SYSTEM AND METHOD FOR ORDERED CREDENTIAL SELECTION

• US 20090037994A1
• Filed: 07/30/2007
• Published: 02/05/2009
• Est. Priority Date: 07/30/2007
• Status: Abandoned Application

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Buss, Duane
• Application Number:
  US11/830,492
• Publication Number:
  US 20090037994A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for assisting in ordered credential selection is disclosed. In one embodiment, the system enables ordered credential selection for credentials associated with one or more digital identities. The system comprises a plurality of security tokens, with each security token comprising a claim associated with a digital identity and where at least two of the security tokens are different from each other. The system also comprises an ordering module and manager module. The ordering module imposes a preferential ordering on the security tokens in accordance with an ordering policy to select a preferred security token. The manager module transmits at least one security token in response to a request, where at least one of the security tokens transmitted by the manager module is the preferred security token.

Claims

1. A system for enabling ordered credential selection wherein the credential is associated with a digital identity, the system comprising:

a plurality of security tokens, wherein each security token comprises a claim regarding a digital identity and at least two of the security tokens are different from each other;

an ordering module adapted to impose a preferential ordering on the plurality of security tokens in accordance with an ordering policy to select a preferred security token;

a manager module adapted to transmit at least one of the security tokens in response to a request;

wherein at least one of the security tokens transmitted by the manager module is the preferred security token.

2. The system of claim 1 wherein the request further comprises a security policy and wherein the ordering module imposes the preferential ordering on subset of security tokens taken from the plurality of security tokens, wherein a token from the plurality of security tokens is put into the subset of security tokens if the security token conforms to the security policy.

3. The system of claim 1 wherein one of the plurality of security tokens comprises a proof.

4. The system of claim 1 wherein the manager module is further adapted to requesting at least one of the plurality of security tokens from an identity provider.

5. The system of claim 1 wherein the ordering module comprises at least one of a constraint framework, a historical information tracker, a rules engine, a consistency checker, a value sorter, a reputation checker, a ranking service, a webservice endpoint, a user-provided rule checker, and a differential weighter.

6. The system of claim 1 wherein the ordering policy comprises a plurality of rules, wherein the rules specify at least one of conforming to constraints, evaluating historical usage, using a rules engine, checking for consistency, determining high and low-value credentials, determining site trust level, evaluating a digital reputation, consulting a ranking service, consulting a web service, consulting an operator, and weighting multiple factors according to given criteria.

7. The system of claim 1 further comprising a graphical user interface (GUI) for displaying the plurality of security tokens ordered according to the preferential ordering.

8. A system for enabling ordered credential selection wherein the credential is associated with a digital identity, the system comprising:

a plurality of security tokens, wherein each security token comprises a claim regarding a digital identity and at least two of the security tokens are different from each other;

an ordering module adapted to impose a preferential ordering on the plurality of security tokens in accordance with an ordering policy to select a preferred security token; and

a user interface (UI) adapted to display a representation of each of the plurality of security tokens ordered according to the preferential ordering;

wherein the UI is adapted to receive an input from an operator, the input comprising security token selection information.

9. The system of claim 8 wherein the UI further comprises one of a recommended section, an available section, and a warning section.

10. The system of claim 8 wherein the UI further comprises a description of one of a security token, the preferential ordering, and the preferred security token.

11. The system of claim 8 wherein the UI is a graphical user interface displayed on a computing system and the input from the operator comes from a pointer device.

12. The system of claim 8 further comprising a security policy and wherein the ordering module imposes the preferential ordering on subset of security tokens taken from the plurality of security tokens, wherein a token from the plurality of security tokens is put into the subset of security tokens if the security token conforms to the security policy.

13. The system of claim 12 wherein the display of the plurality of security tokens only comprises security tokens conforming to the security policy.

14. The system of claim 8 wherein the ordering policy comprises a plurality of rules, wherein the rules specify at least one of conforming to constraints, evaluating historical usage, using a rules engine, checking for consistency, determining high and low-value credentials, determining site trust level, evaluating a digital reputation, consulting a ranking service, consulting a web service, consulting an operator, and weighting multiple factors according to given criteria.

15. A method for enabling ordered credential selection wherein the credential is associated with a digital identity, the method comprising:

responsive to a request, loading a plurality of security tokens, wherein each security token comprises a claim regarding a digital identity and at least two of the security tokens are different from each other;

ordering the plurality of security tokens in accordance with an ordering policy;

determining a preferred security token;

transmitting a response to the request, wherein the response comprises the preferred security token.

16. The method of claim 15 wherein the determining a preferred security token comprises receiving selection information from an operator.

17. The method of claim 15 wherein the loading a plurality of security tokens comprises comparing each security token against a security policy and not loading the security token if it does not conform to the security policy.

18. The method of claim 15 further comprising showing a user interface (UI) to an operator and receiving selection information from the operator.

19. The method of claim 18 further comprising hiding at least one security token from the operator.

20. The method of claim 15 wherein the ordering policy comprises a plurality of rules, wherein the rules specify at least one of conforming to constraints, evaluating historical usage, using a rules engine, checking for consistency, determining high and low-value credentials, determining site trust level, evaluating a digital reputation, consulting a ranking service, consulting a web service, consulting an operator, and weighting multiple factors according to given criteria.