System and method of locating identity providers in a data network

• US 20060218625A1
• Filed: 03/25/2005
• Published: 09/28/2006
• Est. Priority Date: 03/25/2005
• Status: Active Grant

• Current Assignee: Sbc Knowledge Ventures, L.P.
• Original Assignee: Sbc Knowledge Ventures, L.P.
• Inventors: Pearson, Larry B., Doherty, James M.
• Granted Patent: US 7,784,092 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A distributed computer system is disclosed and includes a plurality of identity provider servers and a plurality of service provider servers coupled to a data network. Further, an identity provider locator server is coupled to the data network. In response to a request from one of the plurality of service provider servers, the identity provider locator server can provide an identifier of at least one of the plurality of identity provider servers. The identity provider locator server can include a memory that stores a list of active identity provider servers for a particular end-user having access to the data network. Further, one or more of the plurality of identity provider servers is able to add or remove itself from the list of active identity provider servers.

Claims

1. A distributed computer system comprising:

a plurality of identity provider servers coupled to a data network;

a plurality of service provider servers coupled to the data network; and

an identity provider locator server coupled to the data network and wherein in response to a request from one of the plurality of service provider servers, the identity provider locator server provides an identifier of at least one of the plurality of identity provider servers.

2. The distributed computer system of claim 1, wherein the identity provider locator server includes a memory that stores a list of active identity provider servers for a particular end-user having access to the data network.

3. The distributed computer system of claim 2, wherein one or more of the plurality of identity provider servers is able to add or remove itself from the list of active identity provider servers.

4. An identity provider locator server comprising:

an interface to a data network to communicate with a plurality of identity provider servers and a plurality of service provider servers;

a processor including logic to respond to a request from one of the plurality of service provider server systems to identify one or more of the plurality of identity provider servers; and

a memory accessible to the processor.

5. The server of claim 4, wherein the memory stores a list of active and valid identity provider servers associated with at least one end-user single sign-on session.

6. The server of claim 4, wherein the memory includes at least one static data structure and at least one dynamic data structure.

7. The server of claim 6, wherein the memory includes a list of valid identity provider servers.

8. The server of claim 7, wherein the memory includes an identity provider database table for each valid identity provider server on the list of valid identity provider servers.

9. The server of claim 8, wherein each identity provider database table includes at least one of the following parameters:

an identity provider server identity parameter that includes a unique number that represents the identity provider server, a name parameter that indicates a display name of the identity provider server, a domain name parameter that indicates a domain name of the identity provider server, an encryption method parameter that indicates an encryption method to be used with the identity provider server, an encryption key parameter that is used to encrypt information sent to the identity provider server a decryption method parameter that indicates a decryption method used for the identity provider server, a decryption key parameter that is used to decrypt information received from the identity provider server, a start parameter that indicates a date and time that the identity provider server starts using one or more services provided by the identity provider locator server, and a stop parameter that indicates a date and time that the identity provider server stops using the one or more services provided by the identity provider locator server.

10. The server of claim 9, wherein the parameters are static.

11. The server of claim 8, wherein the memory includes a list of valid service provider servers and wherein the memory includes a service provider database table for each valid service provider server on the list of valid service provider servers.

12. The server of claim 11, wherein each service provider database table includes at least one of the following parameters:

a service provider server identity parameter that includes a unique number that represents the service provider server, a name parameter that indicates a display name of the service provider server, a domain name parameter that indicates a domain name of the service provider server, an encryption method parameter that indicates an encryption method to be used with the service provider server, an encryption key parameter that is used to encrypt information sent to the service provider server, a decryption method parameter that indicates a decryption method used for the service provider server, a decryption key parameter that is used to decrypt information received from the service provider server, a start parameter that indicates a date and time that the service provider server starts using one or more services and a stop parameter that indicates a date and time that the service provider server stops using the one or more services.

13. The server of claim 12, wherein the memory includes an list of valid identity provider to service provider mappings.

14. The server of claim 13, wherein the memory includes an identity provider to service provider mapping database table for each identity provider to service provider mapping on the list of valid identity provider to service provider mappings.

15. The server of claim 14, wherein each identity provider to service provider mapping database table includes at least one of the following parameters:

a mapping identification parameter that includes a unique number that represents an identity provider to service provider mapping, an identity provider server identity parameter, an identity provider server known parameter that includes a string representation of how a service provider server knows the identity provider server, a service provider server identity parameter, a service provider server known parameter that includes a string representation of how the identity provider server knows the service provider server, a link start entry that indicates a date and time after which the mapping is valid, and a link stop entry that indicates a date and time after which the mapping is no longer valid.

16. The server of claim 4, wherein the memory stores dynamic session information associated with one or more active-end-users having a session connected to the identity provider locator server.

17. The server of claim 16, wherein the memory includes a list of active sessions and wherein the memory includes an active session database table for each active session.

18. The server of claim 17, wherein each active session database table includes at least one of the following parameters:

an active session identity parameter that includes a unique number that represents an active session on the identity provider locator server, an active session string parameter that includes an active session key that is stored at an end-user browser, a session start parameter that indicates a date and time that the active session is initiated, and a session refresh parameter that indicates a last date and time that the active session was used.

19. The server of claim 18, wherein the memory includes a list of active session to identity provider mappings.

20. The server of claim 19, wherein the memory includes an active session to identity provider mapping database table for each active session to identity provider mapping.

21. The server of claim 20, wherein each active session to identity provider mapping database table includes at least one of the following parameters:

a mapping identity parameter that includes a unique number that represents an active session to identity provider mapping on the identity provider locator server, an active session identity parameter that includes a foreign key reference to an active session database table, an identity provider server identity parameter that includes a foreign key reference to an identity provider database table, and a mapping start parameter that includes a date and time that the active session to identity provider mapping is created or updated by an identity provider server.

22. A static data structure stored within a memory of an identity provider location server, the static data structure comprising:

a list of valid identity provider servers that may be located;

a list of valid service provider servers; and

a list of valid identity provider to service provider mappings.

23. The static data structure of claim 22, further comprising an identity provider database table associated with each of the valid identity provider servers, each identity provider database table including a plurality of parameters that can be configured to allow identification of the valid identity provider servers.

24. The static data structure of claim 22, further comprising a service provider database table associated with each of the valid service provider servers, wherein each service provider database table includes a plurality of parameters.

25. The static data structure of claim 22, further comprising an identity provider to service provider mapping database table associated with each valid identity provider to service provider mapping, wherein each identity provider to service provider mapping database table includes a plurality of parameters that can be configured to allow mapping between an associated identity provider server and an associated service provider server.

26. The static data structure of claim 22, wherein the list of valid identity provider servers is linked to the list of identity provider to service provider mappings by a first one to many relationship link.

27. The static data structure of claim 23, wherein the list of valid service provider servers is linked to the list of identity provider to service provider mappings by a second one to many relationship link.

28. A dynamic data structure stored within a memory of an identity provider location server, the dynamic data structure comprising:

a list of active sessions;

a list of identity provider servers; and

a list of active session to identity provider mappings.

29. The dynamic data structure of claim 28, further comprising an active session database table associated with each active session on the list of active sessions, wherein each active session database table includes a plurality of parameters that are dynamically populated in order to identify and monitor active sessions.

30. The dynamic data structure of claim 28, further comprising an active session to identity provider mapping database table associated with each active session to identity provider mapping on the list of active session to identity provider mappings, wherein each active session to identity provider mapping database table includes a plurality of parameters that are dynamically populated in order to identify and monitor active session to identity provider mappings.

31. The dynamic data structure of claim 30, wherein the each active session to identity provider mapping database table includes an identity provider server identity parameter that includes a foreign key reference to the list of identity provider servers.

32. A method of interacting with an identity provider locator server, the method comprising:

receiving an end-user connection request at a service provider server;

sending a redirect message including a uniform resource locator to the end-user, the uniform resource locator identifies a type of request and identifies the service provider server wherein, the redirect message is sent to initiate a request to the identity provider locator server to provide a list of valid identity provider servers for use by the service provider to determine which of many identity provider servers to use to authenticate the end-user;

receiving a locate response message sent via a second redirect message the locate response message including an encrypted payload containing the list of active identity provider servers; and

authenticating the end-user using a first identity provider server in the list of active identity provider servers.

33. The method of claim 32, further comprising sending an authentication request and redirect message to the end-user that forwards the authentication request to the first identity provider server.

34. The method of claim 33, further comprising receiving a forwarded authentication response at the service provider server, the forwarded authenticated response provided by the first identity provider server and redirected by the end-user.

35. The method of claim 34, further comprising decoding the authenticated response, creating a login session for the end-user, and sending an HTML page back to the end-user.

36. The method of claim 35, further comprising decoding the authenticated response, determining that the authenticated response indicates that the end-user is not authenticated and further comprising authenticating the end-user using a second identity provider server in the list of active identity provider servers.

37. The method of claim 36, further comprising sending a second authentication request and redirect message to the end-user that forwards the second authentication request to the second identity provider server.

38. The method of claim 32, wherein the redirect message is communicated using a secure connection.

39. The method of claim 32, further comprising transmitting an intelligent login form to an end-user browser when none of the active identity provider servers on the list of active identity provider servers have authenticated the end-user and when the service provider server supports local authentication.

40. The method of claim 39, wherein the intelligent login form comprises:

a user identification input field to receive a user identification;

a password input field to receive a user password; and

a login button, wherein the login button can be selected to post the intelligent form at an identity provider server.

41. The method of claim 40, further comprising receiving an authentication response from an end-user browser, wherein the authentication response is transmitted to the end-user browser from an identity provider server.

42. The method of claim 41, further comprising decoding the authentication response and creating a login session for the end-user.

43. A method of communicating with an identity provider server, the method comprising:

receiving a request message at an identity provider locator server in response to a redirect message sent to an end-user browser from an identity provider server, the redirect message including a request type and an identifier of the identity provider server; and

determining if an end-user session has been previously established for the end-user by performing a query of an active session to identity provider mapping database table.

44. The method of claim 43, further comprising adding an entry into the active session to identity provider mapping database table within a memory of the identity provider locator server after determining that an end-user session was not previously established.

45. The method of claim 44, further comprising sending a redirect message to the end-user browser from the identity provider locator server, the redirect message including an encoded universal resource locator (URL) to identify an identity provider server domain name, a request type, and an encrypted payload that contains a time stamp.

46. The method of claim 45, wherein the identity provider server receives and decodes the redirect message sent from the identity provider locator server.