Virtual Smart Card Logon Reducing Authentication Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote computing environments face challenges with slow smart card authentication due to high latency in connections between servers and clients, and clients often do not receive full domain privileges during logon.
Innovation Solution
Implementing a method for fast smart card logon that reduces interactions between the server and client by using a virtual smart card credential, which can be ephemeral and issued based on external authentication events, allowing single sign-on without PIN transmission over networks and enabling full domain access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional smart card authentication is used in remote computing environments, then security is maintained through multiple interactions and PIN verification, but authentication latency increases significantly due to high network latency
Solution Approach 1:
The system performs preliminary authentication actions by establishing SSL/TLS encrypted connections and obtaining authentication credentials before the actual smart card logon process. The server device sets up the authentication infrastructure in advance, so that when the smart card logon occurs, the heavy cryptographic setup is already complete, reducing the perceived latency of the authentication process.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using SSL/TLS certificates and authentication agents that mediate between the smart card and the remote computing environment. This intermediary layer allows the system to maintain security requirements while reducing the number of direct interactions needed between the client and server, thereby reducing latency caused by high network latency.
2Reliability
If multiple interactions are performed between server and client for smart card authentication, then authentication security is ensured, but network bandwidth is consumed and latency increases
Solution Approach 1:
The patent extracts the authentication credentials and security context from the multiple interaction sequence and consolidates them into a single authenticated session. By taking out the essential authentication elements (SSL/TLS certificates, authentication tokens) and establishing them once, the system avoids repeated interactions while maintaining security, thus improving authentication speed without compromising reliability.
Solution Approach 2:
The system merges multiple authentication interactions into a single unified authentication process. By combining the SSL/TLS handshake, certificate verification, and smart card authentication into one integrated flow, the patent reduces the total number of network round-trips required, thereby improving productivity while maintaining the security guarantees of each individual interaction step.
3Ease of operation
If PIN transmission is performed over the network during smart card authentication, then authentication is completed, but security is compromised due to potential interception
Solution Approach 1:
The patent replaces the mechanical PIN transmission mechanism with a cryptographic substitution approach. Instead of transmitting the PIN over the network, the system uses SSL/TLS encrypted channels and public key infrastructure where the PIN never leaves the client device. The authentication is completed through cryptographic proof of possession of the PIN-derived credentials, eliminating the security risk of PIN interception while maintaining ease of operation.
4Reliability
If full domain privileges are not granted during remote logon, then network security is maintained, but client functionality is limited
Solution Approach 1:
The patent implements dynamic privilege assignment based on the authentication method and context. After successful smart card authentication with full security verification, the system dynamically grants full domain privileges to the client session. This dynamic adjustment allows the system to maintain network security during the authentication process while providing full functionality to authenticated users, resolving the contradiction between security and adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for faster and more efficient smart card logon and for giving a client device full domain access in a remote computing environment are described herein. For fast smart card logon, the system may reduce the number of operations (e.g., interactions, such as fetching a user certificate from the smart card or signing data) between a server device used for authentication and the client device. Components used to implement fast smart card logon may also be used to implement a federated full domain logon. A virtual smart card credential, which may be ephemeral, may be issued based on the acceptance of an external authentication event (e.g., logon at a Security Assertion Markup Language (SAML) Identity Provider, smart card authentication over TLS or SSL, and alternative authentication credentials such as biometrics or one-time password (OTP) without AD password).