Central Password Server

Reuters needed a solution that restricted access to computers installed worldwide to technical staff who are authorised to perform maintenance. It also had to be possible to trace who had performed maintenance, on which system and at what time.

Market: Cross-market
Technology: Voice response, ACE/Server, Java, C, one-time passwords, SSL, SecurID cards

Background

A life-cycle management contract for the complete system was concluded with Reuters, which consisted of a maintenance programme for repairing possible failures, preventative maintenance and, if necessary, expansion activities. A 24/7 call-support contract was also entered into, as the live system was to be launched worldwide. In order to be able to provide adequate maintenance, the West hosting centre in Delft houses an exact copy of the entire system.

Approach

The solution put forward by West was to equip the computers with a one-time password system, whereby a password can only be used once to access a computer. These unique passwords are centrally registered and released. After obtaining authorisation, a maintenance technician may request a new one-time password for a computer from the central server. This can be done in four ways:

  • voice response (touch-tone telephone)
  • a global data network
  • a dial-up connection via a modem
  • the 'human dispatcher'

Technique

Due to the need to be available 24/7, the central server is realised on a Sun High Availability(HA) cluster. The central database, authorisation and administration servers run on this cluster. All components are carried out in two-fold. The system is managed and monitored using a Java servlet interface, which has been placed behind a secured web server.

The system consists of the following components:

  • Sun High Availability(HA) cluster
  • Voice response servers with ISDN30 connection
  • Modem servers
  • Oracle database server
  • iPlanet (former Netscape) Enterprise Server
  • RSA (former Security Dynamics) ACE/Server (SecurID authorisation)
  • Software in Java and C