter the provided challenge code in the Challenge Code field.
2. Click Generate Passcode.
The passcode is displayed.
3. To generate another passcode, click Next Challenge, and then repeat this process.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
29
CHAPTER 6
Deleting, Deactivating and Renaming a Token
Renaming a Token
To change a token name:
1. Open MobilePASS, select the token name from the list, and if prompted, enter your PIN.
2. Click the Change Token Name icon
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
30
3. Enter your new token name and then click Continue.
The change is confirmed.
Renaming a Token on Windows 8/8.1
If your token is on a USB 3.0 device and your environment is Windows 8, ensure that you have “Full control” permissions to write to the device before attempting to change the token name.
To grant “Full control” permissions:
1. In Windows Explorer, right-click the USB 3.0 drive, and select Properties.
2. On the Security tab, in the Group or user names box, select Authenticated Users.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
31
3. Click Edit.
4. If prompted, enter the administrator credentials.
5. In the Permissions for Authenticated Users box, on the Full control row, select Allow.
6. Click OK to save the changes.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
32
Deleting a Token
To delete a token:
1. Open MobilePASS, select the token name from the list, and if prompted, enter your PIN.
2. From the menu items, click the Delete Token icon
3. Read the warning and then click Delete.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
33
Deactivating a Token
NOTE: Before deactivating tokens, contact your administrator. Unless reenrollment privileges are enabled, you cannot re-enroll your token until the administrator removes the token from your record.
To deactivate a token:
1. Open MobilePASS, select the token name from the list, and if prompted, enter your PIN.
2. From the menu items, click the Deactivate Token icon
3. Read the warning and then click Deactivate.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
34
CHAPTER 7
Viewing Token Information
Viewing Token Information
To view application and token information:
1. Open MobilePASS, select the token name from the list, and if prompted, enter your PIN.
2. From the menu items, click the Information icon
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
35
The information is displayed.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
36
CHAPTER 8
Security Features
SafeNet MobilePASS provides time-hacking countermeasures to alert users to the possibility that their device has been compromised, and that OTPs have been generated that could be used in the future.
Time-based Security Enhancement Scenario
Your device was compromised, and the device’s date and time were changed to a future date and time. The person who took the device generates several time-based OTPs (which will be used for authentication purposes without the
SafeNet MobilePASS application), and then restores the device’s time.
With the time-hacking countermeasures, SafeNet MobilePASS is able to detect that the device was tampered with, and alerts the user to the possibility of an attack.
To use the time-based security feature:
1. Open the SafeNet MobilePASS application, create a time-based token, and then generate an OTP.
2. Move the device’s date and time forward, and then generate an OTP.
3. Restore the clock’s date and time, and then generate another OTP.
A message is displayed indicating that an OTP could not be generated.
4. Click No to confirm that the displayed date and time are not correct.
5. You are prompted to change the clock back to the correct date and time. Click OK.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
37
6. Security measures are taken and, if confirmed, your token will be locked. Click OK to confirm.
Your token is now locked.
SafeNet MobilePASS 8.4.3 for Windows Desktop by Gemalto: User Guide
Document PN: 007-013228-001 Rev. A, Copyright © 2015 SafeNet, Inc., All rights reserved.
38
advertisement
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
advertisement