IDENTITY OWNERSHIP MIGRATION

• US 20090260072A1
• Filed: 04/14/2008
• Published: 10/15/2009
• Est. Priority Date: 04/14/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: AYRES, LYNN, SUNDELIN, TORE, FAULKNER, SARAH, FOTEDAR, MRIGANKKA, WONG, PUI-YIN WINFRED, GUO, WEI-QUIANG MICHAEL, ROUSKOV, YORDAN I.
• Granted Patent: US 8,726,358 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Systems, computer-implemented methods, and computer-readable media for establishing an online account with a resource provider are provided. An authentication token including identification of a user from an authentication server is received. The identification of the user from the authentication token is utilized to establish an online account for the user with the resource provider. Additional credentialing information from the user for the online account is received. The additional information received from the user is associated with the online account for the user with the resource provider.

Claims

1. A computer-implemented method for establishing a direct authentication relationship between a user and a resource provider, the method comprising:

receiving an authentication token including identification of a user from an authentication server;

utilizing data from the authentication token to establish a direct authentication relationship between the user and the resource provider; and

storing the direct authentication relationship between the user and the resource provider.

2. The method of claim 1, further comprising:

requesting credentialing information from the user for the direct authentication relationship.

3. The method of claim 1, wherein the direct authentication relationship between the user and the resource provider is an online account of the user with the resource provider.

4. The method of claim 1, wherein requesting additional information from the user comprises displaying a graphical user interface to the user for the entry of the user information when the user accesses one or more resources of the resource provider.

5. The method of claim 1, wherein requesting additional information from the user comprises communicating a graphical user interface to the user for the entry of user information to an electronic mail account of the user.

6. The method of claim 4, wherein the electronic mail account of the user is parsed from the authentication token received from the authentication provider.

7. The method of claim 1, wherein the direct authentication relationship between the user and the resource provider is established by confirming an already existing relationship between the user and the resource provider.

8. The method of claim 1, wherein the direct authentication relationship is established by creating a new account for the user with the resource provider.

9. The method of claim 3, wherein the authentication server and the resource provider exist in a federated relationship.

10. The method of claim 9, wherein the authentication server and the resource provider reside on different service ecosystems.

11. A computer-implemented method for associating an authenticated user and an existing account for a user with a resource provider, the method comprising:

receiving an authentication token including identification of a user from an authentication server;

requesting from the user whether the user has an existing online account with the resource provider;

associating the existing account of the user with the authenticated user; and

storing the association of the authenticated user and the existing account for the user.

12. The method of claim 11, wherein the authentication token is for authenticating a user with the resource provider.

13. The method of claim 11, further comprising:

requesting additional credentialing information from the user comprising displaying a graphical user interface to the user for the entry of the user information when the user accesses one or more resources of the resource provider.

14. The method of claim 13, further comprising:

requesting additional credentialing information from the user comprising communicating a graphical user interface to the user for the entry of user information to an electronic mail account of the user.

15. The method of claim 14, wherein the electronic mail account of the user is parsed from the authentication token received from the authentication provider.

16. The method of claim 11, wherein the authentication server and the resource provider exist in a federated relationship.

17. The method of claim 16, wherein the authentication server and the resource provider reside on different service ecosystems.

18. The method of claim 17, wherein the association of the authenticated user and the existing account for the user is stored such that the user can access an authenticated account and the existing account with the service provider at the same time.

19. One or more computer readable media having computer-executable instructions embodied thereon that, when executed perform a method for creating an online account for a user with a resource provider, the method comprising:

receiving at a resource provider an authentication token including identification of a user from an authentication server, the authentication server and the resource provider each residing on a different service ecosystem;

determining whether the user may access the one or more services provided by the resource provider based on the identification of the user carried in the authentication token;

utilizing data from the authentication token to establish an online account for the user with the resource provider;

storing the online account for the user with the resource provider;

20. The method of claim 19, further comprising:

requesting additional credentialing information from the user, the credentialing information comprising a password; and

storing the credentialing information and online account for the user with the resource provider.