Nokia adds smart cards to security portfolio
Nokia's virtual private network offerings will support smart card-based public key infrastructures
Nokia Internet Communications yesterday announced it is adding a range of features to its line of virtual private network software, designed to make integration with public key infrastructure systems easier. The VPN offerings will also support smart card-based public key infrastructure for the first time.
The client portion of the VPN system has been given more features, making centralised administration tasks easier. The Nokia VPN Client now ties in more tightly with certificate authorities, giving administrators time-saving features such as online certificate enrolment.
This enhancement means remote VPN clients can create their own PKI key pairs and collect certificates directly from the certificate authority (CA). The administrator need only create a generic remote user policy and deploy it to users, rather than creating the whole key pair and cert package for each user.
In addition, Nokia VPN Gateway now has the ability to automatically retrieve "certificate revocation lists" from CAs, a process previously initiated manually. CRLs are lists of certificates that, for one reason or another, have been declared invalid by the CA before their due expiry date.
Together, client and gateway now allow users to access the VPN from behind network address translation (NAT) devices, which are often used on LANs in hotels or airports. NATs alter IP addresses of traffic passing through them, which can lead the gateway to believe the user is unauthorised. The new version avoids that problem by adding the ability to detect and notify the gateway of any NAT between the two devices.
Nokia has also added the option of smart card authentication to the client. Using cards from fellow Finnish company Setec Oy and readers from all the major vendors, VPN customers will be able to have the certs and key pairs of remote users stored on PIN-protected smart cards, rather than policy files on the remote devices, for increased security.
The enhancements apply to versions 3.1 of its CC series of VPN gateway appliances, client software, and policy manager. Initially, CAs from VeriSign and Microsoft are supported. The products will be available next month. Pricing has yet to be set.
