Guided enrollment and login for token users

Patent metadata

Field	Value
Publication number	US-9769158-B2
Application number	US-44815806-A
Country	US
Kind code	B2
Filing date	Jun 7, 2006
Priority date	Jun 7, 2006
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

Embodiments of the present invention provide an automated process for enrolling and logging in with a token. In particular, a security client detects when the user has inserted their token. In response, the security client then notifies the enterprise security system and provides information about the token. The enterprise security system performs a profile lookup and authorizes use of the token.

First claim

What is claimed is:

1. A method comprising:
detecting a presence of a token by a security client;
receiving, by the security client, an input parameter associated with the token;
sending, by the security client to a token management system, the input parameter and a card identification associated with the token, wherein the card identification uniquely identifies the token;
selecting, by a processor of the token management system, a first token enrollment profile of a plurality of profiles in view of the input parameter and the card identification, the first token enrollment profile defining a plurality of aspects to enable enrollment of the token; and
enrolling the token, by the token management system, in view of the plurality of aspects defined by the first token enrollment profile, without user input to perform the enrollment, wherein the enrollment of the token comprises obtaining a token certificate from a certificate authority identified in view of the token enrollment profile.

2. The method of claim 1 , wherein receiving the input parameter comprises receiving an input that confirms a request to enroll the token.

3. The method of claim 1 , wherein receiving the input parameter comprises receiving information that identifies a user.

4. The method of claim 1 , wherein receiving the input parameter comprises receiving a password.

5. The method of claim 1 , wherein the plurality of aspects of the enrollment of the token comprise two or more of a number of keys to generate on the token, a token label, or connection information between an applicable certificate authority, data recovery manager, or token key service associated with the security client.

6. A system comprising:
a memory to store a first token enrollment profile; and
a processor operatively coupled to the memory, the processor to:
detect a presence of a token by a security client executed by the processor;
receive, by the security client, an input parameter associated with the token;
send, by the security client to a token management system, the input parameter and a card identification associated with the token, wherein the card identification uniquely identifies the token;
select, by the token management system, the first token enrollment profile of a plurality of profiles in view of the input parameter and the card identification, the first token enrollment profile defining a plurality of aspects to enable enrollment of the token; and
enroll the token, by the token management system, in view of the plurality of aspects defined by the first token enrollment profile, without user input to perform the enrollment, wherein the enrollment of the token comprises obtaining a token certificate from a certificate authority identified in view of the token enrollment profile.

7. The system of claim 6 , wherein the plurality of aspects of the enrollment of the token comprise two or more of a number of keys to generate on the token, a token label, or connection information between an applicable certificate authority, data recovery manager, or token key service associated with the security client.

8. A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to:
detect a presence of a token by a security client executed by the processor;
receive, by the security client, an input parameter associated with the token;
send, by the security client to a token management system, the input parameter and a card identification associated with the token, wherein the card identification uniquely identifies the token;
select, by the token management system, the first token enrollment profile of a plurality of profiles in view of the input parameter and the card identification, the first token enrollment profile defining a plurality of aspects to enable enrollment of the token; and
enroll the token, by the token management system, in view of the plurality of aspects defined by the first token enrollment profile, without user input to perform the enrollment, wherein the enrollment of the token comprises obtaining a token certificate from a certificate authority identified in view of the token enrollment profile.

9. The non-transitory computer readable medium of claim 8 , wherein the plurality of aspects of the enrollment of the token comprise two or more of a number of keys to generate on the token, a token label, or connection information between an applicable certificate authority, data recovery manager, or token key service associated with the security client.

Assignees

• Kwan Nang Kon
• Magne John
• Red Hat Inc

Inventors

• Kwan Nang Kon
• Magne John

Classifications

• H04L63/0853 Primary

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title