Framework for obtaining cryptographically signed consent

• US 20070101145A1
• Filed: 10/31/2005
• Published: 05/03/2007
• Est. Priority Date: 10/31/2005
• Status: Abandoned Application

• Current Assignee: Axalto Incorporated (Thales SA)
• Original Assignee: Axalto Incorporated (Thales SA)
• Inventors: Sachdeva, Kapil, Krishna, Ksheerabdhi
• Application Number:
  US11/263,324
• Publication Number:
  US 20070101145A1
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 2209/68 Special signature format, e.g. XML format
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A consent service on a host computer providing cryptographically signed consent for user attributes by a user on a host computer to a web service provider. The consent service is operable to provide decryption of the user attributes acquired by the web service provider from an identity provider. The consent service displaying and acquiring user consent to one or more user attributes displayed in a browser web page to the user on the host computer. The consent service is operable to provide encryption of the user consented attributes and to generate cryptographically signed consent of the user. The consent service conveying and transmitting the user consented attribute and cryptographically signed user consent to the web service provider. The web service provider is operable to provide decryption of the user consented attributes and storing the user consented attributes and signed user consent. The web service provider sharing user consented attributes and user signed consent with other web service providers so the user on the host computer can access resources on the other web service providers without multiple authentication or any further interaction with the identity provider.

Claims

1. A method for obtaining cryptographically signed consent from a user on a host computer, comprising:

requesting access to a resource on a web service provider by a user on a host computer;

in response to request from user to access a resource on the web service provider, generating a request for the user attributes by the web service provider and transmitting the request to an identity provider on the network;

encrypting the user attributes by the identity provider and transmitting the encrypted message to the web service provider;

transmitting encrypted message received from the identity provider by the web service provider to the host computer;

generating user consent by a consent service on the host computer;

transmitting encrypted user consented attributes and cryptographically signed user consent by the host computer to the web service provider; and

decrypting the cryptographically signed user consent and the encrypted user consented attributes by the web service provider and storing the user consented attributes and signed consent of the user in the storage device of the web service provider.

2. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the web service provider establishes trust by authenticating the user on the host computer.

3. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the web service provider establishes trust with the identity provider on the network and further requests the user attributes from the identity provider.

4. The method for obtaining cryptographically signed consent from a user on a host computer of claim 3 wherein the web service provider request for the user attributes from the identity provider is a SOAP request.

5. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the identity provider encrypted message is an encrypted XML message using Advanced Encryption Standard (AES).

6. The method for obtaining cryptographically signed consent from a user on a host computer of claim 5 utilizing the encrypted XML message of the identity provider comprising:

generating an AES random key;

encrypting the user attributes with the AES random key using AES cipher;

encrypting the AES random key with the public key of the user on the host computer; and

generating an encrypted XML message embedding the encrypted user attributes and the encrypted AES random key.

7. The method for obtaining cryptographically signed consent from a user on a host computer of claim 6 wherein the encrypted XML message from identity provider is transmitted to the web service provider in a SOAP response.

8. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the method further comprises:

operating the web service provider to;

transmit in a HTTP response, the encrypted XML message received from the identity provider to the host computer; and

request the HTTP response a cryptographically signed user consent.

9. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the method further comprises:

operating the consent service on the host computer to;

receive the encrypted XML message in HTTP response from the web service provider;

validate the encrypted XML message received from the web service provider;

decrypt the AES random key using the private key of the user;

decrypt the user attributes using the AES random key;

display the user attributes in a user interface on the host computer to the user and in response recording user consent of the selected attributes;

encrypt user consented attributes with the public key of the web service provider;

generate user consent using XML signature; and

generate encrypted XML message embedding both the XML signature and the encrypted user consented attributes.

10. The method for obtaining cryptographically signed consent from a user on a host computer of claim 9 wherein the user interface on the host computer is a web page in a web browser or a windows user interface.

11. The method for obtaining cryptographically signed consent from a user on a host computer of claim 9 wherein the encrypted XML message from the consent service is transmitted to the host computer and further the host computer transmitting the encrypted XML message to the web service provider in a SOAP response.

12. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the method further comprises:

operating the web service provider to;

receive the encrypted XML message in SOAP response from the consent service on the host computer;

decrypt user consented attributes using private key of the web service provider;

extract cryptographically signed user consent from the XML signature;

store the user consented attributes and the signed user consent in the web service provider storage device;

grant the user access to the requested resource; and

share user attributes consented by the user with other web service providers for the user to access resources on other web service providers.

21. The method for obtaining cryptographically signed consent from a user on a host computer of claim 1 wherein the consent service is hosted on a security device and the security device is a slave device of the host computer and method further comprising:

operating the consent service on the security device to;

receive the encrypted XML message in HTTP response from the web service provider;

validate the encrypted XML message received from the web service provider;

decrypt the AES random key using the private key of the user;

decrypt the user attributes using the AES random key;

display the user attributes in a user interface on the host computer to the user and in response record user consent to the attributes;

encrypt user consented attributes with the public key of the web service provider;

generate user consent using XML signature; and

generate an encrypted XML message embedding both the XML signature and the encrypted user consented attributes.

22. The method for obtaining cryptographically signed consent from a user on a host computer of claim 21 wherein the security device is a smart card.

23. The method for obtaining cryptographically signed consent from a user on a host computer of claim 21 wherein the user interface on the host computer is a web page in a web browser or a windows user interface.

24. The method for obtaining cryptographically signed consent from a user on a host computer of claim 21 wherein the encrypted XML message from the consent service on the security card is transmitted to the host computer and further the host computer transmits the encrypted XML message to the web service provider in a SOAP response.

13. A method for obtaining cryptographically signed consent from a user on a host computer, comprising:

requesting access to a resource on a web service provider by a user on a host computer;

in response to the request from user to access a resource on the web service provider, generating a request for user consent to user attributes by the web service provider and transmitting the web service provider request to the host computer;

displaying the user attributes requested by the web service provider in a user interface on the host computer for user consent;

transmitting user consent of request for user attributes by web service provider to a consent service on the host computer;

transmitting user consented request for user attributes by the consent service on the host computer to an identity provider;

encrypting the user attributes by the identity provider and transmitting the encrypted message to the consent service on the host computer;

decrypting the user attributes by the consent service on the host computer from the identity provider'"'"'s encrypted message;

encrypting user consented attributes and generating cryptographically signed user consent by the consent service on the host computer;

transmitting encrypted user consented attributes and cryptographically signed user consent by the host computer to the web service provider; and

decrypting the cryptographically signed user consent and the encrypted user consented attributes by the web service provider and storing the user consented attributes and signed consent of the user in the storage device of the web service provider.

14. The method for obtaining cryptographically signed consent from a user on a host computer of claim 13 wherein the web service provider establishes trust by authenticating the user on the host computer and further requests consent to user attributes by the user on the host computer.

15. The method for obtaining cryptographically signed consent from a user on a host computer of claim 13 wherein the user interface on the host computer is a web page in a web browser or a windows user interface.

16. The method for obtaining cryptographically signed consent from a user on a host computer of claim 13 wherein the identity provider encrypted message is an encrypted XML message using Advanced Encryption Standard (AES).

17. The method for obtaining cryptographically signed consent from a user on a host computer of claim 16 utilizing the encrypted XML message of the identity provider, the method comprising:

generating an AES random key;

encrypting the user attributes with the AES random key using AES cipher;

encrypting the AES random key with the public key of the user on the host computer; and

generating an encrypted XML message embedding both the encrypted user attributes and the encrypted AES random key.

18. The method for obtaining cryptographically signed consent from a user on a host computer of claim 16 wherein the encrypted XML message from identity provider is transmitted to the consent service on the host computer in a SOAP response.

19. The method for obtaining cryptographically signed consent from a user on a host computer of claim 13 utilizing the consent service on the host computer, the method comprising:

receiving the encrypted XML message from the identity provider;

decrypting the AES random key using the private key of the user;

decrypting the user attributes using the AES random key;

encrypting user consented attributes with the public key of the web service provider;

generating user consent using XML signature; and

generating an encrypted XML message embedding both the XML signature and the encrypted user consented attributes.

20. The method for obtaining cryptographically signed consent from a user on a host computer of claim 19 wherein the encrypted XML message from the consent service is transmitted to the host computer and further transmitted by the host computer to the web service provider in a SOAP response.