Using opaque groups in a federated identity management environment
First Claim
1. A method of promoting user anonymity within an electronic federated identity management system, the system comprising identity providers configured to authenticate users and service providers configured to provide services to the users, the method comprising operating a set of one or more computers to:
- create an opaque group at a first identity provider to include multiple users of the federated identity management system, wherein each user has a primary identity within the system, and wherein creating the opaque group comprises determining a secondary identity for each user that is a member of the opaque group;
store at the first identity provider an identity of the opaque group, wherein the identity references the primary identities of the member users;
receive at a first service provider a request to distribute an object to one or more members of the group;
forward the request from the service provider to an identity provider, wherein forwarding the request comprises forwarding the request along with the identity for the opaque group and the secondary identities for the one or more members; and
facilitate the provision of services by the service providers to members of the opaque group without allowing the service providers to know the primary identities of the members of the group.
2 Assignments
0 Petitions
Accused Products
Abstract
A system and method for using an opaque group within a federated identity management environment, to prevent disclosure of identities of the group. An opaque group is constructed at an identity provider within the system and has a group identity that references primary system identities of its members (e.g., electronic mail addresses, public key certificates, network addresses). Services to the group (e.g., distribution of an object such as a document or electronic mail message, invitation to an online meeting, authentication as a member of the group) can be requested from service providers, but because service providers do not have access to members'"'"' primary identities, the service providers forward the requests to an identity provider that has access to the group identity. That identity provider retrieves the members'"'"' identities and completes the action.
-
Citations
19 Claims
-
1. A method of promoting user anonymity within an electronic federated identity management system, the system comprising identity providers configured to authenticate users and service providers configured to provide services to the users, the method comprising operating a set of one or more computers to:
-
create an opaque group at a first identity provider to include multiple users of the federated identity management system, wherein each user has a primary identity within the system, and wherein creating the opaque group comprises determining a secondary identity for each user that is a member of the opaque group; store at the first identity provider an identity of the opaque group, wherein the identity references the primary identities of the member users; receive at a first service provider a request to distribute an object to one or more members of the group; forward the request from the service provider to an identity provider, wherein forwarding the request comprises forwarding the request along with the identity for the opaque group and the secondary identities for the one or more members; and facilitate the provision of services by the service providers to members of the opaque group without allowing the service providers to know the primary identities of the members of the group. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
-
12. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of promoting user anonymity within an electronic federated identity management system, the system comprising identity providers configured to authenticate users and service providers configured to provide services to the users, the method comprising:
-
creating an opaque group at a first identity provider to include multiple users of the federated identity management system, wherein each user has a primary identity within the system, and wherein creating the opaque group comprises determining a secondary identity for each user that is a member of the opaque group; storing at the first identity provider an identity of the opaque group, wherein the identity references the primary identities of the member users; receiving at a first service provider a request to distribute an object to one or more members of the group; forwarding the request from the service provider to an identity provider, wherein forwarding the request comprises forwarding the request along with the identity for the opaque group and the secondary identities for the one or more members; and facilitating the provision of services by the service providers to members of the opaque group without allowing the service providers to know the primary identities of the members of the group.
-
-
13. A computer-implemented method of enabling users within an electronic federated identity management system to access a resource of the system anonymously, the method comprising operating a set of computer processors to:
-
establish an identity of an opaque group at a first identity provider within the system; configure said group identity to include identities of members of the group, wherein configuring said group identity to include identities of members of the group comprises determining a secondary identity for each member of the group; and within the system, enable service providers to provide services to the group without knowledge of the identities of the members of the group, wherein said enabling comprises configuring the service providers to forward service requests for the group to an identity provider having access to said group identity, wherein forwarding the service requests comprises forwarding the service requests along with said group identity and the secondary identities for the one or more members, wherein the identity of each member is unknown to the service providers and to all other members of the group.
-
-
14. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of enabling users within an electronic federated identity management system to access a resource of the system anonymously, the method comprising:
-
establishing an identity of an opaque group at a first identity provider within the system; configuring said group identity to include identities of members of the group, wherein configuring said group identity to include identities of members of the group comprises determining a secondary identity for each member of the group; within the system, enabling service providers to provide services to the group without knowledge of the identities of the members of the group, wherein said enabling comprises configuring the service providers to forward service requests for the group to an identity provider having access to said group identity, wherein forwarding the service requests comprises forwarding the service requests along with said group identity and the secondary identities for the one or more members, wherein the identity of each member is unknown to the service providers and to all other members of the group.
-
-
15. A federated identity management system of multiple computer domains, in which an automated service is provided to a group of anonymous users of the multiple computer domains, the system comprising:
-
within each computer domain, at least one identity provider configured to authenticate users of the computer domain; at least one computer that performs operations for at least one service provider configured to; receive service requests from users of the system; and provide requested services to the users; and a group identity stored at a first identity provider and associated with an opaque group, wherein; said group comprises primary identities of members of the opaque group; said group identity comprises a secondary identity for each primary identity of members of the group; and said group identity and not the members'"'"' primary identities are releasable to service providers; wherein the at least one service provider is further configured to forward to the first identity provider requests to provide services to the group, wherein while forwarding the request from the at least one service provider to the first identity provider, the at least one service provider is configured to forward the request along with said group identity and the secondary identities for the one or more members. - View Dependent Claims (16, 17, 18, 19)
-
Specification