Enterprise Token Software for Windows Mobile 6.5

During the height of Windows Mobile 6.5 in corporate environments, organizations relied on mobile software authenticators to secure remote access, virtual private networks (VPNs), and enterprise logins. While RSA produced an official version of its SecurID client for the operating system, several competing software token platforms provided time-based and challenge-response one-time passwords (OTPs) for the platform. These enterprise solutions eliminated the need for physical hardware key fobs by delivering cryptographic tokens directly through Windows CE-based handheld devices.

RSA SecurID Software Token for Windows Mobile

RSA developed an official native client specifically for the Windows Mobile platform, commonly deployed as RSA SecurID Software Token 3.x and 4.x. The software generated dynamic, time-synchronous 60-second OTP codes directly equivalent to the physical RSA SID700 key fobs. Administrators provisioned the software using encrypted token files (.sdtid) distributed via secure email or enterprise desktop synchronization. The application integrated with RSA Authentication Manager servers to protect remote access points such as Cisco VPN concentrators, Citrix gateways, and Microsoft Outlook Web Access (OWA).

VASCO DIGIPASS

VASCO Data Security (now OneSpan) offered DIGIPASS software authentication clients for Windows Mobile 6.x devices. DIGIPASS supported both event-based and time-based OTP generation, along with challenge-response and transaction data signing modes. These clients tied directly into VASCO's VACMAN Controller or IDENTIKEY authentication servers, allowing financial institutions and corporate networks to validate identity via RADIUS or native API integration without issuing hardware DIGIPASS tokens.

SafeNet MobilePASS

SafeNet (later acquired by Gemalto and now part of Thales) provided MobilePASS for Windows Mobile. The client transformed Windows Mobile 6.5 smartphones into two-factor authentication tokens compatible with SafeNet Authentication Manager (SAM) and SafeNet Authentication Service (SAS). MobilePASS generated time- and event-based OTPs, required an initial user PIN to unlock cryptographic secrets, and was commonly deployed for Microsoft Exchange ActiveSync environments and corporate SSL-VPNs.

Symantec VIP Access (Formerly VeriSign VIP)

VeriSign Identity Protection (VIP), later managed by Symantec and Broadcom, offered the VIP Access client for Windows Mobile 6.0 and 6.5. VIP Access utilized open standards aligned with the Initiative for Open Authentication (OATH) to generate dynamic codes synchronized with cloud-hosted VIP authentication networks. Enterprises implemented VIP Access to protect web portals, Microsoft ISA Server environments, and single sign-on (SSO) gateways.

Entrust IdentityGuard Mobile

Entrust provided an IdentityGuard Mobile client that supported Windows Mobile. Designed as a soft token alternative to the physical Entrust IdentityGuard grid cards and hardware tokens, the mobile client generated standard OTPs and responded to enterprise mutual authentication challenges managed through Entrust IdentityGuard management platforms.

Architecture and Deployment on Windows Mobile 6.5

Deploying these software tokens on Windows Mobile 6.5 required packaged .cab (Cabinet) installation files distributed over-the-air (OTA) or via Microsoft ActiveSync and Windows Mobile Device Center. The authenticators stored cryptographic seeds securely inside the device's persistent flash memory using operating system-level encryption (CryptoAPI) or application-specific key stores protected by mandatory user PINs. Most of these solutions translated user-entered PINs and generated OTPs into standard RADIUS or LDAP payloads accepted by enterprise identity providers.