Method and system for user-determined attribute storage in a federated environment

• US 8,060,632 B2
• Filed: 07/22/2010
• Issued: 11/15/2011
• Est. Priority Date: 12/31/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pfitzmann, Birgit Monika, Blakley, George Robert III, Hinton, Heather Maria
• Primary Examiner(s): SHAW, PELING ANDREW
• Application Number:
  US12/841,197
• Publication Number:
  US 20100287291A1
• Time in Patent Office: 481 Days
• Field of Search: 709/225, 709/227, 709/229, 705/53, 705 64- 67, 705 75- 76, 705 78- 79
• US Class Current: 709/229
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system is presented for facilitating management of user attribute information at one or more attribute information providers (AIPs), which can manage the user'"'"'s attribute information in accordance with user-selected or administratively-determined options, including options that are stored in attribute release policies and/or dynamically determined during a transaction. E-commerce service providers (ECSPs), such as online banks or merchants, also maintain a relationship with an AIP such that the ECSP can trust the user attribute information that is provided by the AIP on behalf of the user. The user can complete transactions that require user attribute information at any ECSP without having to have previously established a relationship with that particular ECSP. If the ECSP has a relationship with one of the user'"'"'s AIPs, then the user will be able to direct the ECSP to an AIP when the ECSP needs user attribute information to complete a transaction for the user.

Claims

1. A method for managing user attribute information within a data processing system, the method comprising:

at a service provider, receiving from a user a request for a resource;

determining, by the service provider, a set of one or more attribute information providers that are associated with the user, wherein an attribute information provider is distinct from the service provider and comprises an attribute management machine and an associated database that maintains user attribute information for the user;

sending a request message from the service provider to a first attribute information provider in the set of one or more attribute information providers determined to be associated with the user in order to retrieve user attribute information to attempt to complete a transaction for the user;

receiving a response message from the first attribute information provider; and

determining that the response message comprises a control flag from the first attribute information provider, wherein the control flag indicates a retrieval condition on subsequent requests from the service provider to attribute information providers while retrieving user attribute information for the user.

2. The method of claim 1 further comprising:

halting retrievals for user attribute information for the user in accordance with the control flag.

3. The method of claim 1 further comprising:

performing subsequent retrievals for user attribute information for the user in accordance with the control flag.

4. The method of claim 1 further comprising:

performing a user-specific operation for the resource based on retrieved user attribute information for the user.

5. Apparatus for managing user attribute information, comprising:

a processor;

computer memory holding program instructions that when executed by the processor perform a method comprising;

at a service provider, receiving from a user a request for a resource;

determining, by the service provider, a set of one or more attribute information providers that are associated with the user, wherein an attribute information provider is distinct from the service provider and maintains user attribute information for the user;

sending a request message from the service provider to a first attribute information provider in the set of one or more attribute information providers determined to be associated with the user in order to retrieve user attribute information to attempt to complete a transaction for the user;

receiving a response message from the first attribute information provider; and

determining that the response message comprises a control flag from the first attribute information provider, wherein the control flag indicates a retrieval condition on subsequent requests from the service provider to attribute information providers while retrieving user attribute information for the user.

6. The apparatus of claim 5 wherein the method further comprises:

halting retrievals for user attribute information for the user in accordance with the control flag.

7. The apparatus of claim 5 wherein the method further comprises:

performing subsequent retrievals for user attribute information for the user in accordance with the control flag.

8. The apparatus of claim 5 wherein the method further comprises:

performing a user-specific operation for the resource based on retrieved user attribute information for the user.

9. A computer program product in a computer readable medium for managing user attribute information in a data processing system, the computer program product holding computer program instructions which when executed by the data processing system perform a method comprising:

at a service provider, receiving from a user a request for a resource;

determining, by the service provider, a set of one or more attribute information providers that are associated with the user, wherein an attribute information provider is distinct from the service provider and maintains user attribute information for the user;

sending a request message from the service provider to a first attribute information provider in the set of one or more attribute information providers determined to be associated with the user in order to retrieve user attribute information to attempt to complete a transaction for the user;

receiving a response message from the first attribute information provider; and

determining that the response message comprises a control flag from the first attribute information provider, wherein the control flag indicates a retrieval condition on subsequent requests from the service provider to attribute information providers while retrieving user attribute information for the user.

10. The computer program product of claim 9 wherein the method further comprises:

halting retrievals for user attribute information for the user in accordance with the control flag.

11. The computer program product of claim 9 wherein the method further comprises:

performing subsequent retrievals for user attribute information for the user in accordance with the control flag.

12. The computer program product of claim 9 wherein the method further comprises:

performing a user-specific operation for the resource based on retrieved user attribute information for the user.