Softex OmniPass Version 4 - WETIF...Softex OmniPass provides password management capabilities to...

Softex OmniPass

Version 4.0

Users' Guide

http://www.softexinc.com

http://www.softexinc.com/

WTiefenbacher

Stempel

Document #:SOF-OP40-UG-1.0

Copyright

Copyright © 2003-2006 Softex Incorporated. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual, or otherwise, without the prior written permission of Softex Incorporated.

Disclaimer of Warranty

Softex Incorporated makes no representations or warranties with respect to the documentation herein described and especially disclaim any implied warranties of merchantability or fitness for any particular purpose. Further, Softex Incorporated reserves the right to revise this document and to make changes from time to time in the content without obligation of Softex Incorporated to notify any person of such revisions or changes.

Trademarks

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this document, and Softex Incorporated were aware of a trademark claim, the designations have been printed in initial caps or all caps. References may be made to Softex, which is a trademark of Softex Incorporated. All other trademarks observed.

Document Inquiries

When referring to this document, please refer to the title and publication date. For additional information about Softex products, visit the Softex website at: http://www.softexinc.com. Comments are welcome and may be addressed to: Softex, Inc. 9300 Jollyville Rd., Suite 201 Austin, TX. 78759

When you send information to Softex, you grant Softex a non-exclusive right to use or distribute the information in any way it believes appropriate without incurring any obligation to you.

© Copyright 2003-2006 by Softex Incorporated. All rights reserved.

Revision 1.0 Date: 02/24/06

ii

http://www.softexinc.com/


Contents

CONTENTS ..................................................................................................................................................III FIGURES .................................................................................................................................................... IV INTRODUCING SOFTEX OMNIPASS ................................................................................................................ V

Features of OmniPass ........................................................................................................................... v How This Document is Organized ........................................................................................................ vi Conventions and Typefaces Used in this Document............................................................................ vi

PART 1. START........................................................................................................ 1 CHAPTER 1. INSTALLING OMNIPASS ............................................................................................................2

1.1 System Requirements.....................................................................................................................2 1.2 Installing the OmniPass Application ...............................................................................................3 1.3 Verifying Information about the OmniPass Application ..................................................................3 1.4 Upgrading from a Previous Version of OmniPass ..........................................................................5 1.5 Uninstalling the OmniPass Application...........................................................................................5

CHAPTER 2. USER ENROLLMENT.................................................................................................................6 2.1 Master Password Concept..............................................................................................................6 2.2 Basic Enrollment .............................................................................................................................6 2.3 Enrolling an Authentication Device (Optional) ..............................................................................13

PART 2. USE ........................................................................................................... 19 CHAPTER 3. PASSWORD REPLACEMENT ....................................................................................................20

3.1 The OmniPass Authentication Toolbar .........................................................................................20 3.2 Remembering a Password and …................................................................................................21 3.3 Logging in to a Remembered Site …............................................................................................25 3.4 Password Management ................................................................................................................26 3.5 OmniPass User Identities .............................................................................................................27 3.6 Identities and Password Management..........................................................................................30

CHAPTER 4. FILE AND FOLDER LOCKING (FILE ENCRYPTION)......................................................................31 4.1 Encrypting Files or Folders ...........................................................................................................31 4.2 Decrypting File or Folders.............................................................................................................32 4.3 OmniPass Encrypted File Sharing................................................................................................33 4.4 Encrypted Files .............................................................................................................................34 4.5 A Special Warning for those who Encrypt …................................................................................35

PART 3. CONFIGURE........................................................................................... 36 CHAPTER 5. BACKUP AND RESTORE OF OMNIPASS USER PROFILES ...........................................................37

5.1 Backup of an OmniPass User Profile ...........................................................................................37 5.2 Restoring an OmniPass User Profile ............................................................................................38 5.3 Things to Know Regarding Backup/Restore.................................................................................40

CHAPTER 6. OVERVIEW OF THE OMNIPASS CONTROL CENTER ...................................................................41 6.1 Protect Your Files .........................................................................................................................42 6.2 Change Your OmniPass Settings .................................................................................................43 6.3 Run Enrollment Wizard.................................................................................................................49

APPENDIX A: TROUBLESHOOTING............................................................... 51 Windows 2000/Windows XP Issues ....................................................................................................51 Dialog appears after OmniPass authentication during Windows Logon .............................................52

INDEX........................................................................................................................................................54


iii


Figures Figure 1: Viewing the version information for OmniPass.............................................................................4 Figure 2: OmniPass Enrollment Wizard - Welcome ....................................................................................7 Figure 3: OmniPass Enrollment Wizard - Verify Username and Password.................................................8 Figure 4: OmniPass Enrollment Wizard - Secure Storage Device Selection ..............................................9 Figure 5: OmniPass Enrollment Wizard - Authentication Device Selection...............................................10 Figure 6: OmniPass Enrollment Wizard - Audio and Taskbar Settings .....................................................11 Figure 7: OmniPass Enrollment Wizard - Backup User Profile..................................................................12 Figure 8: OmniPass Enrollment Wizard - Congratulations ........................................................................13 Figure 9: OmniPass Enrollment Wizard - Enrolling an Authentication Device ..........................................14 Figure 10: Enrolling an Authentication Device - Choose a Finger .............................................................15 Figure 11: Enrolling an Authentication Device - Capture Fingerprint ........................................................16 Figure 12: Enrolling an Authentication Device - Verify Fingerprint ............................................................17 Figure 13: Enrolling an Authentication Device - Device Enrollment Complete..........................................18 Figure 14: The OmniPass Authentication Toolbar.....................................................................................20 Figure 15: OmniPass Authentication Toolbar - Fully Expanded with Fingerprint Prompt .........................21 Figure 16: Microsoft Outlook Login ............................................................................................................21 Figure 17: Microsoft Visual SourceSafe Login...........................................................................................22 Figure 18: The Three Step Remember Password Procedure ...................................................................22 Figure 19: Remember Password Options..................................................................................................23 Figure 20: The Password Wizard...............................................................................................................24 Figure 21: Authentication Prompt for Remembered Site ...........................................................................25 Figure 22: Authentication Prompt - Multiple Authentication Methods........................................................25 Figure 23: Manage Your Passwords - Manage Vault ................................................................................27 Figure 24: Manage Your Passwords - Manage Identities..........................................................................28 Figure 25: Choose Identity During Login ...................................................................................................29 Figure 26: Switch User Identity ..................................................................................................................29 Figure 27: Select Identity ...........................................................................................................................29 Figure 28: Managing Passwords for Multiple Identities .............................................................................30 Figure 29: OmniPass Encrypt File(s) .........................................................................................................31 Figure 30: Encrypting a Folder Containing Multiple Files ..........................................................................32 Figure 31: Decrypt To... .............................................................................................................................32 Figure 32: Select Decryption Location .......................................................................................................33 Figure 33: OmniPass Sharing....................................................................................................................33 Figure 34: OmniPass Encrypted File Sharing............................................................................................34 Figure 35: Locked File - Before and After ..................................................................................................34 Figure 36: Backup User Profile ..................................................................................................................37 Figure 37: Restore User Profile - Select Storage Device (Source)............................................................38 Figure 38: Restore User Profile - Select Storage Device (Target).............................................................39 Figure 39: OmniPass Control Center Main Window ..................................................................................41 Figure 40: Protect Your Files .....................................................................................................................42 Figure 41: Change User Settings...............................................................................................................43 Figure 42: Users' Audio and Taskbar Settings ..........................................................................................44 Figure 43: Window Transparency Settings (cropped) ...............................................................................44 Figure 44: File Encryption Settings (cropped)............................................................................................45 Figure 45: Set Authentication Rules ..........................................................................................................46 Figure 46: Change System Settings ..........................................................................................................47 Figure 47: Modify OmniPass startup options (cropped) ............................................................................48 Figure 48: Enable Strong Logon Security (cropped) .................................................................................48 Figure 49: Enrollment Wizard Menu ..........................................................................................................49 Figure 50: Sharing and security model for local accounts .........................................................................51 Figure 51: Limit local account use of blank passwords ... .........................................................................52 Figure 52: OmniPass/Windows Login Error...............................................................................................52 Figure 53: OmniPass Reconfirm Password...............................................................................................53


iv


Introducing Softex OmniPass

Softex OmniPass provides password management capabilities to Microsoft Windows operating systems. OmniPass enables you to use a “master password” for all Windows, application and on-line passwords. A “master password” is an OmniPass authentication method which simplifies the procedures used to access password protected resources. The “master password” will be used to enter any password protected site or program once you have registered those resources with OmniPass.

OmniPass extends the Windows interactive logon model by requiring users to authenticate themselves before granting access to the Windows desktop. OmniPass enables strong authentication by allowing users to authenticate with single or multiple authentication methods. Fingerprint recognition devices or SmartCard devices are some of the hardware security devices that can be used by OmniPass. Integrating these devices with OmniPass results in a multi-tiered authentication system, which restricts access to your desktop, applications, websites, and other password protected resources. OmniPass can be upgraded with “plug-in” components to support new authentication and storage methods/hardware.

Furthermore, OmniPass enables file encryption on your Windows-based system. The data in these encrypted files cannot be viewed by other users. OmniPass enables you to share your OmniPass encrypted files with other OmniPass users while restricting access from others.

OmniPass presents a convenient graphical user interface, through which you can securely manage passwords, users, and multiple identities for each user.

Features of OmniPass

OmniPass augments your Windows-based system with a rich feature set, enhancing your computing experience with the following characteristics:

• Easy to use “master password” for all Windows, application, and online passwords

• Easy to import and export existing passwords

• Secure storage of unlimited passwords and related information

• Extensible security through integration with hardware security devices – such as fingerprint recognition, SmartCard, or TPM devices

• Compatible with Microsoft Passport support for Internet Explorer and Windows XP Credential Manager

• User-friendly GUI for password, user and identity management

• Integrated file encryption and encrypted-file-sharing

• Seamless integration with Windows, providing secure Windows Logon

• Full support for Windows platforms including Windows 2000 (Server and Professional), XP (Home and Professional), and Windows 2003

• International language support Revision 1.0 Date: 02/24/06

v


How This Document is Organized

This document proceeds from basic to advanced. Outlined steps initially assume an inexperienced user. Towards the end of the document outlined steps are less explicit, the assumption being that the user will be more familiar with application-specific concepts.

• Part 1, “Start”

• Chapter 1, “Installing OmniPass” describes system requirements of the software, and shows install, uninstall, and upgrade procedures.

• Chapter 2, “User Enrollment” walks through how to enroll users into OmniPass, and how to integrate devices with OmniPass

• Part 2, “Use”

• Chapter 3, “Password Replacement” describes how to use identities and the password replacement function

• Chapter 4, “File and Folder Locking” describes how to use the encryption/decryption function

• Part 3, “Configure”

• Chapter 5, “Exporting and Importing Users” describes how to use the export/import function

• Chapter 6, “Overview of the OmniPass Control Center” surveys the remaining OmniPass functions

• Appendix A, “Troubleshooting” Conventions and Typefaces Used in this Document

The terms “choose”, “select”, and “click” are used interchangeably. They all mean either: hovering your mouse over the selection and left-click once, or hitting the <TAB> button until the selection is highlighted and hitting <ENTER>.

“Choose”, “Select”, “Click”

Bold-faced default typeface (Arial) text indicates menu options, commands and dialog titles. Start

Italicized text indicates example text and references to other chapters or sections within this document. Chapter 3.2.2

WARNING All caps indicates text that deserves special attention.

This icon indicates special notice should be taken to prevent future confusion. This icon indicates special notice should be taken or risk data loss, sensitive data exposure, or possibility of being refused access to your system


vi


Part 1. Start

Part 1 guides you through the preparation of your Windows-based system for the OmniPass application. You will be led through the OmniPass installation process. You will also be led through the procedure of enrolling your first user into OmniPass. Enrollment of a hardware security device is also shown, but its integration with OmniPass is completely optional. Your system may not have such a device present. Upon completion of Part 1, you will be ready to start using OmniPass.


1


Chapter 1. Installing OmniPass

In the introduction of this document are described some of the features OmniPass will provide you once installed on your system. It is possible that OmniPass was provided pre-installed by your system manufacturer or distributor. Evidence of this would be:

• The presence of the golden key shaped OmniPass icon in the taskbar

• The launching of the OmniPass Enrollment Wizard upon system boot

• The presence of the Softex program group in the Programs group of the Start menu (the Softex program group may be nested within another program group)

If one of the cases above is true for your system, then you may skip to

Chapter 2. User Enrollment. Otherwise, please continue with this chapter, which will cover the following:

• Notifying of system requirements for OmniPass

• Installing of OmniPass

• Verifying version information of OmniPass

• Upgrading from a previous OmniPass version

• Uninstalling of OmniPass

Before you can install OmniPass, you must determine whether or not your system will support it.

Note to users of OmniPass Enterprise Edition: During Installation and initial restart of your version of OmniPass additional configuration screens may appear. These screens are to configure your OmniPass client software to communicate with an OmniPass Server. For assistance in this configuration, you need to contact your network administrator. Network administrators should consult the OmniPass Enterprise Edition Administrators’ Guide. Foregoing communication with an OmniPass Server, the client will function almost identically as outlined in this users’ guide.

1.1 System Requirements

The OmniPass application requires space on your hard drive; it also requires specific Operating Systems (OS’s), and a specific Internet browser. The minimum requirements are as follows:

• One of these OS’s: Windows 2000 (Professional or Server), Windows XP (Home or Professional), or Windows 2003

• Internet Explorer 5.5 or greater

• At least 60 MB available hard disk space

If your system meets the above requirements then it is capable of running OmniPass.


2


1.2 Installing the OmniPass Application

If OmniPass is already installed on your system, please refer to either Chapter 2. User Enrollment or Chapter 1.4 Upgrading from a Previous Version of OmniPass. Otherwise please continue with this section on software installation.

NOTE: OmniPass requires that the user installing OmniPass have administrative privileges to the system. If your current user does not have administrative privileges, log out and then log in with an administrator user before proceeding with OmniPass installation. To install OmniPass on your system you must:

1. Insert the installation media for the OmniPass application into the appropriate drive. If you are installing from CD-ROM or DVD-ROM, the OmniPass installation program should automatically launch and provide directions for you to follow.

NOTE: If you are not using CD or DVD media to install OmniPass or if the OmniPass installation program does not automatically launch, then you may have to perform a manual installation. Files may need to be extracted before you can manually launch SETUP.EXE.

2. Follow the directions provided in the OmniPass installation program.

Specify a location to which you would like OmniPass installed.

WARNING: It is recommended that you NOT install OmniPass in the root directory (e.g. C:\). OmniPass file encryption does not permit the encryption of files within the OmniPass installation directory. Installing OmniPass to root will dramatically limit where files can be encrypted on your system.

3. Once OmniPass has completed installation you will be prompted to

restart you system. Once your system has rebooted you will be able to use OmniPass. If you choose not to restart immediately after installation, OmniPass will not be available for use until the next reboot.

The installation program automatically places an icon (Softex OmniPass) in the Windows Control Panel as well as a golden key shaped icon in the taskbar. This concludes OmniPass installation. If you would like to proceed with using OmniPass, skip to Chapter 2. User Enrollment. Otherwise continue this chapter to learn more about upgrading or uninstalling OmniPass.

1.3 Verifying Information about the OmniPass Application

After you have completed installing OmniPass and restarted your system, you may wish to check the version of OmniPass and that it is properly installed on your system. To check the version information of OmniPass:


3


1. From the Windows Desktop, double-click the key shaped OmniPass icon in the taskbar (usually located in the lower right corner of the screen).

Or

Click the Start button, select Settings, and click Control Panel (if you are using Windows XP you will see the Control Panel directly in the Start menu; click it, then click Switch to Classic View). Double-click Softex OmniPass in the Control Panel, and the OmniPass Control Panel will appear. If it does not appear, then the program is not properly installed.

Or Click the Start button, select Programs, and from the submenu select the Softex program group, from that submenu click OmniPass Control Center.

2. You will see the OmniPass Control Center main window. The version information is under the Version Detail menu. You may need to expand the Version Detail menu to view the version information.

Figure 1: Viewing the version information for OmniPass


4


1.4 Upgrading from a Previous Version of OmniPass

If you already have a version of OmniPass installed on your system, you can upgrade OmniPass to a more recent version. OmniPass installation supports automatic upgrading of the software. To upgrade OmniPass, refer to Chapter 1.2 Installing the OmniPass Application for directions. If you want to uninstall OmniPass and then reinstall it then: WARNING: Before you uninstall the software, decrypt all OmniPass encrypted files and export all OmniPass User Profiles. Failure to do so may result in permanent loss of encrypted file data, and permanent loss of all remembered passwords and associated information (see Chapter 5. Exporting and Importing Users).

1. Uninstall the previous version of OmniPass. Follow the steps outlined in Chapter 1.5 Uninstalling the OmniPass Application.

2. After the system has been rebooted, you can install the new version of

OmniPass. For directions refer to Chapter 1.2 Installing the OmniPass Application.

3. Reboot your system. Now you can use the new version of OmniPass.

Proceed to the next chapter to start user enrollment.

1.5 Uninstalling the OmniPass Application

If you would like to remove the OmniPass application from your system, or migrate your licensed version of OmniPass to another system, then you should: WARNING: Before you uninstall the software, decrypt all OmniPass encrypted files and export all OmniPass User Profiles. Failure to do so may result in permanent loss of encrypted file data, and permanent loss of all remembered passwords and associated information (see Chapter 5. Exporting and Importing Users).

1. Click Start on the Windows taskbar. Select Settings, and then Control Panel.

2. Double-click Add/Remove Programs.

3. Select OmniPass, and then click Change/Remove.

4. Follow the directions to uninstall the OmniPass application.

5. Once OmniPass has finished uninstalling, reboot your system when

prompted.


5


Chapter 2. User Enrollment

OmniPass is now installed on your system, but before you can use any OmniPass features you have to enroll a user into OmniPass. Chapter 2.2 Basic Enrollment is where you should start your enrollment process. If you would like to use an optional authentication device (e.g. fingerprint recognition or SmartCard device) then you will also need to consult Chapter 2.3 Enrolling an Authentication Device (Optional).

2.1 Master Password Concept

Computer resources are often protected with passwords. Whether you are logging into your computer desktop, accessing your email, e-banking, paying bills online, or accessing network resources, you often have to supply credentials to gain access. This can result in dozens of sets of credentials that you have to remember. During OmniPass user enrollment a single “master password” is created for the enrolled user. This master password “replaces” all other passwords for sites you register with OmniPass (the process of registering sites with OmniPass will be discussed in Part 2. Use). Example – A user, Shinji, installs OmniPass on his system (his home computer) and enrolls an OmniPass user with the username “Eva_01” and the password “eschaton”. He then goes to his webmail site to log on to his account. He inputs his webmail credentials as usual (username “Ikari” and password “warriors”), but instead of clicking Submit, he directs OmniPass to Remember Password. Now whenever he returns to that webmail site, OmniPass will prompt him to supply access credentials. He then enters his OmniPass user credentials (“Eva_01” and “eschaton”) in the OmniPass authentication prompt, and he will be allowed into his webmail account. He can do this with as many websites or password protected resources he likes, and he will gain access to all those sites with his OmniPass user credentials (“Eva_01” and “eschaton”). This is assuming he is accessing those sites with the system he enrolled his OmniPass user onto. OmniPass does not actually change the credentials of the password protected resource. If he were to go to an Internet café to access his webmail, he would need to enter his original webmail credentials (“Ikari” and “warriors”) to gain access. If he attempts his OmniPass user credentials (“Eva_01” and “eschaton”) on a system other than where he enrolled that OmniPass user, he will not gain access. Continue to the next section to begin OmniPass user enrollment.

2.2 Basic Enrollment

The basic enrollment procedure assumes you have no hardware authentication devices or alternate storage locations that you wish to integrate with OmniPass. If you desire such functionality, consult the appropriate sections after reviewing this section. OmniPass supports additional authentication methods (hardware security devices) through the installation of OmniPass component Plug-Ins. Please visit our website or contact us for more information about Plug-Ins.


6


The OmniPass Enrollment Wizard will guide you through the process of enrolling an OmniPass user. Unless you specified otherwise, after OmniPass installation the OmniPass Enrollment Wizard will launch on Windows login. If you do not see the OmniPass Enrollment Wizard, you can bring it up by clicking Start on the Windows taskbar; select Programs; select Softex; click OmniPass Enrollment Wizard (see Figure 2).

2.2.1 Welcome

Figure 2: OmniPass Enrollment Wizard - Welcome

Click Enroll to proceed to username and password verification (see Figure 3). By default, the OmniPass Enrollment Wizard enters the credentials of the user currently logged on to Windows.


7


2.2.2 Verify Credentials

Figure 3: OmniPass Enrollment Wizard - Verify Username and Password

For most users the Domain: field should be the local computername (with “(Local Machine)” appended to it), but those enrolling their Windows domain user should select the appropriate domain. Selecting OmniPass Account will specify a set of user credentials independent of the Windows authentication framework. This set of user credentials is recognized by the OmniPass application and is not associated with any Windows object. Enter the password you use to log in to Windows. This will become the “master password” for this OmniPass user. Click Next to continue (see Figure 4).


8


2.2.3 Select Secure Storage Device

Many users will not see the following screen during initial user enrollment. The following screen will only be displayed if OmniPass detects multiple secure storage devices. Supported secure storage devices must have their drivers installed for OmniPass to recognize them.

Figure 4: OmniPass Enrollment Wizard - Secure Storage Device Selection

In this step you are selecting where OmniPass will be securely storing your OmniPass data. Do not be alarmed if there are devices listed as selections that you have not installed on your system. The selections displayed on this screen are dependent upon the version of OmniPass you have installed. These selections are not necessarily dependent upon which devices are attached to your system. Although, if an applicable device (e.g. SmartCard, USB key) is installed but not attached to your system, it may not be visible as a selection.

Regardless of where you choose to store OmniPass data, the data are stored in an encrypted format and their content will not be viewable to others.

If you would like to use a secure storage device other than Local Hard Disk Drive then please review Chapter 2.4 Alternate Storage Location to see how your enrollment procedure will differ. Otherwise click Local Hard Disk Drive and click Next to proceed (see Figure 5).


9


2.2.4 Enrolling an Authentication Device

If there are no supported authentication devices attached to the system then the following screen may not be displayed.

Figure 5: OmniPass Enrollment Wizard - Authentication Device Selection

In this step you can select which authentication devices you would like to integrate with OmniPass. Just as in the secure storage device selection screen, there may be devices listed that are not present on your system. Also, installed devices that are not attached may not appear on this screen. If you do not want to enroll any authentication devices right now then do not select any, and click Next to proceed. You may be prompted to confirm that you are not enrolling any authentication devices.


10


2.2.5 User Notification Settings

Figure 6: OmniPass Enrollment Wizard - Audio and Taskbar Settings

In this step you can choose how OmniPass notifies you of various OmniPass events. We recommend you keep Taskbar Tips on Beginner mode taskbar tips and Audio Prompts on at least Prompt with system beeps only until you get accustomed to how OmniPass operates. Click Next to proceed with user enrollment. You will be forced to backup your OmniPass User Profile. This file contains OmniPass data specific to the user enrolled. It can be used to port your OmniPass user to another system running a compatible version of OmniPass. It also stores user-specific OmniPass data (e.g. enrolled fingerprints, encryption keys, and password vault data).


11


2.2.6 Backup OmniPass User Profile

Figure 7: OmniPass Enrollment Wizard - Backup User Profile Once you click Next OmniPass will prompt for the location to which you want to save the OmniPass User Profile. You will also need to specify a password; this password will be required if and when you ever import the OmniPass User Profile.


12


2.2.7 Congratulations

Figure 8: OmniPass Enrollment Wizard - Congratulations You will be asked if you would like to log in to OmniPass with your newly enrolled user; click Yes and then proceed to Part 2 to start using OmniPass.

2.3 Enrolling an Authentication Device (Optional)

Integration with a hardware authentication device will both, increase the security of your OmniPass system, and streamline the OmniPass authentication procedure. Security is augmented because you can restrict


13


access to OmniPass (as well as your Windows desktop and password protected resources) via enrolled hardware security devices; with this configuration, compromising the “master password” will not be sufficient to compromise system security. You can configure OmniPass so that access is restricted entirely unless your authentication devices are used. When decrypting files or visiting remembered websites, instead of manually typing your “master password” each time, you could authenticate with the security device (e.g. use your fingerprint). You can enroll devices manually via the OmniPass Control Center. With an OmniPass user logged on, double-click the OmniPass system tray icon. Click Run Enrollment Wizard and select Modify a user’s device enrollment. Upon successfully authentication, OmniPass will direct you to the authentication device enrollment section of the OmniPass Enrollment Wizard.

2.3.1 Enrolling a Fingerprint Recognition Device

At the Select Authentication Device dialog select the security device which you want to enroll and click Next (see Figure 9).

Figure 9: OmniPass Enrollment Wizard - Enrolling an Authentication Device


14

At any time only one fingerprint recognition device should be connected to your system. Having multiple fingerprint recognition devices attached to your system may cause OmniPass to operate unpredictably.


2.3.2 Choosing a Finger

You will be prompted to select the finger you wish to enroll. Fingers that have already been enrolled will be marked by a green check . The finger you select to enroll at this time will be marked by a red arrow . OmniPass will allow you re-enroll a finger. If you choose a finger that has already been enrolled and continue enrollment, OmniPass will enroll the fingerprint, overwriting the old fingerprint. Select a finger to enroll and click Next (see Figure 10).

Figure 10: Enrolling an Authentication Device - Choose a Finger

Clicking Practice will direct you to an exercise that will assist in your learning how to use the fingerprint recognition device properly. Different types of fingerprint sensors (e.g. swipe vs. touch) require the user to take different actions with their finger for the sensor to register a valid fingerprint scan.

2.3.3 Capturing the Fingerprint


15

It is now time for OmniPass to capture your selected fingerprint (see Figure 11). It may take up to eight captures before OmniPass can acquire your fingerprint. Should OmniPass fail to acquire your fingerprint, or if the fingerprint capture screen times out, you can click Back to restart the fingerprint enrollment process.


Touch Sensor

Swipe Sensor

Figure 11: Enrolling an Authentication Device - Capture Fingerprint

There are several types of fingerprint sensors (e.g. "swipe" or "touchpad"), and each type requires a different action for capturing. The "core" of the fingerprint is the ideal area for capture. The core of your fingerprint is usually aligned with the base of your cuticle. It is where the concentric whorls of your fingerprint converge. To start fingerprint capturing, follow the directions on the Capture Fingerprint screen. Touchpad sensors are square, and they require you to place your fingertip on the sensor and hold it there until it is captured. During a successful fingerprint capture the text, Place the selected finger on the sensor, will be replaced with the text, Lift and replace your finger on the sensor. You will also see a black fingerprint in the capture windows turn and stay green, and the counter under the capture window will increment. Lift and replace your fingertip as many times necessary for OmniPass to acquire your fingerprint.


16

Swipe sensors are a type of fingerprint sensor that is operated by placing your finger on the scanner and pulling the finger across the sensor firmly with even speed. Swiping too fast or too slow will result in a failed fingerprint capture. For better results, it is recommended that you use the Practice fingerprint selection before enrolling the first time.


2.3.4 Verifying the Fingerprint

Once OmniPass has successfully acquired the fingerprint, the Verify Fingerprint screen will automatically appear (see Figure 12).

Figure 12: Enrolling an Authentication Device - Verify Fingerprint

To verify your enrolled fingerprint, place or swipe your fingertip on the sensor as if you were having a fingerprint captured. Successful fingerprint verification will show a green fingerprint in the capture window and the text Verification Successful under the capture window. Upon clicking Next, OmniPass will recommend that you enroll at least two fingers. You may enroll just a single fingerprint, or as many fingerprints as you like.


17


2.3.5 Completing Device Enrollment

If there are multiple OmniPass-supported authentication devices connected to the system, you may be presented with the following screen.

Figure 13: Enrolling an Authentication Device - Device Enrollment Complete

If you check the first box, Enroll more security authentication devices …, upon clicking Next, you will be directed back to the Select Authentication Device screen (see 2.2.4 or 2.3.1). If you check the second box, I am done with enrolling security authentication devices …, upon clicking Next, you will be directed to the Audio and Taskbar Settings (see 2.2.5). Continue the OmniPass Enrollment Wizard, resuming the procedure at 2.2.4 or 2.2.5.


18


Part 2. Use

You are now ready to begin using OmniPass. Used regularly, OmniPass will streamline your authentication procedures. For the credentials registered with it, OmniPass is a secure repository. In the event you forget any of those passwords, you can find them in OmniPass. Part 2. Use covers basic OmniPass functionality. Review this section to quickly get familiar with the OmniPass functions you will most use. If your system is shared among several users (often the case in a home PC or SOHO environment) then you may find some additional useful features in Part 3. Configure.


19


Chapter 3. Password Replacement

You will often use the password replacement function of OmniPass. When you go to a restricted access website (e.g. your bank, your web-based email, online auction or payment sites), you are always prompted to enter your login credentials. OmniPass can detect these prompts and you can “teach” OmniPass your login credentials. The next time you go to that website, you can authenticate with OmniPass to gain access. OmniPass prompts you for your “master password”, and that single password gains you access to any site you have “taught” OmniPass. Or you could login with any hardware authentication device you have enrolled into OmniPass. This functionality is not limited to restricted access websites. OmniPass can learn any set of credentials that you are prompted to provide (e.g. your Intranet email, your ftp login, any of your client logins, any restricted access network resource).

3.1 The OmniPass Authentication Toolbar

After installing OmniPass and restarting, you may have noticed a dialog you had not seen before at Windows Logon (see Figure 14). This is the OmniPass Authentication Toolbar, and it is displayed whenever the OmniPass authentication system is invoked. The OmniPass authentication system may be invoked frequently: during Windows Logon, during OmniPass Logon, when unlocking your workstation, when resuming from standby or hibernate, when unlocking a password-enabled screensaver, during password replacement for remembered site or application logins, and more. You see the OmniPass Authentication Toolbar upon Windows Logon because the OmniPass authentication system is seamlessly integrated with Windows. When you see this toolbar, OmniPass is prompting you to authenticate.

Figure 14: The OmniPass Authentication Toolbar The bold-faced text "Logon User Authentication" shows what OmniPass-restricted function you are attempting. The non-bold-faced text beneath may give you additional instructions regarding authentication. Figure 14 displays the both the collapsed and the expanded toolbar. Expanding the toolbar displays which authentication methods are available. Selected authentication methods are highlighted while unselected methods are not. When you click the icon for an unselected authentication method, the authentication prompt associated with that method is displayed (see Figure 15).


20


Figure 15: OmniPass Authentication Toolbar - Fully Expanded with Fingerprint Prompt When prompted to authenticate, you must supply the appropriate credentials: an enrolled finger for the fingerprint capture window, a PIN for the SmartCard PIN prompt, your master password for the master password prompt (the key icon). Depending on your Authentication Rules (see 6.2 User Settings), you may have to satisfy several different authentication prompts to gain access (e.g. fingerprint AND SmartCard PIN). By default all authentication methods are set to Automatic. Whenever OmniPass prompts for authentication all enrolled methods are available, even though only one method might be displayed. If you click Make Manual for an authentication method on the expanded toolbar, that authentication method will not automatically display during an OmniPass event. Methods of authentication set to Automatic will be displayed, but you must fully expand the toolbar and click the authentication method if you want to authenticate via a method set to Manual.

3.2 Remembering a Password and …

Most examples of password replacement used in this document show the remembering of websites, but OmniPass can remember any set of credentials used to access any restricted resource. Any application you use, any GUI client, any password protected resource that manifests a password prompt, OmniPass can remember (See Figures 16 and 17).

Figure 16: Microsoft Outlook Login


21


Figure 17: Microsoft Visual SourceSafe Login

Both of the previous dialogs represent application login prompts that OmniPass will recognize as candidates for password replacement. If you have configured your Taskbar Tips to do so, OmniPass will notify you of when you have an opportunity to remember a password. Using the following procedure, you can store a set of credentials into OmniPass. These credentials will then be linked to your “master password” or any enrolled authentication devices. Go to a site that requires a login (username and password), but DO NOT LOGIN YET. At the site login prompt, enter your username and password in the prompted fields, but DO NOT ENTER THE SITE (do not hit Enter or click Submit or OK or Login). Right-click the OmniPass system tray icon and select Remember Password from the submenu. The Windows arrow cursor will change to a golden key OmniPass cursor. Click this OmniPass cursor in the login prompt area, but DO NOT CLICK the “Login” or “Submit” button (see Figure 18).

Figure 18: The Three Step Remember Password Procedure


22


3.2.1 Associating a Friendly Name

After clicking the OmniPass key cursor near the login prompt OmniPass will prompt you to enter a “friendly name” for this remembered site (see Figure 19). You should enter something that reminds you of the website, the company, or the service you are logging into. In its secure database, OmniPass associates this “friendly name” with this website. You can remember multiple different logins to the same password protected resource. To do this you must specify different friendly names for each set of credentials. If you use the same friendly name then OmniPass will overwrite the previous set of credentials associated with the application or website. If you have several credentials remembered for the same site, OmniPass will prompt you to select among the available friendly names.

Figure 19: Remember Password Options

3.2.2 Additional Settings for Remembering a Site

When OmniPass prompts you to enter a “friendly name” you also have the opportunity to set how OmniPass authenticates you to this site (see Figure 19). There are three effective settings for how OmniPass handles a remembered site. The default setting is Automatically click the “OK” or “Submit” button for this password protected site once the user is authenticated. With this setting, each time you navigate to this site OmniPass will prompt you for your “master password” (or authentication device). Once you have authenticated with OmniPass, you will automatically be logged into the site. Less secure is the option to Automatically enter this password protected site when it is activated. Do not prompt for authentication. Check the upper box to get this setting, and each time you navigate to this site OmniPass will log you into the site without prompting you to authenticate.


23


WARNING: This setting is more convenient in that whenever you go to a site remembered with this setting, you will bypass any authentication procedure and gain instant access to the site. But should you leave your system unattended, unlocked, with your OmniPass user logged in, anyone using your system can browse to your password protected sites and gain automatic access. If you uncheck both boxes in Settings for this Password Site, OmniPass will prompt you for your “master password” (or authentication device). Once you have authenticated with OmniPass your credentials will be filled in the site login prompt, but you will have to click the website OK, Submit, or Login button to gain access to the site. Click Finish to complete the remember password procedure. The site location, the credentials to access the site, and the OmniPass authentication settings for the site are now stored in OmniPass’ secure database. The OmniPass authentication settings (Settings for this Password Site) can always be changed in Vault Management (see Chapter 3.5 Password Management).

3.2.3 Using the Password Wizard

Most authentication dialogs consist of two or three fields that ask for credentials (LoginID/Password, Username/PIN). Authentication prompts may require more sophisticated user input or may require sequential login steps and OmniPass may fail to "Remember" how to log in. Under these circumstances, users can take advantage of the Password Wizard feature to remember passwords. If OmniPass fails to remember a set of credentials, you will be given the option to run the Password Wizard. You can use the Password Wizard to direct OmniPass to replay the user input necessary to gain access to the resources protected by the authentication prompt. The Password Wizard also has an advanced mode through which the user can script other user input events to be replayed by OmniPass at an authentication prompt (e.g. TAB, Backspace, Mouse-Clicks, etc.).

Figure 20: The Password Wizard


24


3.3 Logging in to a Remembered Site …

Whether or not OmniPass prompts you to authenticate when you return to a remembered site is determined by Settings for this Password Site (see 3.2.2) and can be changed in Vault Management (see 3.5). The authentication methods required for access to password protected resources are determined by Authentication Rules (see Chapter 6.2 User Settings). The following cases are applicable to using OmniPass to login to: Windows, remembered websites, and other password protected resources.

3.3.1 With Master Password

Once you return to a site you have remembered with OmniPass, you may be presented with a “master password” prompt (see Figure 21). Enter your “master password” and you will be allowed into the site.

Figure 21: Authentication Prompt for Remembered Site

3.3.2 With Multiple Authentication Methods

Or you may be presented with an OmniPass authentication prompt that has several different authentication methods (see Figure 22).

Figure 22: Authentication Prompt - Multiple Authentication Methods Revision 1.0 Date: 02/24/06

25


If multiple authentication methods are shown at the authentication prompt, you may have to authenticate multiple times (fingerprint reader AND SmartCard reader) to gain access. NOTE: It may take a few tries for a fingerprint reader to capture your fingerprint. Try to place or swipe your fingertip on the sensor as you did during fingerprint enrollment.

3.3.3 Logging into Windows with a Biometric Device

When logging into Windows with a biometric device, the fingerprint capture window will now appear next to the Windows Login screen. Place or swipe your enrolled fingertip on the sensor to authenticate. You will be simultaneously logged into Windows and OmniPass.

The capture window will also appear if you have used Ctrl-Alt-Del to lock a system, and the biometric device can be used to log back in as stated above.

NOTE: If a machine is locked and OmniPass detects a different user logging back in with a fingerprint, the first user will be logged out and the second user logged in.

In Windows XP, your login options must be set either for classic login, or for fast user switching and logon screen to be enabled to use your fingerprint to log on to Windows. To change this go to Control Panel, select User Accounts and then click Change the way users log on or off.

If your Windows screensaver is password protected, the fingerprint capture window will now appear next to screensaver password dialog during resume. You can authenticate to your screensaver password prompt with your enrolled finger.

3.4 Password Management

OmniPass provides an interface that allows you to manage your passwords. To access this GUI, double-click the OmniPass key in the system tray. Click Manage Your Passwords; OmniPass will prompt you to authenticate. Once you gain access to the Password Vault, the Manage Vault menu should be displayed by default. You will see the Manage Vault interface, with a list of your friendly names (see Figure 23).


26


Figure 23: Manage Your Passwords - Manage Vault You can view the credentials stored for any remembered website by highlighting the desired resource under Password Protected Dialog and clicking Unmask Values. Should a password be reset, or an account expires, you can remove stored credentials from OmniPass. Highlight the desired resource under Password Protected Dialog and click Delete Page. You will be prompted to confirm the password deletion. The two check boxes in the Manage Vault menu govern whether OmniPass prompts you to authenticate or directly logs you into the remembered site (see 3.2.2). Finally, you can manage passwords for all your OmniPass user identities using the Identities drop-down box (see Chapter 3.5 OmniPass User Identities for more information).

3.5 OmniPass User Identities

To create and manage identities, double-click the OmniPass key in the system tray. Click Manage Your Passwords; OmniPass will prompt you to authenticate, then click Manage Identities (see Figure 24). You can only manage the identities of the currently logged in OmniPass user.


27


Figure 24: Manage Your Passwords - Manage Identities

To add a new identity, click New Identity or double-click <Click here to add a new identity>. Name the new identity and click OK. Click Apply to ensure the settings are saved. You can now switch to the new identity and start remembering passwords. To delete an identity, highlight the identity you want to delete and click Delete Identity; click Apply to ensure the settings are saved. When you delete an identity, all the remembered sites and password protected dialogs associated with the identity are lost. To set the default identity, highlight the identity you want as default and click Set as Default; click Apply to ensure the settings are saved. If you log in to OmniPass with a biometric device, you will automatically be logged in to the default identity for that OmniPass user. You can choose the identity with which you are logging in if you login using “master password”.

3.5.1 Choosing User Identity during Login

To choose your identity during login, type your username in the User Name: field. Press <TAB> and see that the Domain: field self-populates. Click the Password: field to bring the cursor to it, and you will see the pull-down menu in the Identity: field become available. Select the identity you wish to login as and then click OK to login (see Figure 25).


28


Figure 25: Choose Identity During Login

3.5.2 Switch User Identity

To switch identities at any time, right-click the OmniPass system tray icon and click Switch User Identity from the submenu (see Figure 26). The Switch Identity dialog will appear (see Figure 27). Select the desired identity and then click OK.

Figure 26: Switch User Identity

Figure 27: Select Identity


29


3.6 Identities and Password Management

On the Manage Vault interface, there is a pull-down selection box labeled, Identity. This field lets you choose for which identity you are managing passwords. When you select an identity here, only those password protected dialogs that are associated with that identity are shown (see Figure 28). You can perform all the functions explained in Chapter 3.4 Password Management.

Figure 28: Managing Passwords for Multiple Identities


30


Chapter 4. File and Folder Locking (File Encryption)

To protect yourself from theft or unauthorized viewing of sensitive material, OmniPass allows you to securely lock files or entire folders on your machine. These files are locked with a method called encryption, in which the data are converted to a form that unauthorized users cannot read. Once encrypted, the files can only be unlocked, or decrypted with your master password or enrolled hardware security device. OmniPass encrypted files will have the extension ".opf". You can always search your hard drive for *.opf to find all OmniPass encrypted files. It is recommended that you dedicate a new folder in which to put all your OmniPass encrypted files. OmniPass encrypted folders take the name of the original folder but end in ".opef".

4.1 Encrypting Files or Folders

To encrypt a file or folder, right-click the file or folder that you would like to prevent unauthorized access to. Click OmniPass Encrypt File(s) in the contextual menu (see Figure 29). OmniPass will prompt you to authenticate.

Figure 29: OmniPass Encrypt File(s) Revision 1.0 Date: 02/24/06

31


Figure 30: Encrypting a Folder Containing Multiple Files

If a folder containing multiple files is encrypted, a window will appear with a list of the files in the folder and their encryption status (see Figure 30). Click OK when encryption is complete.

There are certain folders that cannot be encrypted because it would have a negative impact on your system and your installed programs. The contents of C:\Windows and C:\Program Files cannot be encrypted, nor can the folder where OmniPass is installed.

4.2 Decrypting File or Folders

To decrypt a file or folder, right-click the file or folder to which you would like to regain normal access. Click OmniPass Decrypt File(s) from the contextual menu. OmniPass will prompt you to authenticate. OmniPass Decrypt File(s) will not be available if the files are already encrypted, or if they are system files, unable to be encrypted. Other ways to decrypt files are to right-click them and select Open, or double-click the files. Both of these actions will cause OmniPass to prompt you to authenticate. Once decrypted, they will remain so unless you decide to encrypt them again. If you encrypt a folder containing multiple files, all the contained files will be encrypted. Files you copy or move to the encrypted folder will also be encrypted. You can open and edit the contents of these files, and so long as they stay in the encrypted folder, when you close and save these files they will automatically be encrypted. To decrypt a file contained in an encrypted folder right-click it and select Decrypt To… select a location to which the decrypted file will be saved and click OK (See Figures 31 and 32). A copy of the file will be decrypted to the target directory. The original encrypted file will remain in the encrypted folder.

Figure 31: Decrypt To... Revision 1.0 Date: 02/24/06

32


Figure 32: Select Decryption Location 4.3 OmniPass Encrypted File Sharing

Once you have encrypted a file or folder, you have prevented anyone from viewing the contents without first decrypting the file or folder. OmniPass allows you to selectively share your encrypted files with other enrolled OmniPass users. To share an encrypted file or folder with another OmniPass user, right-click the encrypted resource and select OmniPass Sharing… from the contextual menu (see Figure 33). OmniPass will prompt you to authenticate.

Figure 33: OmniPass Sharing


33


Figure 34: OmniPass Encrypted File Sharing Upon successful authentication, the OmniPass Encrypted File Sharing dialog automatically opens (see Figure 34). Select the OmniPass user with whom you want to share this encrypted file or folder. Click Add User(s), and click OK. The encrypted resource has been shared. NOTE: Sharing an OmniPass encrypted file or folder effectively gives full control of the shared resource to whomever you shared it with. The users with whom you share these files can open, copy, delete, and modify all files you share. They can also remove you from the list of authorized OmniPass users, effectively taking control of the encrypted resource away from you.

4.4 Encrypted Files

Files that are encrypted by OmniPass have a new icon (see Figure 35). These files cannot be accessed until they are decrypted. Icons of encrypted folders are also updated with a lock graphic.

Figure 35: Locked File - Before and After Revision 1.0 Date: 02/24/06

34


4.5 A Special Warning for those who Encrypt …

If you are reading this then you are taking steps to safeguard your information. You will probably start encrypting your files with OmniPass soon (if you haven’t already). IMMEDIATELY export your current user profile (the one you have used and are going to use to encrypt) and save it on SEVERAL floppy disks and perhaps some places on your hard disk. Email it to yourself and save it in your Inbox. If your system crashes (or you mistakenly remove or overwrite OmniPass), and you do not have the OmniPass user profile that encrypted all you archived data files, THEN YOU WILL LOSE THAT DATA. Creating another OmniPass user with the same name and password and settings will not do. It will not be the same as the user profile originally created and with which you encrypted your files.


35


Part 3. Configure

If Part 2 could be viewed as a “Getting Started Guide” then this part can be viewed as an “Administrators’ Guide”. This part will give an overview of both the Export/Import function and the OmniPass Control Center. Much of what is discussed in this part could be considered customization of OmniPass. Customizations can be made on a per-user basis, or globally. Authentication rules will be discussed; in OmniPass, authentication rules can be configured so as to require very stringent levels of authentication (Multi-Factor Authentication).


36


Chapter 5. Backup and Restore of OmniPass User Profiles

Using the OmniPass Control Center, you can backup and restore OmniPass User Profiles. The backup process exports all remembered sites, credentials, and any enrolled fingerprints for an OmniPass user. All OmniPass data for a user is backed up to a single encrypted database file. During the import process, the Windows login of the exported user is required. If the proper credentials cannot be supplied, the user profile will not be imported. NOTE: You can, and should periodically backup your user profile and store it in a safe place (e.g. on several floppies). Should anything happen to your system, you can restore your OmniPass profile on your new system and have all your remembered sites, custom OmniPass settings, and enrolled fingerprints instantly. You would even be able to decrypt files that you had encrypted with that user profile (see 4.5).

5.1 Backup of an OmniPass User Profile

To backup an OmniPass user profile launch the OmniPass Enrollment Wizard and select Backup a user’s OmniPass profile (see Figure 36).

Figure 36: Backup User Profile


37


OmniPass will prompt you to authenticate. Upon successfully authentication, you must name the OmniPass user profile and decide where to save it. An .opi file is generated, and you should store a copy of it in a safe place. This .opi file contains all your user specific OmniPass data, and it is both encrypted and password protected. This user profile does NOT contain any of your encrypted data files.

5.2 Restoring an OmniPass User Profile

NOTE: You cannot restore a user into OmniPass if there already is a user with the same name enrolled in OmniPass. To restore an OmniPass user profile launch the OmniPass Enrollment Wizard and select Restore a user’s OmniPass profile (Figure 36). You will be directed to select the storage device from which to restore the user profile (see Figure 37). This step may be skipped if there are no alternate storage devices attached to the system.

Figure 37: Restore User Profile - Select Storage Device (Source)

If you did not enroll any alternate secure storage devices, then select OmniPass Import/Export File (*.opi) and click Next. OmniPass will then


38


prompt you to browse for the file you had previously backed up (.opi file). When you select the .opi file for restore, OmniPass will prompt you for authentication. The credentials that will allow a user profile to be imported are the Windows login credentials of the exported user. They are the credentials that had to be submitted when the user profile was exported. You will need User Name, Password, and Domain. If you don’t remember the value for Domain, in a corporate environment your network administrator should know, and in a PC or SOHO environment Domain should be your computer name. Once authentication is successful, OmniPass will prompt you to select a storage device for this users OmniPass data (see Figure 38).

Figure 38: Restore User Profile - Select Storage Device (Target) Unless you have an alternate secure storage device installed (USB key, SmartCard, etc.) select Local Hard Disk Drive and click Next. OmniPass will notify you if the user was successfully restored.


39


5.3 Things to Know Regarding Backup/Restore

• Assume you backup a local Windows user’s profile from OmniPass, and you want to restore that profile to another machine that has OmniPass. Before you can restore the profile, a Windows user with the same login credentials must be created on the machine restoring the profile. Example – I have a Windows user with the username “Kasahara” and the password “Motorcycle” on my system. I have enrolled Kasahara into OmniPass and remembered passwords. I want to take all my passwords to new system. I backup Kasahara’s OmniPass user profile. I go to my new system and using the Control Panel I create a user with the username “Kasahara” and the password “Motorcycle”. I can now successfully restore the OmniPass user data to the new system.

• When you backup an OmniPass User Profile for a Windows domain user, you can restore that OmniPass user profile on any domain computer running OmniPass. Example – Balthasar and Melchior are computers on the “NERV” domain. I work on Balthasar with the username “Ikari” and the password “PenPen” on the NERV domain. I have enrolled this user, Ikari, in OmniPass and remembered passwords. I want to take all my passwords to Melchior. I backup Ikari’s user profile from OmniPass on Balthasar. I go to OmniPass on Melchior and restore Ikari’s OmniPass data. Since Balthasar and Melchior are on the same domain, the restore is successful. If you do not know the domain you are using, you should contact your network administrator for assistance.

• If you backup an OmniPass-only User Profile, you can restore that user to any computer running OmniPass, provided that a user with that name is not already enrolled in OmniPass.

• If you attempt to restore a user profile who has the same name as a user

already enrolled in OmniPass, the OmniPass restore function will fail. Revision 1.0 Date: 02/24/06

40


Chapter 6. Overview of the OmniPass Control Center

Most of the functionality within the OmniPass Control Center has been touched upon in the previous two parts (Start and Use). This chapter will serve to explain functions within the OmniPass Control Center that weren’t explained thoroughly in the preceding parts of this users’ guide. The Manage Your Passwords section was exhaustively outlined in Chapter 3.4 – 3.6 and will not be covered in this chapter. You can access the OmniPass Control Center any of three ways:

• Double-click the golden OmniPass key shaped icon in the Windows taskbar (typically in the lower-right corner of the desktop)

• Click the Start button; select the Programs group; select the Softex program group; and click the OmniPass Control Center selection.

• Open the Windows Control Panel (accessible via Start button --> Settings --> Control Panel) and double-click the Softex OmniPass icon.

Figure 39: OmniPass Control Center Main Window

The information displayed and the functionality available through the main window of the OmniPass Control Center is dependent upon if there is a user currently logged on to OmniPass. The left pane of this main window


41


contains: Version Detail specific to the OmniPass application build installed on the system, User Information specific to the user currently logged on to OmniPass, and an Action menu providing quick access to operations normally available to the user upon right-clicking the OmniPass system tray icon. Also in the Action menu is a link to manually launch the Password Wizard.

6.1 Protect Your Files

The Protect Your Files selection provides a window through which you can do encryption and decryption functions (see Chapter 4). Similar to the Windows Explorer, the Protect Your Files window presents the directory structure of your system (Figure 40).

Figure 40: Protect Your Files

You can select files and folders and use the Encrypt and Decrypt buttons to encrypt and decrypt files. Some files and folders used by the Windows system or by other programs cannot be encrypted by OmniPass. Directing OmniPass to encrypt or decrypt a file will result in OmniPass prompting you for authentication. If you cannot authenticate successfully, the file will not be encrypted or decrypted. You can bypass the Protect Your Files window of the OmniPass Control Center via the OmniPass encryption/decryption shell extension. In the normal course of browsing and


42


accessing your files, if you right-click the file and see OmniPass Encrypt File(s) or OmniPass Decrypt Files(s), those OmniPass functions are available to you. Encryption and decryption will occur upon successful authentication.

6.2 Change Your OmniPass Settings

Use these settings to adjust different user preferences and settings such as the degree of audio and taskbar prompts, display preferences of the authentication window, encryption settings, and security authentication policies.

6.2.1 Change User Settings Each enrolled OmniPass User has their own settings with respect to OmniPass which are independent of other OmniPass Users’ settings. The Change User Settings pane allows users to customize OmniPass to suit their individual preferences (Figure 41). Home will navigate to the main window of the OmniPass Control Center and Back will navigate to the previous window.

Figure 41: Change User Settings


43


Inside both the Change user audio settings and the Change taskbar tips shown to the user interfaces, you can set how OmniPass notifies the user of OmniPass events (e.g. successful login, access denied, etc.). The details of each setting for both audio prompts and taskbar tips are explained fully in their respective interfaces (Figure 42). Figure 42: Users' Audio and Taskbar Settings

Within the Change authentication window settings interface you may set the transparency of the OmniPass authentication toolbar and the OmniPass authentication prompts. By default OmniPass is set to have a Solid Authentication Window which is completely opaque. You may adjust the transparency of the toolbar by selecting Transparent authentication window and adjusting the slider (Figure 43). This allows you to view the page/desktop “underneath” the OmniPass authentication toolbar.


44Figure 43: Window Transparency Settings (cropped)


The Modify file encryption settings interface (Figure 44) allows you to choose either the OmniPass Roaming Profile or a Digital Certificate that is already installed on your system. If you choose OmniPass Roaming Profile then the keys used for encryption are part of your OmniPass User Profile. Portability of OmniPass encryption functions to other computers requires only your OmniPass User Profile. If you choose Digital Certificate then the keys used for encryption are separate from your OmniPass User Profile. Portability of OmniPass encryption functions will require migration of both your OmniPass User Profile and the installed Digital Certificate. NOTE: Do not remove this Digital Certificate. If it is removed from the system, you will not be able to recover any of the encrypted files! Figure 44: File Encryption Settings (cropped)

Within this section you can also configure both the encryption Algorithm and the Keylength (in bits). Changes you make to these settings are only applied to future encryptions. So if you already had files encrypted when you change the encryption settings, you will need to decrypt and re-encrypt those files to have your encryption settings apply to them. Decryptions using original encryption settings are handled transparently to the user. The selections on the Set user authentication rules and policies screen determine which OmniPass functions require authentication via an enrolled security device (Figure 45). You can set individual authentication rules for each enrolled security device. If you have not enrolled any hardware security devices, then you cannot set any authentication rules. All OmniPass functions are accessible via a master password authentication. Setting Windows and OmniPass Logon will require the enrolled security device be authenticated against for the following functions: Windows Logon, OmniPass Logon, unlocking your workstation, resuming from standby or hibernate, and unlocking a password-enabled screensaver.


45


WARNING: If this setting is enabled for an enrolled security device, and the device fails or is removed from the system, you will not be able to regain access to your system. Only through a successful authentication via the enrolled device will access be granted.

Figure 45: Set Authentication Rules Example – You have a SmartCard device and a fingerprint recognition device enrolled. The SmartCard authentication rules are set independently of the fingerprint reader authentication rules, but rules are cumulative.

1. If there are no selections checked for any enrolled authentication devices, then there are no OmniPass authentication restriction, and you can access any OmniPass function using any method to authenticate (enrolled finger, master password, enrolled SmartCard).

2. For SmartCard authentication rules you checked Windows and

OmniPass Logon and File and Folder Encryption and Decryption. For fingerprint reader authentication rules you checked Windows and OmniPass Logon and Application and Website Password Replacement.


46

a. If you visit a remembered website, OmniPass will prompt you to authenticate and will not grant you access to the website until you successfully authenticate with an enrolled finger. Successful authentications with master password or enrolled SmartCard are not sufficient.


b. If you attempt to encrypt or decrypt a file with OmniPass, you will be prompted to authenticate and OmniPass will not allow you to encrypt/decrypt until you successfully authenticate with an enrolled SmartCard. Successful authentications with master password or enrolled finger are not sufficient.

c. If you log out of Windows (or OmniPass) and attempt to log back

in, you will be prompted to authenticate and OmniPass will not allow you to log back on until you successfully authenticate with BOTH a fingerprint reader AND a SmartCard. This dual authentication requirement is a Multi-Factor Authentication. Successful authentication with a master password, or with just the fingerprint reader are not sufficient. Neither are successful authentications with just the SmartCard. Loss or failure of either the SmartCard or the fingerprint reader will result in an inaccessible system.

6.2.2 Change System Settings OmniPass system settings are configuration parameters that are specific to the OmniPass authentication system as installed on your machine (Figure 46). Whichever OmniPass user logs onto the system, the OmniPass system settings will be the same.

Figure 46: Change System Settings


47


Through the Modify OmniPass startup options interface (Figure 47) you can specify how your OmniPass Logon is tied to your Windows Logon.

Figure 47: Modify OmniPass startup options (cropped) The first option, Automatically log on to OmniPass as the current user, will do just as it says; during Windows login, you will be logged on to OmniPass using your Windows login credentials. If the user logging into Windows was never enrolled into OmniPass, upon login no one will be logged on to OmniPass. This setting is appropriate for an office setting or any setting where users must enter a username and password to log into a computer. This is the default setting. With the second option, Manually log on to OmniPass at startup, OmniPass will prompt you to login once you have logged on to Windows. With the third option, Do not log on to OmniPass at startup, OmniPass will not prompt for a user to be logged on. OmniPass has a feature where any authentication device can be set as "Required" for Windows Logon. This feature is referred as Strong Logon Security (Figure 48).

Figure 48: Enable Strong Logon Security (cropped)


48


For Strong Logon Security to work on Windows XP the system has to be switched to the Classic Logon Mode. An unfortunate side effect of enabling the Classic Logon Mode is that Fast User Switching (FUS) and the XP Welcome Screen must be disabled. This is a Windows XP limitation. Check Enable Strong Logon Authentication in the Change System Settings interface. Once you have enabled Strong Logon Authentication you have to reboot the system for the setting to take effect. To get back to the XP Welcome Screen or to turn FUS back on, the user must disable Strong Logon Security, reboot the system and then manually enable the XP Welcome Screen and FUS from the User Accounts in Windows Control Panel. Once this is done the fingerprint reader or other security device can no longer be made as a "Required" device for login to the PC. This limitation is specific to Windows XP only. For Windows 2K and 2003 Server Strong Logon Security is always enabled.

6.3 Run Enrollment Wizard Click Run Enrollment Wizard to launch the Enrollment Wizard Menu which grants you access to high level user management functions (Figure 49).

Figure 49: Enrollment Wizard Menu


49


Clicking Add a new user to OmniPass will launch user enrollment exactly as seen in Chapter 2.2.2. And clicking either Backup a user’s OmniPass profile or Restore a user’s OmniPass profile will launch the backup/restore procedure as documented in Chapter 5. Clicking Remove a user from OmniPass will initiate an OmniPass authentication event. At this authentication prompt you are to enter the authenticating data of the user to be removed from OmniPass. WARNING: Removing a user will automatically destroy all OmniPass data associated with that user. All identities and remembered credentials associated with the user will be lost. Any remaining files encrypted by the user will be impossible to decrypt. If you are sure about removing the user, we recommend you –

1. Decrypt all OmniPass encrypted files before removing the user 2. Export the user profile

Clicking Modify a user’s device enrollment will initiate an OmniPass authentication event. At this authentication prompt you are to enter the authenticating data of the user whose device enrollment is to be modified. Upon successful authentication, OmniPass will launch the authentication device enrollment procedure as documented in Chapters 2.2.4 and 2.3.1.


50


Appendix A: Troubleshooting

Most major problems can be avoided by paying special attention to the NOTES and WARNINGS distributed throughout this document. Other common problems are discussed in this appendix. For support not covered in this document contact [email protected].

Windows 2000/Windows XP Issues

In Windows 2000 or Windows XP, you cannot use OmniPass to create Windows users. You must first create the Windows user, and you will need administrative privileges to do that. Once the Windows user is created, you can add that user to OmniPass using the same username and password.

Cannot add Windows users to OmniPass

If you experience difficulties adding a Windows user to OmniPass, you may need to adjust your local security settings. You can do this by going to Start, Control Panel, Administrative Tools, and Local Security Settings. Expand Local Policies, expand Security Options, and double-click Network Access: Sharing and Security Model for Local Accounts. The correct setting should be Classic – Local Users Authenticate as Themselves (see Figure 50).

Figure 50: Sharing and security model for local accounts Cannot add a User with a Blank Password to OmniPass


51

If you experience difficulties adding a user with a blank password to OmniPass, you may need to adjust your local security settings. First attempt the procedure explained in the Cannot add Windows user to OmniPass section. If the difficulties persist, then try the following procedure.

mailto:[email protected]


Click Start, Control Panel, Administrative Tools, and Local Security Settings. Expand Local Policies, expand Security Options, and double-click Accounts: Limit account use of blank passwords to console login only. This setting should be set to Disabled (see Figure 51).

Figure 51: Limit local account use of blank passwords ... Dialog appears after OmniPass authentication during Windows Logon

After installing OmniPass on your system, you can choose to logon to Windows using OmniPass. You authenticate with OmniPass (via master password, or an enrolled security device) and OmniPass logs you into Windows. You may, during this OmniPass authentication, see a Login Error dialog box (see Figure 52).

Figure 52: OmniPass/Windows Login Error

This dialog box occurs when OmniPass was unable to log you into Windows with the credentials supplied (username and password). This could happen for any of the following reasons:


52


• Your Windows password has changed • The network connection is unavailable and the cached credentials

could not be used

• You Windows account has been disabled

If you are having difficulties due to the first reason, you will need to update OmniPass with your changed Windows account password. Click Update Password and you will be prompted with a dialog to reconfirm your password (see Figure 53).

Figure 53: OmniPass Reconfirm Password

Enter the new password to your Windows user account and click OK. If the error persists, then it is unlikely the problem is due to your Windows user account password changing. You should contact your network administrator for assistance.


53


Index Master Password v, 6, 8, 14, 18, 20-28, 31, 45-47, 50,

52 A Multi-Factor Authentication ..........................36, 47, 50

authentication device ........6, 10, 13, 18, 20-25, 45, 50 N Automatically log on ...........................................48, 50

New Identity .............................................................28 B NOTE.......................................................3, 26, 34, 38

biometric device .................................................26, 28 O

C OmniPass Authentication Toolbar......................20, 21 OmniPass Control Center ........ vi, 4, 14, 30, 36-38, 41 OmniPass Enrollment Wizard ...............2, 6-14, 18, 50 capture window ......................................16, 17, 21, 26 OmniPass Logon..............................20, 45, 46, 48, 50

D P decrypt ...................................5, 13, 32, 37, 42, 47, 50 password management..............................................v default identity ..........................................................28 password protected...................v, 6, 23-26, 28, 30, 38 Digital Certificate ................................................45, 50 password replacement ................................... vi, 20-22

Password Replacement ..................... vi, 19-21, 46, 50

E R

Encrypt/Decrypt window.....................................42, 50 encrypted database file ............................................37 Reconfirm.................................................................53 Encrypted File Sharing.......................................33, 34 Remember Password.....................................6, 22, 23 export ...................................v, vi, 5, 13, 35, 37, 38, 40 remembered site ....................................20, 23, 25, 27

F S File and Folder Locking....................................... vi, 31 secure database.................................................23, 24 file encryption .........................................................v, 3 security device ................... See Authentication device fingerprint ............................v, 6, 14-17, 26, 46, 47, 50 Set as Default...........................................................28 friendly name............................................................23 share ..............................................................v, 33, 34

SmartCard................ v, 6, 9, 19, 21, 26, 39, 46, 47, 50 Switch User Identity .................................................29 I

T Identities.......................................................27, 28, 30 import .................................................. v, vi, 37, 38, 40 Import/Export User .......................................37, 38, 50 Taskbar Tips ................................................11, 26, 50 install ............................................................. vi, 2, 3, 5 Troubleshooting .................................................. vi, 51

L U Local Security Settings.......................................51, 52 uninstall ................................................................. vi, 5

unlock workstation..............................................45, 50 Unmask Values ........................................................27 M Update Password.................................See Reconfirm upgrade................................................................. vi, 5

Manage Identities................... See Vault Management user enrollment .......................... vi, 2-6, 10, 13, 14, 19 Manually log on..................................................48, 50 User Management.......................13, 19, 35-40, 42, 50


54


V

Vault Management ..................................24-28, 30, 41 version ............................................................... 2-5, 9

W

WARNING..........................3, 5, 13, 18, 19, 24, 46, 50 Windows login credentials............................39, 48, 50 Windows Logon............................ v, 20, 45, 48, 50, 52


55

WETIF Industrie EDV Telefon DE +49 8142 448976-0 Mobil AT +43 664 2868223 Paul - Keller - Weg 6 Telefax DE +49 8142 448976-4 eMail: [email protected] D - 82140 Olching Mobil DE +49 172 8174411 Internet: www.wetif.com

Softex OmniPass Version 4 - WETIF...Softex OmniPass provides password management capabilities to...

Documents

Transcript of Softex OmniPass Version 4 - WETIF...Softex OmniPass provides password management capabilities to...