Virtual smartcard authentication
AssigneeEntersekt International Limited
InventorsChristiaan Johannes Petrus BRAND, Albertus Stefanus VAN TONDER
Life of this patent
Estimating the term…
Abstract
The invention provides a system and method for signing a user workstation onto an access restricted network utilising a mobile communication device. The method includes receiving a sign-on request from a mobile communication device of a user of the network, looking up a user certificate included in the sign-on request in an enrolment database and retrieving identifiers relating to the user, the workstation and network from the database, and transmitting a sign-on command to an authentication driver operating on the workstation, in response to which the authentication driver negotiates a sign-on operation of the workstation onto the network.
Claims13
A network sign-on system for use in an access restricted network comprising:
- a public key infrastructure (“PKI”) provider operable to issue digital certificates to mobile communication devices;
- an authentication server in data communication with an enrolment database, the enrolment database containing records pairing digital user certificates with one or more of user, workstation and network identifiers;
- at least one workstation configured to access the network, the workstation having a unique workstation identifier associated with it and an authentication driver operating on it;
- and at least one mobile communication device associated with a user of the network having a unique digital user certificate installed on it which was previously issued to it by the PKI provider, wherein:
- the authentication server is operable to receive a sign-on request including the digital user certificate of the mobile communication device from the mobile communication device, to authenticate the mobile communication device using the digital user certificate, to look up one or more of a user, workstation and network identifier in the enrolment database contained in a record associated with the digital user certificate, and to transmit a sign-on command to the authentication driver operating on the workstation identified by the workstation identifier;
- and
- the authentication driver is operable to, upon receipt of the signon command from the authentication server, sign the workstation onto the network through the authentication server, utilizing public key encryption with the digital user certificate of the mobile communication device.
A method of signing a user workstation onto an access restricted network, the method being conducted at an authentication server and comprising the steps of
- receiving a sign-on request including a digital user certificate associated with a mobile communication device of a user of the network, the request having been initiated from the mobile communication device and the digital user certificate having previously been issued to the mobile communication device by a public key infrastructure (PKI) provider;
- looking up the user certificate in an enrolment database and retrieving one or more of a user identifier of the user, a workstation identifier and a network identifier of the workstation and network onto which the user wishes to sign;
- and
- transmitting a sign-on command to an authentication driver operating on the workstation identified by means of the workstation identifier in respect of a user identified by means of the user identifier, in response to which the authentication driver negotiates a sign-on operation of the workstation onto the network.
Dependencies are inferred from the claim text.