Portable personal identity information

• US 8,078,880 B2
• Filed: 07/28/2006
• Issued: 12/13/2011
• Est. Priority Date: 07/28/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Nanda, Arun K., Bhargava, Ruchita, Melton, Lucas R.
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US11/495,826
• Publication Number:
  US 20080028215A1
• Time in Patent Office: 1,964 Days
• Field of Search: 713/168, 713182-186, 713/175, 726 4- 21, 709/203
• US Class Current: 713/182
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A user interacts with a client containing personal identity information operable to identify the user to a relying party when the relying party is presented with claims comprising a portion of the personal identity information. The personal identity information includes one or more claims, metadata associated with the one or more claims, and backing data associated with the one or more claims. The user may initiate use of another client and seek to be identified by the relying party while interacting with the other client by first porting the personal identity information to the other client. Porting the personal identity information includes binding the personal identity information and sending the bound personal identity information to a receiving client.

Claims

1. A computer-implemented method for porting personal identity information of a principal from a first client to a second client, comprising:

receiving selection of the first client;

requesting identification of the principal by a relying party by providing personal identity information located on the first client to the relying party, wherein the personal identity information comprises a) one or more claims, b) metadata associated with the one or more claims, and c) backing data associated with the one or more claims;

receiving selection of the second client;

binding, by a processor, the personal identity information located on the first client, wherein the binding ties together the one or more claims, metadata, and backing data;

sending, by the processor, the bound personal identity information to the second client, wherein the sending the bound personal identity information comprises transmitting a copy of the bound personal identity information to the second client; and

deleting the bound personal identity information on the first client after sending the bound personal identity information to the second client.

2. The computer-implemented method of claim 1, wherein the binding of the personal identity information occurs in response to a received user-action.

3. The computer-implemented method of claim 1, wherein:

the binding the personal identity information further comprises binding the personal identity information together with a container; and

wherein the sending the bound personal identity information further includes sending the container.

4. The computer-implemented method of claim 3, wherein the binding further comprises incorporating the personal identity information into the container.

5. The computer-implemented method of claim 1, further comprising encrypting the personal identity information prior to sending.

6. The computer-implemented method of claim 5, wherein encrypting the personal identity information further comprises encrypting the bound personal identity information.

7. The computer-implemented method of claim 1, further comprising standardizing the personal identity information prior to sending.

8. The computer-implemented method of claim 1, further comprising after sending the bound personal identity information, marking the personal identity information as sent.

9. A computer-implemented method for receiving ported personal identity information of a principal at a receiving client from an originating client, the method comprising:

receiving, at the receiving client, bound personal identity information from the originating client, wherein the bound personal identity information comprises a) one or more claims generated by an identity provider, b) metadata associated with the one or more claims, and c) backing data associated with the one or more claims, and wherein the one or more claims, metadata, and backing data are tied together, wherein the bound personal identity information received at the receiving client comprises a copy of the bound personal identity information located on the originating client;

unbinding, by a processor, the received bound personal identity information, wherein the unbinding extracts at least one claim from the bound personal identity information; and

requesting identification of the principal by a relying party, via the receiving client, by providing the extracted bound personal identity information to the relying party.

10. The computer-implemented method of claim 9, further comprising locally storing the received bound personal identity information.

11. The computer-implemented method of claim 9, further comprising upon receiving the bound personal identity information, signaling the originating client.

12. The computer-implemented method of claim 9, further comprising decrypting the bound personal identity information when encrypted.

13. The computer-implemented method of claim 9, further comprising localizing standardized personal identity information.

14. A computer-readable storage medium having encoded thereon computer-executable instructions that when executed perform a computer process for porting personal identification information of a principal from a first client to a second client, the computer process comprising:

receiving selection of the first client;

requesting identification of the principal by a relying party by providing personal identity information located on the first client to the relying party, wherein the personal identity information comprises a) one or more claims, wherein the one or more claims are generated by an identity provider, b) metadata associated with the one or more claims, and c) backing data associated with the one or more claims;

receiving selection of the second client;

binding the personal identity information located on the first client, wherein the binding ties together the one or more claims, metadata, and backing data;

sending the bound personal identity information to the second client, wherein the sending the bound personal identity information comprises transmitting a copy of the bound personal identity information to the second client; and

deleting the bound personal identity information on the first client after sending the bound personal identity information to the second client.

15. The computer-readable storage medium of claim 14, further comprising standardizing the personal identity information to be sent.

16. The computer-readable storage medium of claim 14, further comprising binding the personal identity information together with a container.

17. The computer-readable storage medium of claim 14, further comprising triggering the execution of the binding personal identity information together and sending the bound personal identity information together, in accord with a user action.