Patent ID: 7836298
Filing Date: 2010-11-16
Classification: G06F,H04L

Abstract:
1. A computer implemented method for providing identity-related information (IRI) to a requesting entity by means of an identity provider, wherein a client application is provided for the communication of a user with the requesting entity and with the identity provider, wherein the client application uses a first communication protocol, wherein the first communication protocol comprises a referrer function according to which a communication message comprises a referrer element with information about previous communication, said method comprising: authenticating, by a computing device, the user to the identity provider; a first authenticity reference part generation step, comprising the generation, by said computing device, of a first authenticity reference part by the identity provider; a first authenticity reference communication step between the client application and the identity provider comprising the communication, by said computing device, of the first authenticity reference part; a second authenticity reference part generation step, comprising the generation, by said computing device, of a second authenticity reference part by the identity provider based on verification of user delivered authentication information sent to the identity provider in response to said first authenticity reference part communicated to the client application; a second authenticity reference communication step between the identity provider and the requesting entity, by means of the first communication protocol, comprising the communication, by said computing device, of the second authenticity reference part and in the referrer element the communication of the first authenticity reference part; a request step wherein the requesting entity sends one of the first and the second authenticity reference part, and a secure function of the first and the second authenticity reference part to the identity provider; a removing step wherein the identity provider deletes information regarding the first and second authenticity reference parts from an identity provider database; and a response step wherein the identity provider sends the identity related information (IRI) to the requesting entity, where the referrer element includes a former destination URL of the client application, where the first authenticity reference part is a uniformly chosen random, pseudorandom or otherwise hard to guess element, where the second authenticity reference part is a uniformly chosen random, pseudorandom or otherwise hard to guess element that is independent from the first authenticity reference part, where the first authenticity reference communication step delivers the first authenticity reference part to a current URL of the first communication protocol, and where the second authenticity reference communication step sends a redirect command to the client application and the client application sends a get request to the requesting entity.