Guided enrollment and login for token users

• US 9,769,158 B2
• Filed: 06/07/2006
• Issued: 09/19/2017
• Est. Priority Date: 06/07/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Kwan, Nang Kon, Magne, John
• Primary Examiner(s): King, John B
• Application Number:
  US11/448,158
• Publication Number:
  US 20080005339A1
• Time in Patent Office: 4,122 Days
• Field of Search: 726 9, 726 10, 726 20, 713182-184, 705 64- 67
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

Embodiments of the present invention provide an automated process for enrolling and logging in with a token. In particular, a security client detects when the user has inserted their token. In response, the security client then notifies the enterprise security system and provides information about the token. The enterprise security system performs a profile lookup and authorizes use of the token.

Claims

1. A method comprising:

detecting a presence of a token by a security client;

receiving, by the security client, an input parameter associated with the token;

sending, by the security client to a token management system, the input parameter and a card identification associated with the token, wherein the card identification uniquely identifies the token;

selecting, by a processor of the token management system, a first token enrollment profile of a plurality of profiles in view of the input parameter and the card identification, the first token enrollment profile defining a plurality of aspects to enable enrollment of the token; and

enrolling the token, by the token management system, in view of the plurality of aspects defined by the first token enrollment profile, without user input to perform the enrollment, wherein the enrollment of the token comprises obtaining a token certificate from a certificate authority identified in view of the token enrollment profile.

2. The method of claim 1, wherein receiving the input parameter comprises receiving an input that confirms a request to enroll the token.

3. The method of claim 1, wherein receiving the input parameter comprises receiving information that identifies a user.

4. The method of claim 1, wherein receiving the input parameter comprises receiving a password.

5. The method of claim 1, wherein the plurality of aspects of the enrollment of the token comprise two or more of a number of keys to generate on the token, a token label, or connection information between an applicable certificate authority, data recovery manager, or token key service associated with the security client.

6. A system comprising:

a memory to store a first token enrollment profile; and

a processor operatively coupled to the memory, the processor to;

detect a presence of a token by a security client executed by the processor;

receive, by the security client, an input parameter associated with the token;

send, by the security client to a token management system, the input parameter and a card identification associated with the token, wherein the card identification uniquely identifies the token;

select, by the token management system, the first token enrollment profile of a plurality of profiles in view of the input parameter and the card identification, the first token enrollment profile defining a plurality of aspects to enable enrollment of the token; and

enroll the token, by the token management system, in view of the plurality of aspects defined by the first token enrollment profile, without user input to perform the enrollment, wherein the enrollment of the token comprises obtaining a token certificate from a certificate authority identified in view of the token enrollment profile.

7. The system of claim 6, wherein the plurality of aspects of the enrollment of the token comprise two or more of a number of keys to generate on the token, a token label, or connection information between an applicable certificate authority, data recovery manager, or token key service associated with the security client.

8. A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to:

detect a presence of a token by a security client executed by the processor;

receive, by the security client, an input parameter associated with the token;

send, by the security client to a token management system, the input parameter and a card identification associated with the token, wherein the card identification uniquely identifies the token;

select, by the token management system, the first token enrollment profile of a plurality of profiles in view of the input parameter and the card identification, the first token enrollment profile defining a plurality of aspects to enable enrollment of the token; and

enroll the token, by the token management system, in view of the plurality of aspects defined by the first token enrollment profile, without user input to perform the enrollment, wherein the enrollment of the token comprises obtaining a token certificate from a certificate authority identified in view of the token enrollment profile.

9. The non-transitory computer readable medium of claim 8, wherein the plurality of aspects of the enrollment of the token comprise two or more of a number of keys to generate on the token, a token label, or connection information between an applicable certificate authority, data recovery manager, or token key service associated with the security client.