RSA SecurID Ready Implementation Guide
SecurID Ready Implementation Guide Ericsson R380
Last Modified October 26, 2000

1. Partner Information

Partner Name Web Site Product Name Product Description Ericsson http://www.ericsson.com/ R380 RSA SecurID for the Ericsson R380s Smartphone is an authentication system that positively authenticates valid network users to networks and services that are protected by an RSA ACE/Agent. RSA SecurID for the Ericsson R380s Smartphone provides the same two-factor authentication solution as all other SecurID authenticators, combined with the convenience of the multi-functional Ericsson R380s mobile phone handset. In addition, RSA SecurID for the Ericsson R380s Smartphone enables secure connections to WAP-enabled services. Wireless Communications

Product Category

2. Contact Information
Name Phone Web Pre-Sales Sales 1.800.ERICSSON http://www.ericsson.com/ Post-Sales Support 1.800.ERICSSON http://www.ericsson.com/

3. Product configuration

= Administrative Setup
To enable RSA SecurID protection on a users mobile phone, you must: - Import the RSA SecurID Software Token records into the RSA ACE/Server database - Create a record for the user in the ACE/Server database and assign one of the token records to the user - Send the user the activation license that corresponds with the users token record serial number. The user must then correctly enter the activation license into the mobile phone. To install and activate RSA SecurID on the Ericsson R380s Smartphone: 1. Import the RSA SecurID token records to the RSA ACE/Server database. The Software Token files are on the token record diskette and have the extension.ASC. For instructions on how to import the token records, see the RSA ACE/Server documentation. 2. In the RSA ACE/Server database, create user records for each user, and assign each user an RSA SecurID Software Token. 3. In the RSA ACE/Server Data Administration application, list the users record to display the users assigned token serial number. 4. On the RSA SecurID Phone Activation Licenses diskette, locate the activation license file whose serial number matches the serial number associated with the users token record in the RSA ACE/Server. The activation license files have the extension.SAL. 5. Copy the activation license; paste it into a text file, and save the text file. The activation license is the string of characters that follows the colon. For example, in the activation license file 3314794:AJ6K452Y6N2HSCT3YE69EB2DHSRH2, the numbers 3314794 represent the serial number, and the characters AJ6K452Y6N2HSCT3YE69EB2DHSRH2 represent the activation license. 6. Distribute the activation license to the user. 7. Distribute the RSA SecurID for the Ericsson R380s Smartphone End-Users Quick-Start Guide (r380user.pdf) to the user. Distribute the documentation to users when you distribute their activation licenses.
RSA SecurID Ready Implementation Guide = User Setup
To activate RSA SecurID on your mobile phone, you must obtain an activation license from your administrator (see previous steps). The license consists of approximately thirty alphanumeric characters that you must key in to your mobile phone. To activate RSA SecurID on your Ericsson R380s Smartphone: 1. Make sure that the phone is on and in standby mode. 2. Open the flip, and tap the Extras tab:

3. Tap System. 4. Tap Preferences, then Messaging, and then One-Time Passcodes. 5. Tap Initialise RSA SecurID. If an activation license is already installed on the phone, the activation program prompts you to confirm the removal of the previous license. If you are not sure whether you want to remove the previous license, select No, and consult your administrator. 6. Tap the Activation License input field. The activation license input view appears, showing a software keyboard at the bottom of the screen. 7. Use the keyboard to enter your activation license. The license is not case-sensitive. However, do not enter a space or carriage return at the end of the activation license string. If you do, the activation license will be rejected. 8. Tap to return to the Initialise RSA SecurID view, then tap OK to continue. If you enter a correct license, the message, RSA SecurID has been successfully initialized appears briefly. RSA SecurID Software Token is activated on your mobile phone. If you see this message, do not continue on to the next step. If you enter an incorrect license, the message, Activation license incorrect appears. If you see this message, continue on to Step 9. 9. At the message, Activation license incorrect, tap OK to return to the Initialise RSA SecurID view. 10. Tap the activation license text to access the software keyboard. The incorrect license remains in the input field so you can compare what you entered with the correct activation license. 11. Repeat Steps 7 and 8 to re-enter the activation license.
Using RSA SecurID on the Ericsson R380s Smartphone The RSA SecurID software token provides you with a PASSCODE that enables you to access protected services and networks. Using RSA SecurID on the R380s Smartphone with a Personal Computer To access a protected service or network from a personal computer, you use the Ericsson R380s Smartphone to generate a PASSCODE. Then, on your computer, you type the PASSCODE when you are prompted for it. 1. Open the flip, and tap the Messaging tab:
2. Tap Generate passcode. The Generate Passcode view appears. 3. Tap the PIN input field. The software keyboard view appears. Use the keyboard to enter your PIN. If you have not been assigned a PIN, or if your PIN has been cleared by your administrator, leave the input field blank and continue with the next step.
4. Tap to return to the Generate Passcode view, and tap OK to continue. The PASSCODE appears for 60 seconds:

5. When you are prompted for it, type the PASSCODE. Be sure to type in the PASSCODE within the 60-second interval, or the PASSCODE will not be valid. If you are prompted for a second PASSCODE, wait 60 seconds until the software token on your phone generates a new PASSCODE, then repeat steps 1 through 4.
Troubleshooting = If login attempts consistently fail, verify that the time settings on your mobile phone are correct in relation to Coordinated Universal Time (UTC) time, also known as Greenwich Mean Time (GMT). Because RSA SecurID relies on UTC, the time, date, and time zone settings on your mobile phone must always be correct in relation to UTC. If the time settings drift, authentication to SecurID-protected networks and services cannot take place. To get UTC, call a reliable time service. For instructions on how to change the time settings on your mobile phone, see the Ericsson R380s Users Manual. = = Inspect the RSA ACE/Server logs to determine whether the users token has been disabled because of failed login attempts. Verify that the user has installed the correct activation license on the mobile phone by listing the activation license serial number on the phone, then verifying that it matches the serial number assigned to the user in the RSA ACE/Server. 1. Open the flip, and tap the Extras tab. 2. Tap System. 3. Tap Preferences, then Messaging, then One-Time Passcodes, and then Get serial number. The RSA SecurID activation license serial number appears:

4. Known Problems

5. Certification Checklist
The following are the original tests performed against the Ericsson R380 during the QA testing process:
Test Description Successful Authentication 1. Select Messaging | Password Access | SecurID 2. Enter correct PIN and press Enter 3. Use the resulting Passcode to perform a test authentication on the ACE/Agent 4. Test must result in successful authentication message Unsuccessful Authentication 1. Select Messaging | Password Access | SecurID 2. Enter incorrect PIN and press Enter 3. Use the resulting Passcode to perform a test authentication on the ACE/Agent 4. Test must result in unsuccessful authentication message Next Tokencode 1. Place the token in Next Tokencode Mode by trying 3 unsuccessful authentications 2. Select Messaging | Password Access | SecurID 3. Enter correct PIN and press Enter 4. Use the resulting Passcode to successfully authenticate on the ACE/Agent 5. ACE/Agent will prompt for Next Tokencode 6. Select Next Tokencode Button 7. Use the new PRN as the Next Tokencode on the ACE/Agent 8. Test must result in successful authentication message New Pin Mode 1. System generated PIN 2. Set ACE/Server to system generated PIN 3. Place token in New PIN mode 4. Authenticate with just the PRN displayed on the Ericsson R380 SecurID (this may require a Null PIN 0000) 5. The system will generate the PIN to be used in the rest of this test 6. Use the PIN on the Ericsson R380 SecurID to generate a Passcode 7. Use the generated Passcode to successfully test authenticate User generated PIN 1. Set ACE/Server to user generated PIN 2. Place token in New PIN mode 3. Authenticate with just the PRN displayed on the Ericsson R380 SecurID (this may require a Null PIN 0000) 4. The user will create the PIN to be used in the rest of this test 5. Use the PIN on the Ericsson R380 SecurID to generate a Passcode 6. Use the generated Passcode to successfully test authenticate User selectable PIN 1. Set ACE/Server to user selectable PIN 2. Place token in New PIN mode 3. Authenticate with just the PRN displayed on the Ericsson R380 SecurID (this may require a Null PIN 0000) 4. The user may select whether to create their own or let the system generate the PIN to be used in the rest of this test 5. Use the PIN on the Ericsson R380 SecurID to generate a Passcode 6. Use the generated Passcode to successfully test authenticate Results PASS

RSA SecurID Ready Implementation Guide
Last Modified July 24, 2001

1. Partner Information

Partner Name Web Site Product Name Product Description Ericsson www.ericsson.com R380 RSA SecurID for the Ericsson R380s Smartphone is an authentication system that positively authenticates valid network users to networks and services that are protected by an RSA ACE/Agent. RSA SecurID for the Ericsson R380s Smartphone provides the same two-factor authentication solution as all other SecurID authenticators, combined with the convenience of the multi-functional Ericsson R380s mobile phone handset. In addition, RSA SecurID for the Ericsson R380s Smartphone enables secure connections to WAP-enabled services. Wireless Communication

Product Category

2. Contact Information
Phone Web Sales Support See www.ericsson.com for details of local Sales & Support Contact Numbers www.ericsson.com www.ericsson.com

3. Solution Summary

Feature SecurID Authenticator Functionality. Details
The Ericsson R380 Smartphone includes the SecurID Authenticator functionality required to generate PASSCODES and Tokencodes. The generated codes can be used in one of two ways: 1. Manual Mode Ericsson R380 Smartphone is used to generate PASSCODES or Tokencodes as per a standard key fob or card. These codes are then manually entered into an alternative device to authenticate the user.
2. Automatic mode Ericsson R380 Smartphone generates
PASSCODES or Tokencodes, which can be used to gain access to RSA SecurID protected WAP Services, browsed to via the phone itself.

4. Product Requirements

Hardware requirements
Component Name: ACE/Client protecting Web Server CPU make/speed required Memory See ACE/Server Documentation for details HD space Firmware level Component Name: ACE/Server CPU make/speed required Memory HD space Firmware level
See ACE/Server Documentation for details
Component Name: Ericsson R380 Smartphone See Ericsson R380 Smartphone Documentation for details

Software requirements

Component Name: ACE/Agent protecting Web Server Operating System Microsoft Windows RSA SecurID ACE/Agent Software Version (Patch-level) NT4.0 (SP 6a) & 2000 V 4.1 or greater See ACE/Server Documentation for details
Component Name: ACE/Server Operating System ACE/Server Software Version (Patch-level) V4.1 or greater ACE /Server 5.0 Tested SEE ACE/Server Documentation for additional details of available operating systems and applicable versions
5. Partner Product configuration

Product Requirements

Ericsson R380 Smartphone RSA SecurID Activation License (Purchased from RSA Security or approved reseller) RSA ACE/Server (Version Tested v5.0) RSA ACE/Client protected device (Version Tested v4.4.1)

Administrative Setup

To implement RSA SecurID protection using your Ericsson R380 Smartphone, you must:
Import the RSA SecurID Software Token records into the RSA ACE/Server database. Create a record for the user in the ACE/Server database and assign one of the token records to the user. Send the user the activation license that corresponds with the users token record serial number. The user must then correctly enter the activation license into the Ericsson R380 Smartphone.

To install and activate RSA SecurID on the Ericsson R380 Smartphone: 1. Import the RSA SecurID token records to the RSA ACE/Server database. The Software Token files are on the token record diskette and have the extension.ASC. For instructions on how to import the token records, see the RSA ACE/Server documentation. 2. In the RSA ACE/Server database, create user records for each user, and assign each user an RSA SecurID Software Token. 3. In the RSA ACE/Server Data Administration application, list the users record to display the users assigned token serial number. 4. On the RSA SecurID Activation Licenses diskette, locate the activation license file whose serial number matches the serial number associated with the users token record in the RSA ACE/Server. The activation license files have the extension.SAL and can be viewed with a standard text editor. See Figure 1.

Serial Numbers

Activation Licenses

Figure 1.

5. Create a.SAL file for each user, which contains only one activation license.
6. Distribute the individual licenses to the appropriate users.

User Setup

To activate RSA SecurID on the Ericsson R380 Smartphone, you must: Configure the users SecurID activation license. The activation license consists of twenty-nine alphanumeric characters. Ensure that the devices time and date are set correctly in relation to Coordinated Universal Time (UTC). To configure an RSA SecurID activation license on Ericsson R380 Smartphone :
1. Obtain an activation license from your administrator. 2. Make sure the Ericsson R380 Smartphone is on and in standby mode. 3. Open the flip, and select the Extras tab. See figure 2.

Figure 2.

4. Select System>Preferences>Messaging>One-Time Passcodes. 5. Select Initialise RSA SecurID. If an activation license is already installed on the phone, the activation program prompts you to confirm the re-initialisation and removal of the previous license. If you are not sure whether you want to remove the previous license, select No, and consult your administrator. 6. Select the Activation License input field. The activation license input view appears, showing a software keyboard at the bottom of the screen. 7. Use the keyboard to enter your activation license and select the arrow shaped icon at the bottom right hand of the UI to commit your entry. The license is not case-sensitive. However, do not enter a space or carriage return at the end of the activation license string. If you do, the activation license will be rejected. 8. At the Initialise RSA SecurID view, select OK to continue. If you enter a correct license, the message, RSA SecurID has been successfully initialized appears briefly. The RSA SecurID Software Token is now activated on the Ericsson R380 Smartphone. If you enter an incorrect license, the message, Activation license incorrect appears. If you see this message, continue on to Step 9. 9. At the message, Activation license incorrect, select OK to return to the Initialise RSA SecurID view. 10. Tap the activation license text to access the software keyboard. The incorrect license remains in the input field so you can compare what you entered with the correct activation license string supplied by your administrator. 11. Repeat Steps 7 and 8 to re-enter the activation license. Configuring the Ericsson R380 Smartphones Time Settings: As the RSA SecurID software relies on time, it is important to make sure that the date and time settings on the Ericsson R380 Smartphone are always correct in relation to Coordinated Universal Time (UTC), also known as Greenwich Mean Time (GMT). If the time settings drift significantly, SecurID authentication will fail. For instructions on setting the date and time on the Ericsson R380 Smartphone, see the Ericsson R380 Smartphone User Manual. Using RSA SecurID on the Ericsson R380s Smartphone: The RSA SecurID software token provides you with a PASSCODE or Tokencode that enables you to access protected services and networks. To access a protected service or network from a personal computer or the integrated WAP browser, you use the Ericsson R380s Smartphone to generate a PASSCODE. Then, on either your computer or in an entry field on a browser page, you enter the PASSCODE when prompted.

1. Open the flip, and select the Messaging tab. See Figure 3.

Figure 3.

2. Select Generate passcode. The Generate Passcode view appears. 3. Select the PIN input field. The software keyboard view appears. Use the keyboard to enter your PIN. If you have not been assigned a PIN, or if your administrator has cleared your PIN, leave the input field blank and continue with the step 4. 4. Select the arrow shaped icon at the bottom right hand of the UI to commit your entry and return to the Generate Passcode view. Select OK to continue. See Figure 4. The PASSCODE appears for 60 seconds.

Figure 4.

5. Enter the generated PASSCODE into the RSA SecurID protected application. Be sure to type in the PASSCODE within the 60-second interval, or the PASSCODE will not be valid. If you are prompted for a second PASSCODE, wait 60 seconds until the software token on the Ericsson R380 Smartphone generates a new PASSCODE, then repeat steps 1 through 4.

Troubleshooting

If login attempts consistently fail: Verify that the time settings on the Ericsson R380 Smartphone are correct in relation to Coordinated Universal Time (UTC) time, also known as Greenwich Mean Time (GMT). Inspect the RSA ACE/Server logs to determine whether the users token has been disabled because of failed login attempts. Using the steps outlined below, verify that the user has installed the correct activation license. Compare the activation license serial number against the serial number assigned to the user in the RSA ACE/Server Database. 1. Open the flip, and select the Extras tab. 2. Select System>Preferences>Messaging>One-Time Passcodes>Get serial number. The RSA SecurID activation license serial number appears. See Figure 5.

Figure 5.

6. Certification Checklist
Date Tested: June 27, 2001

Results PASS

Test Description Successful Authentication 1. Select | Messaging | Generate passcode 2. Select PIN input field 3. Enter correct PIN and select arrow shaped icon at the bottom right hand corner of UI 4. Select OK 5. Use the resulting PASSCODE to perform a test authentication on the ACE/Agent 6. Test must result in successful authentication message Unsuccessful Authentication 1. Select | Messaging | Generate passcode 2. Select PIN input field 3. Enter incorrect PIN and select arrow shaped icon at the bottom right hand corner of UI 4. Select OK 5. Use the resulting PASSCODE to perform a test authentication on the ACE/Agent 6. Test must result in unsuccessful authentication message Next Tokencode 1. Place the token in Next Tokencode Mode by trying an unsuccessful authentication 2. Select | Messaging | Generate passcode 3. Select PIN input field 4. Enter correct PIN and select arrow shaped icon at the bottom right hand corner of UI 5. Use the resulting PASSCODE to perform a test authentication on the ACE/Agent 6. ACE/Agent will prompt for Next Tokencode 7. Wait at least 60 seconds for the R380 to generate the next Tokencode 8. Select | Messaging | Generate passcode 9. Select OK 10. Use the resulting Tokencode to complete authentication on the ACE/Agent 11. Test must result in successful authentication message New 1. 2. 3. 4. 5. 6. 7. 8. 9. New 1. 2. 3. 4. 5. 6. 7. 8. 9. New 1. 2. 3. 4. 5. 6. 7. 8. 9. Pin Mode - |System Generated PIN Set ACE/Server to system generated PIN Place token in New PIN mode Select | Messaging | Generate passcode Without entering a PIN Select OK Authenticate with the resultant Code The system will generate the PIN to be used in the rest of this test Wait at least 60 seconds for the R380 to generate the next Tokencode Repeat the PASSCODE generation process using the newly assigned system generated PIN Use the generated PASSCODE to successfully test authenticate Pin Mode - |User generated PIN Set ACE/Server to user generated PIN Place token in New PIN mode Select | Messaging | Generate passcode Without entering a PIN Select OK Authenticate with the resultant Code The user will create the PIN to be used in the rest of this test Wait at least 60 seconds for the R380 to generate the next Tokencode Repeat the PASSCODE generation process using the newly created PIN Use the generated PASSCODE to successfully test authenticate Pin Mode - |User selectable PIN Set ACE/Server to user selectable PIN Place token in New PIN mode Select | Messaging | Generate passcode Without entering a PIN Select OK Authenticate with the resultant Code Select create own or let the system generate the PIN to be used in the rest of this test Wait at least 60 seconds for the R380 to generate the next Tokencode Repeat the PASSCODE generation process using the newly created PIN Use the generated PASSCODE to successfully test authenticate