Distributed hierarchical identity management system authentication mechanisms

• US 7,454,623 B2
• Filed: 06/16/2004
• Issued: 11/18/2008
• Est. Priority Date: 06/16/2004
• Status: Active Grant

• Current Assignee: Callahan Cellular LLC (Intellectual Ventures LLC)
• Original Assignee: Blame Canada Holdings Inc
• Inventors: Hardt, Dick C.
• Primary Examiner(s): Peeso; Thomas R
• Application Number:
  US10/867,635
• Publication Number:
  US 20050283614A1
• Time in Patent Office: 1,616 Days
• Field of Search: 713/182, 713/185, 713/184, 713/186
• US Class Current: 713/182
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/68 Special signature format, e.g. XML format
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A set of methods, and systems, for use in an identity management system are disclosed herein. A modular user identity information datastore using hardware accelerated encryption for user data security operates in a network for receiving requests for, and issuing responses containing user information including third party accredited assertions.

Claims

1. A homesite appliance for managing user identity information, the homesite appliance comprising:

a request processor for receiving requests for the user identity information from an external system, for authenticating a user associated with the user identity information and for obtaining authorization from the authenticated user to release the requested user identity information, for extracting the requested user identity information from a schema containing the user identity information, and for transmitting the extracted user identity information to the external system upon receipt of user authorization; and

an authoritative site interface for obtaining and refreshing third party assertions associated with the user identity information, and for associating the obtained and refreshed assertions with the schema.

2. The homesite appliance of claim 1, further including a storage array interface for connecting the request processor to a storage array, the storage array for storing the schema containing the user identity information sent by the request processor, and for retrieving previously stored user identity information.

3. The homesite appliance of claim 2, wherein the storage array is external to the homesite appliance.

4. The homesite appliance of claim 2 further including a hardware encryption engine for encrypting user identity information sent to the storage array.

5. The homesite appliance of claim 4, wherein the hardware encryption engine includes means for decrypting user identity information retrieved from the storage array.

6. The homesite appliance of claim 5, further including a cache memory for use by the request processor to cache decrypted user identity information.

7. The homesite appliance of claim 6, further including a cache memory controller for directing retrieval requests from the request processor to one of the cache memory and the external storage array.

8. The homesite appliance of claim 1, wherein the request processor includes user authentication means for authenticating the identity of the user using at least one of a request for a username and password combination, a request for an out of band authentication request for a shared secret, a request for biometric data and a request for a securely generated token.

9. The homesite appliance of claim 1, wherein the request processor includes means to receive requests for the user identity information from the external system via the user associated with the user identity information.

10. The homesite appliance of claim 1, wherein the request processor includes means to transmit the retrieved user identity information to the external system via the user associated with the user identity information.

11. The homesite appliance of claim 1, wherein the request processor includes means to encrypt the retrieved user identity information prior to transmission to the user.

12. The homesite appliance of claim 11, wherein the means to encrypt perform secure sockets layer encryption.

13. The homesite appliance of claim 11, further including a secure sockets layer encryption engine for encrypting the retrieved user identity information prior to transmission.

14. The homesite appliance of claim 4, wherein the hardware encryption engine includes means to encrypt the retrieved user identity information prior to transmission to the user.