Router for managing trust relationships

• US 20080016195A1
• Filed: 07/14/2006
• Published: 01/17/2008
• Est. Priority Date: 07/14/2006
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Tulshibagwale, Atul Vijay, Whitehead, Gregory Ryan
• Granted Patent: US 7,926,089 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/306 User profiles

Abstract

One embodiment relates to a method of managing trust relationships between federated identity and service providers. An assertion of a user identity is received from an identity provider via a first federation protocol, wherein a destination service provider is indicated with the assertion. Permission of the user identity to access the destination service provider is verified. If permission is verified, the user identity is asserted to the destination service provider via a second federation protocol. Other embodiments and features are also disclosed.

Claims

1. A method of managing trust relationships between federated identity and service providers, the method comprising:

receiving an assertion of a user identity from an identity provider via a first federation protocol, wherein a destination service provider is indicated with the assertion;

verifying permission of the user identity to access the destination service provider; and

asserting the user identity to the destination service provider via a second federation protocol.

2. The method of claim 1, further comprising, prior to asserting the user identity, constructing a view of the user identity for presentation to the destination service provider.

3. The method of claim 1, further comprising:

determining an appropriate federation protocol which is compatible with the destination service provider; and

selecting the appropriate federation protocol to be the second federation protocol.

4. The method of claim 1, wherein the first and second federation protocols comprise different protocols.

5. The method of claim 1, wherein the first and second federation protocols comprise a same protocol.

6. The method of claim 1, wherein assertions of user identities are received from multiple domains of an organization.

7. The method of claim 1, wherein assertions of user identities are sent to multiple domains within an organization.

8. A router for managing trust relationships between federated identity and service providers, the router comprising a processor and memory, wherein the memory includes:

computer-readable code configured to receive an assertion of a user identity from an identity provider via a first federation protocol, wherein a destination service provider is indicated with the assertion;

computer-readable code configured to verify permission of the user identity to access the destination service provider;

computer-readable code configured to determine a second federation protocol which is compatible to the destination service provider; and

computer-readable code configured to assert the user identity to the destination service provider via the second federation protocol.

9. The router of claim 8, wherein the memory further includes computer-readable code configured to generate a view of the user identity for presentation to the destination service provider.

10. The router of claim 8, wherein the first and second federation protocols comprise different protocols.

11. The router of claim 8, wherein the first and second federation protocols comprise a same protocol.

12. The router of claim 8, wherein the router is configured to receive assertions of user identities from multiple domains of an organization.

13. The router of claim 8, wherein the router is configured to send assertions of user identities to multiple domains within an organization.

14. An apparatus for managing trust relationships between federated identity and service providers, the apparatus comprising:

means for intercepting an assertion of a user identity from an identity provider, wherein a destination service provider is indicated with the assertion;

means for checking permission of the user identity to access the destination service provider;

means for constructing a view of the user identity for presentation to the destination service provider; and

means for sending the constructed view of the user identity to the destination service provider.

15. The apparatus of claim 14, further comprising:

means for determining a federation protocol which is compatible with the destination service provider; and

means for selecting the determined federation protocol for use in sending the using identity to the destination service provider.