PROVISIONING OF DIGITAL IDENTITY REPRESENTATIONS

• US 20080178272A1
• Filed: 09/17/2007
• Published: 07/24/2008
• Est. Priority Date: 01/18/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Raj, Rashmi, Del Conte, Derek T., Kwan, Stuart L.S., Gajjala, Vijay K., Nanda, Arun K., Brace, Colin H., Nori, Vijayavani
• Granted Patent: US 8,407,767 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A system and method for provisioning digital identity representations (“DIRs”) uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. Various methods are provided for creating new DIRs, requesting DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.

Claims

1. A method for provisioning a digital identity representation for a principal, comprising the steps of:

receiving a request through a first channel to create the digital identity representation for the principal;

issuing a notification through a second channel that the digital identity representation has been requested;

receiving approval for the digital identity representation to be created;

creating the digital identity representation.

2. The method of claim 1, wherein the notification is an electronic message sent to a known address for the principal.

3. The method of claim 1, wherein the notification is an electronic message sent to a third party.

4. The method of claim 1, wherein the notification includes an electronic link to facilitate the approval.

5. The method of claim 1, wherein the first channel is an HTTP request and the second channel is an email.

6. The method of claim 1, further comprising the steps of:

receiving a second request through the first channel to create a second digital identity representation for the principal;

issuing a second notification through the second channel that the second digital identity representation has been requested;

receiving a denial of approval for the digital identity representation to be created;

sending an electronic message to a third party that the denial of approval has been received.

13. The method of claim 1, wherein the step of issuing the notification comprises sending a message to at least one application running on a principal machine that is associated with at least one of the principals in the group of principals.

14. The method of claim 13, wherein the request is created by the at least one application automatically, without prompting by the at least one principal.

7. A method for provisioning one or more digital identity representations for a principal, comprising the steps of:

issuing a notification that the one or more digital identity representations are available for the principal;

receiving a request to create the one or more digital identity representations;

creating the one or more digital identity representations.

8. The method of claim 7, wherein the notification includes a link to an electronic site to enable creation of the request.

9. The method of claim 7, further comprising the step of:

capturing data regarding the principal;

wherein the step of issuing is automatically performed following the step of capturing.

10. The method of claim 7, wherein the notification is issued to a third party.

11. The method of claim 7, further comprising the step of:

creating a digital identity representation descriptor;

wherein the step of issuing a notification is automatically performed following the step of creating.

12. The method of claim 7, wherein the principal is a member of a group of principals, further comprising the step of:

setting a policy that the group of principals are permitted access to the digital identity representation;

wherein the step of issuing the notification comprises issuing the notification to the group of principals.

15. The method of claim 7, further comprising the steps of:

cryptographically protecting the one or more digital identity representations;

sending the one or more cryptographically protected digital identity representations to a principal machine.

16. A method for provisioning a digital identity representation for a principal, comprising the steps of:

polling a digital identity representation generation system to determine whether any new digital identity representations are available to the principal;

receiving a notification that a first new digital identity representation is available to the principal;

requesting that the first new digital identity representation be created;

receiving the first new digital identity representation.

17. The method of claim 16, wherein the step of polling is performed automatically and periodically by a principal machine.

18. The method of claim 16, further comprising the step of:

after receiving the notification, alerting the principal that the digital identity representation is available.

19. The method of claim 18, wherein the step of issuing a notification comprises causing a pop-up notice to appear on a user interface of a principal machine.

20. The method of claim 18, wherein the step of alerting includes providing the principal an option to be reminded later to cause the requesting step to be performed.