Integrated identity provider

Abstract

A communications system for providing secure access to a digital resource of a group of digital resources accessible via a communications network, the system comprising: an identity provider (IDP) that controls access to the digital resource; a data processing hub accessible at an IP (internet protocol) address; a plurality of user equipment (UE) useable by users to communicate via the communications network, each UE having a cyber secure isolated environment (CISE) that is isolated from ambient software in the UE and comprises a secure web browser (SWB) identified by a web browser ID; wherein the hub, the IDP, and the SWB are configured to cooperate and exchange information to authorize a user of a UE of the plurality of UEs to use the UE's SWB to access the digital resource.

1 . A communications system for providing secure access to a digital resource of a group of digital resources accessible via a communications network, the system comprising:
 an identity provider (IDP) that controls access to the digital resource;   a data processing hub accessible at an IP (internet protocol) address;   a plurality of user equipment (UE) useable by users to communicate via the communications network, each UE having a cyber secure isolated environment (CISE) that is isolated from ambient software in the UE and comprises a secure web browser (SWB) identified by a web browser ID;   wherein the hub, the IDP, and the SWB are configured to cooperate and exchange information to authorize a user of a UE of the plurality of UEs to use the UE's SWB to access the digital resource.   
     
     
         2 . The communication system according to  claim 1  wherein to cooperate and exchange information to authorize comprises that the SWB and hub communicate to have the hub issue a security token to the SWB for use by the SWB to access the hub and the resource. 
     
     
         3 . The communication system according to  claim 1  and comprising authorizing only if the resource or the IDP verifies that the SWB has the token. 
     
     
         4 . The communication system according to  claim 1  wherein to cooperate and exchange information to authorize comprises that the SWB notify the hub of a request for access that the user submits to the given digital resource using the SWB. 
     
     
         5 . The communication system according to  claim 4  wherein to cooperate and exchange information to authorize comprises that the IDP communicate with the hub to determine whether or not the SWB has notified the hub of the request for access to the digital resource. 
     
     
         6 . The communication system according to  claim 5  and comprising authorizing only if the IDP has determined that the hub has been notified of the request. 
     
     
         7 . The communication system according to  claim 6  and comprising authorizing only if the IDP has determined that the hub has been approved of the request. 
     
     
         8 . The communication system according to  claim 1  wherein to cooperate and exchange information to authorize comprises that the IDP run a multifactor authentication (MFA) ID test on the user. 
     
     
         9 . The communication system according to  claim 8  and comprising authorizing only if the IDP has determined that the MFA is satisfied. 
     
     
         10 . The communication system according to  claim 1  wherein to cooperate and exchange information to authorize comprises that the digital resource or the IDP authenticate the ID of the SWB. 
     
     
         11 . The communication system according to  claim 10  and comprising authorizing only if the ID of the SWB is authenticated. 
     
     
         12 . The communication system according to  claim 1  and comprising a proxy server having an IP (internet protocol) address at which the proxy server is accessible. 
     
     
         13 . The communication system according to  claim 12  wherein the IDP is configured to grant access to the digital resource only if the request is received from the proxy server. 
     
     
         14 . The communication system according to  claim 13  wherein to cooperate and exchange information comprises that the SWB request and receive the proxy server IP from the data processing hub and use the received proxy server IP address to request access to the digital resource via the proxy server. 
     
     
         15 . A method for providing secure access to a digital resource of a group of digital resources accessible via a communications network, the method comprising:
 using a secure web browser (SWB) to request access to the digital resource via a secure channel of the communications network;   notifying a hub via a secure channel of the communications network of the request;   having an IDP that controls access to the digital resource determine whether or not the hub has been notified of the request; and   authorizing access only if the IDP has determined that the hub has been notified of the request.   
     
     
         16 . The method according to  claim 15  comprising:
 configuring the hub and the SWB to communicate to have the hub issue a security token to the SWB; 
 determining if the hub has issued the SWB with the security token; and 
 authorizing access only if the SWB has been determined to have the security token. 
 
     
     
         17 . The method according to  claim 16  and comprising authorizing access to the digital process only if a user using the SWB satisfies a multifactor authentication test. 
     
     
         18 . A method for providing secure access to a digital resource of a group of digital resources accessible via a communications network, the method comprising:
 providing a hub with an IP address and password of a proxy server that communicates via the network;   configuring an IDP that controls access to the digital resource to accede to a request to access the digital resource only if the request is received from the proxy; and   using a SWB to communicate with the hub to receive the IP address and password and use the received IP address and password to request access to the digital resource via the proxy.   
     
     
         19 . The method according to  claim 18  and comprising authorizing access to the digital process only if a user using the SWB satisfies a multifactor authentication test.