FRAMEWORK AND TECHNOLOGY TO ENABLE THE PORTABILITY OF INFORMATION CARDS

• US 20080229398A1
• Filed: 08/22/2007
• Published: 09/18/2008
• Est. Priority Date: 03/16/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Sanders, Daniel S., Felsted, Patrick R., Sermersheim, James G., Hodgkinson, Andrew A., Norman, James M.
• Granted Patent: US 8,074,257 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

When a user connects a pluggable card store to a machine, the machine plugs a pluggable card provider into a card provider registry. The pluggable card store can be an object portable to the user, or can be a remote store available via some connection, such as an FTP connection. The user can then use the information cards stored on the pluggable card store in a transaction.

Claims

1. An apparatus, comprising:

a machine (105);

a card provider registry (1510) installed on the machine (105); and

a set of pluggable card providers (1545, 1555, 1560) coupled to the card provider registry (1510), each of the set of pluggable card providers (1545, 1555, 1560) operative to access at least one pluggable card store (1515, 1520, 1525, 1530, 1535), each of said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) including at least one information card (1715).

2. An apparatus according to claim 1, wherein:

the card provider registry (1510) is operative to request and receive from each of the set of pluggable card providers (1545, 1555, 1560) a list of information cards in said at least one pluggable card store (1515, 1520, 1525, 1530, 1535); and

each of the set of pluggable card providers (1545, 1555, 1560) is operative to enumerate the at least one information card (1715) in each of said at least one pluggable card store (1515, 1520, 1525, 1530, 1535).

3. An apparatus according to claim 1, further comprising an authenticator (1705) to authenticate a request to access one of said at least one pluggable card stores (1515, 1520, 1525, 1530, 1535).

4. An apparatus according to claim 1, further comprising means for registering (1635) a new pluggable card provider (1545, 1555, 1560) with the card provider registry (1510).

5. An apparatus according to claim 1, further comprising means for deregistering (1635) one of said pluggable card stores (1515, 1520, 1525, 1530, 1535) from said machine (105).

6. An apparatus according to claim 1, wherein each of the set of pluggable card providers (1545, 1555, 1560) includes software to interface with said at least one pluggable card store (1515, 1520, 1525, 1530, 1535).

7. An apparatus according to claim 6, wherein the software to interface said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) is designed to be installed from said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) when said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) is connected to the machine (105).

8. An apparatus according to claim 6, wherein the software to interface said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) is designed to be installed from the machine (105) when said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) is connected to the machine (105).

9. An apparatus according to claim 6, wherein the software to interface said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) is designed to be installed from an external source (1630) when said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) is connected to the machine (105).

10. An apparatus according to claim 1, wherein the machine (105) includes at least one connector to connect said at least one pluggable card store (1515, 1520, 1525, 1530, 1535) to the machine (105).

11. An apparatus according to claim 10, wherein at least one of the set of pluggable card providers (1545, 1555, 1560) is operative to add a new pluggable card store (1515, 1520, 1525, 1530, 1535) when said new pluggable card store (1515, 1520, 1525, 1530, 1535) is connected to the at least one connector.

12. An apparatus according to claim 10, wherein at least one of the set of pluggable card providers (1545, 1555, 1560) is operative to remove an old pluggable card store (1515, 1520, 1525, 1530, 1535) when said old pluggable card store (1515, 1520, 1525, 1530, 1535) is disconnected from the at least one connector.

13. An apparatus according to claim 12, wherein the at least one of the set of pluggable card providers (1545, 1555, 1560) is operative to be uncoupled from the card provider registry (1510) if the at least one of the set of pluggable card providers (1545, 1555, 1560) is not interfacing with at least one pluggable card store (1515, 1520, 1525, 1530, 1535).

14. An apparatus according to claim 1, further comprising a receiver (210) is operative to receive a credential (1725) from a user to unlock at least one of said at least one pluggable card stores (1515, 1520, 1525, 1530, 1535).

15. A method for accessing an information card, comprising:

identifying (1805) a pluggable card store (1515, 1520, 1525, 1530, 1535) that is available at a machine (105);

interfacing (1820) with the pluggable card store (1515, 1520, 1525, 1530, 1535) using a pluggable card provider (1545, 1555, 1560);

receiving (1905) a security policy (150) from a relying party (130);

receiving (1935) an identifier of an information card (220, 1715) in the pluggable card store (1515, 1520, 1525, 1530, 1535) from a user;

transmitting (1940) requirements for a security token (160) based on the identified information card (220, 1715) to an identity provider (135);

receiving (1945) the security token (160) from the identity provider (135); and

transmitting (1950) the security token (160) to the relying party (130).

16. A method according to claim 15, wherein interfacing (1820) with the pluggable card store (1515, 1520, 1525, 1530, 1535) includes unlocking (1830, 1835) the pluggable card store (1515, 1520, 1525, 1530, 1535).

17. A method according to claim 16, wherein unlocking (1830, 1835) the pluggable card store (1515, 1520, 1525, 1530, 1535) includes:

receiving (1830) a credential (1725) from the user; and

providing (1835) the credential (1725) to the pluggable card store (1515, 1520, 1525, 1530, 1535) to enable the pluggable card store (1515, 1520, 1525, 1530, 1535) to authenticate the user.

18. A method according to claim 15, wherein receiving (1935) an identifier of an information card (220, 1715) in the pluggable card store (1515, 1520, 1525, 1530, 1535) includes presenting (1915, 1930) the set of information cards available on the machine (105) to the user.

19. A method according to claim 18, wherein presenting (1915, 1930) the set of information cards available on the machine (105) includes presenting (1915) a subset of the set of information cards available on the machine (105), the subset including information cards that satisfy (1910) the security policy (150).

20. A method according to claim 18, wherein presenting (1915, 1930) the set of information cards available on the machine (105) includes:

presenting (1920) a list of pluggable card stores (1515, 1520, 1525, 1530, 1535) managed by the pluggable card provider (1545, 1555, 1560) to the user;

receiving (1925) a selection of the pluggable card store (1515, 1520, 1525, 1530, 1535) from the user; and

presenting (1930) the set of information cards available on the pluggable card store (1515, 1520, 1525, 1530, 1535) to the user.

21. A method according to claim 15, further comprising determining (2005) that the pluggable card store (1515, 1520, 1525, 1530, 1535) is no longer available at a machine (105).

22. A method according to claim 21, further comprising unplugging (2015) the pluggable card provider (1545, 1555, 1560) from the card provider registry (1510).

23. A method according to claim 15, further comprising plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510).

24. A method according to claim 23, wherein plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510) includes installing (1815) software implementing the pluggable card provider (1545, 1555, 1560) from the machine (105).

25. A method according to claim 23, wherein plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510) includes installing (1815) software implementing the pluggable card provider (1545, 1555, 1560) from the pluggable card store (1515, 1520, 1525, 1530, 1535).

26. A method according to claim 23, wherein plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510) includes installing (1815) software implementing the pluggable card provider (1545, 1555, 1560) from an external source (1630).

27. An article, comprising a storage medium, said storage medium having stored thereon instructions that, when executed by a machine, result in:

identifying (1805) a pluggable card store (1515, 1520, 1525, 1530, 1535) that is available at a machine (105);

interfacing (1820) with the pluggable card store (1515, 1520, 1525, 1530, 1535) using a pluggable card provider (1545, 1555, 1560);

receiving (1905) a security policy (150) from a relying party (130);

receiving (1935) an identifier of an information card (220, 1715) in the pluggable card store (1515, 1520, 1525, 1530, 1535) from a user;

transmitting (1940) requirements for a security token (160) based on the identified information card (220, 1715) to an identity provider (135);

receiving (1945) the security token (160) from the identity provider (135); and

transmitting (1950) the security token (160) to the relying party (130).

28. An article according to claim 27, wherein interfacing (1820) with the pluggable card store (1515, 1520, 1525, 1530, 1535) includes unlocking (1830, 1835) the pluggable card store (1515, 1520, 1525, 1530, 1535).

29. An article according to claim 28, wherein unlocking (1830, 1835) the pluggable card store (1515, 1520, 1525, 1530, 1535) includes:

receiving (1830) a credential (1725) from the user; and

providing (1835) the credential (1725) to the pluggable card store (1515, 1520, 1525, 1530, 1535) to enable the pluggable card store (1515, 1520, 1525, 1530, 1535) to authenticate the user.

30. An article according to claim 27, wherein receiving (1935) an identifier of an information card (220, 1715) in the pluggable card store (1515, 1520, 1525, 1530, 1535) includes presenting (1915, 1930) the set of information cards available on the machine (105) to the user.

31. An article according to claim 30, wherein presenting (1915, 1930) the set of information cards available on the machine (105) includes presenting (1915) a subset of the set of information cards available on the machine (105), the subset including information cards that satisfy (1910) the security policy (150).

32. An article according to claim 30, wherein presenting (1915, 1930) the set of information cards available on the machine (105) includes:

presenting (1920) a list of pluggable card stores (1515, 1520, 1525, 1530, 1535) managed by the pluggable card provider (1545, 1555, 1560) to the user;

receiving (1925) a selection of the pluggable card store (1515, 1520, 1525, 1530, 1535) from the user; and

presenting (1930) the set of information cards available on the pluggable card store (1515, 1520, 1525, 1530, 1535) to the user.

33. An article according to claim 27, further comprising determining (2005) that the pluggable card store (1515, 1520, 1525, 1530, 1535) is no longer available at a machine (105).

34. An article according to claim 33, further comprising unplugging (2015) the pluggable card provider (1545, 1555, 1560) from the card provider registry (1510).

35. An article according to claim 27, wherein said storage medium has stored thereon further instructions that, when executed by the machine, result in plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510).

36. An article according to claim 35, wherein plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510) includes installing (1815) software implementing the pluggable card provider (1545, 1555, 1560) from the machine (105).

37. An article according to claim 35, wherein plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510) includes installing (1815) software implementing the pluggable card provider (1545, 1555, 1560) from the pluggable card store (1515, 1520, 1525, 1530, 1535).

38. An article according to claim 35, wherein plugging (1810, 1815) the pluggable card provider (1545, 1555, 1560) into the card provider registry (1510) includes installing (1815) software implementing the pluggable card provider (1545, 1555, 1560) from an external source (1630).