Identification and privacy in the World Wide Web

• US 20030084172A1
• Filed: 10/29/2001
• Published: 05/01/2003
• Est. Priority Date: 10/29/2001
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: deJong, Eduard K., Levy, Moshe, Leung, Albert Y.
• Application Number:
  US10/033,373
• Publication Number:
  US 20030084172A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A method for obtaining a service on a data communications network, the method includes enrolling with an authority and using the enrollment results to obtain a service from a service provider. The enrolling creates enrollment results that include user data. The service provider is capable of communicating with the authority to verify the enrollment results

Claims

1. A method for obtaining a service on a data communications network, the method comprising:

enrolling with an authority, said enrolling creating enrollment results, said enrollment results comprising user data; and

using said enrollment results to obtain a service from a service provider, said service provider capable of communicating with said authority to verify said enrollment results.

2. A method for managing identification in a data communications network, the method comprising:

generating authenticated user data, said generating comprising;

presenting a request for authenticated user data and a first set of user data to an authority; and

receiving authenticated user data from said authority in response to said request; and

using said authenticated user data to obtain at least one service on said data communications network, said using comprising;

presenting a service request, said authenticated user data to a service provider; and

receiving said at least one service in response to said service request if said service provider determines said authenticated user data is sufficient to provide said at least one service.

3. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for obtaining a service on a data communications network, the method comprising:

enrolling with an authority, said enrolling creating enrollment results, said enrollment results comprising user data; and

using said enrollment results to obtain a service from a service provider, said service provider capable of communicating with said authority to verify said enrollment results.

4. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for managing identification in a data communications network, the method comprising:

generating authenticated user data, said generating comprising;

presenting a request for authenticated user data and a first set of user data to an authority; and

receiving authenticated user data from said authority in response to said request; and

using said authenticated user data to obtain at least one service on said data communications network, said using comprising;

presenting a service request, said authenticated user data to a service provider; and

receiving said at least one service in response to said service request if said service provider determines said authenticated user data is sufficient to provide said at least one service.

5. An apparatus for managing identification in a data communications network, the apparatus comprising:

means for generating authenticated user data, said generating comprising;

means for presenting a request for authenticated user data and a first set of user data to an authority; and

means for receiving authenticated user data from said authority in response to said request; and

means for using said authenticated user data to obtain at least one service on said data communications network, said means for using comprising;

means for presenting a service request, said authenticated user data to a service provider; and

means for receiving said at least one service in response to said service request if said service provider determines said authenticated user data is sufficient to provide said at least one service.

6. An apparatus for managing identification in a data communications network, the apparatus comprising:

means for receiving a user-controlled secure storage device;

means for enrolling said user with an authority, said enrolling comprising providing information requested by said authority;

means for receiving user data in response to said enrolling;

means for storing said user data in said user-controlled secure storage device; and

means for using said user data at a service provider Web site to obtain a service.

7. An apparatus for obtaining a service on a data communications network, the apparatus comprising:

an enrollment authority configured to accept an enrollment request, said enrollment authority further configured to return enrollment results in response to said enrollment request, said enrollment results comprising user data, said enrollment results for use in obtaining a service from a service provider.

8. An apparatus for obtaining a service on a data communications network, the apparatus comprising:

a service provider configured to accept a service request and enrollment results obtained from an enrollment authority, said service provider capable of communicating with said authority to verify said enrollment results, said service provider configured to provide said service based upon said enrollment results and a response from said enrollment authority.

9. An apparatus for managing identification in a data communications network, the apparatus comprising:

an authority configured to accept an authenticated data request and a user data, said authority further configured to authenticate said user data to create authenticated data, said authority further configured to return said authenticated data in response to said authenticated data request.

10. An apparatus for managing identification in a data communications network, the apparatus comprising:

a service provider configured to accept a service request, a first set of user data and a second set of user data, said first set of user data comprising user data authenticated by an authority, said service provider further configured to determine whether said first set of user data and said second set of user data are sufficient to provide said service, said service provider further configured to provide said service based upon said determination.