Virtual smart cards with audit capability
Virtual smart card system includes a virtual smart card server (VSS) which controls access to content respectively associated with a plurality of virtual smart cards. A remote client computer system includes a system level agent which establishes the client computer machine to the VSS as a trusted computer system. A user level agent at the client computer system responds to a request for a virtual smart card operation by causing the client computer system to obtain user authentication information, negotiate with the system level agent to obtain a cookie, and initiate a request to the VSS for the virtual smart card operation. The VSS will perform the virtual smart card operation provided that a security policy is satisfied and will communicate the results to the user level agent.
1. A method for controlling use of a private key in the context of a public key infrastructure (PKI) scheme, comprising:
storing a plurality of private keys respectively assigned to virtual smart cards in a secure data store which is accessible only to a virtual smart card server (VSS);
using a system level agent at a client computer machine remote from the VSS to initiate a machine authentication protocol of the client computer machine at the VSS to establish the client computer machine to the VSS as a trusted computer system;
in response to receiving a request for a private key operation at a user level agent of the client computer machine, obtaining a user authentication information from the user;
causing the user level agent to negotiate with the system level agent to obtain a cookie authorizing the private key operation from the VSS, prior to when the user is authenticated based on the user authentication information;
initiating a request from the user level agent to the VSS for a private key operation;
communicating the user authentication information and the cookie from the user level agent to the VSS as part of the request;
in response to the request, selectively performing at the VSS a private key operation requested by the user level agent using a private key assigned to one of the virtual smart cards issued to at least the user.
2. The method according to claim 1 , further comprising communicating the results of the private key operation from the VSS to the user level agent.
3. The method according to claim 2 , further comprising providing the results of the private key operation to an application program executing on said client computer machine.
4. The method according to claim 1 , further comprising receiving the request for the private key operation at the user level agent from an application program executing on the client computer machine.
5. The method according to claim 1 , further comprising limiting the use of the cookie at the VSS so that the cookie is valid only one time at the VSS for allowing the performance of the private key operation.
6. The method according to claim 1 , further comprising selecting the private key operation performed at the VSS to include generating a secured hash of signed or decrypted data which has been communicated to the VSS.
7. The method according to claim 1 , wherein the user authentication information is comprised of one or more elements selected from the group consisting of a password, a user biometric data, and data obtained from a physical smart card.
8. The method according to claim 7 , wherein the method further comprises capturing the user authentication information by using at least one of a biometric data capture device and smart card reader device.
9. The method according to claim 1 , further comprising selectively applying at the user level agent, the system level agent and the VSS a predetermined security policy determined in accordance with a particular private key for which use is being requested.
10. The method according to claim 1 , further comprising recording in a secure data log at the VSS information concerning each action requesting performance of a private key operation.
11. A method for controlling use of a private key in the context of a public key infrastructure (PKI) scheme, comprising:
storing a plurality of private keys respectively assigned to virtual smart cards in a secure data store which is accessible only to a virtual smart card server (VSS);
receiving at the VSS a request to establish a client computer machine remote from the VSS as a trusted computer system, said request initiated by a system level agent at the client computer machine in accordance with a predetermined machine authentication protocol;
receiving at the VSS a request for a cookie from the system level agent, prior to when a user of the client computer machine is authenticated;
providing the requested cookie to the system level agent;
receiving at the VSS a request from a user level agent for a private key operation, where the cookie and selected user authentication information obtained by the user level agent from the user comprise part of the request; and
in response to the request, selectively performing at the VSS the private key operation requested by the user level agent by using a private key assigned to one of the virtual smart cards issued to at least the user.
12. A virtual smart card system, comprising:
a first computer machine comprising a virtual smart card server (VSS) which controls access to content respectively associated with a plurality of virtual smart cards;
one or more second computer machines disposed remote from the VSS, each comprising a client computer system including a system level agent which initiates a machine authentication protocol of the client computer machine at the VSS to establish the client computer machine to the VSS as a trusted computer system;
a user level agent at the client computer system which receives a request for a virtual smart card operation initiated by at least one application program of the client computer machine;
wherein the user level agent is responsive to the request to cause the client computer system to
obtain from a user of the client computer system a user authentication information necessary to permit use of the virtual smart card operation;
negotiate with the system level agent to obtain a cookie from the VSS, prior to when the user is authenticated based on the user authentication information;
initiate a request to the VSS for performing the virtual smart card operation, and
communicate the user authentication information and the cookie to the VSS as part of the request; and
wherein the VSS is responsive to the request by selectively performing the virtual smart card operation if a security policy applicable to the requested virtual smart card operation is satisfied.
13. The virtual smart card system according to claim 12 , wherein the VSS is configured to communicate the results of the virtual smart card operation to the user level agent.
14. The virtual smart card system according to claim 13 , wherein the user level agent is configured to provide the results of the virtual smart card operation to the application program which initiated the request for the virtual smart card operation.
15. The virtual smart card system according to claim 12 , wherein the VSS is configured so that the cookie is valid for only a single virtual smart card operation at the VSS.
16. The virtual smart card system according to claim 12 , wherein the virtual smart card operation is a private key operation performed at the VSS, and the VSS is configured to generating a secured hash of signed or decrypted data which has been communicated to the VSS.
17. The virtual smart card system according to claim 12 , wherein the user authentication information is comprised of one or more elements selected from the group consisting of a password, a user biometric data, and data obtained from a physical smart card.
18. The virtual smart card system according to claim 17 , wherein the client computer system is configured to capture the user authentication information by using at least one of a biometric data capture device and smart card reader device.
19. The virtual smart card system according to claim 12 , wherein each of the user level agent, the system level agent and the VSS are configured to selectively apply a predetermined security policy determined in accordance with a particular virtual smart card for which use is being requested.
20. The virtual smart card system according to claim 12 , wherein the VSS is configured to record in a data log information concerning a plurality of events pertaining to each request for a virtual smart card operation.