Transcription
IBM Client SecuritySolutions Client Security Software Version 5.4Installation Guide
IBM Client SecuritySolutions Client Security Software Version 5.4Installation Guide
First Edition (October 2004)Before using this information and the product it supports, be sure to read Appendix A, “U.S. export regulations forClient Security Software,” on page 31 and Appendix C, “Notices and Trademarks,” on page 39. Copyright International Business Machines Corporation 2004. All rights reserved.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.
ContentsPreface . . . . . . . . . . . . . . . vAbout this guide . . . . . . . . . . . . . vWho should read this guide . . . . . . . . . vHow to use this guide . . . . . . . . . . . vReferences to the Client Security SoftwareAdministrator and User Guide . . . . . . . . viAdditional information . . . . . . . . . . viChapter 1. Introduction . . . . . . . . 1The IBM Embedded Security Subsystem . .The IBM Embedded Security Chip . . .IBM Client Security Software . . . . .The relationship between passwords and keysThe administrator password . . . . .The hardware public and private keys . .The administrator public and private keysESS archive . . . . . . . . . . . .User public and private keys . . . . .The IBM key-swapping hierarchy . . .CSS public key infrastructure (PKI) features .11222334445Chapter 2. Getting started . . . . . . . 7Hardware requirements . . . . . .IBM embedded Security Subsystem .Supported IBM models . . . . .Software requirements . . . . . .Operating systems . . . . . .UVM-aware products . . . . .Web browsers . . . . . . . .7777778Chapter 3. Before installing thesoftware . . . . . . . . . . . . . . 11Before you install the software . . . . . .Installing for use with Tivoli Access ManagerStartup feature considerations . . . . .BIOS update information . . . . . . .Using the administrator key pair to archive keys.1111111212Chapter 4. Downloading, installing, andconfiguring the software . . . . . . . 13Downloading the software . . .Installing the software . . . . .Selecting a configuration option .Typical configuration . . . .Advanced configuration . . .Using the IBM Client Security Setup Copyright IBM Corp. 2004. . . . . . . . . . .Wizard.131414141616Using the Setup Wizard to complete a typicalconfiguration . . . . . . . . . . . . .Using the Setup Wizard to complete an advancedconfiguration . . . . . . . . . . . . . .Enabling the IBM Security Subsystem . . . . .Upgrading your version of Client Security SoftwareUpgrading using new security data . . . . .Upgrading from CSS 5.0 or later using existingsecurity data . . . . . . . . . . . . .Uninstalling Client Security Software . . . . . .Export regulations . . . . . . . . . . . .1718202121212223Chapter 5. Troubleshooting . . . . . . 25Administrator functions . . . . . . . . .Authorizing users . . . . . . . . . .Setting a BIOS administrator password(ThinkCentre). . . . . . . . . . . .Setting a supervisor password (ThinkPad) . .Clearing the IBM embedded Security Subsystem(ThinkCentre). . . . . . . . . . . .Clearing the IBM embedded Security Subsystem(ThinkPad) . . . . . . . . . . . .Known issues or limitations with CSS Version 5.4Re-installing Targus fingerprint software. . .BIOS supervisor passphrase . . . . . . .Smart card limitations . . . . . . . . .Troubleshooting charts. . . . . . . . . .Installation troubleshooting information . . . 25. 25. 25. 26. 27.27282828282828Appendix A. U.S. export regulations forClient Security Software . . . . . . . 31Appendix B. Password and passphraseinformation . . . . . . . . . . . . . 33Password and passphrase rules . . . . . .Administrator password rules . . . . .UVM passphrase rules. . . . . . . .Fail counts on systems using the National TPMFail counts on systems using the Atmel TPM .Resetting a passphrase. . . . . . . . .Resetting a passphrase remotely . . . .Resetting a passphrase manually . . . . 39. 40Appendix C. Notices and TrademarksNotices . . .Trademarks .333334353636363739iii
iv IBM Client Security Solutions: Client Security Software Version 5.4 Installation Guide
PrefaceThis section provides information about how to use this guide.About this guideThis guide contains information on how to install IBM Client Security Software onan IBM network computer, also referred to as an IBM client, which contains theIBM embedded Security Subsystem. This guide also contains instructions on howto enable the IBM embedded Security subsystem and how to set the administratorpassword for the security subsystem.The guide is organized as follows:″Chapter 1, “Introduction,”″ contains a brief outline of basic security concepts, anoverview of the applications and components that are included in the software,and a description of Public Key Infrastructure (PKI) features.″Chapter 2, “Getting started,”″ contains computer hardware and softwareinstallation prerequisites as well as instructions for downloading the software.″Chapter 3, “Before installing the software,”″ contains prerequisite instructions forinstalling IBM Client Security Software.″Chapter 4, “Downloading, installing, and configuring the software,”″ containsinstructions for installing, updating, and uninstalling the software.″Chapter 5, “Troubleshooting,”″ contains helpful information for solving problemsyou might experience while using the instructions provided in this guide.″Appendix A, “U.S. export regulations for Client Security Software,”″ contains U.S.export regulation information regarding the software.″Appendix B, “Password and passphrase information,”″ contains passphrasecriteria that can be applied to a UVM passphrase and rules for administratorpasswords.″Appendix C, “Notices and Trademarks,”″ contains legal notices and trademarkinformation.Who should read this guideThis guide is intended for network or system administrators who set uppersonal-computing security on IBM clients. Knowledge of security concepts, suchas public key infrastructure (PKI) and digital certificate management within anetwork environment, is required.How to use this guideUse this guide to install and set up personal-computing security on IBM clients.This guide is a companion to the Client Security Software Administrator and UserGuide. Copyright IBM Corp. 2004v
This guide and all other documentation for Client Security can be downloadedfrom the http://www.pc.ibm.com/us/security/secdownload.html IBM web site.References to the Client Security Software Administrator andUser GuideReferences to the Client Security Software Administrator and User Guide are providedin this document. The Administrator and User Guide contains information aboutusing User Verification Manager (UVM) and working with UVM policy, andinformation about using the Administrator Utility and the User ConfigurationUtility.After you install the software, use the instructions in the Administrator and UserGuide to set up and maintain the security policy for each client.Additional informationYou can obtain additional information and security product updates, whenavailable, from the http://www.pc.ibm.com/us/security/index.html IBM Web site.vi IBM Client Security Solutions: Client Security Software Version 5.4 Installation Guide
Chapter 1. IntroductionSelect ThinkPadTM and ThinkCentreTM computers are equipped with built-incryptographic hardware that work together with downloadable softwaretechnologies to provide a powerful level of security in a client PC platform.Collectively this hardware and software is called the IBM Embedded SecuritySubsystem (ESS). The hardware component is the IBM Embedded Security Chipand the software component is the IBM Client Security Software (CSS).Client Security Software is designed for IBM computers that use the IBMEmbedded Security Chip to encrypt files and store encryption keys. This softwareconsists of applications and components that enable IBM client systems to useclient security features throughout a local network, an enterprise, or the Internet.The IBM Embedded Security SubsystemThe IBM ESS supports key-management solutions, such as a Public KeyInfrastructure (PKI), and is comprised of the following local applications:v File and Folder Encryption (FFE)v Password Managerv Secure Windows logonv Multiple, configurable authentication methods, including:– Passphrase– Fingerprint–Smart CardIn order to effectively use the features of the IBM ESS a security administratormust be familiar with some basic concepts. The following sections describe basicsecurity concepts.The IBM Embedded Security ChipThe IBM Embedded Security Subsystem is the built-in cryptographic hardwaretechnology that provides an extra level of security to select IBM PC platforms.With the advent of this security subsystem, encryption and authenticationprocesses are transferred from more vulnerable software and moved to the secureenvironment of dedicated hardware. The increased security this provides istangible.The IBM Embedded Security Subsystem supports:vvvvvvv Copyright IBM Corp. 2004RSA3 PKI operations, such as encryption for privacy and digital signatures forauthenticationRSA key generationPseudo random number generationRSA-function computation in 200 millisecondsEEPROM memory for RSA key pair storageAll Trusted Computing Group (TCG) functions defined in TCG MainSpecification version 1.1Communication with the main processor through the Low Pin Count (LPC) bus1
IBM Client Security SoftwareIBM Client Security Software comprises the following software applications andcomponents:v Administrator Utility: The Administrator Utility is the interface an administratoruses to activate or deactivate the embedded Security Subsystem, and to create,archive, and regenerate encryption keys and passphrases. In addition, anadministrator can use this utility to add users to the security policy provided byClient Security Software.v Administrator Console: The Client Security Software Administrator Consoleenables an administrator to configure a credential roaming network, to createand configure files that enable deployment, and to create a non-administratorconfiguration and recovery profile.v User Configuration Utility: The User Configuration Utility enables a client userto change the UVM passphrase, to enable Windows logon passwords to berecognized by UVM, to update key archives, and to register fingerprints. A usercan also create backup copies of digital certificates created with the IBMembedded Security Subsystem.v User Verification Manager (UVM): Client Security Software uses UVM tomanage passphrases and other elements to authenticate system users. Forexample, a fingerprint reader can be used by UVM for logon authentication.Client Security Software enables the following features:– UVM client policy protection: Client Security Software enables a securityadministrator to set the client security policy, which dictates how a client useris authenticated on the system.If policy indicates that fingerprint is required for logon, and the user has nofingerprints registered, he will be given the option to register fingerprints aspart of the logon. Also, if the Windows password is not registered, orincorrectly registered, with UVM, the user will have the opportunity toprovide the correct Windows password as part of the logon.– UVM system logon protection: Client Security Software enables a securityadministrator to control computer access through a logon interface. UVMprotection ensures that only users who are recognized by the security policyare able to access the operating system.The relationship between passwords and keysPasswords and keys work together, along with other optional authenticationdevices, to verify the identity of system users. Understanding the relationshipbetween passwords and keys is vital to understand how IBM Client SecuritySoftware works.The administrator passwordThe administrator password is used to authenticate an administrator to the IBMEmbedded Security Subsystem. This password is maintained and authenticated inthe secure hardware confines of the embedded security subsystem. Onceauthenticated, the administrator can perform the following actions:v Enroll usersv Launch the policy interfacevChange the administrator passwordThe administrator password can be set in the following ways:v Through the IBM Client Security Setup Wizard2 IBM Client Security Solutions: Client Security Software Version 5.4 Installation Guide
v Through the Administrator Utilityv Using scriptsv Through the BIOS interface (ThinkCentre computers only)It is important to have a strategy for creating and maintaining the administratorpassword. The administrator password can be changed if it is compromised orforgotten.For those familiar with Trusted Computing Group (TCG) concepts andterminology, the administrator password is the same as the owner authorizationvalue. Since the administrator password is associated with the IBM EmbeddedSecurity Subsystem it is sometimes also referred to as the hardware password.The hardware public and private keysThe basic premise of the IBM Embedded Security Subsystem is that it provides astrong root of trust on a client system. This root is used to secure other applicationsand functions. Part of establishing a root of trust is to create a hardware public keyand a hardware private key. A public key and private key, together referred to as akey pair, are mathematically related in such a way that:v Any data encrypted with the public key can only be decrypted withcorresponding private key.v Any data encrypted with the private key can only be decrypted withcorresponding public key.The hardware private key is created, stored and used in the secure, hardwareconfines of the security subsystem. The hardware public key is made available forvarious purposes (hence the name public key), but it is never exposed outside ofthe secure, hardware confines of the security subsystem. The hardware public andprivate keys are a critical part of the IBM key-swapping hierarchy described in afollowing section.Hardware public and private keys are created in the following ways:v Through the IBM Client Security Setup Wizardv Through the Administrator Utilityv Using scriptsFor those familiar with Trusted Computing Group (TCG) concepts andterminology, the hardware public and private keys are known as the storage root key(SRK).The administrator public and private keysThe administrator public and private keys are an integral part of the IBMkey-swapping hierarchy. They also allow for user-specific data to be backed up andrestored in the event of system board or hard drive failure.Administrator public and private keys can either be unique for all systems or theycan be common across all systems or groups of systems. It is important to notethat these administrator keys must be managed, so having a strategy for usingunique keys versus known keys is important.Administrator public and private keys can be created in one of the following ways:v Through the IBM Client Security Setup Wizardv Through the Administrator UtilityChapter 1. Introduction3
v Using scriptsESS archiveThe administrator public and private keys allow user-specific data to be backed upand restored in the event of a system board or hard drive failure.User public and private keysThe IBM Embedded Security Subsystem creates user public and private keys toprotect user-specific data. These key pairs are created when a user is enrolled intoIBM Client Security Software. These keys are created and managed transparentlyby the User Verification Manager (UVM) component of IBM Client SecuritySoftware. The keys are managed based upon which Windows user is logged intothe operating system.The IBM key-swapping hierarchyAn essential element of the IBM Embedded Security Subsystem architecture is theIBM key-swapping hierarchy. The base (or root) of the IBM key-swappinghierarchy are the hardware public and private keys. The hardware public andprivate keys, called the hardware key pair, are created by IBM Client SecuritySoftware and are statistically unique on each client.The next “level” of keys up the hierarchy (above the root) is the administratorpublic and private keys, or the administrator key pair. The administrator key paircan be unique on each machine, or it can be the same on all clients or a subset ofclients. How you manage this key pair depends upon how you want to manageyour network. The administrator private key is unique in that it resides on theclient system (protected by the hardware public key) in an administrator-definedlocation.IBM Client Security Software enrolls Windows users into the Embedded SecuritySubsystem environment. When a user is enrolled, user public and private keys (theuser key pair) are created and a new key ″level″ is created. The user private key isencrypted with the administrator public key. The administrator private key isencrypted with the hardware public key. Therefore, to utilize the user private key,the administrator private key (which is encrypted with the hardware public key)must be loaded into the security subsystem. Once in the chip, the hardware privatekey decrypts the administrator private key. The administrator private key is nowready for use inside the security subsystem so that data that is encrypted with thecorresponding administrator public key can be swapped into the securitysubsystem, decrypted and utilized. The current Windows user’s private key(encrypted with the administrator public key) is passed into the securitysubsystem. Any data needed by an application that leverages the embeddedsecurity subsystem would also be passed into the chip, decrypted and leveragedwithin the secure environment of the security subsystem. An example of this is aprivate key used to authenticate to a wireless network.Whenever a key is needed, it is swapped into the security subsystem. Theencrypted private keys are swapped into the security subsystem, and can then beused in the protected environment of the chip. The private keys are never exposedor used outside of this hardware environment. This provides for nearly anunlimited quantity of data to be protected through the IBM Embedded SecurityChip.4 IBM Client Security Solutions: Client Security Software Version 5.4 Installation Guide
The private keys are encrypted because they must be heavily protected andbecause there is limited storage space available in the IBM Embedded SecuritySubsystem. Only a couple of keys can be stored in the security subsystem at anygiven time. The hardware public and private keys are the only keys that remainstored in the security subsystem from boot to boot. In order to allow for multiplekeys and multiple users, CSS utilizes the IBM key-swapping hierarchy. Whenever akey is needed, it is swapped into the IBM Embedded Security Subsystem. Therelated, encrypted private keys are swapped into the security subsystem, and canthen be used in the protected environment of the chip. The private keys are neverexposed or used outside of this hardware environment.The administrator private key is encrypted with the hardware public key. Thehardware private key, which is only available in the security subsystem, is used todecrypt the administrator private key. Once the administrator private key isdecrypted in the security subsystem, a user’s private key (encrypted with theadministrator public key) can be passed into the security subsystem and decryptedwith the administrator private key. Multiple users’ private keys can be encryptedwith the administrator public key. This allows for virtually an unlimited number ofusers on a system with the IBM ESS; however, best practices suggest that limitingenrollment to 25 users per computer ensures optimal performance.The IBM ESS utilizes a key-swapping hierarchy where the hardware public andprivate keys in the security subsystem are used to secure other data stored outsidethe chip. The hardware private key is generated in the security subsystem andnever leaves this secure environment. The hardware public key is available outsideof the security subsystem and is used to encrypt or secure other pieces of datasuch as a private key. Once this data is encrypted with the hardware public key itcan only be decrypted by the hardware private key. Since the hardware private keyis only available in the secure environment of the security subsystem, theencrypted data can only be decrypted and used in this same secure environment. Itis important to note that each computer will have a unique hardware public andprivate key. The random number capability of the IBM Embedded SecuritySubsystem ensures that each hardware key pair is statistically unique.CSS public key infrastructure (PKI) featuresClient Security Software provides all of the components required to create a publickey infrastructure (PKI) in your business, such as:v Administrator control over client security policy. Authenticating end users atthe client level is an important security policy concern. Client Security Softwareprovides the interface that is required to manage the security policy of an IBMclient. This interface is part of the authenticating software User VerificationManager (UVM), which is the main component of Client Security Software.v Encryption key management for public key cryptography. Administratorscreate encryption keys for the computer hardware and the client users withClient Security Software. When encryption keys are created, they are bound tothe IBM embedded Security Chip through a key hierarchy, where a base levelhardware key is used to encrypt the keys above it, including the user keys thatare associated with each client user. Encrypting and storing keys on the IBMembedded Security Chip adds an essential extra layer of client security, becausethe keys are securely bound to the computer hardware.v Digital certificate creation and storage that is protected by the IBM embeddedSecurity Chip. When you apply for a digital certificate that can be used fordigitally signing or encrypting an e-mail message, Client Security Softwareenables you to choose the IBM embedded Security Subsystem as theChapter 1. Introduction5
cryptographic service provider for applications that use the MicrosoftCryptoAPI. These applications include Internet Explorer and Microsoft OutlookExpress. This ensures that the private key of the digital certificate is encryptedwith the user’s public key on the IBM embedded Security Subsystem. Also,Netscape users can choose the IBM embedded Security Subsystem as the privatekey generator for digital certificates used for security. Applications that use thePublic-Key Cryptography Standard (PKCS) #11, such as Netscape Messenger, cantake advantage of the protection provided by the IBM embedded SecuritySubsystem.v The ability to transfer digital certificates to the IBM embedded SecuritySubsystem. The IBM Client Security Software Certificate Transfer Tool enablesyou to move certificates that have been created with the default Microsoft CSPto the IBM embedded Security Subsystem CSP. This greatly increases theprotection afforded to the private keys associated with the certificates becausethey will now be securely stored on the IBM embedded Security Subsystem,instead of on vulnerable software.Note: Digital certificates protected by the IBM embedded Security SubsystemCSP cannot be exported to another CSP.v A key archive and recovery solution. An important PKI function is creating akey archive from which keys can be restored if the original keys are lost ordamaged. IBM Client Security Software provides an interface that enables you toestablish an archive for keys and digital certificates created with the IBMembedded Security Subsystem and to restore these keys and certificates ifnecessary.v File and folder encryption. File and folder encryption enables a client user toencrypt or decrypt files or folders. This provides an increased level of datasecurity on top of the CSS system-security measures.v Fingerprint authentication. IBM Client Security Software supports the TargusPC card fingerprint reader and the Targus USB fingerprint reader forauthentication. Client Security Software must be installed before the Targusfingerprint device drivers are installed for correct operation.v Smart card authentication. IBM Client Security Software supports certain smartcards as an authentication device. Client Security Software enables smart cardsto be used as a token of authentication for a single user at a time. Each smartcard is bound to a system unless credential roaming is being used. Requiring asmart card makes your system more secure because this card must be providedalong with a password, which can be compromised.v Credential roaming. Credential roaming enables an authorized network user touse any computer on the network as though it was his own workstation. After auser is authorized to use UVM on any Client Security Software-registered client,he can then import his personal data to any other registered client in thecredential roaming network. His personal data is then updated automaticallyand maintained in the CSS archive and on any computer to which it wasimported. Updates to this personal data, such as new certificates or passphrasechanges, are immediately available on all other computers connected to theroaming network.v FIPS 140-1 certification. Client Security Software supports FIPS 140-1 certifiedcryptographic libraries.v Passphrase expiration. Client Security Software establishes a user-specificpassphrase and a passphrase expiration policy when each user is added toUVM.6 IBM Client Security Solutions: Client Security Software Version 5.4 Installation Guide
Chapter 2. Getting startedThis section contains hardware and software compatibility requirements for usewith IBM Client Security Software. Also, information about downloading IBMClient Security Software is provided.Hardware requirementsBefore you download and install the software, make sure that your computerhardware is compatible with IBM Client Security Software.The most recent information regarding hardware and software requirements isavailable at the http://www.pc.ibm.com/us/security/index.html IBM Web site.IBM embedded Security SubsystemThe IBM embedded Security Subsystem is a cryptographic microprocessor that isembedded on the system board of the IBM client. This essential component of IBMClient Security transfers security policy functions from vulnerable software tosecure hardware, radically increasing the security of the local client.Only IBM computers and workstations that contain the IBM embedded SecuritySubsystem support IBM Client Security Software. If you try to download andinstall the software onto a computer that does not contain an IBM embeddedSecurity Subsystem, the software will not install or run properly.Supported IBM modelsClient Security Software is licensed for and supports numerous IBM desktop andnotebook computers. For a complete list of supported models, refer to thehttp://www.pc.ibm.com/us/security/index.html Web page.Software requirementsBefore you download and install the software, make sure that your computersoftware and operating system are compatible with IBM Client Security Software.Operating systemsIBM Client Security Software requires one of the following operating systems:v Windows XPv Windows 2000 ProfessionalUVM-aware productsIBM Client Security comes with User Verification Manager (UVM) software thatenables you to customize authentication for your desktop computer. This first levelof policy-based control increases asset protection and the efficiency of passwordmanagement. UVM, which is compatible with enterprise-wide security policyprograms, enables you to use UVM-aware products, including the following:v Biometrics devices, such as fingerprint readersUVM provides a plug-and-play interface for biometrics devices. You must installIBM Client Security Software before you install a UVM-aware sensor. Copyright IBM Corp. 20047
vvvvvTo use a UVM-aware sensor that is already installed on an IBM client, you mustuninstall the UVM-aware sensor, install IBM Client Security Software, and thenreinstall the UVM-aware sensor.Tivoli Access Manager version 5.1UVM software simplifies and improves policy management by smoothlyintegrating with a centralized, policy-based access control solution, such asTivoli Access Manager.UVM software enforces policy locally whether the system is on the network(desktop) or stands alone, thus creating a single, unified policy model.Lotus Notes version 4.5 or laterUVM works with IBM Client Security Software to improve the security of yourLotus Notes logon (Lotus Notes version 4.5 or later).Entrust Desktop Solutions 5.1, 6.0, or 6.1Entrust Desktop Solutions enhances Internet security capabilities so that criticalenterprise processes can be moved to the Internet. Entrust Entelligence providesa single security layer that can encompass an enterprise’s entire set of enhancedsecurity needs including identification, privacy, verification, and securitymanagement.RSA SecurID Software TokenThe RSA SecurID Software Token enables the same seed record that is used intraditional RSA hardware tokens to be embedded on existing user platforms.Consequently, users can authenticate to protected resources by accessing theembedded software instead of having to carry dedicated authentication devices.Gemplus GemPC400 smart card readerThe Gemplus GemPC400 smart card reader enables the security policy toinclude smart card authentication, adding an additional layer of security to thestandard passphrase protection.Web browsersIBM Client Security Software supports the following Web browsers for requestingdigital certificates:v Internet Explorer 5.0 or laterv Netscape 4.8 and Netscape 7.1Browser encryption strength informationIf support for strong encryption is installed
IBM Client Security Software IBM Client Security Software comprises the following software applications and components: v Administrator Utility: The Administrator Utility is the interface an administrator uses to activate or deactivate the embedded Security Subsystem, and to create, archive, and regenerate encryption keys and passphrases. In .
