Enhancing Win2K Logon Security with Smart Cards

With the release of Windows 2000, Microsoft has expanded support for smart cards. Smart cards are credit card-sized devices that have a microchip with an OS and a small amount of embedded nonvolatile memory. Their potential uses are many. For example, you can use them in mobile phones or as credit cards, employee identification badges, or a means to log on to computers. Let's look at how Win2K uses smart cards for logons and how to set up a smart card system in your Win2K network.

Win2K and Smart Cards
Win2K uses smart cards to store certificates and their associated private keys; the certificates and their keys identify the smart card user. (For information about certificates, see the sidebar "What's a Certificate?" page 9.) When users walk up to a suitably configured Win2K workstation and insert their smart cards into an attached smart card reader, the system initiates a logon process that's similar to pressing Ctrl+Alt+Del. However, instead of entering a username and password, users enter their PIN, which unlocks the smart card. This process is an example of two-factor authentication: the first factor is something you have (i.e., the smart card), and the second factor is something you know (i.e., the PIN). In a domain environment, the workstation sends the certificate in the smart card to a Key Distribution Center (KDC) as part of the Kerberos authentication protocol. The KDC checks that the certificate is valid, creates a logon session key, encrypts the logon session key with the public key in the certificate, and sends the encrypted logon session key back to the workstation. The workstation passes the encrypted logon session key to the smart card for decryption. The smart card, not the workstation, performs all cryptographic functions that involve the certificate and its private key. (For more information about these functions, read the white paper "Windows 2000 Kerberos Authentication," http://www.microsoft.com/windows2000/techinfo/howitworks/security/kerberos.asp.) . . .