Patent ID: 7607008

Claim:
A computer-implemented method of authenticating an identity of a user seeking access to a relying computing entity, wherein the identity of the user is issued by an authentication service and is not issued by the relying computing entity, the method comprising: receiving at a broker service an authentication request from the relying computing entity to authenticate the identity of the user, wherein the authentication request does not include an identification of an authentication service; identifying, by the broker service, an appropriate authentication service among a plurality of authentication services, wherein (a) a first trust relationship exists between the relying computing entity and the broker service; (b) a second trust relationship exists between the identified authentication service and the broker service; (c) no relevant trust relationship exists between the identified authentication service and the relying computing entity; and (d) identifying of the appropriate authentication service is based at least in part on determining that the second trust relationship exists; receiving an authentication response from the identified authentication service at the broker service; and sending an authentication response from the broker service to the relying computing entity representing a trusted authentication of the identity of the user to the relying computing entity based on the first trust relationship and the second trust relationship.