Client Hardware-Token Based Single Sign-On over Several Servers without Trusted Online Third Party Server

Abstract

User authentication in most systems is done by the principle: registration with unique user name and presentation of a secret, e. g., a password or a private cryptographic key, respectively. To obtain a trustworthy method, combinations of hardware token with user certificates and keys secured by a PIN have to be applied.

The main problem of hardware tokens is consumer acceptance. Thus, hardware tokens have to be provided with added values.

This paper proposes such an add-on, namely a client-based approach which allows single sign-on for multiple client applications possibly distributed over several servers without modifications on server side. Where-as current client based hardware token approaches store passwords for authenticating the user to the applications, the approach presented here uses the user certificate stored in the token. A method is provided so that the PIN of the token has to be put in only once and not each time an application is called. Authorization information is taken from a central data base. Thus, the value added to the hardware token consists of both a much more secure authentication method than authentication by user name and secret and single sign-on. So the increase of the consumer acceptance comes along with more security: a win-win situation.