Methods and arrangements for mapping widely disparate portable tokens to a static machine concentric cryptographic environment

• US 6,484,259 B1
• Filed: 11/16/1999
• Issued: 11/19/2002
• Est. Priority Date: 07/23/1999
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Barlow, Douglas C.
• Primary Examiner(s): Darrow, Justin T.
• Application Number:
  US09/444,137
• Time in Patent Office: 1,099 Days
• Field of Search: 713/185, 713/184, 713/186, 713/202, 713/155, 713/156, 713/157, 713/158, 713/159, 713/172, 713/173, 713/174, 705/65, 705/66, 705/67, 380/277, 380/278, 380/279, 380/30
• US Class Current: 713/159
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof

Abstract

Various methods and arrangements are provided to form an interface that allows portable token devices to be used within static machine concentric cryptographic environments. One example of a portable token device is a smart card that can be read or other accessed by a computer through a smart card reader. A cryptographic API, associated with the operating system of the computer, is configured to separate the applications from the cryptographic functions that require the portable tokens. The cryptographic API accesses a smart card cryptographic server provider (SC-CSP) that is configured to work with a smart card cryptographic provider (SCCP) program as part of the interface. This SC-CSP/SCCP interface determines that the requested cryptographic function requires a specific smart card and requests that the user provide the appropriate smart card. The SC-CSP and SCCP are object-oriented and utilize method invocation to provide an efficient and reliable interface that can support a variety of different portable tokens and cryptographic needs.

Claims

1. A hierarchical object-based interface method for use in a machine capable of connecting to portable-token devices, the interface method comprising:

identifying when a portable-token device has been connected to the machine;

upon identifying that the portable-token device has been connected to the machine, causing a processing unit within the machine to instantiate portable-token device control object logic operatively configured to manage the portable-token device;

causing the portable-token device control object logic to further instantiate container control object logic operatively configured to manage a specific key container associated with the portable-token device;

causing the container control object logic to further instantiate key pair control object logic operatively configured to manage individual key pairs provided by the portable-token device; and

causing at least one control object logic selected from a group of control object logic that includes the portable-token device control object logic, the container control object logic and the key pair control object logic to further instantiate certificate list object logic operatively configured to enumerate over a set of certificate objects associated with the at least one control object.

2. The interface method as recited in claim 1, wherein causing the processing unit within the machine to instantiate the portable-token device control object logic further includes instantiating a single portable-token device control object.

3. The interface method as recited in claim 2, wherein causing the portable-token device control object logic to further instantiate the container control object logic further includes instantiating one or more container control objects.

4. The interface method as recited in claim 3, wherein causing the container control object logic to further instantiate the key pair control object logic further includes instantiating one or more key pair control objects.

5. The interface method as recited in claim 4, wherein providing the certificate list object further includes instantiating the certificate list object from at least one control object selected from a set comprising the single portable-token device control object, the one or more container control objects, and the one or more key pair control objects.

6. The interface method as recited in claim 1, wherein the set of certificate objects includes evidentiary data and associated key data.

7. The interface method as recited in claim 6, wherein the evidentiary data includes digital certificate data.

8. The interface method as recited in claim 6, wherein the evidentiary data includes biometric data associated with a user.

9. The interface method as recited in claim 1, wherein the portable-token device includes a smart card.

10. The interface method as recited in claim 1, wherein the portable-token device control object logic, the container control object logic, the key pair control object logic, and the certificate list object logic are associated with portable-token device cryptographic server provider (CSP) logic configured to pass cryptographic data to one or more applications operatively configured to run on the processing unit.

11. A computer-readable medium having computer-executable instructions for performing acts comprising:

within a machine that is configurable to connect to at least one portable-token device, establishing a hierarchical object-based interface by

identifying when a portable-token device has been connected to the machine,

causing a processing unit within the machine to instantiate portable-token device control object logic operatively configured to manage the portable-token device,

causing the portable-token device control object logic to further instantiate container control object logic operatively configured to manage a specific key container associated with the portable-token device,

causing the container control object logic to further instantiate key pair control object logic operatively configured to manage individual key pairs provided by the portable-token device, and

causing at least one control object logic selected from a group of control object logic that includes the portable-token device control object logic, the container control object logic and the key pair control object logic to further instantiate certificate list object logic operatively configured to enumerate over a set of certificate objects associated with the at least one control object.

12. The computer-readable medium as recited in claim 11, wherein causing the processing unit within the machine to instantiate the portable-token device control object logic further includes instantiating a single portable-token device control object.

13. The computer-readable medium as recited in claim 12, wherein causing the portable-token device control object logic to further instantiate the container control object logic further includes instantiating one or more container control objects.

14. The computer-readable medium as recited in claim 13, wherein causing the container control object logic to further instantiate the key pair control object logic further includes instantiating one or more key pair control objects.

15. The computer-readable medium as recited in claim 11, wherein the set of certificate objects includes evidentiary data and associated key data.

16. The computer-readable medium as recited in claim 15, wherein the evidentiary data includes digital certificate data.

17. The computer-readable medium as recited in claim 15, wherein the evidentiary data includes biometric data associated with a user.

18. The computer-readable medium as recited in claim 11, wherein the portable-token device includes a smart card.

19. The computer-readable medium as recited in claim 11, wherein the portable-token device control object logic, the container control object logic, the key pair control object logic, and the certificate list object logic are associated with portable-token device cryptographic server provider (CSP) logic configured to pass cryptographic data to one or more applications operatively configured to run on the processing unit.