Abstract: A data model for managing identity and access management (IAM) data implemented at an electronic database may include a set of logical resource elements, a set of physical resource elements, and a set of access requests elements that respectively model logical resources, physical resources, and access requests received at an access request manager of an enterprise. The physical resource elements may be respectively associated with the logical resource elements such that access rights for the physical resources may be obtained based on a logical resource specified in the access request. A system for managing IAM may include a mapping module configured to transform heterogeneous IAM data provided by a plurality of IAM data sources into homogeneous IAM data formatted according to the common IAM data format. A data store may implement the IAM data model such that the data store is configured to store the homogeneous IAM data.

Abstract: Aspects of the present disclosure are directed to methods and systems for securing mobile computing applications with distributed keys. In one aspect, a computer implemented method or computer readable media include steps electronically receiving, at a computer processor of a computing device, a first security key fragment based on a user input to the computing device; electronically receiving, at the computer processor, a second security key fragment from a network connected storage entity; and electronically concatenating, at the computer processor, the first security key fragment and the second security key fragment to generate a third security key.

Abstract: Aspects of the present disclosure pertain to system and method of securing mobile devices using virtual certificates at a computer processor. A method may include receiving a request for access to a computer network associated with a computing device to an application associated with a network connected server processor; electronically receiving, at the server processor, a first security key fragment from the computing device; the first security key fragment being paired with a verifier key fragment unknown to the computing device; generating a conditional seed key fragment at the server processor associated with the verifier key fragment; comparing a first hash parameter to a second hash parameter at the server processor; transmitting, at the server processor, a session security key for enabling network access to the application associated with the server processor.

Abstract: Aspects of the present disclosure are directed to methods and systems for securing mobile computing applications with distributed keys. In one aspect, a computer implemented method or computer readable media include steps electronically receiving, at a computer processor of a computing device, a first security key fragment based on a user input to the computing device; electronically receiving, at the computer processor, a second security key fragment from a network connected storage entity; and electronically concatenating, at the computer processor, the first security key fragment and the second security key fragment to generate a third security key.

Abstract: Aspects of the present disclosure pertain to system and method of securing mobile devices using virtual certificates at a computer processor. A method may include receiving a request for access to a computer network associated with a computing device to an application associated with a network connected server processor; electronically receiving, at the server processor, a first security key fragment from the computing device; the first security key fragment being paired with a verifier key fragment unknown to the computing device; generating a conditional seed key fragment at the server processor associated with the verifier key fragment; comparing a first hash parameter to a second hash parameter at the server processor; transmitting, at the server processor, a session security key for enabling network access to the application associated with the server processor.

Abstract: Methods, computer-readable media, and apparatuses are disclosed for storing and utilizing state information for service providers. In one aspect of the invention, the methods, processes, or apparatus may include one or more of the following steps: 1) storing state information on a vault; 2) requesting state information on the vault from a receiving party and a device and providing identification to the vault; 3) authenticating and certifying the request from the receiving party; 4) providing the state information to the receiving party; 5) using the state information on the device; and 6) returning the state information to the vault. An additional aspect of the invention provides a method and/or process for storing and utilizing web-based cookies on a cloud environment for service providers.

Abstract: A system for managing an enterprise concept dictionary may include an electronic master dictionary and electronic local dictionaries. The master dictionary may include concept entries respectively associated with concept identifiers and with one or more concept definitions. The local dictionaries may include one or more of the concept identifiers of the master dictionary. A dictionary management module may be in signal communication with the master dictionary and the local dictionaries. The dictionary management module may be configured to query the master dictionary for a concept entry that corresponds to a concept associated with a modeling component. If a concept entry is found, the concept identifier may be provided. If a concept entry is not found, a new concept entry may be added to the master dictionary. A notification module may be in signal communication with the master dictionary and automatically provide notification when a concept entry is added or updated.

Abstract: Methods and systems are described herein for performing attribute authentication for use by a relying party in providing access to a resource as requested by a user. Attribute authentication may be performed entirely by a single identity service provider, or by multiple identity service providers each authenticating a subset of a plurality of user attributes, such as name, address, phone, email, and the like. Each attribute may be authenticated with a level of assurance. Levels of assurance may vary from attribute to attribute. Different levels of assurance may be required for different attributes before the relying party may grant access to the user-desired resource. An authentication broker may act as a registry or broker of identity service providers, and may store information usable by relying parties to establish a trust relationship with a particular identity service provider on demand, as needed by a relying party.

Abstract: Methods and systems are described herein for performing attribute authentication for use by a relying party in providing access to a resource as requested by a user. Attribute authentication may be performed entirely by a single identity service provider, or by multiple identity service providers each authenticating a subset of a plurality of user attributes, such as name, address, phone, email, and the like. Each attribute may be authenticated with a level of assurance. Levels of assurance may vary from attribute to attribute. Different levels of assurance may be required for different attributes before the relying party may grant access to the user-desired resource. An authentication broker may act as a registry or broker of identity service providers, and may store information usable by relying parties to establish a trust relationship with a particular identity service provider on demand, as needed by a relying party.

Abstract: A data model for managing identity and access management (IAM) data implemented at an electronic database may include a set of logical resource elements, a set of physical resource elements, and a set of access requests elements that respectively model logical resources, physical resources, and access requests received at an access request manager of an enterprise. The physical resource elements may be respectively associated with the logical resource elements such that access rights for the physical resources may be obtained based on a logical resource specified in the access request. A system for managing IAM may include a mapping module configured to transform heterogeneous IAM data provided by a plurality of IAM data sources into homogeneous IAM data formatted according to the common IAM data format. A data store may implement the IAM data model such that the data store is configured to store the homogeneous IAM data.

Abstract: A system for managing an enterprise concept dictionary may include an electronic master dictionary and electronic local dictionaries. The master dictionary may include concept entries respectively associated with concept identifiers and with one or more concept definitions. The local dictionaries may include one or more of the concept identifiers of the master dictionary. A dictionary management module may be in signal communication with the master dictionary and the local dictionaries. The dictionary management module may be configured to query the master dictionary for a concept entry that corresponds to a concept associated with a modeling component. If a concept entry is found, the concept identifier may be provided. If a concept entry is not found, a new concept entry may be added to the master dictionary. A notification module may be in signal communication with the master dictionary and automatically provide notification when a concept entry is added or updated.

Abstract: Methods and systems are described herein for performing attribute authentication for use by a relying party in providing access to a resource as requested by a user. Attribute authentication may be performed entirely by a single identity service provider, or by multiple identity service providers each authenticating a subset of a plurality of user attributes, such as name, address, phone, email, and the like. Each attribute may be authenticated with a level of assurance. Levels of assurance may vary from attribute to attribute. Different levels of assurance may be required for different attributes before the relying party may grant access to the user-desired resource. An authentication broker may act as a registry or broker of identity service providers, and may store information usable by relying parties to establish a trust relationship with a particular identity service provider on demand, as needed by a relying party.

Abstract: Methods and systems are described herein for performing attribute authentication for use by a relying party in providing access to a resource as requested by a user. Attribute authentication may be performed entirely by a single identity service provider, or by multiple identity service providers each authenticating a subset of a plurality of user attributes, such as name, address, phone, email, and the like. Each attribute may be authenticated with a level of assurance. Levels of assurance may vary from attribute to attribute. Different levels of assurance may be required for different attributes before the relying party may grant access to the user-desired resource. An authentication broker may act as a registry or broker of identity service providers, and may store information usable by relying parties to establish a trust relationship with a particular identity service provider on demand, as needed by a relying party.

Abstract: Methods, computer-readable media, and apparatuses are disclosed for storing and utilizing state information for service providers. In one aspect of the invention, the methods, processes, or apparatus may include one or more of the following steps: 1) storing state information on a vault; 2) requesting state information on the vault from a receiving party and a device and providing identification to the vault; 3) authenticating and certifying the request from the receiving party; 4) providing the state information to the receiving party; 5) using the state information on the device; and 6) returning the state information to the vault. An additional aspect of the invention provides a method and/or process for storing and utilizing web-based cookies on a cloud environment for service providers.

Abstract: Described are a method and a system for using XML in a real-time message for transmission of data from a source to a destination over a network. The real-time XML message includes a header element and a body element. The header element includes one or more destination elements and one source element, each having a unique identifier and a set of pre-defined and user-defined real-time properties. The body element of the message includes the data to be carried to the destination in plain or encoded XML content. XML addresses are proposed as the identifier of the source and destination, and an XML naming service can look up an XML address from the canonical name of the source and destination. Advantageously, the real-time message can be transported through the network using XML addresses included in the destination and source elements of the message.