Secure identity management

A computer implemented method for providing identity-related information (IRI) to a requesting entity by means of an identity provider, wherein a client application is provided for the communication of a user with the requesting entity and with the identity provider, wherein the client application uses a first communication protocol, wherein the first communication protocol comprises a referrer function according to which a communication message comprises a referrer element with information about previous communication, said method comprising:

• receiving from the identity provider, by means of the first communication protocol, a second authenticity reference part, and in the referrer element, a first authenticity reference part;
• sending one of the first and the second authenticity reference part, and a secure function of the first and the second authenticity reference part to the identity provider, wherein the second authenticity reference part is generated based on verification of user delivered authentication information sent to the identity provider in response to said first
• authenticity reference part communicated to the client application;
• deleting information regarding the first and second authenticity reference parts from an identity provider database;
• and receiving from the identity provider the identity related information (IRI).

A computer implemented method for providing identity-related information (IRI) to a requesting entity by means of an identity provider, wherein a client application is provided for the communication of a user with the requesting entity and with the identity provider, wherein the client application uses a first communication protocol, wherein the first communication protocol comprises a referrer function according to which a communication message comprises a referrer element with information about previous communication, said method comprising:

• generating a first authenticity reference part;
• communicating the first authenticity reference part to the client application;
• generating a second authenticity reference part based on verification of user delivered authentication information sent to the identity provider in response to said first authenticity reference part communicated to the client application;
• communicating, by means of the first communication protocol, the second authenticity reference part and in the referrer element the first authenticity reference part to the requesting entity;
• receiving from the requesting entity one of the first and the second authenticity reference part, and a secure function of the first and the second authenticity reference part;
• deleting information regarding the first and second authenticity reference parts from an identity provider database;
• and
• sending a response with the identity related information (IRI) to the requesting entity.

A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing identity-related information (IRI) to a requesting entity by means of an identity provider, wherein a client application is provided for the communication of a user with the requesting entity and with the identity provider, wherein the client application uses a first communication protocol, wherein the first communication protocol comprises a referrer function according to which a communication message comprises a referrer element with information about previous communication, said method comprising:

• authenticating the user to the identity provider;
• a first authenticity reference part generation step, comprising the generation of a first authenticity reference part by the identity provider;
• a first authenticity reference communication step between the client application and the identity provider comprising the communication of the first authenticity reference part;
• a second authenticity reference part generation step, comprising the generation of a second authenticity reference part by the identity provider based verification of user delivered authentication information sent to the identity provider in response to said first authenticity reference part communicated to the client application;
• a second authenticity reference communication step between the identity provider and the requesting entity, by means of the first communication protocol, comprising the communication of the second authenticity reference part and in the referrer element the communication of the
• first authenticity reference part;
• a request step wherein the requesting entity sends one of the first and the second authenticity reference part, and a secure function of the first and the second authenticity reference part to the identity provider;
• a removing step wherein the identity provider deletes information regarding the first and second authenticity reference parts from an identity provider database;
• and
• a response step wherein the identity provider sends the identity related information (IRI) to the requesting entity.
• 14-16. (canceled)

A computer implemented method for providing identity-related information (IRI) to a requesting entity by means of an identity provider, wherein a client application is provided for the communication of a user with the requesting entity and with the identity provider , wherein the client application uses a first communication protocol, said method comprising:

• checking, by a computing device, whether the first communication protocol comprises a referrer element with information about previous communication;
• determining, by said computing device, if the first communication protocol comprises a referrer element;
• authenticating, by a computing device, the user to the identity provider;
• a first authenticity reference part generation step, comprising the generation, by said computing device, of a first authenticity reference part by the identity provider;
• a first authenticity reference communication step between the client application and the identity provider comprising the communication, by said computing device, of the first authenticity reference part;
• a second authenticity reference part generation step, comprising the generation, by said computing device, of a second authenticity reference part by the identity provider based verification of user delivered authentication information sent to the identity provider in response to said first authenticity reference part communicated to the client application;
• a second authenticity reference communication step between the identity provider and the requesting entity, by means of the first communication protocol, comprising the communication, by said computing device, of the second authenticity reference part and in the referrer element the communication of the first authenticity reference part;
• a request step wherein the requesting entity sends one of the first and the second authenticity reference part, and a secure function of the first and the second authenticity reference part to the identity provider;
• a removing step wherein the identity provider deletes information regarding the first and second authenticity reference parts from an identity provider database;
• and
• a response step wherein the identity provider sends the identity related information (IRI) to the requesting entity.