SyferLock - Secure Authentication

Traditionally, the approach to secure authentication ranges from re-usable passwords at one end of the spectrum to 2 Factor Authentication (2FA) with a one time password (OTP) at the other.

• Re-usable passwords are convenient but they are not secure and vulnerable to attack.
• The 2FA approach is more secure but expensive to implement.
• OTP are typically generated by hardware tokens which are costly, onerous on the user and administrator and need to be replaced when broken or lost and re-licenced.

What's needed is a secure authentication solution that is highly secure, no HW token required, easy to use, reliable, inexpensive to purchase and cost effective to implement, administer and manage.

SyferLock is such a solution in that it provides secure 2 Factor authentication for users with the convenience of reusable passwords, the security of one time password (OTP) at a fraction of the upfront and ongoing costs of other offerings.

SYFERLOCK... is based on a unique Grid Data Security Solution. GridGuard takes the tried and proven process of OTP and adds an interesting twist - THERE IS NO TOKEN.

The SyferLock solution offers one time passwords (OTP) with zero client side footprint i.e. no modification to the users Desktop or loading of client software required. Users can use their existing passwords and customers can maintain their existing infrastructure for accounts management. The solution is integrated into the customers existing web properties and communicates securely with the grid server to authenticate and then allow access to the users web service(s).

SyferLock supports all requirements involving the authentication of users before they interact with mission-critical data and applications through Remote Authentication (SSL VPN), Intranets & extranets, E-mail, Microsoft Windows Desktops, etc. SyferLock integrates easily with existing systems, such as Microsoft OWA, Citrix, .net, Java, Cisco and Juniper. There is an API so creating custom implementations is straightforward. SyferLock is a great alternative for federated identity without the need to share database information or synchronise databases.

Scalability - SyferLock scales up to Millions of Users and is ideally suited for public/customer access to online personal information , ebusiness applications and web based services. Organisations such as government departments, banks, financial institutions, insurance companies and public utilities seeking cost effective secure authentication for end users, citizens or customers can now deliver this capability at a fraction of the cost.

How does it work - On the users website/application, the traditional login interface is replaced by SYFERLOCKS... login grid. At the time of login, the user is provided with a grid with each cell representing one character in the keyboard. The character in the cell is surrounded by four numbers, one at each of the four corners of the cell. When the user sets up the account, he/she simply selects the corner they will use for generating the one time password (OTP) with the userid and the corresponding password being stored in the secure grid server.

When it is time to login to a protected system, the user enters the ID and password as always. However, when entering the password, the user does not type it. Rather, they type the number appearing in the selected corner of each character of the password. This generates a one-time pass-code based on the password. The user never types the actual password in.

At any time, the user can change and select a new corner of the square, change their password and view a log of all authentication activity without Help Desk or Administrator assistance. The numbers on each cell of the grid are randomly generated using SyferLock's powerful algorithm and the user will have a completely unique combination for the password at every login. The userid and the one time password are then sent to the secure grid server/appliance for authentication. Once the user is authenticated, the service provider's web server permits the user access to their application/web service. The solution supports multiple languages and character sets so users can formulate passwords in their native languages and alphabets.

GridGuard can also be set up for two factor authentication (2FA) with one password and one pin. For additonal security, SyferLock incorporates decoy digits in the one time password.

Security - The SyferLock algorithm is designed to thwart attack in such a way that if the attacker sits in the middle and observes the patterns of the random numbers generated, they are unable to obtain the password, as the actual password is never typed in. SyferLock eliminates or mitigates the following attacks: key loggers, shoulder surfing, brute force attacks, phishing, replay attacks, stored browser passwords, dictionary attacks, password sniffing and interception.

READ MORE... for a detailed security analysis of the SyferLock solution

The University of Portsmouth produced a white paper titled "Secure Passwords? - Patented One Time Password technologies and their effect on Privacy. READ MORE... to view the white paper.

Easy to Use - SyferLock has been successfully implemented in senior citizens communities where Help Desk calls tend to be more frequent than with other implementations. People who were just learning to use computers had no trouble learning to use SyferLock GridGuard.

mbits is the exclusive representative for SyferLock here in Australia. Talk to mbits today about what a SyferLock soluton can bring to your organisation and arrange a demonstration. In the meantime the following eBROCHURE... provides further detail on the solution, key benefits and features.