Collaborative cloud identity and credential forgery and abuse defense
A system and method for providing a cloud identity verification exchange service which ingests a plurality of identity assertion data from various Identity Providers and/or Service Providers and aggregates the ingested plurality of data into a master global authentication ledger. The system and method comprise: a data ingestion engine configured for acquiring, extracting, and loading data into the system as well as providing hashing capabilities; a metadata manager for collecting, organizing, and cataloguing ingested data based on collected metadata; and database for storing the master global authentication ledger. The master ledger acts as a central repository that consolidates authentication objects from various Identity Providers, allowing for centralized authentication management, auditing, reporting, and analysis. It provides a comprehensive view of authentication activities across multiple systems and enables the tracking of user authentication events across different identity providers.
1 . A system for providing cloud identity verification, comprising:
a computing device comprising a memory, a processor and a non-volatile data storage device;
a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
receive a plurality of identity assertions from an identity provider;
for each identity assertion of the plurality of identity assertions:
assign an identification value to said identity assertion;
create a unique hash value associated with said identity assertion; and
store said identity assertion, the identification value assigned to said identity assertion, and the unique hash value assigned to said identity assertion in a master global authentication ledger stored on the non-volatile data storage device;
obtain credential data unique to a user from an identity verification service, wherein the unique credential data represents a verified identity of the user;
store the physical credential data to the relevant identity assertion stored in the master global authentication ledger.
2 . The system of claim 1 , further comprising a second plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
for each identity assertion of the plurality of identity assertions:
parse said identity assertion to collect a plurality of metadata associated with said identity assertion; and
store the collected metadata in the master global authentication ledger.
3 . The system of claim 2 , wherein the metadata comprises information related to issuer, timestamp, audience, authentication method, subject, authentication context, authentication level or assurance, attributes, digital signatures, and security tokens.
4 . The system of claim 2 , wherein the identification value assigned to each identity assertion is based on a combination of attributes based on the collected metadata associated with respective identity assertion.
5 . The system of claim 1 , wherein the physical credential data is provided to a requesting party upon request.
6 . The system of claim 5 , wherein the requesting party is associated with real estate closing, bank account openings, powers of attorney, notarization, or health care actions.
7 . The system of claim 1 , wherein each unique the hash value is created using a cryptograph hash function.
8 . The system of claim 1 , wherein the identity assertions comprise at least SAML objects, OAuth tokens, and Kerberos tickets.
9 . The system of claim 1 , wherein the identity assertions are associated with single sign-on systems.
10 . A method for providing cloud identity verification, comprising the steps of:
receiving a plurality of identity assertions from an identity provider;
for each identity assertion of the plurality of identity assertions:
assign an identification value to said identity assertion;
create a unique hash value associated with said identity assertion; and
store said identity assertion, the identification value assigned to said identity assertion, and the unique hash value assigned to said identity assertion in a master global authentication ledger stored on the non-volatile data storage device;
obtaining credential data unique to a user from an identity verification service, wherein the unique credential data represents a verified identity of the user;
storing the physical credential data to the relevant identity assertion stored in the master global authentication ledger.
11 . The method of claim 10 , further comprising the steps of:
for each identity assertion of the plurality of identity assertions:
parse said identity assertion to collect a plurality of metadata associated with said identity assertion; and
store the collected metadata in the master global authentication ledger.
12 . The method of claim 11 , wherein the metadata comprises information related to issuer, timestamp, audience, authentication method, subject, authentication context, authentication level or assurance, attributes, digital signatures, and security tokens.
13 . The method of claim 11 , wherein the identification value assigned to each identity assertion is based on a combination of attributes based on the collected metadata associated with respective identity assertion.
14 . The method of claim 10 , wherein the physical credential data is provided to a requesting party upon request.
15 . The method of claim 14 , wherein the requesting party is associated with real estate closing, bank account openings, powers of attorney, notarization, or health care actions.
16 . The method of claim 10 , wherein each unique the hash value is created using a cryptograph hash function.
17 . The method of claim 10 , wherein the identity assertions comprise at least SAML objects, OAuth tokens, and Kerberos tickets.
18 . The method of claim 10 , wherein the identity assertions are associated with single sign-on systems.