Schema-Based Services For Identity-Based Data Access

• US 20060161554A1
• Filed: 03/09/2006
• Published: 07/20/2006
• Est. Priority Date: 03/14/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Leach, Paul J., Ward, Richard B., Movva, Ramu, Kalki, Jagadeesh, Taylor, Michael B., Gopal, Burra, Fang, Lijiang, Keil, Kendall D., Lucovsky, Mark H., Hoffman, William Raymond, Jacobs, Jay Christopher, Pierce, Shaun Douglas, White, Steven D., Kannan, Suresh, Ford, Peter Sewall, Guu, Yi-Wen, Auerbach, David Benjamin, Yuan, Yun-Qi, George, Samuel John, Steckler, Paul Andrew, Smoot, Philip Michael, Hsueh, Walter C., Wu, Winnie C.
• Granted Patent: US 7,664,724 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 10/109 Time management, e.g. calendars, reminders, meetings or time accounting
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/62 : Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: Y10S 707/99931 : Database or file accessing
• CPC Class Codes: Y10S 707/99939 : Privileged access
• CPC Class Codes: Y10S 707/99942 : Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99943 : Generating database or data structure, e.g. via user interface

Abstract

A schema-based service for Internet access to per-user services data, wherein access to data is based on each user'"'"'s identity. The service includes a schema that defines rules and a structure for each user'"'"'s data, and also includes methods that provide access to the data in a defined way. The services schema thus corresponds to a logical document containing the data for each user. The user manipulates (e.g., reads or writes) data in the logical document by data access requests through defined methods. In one implementation, the services schemas are arranged as XML documents, and the services provide methods that control access to the data based on the requesting user'"'"'s identification, defined role and scope for that role. In this way, data can be accessed by its owner, and shared to an extent determined by the owner.

Claims

1. A method for providing identity-centric services to end users over a distributed computer network, the method comprising:

providing a core set of identity-centric services to end users;

maintaining identity-centric data relating to the end users of the core services; and

providing one or more optional identity-centric services to end users in addition to the core services;

wherein the identity-centric data in the data store is accessible by the core set of services and by the optional services.

2. The method of claim 1 wherein the core services provider also provides the one or more optional identity-centric services.

3. The method of claim 1 wherein at least one optional identity-centric service is provided by a different entity than the provider of the core set of services.