User's Manual

8
2 Introduction
2.1 What is WebOTP?
WebOTP is a secure authentication device via PC and related USB connection.
WebOTP is especially suited for the authentication of web service users by means of an Internet browser, but it can also
be used within all those environments requiring any form of authentication.
The product is made up of an USB device for authentication to assign to users and by an SDK software which provides
the necessary services for authentication.
2.2 Use case
The typical WebOTP use case is represented by a user needing to authenticate for using an Internet remote service via
web.
The authentication process starts with the presentation by the Internet browser of a page requiring the insertion of the
WebOTP device by the user. The user inserts the device in a USB port and the device automatically sends a data code to
the server for authentication. If the authentication is successful the browser will display the user a reserved access page.
This occurs without any interaction by the user, who is only requested to insert the device in a USB port upon
authentication. The whole acknowledgement, transmission and authentication process takes place silently.
2.3 Features
The main features of WebOTP that distinguish it from a traditional OTP are as follows:
Usability –
The interaction requested to the user is extremely reduced. The user is only requested to insert the device in
a USB port upon authentication.
Identification –
Besides being authenticated the user is also identified. Therefore it is not necessary to request the user
an identifier like a username before authentication.
Secure authentication –
Authentication is based on 128 information bits and on the AES 256 bits algorithm
.
It is
therefore almost impossible to carry out a brute force attack.
2.4 Operation
WebOTP provides several authentication methods for better suiting any kind of need. It is possible to use such protocols
as One Time Password, Challenge Response or SMS-based protocols.
2.4.1 One Time Password
The One Time Password protocol, in short WebOTP, is a protocol that allows authentication via a monodirectional
communication from the user towards the system.
The protocol is available both in event-based and in time-based version according to the hardware equipment at
disposal.
The main feature of this protocol is the extreme compatibility with all operating systems and Internet browsers without
the need of installing software components on the system and of being granted special execution permits.
2.4.2 Challenge Response
The Challenge Response protocol, in short WebCHR, is a protocol that allows authentication via a bidirectional
communication between the user and the system.
Thanks to the type of communication, this protocol is intrinsically more secure than the corresponding WebOTP, but it
requires stricter software requisites.
Using special software with the system allows a multiple query of the device from remote without requiring any
interaction with the user.