Distributed network identity

• US 20030149781A1
• Filed: 12/03/2002
• Published: 08/07/2003
• Est. Priority Date: 12/04/2001
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Hapner, Mark, Beatty, John D., Ellison, Gary, Yared, Peter, Stern, Hal, Ranganathan, Aravindan, Finkelstein, Sheldon J., Abrahams, Larry, Allavarpu, Sai
• Granted Patent: US 7,610,390 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 61/4547 for personal communications, i.e. using a personal identifier
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A distributed network identity is provided. An identity provider stores a portion of a user'"'"'s personal information. A service provider accesses user information from one or more identity providers. System entities such as identity providers and service providers can be linked to enable information sharing and aggregation. User policies and privacy preferences are provided to control how information is shared. A single sign-on architecture is provided where an identity provider is used to facilitate cross-domain authentication and to enhance user convenience. Service delegation features are also provided.

Claims

1. A method for establishing a relationship between a first node and a second node, the method comprising:

receiving a login from a user at the first node;

receiving a login from a user at the second node;

authenticating the login at the first node;

authenticating the login at the second node;

generating a first handle corresponding to a user account on the first node, the first handle for identifying the user at the first node;

generating a second handle corresponding to a user account on the second node, the second handle for identifying the user at the second node;

passing the first handle to the second node; and

passing the second handle to the first node, the first handle and the second handle are combinable to identify the user account on the first node and the user account on the second node.

2. The method of claim 1 wherein the first handle and the second handle comprise matching identifiers.

3. The method of claim 1 further comprising:

storing, on the first node, the second handle in a user directory record associated with the user account on the first node.

4. The method of claim 1 further comprising:

storing, on the second node, the first handle in a user directory record associated with the user account on the second node.

5. A method for providing user authentication to a service provider, the method comprising:

receiving, at an identity provider, an identifier that indicates the service provider, wherein the identifier includes an assertion of an identity of a user;

requesting an identity credential from the user;

authenticating the identity credential to produce an authenticated credential; and

passing the authenticated credential to the service provider.

6. The method of claim 5 further comprising:

providing to the service provider user profile data.

7. The method of claim 6 wherein at least one of the receiving, requesting, authenticating, and passing is performed using web services.

8. The method of claim 5 wherein the identity credential comprises a username and a password.

9. The method of claim 5 wherein the identity credential comprises a certificate.

10. The method of claim 5 wherein the authenticated credential comprises a transient token.

11. The method of claim 5 further comprising:

passing an identity provider preference to a common domain, wherein the identity provider preference facilitates selection of the identity provider for authenticating the user.

12. A method for linking user accounts, the method comprising:

authenticating a user with an identity provider;

receiving, at a service provider, a first handle corresponding to the user;

updating a user directory entry associated with the user to include the first handle;

generating a second handle for the user; and

passing the second handle to the identity provider, wherein the first handle and the second handle are combinable to identify an account of the user.

13. The method of claim 12 wherein the second handle is a pseudonym for an account name.

14. The method of claim 12 wherein the second handle is dynamically generated.

15. The method of claim 12 wherein the second handle comprises an e-mail address.

16. The method of claim 12 wherein the first handle and the second handle together form an identifier for differentiating the user.

17. The method of claim 12 wherein the passing further comprises:

encrypting the second handle with a key corresponding to the identity provider.

18. The method of claim 12 wherein the receiving further comprises:

decrypting the first handle with a key corresponding to the service provider.

19. A method for linking user accounts, the method comprising:

generating, at an identity provider, a first handle for a user;

sending the first handle to a service provider;

receiving a second handle for the user from the service provider; and

updating a user directory entry associated with the user to include the second handle, wherein the first handle and the second handle are combinable to identify an account of the user.

20. The method of claim 19 wherein the first handle is a pseudonym for an account name.

21. The method of claim 19 wherein the first handle is dynamically generated.

22. The method of claim 19 wherein the first handle comprises an e-mail address.

23. The method of claim 19 wherein the first handle and the second handle together form a shared secret for differentiating the user.

24. The method of claim 19 wherein the sending further comprises:

encrypting the first handle with a key corresponding to the service provider.

25. The method of claim 19 wherein the receiving further comprises:

decrypting the second handle with a key corresponding to the identity provider.

26. A method for trust chaining, the method comprising:

providing a user account handle, wherein the handle links a first system entity and a second system entity; and

requesting user profile data from one of the first system entity and the second system entity.

27. The method of claim 26 wherein the user account handle is an identifier for the user in a namespace between the first system entity and the second system entity.

28. The method of claim 26 further comprising:

determining whether the user profile data request is approved in a user policy; and

responsive to the determining, sending user profile data to one of the first system entity and the second system entity.

29. The method of claim 28 wherein the determining further comprises:

requesting user validation of the user profile data request.

30. The method of claim 26 wherein the first system entity comprises one of a service provider and an identity provider.

31. The method of claim 26 wherein the second system entity comprises one of a service provider and an identity provider.

32. The method of claim 26 further comprising:

unlinking the first system entity and the second system entity responsive to a user request.

33. The method of claim 26 further comprising:

deleting user profile data from the first system entity user directory and the second system entity user directory.

34. The method of claim 26 further comprising:

updating a user directory with user profile data from at least one of the first entity or the second entity.

35. A method for delegating a service, the method comprising:

authenticating a user with an identity provider;

requesting, by a first service provider a ticket from the identity provider for the delegated service, wherein the delegated service is performed by a second service provider;

receiving the ticket at the first service provider, the ticket for authorizing the second service provider to perform the delegated service on behalf of the user; and

presenting the ticket at the second service provider to use the delegated service.

36. The method of claim 35 wherein the ticket comprises a transient token.

37. The method of claim 35 wherein the ticket is encrypted with a key corresponding to the service provider.

38. The method of claim 35 wherein the delegated service is a payment service.

39. A computer readable medium comprising:

program instructions for providing a user account handle, wherein the handle links a first system entity and a second system entity; and

program instructions for requesting user profile data from one of the first system entity and the second system entity.

40. The computer readable medium of claim 39 wherein the user account handle is an identifier for the user in a namespace between the first system entity and the second system entity.

41. The computer readable medium of claim 39 further comprising:

program instructions for determining whether the user profile data request is approved in a user policy.

42. The computer readable medium of claim 41 wherein the program instructions for determining further comprises:

program instructions for requesting user validation of the user profile data request.

43. The computer readable medium of claim 39 further comprising:

program instructions for updating a user directory with user profile data from at least one of the first entity or the second entity.

44. A system for trust chaining, the system comprising:

an identifier module configured to provide a user account handle, wherein the handle links a first system entity and a second system entity; and

a user account module configured to request user profile data from one of the first system entity and the second system entity.

45. The system of claim 44 wherein the user account handle is an identifier for the user in a namespace between the first system entity and the second system entity.

46. The system of claim 44 further comprising:

a user policy module configured to determine whether the user profile data request is approved in a user policy.

47. The system of claim 46 wherein the user policy module is further configured to request user validation of the user profile data request.

48. The system of claim 44 wherein the first system entity comprises one of a service provider and an identity provider.

49. The system of claim 44 wherein the second system entity comprises one of a service provider and an identity provider.

50. The system of claim 44 wherein the user account module is further configured to unlink the first system entity and the second system entity responsive to a user request.

51. The system of claim 44 wherein the user account module is further configured to delete user profile data from the first system entity user directory and the second system entity user directory.

52. The system of claim 44 wherein the user account module is further configured to update a user directory with user profile data from at least one of the first entity or the second entity.