ViPNet Administrator

In this section

About This Document

About ViPNet Administrator

System Requirements

Distribution Kit

Feedback

Contents

Overview

Installing ViPNet Administrator

Getting Started

Updating ViPNet Administrator

Uninstalling ViPNet Administrator

Troubleshooting

External Storage Devices


About This Document

In this document, the installation and configuration setup procedures are described in details for the ViPNet Administrator software. You will have a chance to explore the deployment schemes and recommendations on the location of the components. Information about updating the ViPNet Administrator software and troubleshooting is also provided.

In this section:

Audience

Document Conventions


Audience

This document is designed for the administrators who deploy, configure, and manage the ViPNet Administrator software suite.


?????????? ?????????

Document Conventions

This document concerns the following conventions:

Conventions for notes

Icon | Description
 | Warning: Indicates an obligatory action or information which may be critical for continuing user operations.
 | Note: Indicates a non-obligatory, but desirable action or information, which may be helpful for users.
 | Tip: Contains additional information.

Conventions for highlighted information

Icon | Description
Name | The name of an interface element. For instance, the name of a window, a box, a button or a key.
Key+Key | Shortcut keys. To use the shortcut keys, press and hold the first key and press other keys.
Menu > Submenu > Command | A hierarchical sequence of elements. For instance, menu items or sections in the navigation pane.
Code | A file name, path, text file (code) fragment or a command executed from the command line.


About ViPNet Administrator

ViPNet Administrator® is intended for managing ViPNet networks and contains two components:

  • ViPNet Network Control Center (NCC).
  • ViPNet Key and Certification Authority (KCA).

ViPNet Network Control Center is intended for creating a ViPNet network topology, configuring ViPNet hosts' parameters, registering users and managing the hosts.

ViPNet Key and Certification Authority (KCA) is designed for issuing and managing public key certificates. It functions as a certification authority and provides users with keys necessary for working on the ViPNet network.


System Requirements

The computers running ViPNet Administrator software must meet certain requirements.

When you install several programs from the ViPNet Administrator software suite on a single computer, this computer must satisfy the maximum of the specified requirements.

In this section:

ViPNet Network Control Center

ViPNet Key and Certification Authority


ViPNet Network Control Center

In this section:

Server Application

Client Application


Server Application

Hardware requirements for installing the NCC server application are as follows:

  • Processor: Intel Core 2 Quad or any other x86-compatible processor‑of similar characteristics with 4 or more cores.
  • RAM: at least 4 GB.

    Note: If there are a lot of hosts and links in your ViPNet network, we recommend using a more powerful computer with the following characteristics:

    • Processor: Intel Core i7 or any other x86-compatible processor of similar characteristics with 8 or more cores.
    • RAM: at least 16 GB.
    • Microsoft SQL Server version other than Express Edition.

  • Free disk space: 20 GB.
  • Operating system: Windows 7 SP1 (32/64-bit), Server 2008 R2 (64-bit), Windows 8 (32/64-bit), Server 2012 (64-bit), Windows 8.1 (32/64-bit), Server 2012 R2 SP1 (64-bit).

    You must install the latest service pack for your version of Windows.

  • Internet Explorer 8.0 or later.

Note: Before you start the installation of the server application on a computer running Windows 8, Windows Server 2012, Windows 8.1 or Windows Server 2012 R2 SP1, make sure the .NET Framework 3.5 Features Windows component is enabled.

To install and use the ViPNet NCC server application, you should observe the following prerequisites:

  • The following software should be installed on the computer:
    • Microsoft .NET Framework 4.5 (programming framework).
    • Microsoft Visual C++ 2010 Redistributable Package (installs runtime components of Visual C++ Libraries required to run applications developed with Visual C++ on a computer that does not have Visual C++ 2010 installed).

    The listed software is part of the ViPNet Network Control Center distribution kit.

  • A database management system must be installed on the computer with the server application or another computer accessible on the network. The following DBMS versions are supported:
    • Microsoft SQL Server 2008 SP3 or later.
    • Microsoft SQL Server 2008 R2 SP1 or later.
    • Microsoft SQL Server 2012.
    • Microsoft SQL Server 2014.

    You may use any edition of the database management system, including Express Edition. Microsoft SQL Server 2014 Express is included in the ViPNet Network Control Center distribution kit. If you need, you can choose to install it automatically together with the server application.

Warning: You should track and regularly install security updates released for the specified third-party software.


Client Application

Hardware requirements for installing an NCC client application are as follows:

  • Processor: Intel Core 2 Duo or any other x86-compatible processor of similar characteristics with two or more cores.
  • RAM: at least 1 GB (2 GB for 64-bit Microsoft Windows operating systems).
  • Free disk space: 1 GB.
  • Operating system: Windows 7 (32/64-bit), Server 2008 R2 (64-bit), Windows 8 (32/64-bit), Server 2012 (64-bit), Windows 8.1 (32/64-bit), Server 2012 R2 SP1 (64-bit).

    You must install the latest service pack for your version of Windows.

  • Internet Explorer 11.0 or later.

Note: Before you start the installation of the server application on a computer running Windows 8, Windows Server 2012, Windows 8.1 or Windows Server 2012 R2 SP1, make sure the .NET Framework 3.5 Features Windows component is enabled.

To install and use ViPNet NCC client application, make sure that the following third-party software is installed on the computer:

  • Microsoft .NET Framework 4.5 (programming framework).
  • Microsoft Visual C++ 2010 Redistributable Package (installs runtime components of Visual C++ Libraries required to run applications developed with Visual C++ on a computer that does not have Visual C++ 2010 installed).

The listed software is part of the ViPNet Network Control Center distribution kit.

Warning: You should track and regularly install security updates released for the specified third-party software.


ViPNet Key and Certification Authority

The system requirements for your computer to run ViPNet Key and Certification Authority are as follows:

  • Processor: Intel Core 2 Duo or any other x86-compatible processor of similar characteristics with two or more cores.
  • RAM: at least 1 GB (2 GB for 64-bit Microsoft Windows operating systems).
  • Free disk space: 1 GB.
  • Operating system: Windows 7 (32/64 bit), Windows Server 2008 R2 (64 bit), Windows 8 (32/64 bit), Windows Server 2012 (64 bit), Windows 8.1 (32/64 bit), Windows Server 2012 R2 SP1 (64 bit).

    You must install the latest service pack for your version of Windows.

  • Internet Explorer 8.0 or later.

Additional requirements:

  • To enable the feature allowing you to save user passwords to files, a Microsoft XPS Document Writer virtual printer must be installed on the computer. This printer may be installed by default in Windows 7 (32/64 bit), Windows 8 (32/64 bit), and Windows 8.1 (32/64 bit). If you use Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2 SP1, you need to install the virtual printer manually.
  • To print user passwords as PIN envelopes, we recommend that you use:
    • Special-purpose printers for printing PIN envelopes or OKI ML5100FB dot matrix printers
    • Standard four-ply PIN mailer paper with an extended area for secret information


Distribution Kit

The ViPNet Administrator distribution kit includes:

  • The setup file for the ViPNet Network Control Center server application.
  • The setup file for the ViPNet Network Control Center client application.
  • Third-party software required for the correct operation of ViPNet Network Control Center.
  • ViPNet Key and Certification Authority setup file.
  • Documentation the in PDF format:
    • “ViPNet Administrator. Installation Guide.”
    • “ViPNet Administrator. Quick Start.”
    • “ViPNet Administrator. Information about Third-Party Software Components.”
    • “ViPNet Network Control Center. Administrator’s Guide.”
    • “ViPNet Key and Certification Authority. Administrator’s Guide.”
    • “ViPNet CSP. User’s Guide.”
    • “ViPNet Network Deployment. Administrator’s Guide.”
    • “Glossary. Supplement to ViPNet Documentation.”
    • “ViPNet Permissions Classification. Supplement to ViPNet Documentation.”
    • “Printing Certificates. Supplement to ViPNet Documentation.”
    • “ViPNet Administrator. Migration Guide: Moving Software to Another Computer.”

Note: You can view the list of third-party software required for the NCC operation in the section System Requirements.


Feedback

Finding Additional Information

For more information about Infotecs products and technologies, see the following resources:

  • ViPNet documentation web portal
  • Information about current Infotecs products
  • Information about Infotecs solutions

Contacting Infotecs

We value any feedback from you. If you have any questions concerning Infotecs products and solutions, any suggestions, complaints or other feedback, feel free to contact us:

  • Global contacts page
  • Telephone (Germany): +49 (0) 30 206 43 66 0
  • Telephone (USA): +1 (646) 274-1494

Errata

Infotecs makes every effort to ensure that there are no errors or misprints in the text of all documents supplied with ViPNet software. However, no one is perfect, and mistakes do occur. If you find an error in one of our documents, like a spelling mistake or some inaccuracy in describing user scenarios or system features, we would be very grateful for your feedback. By sending in errata you may save other reader hours of frustration, and at the same time you will be helping us provide documentation of even higher quality.


Overview

In this section:

ViPNet Administrator Software Architecture

Deployment Schemes for ViPNet Administrator Components

Using ViPNet Client to Send Data to ViPNet Hosts

ViPNet Network License


ViPNet Administrator Software Architecture

The ViPNet Administrator software comprises two programs:

  • ViPNet Network Control Center (hereinafter referred to as NCC).
  • ViPNet Key and Certification Authority (hereinafter referred to as KCA).

ViPNet Network Control Center is intended for creating a ViPNet network topology, configuring ViPNet hosts and users, and sending key, host links, and software updates centrally.

The ViPNet Network Control Center software consists of two components:

  • A server application, which is used for working with a database containing all information about the ViPNet network structure and objects.
  • A client application, which is a user-friendly graphical interface for managing the ViPNet network structure and configuring its objects.

    You can connect to the server application via a client application remotely, or even via several client applications at a time.

KCA provides you with the tools for maintaining the key infrastructure of your ViPNet network, for public key certificate issuing and managing (PKI). Due to its features, KCA can be logically divided into two components: a key management center and a certification authority.

NCC and KCA communicate with each other through the SQL database. The programs connect to the SQL database independently from each other to get or store the required data. Changes applied in one program are displayed in the other program at once.

Interaction of ViPNet Administrator software components


Deployment Schemes for ViPNet Administrator Components

Prior to installing the ViPNet Administrator software, decide on which computers the following components will be located:

  • The ViPNet Administrator database.
  • ViPNet Network Control Center server application.
  • The ViPNet Key and Certification Authority program.
  • One or several client applications for ViPNet Network Control Center.

These components can be installed on one or several computers of the network in any preferred combination. The only vital difference lies in the locations where you install the ViPNet Administrator components and database. There are two typical deployment schemes for the ViPNet Administrator components:

  1. Installing all the components of ViPNet Administrator on one computer.
  2. Installing the components of ViPNet Administrator on different computers.

Both schemes allow you to use one or several NCC client applications on your network computers. You can install the server and client applications on one or different computers. If you install them on different computers, the client application will connect to the server application remotely. You also can connect to the server application from several client applications at once. For detailed information on the possible location of the NCC client and server applications, see Location of the ViPNet Network Control Center Client Application.

In this section:

Installing the Components of ViPNet Administrator on One Computer

Installing the Components of ViPNet Administrator on Different Computers

Location of the ViPNet Network Control Center Client Application


Installing the Components of ViPNet Administrator on One Computer

This deployment scheme is the easiest and most universal one. It is well-suited for rather small networks where one administrator works in NCC and KCA. In this scheme, the NCC, KCA and the SQL server with the ViPNet Administrator database are installed on one computer, which makes it easier to deploy the SQL server.

Installing the NCC server application and KCA on the same computer


Installing the Components of ViPNet Administrator on Different Computers

This deployment scheme is useful if the SQL server is already installed in your network and you are planning to deploy the ViPNet Administrator database on that server. In this case, all other ViPNet Administrator components are installed on separate computers as well (which is useful if your network is managed by several administrators).

Installing the NCC server application and KCA on two different computers


Location of the ViPNet Network Control Center Client Application

In the deployment schemes observed, you can install the NCC client application on any computer of your ViPNet network. Software can be installed in the following combinations:

  • The NCC server and client applications can be installed on one or different computers.
  • The NCC client application can be installed on one or several computers.

If you install the NCC client and server applications on different computers, you can dedicate a powerful computer to the server application. If you install client applications on several computers, you can manage the network in a multiuser mode. You can choose the location of the NCC client application depending on the company's preferences and the number of network administrators.

Variants of NCC applications setup


Using ViPNet Client to Send Data to ViPNet Hosts

For the ViPNet network to work properly you need to arrange the exchange of keys, host links, certificates, and software updates from the administrator's workstation to ViPNet hosts. All these data can be transmitted by the ViPNet MFTP transport module installed with the ViPNet Client software.

You need to install ViPNet Client on the computer running the NCC server application. To provide the efficacy of connection establishment, you need to install ViPNet Client on computers running KCA and the NCC client application. ViPNet Administrator 4.x is compatible with ViPNet Client 4.2 and later.

Note: You do not need to install ViPNet Client on the KCA computer that is isolated and disconnected from the network. Though, in this case, in the ViPNet Monitor program (part of ViPNet Client) on the computer with the NCC server application, you need to create a network filter to connect with the KCA host.

The use of ViPNet Client on the computer with the NCC server application allows for:

  • Protection (encryption) of the IP traffic between the administrator's workstation and other ViPNet network hosts (see the scheme below).
  • Protection of the administrator's workstation from unauthorized access in local and global networks by means of the integrated firewall.

Using ViPNet Client to send data to hosts


ViPNet Network License

To deploy a ViPNet network, you need a license, which allows you to create the customized network structure. To obtain the license, contact Infotecs.

The license is delivered in the *.itcslic or infotecs.reg file that is required for the work of the ViPNet Administrator software.

The license file contains the following information:

  • The number of your ViPNet network and the numbers of subordinate networks, in case the license allows you to establish partner network connection between ViPNet networks based on a hierarchical model.
  • Information about the network owner.
  • The certification authority features that can be used and the maximum number of public key certificates that can be issued in KCA for external and ViPNet users.
  • The roles you can use within your ViPNet network and the restrictions for the number of hosts with various roles added.
  • Restriction on the software version and expiration date for the roles.
  • The license expiration date.

Your license may have support for the hierarchical ViPNet network structure or not.

If your license supports ViPNet network hierarchy, you can create not only the root network, but also subordinate networks. For more information, see the document “ViPNet Network Control Center. Administrator’s Guide.”

If the number of clients on the network has increased, you may need to extend the license. To do it, contact the Infotecs representative and request a new license file. Be ready to provide your ViPNet network number and the desired parameters of your new license. To view your network number, in the NCC client application or KCA, on the Help menu, click About.

Upon the request for license extension is processed, you receive a new *.itcslic or infotecs.reg file. In the main window of the ViPNet Network Control Center client application, on the License menu, click Update License and specify the location for the new license file. Restart the program. Upon restart, the extended license is applied.


Installing ViPNet Administrator

In this section:

Checklist: Installing ViPNet Administrator

Information for a Microsoft SQL Server Administrator

Installing the ViPNet Network Control Center Server Application

Installing the ViPNet Network Control Center Client Application

Installing ViPNet Key and Certification Authority

Installing Updates for the Third-Party Software


Checklist: Installing ViPNet Administrator

To deploy ViPNet Administrator successfully, complete all the tasks from the list below.

Warning: ViPNet Network Control Center and ViPNet Key and Certification Authority of different versions may be incompatible with each other.

Checklist: Installing ViPNet Administrator

Task | Reference
Think over the ViPNet Administrator components deployment scheme. | Deployment Schemes for ViPNet Administrator Components
Decide on the number of computers running the NCC client applications. | Location of the ViPNet Network Control Center Client Application
Prepare the required number of computers and connect them to the physical network. |
Make sure that you have the license file *.itcslic or infotecs.reg. | ViPNet Network License
If you need to deploy the database separately from the ViPNet Administrator components, install the SQL server on a dedicated computer. | See the SQL server operational documentation.
Install the NCC server application taking into account the chosen NCC deployment scheme. If the ViPNet Administrator database is located on a separate computer, connect to the database during the server application installation. | Installing the ViPNet Network Control Center Server Application
Install the NCC client application taking into account the chosen NCC deployment scheme. | Installing the ViPNet Network Control Center Client Application
Install the security updates for the third-party software. | Installing Updates for the Third-Party Software
Install KCA taking into account the chosen ViPNet Administrator components deployment scheme. | Installing ViPNet Key and Certification Authority
Install ViPNet Client version 4.2 or later on computers running the NCC server and client applications and on the computer with KCA. | For more information, see the section “Installing ViPNet Client” in the document “ViPNet Client for Windows. User's Guide.”
Start the NCC client application for the first time and create your ViPNet network structure. | Getting Started with ViPNet Network Control Center
Start KCA for the first time and perform configuration setup. | Starting ViPNet Key and Certification Authority for the First Time Configuration Setup of ViPNet Key and Certification Authority

Tip: We recommend you to print this checklist and tick the boxes as you advance through the steps outlined in this checklist.


Information for a Microsoft SQL Server Administrator

In ViPNet Administrator, the Network Control Center server application and Key and Certification Authority connect to an SQL database, which contains information about the ViPNet network structure and parameters. ViPNet ViPNet Key and Certification Authority allows you to create backup copies of the database if you need to roll back to a particular network configuration later (for details, see the document “ViPNet Key and Certification Authority. Administrator's Guide,” the chapter “Advanced Features.”)

It is created automatically while you are installing the NCC server application. You can store the database on a named instance of an SQL server created earlier on a local or remote computer. Supported versions of an SQL server are listed in the section Server Application.

If you do not have a suitable SQL server, you can install it from the ViPNet Administrator distribution kit. In this case, Microsoft SQL Server 2014 R2 Express will be installed during the NCC server application installation. A named instance of the SQL server is created automatically with the default name WINNCCSQL. You can change the name while installing the NCC server application.

Note: Installation of a named instance on the computer will not affect the operation of another instance that is already installed on this computer. Both instances will work simultaneously.

During the installation of the NCC server application:

  • The ViPNetAdministrator database is created.
  • The ViPNetJournals database is created for storing event logs of ViPNet Network Control Center.
  • A user account that has administrator rights for the database is created for the user who ran the setup file of the NCC server application.
  • KcaUser and NccUser user accounts are created for connecting KCA and the NCC server application respectively to the database. The NCC server application connects to the database at the first startup. For details on connecting KCA to the database, see the section Configuration Setup of ViPNet Key and Certification Authority.

The created database's parameters are shown in the table below.

Database parameters

Parameter | Value
Collation parameters | Cyrillic_General_CI_AS
Recovery model | Full

Warning: We recommend that you should not change the database settings as well as the structure and data of the ViPNet Administrator database. This may lead to ViPNet Administrator malfunctioning. Infotecs is not responsible for any errors caused by such actions.

The named instance of the SQL server must have the parameter values as in the table below. When you install the SQL server from the ViPNet Administrator setup file, these values are set by default.

SQL server parameters

Parameter | Value
FILESTREAM | Enable FILESTREAM for Transact-SQL access
 | Enable FILESTREAM for file I/O streaming access
 | Allow remote clients to have streaming access to FILESTREAM data
The Shared Memory protocol | Enabled
The Named pipes protocol | Enabled
The TCP/IP protocol | Enabled
The state of the SQL Server Browser service | Running
The type of the SQL Server Browser service's startup | Automatic


Installing the ViPNet Network Control Center Server Application

After you have decided on the ViPNet Administrator deployment framework, you can install the NCC server application.

Before installing, make sure that you have the setup file for the ViPNet Network Control Center server application.

To install the application:

  1. Double-click the setup file [image] in the ViPNet Network Control Center folder of the distribution kit.
  2. In the Install ViPNet Administrator [Network Control Center] window, you will be prompted to install additional software, The list of the required additional software depends on the software you have previously installed on your computer. To start installing, click Continue.

    Installing third-party software

    Note: The installation of additional software may take a long time.

  3. After the installation, you may be prompted to restart the computer. Restart the computer. After the restart, the server application installation will continue automatically.
  4. In the displayed window, choose the language that you will use to work with ViPNet Network Control Center and click Continue.

    Note: In this window, you choose the language for the ViPNet Network Control Center setup program and for the interface of the server and client applications.

  5. Read the terms and conditions on the License agreement page. If you accept the terms and conditions, select the corresponding check box. Then click Continue.
  6. On the Install software page, set the parameters for connecting to the database. If you do not specify the name of an existing SQL server, the SQL server will be installed on your computer from the ViPNet Administrator distribution kit, and the name instance WINNCCSQL will be created. If required, you can set another instance name.

    Configuring connection to the database

    To use an existing named instance of the SQL server:

    • In the Server name box, replace WINNCCSQL with the name of an existing named instance of the SQL server. If the SQL server is on a remote computer, replace the dot with the IP address or DNS name of the remote computer.
    • In the Authentication box, choose the type of authentication that will be applied during connecting to the SQL server. If the SQL server is located on this computer, choose Windows authentication. In this case authentication will be performed by the operating system employing the Windows user account. If the SQL server is located remotely, the authentication type is determined by the security policy applied to this server. If authentication is based on the SQL server user credentials, choose SQL Server authentication and type the name and password for the SQL server's user account. Contact the administrator of the remote SQL server to find out its authentication mode and credentials.
    • To check connection to the SQL server, click Test connection. If the SQL server whose name you have specified is unavailable or is not installed in the specified location, you will be notified that connection to the database cannot be established with the current parameters. Click Close, check that the specified server name is correct and test connection once again.
  7. If you want to change the installation parameters, click Customize and specify:
    • The path to the program installation folder.

      The default path is:

      C:\Program Files\InfoTeCS\ViPNet Administrator for 32-bit OS.
      C:\Program Files (x86)\InfoTeCS\ViPNet Administrator for 64-bit OS.

    • The user name and organization.
    • The installation folder name and location on the Start menu.
  8. To start installing, click Continue.

    Customizing installation of the NCC server application

  9. In the displayed window, check the installation parameters. To start installing at once, click Install now.
  10. If the ViPNet Administrator database should be deployed on a dedicated SQL server, specify the name of this SQL server. If the name of the SQL server you have specified does not exist, you will be prompted to create the database server with this name. To create the server, click Yes in the message window.
  11. Upon creating a database server, you will be prompted to restart the computer. Restart the computer. After the restart, the server application installation will continue automatically.
  12. In the displayed window, choose the language that you will use to work with ViPNet Network Control Center and click Continue.
  13. On the Install software page, click Install.
  14. In the displayed window, check the installation parameters. To start installing at once, click Install now.
  15. Upon the installation is complete, click Close.

The NCC server application is installed on your computer. Continue installing one or several NCC client applications.


Installing the ViPNet Network Control Center Client Application

After you have installed the NCC server application, install one or several NCC client applications on the computers of the administrators of the ViPNet network you are creating.

Before installing, make sure that you have the setup file for the ViPNet Network Control Center client application.

To install the application:

  1. Double-click the setup file [image] in the ViPNet Network Control Center folder of the distribution kit.
  2. If you install the client and server applications on different computers, in the Install ViPNet Administrator [Network Control Center] window, you will be prompted to install additional software. Whether you should install it depends on the programs that are already installed on your computer.

    Note: Software components required for the operation of the server application include the components required for the client application. If you install the server and client applications on one computer, you do not need to install the same components twice.

  3. To start installing, click Continue.

    Note: The installation of additional software may take a long time.

  4. After the installation, you may be prompted to restart the computer. Restart the computer. After the restart, the client application installation will continue automatically.
  5. In the displayed window, choose the language of the ViPNet Network Control Center setup program and click Continue.

    Note: You can choose the language only for the ViPNet Network Control Center setup program here. The program interface language is the same language that you have chosen during the installation of the NCC server application.

  6. Read the terms and conditions on the License agreement page. If you accept the terms and conditions, select the corresponding check box. Then, click Continue.
  7. If you want to change the installation parameters, click Customize and, on the Choose the installation you want page, specify:
    • The path to the program installation folder.

      The default path is:

      C:\Program Files\InfoTeCS\ViPNet Administrator for 32-bit OS.
      C:\Program Files (x86)\InfoTeCS\ViPNet Administrator for 64-bit OS.

    • The user name and organization.
    • The installation folder name and location on the Start menu.
  8. To start installing at once, click Install now.

    Advanced configuring of the ViPNet Network Control Center client application

  9. Upon the installation is complete, click Close.

The NCC client application is installed on your computer. Install the NCC client applications on the computers of all network administrators in compliance with the ViPNet Administrator deployment scheme you have chosen. Now you may install KCA.


Installing ViPNet Key and Certification Authority

After you have installed the NCC server and client applications, you may install KCA.

Before the installation make sure that:

  • You have standard regional settings on your computer; and that the time zone, date, and time are specified correctly. Otherwise, you may experience problems with symbols displaying.
  • You have the setup file for ViPNet Key and Certification Authority.

Note: All information about the license restrictions will be obtained when you connect to the SQL database that was created during the installation of the NCC server application.

To install the program:

  1. Double-click the setup file [image] in the ViPNet Key and Certification Authority folder of the distribution kit.
  2. Wait until the required software including the ViPNet CSP program is automatically installed on the computer.
  3. In the Install ViPNet Administrator [Key and Certification Authority] window, on the License agreement page, read terms and conditions of the agreement. If you accept the terms and conditions, select the corresponding check box. Then, click Continue.
  4. If you want to change the installation parameters, on the Choose the installation you want page, click Customize and specify:
    • The path to the program installation folder.
    • The user name and organization.
    • The installation folder name and location on the Start menu.
  5. To start installing at once, click Install now.
  6. Upon the installation is complete, click Close.
  7. After the installation, you may be prompted to restart the computer. Restart the computer.

    You can start working with ViPNet Administrator.


Installing Updates for the Third-Party Software

The third-party software required for ViPNet Network Control Center may contain vulnerabilities. To eliminate risks entailed by such vulnerabilities, you should regularly install security updates released by the software vendors.

After your install the ViPNet NCC server and client applications, do the following:

  1. Check for security updates or new versions of the following software:
    • Microsoft .NET Framework version 4.5
    • Visual C++ 2010 Redistributable Package
    • Your version of Microsoft SQL Server
  2. If any updates are available, install them.
  3. You should track and regularly install security updates released for the specified third-party software.


Getting Started

In this section:

Getting Started with ViPNet Network Control Center

Starting ViPNet Key and Certification Authority for the First Time


Getting Started with ViPNet Network Control Center

After you have installed the ViPNet Administrator software, make sure you have the *.itcslic or infotecs.reg license file for the ViPNet network and start the ViPNet Network Control Center program. The NCC server application consists of two services NccService and NccFilewatcherService that start automatically after the operating system start. To run the NCC client application:

  1. Do one of the following:
    • If you use Windows 7 or Windows Server 2008 R2, on the Start menu, click All programs > ViPNet > ViPNet Administrator > Network Control Center.
    • If you use Windows 8 or Windows Server 2012, on the Start screen, open the App list and select ViPNet > Network Control Center.

    Note: The program location on the Start menu or in the App list might have been changed at installation.

  2. When you start the client application, it connects to the server application automatically. By default, connection is established by the local computer address.

    If you installed the client and the server applications on the different computers, the message informing you, that the client application cannot connect to the server one, will be displayed. The same message will be displayed if the server application services are stopped.

    Notification that there is no connection to the SQL server

    In this case, in the message window, type the IP address or the DNS name of the computer with the ViPNet Network Control Center server application installed and click Continue.

  3. In the logon window, type the default administrator credentials:
    • User name: Administrator.
    • Password: Administrator.

    Typing the administrator's credentials to log on to ViPNet Network Control Center

    Click Continue.

  4. At the first logon to the ViPNet Network Control Center program, for security reasons, change the administrator password. In the Change Password window, type the current password, and then specify and confirm the new one.

    The password must contain at least 8 symbols.

    Tip: We recommend you to create complex passwords that contain no less than 8 symbols and include upper and low case letters, numbers, and special symbols.

    Changing the password of the ViPNet Network Control Center administrator

  5. In the Getting Started with ViPNet Network Control Center window, specify a path to the *.itcslic or infotecs.reg license file by clicking Browse and then click Continue.

    Specifying a path to the license file

  6. In the displayed window, choose how you want to get started with the program:
    • If you are creating a ViPNet network from scratch, choose Create protected network structure automatically to create the structure and configure the main parameters of coordinators and clients using the wizard.
    • If you want to import an already existing ViPNet network structure, choose Load the structure of the existing network.
    • If you are creating a ViPNet network from scratch manually, choose Configure ViPNet network structure manually to create the structure and configure the main parameters of coordinators and clients manually.

      Getting started with ViPNet Network Control Center

  7. If your license for the ViPNet network presupposes the network hierarchy, then you'll be prompted to distribute the license restrictions among the networks.

    Request for license distribution

    For information about license distribution, see the document “ViPNet Network Control Center. Administrator’s Guide.”

  8. Start working following the chosen scenario. For more information, see the document “ViPNet Network Control Center. Administrator’s Guide.”
  9. If necessary, create additional accounts for work in Network Control Center.

In this section:

Creating Additional NCC Administrator Accounts


Creating Additional NCC Administrator Accounts

If several NCC administrators are going to work in your network, then after the first start of the NCC client application, create accounts for each of the administrators. Thus, you will be able to log and monitor actions of each administrator. Administrators must use their own credentials at every logon to the client application. To create a new administrator account:

  1. In Administration, in the view pane of the User Accounts section, click [image].
  2. In the New User Account dialog box, configure the new account and click Create.

    Creating a new administrator account

The administrator for whom you have created the account can use the corresponding credentials to log on to NCC from any client application.


Starting ViPNet Key and Certification Authority for the First Time

Upon installing KCA, get started with the software by creating a KCA administrator and configuring initial options. To do this:

  1. Complete one of the following:
    • If you use Windows 7 or Windows Server 2008 R2, on the Start menu, click All programs > ViPNet > ViPNet Administrator > Key and Certification Authority.
    • If you use Windows 8 or Windows Server 2012, on the Start screen, open the App list and select ViPNet > Key and Certification Authority.

    Note: The program location on the Start menu or in the App list might have been changed at installation.

  2. In the Getting Started with ViPNet Key and Certification Authority window, choose how you want to get started with KCA:
    • If you create the ViPNet network from scratch and KCA will generate new data, then select Create and configure a new database and click Continue. The configuration setup wizard will be started. Complete the configuration setup.

      Getting started with ViPNet Key and Certification Authority

    • If you already have a working ViPNet network and would like to upgrade to KCA 4.x, then, import and upgrade the KCA 3.2.x database. To do this, select Upgrade ViPNet Key and Certification Authority database version 3.2.x and click Continue. The database upgrade will be started. For details on database upgrading, see the document “ViPNet Administrator. Upgrading Guide,” the section “Upgrading Data of Key and Certification Authority Version 3.2.x.”

In this section:

Configuration Setup of ViPNet Key and Certification Authority


Configuration Setup of ViPNet Key and Certification Authority

If, you decide to deploy a brand new KCA, the Configuration Setup wizard will start.

To perform the configuration setup of ViPNet Key and Certification Authority:

  1. On the first page of the Configuration Setup wizard, click Next.
  2. On the Connect to ViPNet Administrator Database page, specify the network address of the SQL server instance and the database name.

    If you have installed KCA and SQL server on the same computer together with the NCC server application, then specify the following address of the SQL server instance .\winnccsql. If you have installed KCA on another computer, then replace the dot with an IP address or DNS name of the computer with SQL server installed. For example, 192.168.32.152\winnccsql.

    Note: The SQL server instance name might have been changed at installation. In this case, instead of WINNCCSQL, specify the name you have provided during the installation.

    The default database name is ViPNetAdministrator.

    Configuring the SQL database connection parameters

    Warning: Do not change the database name during the configuration setup; otherwise, the process will be interrupted.

  3. Choose an authentication type to connect to the SQL server and click Next.

    By default, the SQL Server authentication type is set and the credentials of the user, whose account will be used for connection to the SQL server, are specified. This account is created automatically while you are installing the NCC server application. We do not recommend to change the credentials (name — KcaUser, password — Number1).

    Choosing the SQL server authentication type

    Then click Next. Connection with the SQL server will be established. If the connection fails, check the SQL server connection parameters.

  4. On the Create ViPNet network administrator page, specify the name of the KCA administrator account you would like to use for your work with the program.
  5. If your license permits using a certification authority on the ViPNet network, specify the information required for issuing a root certificate for the administrator. Otherwise, skip to step 11.
  6. On first wizard pages Information about the Subject of the Certificate, specify the administrator's name and other data you want to add to the certificate. Click Next.

    Providing information about the administrator, for whom the certificate is created

  7. On the Additional Information about the Subject of the Certificate page, if necessary, edit the additional information. To do this, select the necessary attributes, click Edit and edit the information. Then click Next.

    Providing additional information about the administrator, for whom the certificate is created

  8. On the Signature key parameters page, choose a cryptographic provider. The selected cryptographic service provider will determine the signature algorithm that will be used for generating private and public keys and calculating the hash function.

    Also, specify the signature algorithm parameters. The public key length and the hashing algorithm will be calculated automatically according to the specified parameters.

    Configuring the signature key parameters

  9. On the Certificate validity period page, specify the certificate validity period in any of the ways suggested.

    Defining the certificate validity period

  10. If you want to use KCA for issuing qualified certificates and your KCA operates as an authorized certification authority, on the Software Tools page, select the Operate as an authorized certification authority check box and provide information about the software tools by clicking Configure. For more information about authorized certification authority mode, see the document “ViPNet Key and Certification Authority. Administrator's Guide.“

    KCA Choosing a database for storing data

    When necessary, on this page, you can also provide information about the digital signing tool of the public key certificate subjects (users).

    Note: You can select the check box and provide all the necessary data about the used tools later, after you complete the configuration setup, in the options dialog box. But, in this case, the public key certificate you have issued earlier will not conform to the qualified certificate standards.

  11. On the page, do one of the following:
    • Set the administrator idle time for the KCA to switch to the automatic mode after the specified period of idleness (15 minutes are set by default).
    • If you do not want KCA to switch to the automatic mode when the administrator is idle, clear the corresponding check box.

    For more information about KCA in the automatic mode, see the document “ViPNet Key and Certification Authority. Administrator Guide”, the section “ViPNet Key and Certification Authority Operation Modes.”

    Configuring the automatic mode of KCA

    Note: You may as well configure the KCA automatic mode parameters in the program settings after the configuration setup.

  12. If, on the previous step, you have chosen to use the automatic mode when the administrator is idle, then you should select the actions to be performed in the automatic mode of KCA. To do this, select the action, click Configure, and in the displayed window select the corresponding check box. Specify the time for creating host keys, loading CRLs of partner ViPNet networks or updating CRLs.

    Setting tasks to be done in the automatic mode

    Note: If your license does not allow you to use KCA as a certification authority (for details, see the document “ViPNet Key and Certification Authority. Administrator's Guide,” the chapter “Overview”), then KCA can only create keys and approve key set requests in the automatic mode.
  13. On the Location of containers with the signature key and Key and Certification Authority protection key page, select the location of the administrator keys container: File or External device. If the key container is on an external device, install the device drive on your computer, connect the external device, and then choose it from the list. If necessary, type the device PIN.

    The private key validity period depends on the key container location. If the signature key is located in a file on the computer or on an external device with no support for the GOST 34.10-2001 algorithm, the private key validity period is one year exactly. If the signature key is located on a device that supports the GOST 34.10-2001 algorithm (which means the key was generated using this algorithm), the private key validity period is 3 years.

    When the private key expires, you must perform a scheduled private key change. Private key expiration makes it impossible to use the private key for signing the issued user certificates. However, private key expiration does not influence the signing of certificate revocation lists (CRLs). When the private key expires, you still can use it for signing CRLs.

    The private key location and validity period must conform to the certification authority policy.

  14. On the Password settings page, specify the following parameters:
    • The password type:
      • User-defined password is a manually created password.
      • Random means that the password will be created based on a passphrase.
      • Random numeric is a password generated automatically from the specified number of digits.

      Note: The specified password type will be saved in the program settings and applied to other passwords you create. If you want to create a password of another type, change the corresponding settings.

    • Methods of delivering passwords to ViPNet users:
      • Save Password to File — to deliver passwords as files. Specify the location where you want to save files with passwords.
      • Print Passwords — to deliver passwords in the printed form. In the list of printers, select a printer to which you want to output user passwords.

    Choosing the administrator password type

  15. If, on the previous step, you selected User-defined, on the displayed page, type and confirm the administrator's password. The password should contain no less than 8 symbols.

    Warning: We recommend that you create complex passwords that contain no less than 8 symbols and include upper and low case letters, numbers, and special symbols.

    Do not create passwords of 32 symbols and more. You cannot use such a password for authentication. This limitation is due to the existing algorithm of password transmission to the cryptoprovider. According to this algorithm, the password length cannot exceed 31 symbols.

    If you selected the random password type, in the Digital Roulette window, move your mouse pointer within the window and, as the new page is displayed, remember your new password (or the passphrase).

    If necessary, change the random password parameters and create another password.

  16. On the next page, make sure all parameters you have specified on the previous pages are correct. To print these parameters by using the default printer, click Print. If you need to make any changes in the parameters, click Back to return to the required page.

    Click Next to continue. The Biometrical Generator will be started, if it has not been yet started during the configuration setup. Move your mouse pointer within the Biometrical Generator window.

  17. If the configuration setup has been completed successfully, on the last page of the wizard, the corresponding message is displayed and every completed operation is marked with [image]. If there were errors during the configuration setup, the corresponding operation are marked with [image].

    Make sure the configuration setup has been finished successfully, and then click Close.

    Completing the configuration setup

If you have configured your KCA correctly, the following actions are completed:

  • The KCA administrator account is created.
  • The private key is created and the KCA administrator certificate is issued (if your license permits using a certification authority on your ViPNet network).

    Note: A certificate issued for another administrator will be a self-signed one. If KCA operates as a subordinate certification authority and according to the CA policy, you cannot use such a certificate for signing the issued user certificates, send a special request for another certificate to a superior certification authority (see the document “ViPNet Key and Certification Authority. Administrator's Guide,” the chapter “Establishing Trust Relationship Based on a Hierarchical Model”).

    If your KCA operates as an authorized certification authority, the issued certificate conforms to the qualified certificate standard.

  • Master keys are created.
  • Connection with the SQL database is established. The database is filled with data.

If the configuration setup was completed successfully, the main window of the program is displayed. You can start working with ViPNet Key and Certification Authority.

If the configuration setup has been completed with errors, detect the reason, uninstall the current KCA version, reinstall it, and repeat the configuration setup.


Updating ViPNet Administrator

In this section:

Workflow of Updating ViPNet Administrator Components

Updating the ViPNet Network Control Center Applications

Updating ViPNet Key and Certification Authority


Workflow of Updating ViPNet Administrator Components

Warning: On receiving ViPNet Administrator updates, update both ViPNet Network Control Center applications and ViPNet Key and Certification Authority. ViPNet Network Control Center and ViPNet Key and Certification Authority of different versions may be incompatible with each other.

To update the ViPNet Administrator software, follow the sequence:

  1. Updating ViPNet Network Control Center Server Application.
  2. Updating ViPNet Network Control Center Client Application.
  3. Updating ViPNet Key and Certification Authority.

Before you start updating ViPNet Administrator components, make sure that your license allows for using the new version. To do this, in the ViPNet Network Control Center software, on the License menu, select Licenses for My Network. In the displayed window, on the General tab, observe the maximum version, to which you can update your ViPNet Administrator.

In addition, prior to updating, we recommend you to back up your ViPNet network configuration by using the ViPNet Key and Certification Authority software. In case the software operates incorrectly after updating, the backup copy will allow you to restore your ViPNet network data. For more information about creating backup copies and restoring the data, see the document “ViPNet Key and Certification Authority. Administrator's Guide,” the chapter “Advanced Features.”


Updating the ViPNet Network Control Center Applications

Updating of the NCC server and client applications is virtually the same, except that you need to set the connection parameters to the database during the server application updating. This is required because the database is updated together with the server application. In this database, data concerning ViPNet network configuration is stored as well as parameters of ViPNet Key and Certification Authority and ViPNet Network Control Center.

Warning: Before updating the NCC server application, stop the KCA program.

To update one of the applications:

  1. Double-click the file [image] from the distribution kit of the new application version.
  2. In the displayed window, choose the language that you will use to work with ViPNet Network Control Center and click Continue.
  3. On the Reinstall or remove your ViPNet software, choose Reinstall and click Continue.

    Changing the installed software

  4. On the Update software page, set the parameters for connecting to the database. This page is displayed only when you update the server application.

    To check connection to the SQL server, click Test connection. If the connection check is successful, click Reinstall to continue. Otherwise, specify the correct parameters for connecting to the database.

    Configuring connection to the database

  5. Wait until the updating is completed.

After updating the server and client applications, update KCA.


Updating ViPNet Key and Certification Authority

To update ViPNet Key and Certification Authority:

  1. On the computer with ViPNet Key and Certification Authority, double-click the [image] file you have got within the setup kit for a new software version.
  2. On the Update page of the ViPNet Key and Certification Authority wizard, click Begin update.

    The “Update” page of the ViPNet Key and Certification Authority wizard

  3. Wait until the updating is completed and click Close.
  4. If prompted, restart the computer.

Now you can start managing your network using the new software version.


Uninstalling ViPNet Administrator

In this section:

If You Need to Uninstall ViPNet Administrator

Uninstalling the ViPNet Network Control Center Applications

Uninstalling ViPNet Key and Certification Authority


If You Need to Uninstall ViPNet Administrator

You need to uninstall the ViPNet Administrator components after you migrate the software onto a new computer successfully (for details, see “ViPNet Administrator. Migration Guide: Moving Software to Another Computer”). If needed you can use the uninstallation procedure if the software update failed.

In the first case, you must also delete the ViPNet Administrator database and all user data together with the software components. In the second case, the administrator can choose to delete the database and user data if needed.

You can delete the ViPNet Administrator database when you uninstall the NCC server application if you select the corresponding check box. You can delete user data when you uninstall each of the ViPNet Administrator components if the corresponding check boxes are selected (see the uninstallation procedure below).


Uninstalling the ViPNet Network Control Center Applications

In the current program version, you can uninstall the server and client applications of ViPNet Network Control Center only using the tools of your operating system.

To uninstall one of the NCC applications:

  1. On the Start menu, choose Control Panel.
  2. On the Adjust your computer's settings page, click Programs and Features.
  3. On the Uninstall or change a program page, select the required application and click Uninstall.
  4. In the window that opens, on the Reinstall or remove your ViPNet software page, select Remove All Components and click Continue.
  5. On the Uninstall the product page, select the corresponding check box to remove user data. If this check box is selected when you uninstall the server application, the ViPNet Administrator database will be deleted as well. If needed, you can check connection to the database before deleting it.
  6. Click Delete.
  7. Wait until the operation is complete and click Close.


Uninstalling ViPNet Key and Certification Authority

To uninstall ViPNet Key and Certification Authority:

  1. Do one of the following:
    • If you use Windows 7 or Windows Server 2008 R2, on the Start menu, click All programs > ViPNet > ViPNet Administrator > Install ViPNet Key and Certification Authority.
    • If you use Windows 8 or Windows Server 2012, on the Start screen, open the App list and select ViPNet > Install ViPNet Key and Certification Authority.

    Note: The program location on the Start menu or in the App list might have been changed at installation.

  2. On the Reinstall or remove your ViPNet software page, select Remove All Components and click Continue.
  3. On the Uninstall the product page, select the Delete all user data check box if, together with the program, you want to delete the KCA administrator's keys and other service data. Click Uninstall.
  4. Wait until the operation is complete and click Close.


Troubleshooting

The following issues may arise while you are installing or updating ViPNet Administrator:

  • Cannot Install Third-Party Software.
  • Cannot Install the NCC Server or Client Application.
  • NCC Client Application Will Not Start.
  • KCA Configuration Setup Failed.
  • NCC or KCA Will Not Start After Updating.
  • KCA Will Not Start

In this section:

Cannot Install Third-Party Software

Cannot Install the NCC Server or Client Application.

NCC Client Application Will Not Start

KCA Configuration Setup Failed

NCC or KCA Will Not Start After Updating

KCA Will Not Start


Cannot Install Third-Party Software

There might be a lack of space on the computer's hard drive. Clean up the required disk space and retry the installation.


Cannot Install the NCC Server or Client Application.

Possible reasons are:

  • The latest Windows updates are not installed.
  • The settings of the selected SQL server do not comply with the settings in the section Information for a Microsoft SQL Server Administrator. Contact the SQL server administrator.
  • The NCC server application service NccService cannot start. Contact the SQL server administrator and check the parameters of the chosen SQL server instance.

    If the service still cannot start, do the following:

    • On the SQL server computer, install SQL Server Management Studio 2014 if there is none. You can download it on the Microsoft web site.

      Warning: You cannot install the SQL Server Management Studio environment on the computer after the creation of the database server, because in this case you will not be able to install the NCC server application.

    • Start SQL Server Management Studio from the Start menu.
    • Connect to the installed SQL server.
    • Open the SQL server options window and configure the following:
      • On the Advanced tab, set the Filestream Access Level parameter value to Full access enabled.
      • On the Security tab, set the Server authentication parameter value to SQL Server and Windows Authentication mode.
  • The computer, where you are trying to install the NCC server application and the database management system, is a domain controller. For security reasons, Microsoft company does not recommend to install the SQL server on a domain controller. Install the database management system on another computer, which is not a domain controller.


NCC Client Application Will Not Start

Possible reasons are:

  • The NccService and NccFilewatcherService services of the NCC server application have not started automatically on the system start. To start the services:
    • Start the Windows Task Manager by pressing Ctrl+Shift+Esc.
    • In the Windows Task Manager window, click Services.
    • Right-click NccService and, on the context menu, select Start service.
    • Start NccFilewatcherService in the same way.
  • The computer with the NCC server application is turned off.
  • There is no connection between a computer with the NCC client application and a computer with the NCC server application. To check connection between computers, execute the ping command.
  • A firewall (for example, Windows firewall) is running on the computer with the NCC client or server application, and this firewall blocks a connection. Check settings on firewalls.
  • Your computer is not connected to the network.


KCA Configuration Setup Failed

Possible reasons are:

  • Random number generation failed.
  • Random numbers generator is configured incorrectly in the ViPNet CSP program.
  • The database has been corrupted (deleted) accidentally or intentionally.
  • Incorrect credentials are specified for the SQL database user. For KCA you should specify:
    • User name: KcaUser.
    • Password: Number1.

On investigation into the causes of the error, retry the configuration setup of ViPNet Key and Certification Authority. If the configuration setup wizard does not start automatically at the program start, delete the folder C:\ProgramData\Infotecs\ViPNet Administrator\KC and all its contents.


NCC or KCA Will Not Start After Updating

Some of the ViPNet Administrator component may have failed to update. Make sure, that all software is updated: NCC client and server applications, KCA.


KCA Will Not Start

Possible reasons are:

  • The computer with the NCC server application and the SQL database is turned off.
  • There is no connection between the computers running the NCC server application and Key and Certification Authority. To check connection between computers, execute the ping command.
  • A firewall (for example, Windows firewall) is running on the computer with the NCC server application or KCA, and this firewall blocks a connection. Check settings on firewalls.
  • Your computer is not connected to the network.


External Storage Devices

In this section:

Overview

Supported External Storage Devices


Overview

External storage devices are intended for storing key containers that you can use for authentication, digital signature, or other purposes.

On an external device, you can store keys created with different encryption algorithms in ViPNet software or third-party programs. The maximum number of key containers stored on a device may vary depending on the device's storage capacity.

You can work with key containers and external storage devices in ViPNet CSP. Make sure that you have installed the drivers required for your external device. Before you store keys on your device, make sure that the device is formatted.


Supported External Storage Devices

In the table below, you can find the list of devices supported by the ViPNet software. For each external device, the table contains a description, and its operation conditions and specifics.

Supported external storage devices

Device name in ViPNet CSP | Device name and type | Requirements
eToken Aladdin | eToken PRO (Java), eToken PRO personal electronic keys, eToken PRO (Java), eToken PRO smart cards by Aladdin Company | The PKI Client software version 5.1 or later should be installed on the computer. You can use eToken PRO SmartCard with any standard PC/SC-compatible USB card reader.
Siemens CardOS | CardOS/M4.01a, CardOS V4.3B, CardOS V4.2B, CardOS V4.2B DI, CardOS V4.2C, and CardOS V4.4 smart cards by Atos (Siemens) | Siemens CardOS API V5.0 and later should be installed on the computer.

Note: For the list of operating systems supported by a device, see the device manufacturer's official web page.


Glossary

Authentication

The process of identifying an individual usually based on a user name and a password. In security systems, authentication is distinct from authorization, which is the process of giving individuals access to system objects based on their identity. Authentication merely ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual.

Biometrical generator

An integrated ViPNet software component that allows you to generate a random number based on your chance movements.

Certificate revocation list (CRL)

A list of certificates that have been revoked or suspended by the certification authority administrator, and are not valid at the moment specified in this certificate revocation list.

Certification authority (CA)

An entity that issues digital certificates, including public key certificates. On ViPNet networks, certificates are issued in ViPNet Key and Certification Authority.

Client (ViPNet client)

A ViPNet host that is the start and the end point of data transfer. Opposite to a coordinator, a client does not route VPN traffic and service data.

Coordinator (ViPNet coordinator)

A ViPNet Coordinator HW appliance or a ViPNet host with installed ViPNet Coordinator for Windows or ViPNet Coordinator VA software. A ViPNet coordinator functions as a server on a ViPNet network and routes VPN traffic and service data.

Digital signature

An attribute of an electronic document intended to protect the document authenticity. It is generated when the information is encrypted using a private key of a digital signature. A digital signature identifies the public key certificate owner, and ensures non-repudiation of the document contents.

Firewall

A device or software installed on a host on a network edge that checks all the incoming and outgoing IP traffic and decides whether it can be redirected to its destination point. In other words, a firewall is intended to prevent unauthorized access from one network to another. A firewall usually translates internal addresses into addresses accessible from the external network (uses NAT). In ViPNet networks, we distinguish three types of firewalls with NAT:

  • ViPNet coordinator — a computer with the ViPNet Coordinator software installed that functions as a firewall and provides NAT for encrypted traffic.
  • Static NAT — a firewall with static network address translation placed between a ViPNet host and an external network to provide IP traffic exchange between external hosts and your host via UDP with a specified port.
  • Dynamic NAT — a firewall with dynamic network address translation placed between a ViPNet host and an external network. An additional coordinator is placed in the unprotected network to support the connections. This coordinator should have a public (routable) IP address. A firewall of this type is used when you connect to an external network via an xDSL modem functioning as a router, wireless devices, GPRS network, other ISPs assigning private IP addresses to your ViPNet hosts.
Host key update

When a ViPNet network administrator makes changes to the ViPNet network structure, the host links and host keys for the affected hosts change as well. Then the administrator should send new keys to the ViPNet hosts of this network.

Host keys updates are sent from Network Control Center. An update file may contain either totally new host keys, or only certificate revocation lists (CRLs) (both for the own network and for partner networks) and the root certificates of partner networks. In the latter case, the keys of all the users of this ViPNet host and service data concerning all the users of this ViPNet host are not included.

Upon updating host keys, keys and host links for ViPNet hosts are changed.

Host links

A set of files containing information on ViPNet network objects (hosts, users, host groups), including their names, ViPNet identifiers, IP addresses, and links. These files are generated in ViPNet Network Control Center.

Issuer certificate

A certificate of the certification authority administrator which is used for verifying other certificates issued by this certification authority.

Keys and host links

Includes host links, host keys, and user keys. They are changed when updated from ViPNet Network Control Center.

Master key

A key, which is used to derive symmetric keys by encrypting a pair of ViPNet identifiers of the corresponding workgroups or hosts using this key. There can be three types of master keys in a ViPNet network:

  • a master key for workgroups' exchange keys,
  • a master key for protection keys for exchange keys,
  • a master key for users' personal keys.

A master key is created using a random numbers generator. A master key should be secretly stored in the Key Authority, as compromising a master key leads to compromising all the keys derived from it.

When you establish a partner network connection, you derive cross network exchange keys from a so-called 'cross-network master key.'

Private key

The secret part of a key pair used in asymmetric encryption. A private key is intended for generating a digital signature that can be verified by the corresponding public key and for decrypting a received message encrypted with the corresponding public key.

A digital signature key is a private key.

Public key

An asymmetric encryption key, one of an asymmetric keys pair. It is not required to keep this key secret. It can be distributed freely and published in a network accessible directory. A public key is used to verify a digital signature.

A public key forms a public (non-secret) part of an asymmetric key pair.

Public key certificate

An electronic document of a predefined format that uses a digital signature to bind a public key with an identity, information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual. A certificate contains information about the key owner, the public key, about its purpose and usage, about the certification authority that has issued the certificate, the certificate validity period, and some other parameters. On a ViPNet network, certificates are issued in ViPNet Key and Certification Authority and verified with the digital signature of the ViPNet Key and Certification Authority administrator. This provides authenticity and integrity of the information specified in the certificate, including its public key and description of its subject.

Subordinate certification authority

A certification authority trusted by a higher certification authority.

Superior certification authority

If the certification authority (CA) (D) is superior to the CA (E), this means that the CA (D) resides higher in the CAs trust hierarchy and the CA (D) trusts the CA (C). In the meantime, if the CA (D) is not the root CA (a root of trust, or “trust anchor”) the CA (D) can itself be subordinate to the CA (C) which in its turn can be subordinate to the CA (B) and so on. This results in the creation of the certification authorities hierarchy, in which the CA (D) is an intermediate CA.

Transport module (MFTP)

A program intended to transfer data on a ViPNet network.

User keys

A set of files necessary for user authentication on a ViPNet network. Only one user should have access to this data.

User keys may contain:

  • a valid personal user key;
  • a container with a signature key or a set of signature keys;
  • a file with user password hash.

The contents of user keys depend on the user’s logon mode.

ViPNet Administrator

A software suite intended to manage a ViPNet network. It includes the ViPNet Network Control Center server and client applications and the ViPNet Key and Certification Authority program.

ViPNet host

A network node where the ViPNet software is installed and which is registered in ViPNet Network Control Center.

ViPNet host keys

A set of keys required for encryption of VPN traffic, service data, and ViPNet Business Mail messages.

ViPNet Key and Certification Authority

A part of the ViPNet Administrator software. The ViPNet Key and Certification Authority (KCA) administrator creates and updates keys for ViPNet hosts and manages certificates and certificate revocation lists.

ViPNet network

A logical network created and maintained with ViPNet software, consists of ViPNet hosts.

A ViPNet network has a special addressing system, which provides for data exchange between its hosts. Each ViPNet network has its own unique number (host ID).

ViPNet network administrator

A person responsible for configuring a ViPNet network, creating and updating keys and host links for ViPNet hosts, configuring partner network connections. This person has the permission to access ViPNet Administrator.

ViPNet Network Control Center

In a network managed using the ViPNet Administrator software, ViPNet Network Control Center (NCC) is a program that is a part of ViPNet Administrator. It is designed to create and configure ViPNet networks. Its main features are as follows:

  • Creating a virtual network (creating network objects and their links, including partner network links);
  • Changing network configuration;
  • Generating and distributing host links;
  • Distributing host keys and user keys;
  • Generating information on users’ links for ViPNet Key and Certification Authority;
  • Granting permissions to ViPNet users.
ViPNet network license

A permission to use a specified set of ViPNet software suite features. A ViPNet network license defines: the network number, the maximum number of coordinators and clients, the maximum total number of addresses to be tunneled by coordinators of the network, the latest allowed ViPNet software version, the license expiration date, and other parameters.