Security Token Mediator for Identity Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current online business transaction systems lack user control over information release, are vulnerable to identity theft, and require storage of sensitive information on local machines, especially when using public computers.
Innovation Solution
A client receives a security policy from a relying party, selects an appropriate information card, and forwards it to an identity provider to obtain a security token, which includes a transaction receipt, allowing controlled release of information without storing sensitive data on the client's machine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the user stores identity information locally on their machine, then the user can control the release of information to service providers, but the user cannot use public computers to perform transactions and must install information cards on each machine
Solution Approach 1:
The patent introduces a security token as an intermediary between the user's identity information and the service provider. The security token contains a reference to the identity information and can be used to access it without the token itself containing the sensitive data. This allows the user to control information release while being able to use different computers, as the token can be stored locally and used to authenticate without installing permanent information cards on each machine.
2Reliability
If the service provider requires the user to log in with username and password, then the service provider can authenticate the user, but the user has no control over how the service provider uses the stored information
Solution Approach 1:
The patent extracts the authentication mechanism from the identity information itself. Instead of the service provider storing and controlling the user's identity information, the system separates authentication (proving who you are) from identity data (your personal information). The security token provides authentication capability without requiring the service provider to store or control the actual identity information, thus giving users control over how their information is used while maintaining reliable authentication.
3Ease of operation
If the user uses the same username and password on multiple computer systems, then the user can remember fewer credentials, but someone who hacks one system can access other systems
Solution Approach 1:
The patent segments the authentication process into multiple independent components: the security token (stored locally on the user's machine), the identity information (stored securely with the identity provider), and the authentication protocol (mediated by the security policy). This segmentation means that even if one system is compromised, the attacker cannot easily access other systems because the security token is machine-specific and the identity information remains protected by the security policy and audit mechanisms. Users still only need to manage a few trusted identity providers rather than many credentials.
4Productivity
If the identity provider releases user information to a third party who convinces them to authenticate, then the transaction can be completed, but the user has no way to know this release has occurred
Solution Approach 1:
The patent implements feedback mechanisms through security policies and audit trails. The security policy explicitly defines what information can be released and under what conditions, providing feedback to both the user and the identity provider. Audit trails record all information releases, allowing users to review and verify what information has been shared with which service providers. This ensures users are aware of information releases while still allowing transactions to complete efficiently.
Data Source
AI summary
A user engages in a transaction with a relying party. The relying party requests identity information from the user in a security policy and identifies transaction elements for an on-line business transaction. Typically, the security policy and transaction elements are transmitted together; the security policy can be as little as a request to conduct the on-line business transaction. The user identifies an information card that satisfies the security policy. The computer system requests a security token from the identity provider managing the information card, which can include requesting a transaction receipt for the transaction elements. The computer system then returns the security token (and the transaction receipt) to the relying party, to complete the transaction.