Identity management system

Patent metadata

Field	Value
Publication number	US-9749309-B2
Application number	US-200813124045-A
Country	US
Kind code	B2
Filing date	Sep 12, 2008
Priority date	Sep 12, 2008
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

A system comprising an IMS network ( 104 ), an adapter module ( 106 ), an identity provider ( 108 ) and an application ( 110 ) is described. The adapter module ( 106 ) is within an IMS trust domain. The application ( 110 ) is within the trust domain of the identity provider. A user of the system can access the application ( 110 ) via the IMS network ( 104 ), regardless of whether the application is within the IMS trust domain, by making use of the adapter module ( 106 ) to obtain the user's user credentials for the application from the identity provider.

First claim

The invention claimed is:

1. A method of enabling a user to access an application via a first trust domain within a closed network, the method comprising the steps of:
accessing an account of the user at an identity provider via an adapter module, wherein the adapter module is within the first trust domain and the identity provider is within a second trust domain, wherein the second trust domain is located outside the closed network;
obtaining user credentials of the user for the application from the identity provider, wherein a server on which the application operates is within the second trust domain; and
using the user credentials for the application to provide the user with access to the application,
wherein when the user credentials at the identity provider are different from a user identity of the user in the first trust domain, the adapter module stores at the adapter module a mapping between the user identity and the user credentials, and wherein the user identity in the first trust domain is fixed and used by services running in the first trust domain within the closed network.

2. The method as claimed in claim 1 , wherein either:
the adapter module is within both the first trust domain and the second trust domain; or
the identity provider is within both the first trust domain and the second trust domain.

3. The method as claimed in claim 1 , wherein:
the adapter module is within the first trust domain and outside the second trust domain; and
the identity provider is with the second trust domain and outside the first trust domain.

4. The method as claimed in claim 1 , wherein the first trust domain is an IMS network.

5. The method as claimed in claim 1 , wherein the adapter module is configured to obtain data required to access the account of the user at the identity provider.

6. The method as claimed in claim 5 , wherein the step of obtaining the data required to access the account of the user at the identity provider via the adapter module further comprises obtaining a location of the identity provider.

7. The method as claimed in claim 5 , wherein the step of the obtaining the data required to access the account of the user at the identity provider via the adapter module further comprises obtaining user credentials required to access the account of the user at the identity provider.

8. The method as claimed in claim 1 , wherein the adapter module performs protocol and/or format translation between the first trust domain on the one hand, and the identity provider and/or the application on the other hand.

9. An adapter module configured to enable a user to access an application via a first trust domain within a closed network, wherein the adapter module is within the first trust domain and a server on which the application operates is within a second trust domain, wherein the second trust domain is located outside the closed network, and wherein the adapter module is configured to:
access an account of the user at an identity provider at which the user has an account, wherein the identity provider is within the second trust domain;
obtain said user credentials of the user for the application from the identity provider; and
enable the user to access the application,
wherein when the user credentials at the identity provider are different from a user identity of the user in the first trust domain, the adapter module stores at the adapter module a mapping between the user identity and the user credentials, and wherein the user identity in the first trust domain is fixed and used by services running in the first trust domain within the closed network.

10. The adapter module as claimed in claim 9 , wherein the adapter module is within the second trust domain.

11. The adapter module as claimed in claim 9 , wherein the identity provider is within the first trust domain.

12. The adapter module as claimed in claim 9 , wherein the adapter module is configured to obtain data required to access the account of the user at the identity provider.

13. The adapter module as claimed in claim 12 , wherein the adapter module is configured to obtain the data required to access the account of the user at the identity provider from a database.

14. The adapter module as claimed in claim 12 , wherein the data required to access the account of the user at the identity provider includes user credentials for the account.

15. The adapter module as claimed in claim 9 , wherein the adapter module is configured to perform protocol and/or format translation between the first trust domain on the one hand and the identity provider and/or the application on the other hand.

16. A system comprising a closed network and an adapter module, wherein:
the closed network is within a first trust domain and outside a second trust domain;
the adapter module is within the first trust domain;
a user of the system has an account with the closed network;
the user has an account with an application, wherein a server on which the application operates is within the second trust domain;
the user has an account with an identity provider, which identity provider is within the second trust domain; and
the adapter module is configured to access the account of the user at the identity provider and to obtain said user credentials of the user for the application from the identity provider,
wherein when the user credentials at the identity provider are different from a user identity of the user in the first trust domain, the adapter module stores at the adapter module a mapping between the user identity and the user credentials, and wherein the user identity in the first trust domain is fixed and used by services running in the first trust domain within the closed network.

17. A system comprising an adapter module and an identity provider, wherein:
the adapter module is in a first trust domain within a closed network;
the identity provider is located in a second trust domain, wherein the second trust domain is located outside the closed network;
a user of the system has an account with the identity provider;
the user has an account with an application, wherein a server on which the application operates is within the second trust domain; and
the adapter module is configured to access the account of the user at the identity provider and to obtain said user credentials of the user for the application from the identity provider,
wherein when the user credentials at the identity provider are different from a user identity of the user in the first trust domain, the adapter module stores at the adapter module a mapping between the user identity and the user credentials, and wherein the user identity in the first trust domain is fixed and used by services running in the first trust domain within the closed network.

18. An apparatus, comprising:
at least one hardware processor; and
at least one memory including a computer program product,
wherein the at least one memory and the computer program product are configured to, with the at least one processor, cause the apparatus at least to:
access an application via a first trust domain within a closed network, wherein the computer program product is within the first trust domain and a server on which the application operates is within a second trust domain, wherein the second trust domain is located outside the closed network;
access an account of the user at an identity provider at which the user has an account, wherein the identity provider is within the second trust domain;
obtain user credentials of the user for the application from

Assignees

• Horn Günther
• Moeller Wolf-Dietrich
• Rajasekaran Hariharan
• Nokia Solutions & Networks Oy

Inventors

• Horn Günther
• Moeller Wolf-Dietrich
• Rajasekaran Hariharan

Classifications

• H04L65/1016

  IP multimedia subsystem [IMS] · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title