Distributed hierarchical identity management system authentication mechanisms
View Patent ↗A set of methods, and systems, for use in an identity management system are disclosed herein. A modular user identity information datastore using hardware accelerated encryption for user data security operates in a network for receiving requests for, and issuing responses containing user information including third party accredited assertions.
1. A homesite appliance for managing user identity information, the homesite appliance comprising:
a request processor for receiving requests for the user identity information from an external system, for authenticating a user associated with the user identity information and for obtaining authorization from the authenticated user to release the requested user identity information, for extracting the requested user identity information from a schema containing the user identity information, and for transmitting the extracted user identity information to the external system upon receipt of user authorization; and
an authoritative site interface for obtaining and refreshing third party assertions associated with the user identity information, and for associating the obtained and refreshed assertions with the schema.
2. The homesite appliance of claim 1 , further including a storage array interface for connecting the request processor to a storage array, the storage array for storing the schema containing the user identity information sent by the request processor, and for retrieving previously stored user identity information.
3. The homesite appliance of claim 2 , wherein the storage array is external to the homesite appliance.
4. The homesite appliance of claim 2 further including a hardware encryption engine for encrypting user identity information sent to the storage array.
5. The homesite appliance of claim 4 , wherein the hardware encryption engine includes means for decrypting user identity information retrieved from the storage array.
6. The homesite appliance of claim 5 , further including a cache memory for use by the request processor to cache decrypted user identity information.
7. The homesite appliance of claim 6 , further including a cache memory controller for directing retrieval requests from the request processor to one of the cache memory and the external storage array.
8. The homesite appliance of claim 1 , wherein the request processor includes user authentication means for authenticating the identity of the user using at least one of a request for a username and password combination, a request for an out of band authentication request for a shared secret, a request for biometric data and a request for a securely generated token.
9. The homesite appliance of claim 1 , wherein the request processor includes means to receive requests for the user identity information from the external system via the user associated with the user identity information.
10. The homesite appliance of claim 1 , wherein the request processor includes means to transmit the retrieved user identity information to the external system via the user associated with the user identity information.
11. The homesite appliance of claim 1 , wherein the request processor includes means to encrypt the retrieved user identity information prior to transmission to the user.
12. The homesite appliance of claim 11 , wherein the means to encrypt perform secure sockets layer encryption.
13. The homesite appliance of claim 11 , further including a secure sockets layer encryption engine for encrypting the retrieved user identity information prior to transmission.
14. The homesite appliance of claim 4 , wherein the hardware encryption engine includes means to encrypt the retrieved user identity information prior to transmission to the user.