DSSA Access System

DSSA™ Client & Client Access Management

[1] The CSG™ [2] is able to allow registration and management of the DSSA™ [3] software clients. The DSSA™ registration process is defined as follows:

• DSSA™ software instance sends a new registration request to the CSG™. The request contains a PKCS#10 Certificate request and user registration data [UID] provided to the DSSA™ administrator at the time of DSSA™ online registration on the official AACD™ website.
• The CSG™ receives the registration request and verifies whether the PKCS#10 request structure is correct. It also attempts to locate in its DSSA™ client database the account for the presented UID by the new DSSA™ client.
• If the UID account does not exists on the CSG™ DSSA™ client database, then the CSG™ communicate with the Digi-CA™ [4] Certificate Authority" />Digi-CA™ System to verify that the UID data is valid, i.e. the user has previously registered online to use DSSA™ software.
• Upon successful verification of the UID data, the CSG™ generates a new X.509 digital Certificate (using its mini-CA sub-system) and responds to DSSA™ with a successful message that contains the newly generated X.509 digital Certificate, which is subsequently stored by DSSA™ software and used for client authentication in any future communications between DSSA™ and CSG™.
• The CSG™ verifies the DSSA™ clients using the extended SSL client authentication mechanism, whereby on top of standard client authentication using an X.509 digital Certificate, which is a built-in mechanism of the SSL/TLS protocol, the CSG™ queries its DSSA™ client database to verify whether the presented Certificate by the connecting DSSA™ client is valid and belongs to a DSSA™ client that resides in the DSSA™ client database.
• The CSG™ will also accept new Certificate signing requests received from successfully authenticated DSSA™ clients. Upon receiving a valid request, the CSG™ forwards the request to the configured Digi-CA™ System and provides the response to the requesting DSSA™ client whether the request was accepted by the CA [5]. The response is provided in a single communication session.