System and method for pool-based identity authentication for service access without use of stored credentials

• US 8,745,700 B2
• Filed: 02/29/2012
• Issued: 06/03/2014
• Est. Priority Date: 05/13/2008
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Kolluru, Raju Venkata, Kleinpeter, Michael Dean
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US13/408,611
• Publication Number:
  US 20120159585A1
• Time in Patent Office: 825 Days
• Field of Search: None
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A computer-implemented system and method for pool-based identity authentication for service access without use of stored credentials is disclosed. The method in an example embodiment includes providing provisioning information for storage in a provisioning repository; receiving a service request from a service consumer, the service request including requestor identifying information; generating an authentication request to send to an authentication authority, the authentication request including requestor identifying information; receiving validation of an authenticated service request from the authentication authority; and providing the requested service to the service consumer.

Claims

1. A method comprising:

receiving a service request from a service consumer, the service request including requestor identifying information;

obtaining an authentication request to send to an authentication authority, the authentication request including information from the service request;

verifying the information from the service request using independently verifiable data corresponding to the service consumer, the independently verifiable data being obtained independently of a service provider providing the requested service;

receiving validation of an authenticated service request; and

providing the requested service to the service consumer.

2. The method as claimed in claim 1 wherein the independently verifiable data includes an IP address of the service consumer.

3. The method as claimed in claim 1 wherein the requester identifying information includes an IP address of the service consumer.

4. The method as claimed in claim 1 wherein the service request is sent using a protocol compatible with the security assertion markup language (SAML).

5. The method as claimed in claim 1 including providing provisioning information for storage in a provisioning repository.

6. The method as claimed in claim 1 including providing provisioning information at initial system/service deployment time.

7. The method as claimed in claim 1 including comparing provisioning information with the requestor identifying information.

8. A method comprising:

providing provisioning information for storage in a provisioning repository;

receiving an authentication request from a service provider, the authentication request including a service request and requestor identifying information that identifies a service consumer that requested a service corresponding to the service request;

verifying the requestor identifying information using independently verifiable data corresponding to the service consumer, the independently verifiable data being obtained independently of a service provider providing the requested service;

matching the service request and requestor identifying information with the provisioning information stored in the provisioning repository;

comparing the provisioning information with the requestor identifying information; and

sending validation of an authenticated service request to the service provider.

9. An apparatus comprising:

a network interface; and

a service provider, coupled to the network interface, to receive a service request from a service consumer, the service request including requestor identifying information;

the service provider to obtain an authentication request to send to an authentication authority, the authentication request including information from the service request, the service provider to verify the information from the service request using independently verifiable data corresponding to the service consumer that is obtained independently of the service provider, the service provider to receive validation of an authenticated service request; and

the service provider to provide the requested service to the service consumer.

10. The apparatus as claimed in claim 9 wherein the independently verifiable data includes an IP address of the service consumer.

11. The apparatus as claimed in claim 9 wherein the requestor identifying information includes an IF address of the service consumer.

12. An apparatus comprising:

a provisioning repository for storing provisioning information; and

an authentication authority to receive an authentication request from a service provider, the authentication request including a service request and requestor identifying information that identifies a service consumer that requested a service corresponding to the service request;

to verify the requestor identifying information using independently verifiable data corresponding to the service consumer, the independently verifiable data being obtained independently of a service provider providing the requested service;

to match the service request and requestor identifying information with the provisioning information stored in the provisioning repository to compare the provisioning information with the requestor identifying information, and to send validation of an authenticated service request to the service provider.