Method and apparatus for establishing a federated identity using a personal wireless device

• US 20050278547A1
• Filed: 06/09/2004
• Published: 12/15/2005
• Est. Priority Date: 06/09/2004
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Hyndman, Arn, Sauriol, Nicholas
• Granted Patent: US 8,522,039 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A federated identity, established through possession of a single sign-on token, will allow a personal wireless device (PWD) to be used in a commercial environment to purchase goods or services, access a building, access a telephone, wireless, or computer network, or in numerous other instances. The token may be obtained by the user authenticating with the PWD and the PWD authenticating with the network. When the PWD comes within range of a service provider, a session is established using a short range wireless protocol, such as Bluetooth or infrared. The session is secured using a security protocol such as SSL, and the service provider authenticates its identity to the PWD. Policy may be implemented regarding transmission of the token to the service provider. Upon receipt of the token, the service provider will validate the token with the federated identity provider, obtain identifying information, and complete the transaction.

Claims

1. A method for establishing an identity, the method comprising the steps of:

authenticating an user to a personal wireless device;

authenticating the personal wireless device to a federated identity provider to obtain a token for the user; and

storing the token on the personal wireless device.

2. The method of claim 1, wherein the personal wireless device is a cellular telephone.

3. The method of claim 1, wherein the token is obtained via a wireless network, the personal wireless device being configured to communicate over the wireless network, and wherein the token is obtained by the personal wireless device when the personal wireless device registers with the wireless network.

4. The method of claim 3, wherein the personal wireless device is configured to acquire the token on behalf of the user.

5. The method of claim 1, further comprising the step of establishing a session with a service provider.

6. The method of claim 5, wherein the step of establishing a session with the service provider comprises establishing a short range wireless communication session with the service provider.

7. The method of claim 6, wherein the short range wireless communication session is formed using a Bluetooth protocol.

8. The method of claim 6, wherein the short range wireless communication session is formed selectively using one of Bluetooth and Infrared depending on at least one of the type of transaction, a level of security required for the transaction, and user policy.

9. The method of claim 5, further comprising the step of securing a channel over the session.

10. The method of claim 9, wherein the step of securing a channel comprises encrypting communications on the channel.

11. The method of claim 10, wherein the step of encrypting communications is accomplished using a secure socket layer protocol.

12. The method of claim 9, further comprising selectively providing the token over the secure channel to establish the identity according to a policy.

13. The method of claim 12, wherein the step of providing the token comprises passing the token to a third party to allow the token to be verified the federated identity provider.

14. The method of claim 13, wherein the step of providing the token allows the user'"'"'s identity to be proved to the third party.

15. The method of claim 12, wherein the policy comprises a set of rules relating to whether particular service providers or classes of service providers should receive the token automatically, never, or upon direction by the user.

16. The method of claim 5, further comprising the step of verifying an identity of the service provider to the personal wireless device.

17. The method of claim 16, wherein the step of verifying the identity occurs via Secure Socket Layer (SSL).

18. The method of claim 16, wherein the step of verifying an identity of the service provider comprises obtaining service provider identification information comprising vendor instance information identifying the service provider terminal associated with the service provider.

19. The method of claim 18, wherein first vendor instance information is associated with wireless signals of a first strength, second vendor instance information is associated with wireless signals of a second strength, and wherein the personal wireless device preferentially selects vendor instance information according to the signal strengths.

20. The method of claim 5, further comprising the step of terminating the session with the service provider.

21. The method of claim 20, wherein the step of terminating the session with the service provider comprises automatically terminating the session upon a change of signal characteristics on the session.

22. A method of validating an identity of a customer by a service provider, comprising:

establishing a short range wireless session with a personal wireless device associated with the customer;

securing a channel over the short range wireless session; and

obtaining an identification token over the secured channel.

23. The method of claim 22, further comprising the step of authenticating to the personal wireless device, an identity of the service provider.

24. A method of conducting a transaction with a cellular telephone, the method comprising the steps of:

establishing a short range wireless Bluetooth connection with a service provider terminal;

encrypting the session to create a secure channel using secure socket layer; and

transmitting a federated identity single sign on token over the secure channel using Security Assertion Markup Language (SAML).