Virtual smart cards with audit capability

A method for controlling use of a private key in the context of a public key infrastructure (PKI) scheme, comprising:

• storing a plurality of said private keys in a secure data store which is accessible only to a virtual smart card server (VSS);
• receiving at the VSS a request to establish a client computer machine remote from the VSS as a trusted computer system, said request initiated by a system level agent at the client computer machine in accordance with a predetermined machine authentication protocol;
• receiving at the VSS a request for a cookie from the system level agent, the request having been generated in response to receiving a demand for a private key operation at a user level agent of the client computer machine;
• providing the requested cookie to the system level agent;
• receiving at the VSS a request from the user level agent for a private key operation;
• receiving from the user level agent the cookie which was previously provided to the system level agent, and selected user authentication information obtained by the user level agent from a user in response to the demand for the private key operation;
• in response to the request, selectively performing at the VSS a private key operation requested by the user level agent by using a private key assigned to the user.

A virtual smart card system, comprising:

• a first computer machine comprising a virtual smart card server (VSS) which controls access to content respectively associated with a plurality of virtual smart cards;
• one or more second computer machines disposed remote from the VSS, each comprising a client computer system including a system level agent which initiates a machine authentication protocol of the client computer machine at the VSS to establish the client computer machine to the VSS as a trusted computer system;
• a user level agent at the client computer system which receives a request for a virtual smart card operation initiated by at least one application program of the client computer machine;
• wherein the user level agent is responsive to the request to cause the client computer system to
• obtain from a user of the client computer system a user authentication information necessary to permit use of the virtual smart card operation;
• negotiate with the system level agent to obtain a cookie from the VSS;
• initiate a request to the VSS for performing the virtual smart card operation, and
• communicate the user authentication information and the cookie to the VSS;
• and
• wherein the VSS is responsive to the request by selectively performing the virtual smart card operation if a security policy applicable to the requested virtual smart card operation is satisfied.