Distributed Network Identity

• US 20080016232A1
• Filed: 09/28/2007
• Published: 01/17/2008
• Est. Priority Date: 12/04/2001
• Status: Active Grant

• Current Assignee: Aravindan Ranganathan, Gary Ellison, Hal Stern, John Beatty, Larry Abrahams, Mark Hapner, Peter Yared, Sai Allavarpu, Sheldon Finkelstein
• Original Assignee: Aravindan Ranganathan, Gary Ellison, Hal Stern, John Beatty, Larry Abrahams, Mark Hapner, Peter Yared, Sai Allavarpu, Sheldon Finkelstein
• Inventors: Finkelstein, Sheldon, Beatty, John, Hapner, Mark, Ellison, Gary, Yared, Peter, Stern, Hal, Ranganathan, Aravindan, Abrahams, Larry, Allavarpu, Sai
• Granted Patent: US 8,037,194 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 61/4547 for personal communications, i.e. using a personal identifier
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A distributed network identity is provided. An identity provider stores a portion of a user'"'"'s personal information. A service provider accesses user information from one or more identity providers. System entities such as identity providers and service providers can be linked to enable information sharing and aggregation. User policies and privacy preferences are provided to control how information is shared. A single sign-on architecture is provided where an identity provider is used to facilitate cross-domain authentication and to enhance user convenience. Service delegation features are also provided.

Claims

1. A method for providing user authentication to a service provider, the method comprising:

receiving, at an identity provider, an identifier that indicates the service provider, wherein the identifier includes an assertion of an identity of a user;

requesting an identity credential from the user;

authenticating the identity credential to produce an authenticated credential; and

passing the authenticated credential to the service provider.

2. The method of claim 1 further comprising:

providing to the service provider user profile data.

3. The method of claim 2 wherein at least one of the receiving, requesting, authenticating, and passing is performed using web services.

4. The method of claim 1 wherein the identity credential comprises a username and a password.

5. The method of claim 1 wherein the identity credential comprises a certificate.

6. The method of claim 1 wherein the authenticated credential comprises a transient token.

7. The method of claim 1 further comprising:

passing an identity provider preference to a common domain, wherein the identity provider preference facilitates selection of the identity provider for authenticating the user.

8. A method for delegating a service, the method comprising:

authenticating a user with an identity provider;

requesting, by a first service provider a ticket from the identity provider for the delegated service, wherein the delegated service is performed by a second service provider;

receiving the ticket at the first service provider, the ticket for authorizing the second service provider to perform the delegated service on behalf of the user; and

presenting the ticket at the second service provider to use the delegated service.

9. The method of claim 8 wherein the ticket comprises a transient token.

10. The method of claim 8 wherein the ticket is encrypted with a key corresponding to the service provider.

11. The method of claim 8 wherein the delegated service is a payment service.