This invention generally relates to secure client-server systems. More particularly, the invention relates to a method and system secure shared smartcard access to a secure client.
Computer security is a field of computer science concerned with the control of risks related to use of computer systems. In computer security, authentication is a process of determining whether a computer, a software application, or a user is, in fact, what or who it is declared to be.
An example of user authentication is a user credential, such as a user name and password. Requirements for user credentials may be different among multiple software applications, which complicate a user's access to multiple software applications during the same work session. For example, healthcare workers may use healthcare-related applications, such as clinical results reporting, physician order entry, and chart completion, and may use general-purpose software applications, such as e-mail, time and attendance, accounting, human resources self-service, and incident reporting.
Single sign-on (SSO) is a specialized form of software authentication that enables a computer, a computer program, or a user to authenticate once, and gain access to multiple software applications and/or multiple computer systems. For example, in a client/server environment, SSO is a session/user authentication process that permits a user to present one set of credentials at one time in order to access multiple software applications. The SSO credentials, which is requested at the initiation of the session, authenticates the user to access the software applications on the server that have been given access rights, and eliminates future authentication prompts when the user switches between software applications during a particular session. Examples of SSO or reduced signon systems include: enterprise single sign-on (E-SSO), web single sign-on (Web-SSO), Kerberos, and others.
E-SSO, also called legacy single sign-on, after primary user authentication, intercepts log-on prompts presented by secondary applications, and automatically fills in fields such as a log-on ID or password. E-SSO systems allow for interoperability with software applications that are unable to externalize user authentication, essentially through “screen scraping.” However, E-SSO requires cooperation among computers in the enterprise, and is sometimes referred to as enterprise reduced sign-on.
Although E-SSO is a solution in enterprises that have a single type of authentication scheme, primarily the ID/password. However, secure enterprise systems typically have multiple log-in systems such as a trusted patch authenticated smart card or a biometric based log-in system. The E-SSO solution cannot operate in these multiple log-in systems because the E-SSO solution has no direct access to the authentication information.
In some instances, a user may log-on to a secure machine with a smart card in the secure multi-user environment. A problem may arise if a second user logs into the secure machine with the first user's smart card inserted. One goal would be to prevent the second user from pretending to be the first user and causing havoc. However, this has to be balanced with the burden of requiring a user to enter a personal identification number to access each application in a session. The issue then becomes how to authenticate to a smart card once as a user and allow other people to use the smart card for other operations. More generally, how to share a log-in state with trusted applications.
An embodiment generally relates to a method of accessing a secure computer. The method includes capturing an authentication state of a security token in response to a verification of user authentication information. The method also includes using the authentication state to provide authenticated services for the at least one application requiring authentication with the security token and accessing the at least one application.
Another embodiment generally pertains to a system for secure access. The system includes a computing machine configured to access a multi-user multi-machine system and a security device interface with the computing machine. The security device is configured to accept a security token for accessing the computing machine. The system also includes a security daemon configured to be executing on the computing machine. The security daemon is configured to initiate a session and capture an authentication state of a security token in response to a verification of user inputted authentication information. The security daemon may also bind the authentication state to the session.
Various features of the embodiments can be more fully appreciated as the same become better understood with reference to the following detailed description of the embodiments when considered in connection with the accompanying figures, in which:
For simplicity and illustrative purposes, the principles of the present invention are described by referring mainly to exemplary embodiments thereof. However, one of ordinary skill in the art would readily recognize that the same principles are equally applicable to, and can be implemented in, all types of secure distributed environments and that any such variations do not depart from the true spirit and scope of the present invention. Moreover, in the following detailed description, references are made to the accompanying figures, which illustrate specific embodiments. Electrical, mechanical, logical and structural changes may be made to the embodiments without departing from the spirit and scope of the present invention. The following detailed description is, therefore, not to be taken in a limiting sense and the scope of the present invention is defined by the appended claims and their equivalents.
Embodiments pertain generally to a method of sharing a security token among applications within a session. More particularly, a user may insert a security token, such as a smart card, into a secure computing machine and begin logging into the secure machine. An application may detect the presence of the inserted smart card and prompt the user to begin the log-on process. The user may authenticate to the security daemon, which then authenticate to the security token with the user entered authentication information. The security daemon may be configured to capture the authentication state and represent the authenticated security token to other applications in the session. In other words, the security daemon would log into the token, keep the token logged in and then use the fact that it has the token opened and logged in to perform operations on behalf of the user. As a result, the security daemon appears to the rest of the processes in the session that the security token is inserted through a Public Key Cryptography Standard (PKCS) #11 interface. Applications that require authentication may query the security daemon for authentication using the same PKCS #11 calls as they do in conventional smart card systems. Moreover, the security daemon may “own” the representation of the security token being inserted, i.e., the authentication state, by locking access to the card. As a result, other processes and/or applications cannot co-opt the authentication state in tokens that do not hold separate authentication states for different processes such as those defined in the PIV standards.
Other embodiments relate to accessing remote computers. More specifically, the security daemon provides a mechanism for secure shell (ssh) access to remote computing machines. More particularly, a local machine may securely connect to the remote machine using ssh protocols. The ssh application may advertise a PKCS #11 port that receives PKCS #11 calls on the remote client. During the authentication process, the remote computer may pass queries for authentication through the advertised port over the secured connection between the local and remote machines. The queries are directed to the security daemon, which presents the authentication state to the remote machine. After authentication, a user has access to the resources on the remote computer as though the user was physically logged-on in at the remote computer.
As shown in
The server 105 may interact with the clients over the local network 115. The local network 115 may be a local area network implementing an established network protocol such as Ethernet, token ring, FDDI, etc. The local network 115 provides a communication channel for the server 105 and clients 110 to exchange data and commands.
The clients 110 may be computing machine or platform (machine) configured to execute secure and open applications through the multi-user operating system. The clients 110 may be implemented with personal computers, workstations, thin clients, thick clients, or other similar computing platform.
Each client 110 may be configured to interface with a security device 120. The security device 120 may be configured to act as a gatekeeper to the client 110. More particularly, a user may use a security token, such as a smart card, to access the respective client 110. Each client 110 may have a security daemon 125 executing to monitor the security device 120, which is illustrated in
As shown in
The OS 205 may also interface with an application program interface (labeled as API in
Returning to
The secure system 100 may also comprise a second network 130 that may be interfaced with local network 115. A remote client 110′ may be connected with the second network 130. The remote client 110′ may be similar to client 110 with a security device 120′. The security device 120′ may also function as a gatekeeper to the remote client 110′. Accordingly, a user may remote login to the remote client 110′ from one of the client 110 using secure shell (ssh) protocols. SSH protocols are well-known to those skilled in the art. During the remote log-in, the client 110 may create a secure connection using ssh protocols to connect with the remote client 110′. The ssh application may be configured to publish the PKCS #11 port of the client computer 110 to the remote client 110′. The remote client 110′ may forward authentication queries through the PKCS #11 port over the secure connection to the client 110. The security daemon 125 on the client 110 presents its authentication state to answer the authentication queries of the remote client 110′. Since the user of client 110 is a valid user, the remote client 110′ may grant access to the client 110 as though the user was logged on at the remote client 110′. This process may also be used to remote access client 110 from another client 110.
As shown in
In step 310, the security daemon 125 may be configured to detect the presence of the security token (i.e., a smart card, PIV smart card, etc.) in the security device 120. The security daemon 125 may then be configured to prompt the user to begin log-on, in step 310. More particularly, the security daemon 125 may prompt the user for authentication information such as personal identification number (PIN), a password or biometric parameter (retinal scan, fingerprint, etc) or enter the same into some trusted patch device. The security daemon 125 may display a dialog box to requesting the user for the authentication information.
In step 320, the security daemon 125 may be configured to pass the user authentication information to the security token for verification or to request that the token read the authentication information from it's trusted path. If the security token fails to verify, the authentication information, in step 325, the security daemon 125 may be configured to inform the user of the verification failure. In some embodiments, the security daemon 125 may prompt the user to re-enter the authentication information in step 315. Alternatively, the security daemon 125 may inform the user that verification failed and return to the idle state of step 305. Alternatively, the security token may detect too many failed attempts to authenticate and the security daemon 125 may be configured to inform the user that the security token is locked.
Otherwise, if the authentication information is verified, in step 325, the security daemon 125 may be configured to capture and hold the authentication state of the inserted security token, in step 335. More specifically, this may be done by holding a PKCS #11 session open and attaching the security token with which the security daemon 125 could perform additional requests against the security token. The security daemon 125 may then represent itself as the authenticated security token to other applications through a PKCS #11 interface. In other words, the security daemon 125 appears to the rest of the processes in the session that the security token is inserted.
In step 340, the security daemon 125 may be configured to bind the authentication state with the current session state of the user. More particularly, in the situation where an application requests requests an initial authentication of the smart card. The application may initially authenticate to the security daemon 125 with some user session mechanism (usually something initialized at login) that does not involve user action (i.e., application authentication). The security daemon 125 would present that authentication information on behalf of the user for that application. Typical implementations of application authentication would include passing magic cookies, environment variables, file descriptors, shared memory segments, etc. to child processes of the parent session, using OS access controls, etc. If an application is part of the session, the security daemon 125 may be configured to implement the steps of
As shown in
In step 410, as part of the instantiation of the secure application 210, the secure application 210 may be configured to query the security device 120 to determine whether the user has privileges to execute the secure application 210. Typically, secure applications 210 execute a call to the PKCS #11 interface. For these embodiments, the PKCS #11 interface may be connected to the security daemon 125.
In step 415, the secured application 210 call to the PKCS #11 interface may be answered by the security daemon 125, which holds the authentication state of the security token. The PKCS #11 interface returns a message that the security token is inserted and begins verification between the secure application 210 and the security daemon 125.
If verification fails, in step 420, the secure application 210 may display a dialog message informing that access to the secure application is denied, in step 425. Otherwise, if verification is successful, in step 420, the secure application 215 continues to instantiate and the user is granted access, in step 430.
As shown in
In step 510, the ssh application may be configured to form a secure connection from the client 110 to the remote client. Once connected to the remote computer, the two clients may begin authentication.
In step 515, the client 110 may receive authentication queries from the remote client over the secure connection. More specifically, the remote client may execute a call to the PKCS #11 interface which is forwarded to the PKCS #11 interface of the security daemon 125 on the client 110.
In step 520, the forwarded call to the PKCS #11 interface may be answered by the security daemon 125, which holds the authentication state of the security token. The PKCS #11 interface returns a message that the security token is inserted to the remote client and begins verification between the remote client and the security daemon 125.
If verification fails, in step 525, the remote client may display a dialog message informing that access is denied, in step 530. Otherwise, if verification is successful, in step 525, the remote client may grant access to the client computer, in step 535.
As shown in
Certain embodiments may be performed as a computer program. The computer program may exist in a variety of forms both active and inactive. For example, the computer program can exist as software program(s) comprised of program instructions in source code, object code, executable code or other formats; firmware program(s); or hardware description language (HDL) files. Any of the above can be embodied on a computer readable medium, which include storage devices and signals, in compressed or uncompressed form. Exemplary computer readable storage devices include conventional computer system RAM (random access memory), ROM (read-only memory), EPROM (erasable, programmable ROM), EEPROM (electrically erasable, programmable ROM), and magnetic or optical disks or tapes. Exemplary computer readable signals, whether modulated using a carrier or not, are signals that a computer system hosting or running the present invention can be configured to access, including signals downloaded through the Internet or other networks. Concrete examples of the foregoing include distribution of executable software program(s) of the computer program on a CD-ROM or via Internet download. In a sense, the Internet itself, as an abstract entity, is a computer readable medium. The same is true of computer networks in general.
While the invention has been described with reference to the exemplary embodiments thereof, those skilled in the art will be able to make various modifications to the described embodiments without departing from the true spirit and scope. The terms and descriptions used herein are set forth by way of illustration only and are not meant as limitations. In particular, although the method has been described by examples, the steps of the method may be performed in a different order than illustrated or simultaneously. Those skilled in the art will recognize that these and other variations are possible within the spirit and scope as defined in the following claims and their equivalents.
Number | Name | Date | Kind |
---|---|---|---|
4108367 | Hannan | Aug 1978 | A |
4849614 | Watanabe et al. | Jul 1989 | A |
4924330 | Seamons et al. | May 1990 | A |
5247163 | Ohno et al. | Sep 1993 | A |
5355414 | Hale et al. | Oct 1994 | A |
5499371 | Henninger et al. | Mar 1996 | A |
5594227 | Deo | Jan 1997 | A |
5631961 | Mills et al. | May 1997 | A |
5666415 | Kaufman | Sep 1997 | A |
5721781 | Deo et al. | Feb 1998 | A |
5745576 | Abraham et al. | Apr 1998 | A |
5745678 | Herzberg et al. | Apr 1998 | A |
5768373 | Lohstroh et al. | Jun 1998 | A |
5862310 | Crawford et al. | Jan 1999 | A |
5923884 | Peyret et al. | Jul 1999 | A |
5937006 | Gennaro et al. | Aug 1999 | A |
5943423 | Muftic | Aug 1999 | A |
5991411 | Kaufman et al. | Nov 1999 | A |
5991882 | O'Connell | Nov 1999 | A |
6005942 | Chan et al. | Dec 1999 | A |
6005945 | Whitehouse | Dec 1999 | A |
6011847 | Follendore, III | Jan 2000 | A |
6016476 | Maes et al. | Jan 2000 | A |
6044155 | Thomlinson et al. | Mar 2000 | A |
6072876 | Obata et al. | Jun 2000 | A |
6141420 | Vanstone et al. | Oct 2000 | A |
6178507 | Vanstone | Jan 2001 | B1 |
6179205 | Sloan | Jan 2001 | B1 |
6226744 | Murphy et al. | May 2001 | B1 |
6377825 | Kennedy et al. | Apr 2002 | B1 |
6490680 | Scheidt et al. | Dec 2002 | B1 |
6502108 | Day et al. | Dec 2002 | B1 |
6539093 | Asad et al. | Mar 2003 | B1 |
6636975 | Khidekel et al. | Oct 2003 | B1 |
6643701 | Aziz et al. | Nov 2003 | B1 |
6687190 | Momich et al. | Feb 2004 | B2 |
6691137 | Kishi | Feb 2004 | B1 |
6698654 | Zuppicich | Mar 2004 | B1 |
6734886 | Hagan et al. | May 2004 | B1 |
6760752 | Liu et al. | Jul 2004 | B1 |
6804687 | Sampson | Oct 2004 | B2 |
6819766 | Weidong | Nov 2004 | B1 |
6826686 | Peyravian | Nov 2004 | B1 |
6829712 | Madoukh | Dec 2004 | B1 |
6880037 | Boyer | Apr 2005 | B2 |
6880084 | Brittenham et al. | Apr 2005 | B1 |
6898605 | Constantino | May 2005 | B2 |
6898714 | Nadalin et al. | May 2005 | B1 |
6931133 | Andrews et al. | Aug 2005 | B2 |
6941326 | Kadyk et al. | Sep 2005 | B2 |
6970970 | Jung et al. | Nov 2005 | B2 |
6978933 | Yap et al. | Dec 2005 | B2 |
6986040 | Kramer et al. | Jan 2006 | B1 |
7007105 | Sullivan et al. | Feb 2006 | B1 |
7010600 | Prasad et al. | Mar 2006 | B1 |
7050589 | Kwan | May 2006 | B2 |
7051213 | Kobayashi et al. | May 2006 | B1 |
7085386 | Audebert et al. | Aug 2006 | B2 |
7114028 | Green et al. | Sep 2006 | B1 |
7156302 | Yap et al. | Jan 2007 | B2 |
7159763 | Yap et al. | Jan 2007 | B2 |
7185018 | Archbold et al. | Feb 2007 | B2 |
7251728 | Toh et al. | Jul 2007 | B2 |
7278581 | Ong | Oct 2007 | B2 |
7299364 | Noble et al. | Nov 2007 | B2 |
7302585 | Proudler et al. | Nov 2007 | B1 |
7356688 | Wang | Apr 2008 | B1 |
7374099 | de Jong | May 2008 | B2 |
7386705 | Low et al. | Jun 2008 | B2 |
7437757 | Holdsworth | Oct 2008 | B2 |
7451921 | Dowling et al. | Nov 2008 | B2 |
7475250 | Aull et al. | Jan 2009 | B2 |
7475256 | Cook | Jan 2009 | B2 |
7480384 | Peyravian et al. | Jan 2009 | B2 |
7502793 | Snible et al. | Mar 2009 | B2 |
7571321 | Appenzeller et al. | Aug 2009 | B2 |
7602910 | Johansson et al. | Oct 2009 | B2 |
7702917 | Tevosyan et al. | Apr 2010 | B2 |
7769996 | Randle et al. | Aug 2010 | B2 |
7822209 | Fu et al. | Oct 2010 | B2 |
7860243 | Zheng et al. | Dec 2010 | B2 |
20010008012 | Kausik | Jul 2001 | A1 |
20010036276 | Ober et al. | Nov 2001 | A1 |
20010054148 | Hoornaert et al. | Dec 2001 | A1 |
20020004816 | Vange et al. | Jan 2002 | A1 |
20020007351 | Hillegass et al. | Jan 2002 | A1 |
20020007359 | Nguyen | Jan 2002 | A1 |
20020010679 | Felsher | Jan 2002 | A1 |
20020029343 | Kurita | Mar 2002 | A1 |
20020056044 | Andersson | May 2002 | A1 |
20020059144 | Meffert et al. | May 2002 | A1 |
20020064095 | Momich et al. | May 2002 | A1 |
20020080958 | Ober et al. | Jun 2002 | A1 |
20020099727 | Kadyk et al. | Jul 2002 | A1 |
20020112156 | Gien et al. | Aug 2002 | A1 |
20020120842 | Bragstad et al. | Aug 2002 | A1 |
20020133707 | Newcombe | Sep 2002 | A1 |
20020171546 | Evans et al. | Nov 2002 | A1 |
20020184149 | Jones | Dec 2002 | A1 |
20020188848 | Buttiker | Dec 2002 | A1 |
20030005291 | Burn | Jan 2003 | A1 |
20030012386 | Kim et al. | Jan 2003 | A1 |
20030028664 | Tan et al. | Feb 2003 | A1 |
20030035548 | Kwan | Feb 2003 | A1 |
20030056099 | Asanoma et al. | Mar 2003 | A1 |
20030075610 | Ong | Apr 2003 | A1 |
20030093695 | Dutta | May 2003 | A1 |
20030115455 | Aull et al. | Jun 2003 | A1 |
20030115466 | Aull et al. | Jun 2003 | A1 |
20030115467 | Aull et al. | Jun 2003 | A1 |
20030115468 | Aull et al. | Jun 2003 | A1 |
20030167399 | Audebert et al. | Sep 2003 | A1 |
20030172034 | Schneck et al. | Sep 2003 | A1 |
20040042620 | Andrews et al. | Mar 2004 | A1 |
20040053642 | Sandberg et al. | Mar 2004 | A1 |
20040066274 | Bailey | Apr 2004 | A1 |
20040088562 | Vassilev et al. | May 2004 | A1 |
20040096055 | Williams et al. | May 2004 | A1 |
20040103324 | Band | May 2004 | A1 |
20040103325 | Priebatsch | May 2004 | A1 |
20040120525 | Miskimmin et al. | Jun 2004 | A1 |
20040144840 | Lee et al. | Jul 2004 | A1 |
20040146163 | Asokan et al. | Jul 2004 | A1 |
20040153451 | Phillips et al. | Aug 2004 | A1 |
20040162786 | Cross et al. | Aug 2004 | A1 |
20040230831 | Spelman et al. | Nov 2004 | A1 |
20050022123 | Constantino | Jan 2005 | A1 |
20050033703 | Holdsworth | Feb 2005 | A1 |
20050109841 | Ryan et al. | May 2005 | A1 |
20050114673 | Raikar et al. | May 2005 | A1 |
20050119978 | Ates | Jun 2005 | A1 |
20050123142 | Freeman et al. | Jun 2005 | A1 |
20050136390 | Adams et al. | Jun 2005 | A1 |
20050138386 | Le Saint | Jun 2005 | A1 |
20050144312 | Kadyk et al. | Jun 2005 | A1 |
20050184163 | de Jong | Aug 2005 | A1 |
20050184164 | de Jong | Aug 2005 | A1 |
20050184165 | de Jong | Aug 2005 | A1 |
20050188360 | de Jong | Aug 2005 | A1 |
20050216732 | Kipnis et al. | Sep 2005 | A1 |
20050262361 | Thibadeau | Nov 2005 | A1 |
20050279827 | Mascavage et al. | Dec 2005 | A1 |
20050289652 | Sharma et al. | Dec 2005 | A1 |
20060005028 | Labaton | Jan 2006 | A1 |
20060010325 | Liu et al. | Jan 2006 | A1 |
20060015933 | Ballinger et al. | Jan 2006 | A1 |
20060036868 | Cicchitto | Feb 2006 | A1 |
20060043164 | Dowling et al. | Mar 2006 | A1 |
20060072747 | Wood et al. | Apr 2006 | A1 |
20060073812 | Punaganti Venkata et al. | Apr 2006 | A1 |
20060075133 | Kakivaya et al. | Apr 2006 | A1 |
20060075486 | Lin et al. | Apr 2006 | A1 |
20060101111 | Bouse et al. | May 2006 | A1 |
20060101506 | Gallo et al. | May 2006 | A1 |
20060173848 | Peterson et al. | Aug 2006 | A1 |
20060174104 | Crichton et al. | Aug 2006 | A1 |
20060206932 | Chong | Sep 2006 | A1 |
20060208066 | Finn et al. | Sep 2006 | A1 |
20060226243 | Dariel | Oct 2006 | A1 |
20060291664 | Suarez et al. | Dec 2006 | A1 |
20060294583 | Cowburn et al. | Dec 2006 | A1 |
20070014416 | Rivera et al. | Jan 2007 | A1 |
20070074034 | Adams et al. | Mar 2007 | A1 |
20070112721 | Archbold et al. | May 2007 | A1 |
20070113267 | Iwanski et al. | May 2007 | A1 |
20070113271 | Pleunis | May 2007 | A1 |
20070118891 | Buer | May 2007 | A1 |
20070162967 | de Jong et al. | Jul 2007 | A1 |
20070169084 | Frank et al. | Jul 2007 | A1 |
20070189534 | Wood et al. | Aug 2007 | A1 |
20070204333 | Lear et al. | Aug 2007 | A1 |
20070230706 | Youn | Oct 2007 | A1 |
20070271601 | Pomerantz | Nov 2007 | A1 |
20070280483 | Fu | Dec 2007 | A1 |
20070282881 | Relyea | Dec 2007 | A1 |
20070283163 | Relyea | Dec 2007 | A1 |
20070283427 | Gupta et al. | Dec 2007 | A1 |
20070288745 | Kwan | Dec 2007 | A1 |
20070288747 | Kwan | Dec 2007 | A1 |
20080005339 | Kwan | Jan 2008 | A1 |
20080019526 | Fu | Jan 2008 | A1 |
20080022086 | Ho | Jan 2008 | A1 |
20080022088 | Fu et al. | Jan 2008 | A1 |
20080022121 | Fu et al. | Jan 2008 | A1 |
20080022122 | Parkinson et al. | Jan 2008 | A1 |
20080022128 | Proudler et al. | Jan 2008 | A1 |
20080034216 | Law | Feb 2008 | A1 |
20080046982 | Parkinson | Feb 2008 | A1 |
20080056496 | Parkinson | Mar 2008 | A1 |
20080059790 | Parkinson | Mar 2008 | A1 |
20080059793 | Lord et al. | Mar 2008 | A1 |
20080069338 | Relyea | Mar 2008 | A1 |
20080069341 | Relyea | Mar 2008 | A1 |
20080072283 | Relyea | Mar 2008 | A1 |
20080077794 | Arnold et al. | Mar 2008 | A1 |
20080077803 | Leach et al. | Mar 2008 | A1 |
20080133514 | Relyea | Jun 2008 | A1 |
20080148047 | Appenzeller et al. | Jun 2008 | A1 |
20080189543 | Parkinson | Aug 2008 | A1 |
20080209224 | Lord | Aug 2008 | A1 |
20080209225 | Lord | Aug 2008 | A1 |
20080229401 | Magne | Sep 2008 | A1 |
20090003608 | Lee et al. | Jan 2009 | A1 |
20090133107 | Thoursie | May 2009 | A1 |
20100313027 | Taylor | Dec 2010 | A1 |
Number | Date | Country |
---|---|---|
9724831 | Jul 1997 | WO |
0048064 | Mar 2000 | WO |
2007096590 | Aug 2007 | WO |
Number | Date | Country | |
---|---|---|---|
20070277032 A1 | Nov 2007 | US |