GRADUATED AUTHENTICATION IN AN IDENTITY MANAGEMENT SYSTEM

1 - 22 . (canceled)

23 . A computer-implemented method, comprising:

receiving, at a webservice provider and from a homesite, a request for information held by the web service provider, the homesite acting as an agent of a user, and the homesite permitted to directly interact with the webservice provider on behalf of the user;

issuing, by the webservice provider to the homesite, a request for user authentication, wherein the request for user authentication includes a minimum security requirement;

receiving, at the webservice provider from the homesite, a first message comprising a response to the request for user authentication, wherein the response is configured in accordance with the minimum security requirement; and

in response to successful user authentication based on the first message, sending, from the webservice provider to the homesite, a second message comprising the information requested.

24 . The method of claim 23 wherein the second message further comprises a token allowing the homesite to request the information without further user-authentication.

25 . The method of claim 23 wherein the request for user authentication includes an authentication security level that defines the minimum security requirement as a lowest authentication security level of a plurality of authentication security levels allowable for the requested information.

26 . The method of claim 23 , wherein the request for user authentication includes a security level including at least one of:

an authentication security level,

a channel security level, or

a time sensitivity security level.

27 . The method of claim 23 wherein the first message is received over a channel selected from a plurality of channels based on the minimum security requirement.

28 . The method of claim 27 wherein the second message is sent over the channel selected from the plurality of channels.

29 . The method of claim 23 wherein the homesite determines, in accordance with the minimum security requirement associated with the request for user authentication, a response security level for transmitting the message comprising the response to the request for user authentication.

30 . The method of claim 23 wherein the minimum security requirement is determined in accordance with:

a response security level specified in the received request for user authentication,

information specified in the received request for user authentication,

user preference information,

at least one homesite policy, or

any combination thereof.

31 . The method of claim 23 wherein the request for information includes an explanation of the information requested by the user, and wherein the minimum security requirement is at least partially based on the explanation.

32 . At least one non-transitory, computer-readable medium carrying instructions, which when executed by at least one data processor, performs operations comprising:

receiving, at a webservice provider and from a homesite distinct from the webservice provider, a request for information held by the webservice provider, the homesite acting as an agent of a user, and the homesite permitted to directly interact with the webservice provider on behalf of the user;

issuing, by the webservice provider to the homesite, a request for user authentication, wherein the request for user authentication includes a minimum security requirement;

receiving, at the webservice provider from the homesite, a first message comprising a response to the request for user authentication, wherein the response is configured in accordance with the minimum security requirement; and

in response to successful user authentication based on the first message, sending, from the webservice provider to the homesite, a second message comprising the information requested.

33 . The at least one non-transitory, computer-readable medium of claim 32 wherein the user is an affiliate of the webservice provider.

34 . The at least one non-transitory, computer-readable medium of claim 32 wherein the second message further comprises a token allowing the homesite to access the information multiple times without further user-authentication.

35 . The at least one non-transitory, computer-readable medium of claim 32 wherein the request for user authentication includes a description of the information being requested by the homesite.

36 . The at least one non-transitory, computer-readable medium of claim 32 wherein the request for user authentication includes an authentication security level that defines the minimum security requirement as a lowest authentication security level of a plurality of authentication security levels allowable for the requested information.

37 . The at least one non-transitory, computer-readable medium of claim 32 wherein the request for user authentication includes a security level, and wherein the security level is:

an authentication security level,

a channel security level, or

a time sensitivity security level.

38 . The at least one non-transitory, computer-readable medium of claim 32 wherein the request for user authentication includes a security level, and wherein the security level is determined in accordance with:

a response security level specified in the received request for information,

information specified in the received request for information,

user preference information,

at least one homesite policy, or

any combination thereof.

39 . The at least one non-transitory, computer-readable medium of claim 32 wherein the request for information includes an explanation of the information requested by the user, and wherein the minimum security requirement is at least partially based on the explanation.

40 . A system comprising:

at least one hardware processor; and

at least one non-transitory memory, coupled to the at least one hardware processor and storing instructions, which when executed by the at least one hardware processor, perform a process, the process comprising:

receiving, at a webservice provider and from a homesite distinct from the webservice provider, a request for information held by the webservice provider, the homesite acting as an agent of a user, and the homesite permitted to directly interact with the webservice provider on behalf of the user;

issuing, by the webservice provider to the homesite, a request for user authentication, wherein the request for user authentication includes a minimum security requirement;

receiving, at the webservice provider from the homesite, a first message comprising a response to the request for user authentication, wherein the response is configured in accordance with the minimum security requirement; and

in response to successful user authentication based on the first message, sending, from the webservice provider to the homesite, a second message comprising the information requested.

41 . The system of claim 40 wherein the second message further comprises a token allowing the homesite to request the information without further user-authentication.

42 . The system of claim 40 wherein the request for user authentication is configured to include an authentication security level that defines the minimum security requirement as a lowest authentication security level of a plurality of authentication security levels allowable for the requested information.