You can restrict the maximum number of assigned authenticators per user for specific authenticator types to the number of devices really needed via the policy settings. If you need to have more than one authenticator provided to your users, limit the number to avoid that too many authenticators (and/or instances) are assigned to or activated for single users. The higher the number of authenticators assigned to a single user, the higher the chances of successful OTP guessing attacks!
Standard licensing and activation
The standard licensing model applies to hardware authenticators that are pre-provisioned ex factory, and software authenticators using standard one-step activation.
The standard activation process involves generating an activation code and sending it to a software authenticator separately or as part of the full activation data. Although generating the activation data is part of the first-time activation process, you can regenerate and resend the activation data for already activated authenticators. This may be required for security purposes.
Generating the activation data of an activated authenticator or sending the activation data to it will invalidate the current activation! In this case, the user will no longer be able to log on with that authenticator.
Multi-device licensing and activation
OneSpan Authentication Server supports multi-device licensing (MDL) and multi-device activation (MDA). This licensing and activation model applies to the following authenticators:
E-signature authenticators: Digipass 760
Software authenticators: Mobile Authenticator Studio and Mobile Security Suite
Certain multi-device licensing/multi-device activation functionalities and the Secure Channel feature are aimed at the banking security market only. Some of these functionalities will therefore not be available for typical enterprise security deployments.
The multi-device licensing/multi-device activation with the Secure Channel feature requires a SOAP provisioning and/or SOAP signature license!
With the multi-device licensing model and its one-to-one relationship between a user account and an authenticator serial number license, a user account can optionally be bound to several authenticator instances. The multi-device activation process is an activation process in two steps that guarantees that only the intended end user can perform the device activation.
Multi-device licensing
With the multi-device licensing (MDL) model, each authenticator serial number corresponds to a unique authenticator license. Consequently, for each authenticator device compliant with the multi-device licensing model, the corresponding DIGIPASS export file (DPX) contains one authenticator master activation application for each authenticator license. These authenticator instances are represented in OneSpan Authentication Server as authenticators with a single authenticator master activation application.
One authenticator license allows to instantiate several authenticator instances that are bound to the same authenticator license. Authenticator instances are not different from authenticators activated in the standard process with regard to the representation of authenticator applications. OneSpan Authentication Server creates the authenticator instance(s) for a particular license during the multi-device activation process.
The number of instances that can be activated for each authenticator license is limited to a predefined threshold that is configured by OneSpan at the time of order. A maximum number of 99 instances can be configured, and each authenticator instance can have from 1 to 8 authentication or e-signature application(s). These authenticator instances are represented in OneSpan Authentication Server as authenticators with the same base serial number as the bound authenticator license, appended with the instance sequence number.
Multi-device activation
In the multi-device activation process, a two-step activation process, two separate activation messages are used for activating the device(s). This serves to guarantee that only the intended end user, and not an adversary who has intercepted one of the messages, can perform the activation. This multi-device activation is a different process from the standard software authenticator activation and requires authenticator devices and DPX files compliant with the multi-device licensing model. When a compliant authenticator is activated, settings and secrets are written into the device.
Master activation applications and activation messages
The multi-device activation process uses the master activation application, which contains an individual master activation key for each authenticator license. Every authenticator license must be linked to a single user account. Two separate activation messages are used in the activation process:
Activation Message 1. The first activation message allows to activate an authenticator license in the device. It may be used several times to allow activation of multiple authenticator instances (of one authenticator license) on multiple authenticator devices if necessary. The validity period for Activation Message 1 is configurable in your OneSpan Authentication Server policy.
Activation Message 2. The second activation message allows to activate an authenticator instance of a license in the device. It can be used for the effective activation of one authenticator instance only.
Both activation messages should be delivered to the end user via authentic channels. For instance, Activation Message 1 should be delivered via a secure letter or email and Activation Message 2 should be delivered via the online banking application.
Each authenticator license will be used several times for activation of several authenticator instances (in several authenticators) for one user account. However, only one license will be consumed for the activation of the different authenticator instances for one user account.
Authenticator instance sequence number
With each activation of a new authenticator instance, OneSpan Authentication Server will generate new authenticator applications. A sequence number will be incremented for each new authenticator instance issued from the same license. The number of instances which can be issued from a license will be limited to a pre-defined threshold between 1 and 99 (configured by OneSpan at the time of order). The different authenticator instances of one user share the base serial number (the serial number of the authenticator license), but will be appended with a unique sequence number for the authenticator instance. The keys of the authenticator instance applications will be different for each instance.
Secure channel
Secure Channel is an optional feature applicable to authenticators compliant with the multi-device activation process (in the context of multi-device licensing). The optional use of secure channels after activation of an authenticator instance allows to protect the messages that are exchanged between the server side and the client side.
The secure channel will be usable only if the secure channel feature has been ordered from and configured by OneSpan at the time of order.
The secure channel feature applies a new protocol that uses payload keys to protect the confidentiality and authenticity of the message's payload. A single master payload key is shared among all authenticator instances linked to a certain authenticator license, enabling the end user to transparently use multiple authenticators to answer the transaction request message.
Secure channel requires the mandatory provisioning of a payload key represented on the server side by a payload key BLOB. In this case, first a payload key will have to be generated once for each authenticator license. The different authenticator instances activated from one authenticator license must share the same payload key. After the activation, the payload key will protect the request and deactivation messages for exchange between the server and the client devices that have been activated using a particular authenticator license (for a particular user account).
The parameters used to generate the request body for secure channel messages can be configured via the POLICIES > Secure Channel tab of the Administration Web Interface.
If secure channel has not been ordered, OneSpan Authentication Server will not generate and provision any payload key.
Push notifications via the Mobile Authenticator app
OneSpan Authentication Server supports authentication via push notifications (push and login). This authentication method uses a push mode to enable the OneSpan Mobile Authenticator app on a mobile device to authenticate the user. For an overview of the push notification-based authentication process, see Push notification–based authentication. For detailed information about the OneSpan Mobile Authenticator app, refer to the OneSpan Mobile Authenticator and Mobile Authenticator Studio product documentation. For detailed information about the push notification solution in general, refer to the Push Notification Solution Guide.
Online activation of the Mobile Authenticator app
After downloading the OneSpan Mobile Authenticator app from the relevant market place of the mobile device, the user must activate the OneSpan Mobile Authenticator app via the OneSpan User Websites. To do so, users must enter their user name and password in the Self-Registration, Auto-Assignment, and Online Activation for Mobile Authenticator page. If back-end authentication is successful, a color QR code containing the required activation data is displayed on the Self-Registration, Auto-Assignment, and Online Activation for Mobile Authenticator page. To complete the activation process, the users need to scan the color QR code using their OneSpan Mobile Authenticator app.
Upgrading to push notifications
The OneSpan Mobile Authenticator app prior to version 2.1 must be upgraded to support push notification–based authentication. The same applies to OneSpan Mobile Authenticator 2.1 if push notifications have not been configured during the activation process.
To upgrade to push notifications, users must enter their user name, password, and the authenticator serial number in the Enable Push Notification for Authentication page. If back-end authentication is successful, a color QR code containing the required upgrade data is displayed on the page. To complete the upgrade process, the users need to scan the color QR code using their OneSpan Mobile Authenticator app.