Virtual smart card system and method

1. A public key authentication system for use is a computer system having a plurality of users, the system comprising:

a virtual smart card agent;

storage including a plurality of virtual smart cards, wherein each virtual smart card includes a private key associated with a corresponding user; and

a virtual smart card server communicatively coupled to the virtual smart card agent and the storage, wherein the virtual smart card server authenticates a user in response to an authentication request received from the virtual smart card agent and accesses from the storage the virtual smart card of a successfully authenticated user to obtain the authenticated user's private key.

2. The system of claim 1 , wherein the virtual smart card agent includes an interface to a smart-card-enabled application.

3. The system of claim 1 , wherein the virtual smart card server uses a one-time password to authenticate the user.

4. The system of claim 1 , wherein the virtual smart card sever performs encryption in response to a remote call from the virtual smart card agent.

5. The system of claim 1 , wherein the virtual smart card server performs signing in response to a remote call from the virtual smart card agent.

6. The system of claim 1 , wherein the virtual smart card server performs key management functions in response to a remote call from the virtual smart card agent.

7. The system of claim 1 , wherein the virtual smart card server includes an authentication server to perform the user authentication.

8. The system of claim 1 , wherein the virtual smart card agent communicates with the virtual smart card server over an agent-server transport layer.

9. The system of claim 1 , wherein the virtual smart card agent communicates with the virtual smart card server over a secure TCP/IP session.

10. In a system having a plurality of users, including a first user, a method of encrypting data, comprising:

assigning first and second keys to each user located at a client, wherein the first and second key form a public/private key pair;

issuing a digital certificate to the first user, wherein the digital certificate is associated with the second key assigned to the first user;

entering a one-time password;

encrypting the one-time password with the first key assigned to the first user to form an encrypted one-time password;

verifying that the digital certificate issued to the first user was signed by a recognized certificate authority;

accessing, via the digital certificate, the second key assigned to the first user;

decrypting the encrypted one-time password with the second key associated with the digital certificate to recover the one-time password;

authenticating the first user by comparing the decrypted one-time password to an expected one-time password; and

once authenticated, encrypting the data with the first key.

11. The method according to claim 10 , wherein the first key is a private key and the second key is a public key.

12. The method according to claim 10 , wherein verifying that the digital certificate issued to the first user was signed by a recognized certificate authority includes accessing a CRL to determine if the certificate has been revoked.

13. A computer-readable non-transitory storage medium comprising program code which executes the method of claim 10 .