ISSUANCE PRIVACY

• US 20080086765A1
• Filed: 10/05/2006
• Published: 04/10/2008
• Est. Priority Date: 10/05/2006
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kaler, Christopher G., Dunn, Melissa W., Cannon, Darrell J.
• Application Number:
  US11/538,902
• Publication Number:
  US 20080086765A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Sending potentially sensitive information with privacy expectations. A method may be practiced, for example, in a computing environment. The method includes sending potentially sensitive information. Privacy expectation information is also sent specifying how the potentially sensitive information should be protected. The information and privacy expectation information may be included in an issued token, such that the privacy expectations can be later conveyed in a token exchange.

Claims

1. In a computing environment, a method of sending potentially sensitive information, the method comprising:

sending potentially sensitive information; and

sending privacy expectation information specifying how the potentially sensitive information should be protected.

2. The method of claim 1, wherein the method is practiced in a token request procedure.

3. The method of claim 2, further comprising receiving a token which includes the privacy expectation information.

4. The method of claim 3, wherein the token is an identity token for identifying an entity.

5. The method of claim 3, wherein the token is an authorization token to allow an entity to access functionality of a service.

6. The method of claim 3, wherein the token comprises an indication of entity specific information that should be echoed for requestors to verify when using the token.

7. The method of claim 1, wherein the method is practiced in an application messaging exchange.

8. The method of claim 1, wherein the privacy expectation information comprises one or more usage restrictions specifying how the potentially sensitive information is to be used.

9. The method of claim 1, wherein the privacy expectation information comprises purpose information specifying the purpose of sending potentially sensitive information.

10. The method of claim 1, wherein the privacy expectation information comprises confidentiality information specifying with whom the potentially sensitive information may be shared.

11. In a computing environment, a method of receiving potentially sensitive information, the method comprising:

receiving potentially sensitive information; and

receiving privacy expectation information specifying how the potentially sensitive information should be protected.

12. The method of claim 11, wherein the method is practiced in a token request procedure.

13. The method of claim 12, further comprising sending a token which includes the privacy expectation information.

14. The method of claim 13, wherein the token comprises an indication of entity specific information that should be echoed for requestors to verify when using the token.

15. The method of claim 11, wherein the method is practiced in an application messaging exchange.

16. The method of claim 11 wherein the privacy expectation information comprises one or more usage restrictions specifying how the potentially sensitive information is to be used.

17. The method of claim 11, wherein the privacy expectation information comprises purpose information specifying the purpose of sending potentially sensitive information.

18. The method of claim 11, wherein the privacy expectation information comprises confidentiality information specifying with whom the potentially sensitive information may be shared.

19. The method of claim 11, further comprising sending an indication specifying whether the privacy expectation information can be honored or not or if the privacy expectation information can be partially honored.

20. A computer readable medium having a data structure stored on the medium, the data structure being embodied in a security token, wherein the data structure comprises:

a first field, wherein the first filed comprises potentially sensitive information; and

a second field, wherein the second field comprises privacy expectation information specifying how the potentially sensitive information should be protected.