SELECTIVELY PROVISIONING CLIENTS WITH DIGITAL IDENTITY REPRESENTATIONS

• US 20090217362A1
• Filed: 04/29/2009
• Published: 08/27/2009
• Est. Priority Date: 01/18/2007
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Chikkamagalur, Raman, Melzer, Oren, Guberman, Dan, Gajjala, Vijay K., Nanda, Arun K., Wilson, Hervey
• Application Number:
  US12/432,606
• Publication Number:
  US 20090217362A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 69/00 Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass networks security protocols H04L9/40; wireless communication networks H04W

Abstract

A server provisions a client with digital identity representations such as information cards. A provisioning request to the server includes filtering parameters. The server assembles a provisioning response containing cards that satisfy the filtering parameters, and transmits the response to a client, possibly by way of a proxy. The provisioning response may include provisioning state information to help a server determine in subsequent exchanges which cards are already present on the client. A client may keep track the source of information cards and discard cards which a server has discarded. A proxy may make the provisioning request on behalf of a client, providing the server with the proxy'"'"'s own authentication and with a copy of the request from the client to the proxy.

Claims

1. A method performed by a server for provisioning a client with at least one digital identity representation which represents aspects of a natural person'"'"'s identity, the method comprising the steps of the server:

receiving a provisioning request for digital identity representations, the provisioning request including at least one filtering parameter associated with at least one digital identity representation field;

automatically assembling a provisioning response containing at least one digital identity representation, wherein each digital identity representation in the provisioning response satisfies the filtering parameter(s) of the provisioning request; and

transmitting the provisioning response onto a computer network.

2. The method of claim 1, wherein the provisioning response also includes client provisioning state information for storage at the client, the provisioning state information including version indication(s) of the digital identity representation(s) of the provisioning response.

3. The method of claim 1, wherein the provisioning request also includes client provisioning state information.

4. The method of claim 1, wherein the provisioning response includes multiple digital identity representations in the form of multiple information cards.

5. The method of claim 1, wherein the assembling step includes placing at least one full copy of an information card in the provisioning response.

6. The method of claim 1, wherein the assembling step includes determining that a copy of an information card already present on the client is current, and placing a reference to that copy in the provisioning response instead of placing a full copy of the information card in the provisioning response.

7. The method of claim 1, wherein the provisioning request also includes a proxy identifier which identifies a proxy purporting to make the provisioning request on behalf of the client.

8. The method of claim 1, wherein at least one of the following is received as a filtering parameter:

an organizational role of the natural person, an account number of the natural person.

9. The method of claim 1, wherein the method further comprises:

the server receiving an indication that a proxy has accepted the client as authorized based on a client authorization basis; and

the server receiving a request to accept the proxy as authorized based on a proxy authorization basis.

10. The method of claim 9, wherein the client authorization basis comprises at least one of:

a password, a digital certificate; and

wherein the proxy authorization basis comprises a digital certificate.

11. A computer-readable medium configured with data and instructions for causing a client to perform a method for at least attempting to obtain at least one digital identity information card from at least one server, the method comprising the steps of the client:

creating a provisioning request for digital identity information cards, the provisioning request including at least one filtering parameter associated with at least one digital identity information card field representing an aspect of a natural person'"'"'s identity; and

sending the provisioning request on a computer network.

12. The configured medium of claim 11, further comprising the client receiving a provisioning response containing at least one digital identity information card which satisfies the filtering parameter(s) of the provisioning request.

13. The configured medium of claim 11, wherein the method further comprises the client:

automatically tracking origin location(s) of digital identity information card(s) received at the client;

automatically comparing a first set of digital identity information card(s) which were received from a particular origin location and which satisfy certain filtering parameter(s) to a second set of digital identity information card(s) which were received from the same origin location and which satisfy the same filtering parameter(s); and

automatically identifying digital identity information card(s) which belong to the first set but not the second set.

14. The configured medium of claim 13, further comprising the client discarding at least one digital identity information card which belongs to the first set but not the second set.

15. The configured medium of claim 11, further comprising the client receiving provisioning state information in response to the provisioning request, storing the provisioning state information, and then sending the provisioning state information with a subsequent provisioning request.

16. A computer system comprising:

server hardware including a logical processor and a memory in operable communication with the logical processor;

a collection of digital identity information cards configuring a portion of the memory and having associated version indication(s);

provisioning software configuring a portion of the memory, the provisioning software embodying code to perform at least the following steps;

automatically receive a provisioning request for digital identity information cards; and

automatically identify within the collection any digital identity information cards which satisfy filtering parameter(s) associated with digital identity information card field(s);

and

provisioning state information indicating a client and a set of the client'"'"'s digital identity information cards.

17. The system of claim 16, wherein the system further comprises a provisioning response containing at least one digital identity information card which satisfies at least one of the following filtering parameters:

an identification of an issuer of information cards, an organizational role of a natural person, an account number of a natural person.

18. The system of claim 16, wherein the system further comprises a client configured with software embodying code to perform at least the following steps:

automatically track origin location of digital identity information cards received at the client;

automatically compare a first set of digital identity information card(s) which were received from a particular origin location and which satisfy certain filtering parameter(s) to a second set of digital identity information card(s) which were received from the same origin location and which satisfy the same filtering parameter(s);

automatically identify digital identity information card(s) which belong to the first set but not the second set, and

automatically discard each digital identity information card which belongs to the first set but not the second set.

19. The system of claim 16, wherein the system further comprises a proxy configured with a client-proxy provisioning request for digital identity information cards.

20. The system of claim 19, wherein the server hardware is inside a firewall, the client is outside the firewall, and the server memory is also configured with a client authorization basis for authenticating the client to the proxy and with a proxy authorization basis for authenticating the proxy to the server.