VIRTUAL SMART CARD SYSTEM AND METHOD

• US 20060248347A1
• Filed: 06/21/2006
• Published: 11/02/2006
• Est. Priority Date: 09/03/1999
• Status: Active Grant

• Current Assignee: SafeNet Data Security (Israel) Ltd.
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Levenberg, Richard, Smith, Lawrence
• Granted Patent: US 7,487,357 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A public key authentication system and method for use in a computer system having a plurality of users. The system includes a virtual smart card server, storage connected to the virtual smart card server, and a virtual smart card agent connected to the virtual smart card server. The storage includes a plurality of virtual smart cards, wherein each virtual smart card is associated with a user and wherein each smart card includes a private key. The virtual smart card agent authenticates the user and accesses the authenticated user'"'"'s virtual smart card to obtain the user'"'"'s private key.

Claims

1-13. -13. (canceled)

14. A public key authentication system for use in a computer system having a plurality of users, the system comprising:

an authentication server;

a directory service connected to the authentication server, wherein the directory service includes a plurality of public keys, wherein each public key is associated with a unique user identifier; and

a host system, wherein the host system includes a public key authentication client and an interface to a smart-card-enabled application, wherein the public key authentication client is connected to the authentication server;

wherein the public key authentication client receives a challenge issued by the authentication server, signs the challenge with a digital signature representing a user and sends the digital signature of the challenge back to the authentication server; and

wherein the authentication server receives the digital signature of the challenge and verifies the digital signature with a public key retrieved from the directory service.

15. The public key authentication system according to claim 14, wherein the authentication server includes role-based access control.

16. The public key authentication system according to claim 14, wherein the authentication server includes automatic logging of authentication attempts.