Patent ID: 8869257

Claim:
In an environment comprising a service provider environment including at least one identity provider and at least one relying party, and a user-portable user computing device including user identity information comprising a plurality of user identities of a user, a system, comprising: an identity manager system executing on a host computer, the identity manager system programmed to facilitate online interactions between a user and the service provider environment by managing identity requirements of the interactions; the identity manager system comprises an agent module programmed to manage communications between the identity manager system and the user computing device, the agent module programmed further to receive user identity information from the user-portable computing device when the user-portable computer device is connected into the host computer, the user identity information pertaining to a selected one of the plurality of user identities of the user and to use the user identity information to facilitate interactions between the user and the service provider environment, and wherein the identity manager system is configured to communicate with the service provider environment through a network; wherein the user-portable computing device comprises: data storage for providing first user identities; a token generator, responsive to a token request in reference to one of the first user identities, for issuing a security token relative to the referenced user identity; wherein the identity manager system further comprises: second data storage for providing a plurality of second user identities; an identity selector, responsive to a security policy from a relying party, programmed to determine whether any user identity satisfies the security policy from among the plurality of first user identities and the plurality of second user identities; user interface programmed to enable the user to make a selection from among the user identities determined to satisfy the security policy; and wherein the identity selector, responsive to a user selection drawn from the plurality of first user identities, configured to provide a token request based on the selected user identity, communicate the token request to the user computing device, and receive the security token issued by the user computing device in response to the token request.