Granted Patent B2

US 8,683,562 · App. 13/363,771 · Granted Mar 25, 2014

Abstract

Claims (34)

1. A client computer configured for authenticating a user to a secure resource, the computer comprising:

a processor;

a client-resident credential-management module, executable by the processor, for obtaining from a secure memory token one or more limited-lifespan user-authentication credentials specific to the secure resource from among a plurality of credentials stored on the secure memory token;

a communications module, facilitating communications over a computer network, for receiving a user-access form of the secure resource; and

a client-resident single-sign-on agent, executable by the processor, for providing the at least one resource-specific limited-lifespan user-authentication credential to the user-access form and causing transmission thereof via the communications module to thereby accord user access to the secure resource;

wherein the client-resident credential-management module authenticates the user based on authentication credentials stored on the client computer.

2. The computer of claim 1 further comprising a reader, in operative communication with the credential-management module, wherein the client-resident credential-management module is configured to interrogate the secure memory token via the reader.

3. The system of claim 2 wherein the secure memory token comprises a contactless smartcard.

4. The system of claim 2 wherein interrogation of the secure memory token comprises writing user-authentication credentials received from a server-resident password manager to the secure memory token.

5. The computer of claim 1 wherein the communications module is configured to facilitate communications over a computer network between the client-resident credential-management module and a server-resident password manager that administers the limited-lifespan authentication credentials.

6. The system of claim 1 wherein the secure memory token comprises one or more secure memory areas each associated with one of a plurality of secure applications.

7. The system of claim 1 wherein the one or more limited lifespan user-authentication credentials comprise one or more of a password, a user identifier, or a biometric credential.

8. The system of claim 7 wherein the one or more limited lifespan user-authentication credentials comprise a plurality of one-time passwords generated by the server-resident password manager.

9. The system of claim 1 wherein the single-sign-on agent facilitates automated log-on of the user to a plurality of applications by means of the one or more limited-lifespan user-authentication credentials obtained by the reader.

10. A method for authenticating a user to a secure resource using a secure memory token, the method comprising:

storing, on the memory token, a plurality of limited-lifespan user-authentication credentials for presentation to a plurality of different secure resources;

locally interrogating the secure memory token upon presentation thereof by the user to a client device;

authenticating the user's identity;

locally detecting the user's request for access to a remote secure resource;

retrieving, from the secure memory token, at least one valid limited-lifespan user-authentication credential specific to the remote secure resource for which the access request was detected;

locally receiving a user-access form of the requested remote secure resource; and

automatically populating the user-access form of the remote secure resource with the limited-lifespan user-authentication credential, thereby permitting user access to the remote secure resource.

11. The method of claim 10 further comprising replenishing the secure memory token with additional limited-lifespan user-authentication credentials.

12. The method of claim 11 wherein the secure memory token is replenished based on comparing a number of remaining valid credentials stored on the token to a minimum credential threshold.

13. The method of claim 10 wherein the automatic population step comprises:

detecting, at the client device, receipt via a computer network of browser-renderable instructions encoding a log-on screen; and

at the client device, injecting the one or more of the limited-lifespan user-authentication credentials received from the secure memory token into the log-on screen, and submitting the log-on screen to its source.

14. The method of claim 10 wherein the user's identity is authenticated based on a user-authentication credential stored on the secure memory token.

15. The method of claim 10 wherein the user's identity is authenticated locally.

16. The method of claim 10 wherein the user's identity is authenticated remotely according to steps comprising:

remotely receiving the limited-lifespan user-authentication credential and a user identifier;

determining whether the limited-lifespan user-authentication credential could have been generated for the user, and if so, authenticating the user's identity.

17. The method of claim 16 further comprising validating, by communication between a local resource and a remote resource, that the limited-lifespan user-authentication credential has not already been used.

18. The method of claim 10 further comprising decrypting the limited-lifespan user-authentication credential prior to using the limited-lifespan user-authentication credential to populate the user-access form.

Assignments (8)