Off-host authentication system
View Patent ↗An off-host authentication system includes a network. An off-host processing system is coupled to the network and sends an encrypted authentication item through the network in response to validating a user. An authentication information handling system (IHS) is coupled to the network and receives the encrypted authentication item from the off-host processing system through the network, decrypts the encrypted authentication item to produce a decrypted authentication item, validates the decrypted authentication item, and sends an approval message through the network. A directory system is coupled to the network and receives the approval message through the network and, in response, sends a user approval through the network. A host processing system, which is located in a user IHS that includes the off-host processing system and which is coupled to the network, logs a user into the user IHS in response to receiving the user approval through the network.
1. An off-host authentication system, comprising:
a network;
an off-host processing system that is coupled to the network and that is configured to send an encrypted authentication item through the network in response to validating a user;
an authentication information handling system (IHS) that is coupled to the network and that is configured to receive the encrypted authentication item from the off-host processing system through the network, decrypt the encrypted authentication item to produce a decrypted authentication item, validate the decrypted authentication item, and send an approval message through the network;
a directory system that is coupled to the network and that is configured to receive the approval message directly from the authentication IHS through the network and, in response, send a user approval that includes an authentication token through the network; and
a host processing system that is located in a user IHS that includes the off-host processing system, wherein the host processing system is coupled to the network and configured to log a user into the user IHS in response to receiving the user approval through the network from the directory system; and
wherein at least one of the off-host processing system, the authentication IHS, the directory system, and the host processing system utilizes a hardware processor.
2. The system of claim 1 , further comprising:
a network controller system that couples the off-host processing system to the network, wherein the network controller is configured to forward the encrypted authentication item to the authentication IHS through the network.
3. The system of claim 2 , further comprising:
an embedded controller system that couples the off-host processing system to the network controller, wherein the embedded controller system is configured to forward the encrypted authentication item from the off-host processing system to the network controller.
4. The system of claim 1 , wherein the encrypted authentication item includes an authentication item that is encrypted by the off-host processing system with a user IHS private key and an authentication IHS public key, and wherein the authentication IHS is configured to decrypt the encrypted authentication item with an authentication IHS private key and a user IHS public key.
5. A user information handling system (IHS), comprising:
a user IHS chassis;
a first network controller that is housed in the user IHS chassis;
an off-host processing system that is housed in the user IHS chassis and that is coupled to the first network controller, wherein the off-host processing system is configured to provide an encrypted authentication item to an authentication IHS over a network through the first network controller in response to validating a user, and wherein the encrypted authentication item is configured to cause the authentication IHS to send an approval message through the network;
a second network controller that is housed in the user IHS chassis; and
a host processing system that is housed in the user IHS chassis and that is coupled to the second network controller, wherein the host processing system is configured to log a user into an operating system in response to receiving a user approval that includes an authentication token from a directory system, wherein the user approval is sent by the directory system over the network in response to receiving the approval message directly from the authentication IHS; and
wherein at least one of the off-host processing system and the host processing system utilizes a hardware processor.
6. The IHS of claim 5 , further comprising:
an embedded controller system that couples the off-host processing system to the first network controller, wherein the embedded controller system is configured to forward the encrypted authentication item from the off-host processing system to the first network controller.
7. The IHS of claim 5 , further comprising:
wherein the encrypted authentication item includes an authentication item that is encrypted by the off-host processing system with a user IHS private key and an authentication IHS public key, and wherein the authentication IHS is configured to decrypt the encrypted authentication item with an authentication IHS private key and a user IHS public key.
8. The IHS of claim 5 , wherein the encrypted authentication item includes user IHS information.
9. A method for providing off-host authentication, comprising:
sending, by an off-host processing system, an encrypted authentication item through a network in response to validating a user;
receiving, by an authentication IHS, the encrypted authentication item from the off-host processing system through the network and, in response, decrypting the encrypted authentication item to produce a decrypted authentication item, validating the decrypted authentication item, and sending an approval message through the network;
receiving, by a directory system, the approval message directly from the authentication IHS through the network and, in response, sending a user approval that includes an authentication token through the network; and
logging, by a host processing system, a user into the user IHS in response to receiving the user approval through the network from the directory system; and
wherein at least one of the off-host processing system, the authentication IHS, the directory system, and the host processing system utilizes a hardware processor.
10. The method of claim 9 , further comprising:
forwarding, by an embedded controller, the encrypted authentication item from the off-host processing system to a network controller; and
forwarding, by the network controller, the encrypted authentication item to the authentication IHS through the network.
11. The method of claim 9 , further comprising:
encrypting, by the off-host processing system, an authentication item with a user IHS private key and an authentication IHS public key to produce the encrypted authentication item; and
decrypting, by the authentication IHS, the encrypted authentication item with an authentication IHS private key and a user IHS public key.