Secure user authentication to computing resource via smart card

• US 6,834,795 B1
• Filed: 06/29/2001
• Issued: 12/28/2004
• Est. Priority Date: 06/29/2001
• Status: Expired due to Fees

• Current Assignee: Netscape Communications Corporation (Apollo Global Management, Inc.), Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Netscape Communications Corporation (Apollo Global Management, Inc.), Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Rasmussen, Brian, Harmsen, Matthew
• Primary Examiner(s): Le, Thien M.
• Assistant Examiner(s): Labaze, Edwyn
• Application Number:
  US09/895,510
• Time in Patent Office: 1,278 Days
• Field of Search: 235/380, 235/375, 235/382, 235/485, 235/487, 235/492, 713/200, 713/176, 713/182, 713/161, 713/167, 713/168, 713/169, 713/170, 713/171, 713/183, 713/201, 713/180, 380/30, 380/277, 380/279, 711/164, 707/9
• US Class Current: 235/380
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3558 Preliminary personalisation for transfer to user
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A simplified user authentication to a computer resource utilizing a smart card. When a new user is issued a smart card, he or she is also issued a user name (ID) and password to be used during a first use to activate the smart card. The user then connects the smart card and enters the user ID and password. The user is authenticated using the user ID and password and identifying information from the smart card. The network administration server then requests a public key from the workstation. The workstation instructs the smart card to generates public and private key. The public key is transmitted to the server. A digital certificate is created the smart card is activated. Once the smart card is activated a simplified login procedure can be used wherein connecting the smart card to a workstation initiates a login process not requiring use of a PIN number or other user input.

Claims

1. A method of activating a smart card, comprising:

receiving identifying information for a non-activated smart card that is being used for the first time by a user;

receiving manual authentication information for the user to whom the non-activated smart card has been issued;

authenticating the user and the non-activated smart card using the identifying information and the manual authentication information;

obtaining a public key from the non-activated smart card; and

issuing a digital certificate that is generated using the public key, wherein the non-activated smart cart is activated upon receiving the digital certificate.

2. The method according to claim 1, wherein the manual authentication information comprises a user identifier and a password.

3. The method according to claim 1, further comprising obtaining the digital certificate from a certificate authority.

4. The method according to claim 1, wherein the smart card is connected to a workstation.

5. The method according to claim 1, wherein the digital certificate is stored in at least one of the activated smart card and a workstation.

6. The method according to claim 1, further comprising:

receiving a login request that is initiated when the activated smart card is connected to a workstation;

authenticating the activated smart card using the digital certificate; and

if authenticated, permitting a login to a computer resource.

7. The method according to claim 6, wherein the activated smart card is removed from the workstation after it is authenticated.

8. The method according to claim 6, wherein authenticating the activated smart card further comprises determining that the digital certificate has not been revoked.

9. A method of activating a smart card, comprising:

sending, to an administration server, identifying information read from a non-activated smart card that has not been previously used by a user to whom the non-activated smart card has been issued;

sending, to the administration server, manual authentication information input by the user;

generating a public key using the non-activated smart card;

sending the public key to the administration server; and

receiving a digital certificate that is generated using the public key, wherein the non-activated smart card is activated upon receipt of the digital certificate.

10. The method according to claim 9, wherein the manual authentication information comprises a user identifier and a password.

11. The method according to claim 9, further comprising receiving the digital certificate from a certificate authority.

12. The method according to claim 9, wherein the smart card is connected to a workstation.

13. The method according to claim 9, further comprising storing the digital certificate in at least one of the activated smart card and a workstation.

14. The method according to claim 9, further comprising:

connecting the activated smart card to a workstation;

sending a login request to a server that authenticates the digital certificate against a certificate revocation list; and

if authenticated, permitting a login to a computer resource.

15. The method according to claim 14, wherein the activated smart card is removed from the workstation after the digital certificate is sent.

16. The method according to claim 14, wherein the server determines that the digital certificate has not been revoked.

17. A method of activating a smart card then using an activated smart card, comprising:

on first use of a non-activated smart card by a user to whom the non-activated smart card has been issued;

receiving identifying information for the non-activated smart card;

receiving manual identification information for the user;

authenticating the user and the non-activated smart card using the manual authentication information and the identifying information;

obtaining a public key from the non-activated smart card; and

sending a digital certificate generated using the public key from a certificate authority to the non-activated smart card, wherein the non-activated smart card is activated upon receiving the digital certificate; and

on a subsequent use of the smart card;

receiving a login request that is initiated when the activated smart card is connected to a workstation;

authenticating the digital certificate against a certificate revocation list to determine that the digital certificate has not been revoked; and

if authenticated, permitting a login to a computer resource.

18. The method according to claim 17, wherein the activated smart card is connected to a workstation and removed from the workstation after it is authenticated.

19. The method according to claim 17, wherein the digital certificate is stored in at least one of the activated smart card and a workstation.