Swekey2

What is it?

The Swekey USB Token is a low cost USB device with a unique signing.
It contains a 32 bit unique hashcode and some software for generating
authentication code sequences based on a random token and the hashcode
on the USB Token itself.
This module integrates the Swekey Token into the Drupal user module, adding
a third level of protection on top of the username and password.

Why should I use it?

If your website or webapplication needs extra protection, or your users
think they need it ;-)

Why not use the original module from Musbe, the creators of the Swekey?

Several reasons. The original module does not integrate well with the session
handler. It assumes we are all using the file method, storing the session data
on disk. Problems also arise for clusterd fileservers because of this.
Second. The Swekey system uses external authentication servers. That's ok, but
one of them is used for generating a random token. Drupal really doesn't need
that because we have a unique token already by way of the unique form-id.
Than finally, for checking purpuses the hashcode from the Token is send to
the authentication server. Unencrypted. The servers from musbe are simple
http servers.

Why use this module?

It is not dependent on any external server. It leverages the full Druapl API.
And it integrates seemlesly into the user module.

How does it work?

Administrators can connect a unique swekey hascode with a user-account.
When a user that's connected this way tries to login, a hashcode is being
generated in the client by combining the unique swekey id and the unique form-id.
The resulting hashcode is send back to the server in the login-form.
The server generates the hashcode the same way and compares them. If they are
identical, the user is logged in. (of course the username and password must
be ok also.)
To verify that the swekey is still attached to the computer during the session,
every form that is generated by the website has to contain a valid swekey
hashcode. If not, the form is not accepted and the user is logged out.
This way, we don't have to rely on any external servers, and the unique Swekey
sign is never send out.
Note that javascript must be enabled in the client for communicating with the
Swekey.

Wim Tol
November 14 2011