Access Security Gateway (ASG) is a software feature available on most Avaya products and uses challenge/responses for authentication by associating a unique secret key with each login on every product. When products are installed, an Avaya security management system called the ASG Manager creates new ASG encryption keys for each Avaya login on every system. Every Avaya login on an Avaya system is associated with a different key. If a key were ever compromised, only a single login on a single system would be affected. The encryption keys are themselves encrypted before they are installed. ASG is session-oriented. A unique challenge is presented, and a unique response must be provided each time the user wants to be authenticated by the Avaya system. ASG uses Advanced Encryption Standard (128-bit AES key) technology.
Messaging provides the ASG process, which is used for Avaya Services login accounts and can be assigned to customer-created administrator logins. ASG replaces static password authentication and adds a level of security to system administration and maintenance ports and/or logins on Messaging. Avaya support (services) accounts are protected by ASG. Customer logins may use ASG if it is enabled in the system license.
A regular password account uses a fixed user name (ID) and a password that can be used multiple times to log into the system. If password has been sent in unencrypted (cleartext) form, a person or device that can monitor (network sniffer) the login messages can capture this password and use it to gain access. ASG instead uses a one-time challenge-response mechanism to authenticate users. The user is allowed to log in only when the correct response is entered. The password is unique to that session and is incorrect if used again. Even if the password is compromised, it cannot be re-used immediately or at a later time, even by the same person from the same terminal. ASG can be enabled on the System Management Interface for each login on an Avaya server if the feature is enabled in the system license.