Method and Apparatus for User Identity Verification

• US 20150139418A1
• Filed: 11/20/2013
• Published: 05/21/2015
• Est. Priority Date: 11/20/2013
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Nocera, Andrew
• Granted Patent: US 9,166,791 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present disclosure describes a method and apparatus for user identity verification as a user migrates amongst systems, servers, computing environments and/or segments within a cloud computing environment. A user currently accessing a first system seeks to migrate from the first system to a target system. The target system validates whether the user may access the target system based on a first private key and a first public key. A verification system maintains a second public key that is based on an identity of the user and inaccessible to the user. The verification system receives a second private key from an initial system of the user. Based on the second private/public keys, the verification system sends a validation of user identity to the target system.

Claims

1. A method of identifying a user accessing a target system, comprising:

receiving a first private key;

validating user access to the target system based on the first private key and a first public key accessible by the target system;

transmitting a request for a validation of user identity to a second system storing a second public key inaccessible to the user; and

receiving the validation of user identity from the second system based on the second public key and a second private key stored at an initial system of the user.

2. The method of claim 1, further comprising

requesting, by the second system, the second private key from the initial system of the user;

and

receiving, by the second system, the second private key from the initial system of the user.

3. The method of claim 2, further comprising:

validating, by the second system, the user identity based on the second private key and the second public key; and

transmitting, by the second system, the validation of user identity to the target system.

4. The method of claim 1, further comprising:

prior to receipt of the first private key in the target system;

logging the user into the second system from the initial system of the user;

associating, by the second system, the second private key and the second public with the user;

transmitting, by the second system, the second private key to the initial system of the user; and

storing, by the second system, the second public key.

5. The method of claim 4, wherein associating, by the second system, the second private key and the second public with the user comprises:

generating, by the second system, the second private key and the second public key based on an identity of the user.

6. The method of claim 4, further comprising:

receiving, by the second system, a request for the validation of user identity from the first system;

transmitting a request, by the second system, for the second private key to the initial system;

receiving, by the second system, the second private key from the initial system; and

transmitting, by the second system, the validation of user identity to the first system based on the second private key and the second public key.

7. The method of claim 1, wherein validating user access to the target system based on the first private key and a first public key comprises:

validating user access to at least one application in the target system based on a first application private key and a first application public key.

8. A tangible computer readable storage device storing computer program instructions for identifying a user accessing a target system, which, when executed on a processor, cause the processor to perform operations comprising:

receiving a first private key;

validating user access to the target system based on the first private key and a first public key accessible by the target system;

transmitting a request for a validation of user identity to a second system storing a second public key inaccessible to the user; and

receiving the validation of user identity from the second system based on the second public key and a second private key stored at an initial system of the user.

9. The tangible computer readable storage device of claim 8, the operations further comprising:

requesting, by the second system, the second private key from the initial system of the user; and

receiving, by the second system, the second private key from the initial system of the user.

10. The tangible computer readable storage device of claim 9, the operations further comprising:

validating, by the second system, the user identity based on the second private key and the second public key; and

transmitting, by the second system, the validation of user identity to the target system.

11. The tangible computer readable storage device of claim 8, the operations further comprising:

prior to receipt of the first private key in the target system;

logging the user into the second system from the initial system of the user;

associating, by the second system, the second private key and the second public with the user;

transmitting, by the second system, the second private key to the initial system of the user; and

storing, by the second system, the second public key.

12. The tangible computer readable storage device of claim 11, wherein associating, by the second system, the second private key and the second public with the user further comprises operations for:

generating, by the second system, the second private key and the second public key based on an identity of the user.

13. The tangible computer readable storage device of claim 11, the operations further comprising:

receiving, by the second system, a request for the validation of user identity from the first system;

transmitting a request, by the second system, for the second private key to the initial system;

receiving, by the second system, the second private key from the initial system; and

transmitting, by the second system, the validation of user identity to the first system based on the second private key and the second public key.

14. An apparatus comprising:

a memory storing computer program instructions for identifying a user accessing a target system;

a processor communicatively coupled to the memory, the processor configured to execute the computer program instructions, which, when executed on the processor, cause the processor to perform operations comprising;

receiving a first private key;

validating user access to the target system based on the first private key and a first public key accessible by the target system;

transmitting a request for a validation of user identity to a second system storing a second public key inaccessible to the user; and

receiving the validation of user identity from the second system based on the second public key and a second private key stored at an initial system of the user.

15. The apparatus of claim 14, the operations further comprising:

requesting, by the second system, the second private key from the initial system of the user; and

receiving, by the second system, the second private key from the initial system of the user.

16. The apparatus of claim 15, the operations further comprising:

validating, by the second system, the user identity based on the second private key and the second public key; and

transmitting, by the second system, the validation of user identity to the target system.

17. The apparatus of claim 14, the operations further comprising:

prior to receipt of the first private key in the target system;

logging the user into the second system from the initial system of the user;

associating, by the second system, the second private key and the second public with the user;

transmitting, by the second system, the second private key to the initial system of the user; and

storing, by the second system, the second public key.

18. The apparatus of claim 17, wherein associating, by the second system, the second private key and the second public with the user further comprises operations for:

generating, by the second system, the second private key and the second public key based on an identity of the user.

19. The apparatus of claim 17, the operations further comprising:

receiving, by the second system, a request for the validation of user identity from the first system;

transmitting a request, by the second system, for the second private key to the initial system;

receiving, by the second system, the second private key from the initial system; and

transmitting, by the second system, the validation of user identity to the first system based on the second private key and the second public key.

20. The apparatus of claim 14, wherein validating user access to the target system based on the first private key and a first public key further comprises operations for:

validating user access to at least one application in the target system based on a first application private key and a first application public key.