Check Point FDE integration with Digipass Key devices - Vasco
Check Point FDE integration with Digipass Key devices - Vasco
Check Point FDE integration with Digipass Key devices - Vasco
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong><br />
<strong>Digipass</strong> <strong>Key</strong> <strong>devices</strong><br />
1 | VASCO Data Security<br />
INTEGRATION GUIDE
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices
1<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Disclaimer<br />
Disclaimer of Warranties and Limitation of Liabilities<br />
All information contained in this document is provided 'as is'; VASCO Data Security assumes no<br />
responsibility for its accuracy and/or completeness.<br />
In no event will VASCO Data Security be liable for damages arising directly or indirectly from any<br />
use of the information contained in this document.<br />
Copyright<br />
Copyright © 2010 VASCO Data Security, Inc, VASCO Data Security International GmbH. All<br />
rights reserved. VASCO ® , Vacman ® , IDENTIKEY ® , aXsGUARD, DIGIPASS ® and ® logo<br />
are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data<br />
Security International GmbH in the U.S. and other countries. VASCO Data Security, Inc.<br />
and/or VASCO Data Security International GmbH own or are licensed under all title, rights and<br />
interest in VASCO Products, updates and upgrades thereof, including copyrights, patent<br />
rights, trade secret rights, mask work rights, database rights and all other intellectual and<br />
industrial property rights in the U.S. and other countries. Microsoft and Windows are<br />
trademarks or registered trademarks of Microsoft Corporation. Other names may be<br />
trademarks of their respective owners.
2<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Table of Contents<br />
1 Overview................................................................................................................... 4<br />
2 Problem Description ................................................................................................. 4<br />
3 Solution .................................................................................................................... 4<br />
4 Technical Concept ..................................................................................................... 4<br />
4.1 GENERAL OVERVIEW ............................................................................................. 5<br />
4.2 PROCEDURE ......................................................................................................... 5<br />
4.3 PREREQUISITES .................................................................................................... 5<br />
5 Setting up Certificate based <strong>Digipass</strong> Logon ............................................................. 6<br />
5.1 CERTIFICATE AUTHORITY ....................................................................................... 6<br />
5.1.1 Issue the right type of certificates ..................................................................... 6<br />
5.1.1 Security Groups for enrollment Stations and agents ............................................ 7<br />
5.1.1 Specifying the Enrollment Policy ...................................................................... 10<br />
5.2 ENROLLMENT STATION ........................................................................................ 12<br />
5.3 LOGON SETTINGS ............................................................................................... 18<br />
5.4 ENROLLING USERS .............................................................................................. 19<br />
5.4.1 Requesting Certificates .................................................................................. 19<br />
6 Enabling Certificate based logon for <strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> ............................................. 25<br />
6.1 VASCO DRIVERS ................................................................................................. 25<br />
6.1.1 Copying vasco files to the <strong>Check</strong> <strong>Point</strong> installer. ................................................ 25<br />
6.1.1.1 Automatic Install using the <strong>Vasco</strong> Batch files. ............................................. 25<br />
6.2 INSTALL CHECK POINT <strong>FDE</strong> WITH CERTIFICATE LOGON .......................................... 27<br />
6.3 Deploying Smart Card Drivers Together <strong>with</strong> Smart Card User Accounts in Installation<br />
Profiles ........................................................................................................................ 30<br />
6.4 To install smart card drivers at the same time as Full Disk Encryption is installed: ....... 30<br />
6.5 Adding and Removing Preboot Drivers <strong>with</strong> the Preboot Drivers Setting ..................... 31<br />
6.6 Full Disk Encryption User Accounts ........................................................................ 31
3<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
7 Using a <strong>Digipass</strong> to authenticate. ............................................................................ 31<br />
7.1 CHECK POINT LOGON .......................................................................................... 31<br />
7.2 LOGIN TO WINDOWS ........................................................................................... 34<br />
7.3 WINDOWS LOGON, OFFLINE USAGE ...................................................................... 35<br />
8 References .............................................................................................................. 35<br />
Reference guide<br />
ID Title Author Publisher Date ISBN<br />
PKI Getting Started <strong>Vasco</strong> <strong>Vasco</strong><br />
PKI Installation<br />
Guide<br />
<strong>Vasco</strong> <strong>Vasco</strong><br />
PKI Manual <strong>Vasco</strong> <strong>Vasco</strong>
4<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
1 Overview<br />
The purpose of this document is to demonstrate how to secure your Windows logon and <strong>Check</strong><br />
<strong>Point</strong> Full Disk Encryption <strong>with</strong> a DIGIPASS supported by DIGIPASS CertiID. This device let’s you<br />
add a certificate and be able to logon <strong>with</strong> the right user credentials. On removing the <strong>Digipass</strong> a<br />
controlled action can take place.<br />
2 Problem Description<br />
The basic <strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> and Windows logon requires a static password. We know static<br />
passwords are not secure. To use a DIGIPASS <strong>Key</strong> as logon device for <strong>Check</strong> <strong>Point</strong> login, we<br />
manually need to install and change a few things.<br />
3 Solution<br />
By using a <strong>Digipass</strong> <strong>with</strong> an internal CA Certificate it is possible to logon to your computer in a<br />
“Pre-Boot” environment and also into Windows. Other functionalities such as email encryption<br />
might also be possible.<br />
4 Technical Concept
5<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
4.1 GENERAL OVERVIEW<br />
The PKI token functionality provides document signing; strong authentication against PKI enables<br />
software systems (operating systems, virtual private networks, applications); as well as e-mail,<br />
file and disk encryption.<br />
4.2 PROCEDURE<br />
To make a DIGIPASS work <strong>with</strong> the pre-boot login <strong>with</strong> <strong>Check</strong> <strong>Point</strong> and the interactive login in<br />
Windows, there are a few steps that need to be taken. First of all you have to setup a Certificate<br />
Authority. This will be the issuer for the certificates used on a DIGIPASS. Next we will make sure<br />
all the correct user rights are set. We will make a new group that will be responsible for issuing<br />
certificates. This will become a powerful group as they can generate certificates for all domain<br />
users, including administrators. And as last we have to enroll the users to a DIGIPASS and setup<br />
the workstations to be able to use it.<br />
4.3 PREREQUISITES<br />
The initial prerequisites for setting up DIGIPASS Certificate logon for windows and <strong>Check</strong> <strong>Point</strong><br />
are:<br />
• Active Directory installed on a 2003 or 2008 domain server<br />
• A Microsoft Certificate Authority (CA) configured <strong>with</strong> the Enterprise policy module. This<br />
may be a root or subordinate CA.<br />
• DIGIPASS CertiID installed on the enrollment machine.<br />
Users PCs are equipped <strong>with</strong> Windows 2000 or higher.
6<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
5 Setting up Certificate<br />
based <strong>Digipass</strong><br />
Logon<br />
5.1 CERTIFICATE AUTHORITY<br />
5.1.1 Issue the right type of certificates<br />
Start the Certification Authority Microsoft Management Console (MMC), located in the<br />
Administrative Tools folder on the Enterprise CA.<br />
Open the Certificate Templates (2003) or Policy Settings (2000) folder, and right-click on this<br />
folder. Select New Certificate Template to Issue.<br />
Figure 1: Issue the right type of certificates (1)<br />
Select, by holding the CTRL key, the following items and click OK:<br />
• Enrollment Agent<br />
• Smartcard Logon<br />
• Smartcard User<br />
Figure 2: Issue the right type of certificates (2)
7<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
5.1.1 Security Groups for enrollment<br />
Stations and agents<br />
Open the Active Directory – Users and Computers from the Administrative Tools folder on the<br />
Domain Controller.<br />
Right-click the Users folder and select New Group.<br />
Figure 3: Security groups for enrollment station and agents (1)<br />
Fill in a relevant group name (e.g. Enrollment_Group) and click OK.<br />
Figure 4: Security groups for enrollment station and agents (2)<br />
Now add users to this group that will be able to make certificates for a DIGIPASS.<br />
Caution: Please be aware that these users will become powerful users as they can create a<br />
certificate for any user in your domain, including administrators.
8<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Right-click the group you just created and select properties.<br />
Figure 5: Security groups for enrollment station and agents (3)<br />
At the members tab, choose the Add… button.<br />
Figure 6: Security groups for enrollment station and agents (4)
9<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Select the user you want to add to the group. (E.g. Enrollment Agent or Administrator)<br />
Figure 7: Security groups for enrollment station and agents (5)<br />
As you can see below, a computer can also be an Enrollment Agent. You then have to take care of<br />
the physical access to this computer.<br />
Click OK to finish<br />
Figure 8: Security groups for enrollment station and agents (6)
10<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
5.1.1 Specifying the Enrollment Policy<br />
Certificates issued by the CA are based on certificate templates stored in the Active Directory.<br />
The Access Control Lists (ACL) set on these templates determine who (user or computer) can<br />
request what (certificates).<br />
Open the Active Directory – Sites and Services MMC from the Administration Tools folder on the<br />
Domain Controller. If the Services folder is not visible, choose View Show Services Node.<br />
Open Services Public <strong>Key</strong> Services Certificate Templates, right-click the Enrollment<br />
Agent and select Properties.<br />
Figure 9: Specifying the Enrollment Policy (1)<br />
On the security tab, add the enrollment group. By clicking the Add… button, add the enrollment<br />
group you created before.<br />
Figure 10: Specifying the Enrollment Policy (2)
11<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Once added, give this group read and enroll permissions. Click OK to finish<br />
Figure 11: Specifying the Enrollment Policy (3)<br />
Now do the same steps for the Smartcard Logon and Smartcard User template.
12<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
5.2 ENROLLMENT STATION<br />
To setup your enrollment station you may need to install the DIGIPASS Drivers and also the<br />
DIGIPASS CertiID. Both can be found on the installation CD. Please refer to the PKI Installation<br />
guide included <strong>with</strong> CertiID<br />
Login on the enrollment Station (from any domain computer) <strong>with</strong> the enrollment Agent user.<br />
Click the Start Run… “mmc”.<br />
Choose File Add/Remove Snap-in.<br />
Figure 12: Enrollment Station (1)<br />
Click the Add… button.<br />
Figure 13: Enrollment Station (2)
13<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Select Certificates and click the Add button.<br />
Figure 14: Enrollment Station (3)<br />
Choose My user account en press Finish.<br />
Figure 15: Enrollment Station (4)<br />
Afterwards click the Close button of the Add Standalone Snap-in window.
14<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Click OK to go to the main console window.<br />
Figure 16: Enrollment Station (5)<br />
At the main console window, right-click the Personal folder and select All Tasks Request New<br />
Certificate…<br />
Figure 17: Enrollment Station (6)
15<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Click Next in the first window of the Certificate Request Wizard.<br />
Figure 18: Enrollment Station (7)<br />
Choose the Enrollment Agent certificate, check the Advanced checkbox and click Next.<br />
Figure 19: Enrollment Station (8)
16<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Choose the Microsoft Enhanced Cryptographic Provider and a key length of 1024 bit. Click<br />
Next.<br />
Figure 20: Enrollment Station (9)<br />
Verify the settings and click Next.<br />
Figure 21: Enrollment Station (10)
17<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Type in a Friendly name and type a meaningful description. Click Next.<br />
Figure 22: Enrollment Station (11)<br />
Review all the settings and click Finish if everything is OK.<br />
Figure 23: Enrollment Station (12)
18<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
5.3 LOGON SETTINGS<br />
In order to enforce a user to log on to the network <strong>with</strong> a DIGIPASS, you must change the<br />
account option as described below. Open the Active Directory – Users and Computers on the<br />
domain controller. In the Users folder select the desired username. Right-click the username and<br />
select Properties.<br />
Figure 24: Logon Settings (1)<br />
In the Account tab, select in the Account options: Smart card is required for interactive<br />
logon. Click OK to finish.
19<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 25: Logon Settings (2)<br />
Note: If this option is not enabled the user will be able to log on either <strong>with</strong> a DIGIPASS or using<br />
interactive password logon.<br />
5.4 ENROLLING USERS<br />
For enrollment of users, you have the choice of two templates:<br />
• Smartcard logon: Logon, SSL<br />
• Smartcard user: Logon, SSL and Secure Email<br />
So the Smartcard user has the extra ability to secure his email transfer <strong>with</strong> the created<br />
certificate.<br />
Note: The following instructions are for Windows XP. If you are using Windows Vista or later refer<br />
to Microsoft Article ID: 922706 How to use Certificate Services Web enrollment pages together<br />
<strong>with</strong> Windows Vista or Windows Server 2008<br />
5.4.1 Requesting Certificates<br />
Open your browser and go to: http://CA-Server/certsrv. (Where CA-Server is the name of the<br />
machine where your CA is installed)<br />
Click Request a certificate.
20<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 26: Requesting certificates (1)
21<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Click the Advanced certificate request link.<br />
Figure 27: Requesting certificates (2)<br />
Click the Request a certificate for a smart card on behalf of another user by using the<br />
smart card certificate enrollment station link.<br />
Figure 28: Requesting certificates (3)
22<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Select the Certificate Template, CA and Cryptographic Service Provider (CSP).<br />
The CSP depends on the installation method of the DIGIPASS CertiID. If you installed it as a CSP<br />
then you will see “VASCO CertiID Smart Card Crypto Provider V1.0”. If it was installed as a card<br />
module (CM) then you will see “Microsoft Base Smart Card Crypto Provider”. For more<br />
information please refer to the CertiID Installation Guide.<br />
Note: The CertID software is included on the <strong>Digipass</strong> USB product. If it is not installed contact<br />
your <strong>Vasco</strong> representative.<br />
Defaults:<br />
• CSP: XP/2003 and below<br />
• CM: Vista/2008 and above<br />
If you are logged in as the Enrollment Agent, the right Administrator Signing Certificate<br />
should be selected by default. Otherwise you click the Select Certificate… button.<br />
In the User To Enroll field, you can select the user you want to create a certificate for. Click the<br />
Select User… button and a known wizard will start.<br />
Figure 29: Requesting certificates (4)<br />
Search the user you want to create a certificate for and click OK.<br />
Figure 30: Requesting certificates (5)
23<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Now make sure your DIGIPASS is plugged in the USB port and initialised (refer to the PKI user<br />
manual for instructions on initialisation) then press the Enroll button.<br />
Figure 31: Requesting certificates (6)<br />
You will be asked for the pin of the DIGIPASS and press OK to continue. This can take a while.<br />
Do not navigate away from this page as long as the process is busy.<br />
Figure 34 shows the PIN box of the CSP method, while Figure 34 shows the PIN box from the<br />
Card Module (CM) method.<br />
Figure 32: Requesting certificates (7)<br />
Figure 33: Requesting certificates (8)
24<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
When the certificate is saved on a DIGIPASS, you will get a message in the window stating “The<br />
smartcard is ready …”. You now have the possibility to view the recently created certificate. To<br />
do so, press the View Certificate button.<br />
Figure 34: Requesting certificates (9)
25<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
6 Enabling Certificate<br />
based logon for<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong><br />
6.1 VASCO DRIVERS<br />
In order to use the DIGIPASS logon for the <strong>Check</strong> <strong>Point</strong> Full Disk Encryption it may be necessary<br />
to add the <strong>Vasco</strong> drivers into the <strong>Check</strong> <strong>Point</strong> pre-boot environment if <strong>Check</strong> <strong>Point</strong> already has<br />
reference to the vasco drivers (<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> version 7.4 HFA3) section 6.1 can be skipped. As<br />
<strong>Check</strong> <strong>Point</strong> runs before windows is enabled the vasco drivers already installed in windows will not<br />
work.<br />
6.1.1 Copying vasco files to the <strong>Check</strong> <strong>Point</strong><br />
installer.<br />
There are two processes that can be used to import the <strong>Vasco</strong> Drivers in to release version before<br />
7.4 HFA3<br />
> To install the drivers for DP CertiID tokens<br />
1) Open a command prompt.<br />
2) Change to the folder containing the command files.<br />
6.1.1.1 Automatic Install using the <strong>Vasco</strong> Batch files.<br />
3) Type the following command ( is the <strong>Check</strong> <strong>Point</strong> installation folder,<br />
optional):<br />
Install.bat []<br />
> To uninstall the drivers for DP CertiID tokens<br />
1) Open a command prompt.<br />
2) Change to the folder containing the command files.<br />
3) Type the following command ( is the <strong>Check</strong> <strong>Point</strong> installation folder,<br />
optional):<br />
Uninstall.bat []<br />
'Install.bat' registers and installs the drivers.<br />
'Uninstall.bat' unregisters and uninstalls the drivers.
26<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Both command files search for an installed version of <strong>Check</strong> <strong>Point</strong> in the default location.<br />
If you have not installed <strong>Check</strong> <strong>Point</strong> Endpoint Security in the default program folder, you can<br />
specify it via the command line parameter.<br />
6.1.1.1.1 INSTALLING DRIVERS MANUALLY (USING<br />
PSCONTROL)<br />
You can install the drivers manually using the 'PS Control Utility' installed <strong>with</strong> <strong>Check</strong> <strong>Point</strong><br />
Endpoint Security.<br />
> To install the drivers for DP CertiID tokens manually<br />
1) Open a command prompt.<br />
2) Change to the folder containing the drivers for DIGIPASS CertiID.<br />
3) Type the following commands ( is the <strong>Check</strong> <strong>Point</strong> installation folder):<br />
\pscontrol -v register-prd vascoprd.inf<br />
\pscontrol -v install-driver prd_ccid.bin<br />
\pscontrol -v register-ptd vascop11.inf<br />
\pscontrol -v install-driver vascop11.bin<br />
You can see if the <strong>Vasco</strong> Drivers are installed in the modules directory:-
27<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 35: <strong>Vasco</strong> Drivers<br />
6.2 INSTALL CHECK POINT <strong>FDE</strong><br />
WITH CERTIFICATE LOGON<br />
Add a certificate to your DIGIPASS <strong>Key</strong> 200 as laid out in section 5.4 above. Then run through<br />
the installer for the <strong>Check</strong> <strong>Point</strong> full disk encryption and accept the relevant license fields.<br />
Pass the readme section and run through the wizard and enter the relevant details.
28<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 36: <strong>Check</strong> <strong>Point</strong> Install (1)<br />
When it comes to Add a user account choose an account name and select the certificate that has<br />
been registered for that user.<br />
Note: The following is an example only. User accounts are normally added <strong>with</strong>in a configuration<br />
set profile after the initial installation. See the <strong>Check</strong> <strong>Point</strong> Full Disk Administrators Guide for<br />
more information.
29<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 37: <strong>Check</strong> <strong>Point</strong> Install (2)<br />
Choose the <strong>Vasco</strong> <strong>Key</strong> Drivers, in this case the DP <strong>Key</strong> 200<br />
Figure 38: <strong>Check</strong> <strong>Point</strong> Install (3)
30<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Choose to Encrypt and enable preboot authentication for all disk volumes.<br />
Figure 39<br />
Continue the rest of the install process <strong>with</strong> your preferred settings.<br />
To complete the installation you will be required to re-boot.<br />
6.3 Deploying Smart Card Drivers<br />
Together <strong>with</strong> Smart Card User<br />
Accounts in Installation Profiles<br />
When creating smart card user accounts via installation profiles, it is important that the required<br />
smart card drivers exist on the machine prior to logon. This is necessary if smart card user<br />
accounts are to be able to log on directly at first-time authentication.<br />
6.4 To install smart card drivers at the<br />
same time as Full Disk Encryption<br />
is installed:<br />
Add the Driver setting to the precheck.txt file. Specify each driver file name if more than one<br />
driver is involved, separating the file names <strong>with</strong> semicolons (no spaces are allowed). Below is an<br />
example in which the smart card driver files prd_ccid.bin and vascop11.bin are specified where<br />
prd_ccid.bin is the smart card reader device driver and vascop11.bin is the smart card device<br />
driver.<br />
Drivers=prd_ccid.bin;vascop11.bin
31<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
6.5 Adding and Removing Preboot<br />
Drivers <strong>with</strong> the Preboot Drivers<br />
Setting<br />
In the <strong>FDE</strong> Management Console you can also use the Hardware Devices - Preboot Drivers setting<br />
to install:<br />
• Smart card drivers<br />
• Smart card reader drivers<br />
• HID drivers<br />
on the configuration of the local machine or to push them to clients via an Update profile.<br />
6.6 Full Disk Encryption User Accounts<br />
A temporary user account is most commonly used when deploying Full Disk Encryption to client<br />
computers. The administrator defines one temporary user account and password, and then<br />
deploys it to clients. When a user logs on using the temporary user account and password,<br />
he/she is immediately prompted for a new user account name and password, which Full Disk<br />
Encryption uses to create a new user account that replaces the temporary user account on that<br />
computer.<br />
To create a temporary smart card user, the user account must have the user account setting<br />
Change Credentials set to Yes. This setting is located under Group/User Account - Permissions –<br />
Change Credentials.<br />
7 Using a <strong>Digipass</strong> to<br />
authenticate.<br />
7.1 CHECK POINT LOGON<br />
Ensure the <strong>Digipass</strong> is connected to the Encrypted PC, and power on the computer. Upon boot<br />
initiation you will be presented <strong>with</strong> a <strong>Check</strong> Poing Endpoint Security Login screen you should<br />
enter your PIN here.
32<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 40: <strong>Check</strong> <strong>Point</strong> Logon<br />
You will be given login information about the user account, choose to continue.
33<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
Figure 41: <strong>Check</strong> <strong>Point</strong> Confirmation
34<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
7.2 LOGIN TO WINDOWS<br />
Make sure, DIGIPASS CertiID is installed on the client pc. Afterwards, the login screen will look<br />
like the one below.<br />
Figure 42: Using The DIGIPASS (1)<br />
After connecting a DIGIPASS <strong>with</strong> the computer, it will automatically be recognized as a<br />
smartcard and you will be asked for your pin.<br />
Figure 43: Using The DIGIPASS (2)<br />
After filling in the pin, the computer logs on <strong>with</strong> the user which certificate is on a DIGIPASS.<br />
Figure 44: Using The DIGIPASS (3)
35<br />
<strong>Check</strong> <strong>Point</strong> <strong>FDE</strong> <strong>integration</strong> <strong>with</strong> <strong>Digipass</strong> <strong>Key</strong> Devices<br />
7.3 WINDOWS LOGON, OFFLINE<br />
USAGE<br />
When a user is disconnected from the network or the domain controller is unreachable due to<br />
failure somewhere along the network path, a user must still be able to logon to his or her<br />
computer. With passwords this capability is supported by comparing the hashed password stored<br />
by the LSA <strong>with</strong> a hash of the credential that the user supplied to the GINA during logon. If the<br />
hashes are the same then the user can be authenticated to the local machine.<br />
In the smart card case, offline logon requires the user’s private key to decrypt supplemental<br />
credentials originally encrypted using the user’s public key.<br />
In order to cache the supplemental credentials on the local PC, you need to set correctly the<br />
policy “Number of previous logons to cache (in case domain controller is not available” on the<br />
domain server.<br />
Here are the values you can assign to this policy:<br />
0 – this means no logons are cached locally. If the domain controller is not available you will not<br />
be able to log on to your PC using your domain account.<br />
n (from 1 to 50) – this means that if the domain controller is not available, you can log on locally<br />
using the credentials of the latest n (from 1 to 50) domain accounts cached on your machine.<br />
For security reasons, it is advisable to:<br />
• set this policy to 1. Only the user <strong>with</strong> a DIGIPASS (and obviously the administrator) will<br />
be able to logon to his machine when it is disconnected from the network;<br />
• the administrator should remember to re-login the user if he accomplish some<br />
administrative operations on the user machine.<br />
8 References<br />
Microsoft Article ID: 257480 Certificate enrollment using smart cards<br />
<strong>Check</strong> <strong>Point</strong> Full Disk Encryption Support Page