Multi-factor authentication first factor is login and password; the second factor is a  time-based, one-time password that is sent to your smartphone. This password is defined in  RFC 6238 standard and uses a cryptographic hash function that combines a secret key with  the current time to generate a one-time password.  The secret key is generated by HMC/SE/TKE while the user is performing first factor logon.  The secret key is known only to HMC/SE/TKE and to the user’s smartphone. For that reason,  it must be protected as much as your first factor password. Multi-factor authentication code (MFA code) that was generated as a second factor is  time-sensitive. Therefore, it is important to remember that it should be used soon after it is  generated.  The algorithm within the HMC that is responsible for MFA code generation changes the code  every 30 seconds. However, to make things easier, the HMC and SE console accepts current,  previous, and next MFA codes. It is also important to have HMC, SE, TKE, and smartphone  clocks synced. If the clocks are not synced, the MFA logon attempt fails. Another important  fact is that time zone differences are irrelevant because the MFA code algorithm uses UTC. The HMC Remote Support Facility (RSF) provides important communication to a centralized  IBM support network for hardware problem reporting and service. The following types of  communication are provided: Consideration:  RSF through a modem is  not  supported on the z14 ZR1 HMC. Broadband  connectivity is needed for hardware problem reporting and service.  The following security characteristics are in effect: 11.4 Remote Support Facility 11.4.1 Security characteristics GLYPH<SM590000> Problem reporting and repair data GLYPH<SM590000> Microcode Change Level (MCL) delivery GLYPH<SM590000> Hardware inventory data, which is also known as vital product data (VPD) GLYPH<SM590000> On-demand enablement GLYPH<SM590000> RSF requests always are started from the HMC to IBM. An inbound connection is never  started from the IBM Service Support System. GLYPH<SM590000> All data that is transferred between the HMC and the IBM Service Support System is  encrypted with high-grade SSL/Transport Layer Security (TLS) encryption. GLYPH<SM590000> When starting the SSL/TLS-encrypted connection, the HMC validates the trusted host  with the digital signature that is issued for the IBM Service Support System.  GLYPH<SM590000> Data that is sent to the IBM Service Support System consists of hardware problems and  configuration data. More information:  For more information about the benefits of Broadband RSF and the  SSL/TLS-secured protocol, and a sample configuration for the Broadband RSF  connection, see Integrating the HMC Broadband Remote Support Facility into Your  Enterprise , SC28-6986. 374  IBM 14 Model ZR1 Technical Guide