Off-host authentication system
View Patent ↗An off-host authentication system includes an authentication information handling system (IHS) that is coupled to a network. The off-host authentication system also includes a host processing system. An off-host processing system in the off-host authentication system is coupled to the host processing system and is coupled to the authentication IHS through the network. The off-host processing system provides an encrypted primary authentication item to the authentication IHS through the network. The off-host processing system then receives an encrypted secondary authentication token from the authentication IHS through the network. The off-host processing system then decrypts the encrypted secondary authentication token to produce a decrypted secondary authentication token and uses the decrypted secondary authentication token to retrieve a tertiary authentication token. The off-host processing system then provides the tertiary authentication token to the host processing system for use in logging a user into a user IHS that includes the host processing system.
1. An off-host authentication system, comprising:
an authentication information handling system (IHS) that is coupled to a network;
a host processing system;
an off-host processing system that is coupled to the host processing system and that is coupled to the authentication IHS through the network, wherein the off-host processing system is configured to:
receive an authentication credential input from a user;
encrypt the authentication credential input to produce an encrypted authentication credential input;
provide the encrypted authentication credential input to the authentication IHS through the network;
receive an encrypted secondary authentication token from the authentication IHS through the network, wherein the encrypted secondary authentication token is sent by the authentication IHS through the network in response to decrypting the encrypted authentication credential input to retrieve the authentication credential input and validating the authentication credential input;
decrypt the encrypted secondary authentication token to produce a decrypted secondary authentication token and use the decrypted secondary authentication token to retrieve a tertiary authentication token; and
provide the tertiary authentication token to the host processing system; and
wherein at least one of the authentication IHS, the host processing system, and the off-host processing system utilizes a hardware processor.
2. The system of claim 1 , wherein the encrypted authentication credential input includes the authentication credential input that is encrypted by the off-host processing system with a user IHS private key and an authentication IHS public key, and wherein the authentication IHS is configured to decrypt the encrypted authentication credential input with an authentication IHS private key and a user IHS public key.
3. The system of claim 1 , wherein the encrypted secondary authentication token includes an authentication token that is encrypted by the authentication IHS with an authentication IHS private key and a user IHS public key, and wherein the off-host processor is configured to decrypt the encrypted secondary authentication token with an user IHS private key and an authentication IHS public key.
4. The system of claim 1 , further comprising:
a network controller system that couples the off-host processing system to the network, wherein the network controller is configured to forward the encrypted authentication credential input from the off-host processing system to the authentication IHS through the network, and wherein the network controller is configured to forward the encrypted secondary authentication token from the authentication IHS to the off-host processing system.
5. The system of claim 4 , further comprising:
an embedded controller system that couples the off-host processing system to the network controller, wherein the embedded controller system is configured to forward the encrypted authentication credential input from the off-host processing system to the network controller, and wherein the embedded controller system is configured to forward the encrypted secondary authentication token from the network controller to the off-host processing system.
6. An information handling system (IHS), comprising:
an IHS host processing system;
a network controller; and
an off-host processing system that is coupled to the IHS host processing system and the network controller, wherein the off-host processing system is configured to:
receive an authentication credential input from a user;
encrypt the authentication credential input to produce an encrypted authentication credential input;
provide the encrypted authentication credential input to an authentication IHS through the network controller, wherein the encrypted authentication credential input is configured to cause the authentication IHS to decrypt the encrypted authentication credential input to retrieve the authentication credential input, validated the authentication credential input and, in response, send an encrypted secondary authentication token to the off-host processing system through the network;
receive the encrypted secondary authentication token from the authentication IHS through the network controller;
decrypt the encrypted secondary authentication token to produce a decrypted secondary authentication token and use the decrypted secondary authentication token to retrieve a tertiary authentication token; and
provide the tertiary authentication token to the IHS host processing system; and
wherein at least one of the IHS host processing system and the off-host processing system utilizes a hardware processor.
7. The IHS of claim 6 , wherein the encrypted authentication credential input includes the authentication credential input that is encrypted by the off-host processing system with a user IHS private key and an authentication IHS public key, and wherein the authentication IHS is configured to decrypt the encrypted authentication credential input with an authentication IHS private key and a user IHS public key.
8. The IHS of claim 6 , wherein the encrypted secondary authentication token includes an authentication token that is encrypted by the authentication IHS with an authentication IHS private key and a user IHS public key, and wherein the off-host processor is configured to decrypt the encrypted secondary authentication token with an user IHS private key and an authentication IHS public key.
9. The IHS of claim 6 , further comprising:
an embedded controller system that couples the off-host processing system to the network controller, wherein the embedded controller system is configured to forward the encrypted authentication credential input from the off-host processing system to the network controller, and wherein the embedded controller system is configured to forward the encrypted secondary authentication token from the network controller to the off-host processing system.
10. The IHS of claim 6 , further comprising:
an IHS chassis, wherein the IHS host processing system and the off-host processing system are each located in the IHS chassis.
11. A method for providing off-host authentication, comprising:
receiving, by an off-host processing system, an authentication credential input from a user;
encrypting, by the off-host processing system, the authentication credential input to produce an encrypted authentication credential input;
providing, by the off-host processing system, the encrypted authentication credential input to an authentication IHS through a network;
decrypting, by the authentication IHS, the encrypted authentication credential input;
validating, by the authentication IHS, the authentication credential input and, in response, sending an encrypted secondary authentication token to the off-host processing system through the network;
receiving, by the off-host processing system, the encrypted secondary authentication token from the authentication IHS through the network;
decrypting, by the off-host processing system, the encrypted secondary authentication token to produce a decrypted secondary authentication token and using the decrypted secondary authentication token to retrieve a tertiary authentication token; and
providing, by the off-host processing system, the tertiary authentication token to a host processing system; and
wherein at least one of the off-host processing system and the authentication IHS utilizes a hardware processor.
12. The method of claim 11 , wherein the encrypted authentication credential input includes the authentication credential input that is encrypted by the off-host processing system with a user IHS private key and an authentication IHS public key, and wherein the authentication IHS decrypts the encrypted authentication credential input with an authentication IHS private key and a user IHS public key.
13. The method of claim 11 , wherein the encrypted secondary authentication token includes an authentication token that is encrypted by the authentication IHS with an authentication IHS private key and a user IHS public key, and wherein the off-host processor decrypts the encrypted secondary authentication token with an user IHS private key and an authentication IHS public key.
14. The method of claim 11 , further comprising:
forwarding, by an embedded controller system, the encrypted authentication credential input from the off-host processing system to a network controller;
forwarding, by the network controller, the encrypted authentication credential input from the embedded controller system to the authentication IHS through the network,
forwarding, by the network controller, the encrypted secondary authentication token from the authentication IHS to the embedded controller system; and
forwarding, by the embedded controller system, the encrypted secondary authentication token from the network controller to the off-host processing system.