# US 11,115,419 B2 · Identity attribute confidence scoring while certifying authorization claims > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,419 B2 - Document ID: US11115419B2 - Status: Granted - Kind: B2 - Application number: 16/377,168 - Filed: 2019-04-06 - Published: 2020-10-08 - Granted: 2021-09-07 - Earliest claimed: 2019-04-06 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Parag Gokhale; Sakshi Malik; Shlok Sanjay Gilda; Shams Hasan Rizvi; Rohan Poulose - Web page: https://patentgrep.com/patent/US11115419B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An identity management system is augmented to compute a time-varying confidence score for an asserted attribute value, typically a value that is received from a third party identity issuer. In this approach, an identity provider (IdP) computes a time-varying confidence score for an asserted attribute that the IdP includes in a security assertion returned to a service provider. The confidence score typically is “deteriorating” (i.e., diminishes over time) for an attribute value. The degree to which the score deteriorates, however, may be altered by one or more qualified attribute verification event(s). Preferably, the IdP maintains a profile of the service provider, and that profile may also include other information, such as a threshold for an attribute confidence score that the SP deems acceptable (to enable access to the service). Based on the SP profiling, the IdP also can recommend use of a given identity issuer for a specific attribute. ## Claims ### Claim 1 A method to authorize a request to access a protected resource, the request being received from a service provider and being associated with a requesting entity having one or more associated identity issuers, comprising: receiving from at least one identity issuer an identity attribute for the requesting entity; computing a time-varying confidence score based in part on the attribute's change frequency as reflected in historical data; and upon validating the requesting entity, generating and returning to the service provider a security assertion that includes the identity attribute and the time-varying confidence score. ### Claim 2 (depends on 1) The method as described in claim 1 wherein the time-varying confidence score is a time-deteriorated confidence measure having a value that diminishes over a time period. ### Claim 3 (depends on 2) The method as described in claim 2 wherein a beginning of the time period is one of: a validation date for the attribute, and a date of attribute registration by the at least one identity issuer. ### Claim 4 (depends on 2) The method as described in claim 2 wherein the time-deteriorated confidence measure is also based on a probability of an adverse event associated with the at least one identity issuer. ### Claim 5 (depends on 4) The method as described in claim 4 wherein the time-deteriorated conference measure is reset to an initial measure upon verifying the adverse event. ### Claim 6 (depends on 1) The method as described in claim 1 further including generating a profile for the service provider, the profile including a minimum threshold for the attribute's confidence score. ### Claim 7 (depends on 6) The method as described in claim 6 further including providing a recommendation to use a different identity issuer, wherein the recommendation is based on information in the profile. ### Claim 8 An apparatus, comprising: a processor; computer memory holding computer program instructions executed by the processor to authorize a request to access a protected resource, the request being received from a service provider and being associated with a requesting entity having one or more associated identity issuers, the computer program instructions comprising program code configured to: receive from at least one identity issuer an identity attribute for the requesting entity; compute a time-varying confidence score based in part on the attribute's change frequency as reflected in historical data; upon validating the requesting entity, generate and return to the service provider a security assertion that includes the identity attribute and the time-varying confidence score. ### Claim 9 (depends on 8) The apparatus as described in claim 8 wherein the time-varying confidence score is a time-deteriorated confidence measure having a value that diminishes over a time period. ### Claim 10 (depends on 9) The apparatus as described in claim 9 wherein a beginning of the time period is one of: a validation date for the attribute, and a date of attribute registration by the at least one identity issuer. ### Claim 11 (depends on 9) The apparatus as described in claim 9 wherein the time- deteriorated confidence measure is also based on a probability of an adverse event associated with the at least one identity issuer. ### Claim 12 (depends on 11) The apparatus as described in claim 11 wherein the program code is further configured to reset the time-deteriorated conference measure to an initial measure upon verifying the adverse event. ### Claim 13 (depends on 8) The apparatus as described in claim 8 wherein the program code is further configured to generate a profile for the service provider, the profile including a minimum threshold for the attribute's confidence score. ### Claim 14 (depends on 13) The apparatus as described in claim 13 wherein the program code is further configured to provide a recommendation to use a different identity issuer, wherein the recommendation is based on information in the profile. ### Claim 15 A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, to authorize a request to access a protected resource, the request being received from a service provider and being associated with a requesting entity having one or more associated identity issuers, the computer program instructions comprising program code configured to: receive from at least one identity issuer an identity attribute for the requesting entity; compute a time-varying confidence score based in part on the attribute's change frequency as reflected in historical data; and upon validating the requesting entity, generate and return to the service provider a security assertion that includes the identity attribute and the time-varying confidence score. ### Claim 16 (depends on 15) The computer program product as described in claim 15 wherein the time-varying confidence score is a time-deteriorated confidence measure having a value that diminishes over a time period. ### Claim 17 (depends on 16) The computer program product as described in claim 16 wherein a beginning of the time period is one of: a validation date for the attribute, and a date of attribute registration by the at least one identity issuer. ### Claim 18 (depends on 16) The computer program product as described in claim 16 wherein the time-deteriorated confidence measure is also based on a probability of an adverse event associated with the at least one identity issuer. ### Claim 19 (depends on 18) The computer program product as described in claim 18 wherein the program code is further configured to reset the time-deteriorated conference measure to an initial measure upon verifying the adverse event. ### Claim 20 (depends on 15) The computer program product as described in claim 15 wherein the program code is further configured to generate a profile for the service provider, the profile including a minimum threshold for the attribute's confidence score. ### Claim 21 (depends on 20) The computer program product as described in claim 20 wherein the program code is further configured to provide a recommendation to use a different identity issuer, wherein the recommendation is based on information in the profile.