Distributed Network Identity

• US 20080014931A1
• Filed: 09/28/2007
• Published: 01/17/2008
• Est. Priority Date: 12/04/2001
• Status: Active Grant

• Current Assignee: Aravindan Ranganathan, Gary Ellison, Hal Stern, John Beatty, Larry Abrahams, Mark Hapner, Peter Yared, Sai Allavarpu, Sheldon Finkelstein
• Original Assignee: Aravindan Ranganathan, Gary Ellison, Hal Stern, John Beatty, Larry Abrahams, Mark Hapner, Peter Yared, Sai Allavarpu, Sheldon Finkelstein
• Inventors: Beatty, John, Hapner, Mark, Ellison, Gary, Yared, Peter, Stern, Hal, Ranganathan, Aravindan, Abrahams, Larry, Allavarpu, Sai, Finkelstein, Sheldon
• Granted Patent: US 7,849,204 B2
• Time in Patent Office: Days
• US Class Current: 455/432.3
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 61/4547 for personal communications, i.e. using a personal identifier
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A distributed network identity is provided. An identity provider stores a portion of a user'"'"'s personal information. A service provider accesses user information from one or more identity providers. System entities such as identity providers and service providers can be linked to enable information sharing and aggregation. User policies and privacy preferences are provided to control how information is shared. A single sign-on architecture is provided where an identity provider is used to facilitate cross-domain authentication and to enhance user convenience. Service delegation features are also provided.

Claims

1. A method for trust chaining, the method comprising:

providing a user account handle, wherein the handle links a first system entity and a second system entity; and

requesting user profile data from one of the first system entity and the second system entity.

2. The method of claim 1 wherein the user account handle is an identifier for the user in a namespace between the first system entity and the second system entity.

3. The method of claim 1 further comprising:

determining whether the user profile data request is approved in a user policy; and

responsive to the determining, sending user profile data to one of the first system entity and the second system entity.

4. The method of claim 3 wherein the determining further comprises:

requesting user validation of the user profile data request.

5. The method of claim 1 wherein the first system entity comprises one of a service provider and an identity provider.

6. The method of claim 1 wherein the second system entity comprises one of a service provider and an identity provider.

7. The method of claim 1 further comprising:

unlinking the first system entity and the second system entity responsive to a user request.

8. The method of claim 1 further comprising:

deleting user profile data from the first system entity user directory and the second system entity user directory.

9. The method of claim 1 further comprising:

updating a user directory with user profile data from at least one of the first entity or the second entity.

10. A computer readable medium comprising:

program instructions for providing a user account handle, wherein the handle links a first system entity and a second system entity; and

program instructions for requesting user profile data from one of the first system entity and the second system entity.

11. The computer readable medium of claim 10 wherein the user account handle is an identifier for the user in a namespace between the first system entity and the second system entity.

12. The computer readable medium of claim 10 further comprising:

program instructions for determining whether the user profile data request is approved in a user policy.

13. The computer readable medium of claim 12 wherein the program instructions for determining further comprises:

program instructions for requesting user validation of the user profile data request.

14. The computer readable medium of claim 10 further comprising:

program instructions for updating a user directory with user profile data from at least one of the first entity or the second entity.

15. A system for trust chaining, the system comprising:

an identifier module configured to provide a user account handle, wherein the handle links a first system entity and a second system entity; and

a user account module configured to request user profile data from one of the first system entity and the second system entity.

16. The system of claim 15 wherein the user account handle is an identifier for the user in a namespace between the first system entity and the second system entity.

17. The system of claim 15 further comprising:

a user policy module configured to determine whether the user profile data request is approved in a user policy.

18. The system of claim 17 wherein the user policy module is further configured to request user validation of the user profile data request.

19. The system of claim 15 wherein the first system entity comprises one of a service provider and an identity provider.

20. The system of claim 15 wherein the second system entity comprises one of a service provider and an identity provider.

21. The system of claim 15 wherein the user account module is further configured to unlink the first system entity and the second system entity responsive to a user request.

22. The system of claim 15 wherein the user account module is further configured to delete user profile data from the first system entity user directory and the second system entity user directory.

23. The system of claim 15 wherein the user account module is further configured to update a user directory with user profile data from at least one of the first entity or the second entity.