OpenID/local openID security
Identity management, user authentication, and/or user access to services on a network may be provided in a secure and/or trustworthy manner, as described herein. For example, trustworthy claims may be used to indicate security and/or trustworthiness of a user or user device on a network. Security and/or trustworthiness of a user or a user device on a network may also be established using OpenID and/or local OpenID, a secure channel between a service and the user device, and/or by including a network layer authentication challenge in an application layer authentication challenge on the user device for example.
1. A method performed by a user device comprising a processor and a memory, the method comprising:
receiving a plurality of claims that each define a key and a value associated with the key, from a network identity provider, such that the plurality of claims is enrolled in the user device, wherein each claim is representative of a verifiable attribute associated with a user of the user device, and each claim is verified by the network identity provider before the claim is enrolled in the user device, such that each claim is associated with a trust that a service has in the network identity provider;
after each claim is verified by the network identity provider, storing the plurality of claims on a secure local entity on the user device such that the plurality of claims cannot be changed by the user;
creating a first digital identity associated with the user and corresponding to the service, wherein the first digital identity is based on a first portion of the plurality of claims;
in response to a user selection of the first digital identity, authenticating with the service using the first digital identity such that the first digital identity conveys, to the service, respective verifiable attributes represented by the first portion of the claims, and the trust associated with the claims;
removing the first portion of claims from the secure local entity on the user device when the first portion of claims expires, wherein each claim in the first portion of claims comprises expiration information corresponding to when the respective claim expires.
2. The method of claim 1 , wherein the first digital identity is associated with the trust that the service has in the network identity provider.
3. The method of claim 1 , the method further comprising:
creating a second digital identity associated with the user and corresponding to the service, wherein the second digital identity is based on a second portion of the plurality of claims; and
authenticating with the service using the second digital identity such that the second digital identity conveys, to the service, respective verifiable attributes represented by the second portion of the claims.
4. The method of claim 3 , wherein at least one of the first and second digital identities is based on one claim.
5. The method of claim 3 , wherein at least one of the first and second digital identities is based on more than one claim.
6. The method of claim 1 , the method further comprising:
sending the first digital identity to the service so that the service can authenticate the user and verify at least one required attribute of the user.
7. The method of claim 1 , wherein the first portion of the plurality of claims represents an age of the user.
8. A user device comprising a processor and a memory, the memory comprising computer-executable instructions that when executed by the processor, cause the processor to perform operations comprising:
receiving a plurality of claims that each define a key and a value associated with the key, from a network identity provider, such that the plurality of claims is enrolled in the user device, wherein each claim is representative of a verifiable attribute associated with a user of the user device, and each claim is verified by the network identity provider before the claim is enrolled in the user device, such that each claim is associated with a trust that a service has in the network identity provider;
after each claim is verified by the network identity provider, storing the plurality of claims on a secure local entity on the user device such that the plurality of claims cannot be changed by the user;
creating a first digital identity associated with the user and corresponding to the service, wherein the first digital identity is based on a first portion of the plurality of claims;
in response to a user selection of the first digital identity, authenticating with the service using the first digital identity such that the first digital identity conveys, to the service, respective verifiable attributes represented by the first portion of the claims, and the trust associated with the claims; and
removing the first portion of claims from the secure local entity on the user device when the first portion of claims expires, wherein each claim in the first portion of claims comprises expiration information corresponding to when the respective claim expires.
9. The user device of claim 8 , wherein the first digital identity is associated with the trust that the service has in the network identity provider.
10. The user device of claim 8 , the memory further comprising computer-executable instructions that when executed by the processor, cause the processor to perform operations further comprising:
creating a second digital identity associated with the user and corresponding to the service, wherein the second digital identity is based on a second portion of the plurality of claims; and
authenticating with the service using the second digital identity such that the second digital identity conveys, to the service, respective verifiable attributes represented by the second portion of the claims.
11. The user device of claim 10 , wherein at least one of the first and second digital identities is based on one claim.
12. The user device of claim 10 , wherein at least one of the first and second digital identities is based on more than one claim.
13. The user device of claim 8 , the memory further comprising computer-executable instructions that when executed by the processor, cause the processor to perform operations further comprising:
sending the first digital identity to the service so that the service can authenticate the user and verify at least one required attribute of the user.
14. The user device of claim 8 , wherein the first portion of the plurality of claims represents an age of the user.