18
Using Contact Smart Cards
Topics
Connecting the Smart Card Reader
Preparing to Update the PageCounter Firmware
Updating the PageCounter Firmware
Configuring the PageCounter to Work with a
Physical Device
Configuring the Firewall
Configuring the PageCounter Terminal
Configuring the PageCounter Mini
Uploading Certificates to the PageCounter
Configuring User Authentication
Using Smart Cards with the PageCounter
Equitrac Office and Express support OMNIKEY 3111 Smart Card readers connected directly to PageCounter terminals or PageCounter minis to provide user authentication via contact Smart Cards at select MFPs.
This chapter provides information about configuring PageCounter devices to work with Smart Cards.
NOTE: The Smart Card solution is only for 64 bit systems.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 459
Chapter 18: Using Contact Smart Cards
Smart Card Setup Workflow
To configure the Smart Card solution to work with the PageCounter control terminals and PageCounter Minis, do the following:
1
2
3
4
5
6
Connect the Smart Card reader to the PageCounter device.
Obtain the required PageCounter Terminal Updater and firmware files from the Partner Portal and update the
PageCounter firmware.
Enable the Smart Card solution on the PageCounter device.
Upload the CA certificates to the PageCounter device using Equitrac SSL Certificate Manager.
Configure Smart Card user authentication.
Login to the PageCounter device with Smart Card.
Connecting the Smart Card Reader
The Smart Card reader needs to be physically connected to the PageCounter or PageCounter Mini. Equitrac uses the
OMNIKEY 3111 card reader connected to the PageCounter device via specific power cables and serial adapters.
To connect the card reader to the PageCounter device, do the following:
1
2
3
4
5
Connect the serial dongle to the serial port on the back of the PageCounter device.
Connect the serial cable from the smart card reader to the serial dongle on the PageCounter.
Connect the single end of the Y-cable (4-pin plug) to the power port on the back of the PageCounter.
Connect the PageCounter’s power cable to the 4-pin end of the Y-cable, and the card reader’s power cable to the 6pin end of the Y-cable.
Plug in the PageCounter device power supply.
Preparing to Update the PageCounter Firmware
Before upgrading the PageCounter or PageCounter Mini firmware, consider the following:
• PageCounters must be equipped with a flash card reader to accept a firmware update. While most PageCounters have flash card readers as part of their hardware, some legacy models lack the required card reader. In this case, you must first manually install one. PageCounters without flash card readers result in the terminal updater tool displaying No Disk under the Status menu.
• Before upgrading a PageCounter to the intermediate 1.2.99 firmware, ensure the hardware is running the latest
"standard" firmware. Hardware with older versions of the firmware may fail the upgrade procedure.
• Ensure you are using the correct version of the EQTerminalUpdater.exe tool. Typically, version 5.1.1.0009 (or higher) is recommended. Older versions of the EQTerminalUpdater.exe tool may be required to install earlier versions of the PageCounter firmware. For example, using version 5.1.1.009 of the tool to install version 1.2.99 of the firmware may cause the upgrade to fail.
• If a PageCounter firmware is updated to version 1.3.17 (or higher), the password to gain access to the PageCounter is reset. By default, the user name is admin and the password is pagecounter. Reset these as soon as possible to maintain security.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 460
Chapter 18: Using Contact Smart Cards
Updating the PageCounter Firmware
Updating the PageCounter terminal or PageCounter Mini to work with the Smart Card solution involves a 2-step firmware upgrade. First, the BIN file needs to be updated to version 1.2.99 to support encryption, and then the firmware must be updated once more to version 1.3.x via an encrypted BIN file. The BIN file only needs to be updated once—any further updates use the encrypted BIN files.
To update the PageCounter or PageCounter Mini firmware, do the following:
1
2
3
On the workstation, create a folder (e.g. "Terminal Firmware") to store the Equitrac Terminal Updater tool and
PageCounter firmware files.
Download the Terminal Updater tool (EQTerminalUpdater.exe) and the latest firmware from the Partner Portal, and save them to the newly created folder.
Open the EQTerminalUpdater.exe file. The Equitrac terminal updater tool opens.
4
In the Equitrac terminal updater tool, do the following: a
Click the Add button and enter the IP address of the PageCounter terminal or PageCounter Mini to be updated, and click OK. The IP address of the PageCounter device appears in the Terminal device list.
Alternatively, click the Discover button if the IP address of the device is unknown.
b c d
In the Advanced options section, select the Automatically restart after device is updated checkbox.
Click the Browse button beside Firmware File.
In the firmware folder, select the BIN (.bin) file, and click Open.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 461
Chapter 18: Using Contact Smart Cards
5 f e g
Click the Update Firmware button to update the terminal with firmware version 1.2.99.
Once the terminal reboots and its status displays Idle, click the Browse button beside Firmware File again.
In the firmware folder, select the Encrypted BIN (.bin.enc) file, and click Open.
j i h k
Click the Browse button beside F/W signature file.
In the firmware folder, select the Firmware Digital Signature (.bin.sign) file, and click Open.
Click the Enter Password button and enter the PageCounter device password, and then click OK. Use the default password (EQPageCounter or EquitracMini) unless it has already been changed.
Click the Update Firmware button to update the PageCounter device with firmware version 1.3.x. l
Close the Equitrac terminal updater.
Repeat these steps for all PageCounter terminals and PageCounter Minis that need to be updated.
Configuring the PageCounter to Work with a Physical Device
When the PageCounter terminal or PageCounter Mini is powered-up and connected to the network, DCE registers the PageCounter device as a Control terminal in System Manager > Devices under the Unassigned control terminals group. The control terminal (PageCounter device) needs to be assigned to a physical device, and then configured to work with the physical device.
See
Adding and Configuring a Control Terminal
on page 122 to configure the PageCounter terminal or PageCounter
Mini to work with a specific physical device.
Configuring the Firewall
Many Equitrac components communicate through firewalls and require certain ports to be open in order for the servers to communicate properly. To ensure proper communication between the PageCounter terminal or
PageCounter Mini and DCE when running the Smart Card solution, port 4943 must be open.
An inbound connection through port 4943 in the firewall for the EQDCEservice.exe is needed to allow communication from a PageCounter terminal or PageCounter Mini to the DCE service. If no inbound connection is created for the DCE service, the firewall will block the connection from the PageCounter device to DCE.
Refer to your firewall documentation for details on how to configure the firewall to allow inbound connection requests.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 462
Chapter 18: Using Contact Smart Cards
Configuring the PageCounter Terminal
After updating the PageCounter terminal firmware, the default password should be changed, and the Smart Card solution must be enabled
Change the Default Password
To change the password for the PageCounter terminal, do the following:
1
Open a web browser and enter the IP address of the PageCounter terminal in the Address field. The Equitrac Web
Admin for PageCounter opens.
2
3
4
Click the CONFIG tab, and then click RE-INIT.
If prompted, enter the PageCounter terminal’s User Name and Password. For example, admin:EQPageCounter.
Enter the current (default) password, enter and confirm the new password, and then click the Update password button. The password must be at least 12 characters.
Enable the Smart Card Solution
To enable the Smart Card solution on the PageCounter terminal, do the following:
1
2
3
4
Power up the PageCounter terminal.
During the start-up sequence, press the F2 function key when the terminal displays the message: Loading
Firmware
.
When prompted, enter a password using the numeric keypad, and press the Enter key to access Manager Mode.
The default password is 2468.
In Manager Mode, use the arrow keys to scroll through the menu options. To select an option, press the corresponding number key. For example, press the 4 key to select Devices (4:Devices).
Press the 4 key to select Devices.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 463
Chapter 18: Using Contact Smart Cards
5
6
7
Press the 0 key to select EDI Settings.
Scroll through the EDI Settings menu and press the 8 key to select Enable Smart Card.
Press the 1 key to select YES to Enable Smart Card.
NOTE: EDI must be disabled when using the Smart Card solution with the PageCounter.
8
9
To disable EDI, scroll through the EDI Settings menu, and press the 0 key to select Enable EDI, and then press the
2
key for NO.
Press the F3 (Back) key 3 times to prompt the terminal to reboot and complete the configuration.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 464
Chapter 18: Using Contact Smart Cards
Configuring the PageCounter Mini
After updating the PageCounter Mini firmware, the default password should be changed, and the Smart Card solution must be enabled.
To change the password and enable the Smart Card solution for the PageCounter Mini, do the following:
1
Open a web browser, and enter
<PageCounter mini IP address>/pc_mini
in the Address field. The
Equitrac PC mini Web Admin opens.
6
7
2
3
4
5
Click the CONFIGURE tab.
If prompted, enter the PageCounter Mini’s User Name and Password. For example, admin:EquitracMini.
In the Change password section, enter the current (default) password, enter and confirm the new password, and then click the Update password button. The password must be at least 12 characters.
In the Change EDI settings section, do the following: a
Clear the Enable EDI checkbox. EDI must be disabled when using Smart Cards with the PageCounter Mini. b
Select the Enable Smart Card checkbox.
Click the Update EDI settings button.
Close the Equitrac PC mini Web Admin page.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 465
Chapter 18: Using Contact Smart Cards
Uploading Certificates to the PageCounter
The PageCounter terminal and PageCounter Mini use trusted certificates when utilizing the Smart Card solution.
Use the Equitrac Certificate Manager (EQSSLCertificateManager.exe) to upload trusted certificates to the
PageCounter device. EQSSLCertificateManager is located in the Program Files\Equitrac\Office or Express\Tools folder on any machine where Equitrac administration tools have been installed. EQSSLCertificateManager must be run on a server which has the DCE certificates installed.
To upload certificates to the PageCounter terminal or PageCounter Mini, do the following:
1
Open the Program Files\Equitrac\Office or Express\Tools folder and run EQSSLCertificateManager.exe.
2
From the EQSSLCertificateManager, select the desired certificate and click the PageCounter upload button.
NOTE: If there are no certificates listed in the EQSSLCertificateManager window, then a trusted certificate first needs
to be created and installed on the server before it can be uploaded to the PageCounter. See
Creating Trusted
Certificates
on page 490.
3
4
5
On the Upload to PageCounter dialog box, enter the PageCounter terminal or PageCounter Mini IP address and
Password
, and click OK.
A popup appears stating that the certificate has been successfully uploaded to the PageCounter. Click OK to close the popup.
Close the EQSSLCertificateManager.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 466
Chapter 18: Using Contact Smart Cards
Configuring User Authentication
In order for users to authenticate at PageCounters and PageCounter Minis with Smart Card
To configure user authentication via Smart Cards, do the following:
1
In System Manager, go to Configuration > Security and authentication > User authentication.
2
3
Select the following Authentication mechanisms:
• Equitrac Office and Express PINs – verifies Equitrac user information.
• External user ID and password – verifies all user information outside of Equitrac.
Click OK to save the settings.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 467
Chapter 18: Using Contact Smart Cards
Using Smart Cards with the PageCounter
When the PageCounter terminal or PageCounter Mini is configured to use the Smart Card solution, users can log on with their card at the Smart Card reader attached to the PageCounter device. If the user does not already exist in CAS, and System Manager is configured to automatically create new user accounts, the user account will be auto-created upon successful login with a Smart Card.
Before using the smart card for the first time at a PageCounter terminal or PageCounter Mini, log onto the DCE server using with the smart card at a USB card reader. Logging on to the DCE server with the smart card sets up the CSP
(Cryptographic Services Provider) which is the software used to decrypt and read the certificate on the card. DCE auto-discovers the CA (Certificate Authority) that issued the certificate and validates it. Additionally, any vendorspecific smart card drivers should be installed on the DCE server before using the card. Once the smart card successfully communicates with DCE, the card can be used to login at the PageCounter devices.
PageCounter Terminal
To login and perform a transaction using a Smart Card at a PageCounter terminal, do the following:
1
2
3
4
5
6
Insert the Smart Card into the Smart Card reader attached to the PageCounter.
On the PageCounter terminal display, enter the Smart Card PIN using the keypad, and press the Enter key. If more than one account exists, press the corresponding number key beside the account name, and then enter the Smart
Card PIN. For example, press the 1 key to select 1:accountname.
Press the corresponding function key for the task to perform. For example, press the F1 key to select Print.
If configured in System Manager to prompt for billing code after user identification, enter the billing code number via the keypad.
Perform the desired transaction.
To logout and end a session, remove the Smart Card from the reader. Alternatively, the user can press the End key on PageCounter terminal.
PageCounter Mini with Xerox MFP
To login and perform a transaction using a Smart Card with a PageCounter Mini at a Xerox MFP, do the following:
1
2
3
4
5
6
Insert the Smart Card into the Smart Card reader attached to the PageCounter Mini.
On the Xerox MFP display screen, enter the Smart Card PIN on the soft keyboard. If more than one account exists, select the account, and then enter the Smart Card PIN.
Select the task to perform. For example, copy or print.
If configured in System Manager to prompt for billing code after user identification, enter the billing code.
Perform the desired transaction.
To logout and end a session, press the Log In/Out hard key on the Xerox MFP front panel. Alternatively, if configured in System Manager, the user can remove the Smart Card from the card reader to end the session. See
Enable Logout with Smart Card at PageCounter Mini
on page 469.
NOTE: The Xerox embedded device and the PageCounter Mini must be on the same DCE server when using the Smart
Card solution.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 468
Chapter 18: Using Contact Smart Cards
Enable Logout with Smart Card at PageCounter Mini
By default, when a user removes a Smart Card from the card reader at the PageCounter terminal, they are automatically logged out from their session. This is not the default action for PageCounter Minis attached to Xerox devices.
To enable logout when removing the Smart Card from the card reader at the PageCounter Mini, do the following:
1
In System Manager, go to Configuration > Devices > Embedded devices.
2
3
4
Select Xerox Secure Access from the Device type drop-down list.
Select the Force logout on swipe checkbox.
Click OK.
Using Multiple Smart Card Readers
Multiple Smart Card readers can be connected to a single DCE server. The default number of card readers physically connected to a single server is eight (8). However, the system can be configured via Registry keys to allow a maximum total of 64 card readers—combined physical and virtual—to be connected to the system at one time.
Although more than the recommended maximum default number of card readers can be connected, there are limitations to running large numbers of card readers on the system. A large number of virtual card readers may impact performance, since the Windows console does not differentiate between virtual and physically connected card readers, and perceives all connections to be physical. The more card readers added, the longer it may take to start the
Smart Card service.
Additionally, if more than 10 Smart Card readers are physically connected to the system, the Windows console stops user logins with Smart Cards.
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 469
Chapter 18: Using Contact Smart Cards
EQ-AG-5.7-20160921
Nuance® Equitrac® Office and Express 5.7 Administration Guide | 470
