Saflink's EntryPoint platform is targeted to SMBs and allows them to replace the standard password based Windows logon process with two- or three-factor authentication based on USB tokens. End users must possess the USB token in order to access the network; with functionality facilitating PIN-based (the user must insert the USB token into their PC/laptop and then additionally enter a known PIN) and biometric (the user must insert the USB token into their PC/laptop and then swipe their fingerprint on the USB token's sensor to unlock and access the USB's information) authentication (or both). EntryPoint logs the user into Windows and communicates with Active Directory (through a network connection to the EntryPoint appliance) to authenticate them to the network domain. However, registration data is cached on the local machine, so the user can still login to the local workstation when disconnected from the network (they may not, however, perform administrative functions, such as registration, deregistration, PIN changes, changing the removal policy, etc. while they are disconnected from the network).

The EntryPoint platform consists of three primary components.

The Security Appliance is a 1U unit that is installed on the LAN and provides administrative tools--as well as the Active Directory communications--for the EntryPoint authentication. It is powered by Windows 2003 Server and exposes a Web-based administration/management interface.

The Client software component provides Windows Logon capabilities at the end user machine and is available for Windows XP Pro. It communicates with the Security Appliance, which in turn communicates with Active Directory (via a single EntryPoint account) to access user account and Group Policy object information.

Finally, the USB tokens themselves are actually repurposed USB 1.1 or 2.0 flash drives and support either PIN or Biometric authentication (or both) based authentication as described above. End users can initialize and manage their own USB tokens via wizard-based tools as required by the administrator; including PIN selection and device de-registration if the token should be lost. (Administrators can additional de-register a token without requiring that they physically possess it.)

Another of the product's key features is support for the setting of removal policies; which govern what happens on the workstation when the USB key is removed. Choices include automatic logoff, complete locking of the computer, or no action.

New to the EntryPoint platform are the EP-Connect and EP-Biometric authentication modules. EP-Connect extends the platform to enforce multi-factor authentication for remote access to the network VPN and/or Outlook Web Access (the initial EP-Connect release supports Cisco's ASA 5500 Series SMB VPN appliances); while EP-Biometric enables biometric authentication (via fingerprints) to the network.

EntryPoint is available now; the EP-Connect and EP-Biometric modules are expected to be available in late July. Contact Saflink Corp. for further information.