SWIFT Certificate Centre
Getting Started with your Personal Token
This document is for security officers, systems administrators and personal token users. It provides a high-level end-to-end view of how to order, to install and to activate the personal token. It also refers to other documentation for moredetailed procedures when necessary.
15 December 2017
Table of Contents
Preface............................................................................................................................................................... 3
1 Get Started............................................................................................................................................... 4
2 Order Personal Tokens from SWIFT...................................................................................................... 5
3 Install Token Software.............................................................................................................................7
4 Define a new SWIFTNet user.................................................................................................................. 8
5 Activate Token....................................................................................................................................... 11
Legal Notices...................................................................................................................................................13
SWIFT Certificate Centre Getting Started with your Personal Token Table of Contents
15 December 2017 2
PrefaceAccess to some services on SWIFT is protected by means of personal tokens. This documentdescribes how to order, to install and to activate the personal token. It also refers to otherdocumentation for more detailed procedures when necessary.
Audience
This document is for the following audience:
• personal token users
• security officers
• systems administrators
Significant changes
The following table lists the main changes since the previous publication of this document, but doesnot include general edits and minor updates.
New information Location
Personal token passwords are now subjected to apassword policy that determines the minimumcomplexity requirements for a valid password. Asecurity officer selects this policy for the token beforegenerating the activation secrets.
Activate Token on page 11
Define a new SWIFTNet user on page 8
SWIFTNet Online Operations Manager is nowavailable to personal token users over the Internet.Users require the appropiate roles to access thisservice.
Define a new SWIFTNet user on page 8
Related documentation
• SWIFT Certificate Centre Personal Token Software Installation Guide
• SWIFTNet Online Operations Manager User Guide
• Secure Channel User Guide
SWIFT Certificate Centre Getting Started with your Personal Token Preface
15 December 2017 3
1 Get StartedOrder and use personal tokens from SWIFT.
About this task
SWIFT provides tokens that enable strong authentication for individual users when accessingcertain SWIFT services. The token includes PKI credentials which the owner of the token hasgenerated. The PKI credentials are used to create digital signatures that allow the owner of thetoken to be identified. The token is personal and must not be shared with another user. It isprotected by a password that the owner of the token must keep private.
The SWIFT Certificate Centre is a portal that allows owners of personal tokens to manage theirtoken or PKI credentials stored on it. Users need their tokens to access the SWIFT CertificateCentre. The portal allows a user to activate a token, set its password and other such operations.
Get started process overview
Token Administrator
SWIFT
Security Officer
WHO
Install token
software
User’s PC2
Send the tokens to administrator
1
Order personal tokens
from SWIFT
swift.com
Token User
Send activation code to users
Define a new SN user
SWIFTNet OnlineOperations Manager
3
Activate token
SWIFT CertificateCentre
4
System Administrator
D13
600
01
WHEN
Procedure
1. Order Personal Tokens from SWIFT on page 5
2. Install Token Software on page 7
3. Define a new SWIFTNet user on page 8
4. Activate Token on page 11
SWIFT Certificate Centre Getting Started with your Personal Token Get Started
15 December 2017 4
2 Order Personal Tokens from SWIFTYou need to evaluate the number of tokens required for your institution, taking into account thenumber of users who will use them. Plan also for sufficient spare tokens in case of replacement.
About this task
Note Some services include an initial pack of personal tokens as part of the subscription.
If you need to order personal tokens, refer to the procedure below.
Procedure
1. Navigate to www.swift.com.
On the Ordering & Support menu, select Order Products and Services.
2. Select Personal tokens.
Click Order Personal Tokens and log in to www.swift.com with the SWIFT Customer log in screen.
The Personal Tokens order form appears.
Personal tokens are delivered in packs of ten. You must order at least one pack. In the Tokensordering section above, ten tokens have been ordered as one pack.
3. Scroll down to the Shipping details section.
SWIFT Certificate Centre Getting Started with your Personal Token Order Personal Tokens from SWIFT
15 December 2017 5
4. Fill in the appropriate fields and click Continue .
You will receive an acknowledgement e-mail at the address you provide in the E-mail field inthe shipping details. This e-mail confirms that your order has been received.
Note Only an administrator or a security officer can order personal tokens for the institutionswithin his scope of authority.
For more information on how to designate your security officer see the SecureChannel User Guide or visit the Secure Channel home page.
Important Allow a few weeks for delivery of the personal tokens.
Related information
Ordering
SWIFT Certificate Centre Getting Started with your Personal Token Order Personal Tokens from SWIFT
15 December 2017 6
3 Install Token SoftwareBefore you can use your personal token, you must install the token software. Each computer onwhich you will use your personal token requires an installation of token software.
Before you beginToken software installation requires your computer to meet minimum configuration requirements.
Minimum configuration requirements
Type Description
Browser Token software requires the 32-bit version of Internet Explorer.
SWIFT recommends Internet Explorer 11.0.
Operating System For personal computer operating systems, SWIFT recommends aWindows 7 PC or newer (32-bit or 64-bit).
For server operating systems, SWIFT recommends WindowsServer 2008 R2 or newer (32-bit or 64-bit).
Java Token software requires the 32-bit version of Java.
SWIFT recommends the latest Java version 8 with thecorresponding Critical Patch Update.
Important • Token software and Java installation requires you to have administrator rights.
• You must use the 32-bit versions of Internet Explorer and Java RuntimeEnvironment, even if you have a 64-bit Windows operating system.
• Windows 8 users must switch to desktop mode before launching Internet Explorer.
Procedure
1. Open Internet Explorer and navigate to SWIFT Certificate Centre.
Download the token installation program.
The zip file contains the token installer package.
2. Download the SWIFT Certificate Centre Personal Token Software Installation Guide for theprocedure on how to install the token software on your PC.
When the token software is installed, the PC is ready for the personal token.
Next, the SWIFTNet security officer must define a new SWIFTNet user for each personal tokenuser.
Related information
SWIFT Certificate Centre Personal Token Software Installation Guide
SWIFT Certificate Centre Getting Started with your Personal Token Install Token Software
15 December 2017 7
4 Define a new SWIFTNet userYour SWIFTNet security officer must assign a distinguished name (DN) for each personal tokenuser. To create a new DN, your security officer must complete the following steps:
Procedure
1. Log in to the SWIFTNet Online Operations Manager (O2M) service.
URL Description
https://www.o2m.swiftnet.sipn.swift.com Use this URL for connection with an HSM orpersonal token certificate over the MV-SIPNnetwork.
https://www.o2m.browse.swiftnet.sipn.swift.com
Use this URL for connection with a personaltoken certificate over the Internet
.
2. Go to Security > Certificate Management - User and click the User certs tab.
3. In the tree view, determine where in the hierarchy the new user is to be positioned. Thisposition in the tree determines the unique distinguished name created for the new user. SWIFTrecommends that you minimise the number of levels used in the tree to facilitate maintenanceof the tree. Put the user under an existing node by clicking that node to select it. The DN has asize limit of 100 characters.
Example of a DN: cn=john-smith,ou=departmentname,o=bankbebb,o=swift, where:
• the cn= segment has the name of the token holder
• the ou= segment allows you to group multiple users under the same organisation unit in yourtree
• the o= segment contains your live BIC
4. Click New .
The New window appears.
SWIFT Certificate Centre Getting Started with your Personal Token Define a new SWIFTNet user
15 December 2017 8
Type a name for the new user and select the type Human or Application.
The rules for entering the name are as follows:
• Minimum length is four characters (maximum is 20 characters)
• First character must be alphabetic, but can be lowercase or uppercase
• Subsequent characters, in any order, can be:
- alphabetic (lowercase or uppercase)
- digits (0-9)
- hyphen (-)
5. Click OK .
6. A confirmation window appears and asks you if you want to set up the user for certification.
7. Click OK
The Setup for Certification window appears.
SWIFT Certificate Centre Getting Started with your Personal Token Define a new SWIFTNet user
15 December 2017 9
8. Select the certificate class:
Personal token.
9. Select the password policy. Choose from Level 6, Level 8, and Level 12. The password policydetermines the minimum password complexity for a user when a token is activated or reset.
For guidance on choosing a password policy, see the SWIFTNet PKI Certificate AdministrationGuide.
10. Click OK .
After a few moments, the information for the user is updated.
11. Click + to display the activation code. Then copy it and pass it securely to the personal tokenuser.
12. [Optional] Enter a description of the new user and DN in the Description field.
13. Click Log off to quit the SWIFTNet Online Operations Manager.
SWIFT Certificate Centre Getting Started with your Personal Token Define a new SWIFTNet user
15 December 2017 10
5 Activate TokenA token requires activation before use. Activation requires you to have your token, activation codesand access to the SWIFT Certificate Centre from a PC that has an installation of token software.
About this task
When you first receive your personal token, the token is inactive because it does not yet containthe private key to your digital certificate. Activation generates a public and private key pair. Youmust activate your token on the SWIFT Certificate Centre before you can use it for SWIFT services.The public key is sent for registration with the SWIFTNet PKI authority. The private key neverleaves the token.
Procedure
1. Open Internet Explorer and navigate to http://www.swift.com/certificates for connection over theInternet, or to https://scc.swiftnet.sipn.swift.com for connection over MV-SIPN.
The SWIFT Certificate Centre window appears.
2. Insert your token into a free USB port of your computer.
3. Click Login .
The Confirm Certificate window appears.
4. Select the certificate and click OK .
The Log on to eToken window appears.
5. Type the initial password that was supplied with the token in the Password field and click OK .
6. You may have to provide the password a second time.
The SWIFT Certificate Centre Login window appears.
7. Type the initial password that was supplied with the token in the Enter your token passwordfield and click Login .
The Token Activation window appears.
8. In the Enter Activation Code window, type the activation code that you received from SWIFT,or enter it using copy-and-paste and click Validate .
If there is a problem with the activation code, then re-enter the code and click Validate again.
Note The activation code is required only once to complete the activation. Afteractivation is complete, this code cannot be reused.
9. You must now set your own password for the token. Read the password policy rules on theChange password window, then complete the following fields:
Current Password Enter the initial password that was supplied with the token.
SWIFT Certificate Centre Getting Started with your Personal Token Activate Token
15 December 2017 11
New Password Provide a strong password. Use the following guidelines when creating apassword:
• the minimum length varies according to the password policy
• the maximum possible password length is twenty characters
• You can use the following characters:
- 0-9 A-Z a-z and space
- ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ]^ _ ` { | } ~
• you cannot use accented characters (for example, é or ö)
Confirm new password Re-enter the new password.
Note Passwords expire. The token password policy determines how often you mustchange your password.
10. Click Change .
Your private key is now being generated on the token and the public key is being certified bySWIFT.
The Activation complete window appears.
Your personal token is ready for use now that it a stores your certificate and a private key that ispassword protected.
The Activation complete window displays the following information about the certificate on yourtoken:
DN The Distinguished Name of your certificate.
Expires The date and time at which the certificate expires.
Click Logout to quit the SWIFT Certificate Centre.
Related information
SWIFT Certificate Centre Portal User Guide
SWIFT Certificate Centre Getting Started with your Personal Token Activate Token
15 December 2017 12
Legal NoticesCopyright
SWIFT © 2017. All rights reserved.
Disclaimer
The information in this publication may change from time to time. You must always refer to thelatest available version.
Translations
The English version of SWIFT documentation is the only official and binding version.
Trademarks
SWIFT is the trade name of S.W.I.F.T. SCRL. The following are registered trademarks of SWIFT:the SWIFT logo, SWIFT, SWIFTNet, Sibos, 3SKey, Innotribe, the Standards Forum logo,MyStandards, and SWIFT Institute. Other product, service, or company names in this publicationare trade names, trademarks, or registered trademarks of their respective owners.
SWIFT Certificate Centre Getting Started with your Personal Token Legal Notices
15 December 2017 13