US 8,020,007 B1 · System and method for obtaining identities

Abstract

A system and method identifies one of several security token services that can be used to convert an identity token into one containing content, a format and having a signature corresponding to a signing key name that a software service can use. The identification of the security token service that may be used to perform the conversion is made using machine readable information about the signing key name that the software service can use.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims21

Dependent claims

A method of providing an identity token, the method comprising:

receiving at least one document specifying at least one signing key name describing a source of digital signatures that each of a plurality of services can use to verify a user's identity;
receiving a first identity token comprising a first set of content that identifies a user, and a digital signature comprising a first signing key name, the first identity token having a first format, and also receiving a request for one of the plurality of services;
identifying, responsive to the request and at least one of the at least one document, at least one second signing key name used by one of the plurality of services corresponding to a service requested in the request;
identifying, responsive to the at least one second signing key name, at least one of a plurality of security token services that can convert the first identity token into a second identity token having at least one selected from:
a second content, different from the first content, that specifies the user;
a second format, different from the first format, that the service requested by the request is able to use;
and
the second signing key name, different from the first signing key name, that the service requested in the request can use to verify the second identity token;
providing to the at least one of the plurality of security token services identified, the first identity token and an indicator corresponding to the request or at least part of the request;
receiving from the at least one of the plurality of security token services the second identity token;
and
providing at least part of the request and the second identity token in the second format to service provider corresponding to the request for use in authenticating the user.

9 more elements

A system for providing an identity token, the system comprising:

a policy receiver having an input for receiving at least one document specifying at least one signing key name describing a source of digital signatures that each of a plurality of services can use to verify a user's identity, the policy receiver for providing the at least one document at an output;
a request receiver having an input for receiving a first identity token comprising a first set of content that identifies a user, and a digital signature comprising a first signing key name, the first identity token having a first format, and also receiving a request for one of the plurality of services, the request receiver for providing at an output at least a portion of the first identity token and at least a portion of the request;
a matcher having an input coupled to the request receiver output, for receiving the at least the portion of the first identity token and the at least the portion of the request, and to the policy receiver for receiving the at least one document, the matcher for identifying and providing at an output, responsive to the request and at least one of the at least one document, at least one second signing key name used by one of the plurality of services corresponding to a service requested in the request;
a URL locator having an input coupled to the matcher output for receiving the at least one second signing key name, the URL locator for identifying, responsive to the at least one second signing key name, and for identifying, and providing at an output an identifier of, at least one of a plurality of security token services that can convert the first identity token into a second identity token having at least one selected from:
a second content, different from the first content, that specifies the user;
a second format, different from the first format, that the service requested by the request is able to use;
and
the second signing key name, different from the first signing key name, that the service requested in the request can use to verify the second identity token;
a new token requestor having an input coupled to the URL locator output for receiving the identifier of the identifier of the at least one of the plurality of security token services, and to the request receiver output for receiving at least the portion of the identity token and at least the portion of the request, the new token requestor for providing at an input/output coupled to the at least one of the plurality of security token services corresponding to the identifier received at the new token requestor input, the at least the portion of the first identity token and an indicator corresponding to the request or at least the portion of the request, and for receiving from the at least one of the plurality of security token services the second identity token and for providing at an output at least a portion of the second identity token;
and
a request provider having an input coupled to the new token requestor output for receiving the at least the portion of the identity token, and to the request receiver output for receiving the at least the portion of the request, the request provider for providing at an output the at least the portion of the request and the at least the portion of the second identity token in the second format to the service provider corresponding to the at least the portion of the request for use in authenticating the user.

8 more elements

A computer program product comprising a non-transitory computer useable medium having computer readable program code embodied therein for providing an identity token, the computer program product comprising computer readable program code devices configured to cause a computer system to:

receive at least one document specifying at least one signing key name describing a source of digital signatures that each of a plurality of services can use to verify a user's identity;
receive a first identity token comprising a first set of content that identifies a user, and a digital signature comprising a first signing key name, the first identity token having a first format, and also receiving a request for one of the plurality of services;
identify, responsive to the request and at least one of the at least one document, at least one second signing key name used by one of the plurality of services corresponding to a service requested in the request;
identify, responsive to the at least one second signing key name, at least one of a plurality of security token services that can convert the first identity token into a second identity token having at least one selected from:
a second content, different from the first content, that specifies the user;
a second format, different from the first format, that the service requested by the request is able to use;
and the second signing key name, different from the first signing key name, that the service requested in the request can use to verify the second identity token;
provide to the at least one of the plurality of security token services identified, the first identity token and an indicator corresponding to the request or at least part of the request;
receive from the at least one of the plurality of security token services the second identity token;
and provide at least part of the request and the second identity token in the second format to service provider corresponding to the request for use in authenticating the user.

7 more elements

Dependencies are inferred from the claim text.

Description4,818 words

Summary712 words

#This application claims the benefit of U.S. Provisional Application Ser. No. 61/126,632, entitled, “Method and Apparatus for Obtaining Identities”, filed by Valery Zubovsky on May 5, 2008, having the same assignee as this Application and is hereby incorporated by reference in its entirety.

#The present invention is related to computer software and more specifically to computer software for authentication.

#To perform functions on a computer system, different services may be used. A service may correspond to a computer program, or to a functional part of a computer program. Different services may have been developed independently of one another, and each service may have different ways of authenticating users of that service. When the user of one service wishes to use a different service, a different manner of authentication may be necessary, requiring the user to authenticate himself or herself to the second service using an entirely different method than is used to authenticate the same user to a first service. This makes it cumbersome for users to remember, if the formats for authentication are different. For example, one service may require an account identifier and a password, while another service requires an e-mail address and a password.

Brief description of the drawings3 figures

#FIG. 1 is a block schematic diagram of a conventional computer system.

#FIG. 2 is a flowchart illustrating a method of providing identity information according to one embodiment of the present invention.

#FIG. 3 is a block schematic diagram of a system for providing identity information according to one embodiment of the present invention.

Detailed description4,052 words

#The present invention may be implemented as computer software on a conventional computer system. Referring now to FIG. 1, a conventional computer system 150 for practicing the present invention is shown. Processor 160 retrieves and executes software instructions stored in storage 162 such as memory, which may be Random Access Memory (RAM) and may control other components to perform the present invention. Storage 162 may be used to store program instructions or data or both. Storage 164, such as a computer disk drive or other nonvolatile storage, may provide storage of data or program instructions. In one embodiment, storage 164 provides longer term storage of instructions and data, with storage 162 providing storage for data or instructions that may only be required for a shorter time than that of storage 164. Input device 166 such as a computer keyboard or mouse or both allows user input to the system 150. Output 168, such as a display or printer, allows the system to provide information such as instructions, data or other information to the user of the system 150. Storage input device 170 such as a conventional floppy disk drive or CD-ROM drive accepts via input 172 computer program products 174 such as a conventional floppy disk or CD-ROM or other nonvolatile storage media that may be used to transport computer instructions or data to the system 150. Computer program product 174 has encoded thereon computer readable program code devices 176, such as magnetic charges in the case of a floppy disk or optical encodings in the case of a CD-ROM which are encoded as program instructions, data or both to configure the computer system 150 to operate as described below.

#In one embodiment, each computer system 150 is a conventional SUN MICROSYSTEMS ULTRA 10 workstation running the SOLARIS operating system commercially available from SUN MICROSYSTEMS, Inc. of Mountain View, Calif., a PENTIUM-compatible personal computer system such as are available from DELL COMPUTER CORPORATION of Round Rock, Tex. running a version of the WINDOWS operating system (such as 95, 98, Me, XP, NT or 2000) commercially available from MICROSOFT Corporation of Redmond Wash. or a Macintosh computer system running the MACOS or OPENSTEP operating system commercially available from APPLE INCORPORATED of Cupertino, Calif. and the MOZILLA browser commercially available from the MOZILLA FOUNDATION of Mountain View, Calif. or INTERNET EXPLORER browser commercially available from MICROSOFT above, although other systems may be used.

#Referring now to FIG. 2, a method of providing identity information is shown according to one embodiment of the present invention.

Facts

Application

12/151,630Filed 7 May 2008

Granted

13 Sep 2011

Term ends

22 Jun 2030

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 776 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification8 codes

H04L 63/126
Applying verification of the received information: the source of the received data
G06F 21/00
Security arrangements for protecting computers, components thereof, programs or data against unauthorised
G06F 21/33
User authentication: using certificates
G06F 21/41
User authentication: where a single sign-on provides access to a plurality of computers

System and method for obtaining identities

Life of this patent

System and method for obtaining identities

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims21

Description4,818 words

Drawings

Classification8 codes

Life of this patent

Description4,818 words