Method and system for establishing trust between a service provider and a client of the service provider

A computer-implemented. method of establishing trust between a service provider and a client of the service provider through an identity provider that is trusted by the service provider, the method comprising:

• signing data that identifies a party associated with the client to the identity provider according to a first cryptographic protocol, wherein the service provider and the identity provider are preconfigured with the first cryptographic protocol and a second cryptographic protocol for use in configuring respective first and second channels between the service provider and the identity provider;
• configuring the first channel between the identity provider and the service provider with the first cryptographic protocol;
• sending the signed data to the identity provider via the first channel;
• sharing a shared secret with the identity provider via the second channel, wherein the second channel is configured such that data sent via the second channel is signed by one of the identity provider and the service provider sending the shared secret according to the second cryptographic protocol;
• determining, in response to receipt of a client secret from the client, that the client secret corresponds to the shared secret;
• and,
• determining to trust the client.

A system for use in establishing trust between a service provider and a client of the service provider through a proxy that is trusted by the service provider, the system comprising:

• a data store comprising executable software;
• and
• at least one processor in data communication with the data store, the processor configured to execute the software and cause a computing device to:
• configure a first channel between the proxy and the service provider with a first cryptographic protocol, wherein the first channel is configured such that data received by the proxy from the service provider via the first channel is signed by the service provider according to the first cryptographic protocol;
• determine that the data received by the proxy via the first channel is authentic according to the first cryptographic protocol
• identify a medium for communications between a party and the proxy wherein the party is associated with the client, the party is known by the identity proxy, and the data received by the proxy from the service provider via the first channel identifies the party, and wherein the medium is predetermined by the proxy at least in relation to determining whether the data received via the first channel is authentic;
• request the party to identify itself with identification data to the proxy via the predetermined medium;
• determine, up to a predetermined level of trust, that the identification data provided by the party corresponds to stored identification data of the party held by the proxy;
• and
• share a first secret with the party via a further channel wherein the first secret is used by the client in establishing trust between the client and the service provider.

A non-transitory computer-readable storage medium comprising a set of computer executable instructions stored thereon, which, when executed by a processor, cause a computing device to perform a method of establishing trust between a service provider and a client of the service provider through an identity provider that is trusted by the service provider, the method comprising:

• configuring a first channel between the identity provider and the service provider with a first cryptographic protocol, wherein the first channel is configured such that data received by the identity provider from the service provider via the first channel is signed by the service provider according to the first cryptographic protocol;
• determining that the data received by the identity provider via the first channel is authentic according to the first cryptographic protocol;
• identifying a medium for communications between a party and the identity provider, wherein the party is associated with the client, the party is known by the identity provider, and the data received b the identity provider from the service provider via the first channel identifies the party and wherein the medium is predetermined by the identity provider at least in relation to determining whether the data received via the first channel is authentic;
• requesting the party to identify itself with identification data to the identity provider via the predetermined medium;
• determining, up to a predetermined level of trust, that the identification data provided by the party corresponds to stored identification data of the party held by the identity provider;
• and
• sharing a first secret with the party via a further channel, wherein the first secret is used by the client in establishing trust between the client and the service provider.

A non-transitory computer-readable storage medium comprising a set of computer executable instructions stored thereon, which, when executed by a processor, cause a computing device to perform a method of establishing trust between a service provider and a client of the service provider through an identity provider that is trusted by the service provider, the method comprising:

• signing data that identifies a party associated with the client to the identity provider according to a first cryptographic protocol, wherein the service provider and the identity provider are preconfigured with the first cryptographic protocol and a second cryptographic protocol for use in configuring respective first and second channels between the service provider and the identity provider;
• configuring the first channel between the identity provider and the service provider with the first cryptographic protocol;
• sending the signed data to the identity provider via the first channel;
• sharing a shared secret with the identity provider via the second channel, wherein the second channel is configured such that data sent via the second channel is signed by one of the identity provider and the service provider sending the shared secret according to the second cryptographic protocol;
• determining, in response to receipt of a client secret from the client, that the client secret corresponds to the shared secret;
• and,
• determining to trust the client.