Two-factor authentication of a remote administrator

• US 7,971,238 B2
• Filed: 08/21/2006
• Issued: 06/28/2011
• Est. Priority Date: 08/21/2006
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Liu, Gang, Pan, Weimin
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US11/465,945
• Publication Number:
  US 20080046967A1
• Time in Patent Office: 1,772 Days
• Field of Search: 726/2, 726/9, 713182-183
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273

Abstract

An information handling system includes a processor, system memory, and a remote access resource that includes a virtual card reader enabled to establish a communication channel between the remote access resource and a remote card reader to communicate smart card reader access requests and response between them. The system may include an authentication module requiring two factor authentication including userid/password authentication and a physical card authentication. The communication channel enables remote physical card authentication. The resource further supports redirection of system console traffic enabling remote userid/password authentication. The virtual card reader is preferably operable to download a virtual card reader client to a remote management station to which the smart card reader is attached. The remote access resource may be operable to direct console traffic of the system to the remote management station to display a system login screen on the remote management station.

Claims

1. A system, comprising:

an information handling system comprising;

a processor and system memory accessible to the processor;

a remote access controller coupled to the processor, wherein the remote access controller includes a virtual card reader; and

a management station communicatively coupled to the information handling system, wherein the management station is remotely located from the information handling system, and wherein the management station comprises a physical card reader configured to read a physical card;

wherein when a connection between the information handling system and the management station is established, the remote access controller is configured to;

provide a virtual card reader client to the management station;

establish a connection between the virtual card reader of the information handling system and the virtual card reader client on the management station;

locate the physical card reader of the management station via the established connection; and

receive, from the virtual card reader client, a card insertion command that emulates insertion of a virtual card into the virtual card reader in response to insertion of the physical card into the physical card reader; and

wherein the virtual card reader is configured to receive information from the physical card via the physical card reader and the established connection between the virtual card reader client and the virtual card reader, in response to receiving the card insertion command.

2. The system of claim 1, wherein the information handling system includes an authentication module requiring two factor authentication including userid/password authentication and a physical card authentication and further wherein the established connection enables remote physical card authentication.

3. The system of claim 2, wherein the remote access controller is further configured to support redirection of system console traffic enabling remote userid/password authentication.

4. The system of claim 1, wherein the remote access controller is further configured to direct console traffic of the system to the management station to display a system login screen on the management station.

5. The system of claim 1, wherein the remote access controller is communicatively coupled to a service processor resource by an IPMI connection.

6. A computer program product comprising computer executable instructions, stored on a computer readable medium, for enabling remote authentication to a server using a remote access controller of the server, the instructions comprising:

instructions for establishing a connection between the server and a management station remotely coupled to the server, the management station comprising a physical card reader, the server including a virtual card reader;

instructions for providing a virtual card reader client to the management station;

instructions for establishing a connection between the virtual card reader of the server and the virtual card reader client on the management station;

instructions for locating the physical card reader of the management station via the established connection;

instructions for emulating insertion of a virtual card into the virtual card reader upon receiving, from the virtual card reader client, a card insertion command generated in response to insertion of a physical card into the physical card reader; and

instructions for receiving information at the virtual card reader from the physical card via the physical card reader and the established connection between the virtual card reader client and the virtual card reader, in response to emulating insertion of the virtual card.

7. The computer program product of claim 6, wherein the instructions for emulating insertion of a virtual card comprise a Ctrl Alt Del sequence.

8. The computer program product of claim 6, further comprising instructions for detecting a removal of the physical card from the physical card reader.

9. The computer program product of claim 8, further comprising instructions for responding to said removal by closing the established connection.

10. The computer program product of claim 6, further comprising instructions for providing a web server.

11. A remote access controller for use in an information handling system comprising:

a processing unit;

a memory communicatively coupled to the processing unit; and

processing instructions encoded in the memory, the processing instructions when executed by the processing unit being operable to;

provide a virtual card reader client to a management station remotely coupled to the information handling system, the management station comprising a physical card reader, the information handling system including a virtual card reader;

establish a connection between the virtual card reader of the information handling system and the virtual card reader client on the management station;

locate the physical card reader of the management station via the established connection; and

emulate insertion of a virtual card into the virtual card reader upon receiving, from the virtual card reader client, a card insertion command generated in response to insertion of a physical card into the physical card reader;

wherein the virtual card reader information handling system is configured to receive information from the physical card reader via the physical card reader and the established connection between the virtual card reader client and the virtual card reader, in response to emulating insertion of the virtual card.

12. The remote access controller of claim 11, wherein the established connection is suitable to communicate smart card reader access requests and responses between the remote access controller and the physical card reader.

13. The remote access controller of claim 11, wherein the remote access controller supports two factor authentication including userid/password authentication and a physical card authentication and further wherein the established connection enables remote physical card authentication.

14. The remote access controller of claim 13, wherein the remote access controller further supports redirection of system console traffic enabling remote userid/password authentication.

15. The remote access controller of claim 11, wherein the processing instructions are further operable to direct console traffic of the information handling system to the management station to display a system login screen on the management station.