Brokered authentication with risk sharing

A method performed by an authentication brokering service comprising a first computing device, the method comprising:

• receiving, by the authentication brokering service, an authentication request via a network from a client application to authenticate a user, the authentication request originated by the client application, the authentication request received in a first message, the first message comprising a message conforming to an application-layer messaging protocol, the authentication request comprising a request to authenticate the user and comprising information associating the authentication request with the user;
• based on the authentication request, performing, by the authentication brokering service, a first authentication procedure to authenticate the user, the first authentication procedure comprising validating an authentication factor provided by the client application via the network with a stored authentication factor associated with the user identity, wherein the first authentication procedure authenticates the user identity;
• based on the authentication of the user identity by the authentication brokering service, generating a token associated with the user identity, storing an indication of the token, generating a second message conforming to the application-layer protocol, the second message comprising the security token, and transmitting the second message to the client device via the network, wherein the client application is configured to receive and store the token and to provide the token via the network to resource providers;
• receiving a first application-layer message from a first resource provider via the network, the first resource provider comprising a second computing device providing application-layer resources via the network, the first application-layer message comprising first authentication risk data derived or obtained by the first resource provider to compute a first risk scored used when performing a second authentication procedure to authenticate the user, wherein the second authentication procedure uses the token and the first risk score to determine whether to authenticate the user, and wherein the authentication brokering service stores the first authentication risk data in association with the indication of the token;
• and
• receiving a second application-layer message from a second resource provider via the network, the second resource provider comprising a third computing device providing application-layer resources via the network, the second application-layer message comprising second authentication risk data derived or obtained by the second resource provider to compute a second risk score used when performing a third authentication procedure to authenticate the user, wherein the second authentication procedure uses the token and the second risk score to determine whether to authenticate the user, and wherein the authentication broker stores the second authentication risk data in association with the indication of the token, wherein, based on the stored the associations of the first and second authentication risk data with the indication of the token, the authentication brokering service shares the first and second authentication risk data with other resource providers when the other resource providers request verification of the token.

A method for providing application-level identity authentication brokering, the method performed by one or more computing devices, the method comprising:

• authenticating users by issuing security tokens to respective clients operated by the users, the tokens issued over a network by a security token service (STS) server, and wherein the security tokens are stored by the clients that provide the security tokens respective resource servers for authentication thereby, the security tokens comprising respective indications of respective user authentications issued and signed by the STS server;
• sending and receiving token request messages over the network between the resource servers and the STS server, each token request message comprising either a security token validation request, a security token validation confirmation, a security token refresh request, a response to a security token refresh request, or a security token issuance, wherein the token request messages comprise risk data obtained and/or computed by the resource servers and the STS server to compute risk scores in association with authenticating the user accounts;
• and
• storing portions of the risk data on the resource servers and the STS server for use in subsequent authentications, wherein, for a given user account having a corresponding given security token and having corresponding given portions of the risk data, a first resource server stores a first given portion of the risk data that originated from another resource server and that was provided in a token request message from the STS server, a second resource server stores a second given portion of the risk data that received from the STS server in a token request message, and wherein the STS server stores a third given portion of the risk data received from at least one of the resource servers in a token request message, wherein the stored given portions of risk data are used for subsequent authentications of the user account.