Multifaceted assertion directory system

Patent metadata

Field	Value
Publication number	US-10033535-B2
Application number	US-201615071408-A
Country	US
Kind code	B2
Filing date	Mar 16, 2016
Priority date	Mar 16, 2015
Publication date	Jul 24, 2018
Grant date	Jul 24, 2018

Abstract

A method of providing one or more assertions about a subject is provided. The method includes obtaining, at an assertion directory access server and over a network, a first assertion about a first attribute of the subject from a first assertion issuer; obtaining, at the assertion directory access server and over a network, a second assertion about a second attribute of the subject from a second assertion issuer; and providing, from the assertion directory access server, the first assertion and the second assertion to an assertion directory authority server over a network.

First claim

What is claimed is:

1. A method of providing one or more assertions about a subject, comprising:
obtaining, at a first assertion directory access server and over a network, a first assertion about a first attribute of the subject from a first assertion provider;
obtaining, at a second assertion directory access server and over the network, a second assertion about a second attribute of the subject from a second assertion provider;
providing, from the first assertion directory access server and the second assertion directory access server, the first assertion and the second assertion, respectively, to an assertion directory authority server over the network;
obtaining, at a third assertion directory access server and over the network, a first request for the first assertion, the second assertion, or both the first assertion and the second assertion from a relying party;
providing, by the third assertion directory access server and over the network, a second request for the first assertion, the second assertion, or both the first assertion and the second assertion to the assertion directory authority server;
obtaining, by the third assertion directory access server and over the network, the first assertion, the second assertion, or both the first assertion and the second assertion from the assertion directory authority server based on one or more access control policies that are associated with the first assertion or the second assertion and are maintained by the assertion directory authority server; and
providing, by the third assertion directory access server and over the network, the first assertion, the second assertion, or both the first assertion and the second assertion to the relying party.

2. The method of claim 1 , wherein the first assertion or the second assertion comprises a web server certificate, a public key assertion, a privacy assertion, a reputation assertion, a payment information assertion, a factory test assertion, or a field test assertion.

3. The method of claim 1 , further comprising creating a digital signature for the first assertion, the second assertion, or both the first assertion and the second assertion using a digital signature protocol and a cryptographic key associated with the first assertion directory access server or the second directory access server.

4. The method of claim 1 , further comprising determining that the relying party is permitted to access the first assertion, the second assertion, or both the first assertion and the second assertion based on a policy.

5. The method of claim 1 , wherein the first assertion provider is a first issuer of the first assertion that makes one or more statements contained in the first assertion and confirms the one or more statements with a digital signature.

6. The method of claim 1 , wherein the second assertion provider is a second issuer of the second assertion that makes one or more statements contained in the second assertion and confirms the one or more statements with a digital signature.

7. The method of claim 1 , wherein the first assertion provider is the subject.

8. The method of claim 1 , wherein the second assertion provider is the subject.

9. The method of claim 1 , wherein the first assertion directory access server and the second assertion directory access server are the same.

10. The method of claim 1 , wherein the first assertion directory access server and the third assertion directory access server are the same.

11. A method of provisioning one or more assertions about a subject, comprising:
obtaining, at a first assertion directory authority server over a network, a request to provision a first assertion about a first attribute of the subject from a first assertion directory access service server and issued by a first assertion issuer;
obtaining, at the first assertion directory authority server over the network, a request to provision a second assertion about a second attribute of the subject from a second assertion directory access service server and issued by a second assertion issuer;
based on one or more access control policies associated with the first assertion and maintained by the first assertion directory authority server, provisioning, by a hardware processor of the first assertion directory authority server, a first record to store the first assertion in a first partition of a database associated with the first assertion directory authority server; and
based on one or more access control policies that are associated with the second assertion and are maintained by the first assertion directory authority server, provisioning, by a hardware processor of the first assertion directory authority server, a second record to store the second assertion in a second partition of a database associated with the first assertion directory authority server.

12. The method of claim 11 , wherein each assertion directory authority server manages access and associated directory entries for a respective partition.

13. The method of claim 12 , wherein the access comprises one or more of: a publication, an update, a deletion, and a lookup.

14. The method of claim 13 , wherein the access is based on one or more policies from one or more of: the first assertion directory authority server, the second assertion directory authority server, the first assertion provider, the second assertion provider, the subject, and a relying party.

15. The method of claim 11 , wherein each assertion directory authority server is operable to determine usage statistics for the partition under control of each assertion directory authority server.

16. The method claim 11 , wherein the first record comprises information for the first assertion issuer, the subject, an attribute type, and an attribute value arranged as a tuple.

17. The method of claim 16 , wherein the first record further comprises a serial number and a validity period.

18. The method of claim 11 , wherein the first record and the second record are stored as a digital certificate, an attribute certificate, a domain name system security extension (“DNSSEC”) record, a domain name system-based authentication of named entities (“DANE”) record, or a security assertion markup language (“SAML”) assertion.

19. The method of claim 11 , wherein the first record and the second record are digitally signed by one or more entities, wherein the one or more entities comprise a respective assertion issuer, the subject, or a respective directory authority.

20. The method of claim 11 , wherein the first assertion or the second assertion comprises a web server certificate, a public key assertion, a privacy assertion, a reputation assertion, a payment information assertion, a factory test assertion, or a field test assertion.

21. The method of claim 11 , wherein the first assertion directory authority server and the second access directory authority server are the same.

22. The method of claim 11 , wherein the first assertion directory access service server and the second assertion directory access service server are the same.

23. A method of providing one or more assertions about a subject, comprising:
obtaining, at an assertion directory access server and over a network, a first assertion about a first attribute of the subject from a first assertion provider;
obtaining, at the assertion directory access server and over the network, a second assertion about a second attribute of the subject from a second assertion provider; and
providing, from the a

Assignees

• Verisign Inc

Inventors

• Kaliski Jr Burton S
• Wiley Glen

Classifications

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title