Identity management and single sign-on in a heterogeneous composite service scenario

• US 8,474,017 B2
• Filed: 07/23/2010
• Issued: 06/25/2013
• Est. Priority Date: 07/23/2010
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Schultz, Paul T., Hahn, Mark J., Sartini, Robert A.
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): CORUM JR, WILLIAM A
• Application Number:
  US12/842,227
• Publication Number:
  US 20120023556A1
• Time in Patent Office: 1,068 Days
• Field of Search: 726/4, 726/5, 726/8, 726/9
• US Class Current: 726/4
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers

Abstract

A server device that includes a memory to store identity information for a group of users, policy information, and context information for a group user devices. The server device also includes a processor to receive, from another server device, a request for login credentials, associated with a user of a user device, that enable a third party application to access a service provider on behalf of the user, the request including identity information associated with the user and context information associated with the user device; verify the identity of the user based on a determination that particular identity information is stored in the memory; authorize the disclosure of the particular identity information based on a determination that the context information matches particular context information stored in the memory and that the policy information permits the disclosure of the particular identity information; and send the particular identity information, that includes the login credentials, to the other server device based on the verified identity and the authorized disclosure.

Claims

1. A method performed by a first server device, the method comprising:

receiving, by the first server device and from a second server device that hosts a third party application, a first request to verify an identity of a user of a user device associated with the third party application,

the first request including a token containing identity information of the user and information regarding two or more service provider applications from which services are to be obtained by the third party application on behalf of the user;

determining, by the first server device, whether the identity information, of the user, matches stored identity information stored in a memory of the server device;

retrieving, by the first server device and from the memory, context information of the user device, when the identity information matches the stored identity information, the context information including location information, that identifies a first location of the user device during a prior session to verify the identity of the user;

comparing, by the first server device, a second location of the user device, at a present point in time, with the first location of the user device;

retrieving, by the first server device and from the memory, the identity information when the second location of the user device matches the first location of the user device; and

sending, by the first server device and to the second server device, the identity information, where the identity information includes login credentials, of the user, said login credentials permitting the third party application to access the two or more service provider applications on behalf of the user.

2. The method of claim 1, further comprising:

receiving, from a third server device, a second request to verify the identity of the user, the third server device hosting one or more service provider applications, of the two or more service provider applications;

sending, to a fourth server device and based on the second request, other identity information of the user, the fourth server device being part of an identity verification service;

receiving, from the fourth server device, a notification verifying the identity of the user based on the other identity information of the user; and

sending, to the third server device, another notification verifying the identity of the user.

3. The method of claim 2, where the other identity information is an OpenID and the identity verification service is based on an OpenID decentralized authentication standard.

4. The method of claim 1, further comprising:

receiving, from a third server device, a second request to verify the identity of the user, the third server device hosting one or more service provider applications of the two or more service provider applications;

sending, based on the second request, a query to the user device requesting other identity information of the user;

receiving, from the user device, the other identity information;

determining whether the other identity information matches the identity information stored in the memory; and

sending, to the third server device, a notification verifying the identity of the user when the other identity information matches the identity information.

5. The method of claim 1, further comprising:

retrieving, from the memory, policy information that includes conditions under which the third party application is authorized to access the two or more service provider applications; and

authorizing the identity information to be sent to the third party application when the conditions have been satisfied.

6. The method of claim 5, where the conditions include an access threshold that establishes a quantity of times that the third party application is authorized to access the two or more service provider applications over a particular period of time;

and

where authorizing the identity information to be sent to the third party application includes;

determining that the quantity of times that the third party application has accessed the two or more service provider applications is less than or equal to the access threshold.

7. The method of claim 5, where the conditions include an access threshold that establishes a quantity of times that the third party application is authorized to access the two or more service provider applications over a particular period of time;

and

where authorizing the identity information to be sent to the third party application includes;

determining whether the quantity of times that the third party application has accessed the two or more service provider applications is greater than the access threshold; and

sending a notification to the third party application indicating that additional costs will be incurred when the quantity of times that the third party application has accessed the two or more service provider applications is greater than the access threshold.

8. The method of claim 1, further comprising:

retrieving, from the memory, permission information that establishes a manner in which the third party application is authorized to access the two or more service provider applications; and

authorizing the identity information to be sent to the third party application when the identity information is sent in the manner authorized.

9. The method of claim 8, where the permission information indicates that the other user has authorized the two or more service provider applications to be accessed during business hours;

and

where authorizing the identity information to be sent to the third party application includes;

determining that the third party application is to access the two or more service provider applications during the business hours.

10. A first server device, comprising:

a memory to store identity information for a plurality of users, policy information for the server device, and particular context information of a plurality of user devices, and

a processor to execute instructions in the memory to;

receive, from a second server device that hosts a third party application, a request to receive login credentials of a user of a user device, where the login credentials enable the third party application to access at least two service provider applications on behalf of the user, the request including a token containing identity information for the user and context information that includes capabilities of the user device,

perform an identity verification operation to determine whether particular identity information, for the user, is stored in the memory, the particular identity information including the login credentials,

perform an authorization operation to determine whether the context information, matches the particular context information stored in the memory or whether the policy information permits the disclosure of the particular identity information, and

send the particular identity information to the second server device to be used by the third party application to access the two or more service provider applications, on behalf of the user, when the identity of the user is verified as a result of the identity verification operation and when the disclosure of the particular identity information is permitted as a result of the authorization operation.

11. The first server device of claim 10, where, when performing the identity verification operation, the processor is further to:

determine whether the identity information for the user matches the particular identity information, and

when the identity information matches the particular identity information;

verify the identity of the user, and when the identity information does not match the particular identity information;

query the user device to obtain other identity information with which to verify the identity of the user.

12. The first server device of claim 10, where, when performing the authorization operation, the processor is further to:

compare particular capabilities of the user device, at a prior point in time and obtained from the particular context information, with the capabilities of the user device obtained from the token, and

authorize the disclosure of the particular identity information when the particular capabilities of the user device match the capabilities of the user device.

13. The first server device of claim 10, where, when performing the authorization operation, the processor is further to:

retrieve, from the memory,

the particular context information of the user device, the particular context information including usage patterns, associated with

service provider applications, from a prior point in time,

determine whether the service provider applications, accessed by the third party application at the prior point in time, are same as the two or more service provider applications, and

authorize the disclosure of the particular identity information when the service provider applications are same as the two or more service provider applications.

14. The first server device of claim 10, where, when performing the authorization operation, the processor is further to:

retrieve, from the memory, the policy information, and

determine, from the policy information, that the third party application is authorized for read only access to the two or more service provider applications.

15. The first server device of claim 10, where the particular identity information sent to the second server device includes a token;

and

where the processor is further to;

store a time-to-live quantity in the token that establishes a period of time after which the third party application is no longer authorized to access the two or more service provider applications.

16. The first server device of claim 10, where the processor is further to:

receive, from a third server device, a request for content access to obtain other identity information for the user that includes a first token associated with a content access protocol,

the third server device hosting one of the two or more service provider applications,

authorize the first token associated with the content access protocol, on behalf of the third server device, using a login credential of the user,

receive a second token, from the third server device, to confirm content access, the second token being associated with the content access protocol,

authorize the second token on behalf of the second server device, and

send, to the third server device, the other identity information of the user.

17. The first server device of claim 16, where the login credential of the user is an OpenID and the content access protocol is based on an OAuth protocol.

18. The first server device of claim 10, where the processor is further to:

determine that a quantity of times that the third party application has accessed the two or more service application providers, on behalf of the user, is greater than a threshold, and

perform an operation to implicitly register the third party application to expedite the identity verification operation or the authorization operation, at a future point in time,

where, when performing the operation to implicitly register the third party application on behalf of the user, the processor is to;

store the particular identity information or information contained in the token when the quantity of times that the third party application has accessed the two or more service application providers, on behalf of the user, is greater than the threshold.

19. A system comprising:

a storage device to store;

identity information of a user of a user device, the identity information including a plurality of identity entries of the user, and

context information that identifies a location of the user device or capabilities of the user device at a prior point in time; and

a first server device to;

receive, from a second server device that hosts a third party application, a first request to verify an identity of the user with which the third party application is associated,

the first request including one or more identity entries,

determine whether the one or more identity entries match at least one identity entry of the plurality of identity entries,

retrieve, from the storage device, the plurality of identity entries when the one or more identity entries match the at least one identity entry,

the plurality of identity entries including login credentials for at least one service provider application from which services are to be obtained by the third party application,

retrieve, from the storage device, the context information when the one or more identity entries match the at least one identity entry,

compare particular context information, associated with the user device at a present point in time, with the retrieved context information to determine whether the particular context information matches the retrieved context information, and

send, to the second server device, the login credentials for the at least one service provider application when the particular context information matches the retrieved context information.

20. The system of claim 19, where the first server device is to:

receive, from a third server device, a second request to verify the identity of the user,

the third server device hosting a particular service provider application;

send, to the user device and based on the second request, a query to obtain one or more other identity entries of the user;

receive, from the user device, the one or more other identity entries;

determine whether the one or more other identity entries match at least one other identity entry, of the plurality of identity entries, stored in the storage device; and

send, to the first server device, a notification verifying the identity of the user when the one or more other identity entries match the at least one other identity entry.

21. The system of claim 19, where, when comparing the particular context information with the retrieved context information, the first server device is further to:

send, to the user device, a query to obtain the particular context information, and

receive, from the user device, the particular context information.

22. The system of claim 19, where, when comparing the particular context information with the retrieved context information, the first server device is to:

compare the capabilities of the user device, at the prior point in time, with information associated with capabilities of the user device specified in the request, and

permit the login credentials to be sent to the third party application when the capabilities of the user device, at the prior point in time, match the capabilities of the user device specified in the request.

23. The system of claim 19, where the first server device is further to:

retrieve, from the storage device, policy information associated with the first server device that includes conditions under which the third party application is permitted to access the at least one service provider application, and

permit the login credentials to be sent to the third party application when the conditions have been satisfied.

24. The system of claim 19, where the first server device is further to:

retrieve, from the storage device, permission information that establishes a manner in which the third party application is permitted, by another user of another user device, to access the at least one service provider application to obtain information associated with the other user device, and

permit the login credentials to be sent to the third party application when the login credentials are sent in the manner permitted by the other user.