Managing digital identity information

• US 7,680,819 B1
• Filed: 09/27/2000
• Issued: 03/16/2010
• Est. Priority Date: 11/12/1999
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Nazeer, Nadeem Ahmad, Robertson, John M., Carter, Stephen R., Sabin, Jeffrey Neil, Earl, Douglas G., Perkins, Arn D., Young, Russell T., Sonderegger, Kelly E., Brough, Farrell Lynn, Phillips, Douglas, Sheridan, Robert Michael, Ferguson, Daniel T., Mellmer, Joseph Andrew, Higley, DeeAnne Barker, McDonald, Michael C.
• Primary Examiner(s): Woo; Isaac M
• Application Number:
  US09/670,783
• Time in Patent Office: 3,457 Days
• Field of Search: 707 1- 10, 707100-1041, 707200-206, 709204-237, 713182-194
• US Class Current: 707/783
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A basic architecture for managing digital identity information in a network such as the World Wide Web is provided. A user of the architecture can organize his or her information into one or more profiles which reflect the nature of different relationships between the user and other entities, and grant or deny each entity access to a given profile. Various enhancements which may be provided through the architecture are also described, including tools for filtering email, controlling access to user web pages, locating other users and making one'"'"'s own location known, browsing or mailing anonymously, filling in web forms automatically with information already provided once by hand, logging in automatically, securely logging in to multiple sites with a single password and doing so from any machine on the network, and other enhancements.

Claims

1. A computer server system for managing digital identity information, comprising at least one processor in operable connection with a memory configured by a database, the database including a vault for storage of multiple user objects for multiple users, the vault having access rights granted to a system administrator for management of the multiple user objects, each of the user objects having a corresponding safe object, the safe object containing multiple different profiles accessed and administered exclusively by a single one of the multiple users at the exclusion of the system administrator, each profile including digital identity information provided by the single one of the multiple users and operable to be shared with other of the multiple users having other multiple different profiles accessible and administered exclusively by the other of the multiple users, the sharing occurring exclusively upon initiation by the single one of the multiple users.

2. The system of claim 1, wherein the safe object also contains at least one user-administered contact, each contact representing an entity outside the user'"'"'s safe which receives controlled read access to digital identity information from at least one of the profiles.

3. The system of claim 1, wherein the safe object also contains at least one drop box object.

4. The system of claim 1, wherein the safe object also contains at least one application object with settings for an application.

5. The system of claim 1, wherein the safe object also contains at least one view object.

6. The system of claim 1, wherein the safe object also contains at least one access object.

7. The system of claim 1, wherein the system comprises a web server and an identity server.

8. The system of claim 7, wherein the web server and the identity server communicate using encrypted usernames.

9. The system of claim 7, wherein the web server and the identity server are secured by a firewall.

10. The system of claim 1, wherein the system comprises an identity server appliance.

11. The system of claim 1, further comprising a zero-byte client.

12. The system of claim 1, further comprising an installed client.

13. The system of claim 1, wherein the system comprises a provider model for access to the database, and the provider model abstracts the details of a particular directory and storage protocol.

14. The system of claim 1, wherein the system comprises an abstract model for access to the database, and the abstract model offers a hierarchical storage system in a representation that includes a user, a container, and data.

15. The system of claim 1, wherein the system comprises a programmatic interface to identity items and operations that correspond generally to directory service objects.

16. The system of claim 1, wherein the database includes multiple safe objects contained in a vault object.

17. The system of claim 16, wherein the system includes at least two vault objects hosted on different servers, each vault object contains at least one user safe object, and objects contained by the safe objects are federated to provide controlled access between the vault servers.

18. The system of claim 17, wherein the objects are federated using a Universal Resource Identifier which specifies at least a protocol, a host, a path, and an object.

19. The system of claim 1, further comprising a digital business card application object having a corresponding profile object which includes digital identity information provided by the single one of the multiple users.

20. The system of claim 1, wherein the system comprises a means for one user to receive updated profile information of another user using a link to the database.

21. The system of claim 1, wherein the database is a partitioned directory services database.

22. The system of claim 1, wherein the system is further characterized in that it provides an account creation service which creates a new account for a user based on a template.

23. The system of claim 1, wherein the system is further characterized in that it provides a safe management service which provides an administrative tool to manage and maintain safe objects.

24. The system of claim 1, wherein the system is further characterized in that it provides a schema management service which permits the system administrator to at least view a directory service schema.

25. The system of claim 1, wherein the system is further characterized in that it provides a batch account creation service which creates several accounts at one time.

26. The system of claim 1, wherein the system is further characterized in that it provides an install service which permits one to install and configure an identity server.

27. The system of claim 1, wherein the system is further characterized in that it provides a backup and restore service which allows one to backup and restore at least one safe object.

28. The system of claim 1, wherein the system is further characterized in that it provides a safe advisor service which allows one to verify the integrity of a safe object.

29. The system of claim 1, wherein the system is further characterized in that it provides a legal recovery tool which recovers digital identity information for forensic use.

30. The system of claim 1, wherein the system is further characterized in that it provides a data denormalization service which facilitates data transformation on database fields.

31. The system of claim 1, wherein the system is further characterized in that it provides a rules service.

32. The system of claim 1, wherein the system is further characterized in that it provides an event service which allows an identity server to register interest in and be notified of changes in the database.

33. The system of claim 1, wherein the system is further characterized in that it provides an identity verification service which allows one to verify the identity of a user based on registration information.

34. The system of claim 1, wherein the system is further characterized in that it provides an authorization service which allows a process to verify information gathered from a user registration form.

35. The system of claim 1, wherein the system is further characterized in that it provides a profile discovery and publishing service which allows users to publish at least a portion of their profile information.

36. The system of claim 1, wherein the system is further characterized in that it provides a form fill-in service which allows a user to have the service fill in at least part of an online form with information from one of the user'"'"'s profile objects.

37. The system of claim 1, wherein the system is further characterized in that it provides a form conversion service which assists a webmaster in converting existing forms to standardized field names.

38. The system of claim 1, wherein the system is further characterized in that it provides an install service which installs servlets on a web server.

39. The system of claim 1, wherein the system is further characterized in that it provides an identity exchange service for portions of a privacy protection protocol.

40. The system of claim 1, wherein the system is further characterized in that it provides a chat service which sets up chat rooms so users can communicate with each other in real time.

41. The system of claim 1, wherein the system is further characterized in that it provides a presence service which lets users specify where they are and allows them to discover another user'"'"'s presence information.

42. The system of claim 1, wherein the system is further characterized in that it provides an anonymous remailer service which allows users to choose different email addresses for different profiles.

43. The system of claim 1, wherein the system is further characterized in that it provides an anonymous browsing service which allows a user to browse a network in an anonymous fashion to prevent sites from collecting user identity information.

44. The system of claim 1, wherein the system is further characterized in that it provides an infomediary service which facilitates creating an infomediary.

45. The system of claim 1, wherein the system is further characterized in that it uses profile objects and software for tracking IP addresses in order to selectively publish the last known IP address of a user.

46. The system of claim 1, wherein the system is further characterized in that it uses profile objects and at least one of an underlying directory service and an underlying file system in order to enforce access controls on web pages published by users.

47. The system of claim 1, wherein the system is further characterized in that it provides email services.

48. The system of claim 47, wherein the single one of the multiple users has an email address, and the system encodes contact relationship information in the email address.

49. The system of claim 47, wherein the system uses profiles to filter email sent to the single one of the multiple users.

50. The system of claim 1, further comprising a means for determining whether a user logging in at a third party web site is registered as a user of the system.

51. The system of claim 50, further comprising a means for logging the user into the system if the user is registered, and a means for registering the user and logging the user in if the user was not registered.

52. The system of claim 51, wherein the means for registering the user and logging the user in comprises a means for capturing user login information for the third party web site.

53. The system of claim 1, wherein the system is further characterized in that user digital identity information is only made available to a partner site if the user has flagged the information as public.

54. The system of claim 1, wherein the system is further characterized in that it uses an embossed icon which provides a transaction history.

55. The system of claim 1, wherein the system is further characterized in that it uses an embossed icon which provides a user authentication mechanism.

56. The system of claim 1, wherein the system is further characterized in that it uses an embossed icon which provides a launch point for launching application programs.

57. The system of claim 1, wherein the system is further characterized in that it uses a non-repudiation feature whereby the system administrator cannot change a user password and then log on as the user.

58. A computer server system for managing digital identity information, comprising one or more processors in operable connection with one or more memories defining a vault for storage of one or more safes of digital identities, the vault including an access protocol layer, an identity server layer and an identity manager layer and having access rights granted to one or more system administrators including management of the one or more safes of digital identities of one or more accounts of end users, the one or more safes of digital identities having multiple profiles each with access rights granted exclusively to the end users via the one or more accounts including the exclusion of access rights of the one or more system administrators, the multiple profiles being shared amongst the end users at the exclusion of the one or more system administrators.

59. The system of claim 58, wherein the access protocol layer includes one or more protocols selected from LDAP, XML, RPC-over-HTTP, XDAP or SMTP.

60. The system of claim 58, wherein the identity server layer serves as an NDS access point.

61. The system of claim 58, wherein the identity server layer maintains access rights to the digital identities.

62. The system of claim 58, wherein the identity manager layer includes NDS authentication and authorization that controls access to the digital identities.

63. The system of claim 58, wherein the identity manager layer has a secret store.

64. The system of claim 58, wherein the one or more processors and the one or more memories are located on an identity server.

65. The system of claim 58, wherein the one or more processors and the one or more memories are functionally apportioned between a client, a web server and an identity server, including servlets and applets.

66. A configured computer-readable storage medium that manages digital identities, comprising a vault for secure storage of one or more safes of digital identity profiles, the vault having an access protocol layer, an identity server layer and an identity manager layer and having access rights granted to a system administrator for management of the safes of digital identity profiles, the one or more safes of digital identity profiles having access rights granted exclusively to one or more end users at locations remote from the vault, the one or more safes of digital identity profiles further including multiple profiles shared amongst the end users at the exclusion of the system administrator.

67. The configured storage medium of claim 66, further including a zero-byte client interface.

68. The configured storage medium of claim 66, further including a client application interface.

69. The configured storage medium of claim 66, further including a database including a user object and a corresponding safe object, the safe object containing at least one profile of the digital identity profiles.