Wave Virtual Smart Card

February 25, 2014, RSA Conference, San Francisco—Wave Systems (www.wave.com) is combining features of the Trusted Platform Module and some software to create functionality of a smart card without any physical devices. The package stores authentication credentials in TPM containers, so they can offer security comparable to that of a smart card or other physical media.

The challenge for IT and security people is that physical media can be lost or damaged in normal use and can be as high as 20 percent of the total inventory. In addition, the media require specialized hardware to read the smart cards. Moving to embedded credentials can reduce IT workloads by eliminating or reducing password resets.

Wave addresses two-factor authentication by making the PC or notebook into the token, which becomes the security equivalent of the smart card. The user needs to use a PIN and have a TPM-equipped machine to log in. TPM is a hardware security chip which can store various credential as well as check bios and OS for integrity before boot. The combined devices can confirm the integrity of other software prior to authentication and send notifications if the machine is compromised. The TPM assures IT that the machine is a known-good device, and tells that the user at least knows a password.

The use of TPM assures that the private keys cannot be extracted or exported from the machine and all crypto operations for authentication are isolated from the system, presenting a more robust security operation. The TPM containers can store up to 50 keys, passwords, and certificates which allows entry into multiple systems or software packages from a single source.

The tool works with Windows Vista, 7, and 8, which enables an enterprise to quickly implement virtual smart card technologies without changing operating system on existing machines. The only additional requirement for the machines is that they have TPM installed, which can be a challenge with user-owned equipment.