System integrating an identity selector and user-portable device and method of use in a user-centric identity management system

• US 8,402,526 B2
• Filed: 05/27/2009
• Issued: 03/19/2013
• Est. Priority Date: 05/27/2008
• Status: Active Grant

• Current Assignee: Philips North America LLC (Koninklijke Philips N.V.)
• Original Assignee: Open Invention Network LLC
• Inventors: Ahn, Gail-Joon
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US12/472,489
• Publication Number:
  US 20090300746A1
• Time in Patent Office: 1,392 Days
• Field of Search: 726/9
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A combination includes a user-portable computing device, and an identity selector adapted for interoperable use with the user device. The user computing device includes a security token service that issues security tokens in reference to a portfolio of user identities stored as information cards on the user device. The issuance of security tokens employs user attribute information that is stored onboard the user device. The identity selector exports the information cards from the user device and determines which user identity satisfies a security policy promulgated by a relying party as part of an authentication process within the context of an online interaction. The identity selector generates a token request based on one of the eligible user identities, and forwards the token request to the user device to invoke the token issuance operation. The identity selector presents the issued security token to the relying party to comply with the security policy.

Claims

1. In an environment including a service provider environment, an identity provider environment, a host computing system, a user-portable user computing device comprising user identity information including a plurality of first user identities of a user, the user computing device configured to communicate with the host computing system, and a network connecting the host computing system to the service provider environment and the identity provider environment, a method, comprising:

the host computing system initiating an interaction with the service provider environment;

the host computing system receiving from the service provider environment identity requirements for a user relating to the interaction;

the host computing system determining whether any user identity among at least one of the first user identities of the user satisfies the identity requirements;

the host computing system generating a token request with respect to a selective one of any user identity determined to satisfy the identity requirements;

the host computing system communicating the token request to the user computing device;

the user computing device issuing a security token according to the token request; and

the user computing device communicating the security token to the host computing system.

2. The method of claim 1, further comprises:

the host computing system providing a plurality of second user identities each associated with a respective identity provider;

the host computing system determining further includes determining whether any user identity among the second user identities satisfies the identity requirements;

the host computing system enabling the user to select one of the user identities determined to satisfy the identity requirements;

upon a user selection relating to the first user identities, the host computing system generating further includes generating a token request with respect to the selected first user identity; and

upon a user selection relating to the second user identities, the host computing system generating a token request with respect to the selected second user identity and communicating the token request to the identity provider environment.

3. The method of claim 1, further comprises:

the user computing device issuing further includes operating a security token service.

4. The method of claim 3, further comprises:

the user computing device providing at least one user attribute; and

the user computing device issuing further includes using the at least one user attribute.

5. The method of claim 1, further comprises:

the host computing system receiving further includes receiving a security policy;

the user computing device exporting at least one first user identity to the host computing system, in response to an import request from the host computing system;

the host computing system determining further includes determining whether any user identity among the exported first user identities satisfies the security policy;

the host computing system presenting to the user at least one of the exported first user identities determined to satisfy the security policy;

the host computing system enabling the user to select one of the presented user identities; and

the host computing system generating further includes generating a token request relative to the selected user identity.

6. The method of claim 1, further comprises:

the user computing device exporting at least one first user identity to the host computing system, in response to an import request from the host computing system; and

the host computing system determining further includes determining whether any of the exported identities satisfies the identity requirements.

7. The method of claim 1, further comprises:

the host computing system receiving the security token from the user computing device; and

the host computing system presenting the security token to the service provider environment to facilitate the interaction relative to compliance with the identity requirements.

8. The method of claim 1, wherein the plurality of first identities includes at least one third-party managed information card.

9. In an environment comprising a service provider environment including at least one identity provider and at least one relying party, a system, comprising:

a user-portable user computing device;

the user computing device comprising;

a storage including a plurality of first user identities for a user,

a storage including at least one user attribute, and

the user computing device programmed to receive a token request in reference to a first user identity and for generating a security token in accordance with the token request, using the at least one user attribute;

the system further comprising;

an identity manager system configured to facilitate interactions between a user and the service provider environment by managing identity requirements of the interactions;

the identity manager system comprises;

an agent module programmed to manage communications between the identity manager system and the user computing device, and

the agent module programmed further to generate a token request; and

means for enabling communications between the identity manager system and the service provider environment.

10. The system of claim 9, wherein the identity manager system configured further to:

(i) receive identity requirements from the service provider environment, (ii) identify, as an eligible identity, any user identity among the plurality of first user identities of the user that satisfies the identity requirements, (iii) generate a token request in reference to an eligible user identity, (iv) send the token request to the first means of the user computing device, and (v) receive the security token generated by the first means in response to the token request.

11. The system of claim 9, wherein the identity manager system further comprises:

a plurality of second user identities each associated with a respective identity provider.

12. The system of claim 11, wherein the identity manager system configured further to:

(i) receive identity requirements from the service provider environment, (ii) identify, as an eligible user identity, any user identity among the plurality of first user identities and the plurality of second user identities that satisfies the identity requirements, (iii) enable a user to select an eligible user identity, (iv) generate a token request in reference to the selected user identity, (v) in the event of a user identity selection drawn from the plurality of first identities, send the token request to the user computing device and receive the security token generated by the user computing device in response to the token request, (vi) in the event of a user identity selection drawn from the plurality of second identities, send the token request to the identity provider associated with the selected user identity.

13. The system of claim 9, wherein the identity manager system is programmed to:

provide a plurality of second user identities including at least one managed identity;

respond to a security policy from a relying party, by determining whether any user identity satisfies the security policy from among the plurality of first user identities and the plurality of second user identities;

enable the user to make a selection from among the user identities determined to satisfy the security policy; and

respond to a user selection drawn from the plurality of first user identities, by providing a token request based on the selected user identity, communicating the token request to the user computing device, and receiving the security token generated by the user computing device in response to the token request; and

respond to a user selection drawn from one of the managed identities of the plurality of second identities, by providing a token request based on the selected second identity, and communicating the token request to the identity provider associated with the selected second identity.

14. The system of claim 9, wherein the user computing device further comprises:

a smart card configured as a personal portable security device.

15. The system of claim 9, wherein the user identity storage further comprises:

at least one third-party managed information card.

16. The system of claim 9, wherein the at least one attribute of the user attribute storage is sufficient for the first means to formulate any claim concerning any of the first user identities as part of the token generating operation of the first means.

17. In an environment comprising a service provider environment, a user-portable user computing device comprising user identity information including a plurality of first user identities, the user computing device further comprising a means for issuing a security token relative to any of the first user identities in response to a token request referencing one of the first user identities, a non-transitory computer-readable medium having computer-executable instructions for execution by a processor, that, when executed, cause the processor to:

initiate an interaction with the service provider environment;

receive from the service provider environment identity requirements relating to the interaction;

determine whether any user identity among at least one of the first user identities of a user satisfies the identity requirements;

generate a token request with respect to one of any user identity of the user determined to satisfy the identity requirements;

direct the token request to the user computing device; and

receive from the user computing device the security token issued according to the token request.

18. The non-transitory computer-readable medium of claim 17, wherein the instructions further cause the processor to:

receive a security policy from the service provider environment;

import at least one first user identity to the host computing system;

determine whether any user identity among the imported first user identities satisfies the security policy;

enable the user to select one of the imported first user identities determined to satisfy the security policy; and

generate a token request relative to the selected user identity.

19. The non-transitory computer-readable medium of claim 17, wherein the instructions further cause the processor to:

use the security token to facilitate compliance with the identity requirements.

20. The non-transitory computer-readable medium of claim 19, wherein the instructions further cause the processor to:

present the security token to the service provider environment within the context of an authentication process.