PKI Smart Card Access Control for Shared Kiosk Accounts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems operating in 'kiosk' or 'tactical' modes, which use shared accounts, face challenges in securely identifying and authorizing multiple users due to the limitations of Public Key Infrastructure (PKI) with digital certificates on smart cards, particularly in environments requiring heightened security and continuous operation.
Innovation Solution
A software application that secures access to tactical applications by displaying restricted user interfaces, intercepting user input, and logging user activities to ensure only authorized users can access the system, integrating with operating system logs to provide comprehensive audit trails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI with digital certificates on smart cards is used for user identification, then security is improved, but the system cannot support shared group accounts required for kiosk and tactical modes
Solution Approach 1:
The patent segments the authentication process into two independent layers: (1) group-level authentication using digital certificates on smart cards for authorized access to the shared account, and (2) individual user identification through separate user profiles and activity logging. This allows the system to maintain PKI security while supporting multiple users under a single group account, resolving the contradiction between security and shared account support.
2Reliability
If separate user accounts are created for each user with PKI, then security is improved, but continuous system operation and resource sharing are compromised
Solution Approach 1:
The patent merges multiple individual user identities under a single group account that authenticates via PKI. The group account serves as a container for multiple user profiles, allowing the system to maintain continuous operation and share resources while still tracking individual user activities. This combining approach enables both security through PKI and productivity through uninterrupted system availability.
3Reliability
If the system locks or logs out upon card removal, then security is improved, but user experience and system availability deteriorate
Solution Approach 1:
The patent implements dynamic session management where the system adapts its behavior based on the authentication context. When a smart card is removed, the system does not immediately lock or log out; instead, it dynamically transitions to a shared account mode that allows continued access for authorized users. This dynamic approach maintains security while significantly improving ease of operation and user experience in kiosk and tactical environments.
4Measurement precision
If individual user accounts with separate logins are used, then user identification is improved, but audit trail complexity and system complexity increase
Solution Approach 1:
The patent introduces an intermediary layer consisting of user profiles and activity logging mechanisms that operate within the shared group account context. This intermediary structure enables precise tracking of individual user activities and maintains detailed audit trails without requiring separate complex account structures for each user. The intermediary layer simplifies the overall system architecture while maintaining precise user identification and accountability.
Data Source
AI summary
A system, method, and computer program to implement Public Key Infrastructure (“PKI”)-based access controls on a computing device independently of the operating system's user identification and authorization system. A software application on a standalone, non-networked computing device detects a “smart card” with a PKI certificate identifying the card holder. The identity of the card holder is verified against a registry stored on the computing device separately from the operating system's user identification and authorization system. Verification of the identity of the card holder results in setting the state of the computer system as “authorized” or “unauthorized.” In the unauthorized state, user input and viewing of information is prevented. The software application may thus identify individual smart card holders and provide secure access to data and resources, and track authorized and unauthorized access on computing devices that must remain in an “always logged in” state.