Table of Contents
Advertisement
Operation
Message Flow
The Secure Access Modem is connected to a PSTN by voice-band modems. The Authentication
Server is connected to the PSTN via a modem bank, allowing access to the server by multiple users.
A secondary Authentication Server minimizes delay and avoids downtime. The message flow
between components in a Secure Access Controller system is detailed below.
REMOTE USER
CLIENT
MODEM
REMOTE
MANAGEMENT
of SAM
Figure 3-1
Background Communication
1. The Secure Access Modem (SAM) obtains a new private key from the Authentication Server
(AS) via a secure tunnel at every power-up, key time-out or session end.
First Call
2. Remote user's client software calls the Authentication Server (AS) and is identified via
encrypted communication over a secure tunnel. In the event of a hacker attempt, a secure
tunnel is never established. When the caller is authenticated, the Authentication Server sends
the client the SAM phone number and its public key over the secure tunnel. AS then
disconnects the call.
Second Call
3. Client calls the SAM and performs a public key exchange over a secure tunnel.
Authenticated Out-of-Band Management Access
4. User manages protected network equipment via the secure tunnel and AES data encryption:
•
Client sends AES encrypted data to SAM;
•
SAM decrypts data and sends it to the
protected network equipment;
•
The protected equipment sends data to SAM;
•
SAM encrypts data and sends data to client;
•
Client decrypts data and displays it to user;
Note
When the user terminates the management session, that public key is no longer valid.
3-20
Primary Authentication Server Site
Secure
connection
2
to Server
MODEM BANK
PSTN
Secondary Authentication Server Site
MODEM BANK
SAM Authentication Sequence
SpectraComm Dual V.34 Modem
Installation and Operation
PRIMARY
AUTHENTICATION
SERVER
Remote User Modem
3
3
calls SAM Modem
SECONDARY
AUTHENTICATION
SERVER
Remote
User
Decrypted
Encrypted
Data
Data
Security Overview
SAM
Modem calls
MODEM
Server for
New Key
1
Modem
4
connects
secure call
to Switch
CICSO 2611
to SWITCH
Protected
Equipment
SAM
MODEM
MODEM
Encrypted
Decrypted
Data
Data
060R122-000
Issue 15
Advertisement
Table of Contents
