Patent ID: 8554930

Claim:
A method for assertion processing within a data processing system, the method comprising: receiving, from a first trust proxy within a first domain at a second trust proxy in a second domain, an assertion associated with a user, wherein the assertion is associated with a request from a client to access a controlled resource within the second domain; responsive to receipt of the assertion, challenging a user of the client to provide information that is required to be possessed by the user that is associated with the assertion, wherein the challenging step is performed to enable the user associated with the assertion to attempt to re-prove an identity and comprises: sending from the second trust proxy to the first trust proxy a request for challenge information; receiving the challenge information at the second trust proxy from the first trust proxy; generating a proof-of-possession challenge at the second trust proxy, wherein a valid response to the proof-of-possession challenge comprises the information that is required to be possessed by the user that is associated with the assertion; sending the proof-of-possession challenge to the client; and validating a response to the proof-of-possession challenge; and in response to a determination that the user of the client possesses the information that is required to be possessed by the user that is associated with the assertion, validating the assertion at the second trust proxy.