* TriCipher's myOneLogin provides strong security without creating complicated processes for end users
TriCipher has long been known for its strong layered approach to user authentication. Many businesses such as financial institutions have implemented a TriCipher solution to authenticate customers accessing their accounts over the Internet. Until now, a TriCipher security implementation meant installing an ID Vault appliance within the business’ infrastructure. Now the vendor is delivering the power of its authentication solutions to a broader range of businesses by delivering them as a service called myOneLogin.
I first encountered TriCipher a few years ago when I was researching multifactor authentication within the banking industry. I learned then that the company has a layered solution called the TriCipher Armored Credential System (TACS) that the vendor likens to a ladder; the security level gets more stringent as you go up the ladder. The technology provides a range of authentication methods including passwords, browser cookies/certificates, PCs, portable devices, tokens, smart cards and biometrics.
What makes the TriCipher authentication solution so secure is that one part of a user’s credential is generated on his own computer and the other part of the credential is stored on a remote appliance called the ID Vault. For the user to successfully authenticate, both parts of the credential must be combined. This makes it hard for a hacker to steal the entire credential in order to log into an account.
The TriCipher ID Vault is a FIPS 140-2 Level 2 rated appliance that securely manages user information, digitally signs transactions, and authenticates users as part of the TACS.
Companies that want to deploy a TriCipher authentication solution can purchase an ID Vault and deploy it as part of their internal infrastructure. Or, as an alternative deployment method, customers can allow TriCipher to host the ID Vault and subscribe to a new service called myOneLogin. End users access the hosted authentication service through a myOneLogin portal. Business subscribers choose the TriCipher level of authentication that best meets their needs.
There are two distinct services offered as part of myOneLogin: SSL VPN authentication, and authentication to Web-based applications such as SalesForce.com, WebEx and Google Apps.
The myOneLogin SSL VPN authentication service strengthens authentication with SSL VPNs without requiring any hardware or software installation. One part of the myOneLogin credential is stored on the user’s computer and the other part is stored in the myOneLogin service. Authentication requires both parts of the credential.
An end user connects securely to a myOneLogin portal that is specific to a particular business. The myOneLogin service communicates with the SSL VPN using the Security Assertion Markup Language (SAML) standard.
From this point, a business has multiple options for deploying myOneLogin with its SSL VPN. MyOneLogin can handle the complete authentication, including password and second factor. Or, myOneLogin can be configured to validate only the second factor, and the business can validate the password against its existing user repository. Either way, myOneLogin communicates with the SSL VPN using digitally-signed SAML assertions. In addition, the myOneLogin SSL VPN authentication service allows a business to provide secure remote access authentication without requiring the use of hardware tokens.
The second service enabled by the myOneLogin hosted service is access to Web-based applications. This service takes advantage of the TriCipher Authentication Gateway (TAG), which powers the service portal where users authenticate their credentials and then log in to SaaS applications.
Before end users can access their SaaS applications using myOneLogin, an administrator performs a one-time configuration to define the applications that the users can access. The first time a new user connects to the myOneLogin service, a strong 2-factor credential is downloaded to his PC and a one-time activation key is sent to the user. This helps the user set up his computer for perpetual secure access to myOneLogin.
When the user connects to myOneLogin, the portal page displays the applications he is permitted to access, and myOneLogin handles the 2-factor authentication with the application.
Whether a company is interested in providing secure authentication to a company’s SSL VPN or to Web-based application, TriCipher’s myOneLogin provides strong security without impacting the company’s infrastructure in any way, and without creating complicated processes for end users.
