Digital Identity Management

• US 20140366108A1
• Filed: 08/25/2014
• Published: 12/11/2014
• Est. Priority Date: 02/13/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cross, David B., Thomlinson, Matthew W., Hallin, Philip J., Jones, Thomas C.
• Granted Patent: US 9,477,832 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Claims

1. (canceled)

2. An apparatus comprising:

a stand-alone computer, outside of a domain defined by a plurality of clients, the stand-alone computer including;

an application program configured to;

access a Digital Identity Management System (DIMS), the DIMS including an abstraction layer configured to abstract a digital ID associated with the application program as an abstracted digital ID, the trusted data being excluded from the abstracted digital ID provided from the application program;

search for credentials based on some attributes;

return results of the credential search to the DIMS, the DIMS being configured to open the credentials based on a cryptographic key and to return a handle to the application program; and

use the handle to perform an operation.

3. The apparatus of claim 2, wherein the application program is further configured to use the result of the operation to present the handle to a security token service (STS).

4. The apparatus of claim 3, wherein the application program is further configured to expand the result of the operation.

5. The apparatus of claim 2, wherein the application program is further configured to find the credentials based on some attributes, and the DIMS being configured to return the results to the application program within an Application Programming Interface (API).

6. The apparatus of claim 2, the DIMS being further configured to open the credentials based on the cryptographic key and to return the handle to the application program within an Application Programming Interface (API).

7. The apparatus of claim 2, the DIMS being further configured to view all credentials associated with the DIMS.

8. The apparatus of claim 2, the abstraction layer being further configured to provide common storage, retrieval, and management of the abstracted digital ID associated with the application program.

9. An apparatus, comprising:

an application program configured to;

access a Digital Identity Management System (DIMS), the DIMS including an abstraction layer configured to abstract a digital ID associated with the application program as an abstracted digital ID, the trusted data being excluded from the abstracted digital ID provided from the application program;

find credentials based on some attributes, the DIMS being configured to return results to the application program in response to finding credentials and

open at least some of the found credentials based on a cryptographic key.

10. The apparatus as set forth in claim 9, wherein:

the DIMS are further configured to return a handle to the application program; and

the application program is further configured to present the handle to a security token service (STS).

11. The apparatus of claim 9, configured to perform the operation of authentication.

12. The apparatus of claim 9, configured to perform the operations of digitally signing.

13. The apparatus of claim 9, configured to perform the operations of encryption.

14. The apparatus of claim 9, configured to perform the operations of decryption.

15. The apparatus of claim 9, the DIMS being further configured to find the credentials based on some attributes and to return the results to the application program within an Application Programming Interface.

16. The apparatus of claim 9, wherein the application program is further configured to open the credentials based on the cryptographic key and the DIMS being further configured to return the handle to the application program within an Application Programming Interface.

17. The apparatus of claim 9, wherein the application program is further configured to view those credentials associated with the DIMS.

18. The apparatus of claim 9, the abstraction layer being further configured to provide common storage, retrieval, and management of the abstracted digital ID associated with the application program.

19. An apparatus comprising:

a Digital Identity Management System (DIMS) including an abstraction layer configured to abstract a digital ID associated with an application program as an abstracted digital ID, the trusted data being excluded from the abstracted digital ID provided from the application program;

the DIMS being configured to return results in response to the application program finding credentials based at least on attributes and to open at least some of the credentials based on a cryptographic key.

20. The apparatus as set forth in claim 19, further comprising a stand-alone computer, outside of a domain defined by a plurality of clients.

21. The apparatus as set forth in claim 19, the abstraction layer being configured to provide common storage, retrieval, and management of the abstracted digital IDs associated with the application programs.