Nexus Documentation

Space shortcuts

Page tree

CURL vulnerability information (CVE-2023-38545)
Nexus awareness advisory on Microsoft's update KB5014754

Visit Nexus to get an overview of Nexus' solutions, read customer cases, access the latest news, and more.

Why protect digital resources with strong authentication?

Today, most people agree that authentication with username and password is not secure enough to protect your digital resources and services. To be secure, passwords must be long and complex, unique for each service and changed frequently. But that is not the reality. Passwords can also be easily stolen through an endless range of social engineering methods, for example, convincing emails or spoofed websites where people are asked to share their username and password. 

Multifactor authentication dramatically mitigates the risk of unauthorized people getting access to services and information. 


What is multifactor authentication?

The security and trust level of an authentication solution depends on the number of factors required for successful identification. An authentication solution capable of withstanding any type of identity fraud should consist of a combination of these factors:

What you know:

A static username, password or PIN.

What you have:

A unique possession, such as a hardware token, mobile device, or smartcard.

What you are:

A unique biological characteristic, such as a fingerprint, iris pattern or facial features.

Nexus Digital access enables risk-appropriate authentication

Smart ID Digital access management is a unique solution for organizations to empower their users with trusted authentication that is easy to use, easy to manage, cost-efficient and secure, and to enforce strong multi-factor authentication. For example, you can choose from several methods that do not require distributing and maintaining hardware security tokens, by using hardware that the end user already has, such as a mobile device or laptop. 

With the Digital access platform, you can select the most risk-appropriate authentication method for each application. For example, you can allow password-based authentication to access less sensitive applications, while requiring two-factor authentication to access highly sensitive data. When an already authenticated user requests access to a more sensitive application, you can apply step-up authentication, which requires the user to authenticate again with an additional credential. This is what the industry refers to as risk-appropriate authentication. 

Enable strong user authentication throughout the organization and customer base without the complexity of distributing hardware security tokens.

Simple management of users and passwords with Digital access

Users in Digital access can be managed through the web-based administration UI or integrated into your applications by using the web services API, XPI:WS. Provisioning through LDAP and Active Directory is supported to fully automate the enrollment process without requiring any manual user administration. 

Users can manage their passwords via self-service functions in the web portal. When a password is about to expire, the user will be notified and asked to update the password. A user who has forgotten the password can recover it via the web portal login page. New passwords are automatically checked for compliance to password policies and against the password history to avoid reuse of passwords. The solution can be integrated with Microsoft Active Directory, to manage accounts and passwords within Active Directory. 


Available 2FA methods with Smart ID Digital access 

Nexus' Digital access platform is based on leading industry standards to guarantee operability with existing applications and security infrastructures. 

Nexus' solution uses standard protocols and is extendible through a plug-in API. Open standards such as X.509, Open Authentication, RADIUS, LDAP, SAML 2.0, OpenID Connect and OAuth 2.0 are supported. For applications that do not support any of these standards, integration with Web Services interface is offered. 

To find the right two-factor authentication method for your needs, consider the level of security needed for your applications and make sure it is convenient for your end users. 

Compare two-factor authentication (2FA) methods


For full lifecycle management of the authentication methods, with automated workflows and self-service functionality, see Digital ID. 



AAL levels of 2FA methods in Digital access

In the table below you can see the 2FA methods and the corresponding Authenticator Assurance Level (AAL) in the Digital access platform. 

2FA methodAAL level
Mobile virtual smart cardAAL3
Virtual smart cardAAL3
Smart cardAAL3
Mobile OTPAAL2
Hardware OTP tokenAAL2
Software tokenAAL1

The three AALs define the subsets of options agencies can select based on their risk profile and the potential harm caused by an attacker taking control of an authenticator and accessing agencies’ systems. The AALs are as follows:

AAL1: AAL1 provides some assurance that the claimant controls an authenticator registered to the subscriber. AAL1 requires single-factor authentication using a wide range of available authentication technologies. Successful authentication requires that the claimant prove possession and control of the authenticator(s) through a secure authentication protocol.
AAL2: AAL2 provides high confidence that the claimant controls authenticator(s) registered to the subscriber. Proof of possession and control of two different authentication factors is required through a secure authentication protocol. Approved cryptographic techniques are required at AAL2 and above.
AAL3: AAL3 provides very high confidence that the claimant controls authenticator(s) registered to the subscriber. Authentication at AAL3 is based on proof of possession of a key through a cryptographic protocol. AAL3 is like AAL2 but also requires a “hard” cryptographic authenticator that provides verifier impersonation resistance.

For more information about AALs, see https://pages.nist.gov/800-63-3/sp800-63-3.html.


2FA methods

Mobile virtual smart cards

Mobile virtual smart cards are trusted digital identities hosted in a secure mobile app. They are used for out-of-band authentication to digital resources (such as Office 365 or other apps), digital signing, email encryption and visual identification.

With mobile virtual smart cards, you get an intuitive and user-friendly two-factor authentication (2FA) method. They are also an economical choice, since most users already have a smartphone, which means that you do not have to issue and manage hardware tokens, smart cards or smart card readers.

Mobile virtual smart cards are included in Digital ID, with automated lifecycle management and self-service workflows.

How does it work?

Mobile virtual smart cards are based on PKI and enable users to easily authenticate, encrypt or sign using fingerprint or face recognition.

The mobile multi-factor app Smart ID Mobile App for use with mobile virtual smart cards offers fingerprint and face recognition for easy usability. The app is used together with a messaging backend to manage the online authentication and signing services and for sending push notifications. 


Smart ID Mobile App can also be used in offline mode with one-time passwords (OTP). The app is available on iOS and Android.


Security:

  • Out-of-band authentication
  • Multiple encryption layers and device-binding protect keys
  • Protection against reverse engineering and malware

Convenience:

  • No need for extra hardware tokens

  • Easy enrollment and intuitive use cases
  • Biometric validation 

Virtual smart cards

Virtual smart cards use PKI-based identities in a secure environment on laptops, to let users get rid of passwords and use strong authentication, signing and encryption in a smooth way. They work as physical smart cards, but without the need to issue and manage plastic cards or other hardware tokens. 

With virtual smart cards, you get an intuitive and user-friendly two-factor authentication (2FA) method. They are also an economical choice, since they take advantage of existing technology available on many laptops, which means that you do not have to issue and manage hardware tokens, smart cards or smart card readers. 

Virtual smart cards are included in Digital ID, with automated lifecycle management and self-service workflows.

How does it work?

Virtual smart cards are hosted on your laptop and have the same level of security as a physical smart card. Keys are securely created and stored on the Trusted Platform Module (TPM) chip, which is available on most laptops. 

Smart ID Desktop App lets you provision and manage virtual smart cards, based on Microsoft Virtual Smart Card (VSC) and Universal Windows Platform (UWP) technology. The solution uses native Microsoft mini-driver for communication with the VSC.

The Smart ID Desktop App is used together with a messaging backend to manage the online authentication and signing services. 

Security:

  • Keys are created and stored on the secure TPM chip on Windows laptops

Convenience:

  • No need for extra hardware tokens

  • Intuitive use cases
  • Integrated in Windows environment 

Smart cards

By using PKI chip cards with certificates, users can log in to computers without a password, sign documents digitally and access local and cloud resources. 

Smart cards helps users with a high-security, all-in-one solution by combining PKI certificates with RFID technology and visual identity on one card. 

If you order cards as a service from Nexus GO, you get customized and personalized PKI cards, encoded and ready to use, with the right security level for your organization. Then, Nexus provides and maintains the PKI infrastructure.

The PKI certificates on the card chip can be used for two-factor authentication, passwordless login to Windows, digital signing and encryption.

How does it work?

Combine the following components to suit your organizations special requirements:

  • Visual identity
    Get your cards customized with a company logo and color scheme and personalized with a photo and personal data.

  • PKI chip
    Use certificates for two-factor authentication, passwordless login to Windows, digital signing and encryption.

  • RFID technology 
    Choose one or combine two of the most common RFID (Radio-frequency identification) technologies on high-quality cards with the original RFID chip.

  • Visual security elements 
    Add security elements to ensure that your photo ID cards are hard to forge. 

Security:

  • Keys are created and stored on the secure PKI chip of the card

Convenience:

  • All-in-one solution for visual ID, physical access, strong authentication, signing and encryption

  • Use one card on multiple computers

Mobile OTP

The mobile app Smart ID Mobile App supports time-based and event-based one-time passwords (OTP). 

Smart ID Mobile App works in offline mode and offers extra security compared to other mobile apps for two-factor authentication, since the user must authenticate in the app with a PIN code or biometric validation with fingerprint or face recognition, before receiving the OTP. 

About one-time passwords (OTP)

A one-time password (OTP) is a temporary and unique passcode, that is generated by an algorithm to authenticate users to digital resources. There are different types of one-time passwords (OTP), as defined by the Initiative for Open Authentication (OATH):

  • Time-based OTP (TOTP): A TOTP is renewed after a fix amount of time, for example 30 seconds. The algorithm that generates each password uses the current time of day as one of its factors, ensuring that each password is unique. 
  • Event-based OTP (HOTP): An HOTP is valid per authentication. After authentication a new OTP is generated. 

One-time passwords (OTP) in Nexus' Digital access platform

Smart ID Digital access supports OTP-token authentication for the OATH standards for HOTP, TOTP and OCRA as well as self-registration for OATH-compliant mobile applications. 

For information on other supported OATH-based authentication methods in Digital access, see Authentication methods in Digital Access. 

Security:

  • Time- or event-based one-time passwords.
  • Protection with PIN or biometric validation.
  • Supports strong algorithms, such as SHA512 and SHA256.

Convenience:

  • No need for extra hardware tokens

  • Works offline

Hardware OTP tokens

Hardware one-time password (OTP) tokens include various devices, such as key fobs and display cards, and either one-button tokens or tokens with PIN protection. 

About one-time passwords (OTP)

A one-time password (OTP) is a temporary and unique passcode, that is generated by an algorithm to authenticate users to digital resources. There are different types of one-time passwords (OTP), as defined by the Initiative for Open Authentication (OATH):

  • Time-based OTP (TOTP): A TOTP is renewed after a fix amount of time, for example 30 seconds. The algorithm that generates each password uses the current time of day as one of its factors, ensuring that each password is unique. 
  • Event-based OTP (HOTP): An HOTP is valid per authentication. After authentication a new OTP is generated. 

One-time passwords (OTP) in Nexus' Digital access platform

Smart ID Digital access supports OTP-token authentication for the OATH standards for HOTP, TOTP and OCRA as well as self-registration for OATH-compliant mobile applications. 

For information on other supported OATH-based authentication methods in Digital access, see Authentication methods in Digital Access. 


Security:

  • Time- or event-based one-time passwords.

Convenience:

  • Works offline

Software tokens

PKI software tokens (or soft tokens) can be used when you need a convenient method that is easy to rollout, but does not necessarily have the highest security level. Typical use cases include authentication at VPN access point and web services or for digital signature of emails and documents. 

Software tokens are often used in combination with other methods. For example, a smart card might be required for Windows logon, but the security level of a software token is enough for VPN access.  

Software tokens are delivered as PKCS#12 files or published in to Windows certificate store. A software token is used together with a password for authentication, signing and encryption.  

Security:

  • Two-factor authentication by using PKCS#12 file and password
  • Easy withdrawal by revoking certificates

Convenience:

  • Certificate is available on the device
  • Used for multiple use cases




Copyright 2023 Technology Nexus Secured Business Solutions AB. All rights reserved.
Contact Nexus | https://www.nexusgroup.com | Disclaimer | Terms & Conditions