2Element - Multi-factor Authentication (MFA)

2Element - Multi-factor authentication (MFA)

General solution for organizations and companies
It complements problematic passwords with other factors
MFA is mainly used for:
- Privileged accounts (various administrator rights) – for all access types
  - VPN, server login, password administrator, …
- User accounts – especially for Internet access to the organization (or to the cloud)
  - VPN, remote desktops (RDP), …
Czech and English language support (other languages can be added)
Flexible solution for authentication – of employees, partners, customers
On-premise installation option (entirely at the customer's site only, no cloud)

Authentication factors are categorized into three groups:
- Something you know (such as a password or PIN).
- Something you have (such as a phone or a HW token).
- Something you are (such as a fingerprint, facial scan or other biometric data).
MFA requires the user to authenticate using two or more authentication factors from different categories (e.g. "something you know" in combination with "something you have").
The modern method of Push notifications for smartphones with biometric authentication combines all three of these categories. Logging in with your name and password (something you know) is complemented by Push notifications on your mobile phone (something you have), which must be confirmed after biometric verification (something you are).

PUSH authentication
- from mobile application (2Element Mobile for iOS or Android)
TOTP authentication
- from mobile application (2Element Mobile for iOS or Android)
- from SMS message
Hardware tokens
- YubiKey pro OS Windows, MacOS a Linux

2Element includes security technologies and processes, that help fulfill the recommendations of authorities NÚKIB, CISA.

Detailed logging (audit log) of all processes in the whole solution.

Registration and authorization of mobile applications is ensured by asymmetric cryptography.

Private key in modern mobile phones is stored in a dedicated security storage site and is protected biometrically.

The administrator defines the required security policies for the user.

Data transmissions are encrypted by default using SSL / TLS.

Export of logs using Syslog for external processing (SIEM support).

The application is tested by penetration tests according to the OWASP methodology.

Possibility to provide source code for audit.

Link to Active Directory, including setting which trees or user groups to synchronize and how.
Concurrent support for both local groups and users, as well as those transferred from AD.
Possible operation even without link to AD. Local users can be created directly in the MFA server. Suitable for installations without AD or users who are not in AD.
Support of other LDAP compatible directories is also possible.
Integration into ADFS logins – this makes it easy to extend the entire ecosystem with MFA, supporting ADFS logins and also SAML as a chain-type response.

VPN accesses (Fortinet, Cisco, CheckPoint, …)

Administrator RDP accesses to MS servers

Remote desktops (RDP) for users, incl. Terminal Server access

Local user logins for the computer

ADFS (Active Directory Federation Services) integration

Cloud services (O365, …)

Customer's own application (Helpdesk, Intranet,…) using API, SAML

Gateways and solutions for partners and customers

Other integration protocols with Radius or LDAP

Installation on dedicated servers (Linux CentOS)
- Installation into virtualisation is recommended - VMware, Hyper-V, KVM
Web interface for administrators available
Optimally divided into two sections:
- In DMZ – MFA WEB server - it communicates to the Internet (Push notifications, etc.), provides API
- In VLAN - MFA Authentication PROXY server - Auth proxy, it mediates communication with AD and RADIUS
A scalable solution for large installations that meets the required SLAs.
MFA servers can be installed in a cloud environment

For larger implementations, we offer a solution that is popular today, for example, in banks under the names such as – KB key, RB key, …
This means delivering a customized mobile application to the customer that can be used for all MFA accesses.
Appropriate consolidation of all applications that should use MFA authentication.
“White label” customization
- for server (own name and design)
- for mobile applications (own name, design and fixed connection with the customer's server)