Active security token with security phantom for porting a password file

An active security token includes: a sentry that controls access to token data disposed on the active security token through verification of user authentication data; the token data including: reference authentication data for verification of user authentication data; and a security phantom including a password file, the security phantom being a public key certificate or a biometric template.

BRIEF DESCRIPTION

Disclosed is an active security token comprising: a sentry that controls access to token data disposed on the active security token through verification of user authentication data; the token data comprising: reference authentication data for verification of user authentication data; and a security phantom comprising a password file, the security phantom being a public key certificate or a biometric template.

Also disclosed is a process for making an active security token, the process comprising: providing an active security token; producing a security phantom comprising a password file, the security phantom being a public key certificate or a biometric template; and storing the security phantom on the active security token to make the active security token.

Further disclosed is a process for obtaining a password from an active security token, the process comprising: providing the active security token; communicating with a host by the active security token; requesting the security phantom by the host; communicating the security phantom from the active security token; and receiving the security phantom by the host from the active security token to obtain the password.

Also disclosed is a computer-implemented method, comprising: producing a security phantom comprising a password file, the security phantom being a public key certificate or a biometric template; storing the security phantom; communicating with a host; requesting the security phantom by the host; communicating the security phantom; receiving the security phantom by the host to obtain the password; receiving user authentication data; validating the user authentication data against reference authentication data; determining whether the user authentication data matches the reference authentication data; providing access to the password file in the security phantom if the user authentication data matches the reference authentication data; identifying the password in the security phantom; and logging into a password-protected host with the password obtained from the security phantom.

Also disclosed is a system comprising: one or more computers configured to perform operations, the operations comprising: producing a security phantom comprising a password file, the security phantom being a public key certificate or a biometric template; storing the security phantom; communicating with a host; requesting the security phantom by the host; communicating the security phantom to the host; receiving the security phantom by the host; receiving user authentication data; validating the user authentication data against reference authentication data; determining whether the user authentication data matches the reference authentication data; providing access to the host to the password file in the security phantom if the user authentication data matches the reference authentication data; identifying the password in the security phantom; and logging into a password-protected host with the password obtained from the security phantom.

Also disclosed is a computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising: producing a security phantom comprising a password file, the security phantom being a public key certificate or a biometric template; storing the security phantom; communicating with a host; requesting the security phantom by the host; communicating the security phantom to the host; receiving the security phantom by the host; receiving user authentication data; validating the user authentication data against reference authentication data; determining whether the user authentication data matches the reference authentication data; providing access to the host to the password file in the security phantom if the user authentication data matches the reference authentication data; identifying the password in the security phantom; and logging into a password-protected host with the password obtained from the security phantom.

DETAILED DESCRIPTION

It has been discovered that an article (e.g., an active security token) and a process herein provide storing a password file that can include a username and a corresponding password or database thereof on a software or hardware security module (e.g., an active security token such as a smart card, universal serial bus (USB) security token, and the like) in which the active security token has an absence of native password database storage capability. Advantageously and unexpectedly, an external application can access and use the password database to automatically log on to a network service such as a web server. Although some active security tokens do not explicitly support storage of password databases or do not allow an implementer to store an arbitrary file on the active security token, the articles and processes described herein include a security phantom that emulates a public key certificate or a biometric template that is an object to contain the password file and which overcomes these limitations. Beneficially, a normal username and password logon process of a network service can be used with a password and username obtained from the security phantom to log into the network service.

In an embodiment, the active security token provides storage and access to a password file (e.g., including a password database) on a security module (e.g., a hardware security module or software security module) that does not natively include this capability (i.e., storage or access to the password file). Moreover, the active security token provides secure password database management, e.g., to a conventional security module product without changing such conventional security module product. Additionally, the active security token is compatible with password-based logon processes used by web and other network servers. Advantageously, the active security token overcomes a need to change a security module functionality server logon process.

Commercially available security modules provide cryptographic operations such as key generation, public key certificate storage, digital signature generation, and encryption. However, such conventional security modules typically do not provide storage capabilities for password databases nor for general data file storage. Unexpectedly, the active security token embeds a password file that can include a password database, on a security module, in another security object such as a public key certificate or and biometric template. These other security objects are stored on and retrievable from the security module by an external application using a native interface of the security module.

Moreover, with regard to certain security objects, conventional security modules often do not process or parse them internally. As a result, the security object can include arbitrary content. According to an embodiment, a user can store a security object on an active security token (e.g., a security module) and provide the active security token with the password file in a raw form. Header information can be included in the password file. Header information can include an object identifier, tag-length value, or the like that the active security token requires for that type of security object.

In an embodiment, the content of a security object is checked and validated by a security module, and a security object is prepared with the correct format such that the password file is encoded in a sub-element or field of the security object.

In an embodiment, the security object can include an optional field or noncritical field that can be used as a container for the password file while maintaining conformance to a formal specification for the security object. In an embodiment, an X.509 public key certificate that passes a validity check is prepared with a field or extension that includes the password file embedded therein.

In an embodiment, the password file is secured so that a legitimate user can access the password file on the active security token. Here, the password file is stored in a security object that the active security token protects with a personal identification number (PIN) or master password. It is contemplated that the user provides a PIN or master password to the active security token before the active security token provides access by an application to read the password file.

In an embodiment, the password file can be included on the active security token by encrypting the password file before the password file is stored on the active security token. Here, an external application reads the encrypted password file stored on the active security token and obtains a PIN or password from the user to decrypt the password file.

Advantageously and unexpectedly, storing the password file on the active security token overcomes the problem of storing password file on security modules that do not natively provide this functionality. Further, storing the password file on the active security token overcomes a lack of secure password management in the online world by adding a new capability to existing security modules and server logon systems without requiring design changes to those systems.

In an embodiment, with reference toFIG. 1, active security token100includes sentry4that controls access to token data70disposed on active security token100, wherein access to token data70is accomplished through verification of user authentication data72. Active security token100also includes token data70including: reference authentication data10for verification of user authentication data72; and security phantom6including password file8. It is contemplated that security phantom6can be a public key certificate or a biometric template. Active security token100also can include interface12in communication with sentry4and security phantom6via wire14. Additionally, sentry4can be in communication with token data70via wire14. Components of active security token100can be disposed on substrate2.

In an embodiment, with reference toFIG. 2system102includes active security token100in communication with host30via communication channel40. In this manner, active security token100can communicate security phantom6to host30via communication channel40. Such communication can occur at active security token100through interface12. User54can be in communication with host30via communication channel40. Host30can include password courier32that identifies a password or username in password file6received from active security token100. User54can provide user authentication data72to host30via communication channel40. Host30can communicate password38from password file6to network service34via communication channel40. Network service34can include login manager36to log into a service with password38received from host30. Thereafter, service can be provided from network service34to host30. It should be appreciated that such service is predicated upon communication of password file8from security phantom6disposed on active security token100to host30.

In an embodiment, with reference toFIG. 3, system102includes communication of security phantom6with password file8to administrator50over communication channel40. Administrator50includes application programming interface56. Application programming interface56includes a function for storing a certificate on active security token100. In this regard, administrator50uses the function for storing the certificate to communicate and to store security phantom6that contains password file8on active security token100. Active security token100receives security phantom6from administrator50and provides security phantom6to host30over communication channel40. Host30receives security phantom6from active security token100. Here, host30includes password courier32to identify and retrieve password file8from security phantom6. Host30also can include application programming interface52accessible by user54in which user54communicates user authentication data via application programming interface52to host30. Upon authentication of user authentication data72by active security token100against reference authentication data10, password courier32can supply the password from password file8to an application, e.g., web browser60, plug-in62, and the like, included on host30. Web browser64or plug-in62can communicate with network service34through communication channel40, wherein password38from password file8is provided to network service34for provision of a service from network service34to user54from host30via web browser60. Plug-in62can automate unlocking of password38from password file8in security phantom6and provision of password38to network service34. It is contemplated that plug-in62can interwork with password courier32so that plug-in62instantiates an instance of password courier32that identifies and retrieves password38from password file8in security phantom6that was transferred from active security token100. Accordingly, plug-in62can be plug-in for web browser60, a standalone program, a script, and the like.

Active security token100can be a security module such as a personal identification verification card, universal serial bus (USB) token, credit card, identification card, smart card, software security module, and the like. Software security modules emulate the functionality of hardware security modules in software that executes on general purpose computing platforms. In an embodiment, active security token100is the personal identification verification card. In an embodiment, active security token100is the credit card that includes a chip. Active security token100can include substrate two on which components are disposed. Substrate2can be made of any material effective to provide disposition of the components thereon. Exemplary materials for substrate2include a plastic, metal, composite, and the like.

Interface12disposed on active security token100provides external communication with sentry4and token data70. Interface12can be electronic circuit, and optical interface, and the like. Moreover, interface12can communicate via mechanical contact, wireless contact, electrical contact, optical contact, or a combination thereof with user54, host30, and the like. It is contemplated that interface12provide communication, e.g., with a card reader when active security token100is a card, e.g., a PIV card or the like.

Interface12communicates with sentry4and token data70via wire14. Wire14can be an electrically conductive medium (e.g., gold trace or the like) or other material for communicating data through interface12to sentry4and other components of active security token100.

Sentry4resides on active security token100, receiving user authentication data72through interface12and comparing it to reference authentication data10previously stored on active security token100. If received user authentication data72matches previously stored reference authentication data10, sentry4grants access to security phantom6stored on active security token100via interface12. If received user authentication data72does not match previously stored reference authentication data10, sentry4denies access to security phantom6stored on active security token100via interface12.

Token data70includes reference authentication data10and security phantom6. Token data70is constructed according to internal formatting rules specific to each embodiment of active security token10.

Reference authentication data10includes a password, PIN, biometric template, or other authentication data element in which sentry4compares reference authentication data10to user authentication data72to grant or deny access to security phantom6via interface12depending on success or failure of such comparison.

Security phantom6includes password file8such as a data object represented as a public key certificate or biometric template. Security phantom6can include password file8in raw form (i.e., unmodified or partially unmodified) that is transferred to and stored on active security token100. It is contemplated that security phantom6can be a data object structured to conform with a formatting rule for a public key certificate or biometric template for active security token100.

Password file8is a data object that can contain password38and a corresponding username also referred to in combination as user credentials. In addition, password file8can contain an identifier for the service associated with a set of user credentials. Password38is constructed according to the requirements of the host service for acceptable passwords, which can vary from one service to another. Accordingly, the username requested to log in to a service can be subject to the formatting requirements of that service.

In an embodiment, password file8includes a password database. Here, the password database contains zero or more records including passwords, usernames, optional service identifiers, and the like, or a combination thereof. A processing element external to active security token100, such as password courier32, may use the optional service identifiers as an index to retrieve the appropriate combination of username and password for a specific service.

Active security token100communicates security phantom6to host30via communication channel40. Communication channel40can be a mechanism that transfers digital information between active security token100and host30, including electrical wires and contacts, and optical, radio frequency, electromagnetic, and audio signals.

Host30can be a desktop computer, terminal, laptop, tablet, smart phone, or other computing device with a user interface. Host30mediates the transfer of data between user54, active security token100, and network service34.

Host30communicates with user54to receive user authentication data72therefrom. User54indicates a desire to access network service34, initiating the logon process. Host30responds to this request by collecting user authentication data72from user54via a user interface such as a keyboard, mouse, touchpad, voice recognition package, biometric scanner, or other human-machine interface. User authentication data72includes, e.g., a password, PIN, biometric scan, or other suitable authenticator is transmitted via interface12to active security token100. Here, host30includes password courier32. Password courier32manages the process of sending user authentication data72to active authentication token100, retrieving security phantom6from active security token100, and extracting the username and password associated with desired network service34from security phantom6.

Further, host30communicates with network service34. Network service34includes a service that user54wishes to access. Network service34requires a username and password from user54that is verified before user54is granted access to network service54.

Login manager36can be included in network service34as a software module receives username and password from host30via communication channel40. Login manager36verifies username and password and, if verification succeeds, grants user54access to network service34.

In some embodiments, active security token100communicates with administrator50. Administrator50is responsible for constructing the elements of token data70and storing said elements on active security token100.

Administrator50or host30can include application programming interface (e.g.,52,56). Application programming interfaces provide functions for storing token data70on active

Host30can include plug-in62that integrates with applications such as web browsers installed on host30. Plug-in62is specific to a given application and enables said application executing on host30to use active security token100for login to network service54. The plug-in and password courier can be separate elements or can be unique elements.

Additionally, host30can communicate with network service34. Network service34can be, e.g., a web service such as webmail, an online retail store, a bank account, social media, and the like. Such service can require users to log on to prevent attackers from accessing user accounts and services. Passwords are a common form of user authentication among online services.

Active security token100has numerous beneficial uses, including performing secured data exchange between host30and network service34. To accomplish secured data exchange, active security token100can be made in various ways. In an embodiment, a process for making active security token100includes providing a medium for storing security phantom6thereon. The medium for storing can be made by fabricating an integrated circuit (chip) containing a processor, memory, and a communications interface and embedding or otherwise attaching this chip to a substrate such as a plastic card, USB casing, or the like. The processor is required on the medium for storing security phantom6because sentry4is an executable program. Simple memory devices without processors are therefore unsuitable as a medium for making active security token100because sentry4cannot be implemented on such devices. The process for making active security token100includes: providing active security token100; producing security phantom6including password file8, security phantom6being a public key certificate or a biometric template; and storing security phantom6on active security token100to make active security token100.

In an embodiment, producing security phantom6includes calling an API function for storing a certificate on active security token100; and storing password file8as security phantom6on active security token100in response to calling the API function for storing the certificate.

In an embodiment, producing security phantom6includes producing security phantom6as the public key certificate that includes a verifiable certificate field; calling an API function for storing a certificate on active security token100; and storing security phantom6on active security token100in response to calling the API function for storing the certificate.

According to an embodiment, a process for obtaining password38from active security token100includes: providing active security token100; communicating with host30by active security token100; requesting security phantom6by host30; communicating security phantom6from active security token100; and receiving security phantom6by host30from active security token100to obtain password38. The process further can include: providing user authentication data72to active security token100; validating user authentication data72against reference authentication data10stored on active security token100; determining, by active security token100, whether user authentication data72matches reference authentication data10; and providing access to security phantom6if user authentication data72matches reference authentication data10. The process also can include identifying password38in security phantom6. Password38is used to log into password-protected host30with password38obtained from security phantom6.

Active security token100can be used in various environments. In an embodiment, a computer-implemented method includes: producing security phantom6including password file8, security phantom6being a public key certificate or a biometric template; storing the security phantom; communicating with host30; requesting security phantom6by host30; communicating security phantom6; receiving security phantom6by host60to obtain password38; receiving user authentication data72; validating user authentication data72against reference authentication data10; determining whether user authentication data72matches reference authentication data10; providing access to password file8in security phantom6if user authentication data72matches reference authentication data10; identifying password38in security phantom6; and logging into password-protected host30with password38obtained from security phantom6. In the computer-implemented method, producing security phantom6can include: calling an API function for storing a certificate; and storing password file8as security phantom6in response to calling the API function for storing the certificate. In some embodiments of the computer-implemented, producing security phantom6includes: producing security phantom6that further includes a verifiable certificate field prior to calling the API function for storing the certificate on active security token100and prior to storing security phantom6on active security token100in response to calling the API function for storing the certificate. As used herein, “verifiable certificate” refers to a data structure constructed according to a set of specifications such that a parser with knowledge of these specifications can verify conformance by analyzing the data structure and comparing it to the specifications. Additionally, verifiable conformance to certificate specifications enables parsers to retrieve elements or fields from verifiable certificates. It should be noted that certificate verification is not a monolithic process; many different levels of verification are possible due to the complexity of public key certificate standards. A compendium of public key certificate standards and specifications are available via an Internet such and from organizations such as the Organization for the Advancement of Structured Information Standards (OASIS), which is a nonprofit consortium involved in development, convergence, and adoption of open standards for information technology, in promotion of industry consensus, and in production of worldwide standards for security, Cloud computing, Internet of Things, the Smart Grid, content technologies, and emergency management.

Active security token100can be included in a system. In an embodiment, a system includes: one or more computers configured to perform operations, the operations including: producing security phantom6including password file8, security phantom6being a public key certificate or a biometric template; storing security phantom6; communicating with host30; requesting security phantom6by host30; communicating security phantom6to host30; receiving security phantom6by host30; receiving user authentication data72; validating user authentication data72against reference authentication data10; determining whether user authentication data72matches reference authentication data10; providing access to host30to password file8in security phantom6if user authentication data72matches reference authentication data10; identifying password38in security phantom6; and logging into password-protected host30with password38obtained from security phantom6. In the computer-implemented, producing security phantom6can include: calling an API function for storing a certificate; and storing password file8as security phantom6in response to calling the API function for storing the certificate. In the computer-implemented method, producing the security phantom6can include: producing security phantom6that further includes a verifiable certificate field prior to calling the API function for storing the certificate on active security token100and prior to storing security phantom6on active security token100in response to calling the API function for storing the certificate.

According to an embodiment, a computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations including: producing security phantom6including password file8, security phantom6being a public key certificate or a biometric template; storing security phantom6; communicating with host30; requesting security phantom6by host30; communicating security phantom6to host30; receiving security phantom6by host30; receiving user authentication data72; validating user authentication data72against reference authentication data10; determining whether user authentication data72matches reference authentication data10; providing access to host30to password file8in security phantom6if user authentication data72matches reference authentication data10; identifying password38in security phantom6; and logging into password-protected host30with password38obtained from security phantom6. Here, producing security phantom6can include: calling an API function for storing a certificate; and storing password file8as security phantom6in response to calling the API function for storing the certificate. Also, here, producing the security phantom6can include: producing security phantom6that further includes a verifiable certificate field prior to calling the API function for storing the certificate on active security token100and prior to storing security phantom6on active security token100in response to calling the API function for storing the certificate.

Active security token100has numerous advantageous and beneficial properties. In an aspect, active security token100provides the ability to store password databases on security tokens that do not intrinsically have this capacity, adding a new capability to existing commercial products. In another aspect, active security token100enables users to securely carry password databases from one host system to another. In another aspect, active security token provides a higher level of password management assurance without requiring programmatic changes to existing security tokens and network server login components.

Advantageously, active security token100provides storage of password database as a payload in a security object where elements of the security object are critical to the operating process of a given security module. Beneficially, active security token100provides protection for plaintext passwords while such password is in use by an external user or application and deletion of the password from memory after use to avoid compromise of the password. Further, active security token100provides storage of plaintext password databases on security modules, wherein the sentry requires a PIN or password to access the password database.

The articles and processes herein are illustrated further by the following Example, which is non-limiting.

EXAMPLE

With reference toFIGS. 1, 2, and 3, a personal identity verification (PIV) security card is a cryptographic authentication token carried by all federal employees, mandated by Homeland Security Presidential Directive12and specified in Federal Information Processing Standards publication 201 and other documents. Password database files cannot be stored on the PIV card explicitly, but PIV cards can contain public key certificates and biometric templates. A PIV card can therefore serve as the medium for making active security token100.

Administrator50generates security phantom8and invokes the PIV card application programming interface56function to store a certificate on the card as defined in NIST Special Publication 800-73-4. In response to this function call security phantom8is stored in one of the card's memory slots reserved for public key certificates. The card is provided to user54, and user54uses the card to log on to a webmail service as follows. User54indicates to host30that they wish to access the webmail service (network service34) by entering the URL of the webmail service in a browser resident on host30. Browser plug-in62prompts user54for user authentication data72in the form of a PIN. User54enters the PIN and plug-in62transmits this PIN to the card. Sentry4verifies the PIN against reference authentication data10and grants access to security phantom8stored in a public key certificate slot on the card. Plug-in62retrieves security phantom8from the card via communication channel40, parses security phantom8, extracts the username and password for the webmail service, and provides these to host30. Host30communicates the username and password to the webmail service login manager36, which verifies the password and grants user54access to the webmail service. In this manner, the active security token is provisioned with a security phantom that includes a password that is ported from one device to another.

Computers suitable for the execution of a computer program include, by way of example, can be based on general or special purpose microprocessors or both, workstations, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a central processing unit for performing or executing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic; magneto-optical disks, optical disks, USB drives, and so on. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a microwave oven, mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The central processing unit and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

Reference throughout this specification to “one embodiment,” “particular embodiment,” “certain embodiment,” “an embodiment,” or the like means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, appearances of these phrases (e.g., “in one embodiment” or “in an embodiment”) throughout this specification are not necessarily all referring to the same embodiment, but may. Furthermore, particular features, structures, or characteristics may be combined in any suitable manner, as would be apparent to one of ordinary skill in the art from this disclosure, in one or more embodiments.

All ranges disclosed herein are inclusive of the endpoints, and the endpoints are independently combinable with each other. The ranges are continuous and thus contain every value and subset thereof in the range. Unless otherwise stated or contextually inapplicable, all percentages, when expressing a quantity, are weight percentages. The suffix “(s)” as used herein is intended to include both the singular and the plural of the term that it modifies, thereby including at least one of that term (e.g., the colorant(s) includes at least one colorants). “Optional” or “optionally” means that the subsequently described event or circumstance can or cannot occur, and that the description includes instances where the event occurs and instances where it does not. As used herein, “combination” is inclusive of blends, mixtures, alloys, reaction products, and the like.

As used herein, “a combination thereof” refers to a combination comprising at least one of the named constituents, components, compounds, or elements, optionally together with one or more of the same class of constituents, components, compounds, or elements.

All references are incorporated herein by reference.

The use of the terms “a” and “an” and “the” and similar referents in the context of describing the invention (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. “Or” means “and/or.” Further, the conjunction “or” is used to link objects of a list or alternatives and is not disjunctive; rather the elements can be used separately or can be combined together under appropriate circumstances. It should further be noted that the terms “first,” “second,” “primary,” “secondary,” and the like herein do not denote any order, quantity, or importance, but rather are used to distinguish one element from another. The modifier “about” used in connection with a quantity is inclusive of the stated value and has the meaning dictated by the context (e.g., it includes the degree of error associated with measurement of the particular quantity).