MODELING PARTY IDENTITIES IN COMPUTER STORAGE SYSTEMS

• US 20100114984A1
• Filed: 03/25/2009
• Published: 05/06/2010
• Est. Priority Date: 10/23/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Short, Keith W., Cameron, Kim
• Granted Patent: US 8,171,057 B2
• Time in Patent Office: Days
• US Class Current: 707/803
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

The present invention extends to methods, systems, and computer program products for modeling party identities in computer storage systems. A federated identity fabric models identity data and relationships between portions of indentify data in computer storage systems in accordance with a uniform schema. The federated identity fabric can federate distributed identity and identity relationship data from computer storage systems within the variety of different computing environments. Code and metadata at computing environments associated with the federated identity fabric can interoperate to facilitate uniformly storing, accessing, modifying, deleting, and securing identity and identity relationship data within the federated identify fabric. Embodiments of the invention include utilizing an identity key table entry to locate party identity information and performing key transformations between different types of identity keys.

Claims

1. At a computer system including one or more processors and system memory, the computer system connected to a federated identity fabric, the federated identity fabric modeling identity related information in computer storage systems, the federated identity fabric providing a consistent view of and access to identity information across a plurality of different applications, a plurality of different computer systems, a plurality of different contexts, and a plurality of different networks, a method for utilizing the federated identity fabric to locate identity related data, the method comprising:

an act of creating a first data object within a data structure, the first data object representing an entity from the physical or digital world, within the data structure, the data structure capable of representing, through a single schema, the existence of any entity that can be unambiguously identified;

an act of inserting the first data object into the federated identity fabric;

an act of creating a second data object containing the representation of an unambiguous identifier used within the federated identity fabric;

an act of inserting the second data object into the federated identity fabric;

an act of relating the second data object to the first data object such that the second data object can subsequently be used to locate the first data object;

an act of subsequently using the unambiguous identifier as a template for locating the second data object;

an act of using the relationship between the first data object and the second data object to locate the first data object subsequent to using the unambiguous identifier to locate the second data object; and

an act of retrieving identity related data for the entity from the first data object.

2. The method as recited in claim 1, wherein the act of retrieving identify related information for the entity from the first data object comprises an act of utilizing the first data object to retrieve any combination of:

information generic to any type of party;

information stored using a schema for the particular type of party that has been located;

information about the relationship of the party to any other party of any other type; and

information about alternate unambiguous identifiers related to the same party.

3. The method described as recited in claim 1, wherein the data structure is configured to store unambiguous identifiers and, wherein:

the data structure contains a data element representing a type of the unambiguous identifier; and

the type of the unambiguous identifier is used in locating unambiguous identifiers of a different type representing the same party.

4. The method as recited in claim 2, wherein the type of the unambiguous identifier corresponds to a taxonomy entry in a taxonomy data structure.

5. The method described in claim 4, wherein individual entries within the taxonomy data structure are the same regardless of which instance of the identity system they are stored in.

6. The method as recited in claim 1, wherein there is, additionally, a single data structure with a single schema capable of representing any relationship between any two entities of any type.

7. The method as recited in claim 6, wherein a specific relationship instance has a type representing the type of the relationship.

8. The method as recited in claim 1, wherein the act of creating a second data object comprises an act of creating the second data object in accordance with the single schema.

9. The method as recited in claim 1, wherein the act of subsequently using the unambiguous identifier as a template for locating the second data object comprises an act of using an identity key that includes:

an identity key type defined in accordance with a identity key taxonomy within the single schema; and

an identity key value indicating a value of for the identity key type, the combination of identity key type and identity key value representing a location in a key identification table.

10. The method as recited in claim 1, wherein the act of using the relationship between the first data object and the second data object to locate the first data object comprises an act of using identity key to party relationship to locate a party entry in a party identification table.

11. The method as recited in claim 1, wherein the act of using the relationship between the first data object and the second data object to locate the first data object comprises an act of using identity key to identify key relationship to locate an identity key entry in a key identification table.

12. The method as recited in claim 1, wherein the act of creating a first data object within a data structure, the first data object representing a party from the physical or digital world, comprises an act of creating a first data object that represents a party selected from among:

organization, person, group, service, and device.

13. The method as recited in claim 1, wherein the act of creating a first data object within a data structure, the first data object representing a party from the physical or digital world, comprises an act of creating a first data object that represents a person having a role selected from among:

customer, basic citizen, employee, process role, and private person.

14. A computer program product for use in a federated identify fabric, the federated identify fabric including one or more computer systems, each computer system including one or more processors and system memory, the federated identity fabric providing a consistent view of and access to identity information across a plurality of different applications, a plurality of different computer systems, a plurality of different contexts, and a plurality of different networks, the computer program product for implementing a method for retrieving identify related data for a party from the federated identify fabric, the computer program product comprising one or more computer storage media having stored thereon computer-executable instructions that, when executed at a process, cause the federated identity fabric to perform the method inclugin the following:

receive a request for identity related data for a party, the request including;

an identity key type defined in accordance with a identity key taxonomy within a single schema, the single schema capable of representing the existence of any entity that can be unambiguously identified;

an identity key value indicating a value of the identity key type, the combination of identity key type and identity key value representing an entry within key identification table information; and

a data value request, the data value request representing a request for a portion of party related identity data from a party table entry identifiable through the use of the combination of identity key type and identity key value and a relationship to party identification table information;

locate the key identification table entry, within the key identification table information, that corresponds to the combination of the identity key type and identity key value;

access a party identifier value from the key identification table entry, the party identifier value corresponding to the party associated with the identity key;

refer to a party identity entry in the party identity table information based on the accessed party identifier and the relationship to the party identify table information;

retrieve party identity data responsive to the data value request from the party identity entry; and

return the party identity data in response to the received request.

15. The computer program product as recited in claim 14, wherein computer-executable instructions that when executed cause the federated identity fabric to retrieve party identity data comprising computer-executable instructions that when executed cause the federated identify fabric to retrieve party identity data for a party selected from among:

an organization, a person, a group, a service, and a device.

16. The computer program product as recited in claim 14, wherein computer-executable instructions that when executed cause the federated identity fabric to retrieve party identity data comprising computer-executable instructions that when executed cause the federated identify fabric to retrieve party identity data for a person having a role selected from among:

customer, basic citizen, employee, process role, and private person.

17. A computer program product for use in a federated identify fabric, the federated identify fabric including one or more computer systems, each computer system including one or more processors and system memory, providing a consistent view of and access to identity information across a plurality of different applications, a plurality of different computer systems, a plurality of different contexts, and a plurality of different networks, the computer program product for implementing a method for performing a key transformation within the federated identify fabric, the computer program product comprising one or more computer storage media having stored thereon computer-executable instructions that, when executed at a process, cause the federated identity fabric to perform the method inclugin the following:

receive a request for identity related data for a party, the request including;

an first identity key type, the first identity key type defined in accordance with a identity key taxonomy within single schema, the single schema capable of representing the existing of any entity that can be unambiguously identified;

an identity key value indicating a corresponding value of the first identity key type, the combination of first identity key type and corresponding identity key value representing an entry within key identification table information; and

a key type request, the key type request representing a request for the corresponding key value of a second identity key type associated with the party, the second identity key type also defined in accordance with the identity key taxonomy within the single schema;

locate the key identification table entry, within the key identification table information, that corresponds to the combination of the first identity key type and corresponding identity key value;

access a party identifier value from the key identification table entry, the party identifier value corresponding to the party associated with the identity key;

refer to the identity key table information to locate a second key identification table entry having the second identity type key and that includes the party identifier;

retrieve the identity key value from the second key identification table entry;

return the retrieved identity key value from the second key identification table entry in response to the request.

18. The computer program product as recited in claim 17, wherein the party is selected from among:

an organization, a person, a group, a service, and a device.

19. The computer program product as recited in claim 17, the party has a role selected from among:

customer, basic citizen, employee, process role, and private person.

20. The computer program product as recited in claim 19, wherein the first key type identifies the party in a first context in the plurality of different contexts and the second key type identifies the party in a second different context in the plurality of different contexts.