Method and system for identity exchange and recognition

• US 20050091495A1
• Filed: 10/23/2003
• Published: 04/28/2005
• Est. Priority Date: 10/23/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Smith, Walter, Satagopan, Murli, Cameron, Kim, Brace, Colin, Nanda, Arun, Kwan, Stuart, Hacherl, Don, Dunn, Melissa
• Granted Patent: US 7,822,988 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

In accordance with various aspects, the present invention relates to methods and systems for sending an identity information document comprising selecting identity information from a self-identity information store for inclusion in the identity information document. The selected identity information is read from a self-identity information store. The identity information document is generated to include the selected identity information and one or more keys, and signed using a key associated with one of the keys included in the identity information document. The identity information document is then sent to a recipient. Receiving an identity information document comprises receiving a signed identity information document from an originator. A determination is made as to whether identity information in the identity information document is reliable. The identity information is saved in a recognized identity information store if the identity information is determined to be reliable. If the identity information is determined to be unreliable, an identity recognition number retrieved from the sender is compared to an identity recognition number generated by the recipient based on information in the received identity information document. If the identity recognition number is verified, the identity information is saved in the recognized identity information store.

Claims

1. A method of sending an identity information document comprising:

selecting identity information from a self-identity information store for inclusion in the identity information document;

reading the selected identity information from a self-identity information store;

generating the identity information document to include the selected identity information and at least a first key, the identity information document signed using a second key associated with the first key in the identity information document; and

sending the identity information document to a recipient.

2. The method of claim 1, wherein selecting identity information comprises selecting a subset of identity information from the self-identity information store based on user input from a Graphical User Interface (GUI).

3. The method of claim 1, wherein selecting identity information comprises selecting a predetermined subset of information from the self-identity information store.

4. The method of claim 1, wherein generating an identity information document comprises encoding the selected identification information in an extensible Mark-up Language (XML) document.

5. The method of claim 1, wherein the selected identity information comprises identity claims of a principal originating the identity information document.

6. The method of claim 1, wherein the selected identity information comprises use policies for defining uses to which the contents of the identity information may be put.

26. The computer readable medium of claim 21, wherein the selected identity information comprises use policies for defining uses to which the contents of the identity information may be put.

7. A method of receiving an identity information document comprising:

receiving a signed identity information document from an originator;

determining whether identity information in the identity information document is reliable; and

saving the identity information in a recognized identity information store if the identity information is determined to be reliable.

8. The method of claim 7, further comprising:

responsive to determining that the identity information is not reliable, determining whether to verify the identity information;

responsive to determining to verify the identity information, retrieving an Identification Recognition Number (IRN) from the originator of the identity information document, determining whether the IRN is correct and, responsive to the IRN being correct, saving the identity information in the recognized identity information store.

9. The method of claim 8, wherein determining whether the identity information is reliable is based on a user input through a graphical user interface.

10. The method of claim 8, wherein determining whether to verify the identity information is based on a user input through a graphical user interface.

11. A system to send an identity information document comprising:

a processor;

a communication channel connected with the processor; and

a memory coupled with and readable by the processor, the memory containing a series of instructions that, when executed by the processor, cause the processor to select identity information from a self-identity information store for inclusion in the identity information document, read the selected identity information from a self-identity information store, generate the identity information document to include the selected identity information and at least a first key, the identity information document signed using a second key paired with the first key; and

send the identity information document to a recipient connected to the communication channel.

12. The system of claim 11, wherein selecting identity information comprises selecting a subset of identity information from the self-identity information store based on user input from a Graphical User Interface (GUI).

13. The system of claim 11, wherein selecting identity information comprises selecting a predetermined subset of information from the self-identity information store.

14. The system of claim 11, wherein generating an identity information document comprises encoding the selected identification information in an eXtensible Mark-up Language (XML) document.

15. The system of claim 11, wherein the selected identity information comprises identity claims of a principal originating the identity information document.

16. The system of claim 11, wherein the selected identity information comprises use policies for defining uses to which the contents of the identity information may be put.

17. A system to receive an identity information document from an originator for use in future recognition of the originator comprising:

a processor;

a communication channel connected with the processor; and

a memory coupled with and readable by the processor, the memory containing a series of instructions that, when executed by the processor, cause the processor to receive a signed identity information document from an originator, determine whether identity information in the identity information document is reliable, and save the identity information in a recognized identity information store if the identity information is determined to be reliable, the recognized identity information store being used for future recognition of the originator.

18. The system of claim 17, further comprising:

responsive to determining that the identity information is not reliable, determining whether to verify the identity information;

responsive to determining to verify the identity information, receiving an Identification Recognition Number (IRN) from the initiator of the identity information document, determining whether the IRN is correct and, responsive to the IRN being correct, saving the identity information in the recognized identity information store.

19. The system of claim 18, wherein determining whether the identity information is reliable is based on a user input through a graphical user interface.

20. The system of claim 18, wherein determining whether to verify the identity information is based on a user input through a graphical user interface.

21. A computer readable medium encoding a computer program of instructions for executing a computer process for identity recognition, said computer process comprising:

selecting identity information from a self-identity information store for inclusion in the identity information document;

reading the selected identity information from a self-identity information store;

generating the identity information document to include the selected identity information and at least a first key, the identity information document signed with a second key associated with the first key in the identity information document; and

sending the identity information document to a recipient.

22. The computer readable medium of claim 21, wherein selecting identity information comprises selecting a subset of identity information from the self-identity information store based on user input from a Graphical User Interface (GUI).

23. The computer readable medium of claim 21, wherein selecting identity information comprises selecting a predetermined subset of information from the self-identity information store.

24. The computer readable medium of claim 21, wherein generating an identity information document comprises encoding the selected identification information in an extensible Mark-up Language (XML) document.

25. The computer readable medium of claim 21, wherein the selected identity information comprises identity claims of a principal originating the identity information document.

27. The computer readable medium of claim 21, further comprising:

receiving a signed identity information document from an originator;

determining whether identity information in the identity information document is reliable; and

saving the identity information in a recognized identity information store if the identity information is determined to be reliable, the recognized identity information store for future recognition of the originator.

28. The computer readable medium of claim 27, further comprising:

responsive to determining that the identity information is not reliable, determining whether to verify the identity information;

responsive to determining to verify the identity information, retrieving a retrieved Identification Recognition Number (IRN) from the initiating system of the identity information document, generating a computed IRN at the receiving system based in information in the identity information document, comparing the retrieved IRN with the computed IRN to determine whether the computed IRN is verified and, responsive to the computed IRN being verified, saving the identity information in the recognized identity information store.

29. The computer readable medium of claim 28, wherein determining whether the identity information is reliable is based on a user input through a graphical user interface.

30. The computer readable medium of claim 28, wherein determining whether to verify the identity information is based on a user input through a graphical user interface.