Posts Tagged ‘authentication’

Memory Tokens That Can Stand The Heat

Monday, July 12th, 2010

To combat the rising incidence of counterfeit medical products, medical device manufacturers can implement removable memory tokens that contain product authentication keys and other security features. However, the continued reuse of these small, detachable tokens in demanding hospital and healthcare settings can be problematic.

With this in mind, Datakey Electronics produces an anti-counterfeit memory token system that is not only rugged, but can survive repeated sessions of high temperature sterilization without failure, while retaining data. And according to Datakey,

[Using] removable memory for product authentication/anti-counterfeit…opens up a host of other capabilities, including: tracking (and limiting) the number of times an attachment has been used, automatically identifying the model of the attachment and uploading any model-specific parameters, uploading any calibration information that is unique/specific to that particular attachment, and recording settings and other usage data to ensure the device was used properly according to the manufacturer’s instructions.

In addition, the Receptacle on the base controller can be used for secondary uses, including: in-field firmware updates, medical personnel access control, rights management, and more!

Bugs Leave Buildings’ Critical Systems Vulnerable

Wednesday, May 26th, 2010

Cisco Systems is warning of flaws in one of their devices that could leave a building’s critical systems vulnerable to attacks that might ultimately result in unauthorized takeover of the building. The device links together a building’s critical systems–including security, lighting and HVAC–allowing IT personnel to automate and control these functions remotely.

As reported on The Register,

The networking giant on Wednesday urged users of the Cisco Network Building Mediator products to patch the vulnerabilities, which among other things allow adversaries to obtain administrative passwords. No authentication is required to read the system configuration files, making it possible for outsiders to take control of a building’s most critical control systems.

“Successful exploitation of any of these vulnerabilities could result in a malicious user taking complete control over an affected device,” a Cisco advisory stated.

TI Calculators: Master Keys Cracked

Tuesday, October 6th, 2009

pic3-19The master operating system keys to a large number of Texas Instruments’ calculators, which use RSA digital signatures to authenticate system updates, were recently cracked and published online.

According to a recent post on the Schneier on Security blog; at only 512-bits long, the Texas Instruments signing keys were simply too short, making them easy targets for being cracked.

Hints from Mocana Engineering

Monday, February 23rd, 2009

pic4-10-700292What is the difference between an EAP pass-thru authenticator and an EAP standalone authenticator?

A pass-thru authenticator requires a AAA server to do user credential verification, whereas a standalone authenticator has a local username/password or certificate store to verify identity. NanoEAP can act as a standalone as well as pass-thru authenticator. e.g. Critical users may use EAP-TLS certificate authentication, while others might pass-thru to a AAA for simple username / password authentication.

Hints from Mocana Engineering

Friday, December 5th, 2008

Does NanoSSH support certificates for host authentication?

Yes. NanoSSH supports certificates for host authentication, including host certificate chains. Even more interesting, NanoSSH supports certificates for client authentication. This decreases enterprises TCO by allowing their NanoSSH-enabled network equipment to hook into their enterprise’s authentication infrastructure for unified security for identity.

How Much Do You Really Know About (SSH) Security?

Monday, October 6th, 2008

pic3-2-723759This informative article explains how to approach an actual integration of SSH into embedded and mobile devices, while answering some key SSH configuration questions. Regardless of whether you’re a “Newbie, Intermediate or Expert” security type, learn how to make informed technical decisions about communications modes, encryption ciphers, and authentication methods.

Buy the O’Reilly book at amazon.com