Partitioning data on a smartcard dependent on entered password

• US 8,161,546 B2
• Filed: 02/28/2007
• Issued: 04/17/2012
• Est. Priority Date: 02/28/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Parkinson, Steven W., Lord, Robert
• Primary Examiner(s): Zee, Edward
• Application Number:
  US11/712,634
• Publication Number:
  US 20080209574A1
• Time in Patent Office: 1,875 Days
• Field of Search: 726/9, 726/20, 726 26- 28, 713/173, 713/193, 713/194, 713/185
• US Class Current: 726/20
• CPC Class Codes: G06Q 20/3572 Multiple accounts on card
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1066 PIN data being compared to data on card

Abstract

In one embodiment, an apparatus and method for partitioning data on a smartcard dependent on an entered password are disclosed. In one embodiment, the method includes maintaining multiple containers in a smartcard, associating a different personal identification number (PIN) with each of the multiple containers, and accessing contents of a container when an associated PIN for the container is provided by a user of the smartcard. Other embodiments are also described.

Claims

1. A method, comprising:

managing, in a smartcard, multiple containers at each of a plurality of modules on the smartcard;

associating a different personal identification number (PIN) with each of the multiple containers of each of the modules of the plurality of modules;

receiving a PIN and an identifier of a module of the plurality of modules from a computer coupled with the smartcard, the PIN being provided by a user and the identifier of the module provided by the computer; and

comparing, by the identified module, the PIN provided by the user against PINs associated with the multiple containers of the identified module;

when the PIN provided by the user matches the PIN associated with a container of the multiple containers of the identified module, allowing access rights to contents of the container having the matching PIN.

2. The method of claim 1, wherein each container of the multiple containers of each of the modules of the plurality of modules stores information associated with a different identity of the user.

3. The method of claim 2, wherein the different identities includes at least one of a home user identity and a work user identity.

4. The method of claim 1, wherein a first container of the multiple containers of each of the modules of the plurality of modules includes an identification certificate and its associated private key, while a second container of the multiple containers of each of the modules of the plurality of modules includes an attribute certificate associated with the identification certificate.

5. The method of claim 4, wherein the first and second containers are accessed by different PINs.

6. The method of claim 1, wherein the allowing access further includes hiding an existence of the multiple containers of each of the modules of the plurality of modules from the user.

7. The method of claim 1, wherein a program executing on the smartcard is an applet that performs a matching algorithm to determine whether the PIN provided by the user can access a container of the multiple containers of each of the modules of the plurality of modules.

8. The method of claim 7, wherein the smartcard includes more than one applet, each applet associated with a different functionality of the smartcard.

9. An apparatus for a smartcard, comprising:

a memory included in the smartcard;

a processing device communicably coupled to the memory; and

a plurality of applets executable from the memory by the processing device, each applet configured to;

manage a plurality of containers that are stored in the memory, each container of the plurality of containers having a different personal identification number (PIN) associated with the container that is used to access content of the container;

receive a PIN and an identifier of the applet, the PIN provided by a user from a computer coupled with the smartcard and the identifier of the applet provided by the computer;

determine whether the PIN provided by the user matches any of the different PINs of the plurality of containers of the identified applet; and

when the PIN provided by the user matches the PIN associated with a container of the plurality of containers of the identified applet, allow access to the contents of the container having the matching PIN.

10. The apparatus of claim 9, wherein each container of the plurality of containers stores information associated with a different identity of the user.

11. The apparatus of claim 10, wherein the different identities includes at least one of a home user identity and a work user identity.

12. The apparatus of claim 9, wherein a container of the plurality of containers includes an identification certificate and its associated private key, while another container of the plurality of containers includes an attribute certificate associated with the identification certificate.

13. The apparatus of claim 9, wherein each applet is further configured to hide an existence of the plurality of containers from the user.

14. The apparatus of claim 9, wherein each applet performs a matching algorithm to determine whether the PIN provided by the user can access a container of the plurality of containers.

15. The apparatus of claim 14, wherein each applet of the plurality of applets is associated with a different functionality of the smartcard.

16. A non-transitory machine-readable storage medium including data that, when accessed by a machine, cause the machine to perform operations comprising:

managing, in a smartcard, multiple containers at each of a plurality of modules on the smartcard;

associating a different personal identification number (PIN) with each of the multiple containers of each of the modules of the plurality of modules;

receiving a PIN and an identifier of a module of the plurality of modules from a computer coupled with the smartcard, the PIN being provided by a user and the identifier of the module provided by the computer; and

comparing, by the identified module, the PIN provided by the user against PINs associated with the multiple containers of the identified module;

when the PIN provided by the user matches the PIN associated with a container of the multiple containers of the identified module, allowing access rights to contents of the container having the matching PIN.

17. The non-transitory machine-readable storage medium of claim 16, wherein each container of the multiple containers of each of the modules of the plurality of modules stores information associated with a different identity of the user.

18. The non-transitory machine-readable storage medium of claim 16, wherein a container of the multiple containers of each of the modules of the plurality of modules includes an identification certificate and its associated private key, while another container of the multiple containers of each of the modules of the plurality of modules includes an attribute certificate associated with the identification certificate.

19. The non-transitory machine-readable storage medium of claim 16, wherein the allowing access further includes hiding an existence of the multiple containers of each of the modules of the plurality of modules from the user.

20. The non-transitory machine-readable storage medium of claim 16, wherein a program executing on the smartcard is an applet that performs a matching algorithm to determine whether the PIN provided by the user can access a container of the multiple containers of each of the modules of the plurality of modules.