RSA Adaptive Authentication (Hosted) Programmer's Guide Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com Trademarks RSA, the RSA Logo and EMC are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. For a list of RSA trademarks, go to www.rsa.com/legal/trademarks_list.pdf. License agreement This software and the associated documentation are proprietary and confidential to EMC, are furnished under license, and may be used and copied only in accordance with the terms of such license and with the inclusion of the copyright notice below. This software and the documentation, and any copies thereof, may not be provided or otherwise made available to any other person. No title to or ownership of the software or documentation or any intellectual property rights thereto is hereby transferred. Any unauthorized use or reproduction of this software and the documentation may be subject to civil and/or criminal liability. This software is subject to change without notice and should not be construed as a commitment by EMC. Note on encryption technologies This product may contain encryption technology. Many countries prohibit or restrict the use, import, or export of encryption technologies, and current use, import, and export regulations should be followed when using, importing or exporting this product. Distribution Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright © 2012-2014 EMC Corporation. All Rights Reserved. October 2012 Revised: July 2014 RSA Adaptive Authentication (Hosted) Programmer’s Guide Contents Preface................................................................................................................................... 7 About This Guide................................................................................................................ 7 RSA Adaptive Authentication (Hosted) Documentation.................................................... 7 Support and Service ............................................................................................................ 8 Before You Call Customer Support............................................................................. 9 Chapter 1: Overview of RSA Adaptive Authentication...........................11 Risk Models ...................................................................................................................... 12 Anti-Fraud Model ...................................................................................................... 12 Anti-Intrusion Model ................................................................................................. 13 General Workflow............................................................................................................. 13 RSA Adaptive Authentication Decision Flow and Module Relationship ................. 14 SOAP Messages......................................................................................................... 15 Integration Points .............................................................................................................. 16 Protocols and Message Formats........................................................................................ 17 SOAP API.................................................................................................................. 17 Message Structure and Format .................................................................................. 17 Transport Protocols.................................................................................................... 19 Web Services URLs and Multiple Version Support ......................................................... 20 Security ............................................................................................................................. 21 Transport Security...................................................................................................... 21 Application Security .................................................................................................. 21 Data Integrity ............................................................................................................. 22 Integration Options ........................................................................................................... 22 SOAP API.................................................................................................................. 22 SOAP API with Authentication Data Stored at Organization’s Site ......................... 22 SOAP API and HTML Redirection........................................................................... 23 FI-Defined Authentication Method ........................................................................... 23 Chapter 2: Initial Data Collection........................................................................ 25 Collection for Challenge Questions Authentication ......................................................... 25 Stage I - Analyze Message......................................................................................... 27 Stage II - Query.......................................................................................................... 27 Stage III - Authentication Data Collection ................................................................ 28 Collection for Out-of-band Phone and Out-of-band SMS Authentication ....................... 30 Stage I - Analyze Message......................................................................................... 31 Stage II - Collection................................................................................................... 31 Stage III - Authentication Data Collection ................................................................ 32 Chapter 3: SOAP API Use Cases ........................................................................ 33 RSA Adaptive Authentication API Message Flow........................................................... 33 Contents 3 RSA Adaptive Authentication (Hosted) Programmer’s Guide Challenge Questions Authentication Use Case................................................................. 36 Stage I - Logon Process ............................................................................................. 37 Stage II - Analyze Message ....................................................................................... 37 Stage III - Challenge .................................................................................................. 38 Stage IV - Authenticate.............................................................................................. 38 Out-of-Band Phone Authentication Use Case .................................................................. 39 Stage I - Logon Process ............................................................................................. 40 Stage II - Analyze Message ....................................................................................... 40 Stage III - Query ........................................................................................................ 41 Stage IV - Challenge.................................................................................................. 41 Stage V - QueryAuthStatus........................................................................................ 42 Out-of-Band SMS Authentication Use Case .................................................................... 43 Stage I - Logon Process ............................................................................................. 44 Stage II - Analyze Message ....................................................................................... 44 Stage III - Query ........................................................................................................ 45 Stage IV - Challenge.................................................................................................. 45 Stage V - Authenticate............................................................................................... 46 Knowledge-Based Authentication Use Case .................................................................... 47 Stage I - Logon Process ............................................................................................. 49 Stage II - Analyze Message ....................................................................................... 49 Stage III - Challenge .................................................................................................. 49 Stage IV - Authenticate.............................................................................................. 50 One-Time Password Authentication Use Case ................................................................. 51 Stage I - Logon Process ............................................................................................