MULTI-HOP SINGLE SIGN-ON (SSO) FOR IDENTITY PROVIDER (IdP) ROAMING/PROXY

• US 20130276085A1
• Filed: 12/19/2011
• Published: 10/17/2013
• Est. Priority Date: 08/01/2011
• Status: Active Grant

• Current Assignee: Apple Inc., Intel Corporation
• Original Assignee: Intel Deutschland GmbH (Intel Corporation)
• Inventors: Sharaga, Avishay, Luft, Achim
• Granted Patent: US 9,258,344 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 65/75 Media network packet handling
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04N 21/25833 involving client hardware characteristics, e.g. manufacturer, processing or storage capabilities allocation of resources considering hardware capabilities in multiprogramming arrangements G06F9/5044; allocation of resources considering software capabilities in multiprogramming arrangements G06F9/5055
• CPC Class Codes: H04N 21/2662 Controlling the complexity of the video stream, e.g. by scaling the resolution or bitrate of the video stream based on the client capabilities
• CPC Class Codes: Y02D 30/70 in wireless communication networks

Abstract

Embodiments of the present disclosure describe methods, apparatuses, and systems related to using an identity provider (IdP) as a proxy for another IdP. Other embodiments may be described and/or claimed.

Claims

1. An apparatus, comprising:

a network device of a first identity provider (IdP) that provides a first identity and configured to operate as a proxy, for a second IdP that provides a second identity, to enable the second identity to be used to obtain authorized access to a service that recognizes the first identity,

wherein to operate as the proxy to enable the second identity to be used to obtain authorized access to the service, the network device is configured to;

initiate an authentication process with the second IdP for the second identity; and

if the second identity is determined by the network device to be authenticated by the authentication process, send to the service an assert message associated with the first identity to complete the authorized access to the service; and

a network interface, included in the network device and having a transceiver, configured to communicate with the second IdP.

2. The apparatus of claim 1 wherein the network device includes:

an IdP component configured to receive an authentication request sent by the service;

a relaying party (RP) component configured to send a communication to initiate the authentication process with the second IdP; and

hardware including a processor and a memory configured to store the IdP component and the RP component.

3. The apparatus of claim 2 wherein the IdP component is configured to receive the authentication request from user equipment (UE) that has redirected the authentication request from the service to the network device.

4. The apparatus of claim 2 wherein the RP component is configured to send the communication to initiate the authentication process directly to the second IdP.

5. The apparatus of claim 2 wherein the RP component is configured to send the communication to initiate the authentication process to user equipment for redirection to the second IdP.

6. The apparatus of claim 1 wherein the service includes a web service and wherein the network device is configure to operate as the proxy in a wireless or wired communication network.

7. A method, comprising:

providing, to a first identity provider (IdP) corresponding to a first identity, information pertaining to a second identity corresponding to a second IdP to enable the second identity to be associated with the first identity;

receiving, by the second IdP, a request to authenticate the second identity to enable authorized access to a service that recognizes the first identity;

authenticating, by the second IdP, the second identity; and

sending, by the second IdP, an assert message to enable the first IdP to determine that the second identity has been authenticated.

8. The method of claim 7 wherein the sending includes sending, by the second IdP, the assert message directly to the first IdP.

9. The method of claim 7 wherein the sending includes sending, by the second IdP, the assert message to user equipment for redirection to the first IdP.

10. The method of claim 7 wherein the receiving includes receiving, by the second IdP, the request to authenticate directly from the first IdP.

11. The method of claim 7 wherein the receiving includes receiving, by the second IdP, the request to authenticate as a redirection of a message sent from the first IdP to user equipment.

12. The method of claim 7 wherein the authenticating includes requesting, by the second IdP, user equipment to provide authentication information to authenticate the second identity.

13. An article of manufacture, comprising:

a non-transitory computer-readable medium having computer-readable instructions stored thereon and executable by a processor of a first identity provider (IdP) corresponding to a first identity, to;

in response to receipt of a request to authenticate the first identity, determine that the first identity is linked to a user having a second identity corresponding to a second IdP;

obtain an assertion that the second identity is authenticated; and

in response to the obtained assertion that the second identity is authenticated, assert verification of the first identity.

14. The article of manufacture of claim 13 wherein to determine that the first identity is linked to the user having the second identity, the computer-readable instructions are executable by the processor to check a stored subscription that pertains to the second identity.

15. The article of manufacture of claim 13 wherein the computer-readable medium further includes computer-readable instructions that are executable by the processor to:

provide the first identity;

enable a service to be accessed according to a single sign-on (SSO) process using the first identity; and

enable the service to be accessed according to the SSO process using the second identity.

16. The article of manufacture of claim 13 wherein the computer-readable medium further includes computer-readable instructions that are executable by the processor to:

in response to a determination that the second identity is not requested to be used to access a service, assert verification of the first identity to enable the first identity to be used to access the service.

17. A system, comprising:

a network device of the second IdP and configured to communicate with a network device of the first IdP having the computer-readable medium and processor of any of claims 13-16, wherein the network device of the second IdP includes;

a memory to store the second identity; and

a network interface coupled to the memory and configured to communicate information pertaining to the second identity to the network device of the first IdP to enable the second IdP to operate in a proxy relationship with the first IdP,

wherein for the proxy relationship, the second identity is usable by the first IdP to obtain access to a service that recognizes the first identity.

18. The system of claim 17 wherein the network device of the second IdP is further configured to operate as a relaying party to obtain authentication for one or more additional identities of the user.

19. The system of claim 17 wherein the network device of the second IdP includes a server that is configured to provide web services in addition to identity management services associated with the second identity.