Provisioning of digital identity representations

• US 8,407,767 B2
• Filed: 09/17/2007
• Issued: 03/26/2013
• Est. Priority Date: 01/18/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gajjala, Vijay K., Brace, Colin H., Del Conte, Derek T., Nanda, Arun K., Kwan, Stuart L. S., Raj, Rashmi, Nori, Vijayavani
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Durham, Imhotep
• Application Number:
  US11/856,636
• Publication Number:
  US 20080178272A1
• Time in Patent Office: 2,017 Days
• Field of Search: 726/6
• US Class Current: 726/5
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A system and method for provisioning digital identity representations (“DIRs”) uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. Various methods are provided for creating new DIRs, requesting DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.

Claims

1. A method for provisioning a digital identity representation for a principal, comprising the steps of:

receiving input defining a descriptor for the digital identity representation;

storing the descriptor;

receiving a request for the descriptor from the principal;

sending the descriptor to the principal;

receiving a selection of the descriptor;

in response to receiving a selection of the descriptor, receiving a request through a first channel to create the digital identity representation corresponding to the selected descriptor for the principal;

issuing a second notification through a second channel that the digital identity representation has been requested;

receiving approval for the digital identity representation to be created; and

creating the digital identity representation.

2. The method of claim 1, wherein the second notification is an electronic message sent to a known address for the principal.

3. The method of claim 1, wherein the second notification is an electronic message sent to a third party that is different from the principal.

4. The method of claim 1, wherein the second notification includes an electronic link to facilitate the approval.

5. The method of claim 1, wherein the first channel is an HTTP request and the second channel is an email.

6. The method of claim 1, further comprising the steps of:

receiving a second request through the first channel to create a second digital identity representation for the principal;

issuing a third notification through the second channel that the second digital identity representation has been requested;

receiving a denial of approval for the digital identity representation to be created;

sending an electronic message to a third party that the denial of approval has been received.

7. A method for provisioning a digital identity representation for a principal, comprising the steps of:

receiving input defining a descriptor for the digital identity representation;

storing the descriptor;

in response to storing the descriptor, automatically issuing a notification to the principal that the digital identity representation is available for the principal;

receiving a request to create the digital identity representation;

creating the digital identity representation, wherein the digital identity representation includes at least one authentication type requiring authentication to a digital identity representation generation system prior to accessing the digital identity representation; and

sending the digital identity representation to the principal.

8. The method of claim 7, wherein the notification includes a link to an electronic site to enable creation of the request.

9. The method of claim 7, further comprising the step of:

capturing data regarding the principal;

wherein the step of issuing is automatically performed following the step of capturing.

10. The method of claim 7, wherein the notification is issued to a third party.

11. The method of claim 7, wherein the principal is a member of a group of principals, further comprising the step of:

setting a policy that the group of principals is permitted access to the digital identity representation;

wherein the step of issuing the notification comprises issuing the notification to the group of principals.

12. The method of claim 11, wherein the step of issuing the notification comprises sending a message to at least one application running on a principal machine that is associated with at least one of the principals in the group of principals.

13. The method of claim 12, wherein the request is created by the at least one application automatically, without prompting by the at least one principal.

14. The method of claim 7, further comprising the steps of:

cryptographically protecting a file containing the one or more digital identity representations; and

sending the cryptographically protected file containing the one or more digital identity representations to a principal machine.

15. A system for provisioning a digital identity representation for a principal, the system comprising:

at least one processing unit;

memory, communicatively connected to the at least one processing unit and storing instructions that, when executed by the at least one processing unit, perform a method, the method comprising the steps of;

receiving input defining a descriptor for the digital identity representation;

storing the descriptor;

receiving a request for the descriptor from the principal;

sending the descriptor to the principal;

receiving a selection of the descriptor;

in response to receiving a selection of the descriptor, receiving a request to create the digital identity representation corresponding to the selected descriptor for the principal;

creating the digital identity representation;

polling a digital identity representation generation system to determine whether a second digital identity representation is available to the principal;

determining that a second digital identity representation is available to the principal by determining that a new descriptor is available to the principal;

in response to determining that a second digital identity representation is available, automatically sending to the principal a notification that the second digital identity representation is available to the principal;

receiving a request to create the second digital identity representation; and

creating the second digital identity representation.

16. The method of claim 15, wherein the notification includes a link to an electronic site to enable creation of the request.

17. The method of claim 15, further comprising the step of:

capturing data regarding the principal;

wherein the step of issuing is automatically performed following the step of capturing.

18. The method of claim 15, wherein the principal is a member of a group of principals, further comprising the step of:

setting a policy that the group of principals are permitted access to the digital identity representation;

wherein the step of issuing the notification comprises issuing the notification to the group of principals.

19. The method of claim 18, wherein the step of issuing the notification comprises sending a message to at least one application running on a principal machine that is associated with at least one of the principals in the group of principals.