Virtual smart card system and method

• US 7,890,767 B2
• Filed: 02/03/2009
• Issued: 02/15/2011
• Est. Priority Date: 09/03/1999
• Status: Expired due to Fees

• Current Assignee: SafeNet Data Security (Israel) Ltd.
• Original Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Inventors: Smith, Lawrence, Levenberg, Richard
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US12/364,742
• Publication Number:
  US 20090172407A1
• Time in Patent Office: 742 Days
• Field of Search: None
• US Class Current: 713/182
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A public key authentication system and method for use in a computer system having a plurality of users. The system includes a virtual smart card server, storage connected to the virtual smart card server, and a virtual smart card agent connected to the virtual smart card server. The storage includes a plurality of virtual smart cards, wherein each virtual smart card is associated with a user and wherein each smart card includes a private key. The virtual smart card agent authenticates the user and accesses the authenticated user'"'"'s virtual smart card to obtain the user'"'"'s private key.

Claims

1. A public key authentication system for use is a computer system having a plurality of users, the system comprising:

a virtual smart card agent;

storage including a plurality of virtual smart cards, wherein each virtual smart card includes a private key associated with a corresponding user; and

a virtual smart card server communicatively coupled to the virtual smart card agent and the storage, wherein the virtual smart card server authenticates a user in response to an authentication request received from the virtual smart card agent and accesses from the storage the virtual smart card of a successfully authenticated user to obtain the authenticated user'"'"'s private key.

2. The system of claim 1, wherein the virtual smart card agent includes an interface to a smart-card-enabled application.

3. The system of claim 1, wherein the virtual smart card server uses a one-time password to authenticate the user.

4. The system of claim 1, wherein the virtual smart card sever performs encryption in response to a remote call from the virtual smart card agent.

5. The system of claim 1, wherein the virtual smart card server performs signing in response to a remote call from the virtual smart card agent.

6. The system of claim 1, wherein the virtual smart card server performs key management functions in response to a remote call from the virtual smart card agent.

7. The system of claim 1, wherein the virtual smart card server includes an authentication server to perform the user authentication.

8. The system of claim 1, wherein the virtual smart card agent communicates with the virtual smart card server over an agent-server transport layer.

9. The system of claim 1, wherein the virtual smart card agent communicates with the virtual smart card server over a secure TCP/IP session.

10. In a system having a plurality of users, including a first user, a method of encrypting data, comprising:

assigning first and second keys to each user located at a client, wherein the first and second key form a public/private key pair;

issuing a digital certificate to the first user, wherein the digital certificate is associated with the second key assigned to the first user;

entering a one-time password;

encrypting the one-time password with the first key assigned to the first user to form an encrypted one-time password;

verifying that the digital certificate issued to the first user was signed by a recognized certificate authority;

accessing, via the digital certificate, the second key assigned to the first user;

decrypting the encrypted one-time password with the second key associated with the digital certificate to recover the one-time password;

authenticating the first user by comparing the decrypted one-time password to an expected one-time password; and

once authenticated, encrypting the data with the first key.

11. The method according to claim 10, wherein the first key is a private key and the second key is a public key.

12. The method according to claim 10, wherein verifying that the digital certificate issued to the first user was signed by a recognized certificate authority includes accessing a CRL to determine if the certificate has been revoked.

13. A computer-readable non-transitory storage medium comprising program code which executes the method of claim 10.