Virtual smart card system and method

• US 7,487,357 B2
• Filed: 06/21/2006
• Issued: 02/03/2009
• Est. Priority Date: 09/03/1999
• Status: Expired due to Fees

• Current Assignee: SafeNet Data Security (Israel) Ltd. (Thales SA)
• Original Assignee: Aladdin Knowledge Systems (Thales SA)
• Inventors: Levenberg, Richard, Smith, Lawrence
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/425,536
• Publication Number:
  US 20060248347A1
• Time in Patent Office: 958 Days
• Field of Search: None
• US Class Current: 713/176
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A public key authentication system and method for use in a computer system having a plurality of users. The system includes a virtual smart card server, storage connected to the virtual smart card server, and a virtual smart card agent connected to the virtual smart card server. The storage includes a plurality of virtual smart cards, wherein each virtual smart card is associated with a user and wherein each smart card includes a private key. The virtual smart card agent authenticates the user and accesses the authenticated user'"'"'s virtual smart card to obtain the user'"'"'s private key.

Claims

1. A public key authentication system for use in a computer system having a plurality of users, the system comprising:

an authentication server;

a directory service connected to the authentication server, wherein the directory service includes a plurality of public keys, wherein each public key is associated with a unique user identifier; and

a host system, wherein the host system includes a public key authentication client and an interface to a smart-card-enabled application, wherein the public key authentication client is connected to the authentication server;

wherein the public key authentication client receives a challenge issued by the authentication server in response to a user request by the host system, signs the challenge with a digital signature representing a user and sends the digital signature of the challenge back to the authentication server; and

wherein the authentication server receives the digital signature of the challenge and verifies the digital signature with the user'"'"'s public key retrieved from the directory service.

2. The public key authentication system according to claim 1, wherein the authentication server includes role-based access control.

3. The public key authentication system according to claim 1, wherein the authentication server includes automatic logging of authentication attempts.

4. A public key authentication method, comprising:

providing a plurality of public keys through a directory service, wherein providing includes associating each public key with a unique user;

receiving a user request from a host system;

sending a challenge to the host system in response to the user request;

receiving a digital signature of the challenge from the host system; and

verifying the received digital signature with a public key associated with the user, wherein verifying includes retrieving the public key associated with the user from the directory service.

5. The method according to claim 4, wherein verifying includes determining the level of service in response to the user request as a function of role-based access control.

6. The method according to claim 4, wherein verifying includes automatically logging authentication attempts.

7. A computer-readable medium including instructions that, when executed by a computer, cause the computer to perform:

providing a plurality of public keys through a directory service, wherein providing includes associating each public key with a unique user;

receiving a user request from a host system;

sending a challenge to the host system in response to the user request;

receiving a digital signature of the challenge from the host system; and

verifying the received digital signature with a public key associated with the user, wherein verifying includes retrieving the public key associated with the user from the directory service.

8. The medium according to claim 7, wherein verifying includes determining the level of service in response to the user request as a function of role-based access control.

9. The medium according to claim 7, wherein verifying includes automatically logging authentication attempts.