Graduated authentication in an identity management system

• US 20060005020A1
• Filed: 01/24/2005
• Published: 01/05/2006
• Est. Priority Date: 06/16/2004
• Status: Active Grant

• Current Assignee: Callahan Cellular LLC (Intellectual Ventures LLC)
• Original Assignee: SXIP Networks SRL
• Inventors: Hardt, Dick C.
• Granted Patent: US 8,527,752 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method and system for graduated security in an identity management system utilize differing levels of time sensitivity, channel security and authentication security to provide a multi-dimensional approach to providing the right fit for differing identity requests. The differing levels of security can be selected by user preference, membersite request or homesite policy.

Claims

1. A method of selecting a security level for transmitting identity information from a homesite in an identity management network to a membersite in the identity management network, the method comprising:

receiving a request from a membersite;

determining, in accordance with a security level associated with the received request, the security level for transmitting the response to the request and

transmitting the response to the received request over a channel selected in accordance with the determined security level.

2. The method of claim 1 wherein the received request is a request for identity information.

3. The method of claim 1 wherein the received request is a request for authentication of a user identity.

4. The method of claim 1 wherein the security level associated with the received request is an authentication security level.

5. The method of claim 1 wherein the security level associated with the received request is a channel security level.

6. The method of claim 1 wherein the security level associated with the received request is a time sensitivity security level.

7. The method of claim 1 wherein the step of determining includes selecting a security level at least as secure as a level associated with the received request.

8. The method of claim 1 wherein the step of determining includes selecting a security level specified in the received request.

9. The method of claim 1 wherein the step of determining includes selecting a security level in accordance with information specified in the received request.

10. The method of claim 9 wherein the security level is selected in accordance with user preferences.

11. The method of claim 10 wherein the user preferences are predefined.

12. The method of claim 10 wherein the user preferences are associated with the information requested in the received request.

13. The method of claim 9 wherein the security level is selected in accordance with homesite policies.

14. A homesite, in an identity management system, for receiving information requests from a membersite in the identity management system, and for determining a security level for transmitting a response to received information requests, the homesite comprising:

an input for receiving an information request from a membersite;

an authentication engine for authenticating a user associated with the information request; and

response engine for assembling information associated with the user in accordance with the received authentication request, and for transmitting the assembled information to the membersite over a channel selected in accordance with a security level determined in accordance with the received information request.

15. The homesite of claim 14 wherein the response engine includes a security level determining engine for selecting an authentication security level.

16. The homesite of claim 14 wherein the response engine includes a security level determining engine for selecting a channel security level.

17. The homesite of claim 14 wherein the response engine includes a security level determining engine for selecting time sensitivity security level.

18. The homesite of claim 14 wherein the response engine includes a security level determining engine for selecting a security level at least as secure as a level associated with the received request.

19. The homesite of claim 14 wherein the response engine includes a security level determining engine for selecting a security level specified in the request.

20. The homesite of claim 14 wherein the response engine includes a security level determining engine for selecting a security level in accordance with information specified in the received request.

21. The homesite of claim 20 wherein the security level determining engine determines the security level in accordance with user preferences.

22. The homesite of claim 20 wherein the security level determining engine determines the security level in accordance with a homesite policy.