Methods and apparatus for delegated authentication

A user authentication method comprising the steps of:

• receiving a request from a relying party for delegated authentication information associated with a particular user, the delegated authentication information having the property that the user can be presently authenticated based on such information;
• determining a level of trust associated with the relying party;
• and
• providing the delegated authentication information to the relying party responsive to the request only if the relying party has a sufficient level of trust, so as to permit the relying party to authenticate the user based on the delegated authentication information;
• wherein each of the steps is performed at least in part by one or more processing devices;
• and
• wherein the relying party is not in possession of an authentication credential of the user but is in possession of information derived from the authentication credential of the user.

A user authentication method comprising the steps of:

• receiving a request from a relying party for delegated authentication information associated with a particular user, the delegated authentication information having the property that the user can be presently authenticated based on such information;
• determining a level of trust associated with the relying party;
• providing the delegated authentication information to the relying party responsive to the request only if the relying party has a sufficient level of trust, so as to permit the relying party to authenticate the user based on the delegated authentication information;
• receiving feedback information from the relying party indicative of status of the authentication of the user;
• and
• updating high watermark information based on the feedback information;
• wherein each of the steps is performed at least in part by one or more processing devices.

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory, said processing device implementing an authentication-delegating service which is configured to receive a request from a relying party for delegated authentication information associated with a particular user, the delegated authentication information having the property that the user can be presently authenticated based on such information;
• to determine a level of trust associated with the relying party;
• and to provide the delegated authentication information to the relying party responsive to the request only if the relying party has a sufficient level of trust, so as to permit the relying party to authenticate the user based on the delegated authentication information;
• wherein the authentication-delegating service comprises a graded authentication-delegating service configured to determine which of a plurality of trust levels is associated with the relying party, the plurality of trust levels corresponding to respective ones of a plurality of different types of delegated authentication information, and to provide delegated authentication information of a particular one of the plurality of different types to the relying party based on the particular one of the plurality of trust levels determined to be associated with the relying party.

A method comprising the steps of:

• sending a request from a relying party to an authentication-delegating service for delegated authentication information associated with a particular user;
• receiving the delegated authentication information from the authentication-delegating service responsive to the request only if the relying party is determined by that service to have a sufficient level of trust associated therewith;
• and
• utilizing the delegated authentication information to establish a key to be shared between the relying party and the user;
• wherein the steps are performed at least in part by one or more processing devices;
• and
• wherein the authentication-delegating service determines which of a plurality of trust levels is associated with the relying party, the plurality of trust levels corresponding to respective ones of a plurality of different types of delegated authentication information, and the step of receiving the delegated authentication information from the authentication-delegating service further comprises receiving delegated authentication information of a particular one of the plurality of different types from the authentication-delegating service based on the particular one of the plurality of trust levels determined to be associated with the relying party.

A system for authenticating a user, comprising:

• a plurality of processing devices;
• a first one of the processing devices implementing a relying party and configured for communication with a second one of the processing devices implementing an authentication-delegating service;
• wherein the authentication-delegating service is configured to receive a request from a relying party for delegated authentication information associated with a particular user, the delegated authentication information having the property that the user can be presently authenticated based on such information;
• to determine a level of trust associated with the relying party;
• and to provide the delegated authentication information to the relying party responsive to the request only if the relying party has a sufficient level of trust, so as to permit the relying party to authenticate the user based on the delegated authentication information;
• and
• wherein the authentication-delegating service comprises a graded authentication-delegating service configured to determine which of a plurality of trust levels is associated with the relying party, the plurality of trust levels corresponding to respective ones of a plurality of different types of delegated authentication information, and to provide delegated authentication information of a particular one of the plurality of different types to the relying party based on the particular one of the plurality of trust levels determined to be associated with the relying party.

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory, said processing device implementing a relying party configured to send a request to an authentication-delegating service for delegated authentication information associated with a particular user, the delegated authentication information having the property that the user can be presently authenticated based on such information;
• to receive the delegated authentication information from the authentication-delegating service responsive to the request only if the relying party is determined by that service to have a sufficient level of trust associated therewith;
• and to authenticate the user based on the delegated authentication information;
• wherein the authentication-delegating service determines which of a plurality of trust levels is associated with the relying party, the plurality of trust levels corresponding to respective ones of a plurality of different types of delegated authentication information, and the received delegated authentication information from the authentication-delegating service further comprises delegated authentication information of a particular one of the plurality of different types based on the particular one of the plurality of trust levels determined to be associated with the relying party.