Identity-centric data access

• US 20020133535A1
• Filed: 10/22/2001
• Published: 09/19/2002
• Est. Priority Date: 03/14/2001
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Leach, Paul J., Simon, Daniel R., Ward, Richard B., Weinert, Alexander T., Moore, George M., Pierce, Shaun D., Hyman, Robert M., Zwiegincew, Arthur, Burner, Michael G., Pincus, Jonathan D., Lucovsky, Mark, Gundotra, Vivek
• Application Number:
  US10/003,750
• Publication Number:
  US 20020133535A1
• Time in Patent Office: Days
• US Class Current: 709/201
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/109 Time management, e.g. calendars, reminders, meetings or time accounting
• CPC Class Codes: H04L 12/1859 adapted to provide push services, e.g. data channels
• CPC Class Codes: H04L 12/1863 comprising mechanisms for improved reliability, e.g. status reports arrangements for detecting or preventing errors by carrying supervisory signal the return channel H04L1/16
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A model for accessing data in an identity-centric manner. An identity may be a user, a group of users, or an organization. Instead of data being maintained on an application-by-application basis, the data associated with a particular identity is stored by one or more data services accessible by many applications. The data is stored in accordance with a schema that is recognized by a number of different applications and the data service. When a user is to perform an operation on the identity'"'"'s data, the corresponding application generates a message that has a structure that is recognized by the data service. The message represents a request to perform an operation on the data structure corresponding to the identity. The data service receives and interprets the message. If authorized, the data service then performs the operation.

Claims

1. In a computer environment including a plurality of applications that operate on data related to an identity, the computer environment also including a service that maintains data associated with the identity, a method for one of the plurality of applications to operate on data related to the identity, the method comprising the following:

an act of identifying a data structure that represents data that is to be operated on, the data being associated with the identity, the data structure being in accordance with a data format recognized by the service and the plurality of applications;

an act of constructing a network message in accordance with a message format that is recognized by the service, the network message representing a request to perform the operation on the data structure, the network message identifying the data structure by identifying the identity; and

an act of dispatching the network message to the service.

2. A method in accordance with claim 1, wherein the act of dispatching the network message to the service comprises dispatching the network message directly to the service without first communicating with a locator service.

3. A method in accordance with claim 1, wherein the data structure comprises a content data structure that represents the actual data of interest.

4. A method in accordance with claim 1, wherein the data structure comprises an access control data structure.

5. A method in accordance with claim 1, wherein the data structure comprises a systems data structure.

6. A method in accordance with claim 1, wherein the data that is to be operated on is not directly accessed by the plurality of application, but is only directly accessed via the service.

7. A method in accordance with claim 1, further comprising:

an act of the granting the application access to the data structure prior to the acts of identifying, constructing, and dispatching.

8. A method in accordance with claim 1, further comprising:

an act of revoking access from the application to the data structure after the acts of identifying, constructing, and dispatching.

9. A method in accordance with claim 1, further comprising the following:

an act of determining an address of the service.

10. A method in accordance with claim 9, wherein the act of constructing a network message comprises the following:

an act of including the address of the service in the network message.

11. A method in accordance with claim 9, wherein the network message is a first network message, wherein the act of determining an address of the service comprises the following:

an act of constructing a second network message in accordance with the message format that is recognized by a locator service, the second network message representing a query for the address using the identification of the identity;

an act of dispatching the second network message to the locator service; and

an act of receiving a response from the locator service that includes the address.

12. A method in accordance with claim 11, wherein the act of receiving a response from the locator service comprises the following:

an act of receiving a third network message from the locator service, the third network message being in accordance with the message format.

13. A method in accordance with claim 1, wherein the act of constructing a network message in accordance with a message format that is recognized by the service comprises the following:

an act of constructing a network message in accordance with the Simple Object Access Protocol.

14. A method in accordance with claim 1, wherein the act of dispatching the network message to the service comprises the following:

an act of dispatching the network request to a locator service that maintains a list of addresses for type-specific data services corresponding to the identity.

15. A method in accordance with claim 1, wherein the act of dispatching the network message to the service comprises the following:

an act of dispatching the network request to a type-specific data service that maintains a list of addresses for type-specific data services corresponding to the identity.

16. A method in accordance with claim 1, wherein the act of dispatching the network message to the service comprises the following:

an act of dispatching the network message to the service using a transport protocol that is compatible with transport over the Internet.

17. A method in accordance with claim 1, wherein the act of dispatching the network message to the service comprises the following:

an act of dispatching the network message to a different machine as compared to the machine that runs the application.

18. A method in accordance with claim 1, wherein the act of dispatching the network message to the service comprises the following:

an act of dispatching the network message to a service that is run on the same machine as the application.

19. A method in accordance with claim 1, wherein the identity is an individual.

20. A method in accordance with claim 1, wherein the identity is a group of individuals.

21. A method in accordance with claim 1, wherein the identity is an organization.

22. In a computer environment including a plurality of applications that operate on data related to an identity, the computer environment also including a service that maintains data associated with the identity, a method for one of the plurality of applications to operate on data related to the identity, the method comprising the following:

an act of determining that data associated with the identity is to be operated on;

a step for formulating a request to operate on the data via a structured network message that identifies the identity; and

an act of dispatching the network message to the service.

23. A method in accordance with claim 22, wherein the step for formulating a request comprises the following:

an act of identifying a data structure that represents the data associated with the identity, the data structure being in accordance with a data format recognized by the service and the plurality of applications; and

an act of constructing a network message in accordance with a message format that is recognized by the service, the network message representing a request to perform the operation on the data structure, the network message identifying the data structure by identifying the identity.

25. A computer program product in accordance with claim 24, wherein the one or more computer-readable media are physical storage media.

26. A computer program product in accordance with claim 24, wherein the one or more computer-readable media further have stored thereon the following:

computer-executable instructions for constructing a second network message in accordance with the message format that is recognized by a locator service, the second network message representing a query for the address using the identification of the identity;

computer-executable instructions for causing the second network message to be dispatched to the locator service; and

computer-executable instructions for detecting the receipt of a response from the locator service that includes the address.

28. A method in accordance with claim 27, further comprising the following:

prior to the act of performing the requested operation, an act of determining that the one of the plurality of applications is authorized to perform the requested operation on the data structure.

29. A method in accordance with claim 28, wherein:

the method further comprises an act of maintaining a list of access rights to the data structure; and

the act of determining that the one of the plurality of applications is authorized to perform the requested operation on the data structure comprises an act of referring to the list of access rights.

30. A method in accordance with claim 29, wherein the act of maintaining a list of access rights to the data structure comprises an act of honoring requests issued by the identity to control access rights to the data structure.

31. A method in accordance with claim 27, wherein the data structure represents addresses corresponding to a plurality of type-specific data services that maintain type-specific data structures related to the identity.

32. A method in accordance with claim 31, wherein network message is a first network message, wherein the act of performing the requested operation on the data structure comprises the following:

an act of reading at least one address from the data structure;

an act of constructing a second network message that includes the at least one address read from the data structure; and

an act of dispatching the second network message.

33. A method in accordance with claim 32, wherein the act of dispatching the second network message comprises an act of dispatching the second network message to the one of the plurality of application programs.

34. A method in accordance with claim 32, wherein the act of dispatching the second network message comprises an act of dispatching the second network message in accordance with the message format.

35. A method in accordance with claim 27, wherein the data structure represents personal address information corresponding to the identity.

36. A method in accordance with claim 27, wherein the data structure represents contacts information corresponding to the identity.

37. A method in accordance with claim 27, wherein the data structure represents grocery list information corresponding to the identity.

38. A method in accordance with claim 27, wherein the data structure represents in-box information corresponding to the identity.

39. A method in accordance with claim 27, wherein the data structure represents music service information corresponding to the identity.

40. A method in accordance with claim 27, wherein the data structure represents calendar information corresponding to the identity.

41. A method in accordance with claim 27, wherein the data structure represents documents that the identity is entitled to access.

42. A method in accordance with claim 27, wherein the data structure represents application setting information corresponding to the identity.

43. A method in accordance with claim 27, wherein the data structure represents physical device information corresponding to the identity.

44. A method in accordance with claim 27, wherein the data structure represents favorite Web site information corresponding to the identity.

45. A method in accordance with claim 27, wherein the network message is a first network message, wherein the act of performing the requested operation on the data structure comprises the following:

an act of reading at least one address from the data structure;

an act of constructing a second network message that includes the at least one address read from the data structure; and

an act of dispatching the second network message.

46. A method in accordance with claim 45, wherein the act of dispatching the second network message comprises an act of dispatching the second network message to the one of the plurality of application programs.

47. A method in accordance with claim 45, wherein the act of dispatching the second network message comprises an act of dispatching the second network message in accordance with the message format.

49. A computer program product in accordance with claim 48, wherein the one or more computer-readable media are physical storage media.

50. A computer program product in accordance with claim 48, wherein the one or more computer-readable media further comprise the following:

computer-executable instructions for determining that the one of the plurality of applications is authorized to perform the requested operation on the data structure prior to the performing the requested operation.

51. A computer program product in accordance with claim 48, wherein the one or more computer-readable media further have stored thereon the following:

computer-executable instructions for maintaining a list of access rights to the data structure; and

computer-executable instructions for referring to the list of access rights in order to determine that the one of the plurality of application is authorized to perform the requested operation on the data structure.

24. A computer program product for use in a computer environment including a plurality of applications that operate on data related to an identity, the computer environment also including a service that maintains data associated with the identity, the computer program product for implementing a method for one of the plurality of applications to operate on data related to the identity, the computer program product comprising one or more computer-readable media having stored thereon the following:

computer-executable instructions for identifying a data structure that represents data that is to be operated on, the data being associated with the identity, the data structure being in accordance with a data format recognized by the service and the plurality of applications;

computer-executable instructions for constructing a network message in accordance with a message format that is recognized by the service, the network message representing a request to perform the operation on the data structure, the network message identifying the data structure by identifying the identity; and

computer-executable instructions for causing the network message to be dispatched to the service.

27. In a computer environment including a plurality of applications that operate on data related to an identity, the computer environment also including a service that maintains data associated with the identity, a method for the service facilitating access of the plurality of applications to data related to the identity, the method comprising the following:

an act of receiving a network message from one of the plurality of applications, the network message structured in accordance with a message format that is recognized by the service, the network message representing a request to operate on a data structure associated with the identity, the data structure being structured in accordance with a data format recognized by the service and the plurality of applications;

an act of interpreting the network message in light of the message format to thereby extract an identification of the identity and an identification of the data structure; and

an act of performing the requested operation on the data structure using the data format.

48. A computer-program product for use in a computer environment including a plurality of applications that operate on data related to an identity, the computer environment also including a service that maintains data associated with the identity, the computer program product for implementing a method for the service facilitating access of the plurality of applications to data related to the identity, the computer program product comprising one or more computer-readable media having stored thereon the following:

computer-executable instructions for detecting the receipt of a network message from one of the plurality of applications, the network message structured in accordance with a message format that is recognized by the service, the network message representing a request to operate on a data structure associated with the identity, the data structure being structured in accordance with a data format recognized by the service and the plurality of applications;

computer-executable instructions for interpreting the network message in light of the message format to thereby extract an identification of the identity and an identification of the data structure; and

computer-executable instructions for performing the requested operation on the data structure using the data format.

52. A computer network that facilitates access to identity-centric data, the computer network comprising the following:

a plurality of applications that operate on data related to an identity, each of the plurality of applications configured to determine that data associated with the identity is to be operated on, identify a data structure that represents the data associated with the identity, construct a network message in accordance with a message structure recognized by the plurality of applications, the network message representing a request to perform the operation on the data structure, the network message identifying the data structure by identifying the identity, and configured to dispatch the network message to the service; and

a plurality of services that maintain data associated with the identity, each of the plurality of applications configured to detect the receipt of the network message from one of the plurality of applications, interpret the network message in light of the message format to thereby extract an identification of the identity and an identification of the data structure, and perform the requested operation on the data structure using the data format.

53. A method for providing identity-centric data to one or more applications, the method including at least the following acts:

storing identity-centric data relating to multiple identities in a data store associated with a data service;

receiving various requests from the applications for identity-centric data relating to at least some of the identities; and

providing the requested data to the requesting applications in response to their requests.

54. A method for accessing identity-centric data via a data service which maintains identity-centric data relating to user identities, the method comprising:

requesting identity-centric data relating to one or more of the user identities from the data service, and

receiving the requested data from the data service.