Method and system for user-determined attribute storage in a federated environment

• US 8,122,138 B2
• Filed: 07/22/2010
• Issued: 02/21/2012
• Est. Priority Date: 12/31/2002
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Blakley, George Robert III, Hinton, Heather Maria, Pfitzmann, Birgit Monika
• Primary Examiner(s): SHAW, PELING ANDREW
• Application Number:
  US12/841,207
• Publication Number:
  US 20100287235A1
• Time in Patent Office: 579 Days
• Field of Search: 709/225, 709/227, 709/229, 705/53, 705 64- 67, 705 75- 76, 705 78- 79
• US Class Current: 709/229
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system is presented for facilitating management of user attribute information at one or more attribute information providers (AIPs), which can manage the user'"'"'s attribute information in accordance with user-selected or administratively-determined options, including options that are stored in attribute release policies and/or dynamically determined during a transaction. E-commerce service providers (ECSPs), such as online banks or merchants, also maintain a relationship with an AIP such that the ECSP can trust the user attribute information that is provided by the AIP on behalf of the user. The user can complete transactions that require user attribute information at any ECSP without having to have previously established a relationship with that particular ECSP. If the ECSP has a relationship with one of the user'"'"'s AIPs, then the user will be able to direct the ECSP to an AIP when the ECSP needs user attribute information to complete a transaction for the user.

Claims

1. A method for managing user information within a data processing system, the method comprising:

at a service provider, receiving from a client a request for a resource;

selecting a set of one or more identifiers of attribute information providers in response to a determination that the service provider does not have a set of one or more identifiers of attribute information providers that was previously associated with the client or a user of the client, wherein each of the attribute information providers is a provider that maintains user attribute information for the user; and

sending, from the service provider to a user-specified attribute information provider, an attribute information retrieval request message.

2. The method of claim 1 further comprising:

providing a user option to choose whether to persistently associate the user with the selection of the set of one or more identifiers of attribute information providers.

3. The method of claim 2 further comprising:

enrolling the selection of the set of one or more identifiers of attribute information providers at the service provider.

4. The method of claim 2 further comprising:

storing the set of one or more identifiers of attribute information providers in a persistent token at the client.

5. The method of claim 2 further comprising:

storing the set of one or more identifiers of attribute information providers in a client-side information repository.

6. The method of claim 1 further comprising:

receiving the set of one or more identifiers of attribute information providers as input from the user.

7. The method of claim 1 further comprising:

retrieving the set of one or more identifiers of attribute information providers from administratively configured information.

8. The method of claim 1 further comprising:

providing a user option to choose whether to establish a relationship with an attribute information provider in the set of one or more identifiers of attribute information providers.

9. An apparatus for managing user information, the apparatus comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method, comprising;

at a service provider, receiving from a client a request for a resource;

selecting a set of one or more identifiers of attribute information providers in response to a determination that the service provider does not have a set of one or more identifiers of attribute information providers that was previously associated with the client or a user of the client, wherein each of the attribute information providers is a provider that maintains user attribute information for the user; and

sending, from the service provider to a user-specified attribute information provider, an attribute information retrieval request message.

10. The apparatus of claim 9 wherein the method further comprises:

providing a user option to choose whether to persistently associate the user with the selection of the set of one or more identifiers of attribute information providers.

11. The apparatus of claim 10 wherein the method further comprises:

enrolling the selection of the set of one or more identifiers of attribute information providers at the service provider.

12. The apparatus of claim 10 wherein the method further comprises:

storing the set of one or more identifiers of attribute information providers in a persistent token at the client.

13. The apparatus of claim 10 wherein the method further comprises:

storing the set of one or more identifiers of attribute information providers in a client-side information repository.

14. The apparatus of claim 9 wherein the method further comprises:

receiving the set of one or more identifiers of attribute information providers as input from the user.

15. The apparatus of claim 9 wherein the method further comprises:

retrieving the set of one or more identifiers of attribute information providers from administratively configured information.

16. The apparatus of claim 9 wherein the method further comprises:

providing a user option to choose whether to establish a relationship with an attribute information provider in the set of one or more identifiers of attribute information providers.

17. A computer program product in a computer readable medium for managing user information in a data processing system, the computer program product holding computer program instructions which when executed by the data processing system perform a method comprising:

at a service provider, receiving from a client a request for a resource;

selecting a set of one or more identifiers of attribute information providers in response to a determination that the service provider does not have a set of one or more identifiers of attribute information providers that was previously associated with the client or a user of the client, wherein each of the attribute information providers is a provider that maintains user attribute information for the user; and

sending, from the service provider to a user-specified attribute information provider, an attribute information retrieval request message.

18. The computer program product of claim 17 wherein the method further comprises:

providing a user option to choose whether to persistently associate the user with the selection of the set of one or more identifiers of attribute information providers.

19. The computer program product of claim 18 wherein the method further comprises:

enrolling the selection of the set of one or more identifiers of attribute information providers at the service provider.

20. The computer program product of claim 18 wherein the method further comprises:

storing the set of one or more identifiers of attribute information providers in a persistent token at the client.

21. The computer program product of claim 18 wherein the method further comprises:

storing the set of one or more identifiers of attribute information providers in a client-side information repository.

22. The computer program product of claim 17 wherein the method further comprises:

receiving the set of one or more identifiers of attribute information providers as input from the user.

23. The computer program product of claim 17 wherein the method further comprises:

retrieving the set of one or more identifiers of attribute information providers from administratively configured information.

24. The computer program product of claim 17 wherein the method further comprises:

providing a user option to choose whether to establish a relationship with an attribute information provider in the set of one or more identifiers of attribute information providers.