Authentication broker service
First Claim
1. A method of authenticating an identity of a user seeking access to a relying computing entity, wherein the identity of the user is issued by an authentication service and is not issued by the relying computing entity, the method comprising:
- receiving at a broker service an authentication request from the relying computing entity to authenticate the identity of the user, wherein a first trust relationship exists between the relying computing entity and the broker service, and a second trust relationship exists between the authentication service and the broker service, in the absence of a relevant trust relationship existing between the authentication service and the relying computing entity;
receiving an authentication response from the authentication service, responsive to receiving the authentication request at the broker service; and
sending an authentication response from the broker service to the relying computing entity representing a trusted authentication of the identity of the user to the relying computing entity based on the first trust relationship and the second trust relationship.
2 Assignments
0 Petitions
Accused Products
Abstract
A user is authenticated for a relying computing entity (e.g., an enterprise) through an authentication broker service, wherein a trust relationship exists between the relying computing entity and the authentication broker service. The authentication broker service has a trust relationship with the relying computing entity and the authentication service that issued the identity of the user. The relying computing entity asks the authentication broker service to authenticate the identity of the user. The authentication broker service captures the user'"'"'s credential (or directs the authentication service to do so) and sends an authentication response (e.g., a token) to the relying computing entity in order to authenticate the identity of the user to the relying computing entity. The relying computing entity verifies the authentication response based on the trust relationship between the relying computing entity and the authentication broker service.
-
Citations
43 Claims
-
1. A method of authenticating an identity of a user seeking access to a relying computing entity, wherein the identity of the user is issued by an authentication service and is not issued by the relying computing entity, the method comprising:
-
receiving at a broker service an authentication request from the relying computing entity to authenticate the identity of the user, wherein a first trust relationship exists between the relying computing entity and the broker service, and a second trust relationship exists between the authentication service and the broker service, in the absence of a relevant trust relationship existing between the authentication service and the relying computing entity;
receiving an authentication response from the authentication service, responsive to receiving the authentication request at the broker service; and
sending an authentication response from the broker service to the relying computing entity representing a trusted authentication of the identity of the user to the relying computing entity based on the first trust relationship and the second trust relationship. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A computer program product encoding a computer program for executing on a computer system a computer process for authenticating an identity of a user seeking access to a relying computing entity, wherein the identity of the user is issued by an authentication service, the computing process comprising:
-
receiving at a broker service an authentication request from the relying computing entity to authenticate the identity of the user, wherein a first trust relationship exists between the relying computing entity and the broker service, and a second trust relationship exists between the authentication service and the broker service;
receiving an authentication response from the authentication service; and
sending an authentication response from the broker service to the relying computing entity representing a trusted authentication of the identity of the user to the relying computing entity based on the first trust relationship and the second trust relationship. - View Dependent Claims (21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38)
-
-
39. A computer system for authenticating an identity of a user seeking access to a relying computing entity, wherein the identity of the user is issued by an authentication service, the computing system comprising:
-
an authentication broker service having a first trust relationship with the relying computing entity and a second trust relationship with the authentication service, the authentication broker service receiving an authentication request from the relying computing entity to authenticate the identity of the user and receiving an authentication response from the authentication service, the authentication broker service further sending an authentication response to the relying computing entity representing a trusted authentication of the identity of the user to the relying computing entity based on the first trust relationship and the second trust relationship.
-
-
40. A method of establishing a brokerable trust relationship between an authentication broker service and each of a plurality of computing entities, the method comprising:
-
establishing one or more brokered authentication rules governing brokered authentication through the authentication broker service;
obtaining an agreement from each computing entity to comply with the one or more brokered authentication rules; and
configuring the authentication broker service to authenticate identities of one or more users for each computing entity in accordance with the one or more brokered authentication rules, wherein the one or more users have identities issued by one or more authentication services having trust relationships with the authentication broker service. - View Dependent Claims (41)
-
-
42. A computer program product encoding a computer program for executing on a computer system a computer process for establishing a brokerable trust relationship between an authentication broker service and each of a plurality of computing entities, the computer process comprising:
-
establishing one or more brokered authentication rules governing brokered authentication through the authentication broker service;
obtaining an agreement from each computing entity to comply with the one or more brokered authentication rules; and
configuring the authentication broker service to authenticate identities of one or more users for each computing entity in accordance with the one or more brokered authentication rules, wherein the one or more users have identities issued by one or more authentication services having trust relationships with the authentication broker service. - View Dependent Claims (43)
-
Specification