Techniques for securing electronic identities
First Claim
1. A method for generating temporarily assigned identity information implemented in a computer-readable medium and executed on a proxy service to perform the method, comprising:
- authenticating, by a proxy server, identity information associated with a request received from a requestor for accessing a service, the request is sent from the requestor to the service and intercepted for processing;
generating, by a proxy server, temporarily assigned identity information for the requestor, the temporarily assigned identity information is in a syntax and format recognized by the service,and the temporary assigned identity information is unique to each of the requests and expires when the requestor terminates communication sessions associated with the services, and the temporarily assigned identity information includes a combination of, a password, a certificate, a token, a biometric value, a hardware value, a network connection value, and a time value, and the temporarily assigned identity information is used to impersonate the requestors,and the original identity information consists of a first subset, which reflects only those portions of the original identity information needed by the services to process the requests, and a second subset, which reflects all the information in the original identity information excluding the first subset,and the temporary assigned identity information includes the first subset of original identity information for the requestors, and excludes the second subset,updating, by a proxy server, a protected identity directory with the temporarily assigned identity information; and
directly transmitting, by a proxy server, the request and the temporarily assigned identity information to the service on behalf of the requestor, the service accesses the protected identity directory with the temporarily assigned identity information to authenticate the requestor for access,and the temporarily assigned identity information is monitored and removed from the protected identity directory and the local identity mapping store when terminating events are detected, and the proxy server detects and denies multiple login events that use the temporary assigned identity information.
11 Assignments
0 Petitions
Accused Products
Abstract
Methods, systems, and data stores generate and manage temporarily assigned identities. A requestor issues a request for a service. The request includes an identity used for authenticating the requestor. The identity is used for generating an identity configuration and for generating a temporarily assigned identity that is updated to a protected identity directory. The request and the temporarily assigned identity are transmitted to the service. The service uses the temporarily assigned identity to access the protected identity directory for purposes of authenticating the request. The service uses the authenticated request to access attributes associated with the temporarily assigned identity.
-
Citations
22 Claims
-
1. A method for generating temporarily assigned identity information implemented in a computer-readable medium and executed on a proxy service to perform the method, comprising:
-
authenticating, by a proxy server, identity information associated with a request received from a requestor for accessing a service, the request is sent from the requestor to the service and intercepted for processing; generating, by a proxy server, temporarily assigned identity information for the requestor, the temporarily assigned identity information is in a syntax and format recognized by the service, and the temporary assigned identity information is unique to each of the requests and expires when the requestor terminates communication sessions associated with the services, and the temporarily assigned identity information includes a combination of, a password, a certificate, a token, a biometric value, a hardware value, a network connection value, and a time value, and the temporarily assigned identity information is used to impersonate the requestors, and the original identity information consists of a first subset, which reflects only those portions of the original identity information needed by the services to process the requests, and a second subset, which reflects all the information in the original identity information excluding the first subset, and the temporary assigned identity information includes the first subset of original identity information for the requestors, and excludes the second subset, updating, by a proxy server, a protected identity directory with the temporarily assigned identity information; and directly transmitting, by a proxy server, the request and the temporarily assigned identity information to the service on behalf of the requestor, the service accesses the protected identity directory with the temporarily assigned identity information to authenticate the requestor for access, and the temporarily assigned identity information is monitored and removed from the protected identity directory and the local identity mapping store when terminating events are detected, and the proxy server detects and denies multiple login events that use the temporary assigned identity information. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method for generating temporarily assigned identity information implemented in a computer-readable medium and executed on a proxy service to perform the method, comprising:
-
acquiring, by a proxy server, a request for a service from a requestor that makes the request directly to the service; authenticating, by a proxy server, the request; compiling, by a proxy server, an identity configuration for the request; generating, by a proxy server, temporarily assigned identity information for the request using the identity configuration, and wherein the temporarily assigned identity information impersonates a requestor, and the temporary assigned identity information is unique to each of the requests and expires when the requestor terminates communication sessions associated with the services, and the temporarily assigned identity information includes a combination of, a password, a certificate, a token, a biometric value, a hardware value, a network connection value, and a time value, and the original identity information consists of a first subset, which reflects only those portions of the original identity information needed by the services to process the requests, and a second subset, which reflects all the information in the original identity information excluding the first subset, and the temporary assigned identity information includes the first subset of original identity information for the requestors, and excludes the second subset, updating, by a proxy server, a protected identity directory with the temporarily assigned identity information; and directly transmitting, by a proxy server, the temporarily assigned identity information and the request to the service on behalf of the requestor, wherein a mapping between the identity configuration and the temporary assigned identity information is removed from cache when the request expires, and the proxy server detects and denies multiple login events that use the temporary assigned identity information. - View Dependent Claims (11, 12, 13, 14, 15, 16)
-
-
17. An identity information management system, comprising:
-
a proxy server that intercepts requests made for services, the requests are associated with requestors, and the requests are made from the requestors directly to the services and are processed by the proxy server; a local identity mapping store for housing mappings between temporarily assigned identity information and identity configurations, the temporarily assigned identity information and the identity configurations are generated from identity information provided with the requests; and a protected identity directory updated with the temporarily assigned identity information and accessed by the services in order to authenticate the requests, the requests and the temporarily assigned identity information are directly transmitted to the services on behalf of the requestors by the proxy server and the temporarily assigned identity information is in a syntax and semantic format recognized by the services for authenticating access to the services, and the temporary assigned identity information is unique to each of the requests and expires when the requestor terminates communication sessions associated with the services, and the temporarily assigned identity information includes a combination of, a password, a certificate, a token, a biometric value, a hardware value, a network connection value, and a time value, and the temporarily assigned identity information is used to impersonate the requestors, and the original identity information consists of a first subset, which reflects only those portions of the original identity information needed by the services to process the requests, and a second subset, which reflects all the information in the original identity information excluding the first subset, and the temporary assigned identity information includes the first subset of original identity information for the requestors, and excludes the second subset, the temporarily assigned identity information is monitored and removed from the protected identity directory and the local identity mapping store when terminating events are detected, and the proxy server detects and denies multiple login events that use the temporary assigned identity information. - View Dependent Claims (18, 19, 20, 21, 22)
-
Specification