I want to know using RSA SecureID, (soft tokens) what is the mechanism that ensure that user is logged in to the system from the authorized station only. How is the passcode bind to the user and the user to machine. I'm thinking there is use of symmetric key that has a device ID or profile that is used as form of authentication.

This is part of use-case for a data entry offices where the user wants to ensure those remote data entry officers users can login from authorized terminals only. For example user given the soft token and the credentials he/she can login from another remote office. How can this prevented. I'm thinking that is the symmetric key placed on mobile device itself to secure the transfer of the passcode to the token-server.

How can it prevented that passcode is only accepted when used from certain GEO-location or machine. I think the GSM data can be used for decision making or for ACL? please assist

  • I don't think Soft Tokens can solve this problem, you probably need to look into firewall / VPN solutions... Dec 19, 2016 at 19:02
  • You mention both "terminals" and "mobile devices". What are the users actually logging into the app from? Accessing the app from a terminal but authenticating using the soft token on their mobile device?
    – PwdRsch
    Dec 19, 2016 at 19:18
  • Mobile device is sms for 2FA, and terminals would be when logged in would be accessing enterprise Portal.
    – Saladin
    Dec 19, 2016 at 19:25


You must log in to answer this question.

Browse other questions tagged .