Controlling Access to a Process Using a Separate Hardware Device

• US 20090205030A1
• Filed: 02/02/2009
• Published: 08/13/2009
• Est. Priority Date: 03/03/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ong, Peng T.
• Granted Patent: US 8,850,558 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A method and apparatus for automatic user authentication are described. The method includes receiving information at a device, the device including a credential container; storing the information at the credential container and performing cryptographic calculations on the received information and providing the encrypted information upon request.

Claims

1-21. -21. (canceled)

22. A method for controlling access to a process to be executed on a data processing system, comprising:

detecting a coupling of a security device to the data processing system, wherein the security device is a separate hardware device from the data processing system and stores a plurality of authentication data items for a plurality of processes that are executable on the data processing system, wherein each authentication data item is stored in the security device in association with an indicator of a corresponding process in the plurality of processes;

identifying the process to be executed on the data processing system;

retrieving, from the security device, an authentication data item that is associated with the identified process to be executed on the data processing system; and

injecting the retrieved authentication data item into the identified process.

23. The method of claim 22, wherein each authentication data item of the plurality of authentication data items comprises a user identifier and a password associated with a corresponding process to be executed on the data processing system.

24. The method of claim 22, wherein:

the security device stores a setup program that executes in response to coupling the security device to the data processing system,

the setup program determines if an access agent is installed on the data processing system, and

if an access agent is determined to not be installed on the data processing system, the setup program initiates an operation through which the data processing system retrieves the access agent from a remote computing device identified by the security device and installs the access agent on the data processing system.

25. The method of claim 22, wherein each authentication data item comprises an access script defining a set of operations to be played back to automatically authenticate a user to a corresponding process.

26. The method of claim 22, wherein the process to be executed is the application, and wherein injecting the retrieved authentication data item into the identified process comprises injecting the authentication data item into a login process associated with the application to automatically authenticate a user to the application.

27. The method of claim 26, wherein injecting the authentication data item into the login process further comprises:

in response to the user attempting to access the application, determining whether an access script exists for the application in the security device; and

playing back the access script to thereby inject the user authentication data into a login process of the application in response to determining that an access script exists for the application.

28. The method of claim 27, wherein, if an access script does not exist for the application, the access agent captures logon information entered by the user and stores the logon information as authentication data in the security device.

29. The method of claim 22, further comprising:

automatically capturing user authentication data input by a user into the data processing system for a corresponding process;

automatically converting the user authentication data into a stronger form of user authentication data to be presented to the corresponding process; and

automatically storing the stronger form of user authentication data in the security device as an authentication data item associated with a corresponding process.

30. The method of claim 29, wherein automatically converting the user authentication data into a stronger form of user authentication data comprises at least one of automatically generating a longer password by adding alpha-numeric characters into a password of the user authentication data or generating a random password to be used instead of a password in the user authentication data.

31. The method of claim 29, wherein automatically converting the user authentication data into a stronger form of user authentication data is performed without the user being aware of the conversion.

32. The method of claim 22, wherein the security device stores a trusted host list identifying remote computing devices with which the security device may operate, and wherein use of the security device is limited to processes associated with only remote computing devices identified in the trusted host list.

33. The method of claim 22, wherein the security device comprises a physical feature for allowing a user to manually input the user'"'"'s authentication for the security device to inject the authentication data item into the process, and wherein the security device only injects the authentication data item in response to a physical interaction by the user with the physical feature of the security device.

34. The method of claim 22, wherein the security device comprises a display, and wherein the display presents information about the process to be executed on the computing system.

35. A security device, comprising:

a first storage device that stores a plurality of authentication data items for a plurality of processes that are executable on a computing device, wherein each authentication data item is stored in the first storage device in association with an indicator of a corresponding process in the plurality of processes;

a communication controller through which the computing device accesses the authentication data items stored in the first storage device; and

an application program interface through which the computing device may access security device services, wherein the application program interface provides an authentication data item, from the first storage, to the computing device via the communication controller in response to an identification of a process, corresponding to the authentication data item, that is to be executed on the computing device, and wherein the computing device injects the authentication data item received from the security device into the process to be executed on the computing device.

36. The security device of claim 35, further comprising:

a second storage device to store software drivers and non-sensitive data.

37. The security device of claim 36, wherein the second storage devices stores a software driver to install an access agent, from a remote server, on the computing device in response to a determination that the computing device does not already have the access agent installed.

38. The security device of claim 36, wherein the second storage device stores, at a time of manufacturing of the security device, information about the security device comprising at least one of serial number of the security device, color of the security device, physical form of the security device, manufacturer identifier, or date of manufacture.

39. The security device of claim 35, further comprising:

a cryptographic processor that performs a cryptographic calculation based on information stored in the first storage device.

40. The security device of claim 35, further comprising:

a physical feature that is able to be manipulated by a user to manually input the user'"'"'s authentication for the security device to provide the authentication data item to the computing device, and wherein the security device only provides the authentication data item to the computing device in response to a physical interaction by the user with the physical feature of the security device.

41. The security device of claim 35, wherein the security device comprises a display, and wherein the display presents information about the process to be executed on the computing device.