Use of pseudonyms vs. real names

• US 7,107,447 B2
• Filed: 04/17/2003
• Issued: 09/12/2006
• Est. Priority Date: 04/17/2003
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Cahill, Conor P., Sanin, Aleksey
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US10/418,904
• Publication Number:
  US 20040210770A1
• Time in Patent Office: 1,244 Days
• Field of Search: 713/170, 713/180, 713/182, 713200-201, 709223-229
• US Class Current: 713/170
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

An apparatus and method is provided for allowing users to share services without sharing identities. Specifically, the apparatus and method allow users to share pseudonyms instead of actual user names, thus protecting both users from unwanted emails, IM messages, and the like. The invention provides an introduction scheme, which comprises a simple and secure way of establishing a user to user link. A preferred embodiment incorporates services of a linked federation network service, such as AOL'"'"'s Liberty Alliance service, without exposing real user names to other users.

Claims

1. An apparatus for sharing services without sharing identity informational data using pseudonyms, said apparatus comprising:

a first service associated with a first identity informational data and associated with a first pseudonym;

a second service associated with a second identity informational data and associated with a second pseudonym, wherein said second service desires to interact with said first service; and

an authentication mechanism for authenticating said second identity informational data for sharing of said first and second services, wherein at least one of said first service and said second service provides a Universal Resource Identity for an internet resource to said authentication mechanism.

2. The apparatus of claim 1, further comprising:

a second authentication mechanism for authenticating said first identity informational data for sharing of said first and second services;

wherein said first authentication mechanism and said second authentication mechanism are inside a circle of trust.

3. The apparatus of claim 2, wherein said first authentication mechanism and said second authentication mechanism are the same authentication mechanism.

4. The apparatus of claim 1, wherein said first service comprises:

a Universal Resource Identity (URI).

5. A method for sharing services without sharing identity informational data using pseudonyms, said method comprising the steps of:

providing a first service associated with a first identity informational data and associated with a first pseudonym;

providing a second service associated with a second identity informational data and associated with a second pseudonym, wherein said second service desires to interact with said first service; and

providing an authentication mechanism for authenticating said second identity informational data for sharing of said first and second services, wherein at least one of said first service and said second service provides a Universal Resource Identity for an internet resource to said authentication mechanism.

6. The method of claim 5, further comprising the steps of:

providing a second authentication mechanism for authenticating said first identity informational data for sharing of said first and second services;

wherein said first authentication mechanism and said second authentication mechanism are inside a circle of trust.

7. The method of claim 6, wherein said first authentication mechanism and said second authentication mechanism are the same authentication mechanism.

8. The method of claim 5, wherein said first service comprises:

a Universal Resource Identity (URI).

9. A method for a first service having identity information to obtain informational data from a second service without said second service having access to said identity information, said method comprising the steps of:

said first service providing identity information of said first service and providing location information of said second service to an authentication service,

said authentication service using said identity information and said location information of said second service for generating an associated access code for said first service; and

said authentication service verifying said associated access code when said first service desires to use said second service.

10. The method of claim 9, wherein said second service comprises:

a Universal Resource Identity (URI).

11. The method of claim 9, further comprising the step of:

federating said first service and said second service upon completion of said step of verifying.

12. An apparatus for a first service having identity information to obtain informational data from a second service without said second service having access to said identity information, said apparatus comprising:

means for said first service providing identity information of said first service and providing location information of said second service to an authentication service,

means for said authentication service using said identity information and said location information of said second service for generating an associated access code; and

means for said authentication service verifying said associated access code when said first service desires to use said second service.

13. The method of claim 12, wherein said location information of said second service comprises:

a Universal Resource Identity (URI).

14. The apparatus of claim 12, wherein said either said first service or said second service comprises any of:

a calendar service;

an address book; and

an instant messaging service.

15. The method of claim 12, further comprising the step of:

federating said first service and said second service upon successful completion of said step of verifying.

16. A method for a second service allowing access by a first service, said method comprising the steps of:

said second service obtaining an access code associated with said first service;

said second service storing said access code; and

said second service requesting an authentication service to verify said access code,

wherein said access code comprises location informational data of said first service and identity informational data of said second service,

wherein said authentication service has both an identity of said first service and said access code associated with said first service.

17. The method of claim 16, wherein said authentication service uses a Universal Resource Identity (URI).

18. An apparatus for a second service allowing access by a first service, said method comprising:

means for said second service obtaining an access code associated with said first service;

means for said second service storing said access code; and

means for said second service requesting an authentication service to verify said access code,

wherein said access code comprises location informational data of said first service and identity informational data of said second service,

wherein said either said first service or said second service comprises any of;

a calendar service;

an address book; and

an instant messaging service.

19. The apparatus of claim 18, wherein said authentication service uses a Universal Resource Identity (URI).

20. A method for a second service allowing access by a first service for sharing relevant data, said method comprising the steps of:

said second service having a name and a user coupled to said second service providing said name of said second service to a user coupled to said first service;

said user coupled to said first service submitting said name and a display name coupled to said second service to said first service;

said first service making a request to an authentication service to generate an access code for said first service to access said second service, wherein said first service provides as input to said authentication service identity information coupled to said first user and said name;

said authentication service returning to said first service said access code;

said first service storing said returned access code, storing said display name, and making said display name available to said first user,

said first user providing said access code to said second user;

said second user providing said access code to said second service for said second service to store said access code;

for using said second service, said user coupled to said first service selecting said display name stored on said first service;

said first service respondably submitting a service assertion, said first user identity information and said access code to said second service;

said second service requesting from said authentication service verification of said access code; and

if verified, said authentication service providing authentication information to said second service,

wherein said name is a Universal Resource Identity (URI).

21. The method of claim 20, wherein said step of providing said access code to said second user is by, but is not limited to, phone, mail, IM, and the like.

22. The method of claim 20, wherein said access code is stored on said second service in an access code list.

23. The method of claim 20, further comprising the step of:

said authentication service storing said name, said identity information, said access code, and any additional and related informational data in a table format.

24. The method of claim 20, wherein said access code is a random number.

25. The method of claim 20, further comprising the steps of:

said second service establishing a relation and relation identification data between said second service and said guest account;

said second service sending said relation identification data to said first service along with said relevant data; and

said first service storing said relation identification data for future use.

26. The method of claim 20, wherein said access code is formatted as:

<

unique IDP code>

<

unique ID inside IDP>

.

27. The method of claim 20, wherein if said second service verifies said access code, then said second service and said first service can communicate in any way possible.

28. The method of claim 20, further comprising the step of said authentication service providing additional information relevant to said first service.

29. An apparatus for a second service allowing access by a first service for sharing relevant data, said apparatus comprising:

means for said second service having a name and a user coupled to said second service providing said name of said second service to a user coupled to said first service;

means for said user coupled to said first service submitting said name and a display name coupled to said second service to said first service;

means for said first service making a request to an authentication service to generate an access code for said first service to access said second service, wherein said first service provides as input to said authentication service identity information coupled to said first user and said name;

means for said authentication service returning to said first service said access code;

means for said first service storing said returned access code, storing said display name, and making said display name available to said first user;

means for said first user providing said access code to said second user;

means for said second user providing said access code to said second service for said second service to store said access code;

for using said second service, means for said user coupled to said first service selecting said display name stored on said first service;

means for said first service respondably submitting a service assertion, said first user identity information and said access code to said second service;

means for said second service requesting from said authentication service verification of said access code; and

if verified, means for said authentication service providing authentication information to said second service,

wherein said name is a Universal Resource Identity (URI).

30. The apparatus of claim 29, wherein said means for providing said access code to said second user is by, but is not limited to, phone, mail, IM, and the like.

31. The apparatus of claim 29, wherein said access code is stored on said second service in an access code list.

32. The apparatus of claim 29, further comprising means for said authentication service storing said name, said identity information, said access code, and any additional and related informational data in a table format.

33. The apparatus of claim 29, wherein said access code is a random number.

34. The apparatus of claim 29, further comprising:

means for said second service establishing a relation and relation identification data between said second service and said guest account;

means for said second service sending said relation identification data to said first service along with said relevant data; and

means for said first service storing said relation identification data for future use.

35. The apparatus of claim 29, wherein said access code is formatted as:

<

unique IDP code>

<

unique ID inside IDP>

.

36. The apparatus of claim 29, wherein if said second service verifies said access code, then said second service and said first service can communicate in any way possible.

37. The apparatus of claim 29, further comprising means for said authentication service providing additional information relevant to said first service.

38. An apparatus for sharing services without sharing identity informational data using pseudonyms, said apparatus comprising:

a first service associated with a first identity informational data and associated with a first pseudonym;

a second service associated with a second identity informational data and associated with a second pseudonym, wherein said second service desires to interact with said first service; and

an authentication mechanism for authenticating said second identity informational data for sharing of said first and second services, wherein at least one of said first service and said second service comprises;

a Universal Resource Identity (URI).

39. A method for sharing services without sharing identity informational data using pseudonyms, said method comprising the steps of:

providing a first service associated with a first identity informational data and associated with a first pseudonym;

providing a second service associated with a second identity informational data and associated with a second pseudonym, wherein said second service desires to interact with said first service; and

providing an authentication mechanism for authenticating said second identity informational data for sharing of said first and second services, wherein said first identity informational data comprises;

a Universal Resource Identity (URI).