Single sign-on framework with trust-level mapping to authentication requirements

A credential gathering service providing a single sign-on for sessions that potentially include access to plural information resources having differing security requirements, the credential gathering service comprising:

• an input port configured to receive an access request identifying an initiating client entity;
• means for associating a trust level requirement with the access request;
• an encoding of correspondence between trust levels and credential types, wherein each of the trust levels corresponds to a respective set of the credential types;
• selection logic for selecting in accordance with the encoding, a credential type corresponding to the trust level requirement;
• and
• a credential obtaining interface for requesting and receiving a credential of the selected credential type for the initiating client entity.

A method of providing a single sign-on for plural information resources in an environment that provides plural trust levels, the method comprising:

• associating credential types with respective ones of the trust levels;
• specifying for each information resource, required ones of the trust levels for accesses thereto;
• obtaining at least one credential corresponding to a client entity and authenticating the client entity thereby;
• and
• permitting access to any of the information resources having a specified trust level requirement commensurate with the trust level associated with the authenticated at least one credential.

A method of providing sign-on in a networked information environment that provides plural trust levels, the method comprising:

• directing a request for access to a first information resource from an insufficiently authenticated client entity to a credential gathering service;
• associating a first trust level requirement with the access to the first information resource;
• selecting from plural credential types, a credential type having an associated trust level commensurate with the first trust level requirement;
• obtaining a credential of the selected credential type for the client entity;
• and authenticating the obtained credential.

A method of providing a security interface common to plural information resources, the method comprising:

• associating credential types with trust levels, wherein each of the trust levels correspond to a respective set of the credential types;
• specifying for each information resource, a required one of the trust levels for accesses thereto;
• with a login service common to the plural information resources, obtaining at least one credential corresponding to a client entity and authenticating an identity of the client entity thereby, wherein the obtained at least one credential is of one of the credential types associated with the required one of the trust levels;
• granting or denying access to a first of the information resources based on correspondence between the required trust-level therefor and an authenticated trust level associated with the obtained at least one credential;
• and
• granting or denying access to a second of the information resources based on correspondence between the required trust-level therefor and the authenticated trust level.