Identity selector for use with a user-portable device and method of use in a user-centric identity management system

• US 8,869,257 B2
• Filed: 05/27/2009
• Issued: 10/21/2014
• Est. Priority Date: 05/27/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Open Invention Network LLC
• Inventors: Ahn, Gail-Joon
• Primary Examiner(s): Gelagay, Shewaye
• Application Number:
  US12/472,517
• Publication Number:
  US 20090300742A1
• Time in Patent Office: 1,973 Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols

Abstract

An identity selector manages the identity requirements of an online interaction between a user and a service provider environment. The identity selector is adapted for interoperable use with a user-portable computing device. The user device enables a user to carry identification information and to generate security tokens for use in authenticating the user to a service provider. The identity selector includes an agent module that facilitates communication with the user device. The identity selector imports the user identities from the user device and determines which user identities satisfy a security policy of a relying party. After the user selects one of the eligible user identities, the identity selector generates a token request based on the selected identity and forwards it to the user device, which in response issues a security token. The security token is returned to the identity selector and used to facilitate the authentication process.

Claims

1. In an environment comprising a service provider environment including at least one identity provider and at least one relying party, and a user-portable user computing device including user identity information comprising a plurality of user identities of a user, a system, comprising:

an identity manager system executing on a host computer, the identity manager system programmed to facilitate online interactions between a user and the service provider environment by managing identity requirements of the interactions;

the identity manager system comprises

an agent module programmed to manage communications between the identity manager system and the user computing device,

the agent module programmed further to receive user identity information from the user-portable computing device when the user-portable computer device is connected into the host computer, the user identity information pertaining to a selected one of the plurality of user identities of the user and to use the user identity information to facilitate interactions between the user and the service provider environment, and

wherein the identity manager system is configured to communicate with the service provider environment through a network;

wherein the user-portable computing device comprises;

data storage for providing first user identities;

a token generator, responsive to a token request in reference to one of the first user identities, for issuing a security token relative to the referenced user identity;

wherein the identity manager system further comprises;

second data storage for providing a plurality of second user identities;

an identity selector, responsive to a security policy from a relying party, programmed to determine whether any user identity satisfies the security policy from among the plurality of first user identities and the plurality of second user identities;

user interface programmed to enable the user to make a selection from among the user identities determined to satisfy the security policy; and

wherein the identity selector, responsive to a user selection drawn from the plurality of first user identities, configured to provide a token request based on the selected user identity, communicate the token request to the user computing device, and receive the security token issued by the user computing device in response to the token request.

2. The system of claim 1, wherein the identity manager system configured further to:

(i) receive identity requirements from the service provider environment relating to a service request, (ii) identify, as an eligible user identity, any user identity among the plurality of first user identities that satisfies the identity requirements, (iii) generate a token request in reference to an eligible user identity, (iv) send the token request to the user computing device, (v) receive the security token issued by the user computing device in response to the token request, and (vi) use the security token to facilitate the interactions between the user and the service provider environment relative to compliance with the identity requirements.

3. The system of claim 1, wherein the identity manager system further comprises:

second data storage for providing a plurality of second user identities each associated with a respective identity provider.

4. The system of claim 3, wherein the identity manager system configured further to:

(i) receive identity requirements from the service provider environment relating to a service request, (ii) identify, as an eligible user identity, any user identity among the plurality of first user identities and the plurality of second user identities that satisfies the identity requirements, (iii) enable a user to select an eligible user identity, (iv) generate a token request in reference to the selected user identity, (v) in the event of a user identity selection drawn from the plurality of first identities, send the token request to the user computing device and receive the security token issued by the user computing device in response to the token request, (vi) in the event of a user identity selection drawn from the plurality of second identities, send the token request to the identity provider associated with the selected user identity and receive any security token issued by the identity provider occurring in response to the token request, and (vii) use the security token to facilitate the interactions between the user and the service provider environment relative to compliance with the identity requirements.

5. The system of claim 1, further comprises:

the second data storage comprises a plurality of managed identities each associated with a respective identity provider and a plurality of self-issued identities;

wherein the identity selector, responsive to a user selection drawn from the plurality of managed identities, is configured to provide a token request based on the selected managed identity, communicate the token request to the identity provider associated with the selected managed identity, and receive any security token issued by the identity provider occurring in response to the token request; and

wherein the identity selector, responsive to a user selection drawn from the plurality of self-issued identities, is configured to generate a security token based on the selected self-issued identity.

6. The system of claim 5, further comprises:

a manage programmed to enable a user to create and manage at least one self-issued identity; and

the identity selector is configured to generate a security token in reference to a self-issued identity.

9. The method of claim 6, further comprises:

the host computing system using further includes presenting the security token to the service provider environment to facilitate the interaction relative to compliance with the identity requirements.

10. The method of claim 6, further comprises:

the host computing system retrieving from the user computing device at least one of the first user identities;

the host computing system presenting the retrieved user identities to the user;

the user selecting one of the retrieved user identities; and

the host computing system generating further includes generating a token request relative to the selected user identity.

11. The method of claim 6, further comprises:

the host computing system receiving from the service provider environment a security policy having requirements, the security policy communicated in connection with a request for service occurring within the context of the interaction;

the host computing system determining whether any of the first user identities satisfies the requirements of the security policy;

the user selecting one of the first user identities determined to satisfy the security policy requirements; and

the host computing system generating further includes generating a token request relative to the selected user identity.

7. In an environment including a service provider environment, an identity provider environment, a host computing system, a user-portable user computing device comprising user identity information including a plurality of first user identities of a user, the user computing device configured to communicate with the host computing system, and a network connecting the host computing system to the service provider environment and the identity provider environment, a method, comprising:

the host computing system initiating an interaction with the service provider environment;

the host computing system receiving user identity information pertaining to a selected one of the plurality of user identities of the user from the user computing device connected into the host computer system; and

the host computing system using the user identity information received from the user computing device to manage identity requirements of the interaction;

wherein the user-portable computing device;

stores first user identities;

generates, responsive to a token request in reference to one of the first user identities, a security token relative to the referenced user identity;

second data storage for providing a plurality of second user identities;

an identity selector, responsive to a security policy from a relying party, programmed to determine whether any user identity satisfies the security policy from among the plurality of first user identities and the plurality of second user identities;

user interface programmed to enable the user to make a selection from among the user identities determined to satisfy the security policy; and

wherein the identity selector, responsive to a user selection drawn from the plurality of first user identities, configured to provide a token request based on the selected user identity, communicate the token request to the user computing device, and receive the security token issued by the user computing device in response to the token request.

8. The method of claim 7, further comprises:

the host computing system generating a token request relative to a first user identity;

the host computing system communicating the token request to the user computing device;

the user computing device issuing a security token in response to the token request; and

the host computing system receiving further includes receiving the security token issued by the user computing device.

12. The method of claim 7, further comprises:

the host computing system receiving from the service provider environment a security policy having requirements, the security policy communicated in connection with a request for service occurring within the context of the interaction;

the host computing system providing a plurality of second user identities each associated with a respective identity provider in the identity provider environment;

the host computing system determining whether any of the first user identities and the second user identities satisfies the security policy requirements;

the user selecting one of the user identities determined to satisfy the security policy requirements;

upon a user selection drawn from the first user identities, the host computing system generating a token request based on the selected user identity, the host computing system communicating the token request to the user computing device, the user computing device issuing a security token in response to the token request, and the host computing system receiving further includes receiving the security token issued by the user computing device; and

upon a user selection drawn from the second user identities, the host computing system generating a token request based on the selected user identity, communicating the token request to the identity provider associated with the selected user identity, and receiving any security token issued by the identity provider occurring in response to the token request.

13. In an environment comprising a service provider environment including at least one service provider and at least one identity provider, a user-portable user computing device comprising user identity information including a plurality of first user identities of a user, the user computing device further comprising a means for issuing a security token relative to any of the first user identities in response to a token request referencing one of the first user identities, a non-transitory computer-readable medium having computer-executable instructions for execution by a processor of a host computer, that, when executed, cause the processor to:

generate a token request in reference to one of the first user identities of the user;

communicate the token request to the user computing device connected to the host computer; and

receive the security token issued by the user computing device in response to the token request;

wherein the user-portable computing device;

stores first user identities;

generates, responsive to a token request in reference to one of the first user identities, a security token relative to the referenced user identity;

second data storage for providing a plurality of second user identities;

an identity selector, responsive to a security policy from a relying party, programmed to determine whether any user identity satisfies the security policy from among the plurality of first user identities and the plurality of second user identities;

user interface programmed to enable the user to make a selection from among the user identities determined to satisfy the security policy; and

wherein the identity selector, responsive to a user selection drawn from the plurality of first user identities, configured to provide a token request based on the selected user identity, communicate the token request to the user computing device, and receive the security token issued by the user computing device in response to the token request.

14. The non-transitory computer-readable medium of claim 13, wherein the instructions further cause the processor to:

retrieve from the user computing device at least one of the first user identities;

present the retrieved user identities to a user;

enable the user to select one of the retrieved user identities; and

cause the generate operation to generate a token request relative to the selected user identity.

15. The non-transitory computer-readable medium of claim 13, wherein the instructions further cause the processor to:

receive a security policy in connection with a request for service;

determine whether any of the first user identities satisfies the security policy;

enable the user to select one of the first user identities determined to satisfy the security policy; and

cause the generate operation to generate a token request relative to the selected user identity.

16. The non-transitory computer-readable medium of claim 13, wherein the instructions further cause the processor to:

retrieve from the user computing device at least one of the first user identities;

provide a plurality of second user identities each defining a respective third-party managed identity and associated with a respective identity provider;

enable a user to select one of the retrieved first user identities and the second user identities;

in the event of a user selection pertaining to the first user identities, cause the generate operation to generate a token request relative to the selected first user identity; and

in the event of a user selection pertaining to the second user identities, generate a token request relative to the selected second user identity and direct the token request to the identity provider associated with the selected second user identity.

17. The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the processor to:

receive a security policy in connection with a request for service;

determine whether any of the retrieved first user identities and the second user identities satisfies the security policy; and

cause the enable operation to enable a user to make a selection only among the user identities determined to satisfy the security policy.

18. The non-transitory computer-readable medium of claim 13, wherein the instructions further cause the processor to:

initiate an interaction with the service provider environment;

receive, within the context of the interaction with the service provider environment, a security policy having identity requirements;

manage the security policy identity requirements of the interaction;

the manage operation including operations to;

determine whether any of the first user identities satisfies the security policy identity requirements,

cause the generate operation to generate a token request in reference to a selectable one of the first user identities determined to satisfy the security policy identity requirements, and

use the security token issued by the user computing device to facilitate the interaction relative to compliance with the security policy.