Identity authentication portfolio system

A method of registration, comprising:

• authenticating a user;
• determining a level of identity confirmation for a registration;
• receiving a new authentication mechanism;
• receiving new authentication verification information;
• and
• storing user identity information, the level of identity confirmation, and the new authentication verification information in a database.

A method of providing an authentication service, comprising:

• providing a list of supported authentication methods;
• receiving requirements for an authentication level from at least one relying party;
• receiving a selection of authentication methods from at least one user;
• receiving identification information for the at least one user;
• producing a portfolio associated with the at least one user, the portfolio comprising the list of authentication methods, each authentication method in the portfolio meeting the selection of the at least one user, each authentication method in the portfolio supported by an authentication system, the list of authentication methods meeting the requirements for the authentication level from the at least one relying party;
• and
• relating the identification information to the portfolio for the at least one user.

A method of authentication, comprising:

• requesting, by a user to a relying party, a protected service;
• sending, by the relying party, a description of the request to an authorization server;
• determining, by the authorization server, a first level of assurance;
• sending, by the authorization server to an authentication server, the first level of assurance;
• requesting, by an authentication server, authentication from the user;
• entering, by the user, authentication information into an authentication device;
• sending, by the authentication device to the authentication server, authentication information;
• verifying, by the authentication server, the authentication information using authentication verification information stored in a portfolio in a database that is associated with the user;
• computing, by the authentication server, a second level of assurance;
• evaluating whether the second level of assurance is high enough;
• sending, by the authentication server to the authorization server, a first success message, upon determining the second level of assurance is high enough;
• verifying, by the authorization server, information from the authentication server;
• verifying, by the authorization server, that the user is allowed to perform the protected service;
• sending, by the authorization server to the relying party, a second success message, upon verification of the information from the authentication server and verification that the user is allowed to perform the protected service;
• and
• providing, by the relying party to the user, the protected service.