Java token unlocks security

TriNet Services and Vasco Data Security are shipping Internet AccessKey, a Java-based user identification technology that uses a hardware token to verify user identities before handing over sensitive information on secure Web sites.

The combination of Vasco's token and TriNet's Java applet to verify the identities of people seeking confidential information on the Internet provides stronger security than just encryption and a password. Vasco is a leading manufacturer of hardware security tokens that has shipped 1.5 million units, many of them in Europe for secure banking applications.

The two companies are working with

Netscape Communications to enhance AccessKey using Netscape's new Common Data Security Architecture (CDSA). AccessKey works with Netscape's FastTrack and Enterprise Web servers without changing server code.

"This is the first real solution to a critical remaining problem with the Web: identifying users to know who's at the other end," Frank Taylor, TriNet president, told CNET. "Other products are coming, but now we're the only one out there with a strong hardware-based authentication system fully integrated with Netscape's product line."

Potential applications include Internet commerce, online banking, access to medical records, online technical support for expensive software products, and opening up corporate intranets to outside partners. First Union National Bank, an Internet bank, is pilot testing the device.

AccessKey, jointly developed by TriNet Services and VDSI, combines a Web-based Java application with a patented hardware device. When a user tries to access a protected Web page, he or she holds a personal hardware device to a flashing bar code generated by the Java applet that appears on the user's computer screen. The applet then flashes a one-time only authorization code. The user enters this unique code on the token's keypad to gain access.

"This product is exciting because of its unique application of Java, secure token, and integration with Netscape security mechanisms," Eric Greenberg, Netscape's manager of security products, said in a statement.

Vasco Data Security is a wholly-owned subsidiary of Vasco Corporation (VASC).

Pricing for the AccessKey system is $500 per server, plus $100 for each token in quantities under 100. For 501 to 1,000 units, the tokens are $88 each plus a software maintenance contract. The system is available for Sun Solaris, Microsoft Windows NT 3.51, and IBM AIX 4.2.