Multi-factor authentication first factor is login and password; the second factor is a time-based, one-time password that is sent to your smartphone. This password is defined in RFC 6238 standard and uses a cryptographic hash function that combines a secret key with the current time to generate a one-time password. 

The secret key is generated by HMC/SE/TKE while the user is performing first factor logon. The secret key is known only to HMC/SE/TKE and to the user’s smartphone. For that reason, it must be protected as much as your first factor password. 

Multi-factor authentication code (MFA code) that was generated as a second factor is time-sensitive. Therefore, it is important to remember that it should be used soon after it is generated. 

The algorithm within the HMC that is responsible for MFA code generation changes the code every 30 seconds. However, to make things easier, the HMC and SE console accepts current, previous, and next MFA codes. It is also important to have HMC, SE, TKE, and smartphone clocks synced. If the clocks are not synced, the MFA logon attempt fails. Another important fact is that time zone differences are irrelevant because the MFA code algorithm uses UTC. 

## 11.4 Remote Support Facility 

The HMC Remote Support Facility (RSF) provides important communication to a centralized IBM support network for hardware problem reporting and service. The following types of communication are provided: 

GLYPH<SM590000> Problem reporting and repair data 

GLYPH<SM590000> Microcode Change Level (MCL) delivery 

GLYPH<SM590000> Hardware inventory data, which is also known as vital product data (VPD) 

GLYPH<SM590000> On-demand enablement 

Consideration:  RSF through a modem is not supported on the z14 ZR1 HMC. Broadband connectivity is needed for hardware problem reporting and service. 

## 11.4.1 Security characteristics 

The following security characteristics are in effect: 

GLYPH<SM590000> RSF requests always are started from the HMC to IBM. An inbound connection is never started from the IBM Service Support System. 

GLYPH<SM590000> All data that is transferred between the HMC and the IBM Service Support System is encrypted with high-grade SSL/Transport Layer Security (TLS) encryption. 

GLYPH<SM590000> When starting the SSL/TLS-encrypted connection, the HMC validates the trusted host with the digital signature that is issued for the IBM Service Support System. 

GLYPH<SM590000> Data that is sent to the IBM Service Support System consists of hardware problems and configuration data. 

More information: For more information about the benefits of Broadband RSF and the SSL/TLS-secured protocol, and a sample configuration for the Broadband RSF connection, see Integrating the HMC Broadband Remote Support Facility into Your Enterprise , SC28-6986. 

