Privacy and identification in a data communications network

• US 7,496,751 B2
• Filed: 10/29/2001
• Issued: 02/24/2009
• Est. Priority Date: 10/29/2001
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: de Jong, Eduard K., Leung, Albert Y., Levy, Moshe
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Fields; Courtney D
• Application Number:
  US10/040,293
• Publication Number:
  US 20030084288A1
• Time in Patent Office: 2,675 Days
• Field of Search: 713/202, 713/182, 713/184, 713/155, 713/193, 709/229, 380/255, 726/8, 726/5, 726/7, 726/9, 726/19, 726/20
• US Class Current: 713/155
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A method for managing identification in a data communications network includes receiving a user-controlled secure storage device and enrolling the user with an authority network site. The enrolling includes providing information requested by the authority network site. The method also includes receiving user data in response to the enrolling, storing the user data in the user-controlled secure storage device, enabling the user-controlled secure storage device to release the user data and using the user data at a service provider network site to obtain a service.

Claims

1. A method for managing identification in a data communications network, the method comprising:

receiving a portable user-controlled secure storage device;

enrolling a user of said portable user-controlled secure storage device with an authority network site, said enrolling comprising providing information requested by said authority network site;

receiving user data in response to said enrolling;

storing said user data in said portable user-controlled secure storage device;

enabling said portable user-controlled secure storage device to release said user data; and

using said user data, from said portable user-controlled secure storage device, at a service provider network site to obtain a service.

2. A method for managing identification in a data communications network, the method comprising:

receiving a portable user-controlled secure storage device;

enrolling a user of said portable user-controlled secure storage device with an authority network site, said enrolling comprising providing information requested by said authority network site;

receiving user data in response to said enrolling, said user data comprising a first portion and a second portion, said first portion comprising a cryptogram computed based on said second portion;

storing said user data in said portable user-controlled secure storage device;

enabling said portable user-controlled secure storage device to release said user data; and

using said user data, from said portable user-controlled secure storage, at a service provider network site to obtain a service.

3. A method for managing identification in a data communications network, the method comprising:

presenting an identity credential request and data to be stored to a federated identity server via a client host;

receiving an identity credential in response to said identity credential request, said identity credential comprising a randomized ID and an identification authority ID, said federated identity server capable of verifying the truthfulness, accuracy and completeness of said data to be stored;

presenting a service request and said identity credential to a service portal, said service portal configured to issue an authentication request to said federated identity server;

receiving a logon credential in response to said service request, said login credential comprising an indication of the client host used by the user; and

using said logon credential to obtain a service from a service provider accessible via said service portal.

4. A computer program storage device including a tangible computer readable media having embodied therein a program of instructions executable by a processor to perform a method for managing identification in a data communications network, the method comprising:

receiving a portable user-controlled secure storage device;

enrolling a user of said portable user-controlled secure storage device with an authority network site, said enrolling comprising providing information requested by said authority network site;

receiving user data in response to said enrolling;

storing said user data in said portable user-controlled secure storage device;

enabling said portable user-controlled secure storage device to release said user data; and

using said user data, from said portable user-controlled secure storage device, at a service provider network site to obtain a service.

5. A computer program storage device including a tangible computer readable media having embodied therein a program of instructions executable by a processor to perform a method for managing identification in a data communications network, the method comprising:

receiving a portable user-controlled secure storage device;

enrolling a user of said portable user-controlled secure storage device with an authority network site, said enrolling comprising providing information requested by said authority network site;

receiving user data in response to said enrolling, said user data comprising a first portion and a second portion, said first portion comprising a cryptogram computed based on said second portion;

storing said user data in said portable user-controlled secure storage device;

enabling said portable user-controlled secure storage device to release said user data; and

using said user data, from said portable user-controlled secure storage device, at a service provider network site to obtain a service.

6. A computer program storage device including a tangible computer readable media having embodied therein a program of instructions executable by a processor to perform a method for managing identification in a data communications network, the method comprising:

presenting an identity credential request and data to be stored to a federated identity server via a client host;

receiving an identity credential in response to said identity credential request, said identity credential comprising a randomized ID and an identification authority ID, said federated identity server capable of verifying the truthfulness, accuracy and completeness of said data to be stored;

presenting a service request and said identity credential to a service portal, said service portal configured to issue an authentication request to said federated identity server;

receiving a logon credential in response to said service request, said login credential comprising an indication of the client host used by the user; and

using said logon credential to obtain a service from a service provider accessible via said service portal.

7. An apparatus for managing identification in a data communications network, the apparatus comprising:

means for receiving a portable user-controlled secure storage device;

means for enrolling a user of said portable user-controlled secure storage device with an authority network site, said enrolling comprising providing information requested by said authority network site;

means for receiving user data in response to said enrolling;

means for storing said user data in said portable user-controlled secure storage device;

means for enabling said portable user-controlled secure storage device to release said user data; and

means for using said user data, from said portable user-controlled secure storage device, at a service provider network site to obtain a service.

8. An apparatus for managing identification in a data communications network, the apparatus comprising:

means for receiving a portable user-controlled secure storage device;

means for enrolling a user of said portable user-controlled secure storage device with an authority network site, said enrolling comprising providing information requested by said authority network site;

means for receiving user data in response to said enrolling, said user data comprising a first portion and a second portion, said first portion comprising a cryptogram computed based on said second portion;

means for storing said user data in said portable user-controlled secure storage device;

means for enabling said portable user-controlled secure storage device to release said user data; and

means for using said user data, from said portable user-controlled secure storage device, at a service provider network site to obtain a service.

9. An apparatus for managing identification in a data communications network, the apparatus comprising:

means for presenting an identity credential request and data to be stored to a federated identity server via a client host;

means for receiving an identity credential in response to said identity credential request, said identity credential comprising a randomized ID and an identification authority ID, said federated identity server capable of verifying the truthfulness, accuracy and completeness of said data to be stored;

means for presenting a service request and said identity credential to a service portal, said service portal configured to issue an authentication request to said federated identity server;

means for receiving a logon credential in response to said service request, said login credential comprising an indication of the client host used by the user; and

means for using said logon credential to obtain a service from a service provider accessible via said service portal.