Authentication using delegated identities

Patent metadata

Field	Value
Publication number	US-10664577-B2
Application number	US-201916391597-A
Country	US
Kind code	B2
Filing date	Apr 23, 2019
Priority date	Nov 20, 2017
Publication date	May 26, 2020
Grant date	May 26, 2020

Abstract

The invention relates to a computer-implemented method for user authentication using a cryptographically secured register. An authentication request for authenticating the user is received. The user is authenticated using a root identity of the user. A successful authentication requires receiving a credential assigned to a root identifier of the root identity of the user. An authentication context of the requested authentication is identified. One of the one or more delegated identities assigned to the root identity of the user and assigned to the identified authentication context is identified. In response to a successful authentication of the user, an authentication token is issued confirming the successful user authentication and identifying the successfully authenticated user by the delegated identifier of the identified delegated identity.

First claim

What is claimed is:

1. A computer-implemented method for user authentication using a cryptographically secured register, the cryptographically secured register comprising a root identity of the user, the root identity comprising a root identifier and a credential assigned to the root identifier for authenticating the user, the cryptographically secured register further comprising one or more delegated identities assigned to the root identity, each of the delegated identities comprising a delegated identifier and being assigned to an authentication context, the method comprising:
receiving an authentication request for authenticating the user,
authenticating the user using the root identity of the user, a successful authentication requiring receiving the credential assigned to the root identifier of the root identity of the user,
identifying an authentication context of the requested authentication,
identifying one of the one or more delegated identities assigned to the root identity of the user and assigned to the identified authentication context using the cryptographically secured register,
in response to a successful authentication of the user using the root identity, issuing an authentication token confirming the successful user authentication and identifying the authenticated user by the delegated identifier of the identified delegated identity,
wherein the root identity includes more than one delegated identities assigned to the root identity, the more than one delegated identities being assigned to the root identity in form of a tree-structure with at least a first one of the more than one delegated identities assigned to the root identity via at least a second one of the more than one delegated identities.

2. The method of claim 1 , the method performing single-sign-on with the root identity of the user for all delegated identities assigned to the respective root identity.

3. The method of claim 1 , the cryptographically secured register comprising computer-readable program code, execution of the computer-readable program code by a processor of an authenticating computer system causing the processor to control the authenticating computer system to execute the user authentication and to issue the authentication token.

4. The method of claim 1 , the cryptographically security of the register comprising one or more of the following: hashing, signing, and encrypting at least parts of the stored root identity and the stored one or more delegated identities.

5. The method of claim 1 , the cryptographically secured register being a distributed register, copies of which are distributed over a plurality of computer systems.

6. The method of claim 5 , the cryptographically security of the distributed register comprising storing the root identity and the one or more delegated identities in a plurality of blocks of a blockchain comprised by each copy of the distributed register.

7. The method of claim 1 , the cryptographically secured register being provided by a central database.

8. The method of claim 1 , the issuing of the authentication token being refused if the root identity used for the authentication or the identified delegated identity is invalid.

9. The method claim 1 , the request comprising the root identifier of the root identity used for authentication.

10. The method of claim 1 , the request comprising the delegated identifier assigned to the root identity used for authenticating the user and assigned to the identified authentication context.

11. The method claim 1 , the authentication request being received by an identity provider computer system having access to the cryptographically secured register, the identity provider computer system performing the authentication of the user and the issuing of the authentication token identifying the successfully authenticated user by the delegated identifier of the identified delegated identity.

12. The method of claim 11 , the authentication request being received from a service provider computer system and the credential used for authenticating the user being received from a user computer system.

13. The method of claim 1 , the one or more delegated identities each comprising an indicator of a validity expiration date at which the validity of the respective delegated identity expires.

14. The method of claim 1 , at least one of the one or more delegated identities comprising additional authentication requirements for a successful authentication, in case the respective delegated identity is the delegated identity identified to be assigned to the root identity used for the authentication and assigned to the identified authentication context.

15. The method of claim 1 , further comprising
receiving from a first identity requester a request for providing all delegated identities assigned the root identity,
providing all the one or more delegated identities assigned the root identity if the first identity requester is successfully authenticated using the respective root identity.

16. The method of claim 1 , further comprising assigning an additional delegated identity to the root identity, the additional delegated identity comprising an additional delegated identifier and being assigned to an additional authentication context, the additional authentication context depending on a further root identity, the assigning comprising:
receiving a request for assigning the additional delegated identity,
checking the additional authentication context of the additional delegated identity,
in case the additional authentication context depends on the further root identity, storing the additional delegated identity assigned to the root identity in the cryptographically secured register in response to receiving an approval of the additional delegated identity from a further user successfully authenticated using the further root identity on which the additional authentication context depends.

17. The method of claim 16 , the additional authentication context depending on a further root identity via one or more further delegated identities assigned to the further root identity.

Assignees

• IBM

Inventors

• Hoffmann Philipp
• Lebutsch David
• Oberhofer Martin
• Pittner Daniel
• Uenluetepe Mehmet

Classifications

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• G06F21/33 Primary

  using certificates · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title