WO2008020991B1

WO2008020991B1 - Notarized federated identity management

Info

Publication number: WO2008020991B1
Application number: PCT/US2007/017047
Authority: WO
Inventors: Michael T Goodrich; Danfeng Yao; Roberto Tamassia
Original assignee: Univ Brown; Michael T Goodrich; Danfeng Yao; Roberto Tamassia
Priority date: 2006-07-28
Filing date: 2007-07-30
Publication date: 2008-10-02
Also published as: WO2008020991A3; WO2008020991A2

Abstract

The exemplary embodiments of this invention provides notarized federated identity management that may have application like supporting efficient user authentication when providers are unknown to each other and/or for avoiding direct communication between identity providers and service providers, which provides improved privacy protection for users. In one non-limiting, exemplary embodiment, a method includes: receiving through a data communication network an assertion generated by a first entity; notarizing the assertion to obtain a corresponding notarized assertion; and in response to receiving from a second entity via the same or a different data communication; network a query corresponding to the assertion, returning the corresponding notarized assertion. The method further includes: determining a user private key for the user identity information; and returning the user private key to the user as data to be stored on a storage medium.

Claims

AMENDED CLAIMS received by the International Bureau on 06 May 2008 (06.05.2008)

What is claimed is:

1. A method comprising: receiving through a data communication network an assertion generated by a first entity; notarizing the assertion to obtain a corresponding notarized assertion; and in response to receiving from a second entity via the same or a different data communication network a query corresponding to the assertion, returning the corresponding notarized assertion.

2. A method as in claim 1, wherein the assertion comprises a signed blinded assertion.

3. A method as in any one of the preceding claims, further comprising: in response to receiving from the second entity via the same or a different data communication network the query corresponding to the assertion, returning a proof corresponding to the query.

4. A method as in any one of the preceding claims, wherein the method is executed within a secure transaction management system (STMS), wherein the notarized assertion comprises the assertion and a STMS proof, the method further comprising: obtaining, by the second entity, a signed STMS basis of a current time quantum from the first entity; verifying, by the second entity, the STMS proof using the signed STMS basis; and verifying, by the second entity, the signature of the STMS basis using a public key of the first entity.

5. A method as in any one of the preceding claims, further comprising: archiving signatures on requests and assertions;

37 encrypting the received assertions; and using an authenticated-dictionary technique to provide verification.

6. A method as in any one of the preceding claims, further comprising: encrypting the received assertion to obtain an encrypted assertion; and storing the encrypted assertion, wherein the notarized assertion comprises a proof indicating that the assertion is stored by a notary entity.

7. A method as in any one of the preceding claims, wherein the notarized assertion does not comprise an identification of the first entity.

8. A method as in any one of the preceding claims, wherein receiving the assertion is performed in response to the first entity receiving a signed request from the second entity comprising session identification information, the method further comprising: receiving via the data communication network the session identification information from the first entity, wherein the session identification information comprises a random value.

9. A method as in any one of the preceding claims, further comprising: determining a user private key for a corresponding user public key consisting of at least one piece of user identity information; and returning the user private key to the user as data to be stored on a storage medium.

10. A method as in claim 9, further comprising: authenticating a user by engaging in a challenge-response protocol utilizing the user public key; and querying a revocation entity to determine if the user public key has been revoked.

11. A computer program product comprising program instructions embodied on a tangible computer-readable medium, execution of the program instructions resulting in operations comprising: receiving through a data communication network an assertion generated by a first

38 comprises one of a user or a service provider.

17. A system as in any one of claims 14-16, further comprising a third entity configured to determine a user private key for a corresponding user public key consisting of at least one piece of user identity information and to return the user private key to the second entity as data to be stored on a storage medium.

18. A system as in any one of claims 14-17, wherein the first entity is further configured to authenticate the second entity by engaging in a challenge-response protocol utilizing the user public key and to query a revocation entity to determine if the user public key has been revoked.

19. A system as in any one of claims 14-18, wherein the notary component is further configured to encrypt the received assertion to obtain an encrypted assertion and to store the encrypted assertion, wherein the notarized assertion comprises a proof indicating that the assertion is stored by the notary component.

20. A system as in anyone of claims 14-19, wherein the notarized assertion does not comprise an identification of the first entity.

40