US 8,554,930 B2Granted

Method and system for proof-of-possession operations associated with authentication assertions in a heterogeneous federated environment

AssigneeInternational Business Machines Corporation

InventorsGeorge Robert Blakley, III, Heather Maria Hinton

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method, apparatus, system, and computer program product are presented in which federated domains interact within a federated environment. Domains within a federation are able to initiate federated single-sign-on operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. Trust proxies interpret assertions from other federated domains as necessary. Trust proxies may have a trust relationship with one or more trust brokers, and a trust proxy may rely upon a trust broker for assistance in interpreting assertions. To enhance security, domains may also require users to re-prove their identity through proof-of-possession challenges that are executed after a user has initiated a single-sign-on operation.

Claims36

Dependent claims

A method for assertion processing within a data processing system, the method comprising:

receiving, from a first trust proxy within a first domain at a second trust proxy in a second domain, an assertion associated with a user, wherein the assertion is associated with a request from a client to access a controlled resource within the second domain;
responsive to receipt of the assertion, challenging a user of the client to provide information that is required to be possessed by the user that is associated with the assertion, wherein the challenging step is performed to enable the user associated with the assertion to attempt to re-prove an identity and comprises:
sending from the second trust proxy to the first trust proxy a request for challenge information;
receiving the challenge information at the second trust proxy from the first trust proxy;
generating a proof-of-possession challenge at the second trust proxy, wherein a valid response to the proof-of-possession challenge comprises the information that is required to be possessed by the user that is associated with the assertion;
sending the proof-of-possession challenge to the client;
and
validating a response to the proof-of-possession challenge;
and
in response to a determination that the user of the client possesses the information that is required to be possessed by the user that is associated with the assertion, validating the assertion at the second trust proxy.

7 more elements

An apparatus for assertion processing within a data processing system, the apparatus comprising:

a processor;
a computer memory holding computer program instructions which when executed by the processor perform a method comprising:
receiving, from a first trust proxy within a first domain at a second trust proxy in a second domain, an assertion associated with a user, wherein the assertion is associated with a request from a client to access a controlled resource within the second domain;
responsive to receipt of the assertion, challenging a user of the client to provide information that is required to be possessed by the user that is associated with the assertion, wherein the challenging step is performed to enable the user associated with the assertion to attempt to re-prove an identity and comprises:
sending from the second trust proxy to the first trust proxy a request for challenge information;
receiving the challenge information at the second trust proxy from the first trust proxy;
generating a proof-of-possession challenge at the second trust proxy, wherein a valid response to the proof-of-possession challenge comprises the information that is required to be possessed by the user that is associated with the assertion;
sending the proof-of-possession challenge to the client;
and
validating a response to the proof-of-possession challenge;
and
validating the assertion at the second trust proxy in response to a determination that the user of the client possesses the information that is required to be possessed by the user that is associated with the assertion.

9 more elements

A computer program product in a computer readable medium for use in a data processing system for assertion processing, the computer program product holding computer program instructions which when executed by the data processing system perform a method comprising:

receiving, from a first trust proxy within a first domain at a second trust proxy in a second domain, an assertion associated with a user, wherein the assertion is associated with a request from a client to access a controlled resource within the second domain;
responsive to receipt of the assertion, challenging a user of the client to provide information that is required to be possessed by the user that is associated with the assertion, wherein the challenging step is performed to enable the user associated with the assertion to attempt to re-prove an identity and comprises:
sending from the second trust proxy to the first trust proxy a request for challenge information;
receiving the challenge information at the second trust proxy from the first trust proxy;
generating a proof-of-possession challenge at the second trust proxy, wherein a valid response to the proof-of-possession challenge comprises the information that is required to be possessed by the user that is associated with the assertion;
sending the proof-of-possession challenge to the client;
and
validating a response to the proof-of-possession challenge;
and
validating the assertion at the second trust proxy in response to a determination that the user of the client possesses the information that is required to be possessed by the user that is associated with the assertion.

7 more elements

Dependencies are inferred from the claim text.