Patent ID: 8782768

Claim:
An authentication system comprising: a plurality of access-protected network resources, each of the access-protected network resources having respective access permissions; a first computing device comprising a first processor configured to: receive an access request and access credentials from a first user; determine that the access credentials are valid; and in response to determining that the access credentials are valid, authenticate the first user and generate an authentication token for the first user; and a second computing device comprising a second processor configured to: receive a request from the first user to access a first access-protected network resource of the plurality of access-protected network resources; receive one of the authentication token for the first user or a reference to the authentication token; determine that the first user has permission to access the first access-protected network resource; generate smartcard credentials for the first user, wherein the smartcard credentials comprise a private key and a digital certificate with a public key for the first user; store the smartcard credentials in a virtual smartcard; associate the virtual smartcard with the first access-protected network resource to allow the first user to access the first access-protected network resource using the smartcard credentials without entering additional access credentials; receive a request from the first user to access a second access-protected network resource of the plurality of access-protected network resources, the second access-protected network resource having different access permissions from the first access-protected network resource; determine that the first user has permission to access the second access-protected network resource from one of the authentication token or a reference to the authentication token; and associate the virtual smartcard with the second access-protected network resource to allow the first user to access the second access-protected network resource using the smartcard credentials without entering additional access credentials, wherein: the plurality of access-protected network resources, the first computing device, and the second computing device are included within a domain.