Sberbank selected the supplier of USB tokens for 350 million rubles

Sberbank buys devices of the electronic identifier with hardware implementation of the Russian standard of the electronic signature, enciphering, hashing and the organization of a client part of the TLS protocol not lower than 1.0. The corresponding competition was announced on June 23, 2016, and in the fall of the same year its results were summed up.^[1]

Sberbank selected the supplier of USB tokens

Purchase subject

Within delivery 2 types of devices – in standard execution and performed by with the button for manual permission to accomplishment of cryptographic transactions were required for the customer. The device should support work in operating environments of Microsoft Windows 2000/2003/XP/Vista/7/8/8.1/10 with a possibility of the subsequent support in operating environments of Mac OS X Apple. The device should be connected to PC USB port and incorporate the internal memory read by regular means to OS. On an internal memory the application for the organization of data exchange through local port on the local IP address of the PC for the HTTP protocol should be written.

In a standard mode all cryptographic transactions should be executed directly in the device without a possibility of extraction of it private keys. In the special mode execution of operations of hashing when forming the EDS and enciphering at TLS connection is allowed.

The application should have the built-in Web page for implementation of access to functionality and settings of the device. Installation on the PC of additional software for operation of the device and also storage of settings of the device in the register and on disk PC is not allowed. The application should serve only for data exchange under the HTTP protocol through USB port.

The device should have the internal hardware or hardware-software random number generator certified by FSB for use in work. Integrity checking of a microcode of the device and integrity of the application should be performed at its connection to PC USB port.

Cost of the agreement and delivery dates

The maximum cost of unit of the purchased products should not have exceeded $17 in a currency part of the price of the device and 300 rubles in a ruble part (the first type of devices) and also $18 in a currency part of the price of the device and 300 rubles in a ruble part (the second type of devices).

The limit amount under the agreement was 1.44 billion rubles, including 1.33 billion for the first type of devices and 110.7 million – for the second type.

Delivery date of products – no more than 20 weeks from order date.

Applicants for the contract

On participation in tender two requests arrived: from the companies Active Soft and Amicon, followed from the protocol published on July 19. The first of them suggested to deliver devices at lower prices, than the competitor: devices of the first type - at the price about 1.29 billion rubles, the second type - about 109 million rubles. The posted prices Amicon are about 1.33 billion rubles and 110 million rubles respectively. Both companies were allowed before participation in tender.

Amicon is an old supplier of Sberbank in the field of cryptographic security aids and repeatedly signed delivery contracts of USB tokens with bank. At the same time often purchases were carried out at the company as at the only supplier.

In April, 2016 Sberbank selected Amicon as the only supplier of cryptographic hardware of security for up to the end of the year^[2]. The agreement with the company assumes equipment procurements, including USB devices, for total amount within 604 million rubles and also software for the amount no more than 99 million rubles.

Sberbank told TAdviser that the moment of a statement of Amicon company the only source in the market there were no ready-made solutions conforming to requirements of bank infrastructure.

The open competition on delivery of USB tokens was announced after receiving confirmation of the fact of development by Active Soft company of the USB devices conforming by the parameters to requirements of bank. In this case the bank considers a possibility of carrying out the competitive purchase which is the most equitable to the interests, - told TAdviser in bank.

Subsidiaries of Sberbank cooperate with Active Soft company, added in bank. A subject of agreements – the electronic identifiers other than the USB tokens requested within the open competition.

auction Results

On October 26, 2016 during the meeting of a tender committee testing of the product samples provided by procurement participants was held. The equipment of Amicon company was recognized to relevant requirements of the technical project at all points. Samples of Active Soft company did not satisfy to 12 points of the testing methodology.

Thus Amicon was approved as the only supplier. The tender committee made the decision to sign with this company the general agreement for a period of 1 year for delivery of 253.7 thousand USB tokens to total amount of 352.6 million rubles.

Originally were estimated at bank documentations of need for similar devices above. So, for 2017 requirement almost in 405 thousand devices of the first type and 30.7 thousand devices of the second type was specified. In 2018 the bank was going to receive 428 thousand tokens of the first type and 35.4 thousand - the second.

Notes