Attested identities

• US 20070061872A1
• Filed: 09/14/2005
• Published: 03/15/2007
• Est. Priority Date: 09/14/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Carter, Stephen
• Granted Patent: US 8,281,374 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Attested identities are provided. An applicant requests an attested identity. Attesting resources provide assertions that include roles, rights, and privileges for the attested identity. The collection of assertions from each of the attesting resources represents the attested identity.

Claims

1. A method, comprising:

receiving a request for an identity from an applicant;

notifying attesting resources of the request;

acquiring one or more assertions from the attesting resources for the identity; and

providing the identity with the one or more assertions.

2. The method of claim 1 further comprising, assigning roles, rights, and privileges to the identity in response to a policy.

3. The method of claim 1 further comprising, interacting with the applicant to assemble attributes about the applicant in response to one or more identifiers provided by the applicant.

4. The method of claim 3, wherein interacting further includes presenting a context-driven form to the applicant, wherein the form represents an application for the identity.

5. The method of claim 1, wherein acquiring further includes obtaining the assertions with signatures of the attesting resources.

6. The method of claim 1 further comprising, communicating instructions or information requests to the applicant before providing the identity.

7. The method of claim 1 further comprising, acquiring one or more certificates for the identity.

8. The method of claim 7, wherein acquiring further includes receiving a digitally signed end user agreement from the applicant.

9. A method, comprising:

receiving a request to attest to at least one of a role, a right, and a privilege for an identity;

examining an application associated with the request;

determining a type of assertion for the request; and

communicating the assertion to an identity service.

10. The method of claim 9 further comprising, signing the assertion.

11. The method of claim 9, wherein determining further includes enforcing policy associated with the request.

12. The method of claim 9, wherein determining further includes requesting advice from other attesting resources.

13. The method of claim 9, wherein determining further includes representing the type within the assertion as at least one of allowed access to a given resource for the identity, disallowed access to the given resource for the identity, partial allowance to the given resource for the identity, and undeclared access to the given resource.

14. The method of claim 9 further comprising, associating one or more constraints or expiring events with the assertion.

15. A system, comprising:

a collection of one or more assertions; and

an identity service, wherein the identity service is to assemble the collection and is to enlist attesting resources to provide the one or more assertions in response to an application for an identity from an applicant.

16. The system of claim 15, wherein each of the one or more assertions are signed by one of the attesting resources.

17. The system of claim 15, wherein the identity service is to interact with the applicant to acquire the application, and wherein the application is acquired via a context-driven form.

18. The system of claim 15, wherein each of the one or more assertions include roles, rights, and privileges for a given resource.

19. The system of claim 15, wherein the identity service is to represent the collection as an attested identity for the applicant and is to acquire an end user agreement and signature from the applicant to associated with the attested identity.

20. The system of claim 15 further comprising, one or more identity stores, wherein the one or more identity stores are to house the collection and associate the collection with the applicant as an attested identity.

21. A data structure implemented in a machine-accessible medium for providing an attested identity as a collection of assertions from attesting resources, the data structure comprising:

one or more rights;

one or more roles;

one or more permissions; and

one or more assertions, wherein each assertion includes different combinations of the rights, roles, privileges, and/or identifiers, and wherein each assertion is to be acquired from an attesting resource, and the one or more assertions represent an attested identity for an applicant of an identity.

22. The data structure of claim 21 further comprising, a signature for each attesting resource.

23. The data structure of claim 21 further comprising, a different signature from the applicant to represent a user agreement for the attested identity.

24. The data structure of claim 21, wherein the data structure is to be created, maintained, and managed by an identity service according to policy.

25. The data structure of claim 24, wherein the data structure is to be created dynamically and iteratively through interactions with the applicant and the attesting resources.

26. The data structure of claim 21 further comprising, constraint data or expiring condition data to define circumstances under which one or more of the assertions terminate for the attested identity.

27. The data structure of claim 21, wherein policies are evaluated by policies to determine values for the roles, rights, and/or permissions for accessing resources.