Release Notes. NCP Android Secure Managed Client. 1. New Features and Enhancements. 2. Improvements / Problems Resolved. 3.

Transcription

1 NCP Android Secure Managed Client can be commissioned for use in one of two environments: NCP Secure Enterprise Management, or NCP Volume License Server. Release: 2.32 build 067 Date: May New Features and Enhancements Full Network Enclosure Mode Full Network Enclosure Mode: for situations where the Android device's local IP address is in the same IP address subnet as the remote network, this option can be enabled to force all data to be forwarded through the VPN tunnel. Classification of configuration updates The Secure Enterprise Management (SEM) can send configuration updates personalized according to IMEI of the Android device. On connecting to the SEM, the Client receives a configuration update providing, at the SEM, the "ID for personalized configuration" has been set to the IMEI, host name or RSU-ID of that Client. The ID is checked in the sequence entered. Various Optimizations The text strings of the configuration interface have been reworked. Certificate PIN handling has been improved. Support for PKCS#11 interface when using a Certgate SD card with certificate memory. 2. Improvements / Problems Resolved Automatic VPN Tunnel Establishment When "Always" Connection Mode is selected a VPN tunnel is automatically established, both when the app starts and after a restart of the Android device. Alternatively, if "Auto reconnect" is selected, the connection is only established after failure of a connection medium. Problems associated with Connection Mode have been resolved. Ending the App Regardless, of whether the app is exited or removed from the "Recents" list, the app is ended correctly. 3. Known Issues None Page 1 of 6

2 4. Getting Help for the NCP Android Secure Managed Client To ensure that you always have the latest information about NCP s products, always check the NCP website at: For further assistance with NCP's Android products, please send mail to the address listed on: or to support@ncp-e.com Page 2 of 6

3 Release: 2.32 build 018 Date: March New Features and Enhancements Management of Android Secure Managed Clients In order to use the license management facilities of the Volume License Server to manage Android Client licenses a) the Client must be commissioned as an NCP Secure Android Client Volume Edition and b) a Volume License Server version 1.01 or higher used. In order to use the license and configuration management facilities of Secure Enterprise Management to manage Android Client licenses and configurations, a) the Client must be commissioned as an NCP Secure Enterprise Android Client and b) an NCP Secure Enterprise Management server version 3.00 build 016 used, together with the following plug-ins: Client Plug-in 9.31 build 005 License Plug-in 2.05 build 005 PKI Plug-in 3.00 build Improvements / Problems Resolved None - this is the first release. 6. Known Issues None - this is the first release. 7. Getting Help for the NCP Android Secure Managed Client To ensure that you always have the latest information about NCP s products, always check the NCP website at: For further assistance with NCP's Android products, please send mail to the address listed on: or to support@ncp-e.com Page 3 of 6

4 8. Features Operating System Android 4.0 and above Management and Licensing The Android Secure Managed Client software package is designed to be used in one of two different secure VPN infrastructure scenarios: Fully Managed by a Secure Enterprise Management server In this scenario, license and VPN Connection Profile parameters are centrally managed by and distributed from an NCP Secure Enterprise Management server. Licenses managed by Volume License Server In this scenario, only the license for each individual Secure Managed Client is managed and distributed by the NCP Volume License Server. The VPN tunnel establishment parameters must be either configured individually at each Android device or configured centrally at another Secure Client and then imported into each Android device and modified. A single software package is provided by NCP and, after being installed, can be configured for either of the two scenarios by use of either of the post-installation commissioning procedures described in the accompanying readme file. Standards Support of all Internet Society IPsec Standards Virtual Private Networking RFC conformant IPsec (Layer 3 Tunneling), IPsec Tunnel Mode IPsec proposals can be determined by the IPsec gateway (IKE, IPsec Phase 2); Event log; Communication only in tunnel; Message Transfer Unit (MTU) Size Fragmentation und Reassembly; Network Address Translation -Traversal (NAT-T); Dead Peer Detection (DPD); NAT-Traversal (NAT-T); Encryption Symmetric processes: AES 128,192,256 bits; Blowfish 128,448 bits; Triple-DES 112,168 bits; Dynamic processes for key exchange: RSA to 2048 bits; Seamless Rekeying (PFS); Hash Algorithms: SHA-256, SHA-384, SHA-512, MD5, DH Groups 1, 2, 5, 14 Page 4 of 6

5 FIPS Inside The NCP Secure Enterprise Android Client uses an embedded FIPS validated cryptographic module (Certificate #1747) running on an Android platform per FIPS Implementation Guidance section G.5 guidelines. FIPS conformance will always be maintained when any of the following algorithms are used for establishment and encryption of the IPsec connection: Diffie Hellman Group: Group 2 or higher (DH starting from a length of 1024 bits) Hash Algorithms: SHA1, SHA 256, SHA 384 or SHA 512 bits Encryption Algorithms: AES with 128, 192 or 256 bits or Triple DES Authentication Process IKEv1 (Aggressive und Main Mode), Quick Mode; XAUTH for extended user authentication; IKE Config Mode for the dynamic assignment of a virtual address from an internal pool (private IP) ; PFS IKEv2 Pre-shared Secrets Strong Authentication PKCS#12 Interface for using User (Soft) Certificates Multi Certificate configuration One-Time Passwords and Challenge Response System; RSA SecurID Ready Network Protocol IP Auto Reconnect A connection is automatically established if the Internet connection has been interrupted or the communication medium has changed from WiFi to mobile data transmission. Configurable connection mode (always, manual) VPN Path Finder NCP VPN Path Finder Technology, Fallback IPsec /HTTPS (Port 443) when port 500 or UDP encapsulation can not be used (prerequisite: NCP VPN Path Finder Technology required at the VPN Gateway) IP Address Assignment Dynamic Host Control Protocol (DHCP); Domain Name Server (DNS): central VPN gateway selection using public IP address allocated by querying a DNS server Page 5 of 6

6 Line Management Dead Peer Detection (DPD) with configurable polling interval; Short Hold Mode; WLAN Roaming (Handover); Timeout Data Compression IPCOMP (lzs), Deflate Other Features UDP encapsulation Import function supporting file formats:*.ini, *.pcf, *.wgx und *.spd Internet Society RFCs and Drafts RFC (IPsec), RFC 3947 (NAT-T negotiations), RFC 3948 (UDP encapsulation), IP Security Architecture: ESP, ISAKMP/Oakley, IKE, XAUTH, IKECFG, DPD, NAT Traversal (NAT-T), UDP encapsulation, IPCOMP Client Monitor Intuitive GUI English, Configuration, import and export, Connection control and management, connection statistics, log files, Trace tool for error diagnosis, Traffic light icon indicates connection status. Page 6 of 6