Identity protocol translation gateway

• US 9,641,512 B2
• Filed: 04/10/2014
• Issued: 05/02/2017
• Est. Priority Date: 04/10/2014
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Platt, Darren C., Gile, Michael Scott
• Primary Examiner(s): JACOBS, LASHONDA T
• Application Number:
  US14/249,749
• Publication Number:
  US 20150295917A1
• Time in Patent Office: 1,118 Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

One or more methods of translating identity protocols and a device and a system implementing such methods are described herein. One such method comprises configuring a gateway to communicate with a first identity protocol and a canonical representation, with the canonical representation being different than the first identity protocol. The method may further comprise: including the first identity protocol in a first communication between a first computing device and the gateway, and translating at least a portion of the first communication from the first identity protocol to a canonical representation. The gateway may then translate the at least a portion of the first communication from the canonical representation to a second identity protocol and sending the first communication to a second computing device, including the first identity information in the second identity protocol in the communication.

Claims

1. A method of translating identity protocols comprising,

configuring a gateway to communicate with a first device implementing a first identity protocol;

configuring the gateway to communicate with a second device implementing a second identity protocol, wherein the second identity protocol is different than the first identity protocol;

including the first identity protocol in a first communication between the first computing device and the gateway, wherein the first communication comprises first identity information;

translating the first identity information from the first identity protocol to a canonical representation;

translating the first identity information from the canonical representation to the second identity protocol; and

sending the first identity information to the second computing device, wherein the second identity protocol comprises the first identity information.

2. The method of claim 1 wherein, the first communication between the first computing device and the gateway comprises a communication that is one of,

received at the gateway from a first computing device application;

and

sent from one of,

a service consumer, and

an application infrastructure device.

3. The method of claim 2 wherein, the first communication further comprises a web service call.

4. The method of claim 2 wherein, the application infrastructure device comprises a device implementing at least one of,

SAML;

Shibboleth;

OpenID;

WS-Federation;

OpenID Connect;

SOAP;

REST; and

a proprietary protocol.

5. The method of claim 1 further comprising,

sending a second communication to the gateway from the second computing device, wherein the second communication comprises,

second identity information, and

the second identity protocol;

translating the second identity information from the second identity protocol to the canonical representation;

translating the second identity information from the canonical representation to the first identity protocol; and

sending the second communication to the first computing device, wherein the second identity information comprises the first identity protocol.

6. The method of claim 5 further comprising, adding additional information at the gateway to at least one of the first communication and the second communication, the additional information being related to at least one of,

the first computing device;

the second computing device;

an end user; and

a context related to the transaction.

7. The method of claim 6 wherein,

the additional information comprises at least one of,

identity information,

a preferred end user language;

and

the second computing device comprises a service provider.

21. The method of claim 1, further comprising:

receiving, from a data provider that is a separate device from the gateway and first computing device, additional identity information related to the first computing device;

including the additional identity information in the canonical representation prior to translating the first identity information from the canonical representation to the second identity protocol;

determining, responsive to the additional identity information, whether the first communication between the first computing device and the gateway is a request for information that should not be provided;

wherein sending the first identity information to the second computing device is responsive to determining that the first communication between the first computing device and the gateway is not a request for information that should not be provided; and

terminating the first communication between the first computing device and the gateway without sending the first identity information to the second computing device in response to determining that the first communication between the first computing device and gateway is a request for information that should not be provided.

22. The method of claim 21, wherein the additional identity information includes a location of the first computing device, a type of the first computing device, and at least one interest associated with a user of the first computing device.

23. The method of claim 22, further comprising removing, by a redaction engine within the gateway responsive to the additional identity information, information from the first communication between the first computing device and the gateway prior to sending the first identity information to the second computing device.

8. A non-transitory, tangible computer readable storage medium, encoded with processor readable instructions to perform a method of communicating between computing devices comprising,

receiving a first communication sent from a first computing device to a second computing device, wherein, the first communication,

comprises a first identity protocol, and,

is received at a gateway;

translating the first identity protocol to a canonical representation;

translating the canonical representation to a second identity protocol; and

sending the first identity information to the second computing device,

wherein the second identity protocol comprises the first identity information.

9. The non-transitory, tangible computer readable storage medium of claim 8 further comprising,

configuring the gateway to communicate with the first identity protocol and the second identity protocol prior to receiving the first communication.

10. The non-transitory, tangible computer readable storage medium of claim 9 wherein,

configuring the gateway to communicate with the first identity protocol comprises implementing a first connector at the gateway to communicate with the first computing device;

and

configuring the gateway to communicate with the second identity protocol comprises implementing a second connector at the gateway to communicate with the second computing device.

11. The non-transitory, tangible computer readable storage medium of claim 10, further comprising, configuring the gateway to communicate with at least one additional identity protocol, wherein, configuring the gateway to communicate with the at least one additional identity protocol comprises implementing at least one additional connector at the gateway to communicate with the at least one additional identity protocol.

12. The non-transitory, tangible computer readable storage medium of claim 8 wherein, prior to receiving the communication, the communication is re-routed from a first destination comprising the second computing device to a second destination comprising a gateway device.

13. The non-transitory, tangible computer readable storage medium of claim 8 wherein, the communication comprises one of,

a web service call from an application;

and

an application infrastructure communication.

14. The non-transitory, tangible computer readable storage medium of claim 8 wherein,

the communication comprises a token;

and

at least one of translating the first identity protocol to a canonical representation and translating the canonical representation to a second identity protocol comprises using the token to perform the translation.

15. The non-transitory, tangible computer readable storage medium of claim 8, further comprising, adding information at the gateway to at least one of the first communication and the second communication, the information being related to at least one of,

the first computing device;

the second computing device

an end user; and

a context related to the transaction.

16. An identity protocol translation computing device comprising,

a first connector portion adapted to communicate with a first identity protocol;

a second connector portion adapted to communicate with a second identity protocol; and

one or more processing engines and transformation rules adapted to process and translate,

identity information from the first identity protocol to a canonical representation, and

the canonical representation to the second identity protocol,

wherein the second identity protocol comprises the identity information.

17. The identity protocol translation computing device of claim 16, further comprising,

at least one authorization engine;

and

at least one redaction engine, wherein,

the at least one authorization engine and at least one redaction engine are adapted to modify the information sent to one or more computing devices, based on one or more received additional identity information.

18. The identity protocol translation computing device of claim 16, further comprising a crypto key management portion, wherein the crypto key management portion is adapted to encrypt and decrypt information sent from/to the identity protocol translation device.

19. The identity protocol translation computing device of claim 16, further comprising a user data enhancement portion wherein, the user data enhancement portion is adapted to add information to one or more communications sent one of from and to the identity protocol translation computing device.

20. The identity protocol translation computing device of claim 16, wherein, one of the first connector portion and the second connector portion is adapted to communication with one or more of a protocol comprising,

SAML 1.1;

SAML 2;

OpenID;

OAuth;

Windows Auth;

Web Access Mgr Auth; and

at least one of a custom and a proprietary protocol.