CA2501848A1 - Identity system for use in a computing environment - Google Patents

Identity system for use in a computing environment Download PDF

Info

Publication number
CA2501848A1
CA2501848A1 CA002501848A CA2501848A CA2501848A1 CA 2501848 A1 CA2501848 A1 CA 2501848A1 CA 002501848 A CA002501848 A CA 002501848A CA 2501848 A CA2501848 A CA 2501848A CA 2501848 A1 CA2501848 A1 CA 2501848A1
Authority
CA
Canada
Prior art keywords
principal
identity
assertion
computing environment
resource
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CA002501848A
Other languages
French (fr)
Other versions
CA2501848C (en
Inventor
Kim Cameron
Donald J. Hacherl
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Microsoft Technology Licensing LLC
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Publication of CA2501848A1 publication Critical patent/CA2501848A1/en
Application granted granted Critical
Publication of CA2501848C publication Critical patent/CA2501848C/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00Digital computers in general; Data processing equipment in general
    • G06F15/16Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00Digital computing or data processing equipment or methods, specially adapted for specific functions
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149Restricted operating environment

Abstract

A system for identifying principals within a computing environment is disclosed. The system includes principal objects containing identity claims.
The principal objects are used by computer processes within the environment to perform tasks related to the association of principals to activated resource objects.
Exemplary principals include individuals, a group of individuals, organizations and computer modules and devices. Each identity claim uniquely identifies a specific principal within a particular scheme. To accomplish this, each identity claim includes an assertion that specifies an identification string unique to a principal within the associated scheme. Exemplary schemes for an individual include email accounts, telephone numbers, credit card account numbers and social security numbers. Thus, exemplary identification strings for an individual are specific email addresses, specific telephone numbers, etc. Exemplary schemes for a group of individuals and organizations include telephone numbers and web page addresses.
The system also determines whether two principal objects conflict, thereby resulting in an identity fault.

Claims (38)

1. A system for identifying principals within a computing environment, the system comprising:
a plurality of principal objects, wherein each principal object corresponds to a specific principal authenticated to perform a digital action within the computing environment and wherein each principal object is operable for use by a computer process within the computing environment to associate a plurality of resource objects with the specific principal corresponding to the principal object; and a plurality of identity claims, wherein each identity claim uniquely identifies the specific principal corresponding to each specific principal object, and wherein at least one of the plurality of principal objects comprises two or more identity claims each uniquely identifying the specific principal corresponding to the at least one principal object.
2. A system as defined in claim 1, further comprising:
a plurality of identity references, wherein each of the plurality of identity references is associated with a resource object within the computing environment, and wherein each of the plurality of identity references identify the associated resource object as being associated with a specific principal based on a link assertion within the identity reference to a specific identity claim.
3. A system as defined in claim 2, wherein each of the plurality of identity claims comprises a type assertion and a value assertion that collectively identify the specific principal corresponding to the principal object to which each of the identity claims are associated.
4. A system as defined in claim 3, wherein the link assertion within each of the plurality of the identity references comprises the type assertion and the value assertion specified in the specific identity claim to which each identity reference is linked.
5. A system as defined in claim 4, wherein a first type assertion for a first identity claim associated with a first principal object indicates that the value assertion in the first identity claim comprises an electronic mail address uniquely associated with a first principal corresponding to the first principal object.
6. A system as defined in claim 5, wherein the first identity claim further comprises a start time reference assertion indicating a point in time when the email address was initially associated with the first principal.
7. A system as defined in claim 6, wherein the first identity claim further comprises an end time reference assertion indicating a point in time when the association between the email address and the first principal lapses.
8. A system as defined in claim 4, wherein a second type assertion for a second identity claim associated with the first principal object indicates that the value assertion in the second identity claim comprises a telephone number uniquely associated with the first principal.
9. A system as defined in claim 2, wherein the computing environment is a distributed computing system, and wherein at least one identity reference is maintained on a computer system different than a computer system on which the identity claim linked to the identity reference is maintained.
10. A system for identifying a first principal within a computing environment, wherein the first principal is authenticated to perform a digital action within the computing environment, the system comprising:
a first principal object corresponding to the first principal, wherein the first principal object is operable for use by a computer process within the computing environment to associate at least one resource object with the first principal;
a plurality of identity claims, wherein each identity claim uniquely identifies the first principal, the first principal object including the plurality of identity claims such that the computer process may associate the at least one resource object with the first principal using any of the plurality of identity claims.
11. A system as defined in claim 10, further comprising:

a first identity reference associated with a first resource object within the computing environment, wherein the first identity reference identifies the first resource object as being associated with the first principal based on a first link assertion within the first identity reference to a first identity claim in the plurality of identity claims.
12. A system as defined in claim 11, further comprising:
a second identity reference associated with a second resource object within the computing environment, wherein the second identity reference identifies the second resource object as being associated with the first principal based on a second link assertion within the second identity reference to the first identity claim.
13. A system as defined in claim 12, wherein the first resource object represents a file associated with a first application program and the second resource object represents a file associated with a second application program.
14. A system as defined in claim 13, wherein the first application program is a word processing application program.
15. A system as defined in claim 12, wherein each of the plurality of identity claims comprises a type assertion and a value assertion that collectively specify the first principal, and wherein the first and second link assertions comprise the type assertion and the value assertion specified in the identity claim to which the first and the second identity references are linked.
16. A system as defined in claim 15, wherein a first type assertion for the first identity claim indicates that the value assertion in the first identity claim comprises an electronic mail address uniquely associated with the first principal.
17. A system as defined in claim 16, wherein the first identity claim further comprises:
a start time reference assertion indicating a point in time when the email address was initially associated with the first principal; and an end time reference assertion indicating a point in time when the association between the email address and the first principal lapses.
18. A system as defined in claim 10, wherein the first principal is selected from the group consisting of an individual, an organization and a module within the computing environment.
19. A system as defined in claim 10, wherein the computing environment is a distributed computing system.
20. A system as defined in claim 10, wherein the computing environment is a stand-alone computing system.
21. A computer readable medium having a data structure stored thereon for use in identifying a principal authenticated to perform a digital action within a computing environment, the data structure comprising:
a value assertion uniquely identifying the principal within a particular identification scheme;
a type assertion indicating the particular identification scheme corresponding to the value assertion; and a time reference assertion specifying a time frame in which the principal is uniquely identified by the value assertion within the particular identification scheme.
22. A computer readable medium as defined in claim 21, wherein the data structure represents an identity claim that associates a principal object with the principal, wherein the principal object is operable for use by a computer process within the computing environment to associate at least one resource object with the principal.
23. A computer readable medium as defined in claim 22, wherein the time reference comprises:
a start time reference assertion indicating a point in time when the value assertion was initially associated with the principal; and
24 an end time reference assertion indicating a point in time when the association between the value assertion and the principal lapses.
24. A computer readable medium as defined in claim 22, the data structure further comprising:
a display assertion specifying the value assertion in a form recognizable to human users within the computing environment, wherein the computer process displays the display assertion to a user in response to a request by the user to view the association between the principal and the at least one resource object.
25. A computer readable medium as defined in claim 21, wherein the principal is selected from the group consisting of an individual, an organization and a module within the computing environment.
26. A computer readable medium as defined in claim 21, wherein the type assertion indicates that the value assertion comprises an electronic mail address uniquely associated with the principal.
27. A computer readable medium as defined in claim 21, wherein the type assertion indicates that the value assertion comprises a telephone number uniquely associated with the principal.
28. A method for identifying a first principal authenticated to perform a digital action within a computing environment, the method comprising:
creating a principal object operable for use by a computer process within the computing environment to identify the first principal as being associated with a plurality of resource objects maintained within the computing environment;
associating with the principal object a first identity claim uniquely identifying the first principal within a particular identification scheme, wherein unique identification of the first principal within the particular identification scheme is accomplished by assignment of unique identification strings to each of a plurality of principals;

receiving a plurality of resource objects associated with a plurality of application programs, wherein each of the plurality of resource objects are associated with an identity reference comprising a declaration that links each resource object to the principal object; and identifying within the computing environment each of the plurality of resource objects as being associated with the first principal based on the declaration links contained in the associated identity references, wherein the computer process utilizes identification of each of the plurality of resource objects to the first principal to perform at least one task in connection with each identified resource object.
29. A method as defined in claim 28, wherein the receiving act comprises:
receiving a first resource object having associated therewith a first identity reference linked to the first identity claim based on a first declaration comprising a unique identification string assigned to the first principal, wherein the first resource object represents a first file associated with a first application program;
and receiving a second resource object having associated therewith a second identity reference linked to the first identity claim based on a second declaration comprising the unique identification string assigned to the first principal, wherein the second resource object represents a second file associated with a second application program.
30. A method as defined in claim 29, wherein the identifying act comprises:
identifying the first file and the second file as being associated with the first principal based on the linking of the first identity reference and the second identify reference to the first identity claim.
31. A method as defined in claim 28, further comprising:
associating with the principal object properties associated with the first principal, wherein the task performed by the computer process in response to the identifying act comprises an act of displaying a graphical representation of the properties associated with the first principal in conjunction with a graphical representation of at least one of the plurality of resources linked to the principal object.
32. A method as defined in claim 30, further comprising:
associating with the principal object properties associated with the first principal, wherein the task performed by the computer process in response to the identifying act comprises an act of authenticating access by the first principal to at least one of the plurality of resources linked to the principal object.
33. A method as defined in claim 28, wherein the creating act comprises:
creating a phantom principal object in response to receiving a resource object having a identity reference comprising a declaration that does not link the resource object to the principal object, the declaration comprising an identification string uniquely identifying a second principal within the particular identification scheme, and wherein the phantom principal object is created to include the identification string assigned to the second principal; and saving the phantom principal object to a data store containing the principal object corresponding to the first principal.
34. A method as defined in claim 33, further comprising:
receiving a second principal object, wherein the second principal object comprises a second identity claim that comprises the identification string assigned to the second principal; and in response to determining that the phantom principal object and the second principal both correspond to the second principal, deleting the phantom principal object from the data store and saving to the data store the second principal object such that the second principal object is operable for use by the identifying act.
35. A method as defined in claim 28, wherein the first identity claim is stored in the computing environment in a data store, the method further comprising:
in response to receiving a second identity claim for storage into the data store, determining whether the second identity claim and the first identity claim both specify an identical unique identification string; and in response to determining that both the first identity claim and the second identity claim specify the identical unique identification string, invoking a fault resolution process to determine a primary identity claim that is to be stored in the data store and available to the identifying act.
36. A method as defined in claim 35, wherein the invoking act comprises:
merging data stored in the second identity claim into the first identity claim.
37. A method as defined in claim 35, wherein the invoking act comprises:
deleting the first identity claim; and storing in the data store the second identity claim.
38. A computer program product readable by a computer system and tangibly embodying a program of instructions executable by the computer system to perform the method of claim 28.
CA2501848A 2003-10-23 2004-07-29 Identity system for use in a computing environment Expired - Fee Related CA2501848C (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US10/693,021 US7631060B2 (en) 2003-10-23 2003-10-23 Identity system for use in a computing environment
US10/693,021 2003-10-23
PCT/US2004/024342 WO2005045577A2 (en) 2003-10-23 2004-07-29 Identity system for use in a computing environment

Publications (2)

Publication Number Publication Date
CA2501848A1 true CA2501848A1 (en) 2005-04-23
CA2501848C CA2501848C (en) 2012-03-20

Family

ID=34522270

Family Applications (1)

Application Number Title Priority Date Filing Date
CA2501848A Expired - Fee Related CA2501848C (en) 2003-10-23 2004-07-29 Identity system for use in a computing environment

Country Status (11)

Country Link
US (1) US7631060B2 (en)
EP (1) EP1682966A4 (en)
JP (1) JP4660483B2 (en)
KR (1) KR20060111253A (en)
CN (1) CN101180825B (en)
AU (1) AU2004279188A1 (en)
BR (1) BRPI0406214A (en)
CA (1) CA2501848C (en)
MX (1) MXPA05006639A (en)
RU (1) RU2377641C2 (en)
WO (1) WO2005045577A2 (en)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7181472B2 (en) * 2003-10-23 2007-02-20 Microsoft Corporation Method and system for synchronizing identity information
US8180834B2 (en) * 2004-10-07 2012-05-15 Computer Associates Think, Inc. System, method, and computer program product for filtering messages and training a classification module
US8104074B2 (en) * 2006-02-24 2012-01-24 Microsoft Corporation Identity providers in digital identity system
US8117459B2 (en) * 2006-02-24 2012-02-14 Microsoft Corporation Personal identification information schemas
US20070203852A1 (en) * 2006-02-24 2007-08-30 Microsoft Corporation Identity information including reputation information
US8078880B2 (en) * 2006-07-28 2011-12-13 Microsoft Corporation Portable personal identity information
US8407767B2 (en) * 2007-01-18 2013-03-26 Microsoft Corporation Provisioning of digital identity representations
US8087072B2 (en) * 2007-01-18 2011-12-27 Microsoft Corporation Provisioning of digital identity representations
US8689296B2 (en) * 2007-01-26 2014-04-01 Microsoft Corporation Remote access of digital identities
US8990896B2 (en) * 2008-06-24 2015-03-24 Microsoft Technology Licensing, Llc Extensible mechanism for securing objects using claims
US8689004B2 (en) 2010-11-05 2014-04-01 Microsoft Corporation Pluggable claim providers
EP3131353B1 (en) * 2014-04-29 2019-09-11 Huawei Technologies Co., Ltd. Resource reuse apparatus and method
US9674200B2 (en) * 2015-07-14 2017-06-06 Mastercard International Incorporated Identity federation and token translation module for use with a web application

Family Cites Families (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2724471B1 (en) 1994-09-13 1996-10-25 Bull Sa DEVICE FOR GENERATION OF OBJECT-ORIENTED INTERFACES FOR RELATIONAL DATABASES AND METHOD IMPLEMENTED BY SUCH DEVICE
US5542078A (en) 1994-09-29 1996-07-30 Ontos, Inc. Object oriented data store integration environment for integration of object oriented databases and non-object oriented data facilities
US5634052A (en) 1994-10-24 1997-05-27 International Business Machines Corporation System for reducing storage requirements and transmission loads in a backup subsystem in client-server environment by transmitting only delta files from client to server
US7562392B1 (en) * 1999-05-19 2009-07-14 Digimarc Corporation Methods of interacting with audio and ambient music
US5778395A (en) 1995-10-23 1998-07-07 Stac, Inc. System for backing up files from disk volumes on multiple nodes of a computer network
US7192352B2 (en) * 1996-04-22 2007-03-20 Walker Digital, Llc System and method for facilitating play of a video game via a web site
US6182188B1 (en) 1997-04-06 2001-01-30 Intel Corporation Method of performing reliable updates in a symmetrically blocked nonvolatile memory having a bifurcated storage architecture
US6370566B2 (en) 1998-04-10 2002-04-09 Microsoft Corporation Generating meeting requests and group scheduling from a mobile device
US6237035B1 (en) 1997-12-18 2001-05-22 International Business Machines Corporation System and method for preventing duplicate transactions in an internet browser/internet server environment
US6292880B1 (en) * 1998-04-15 2001-09-18 Inktomi Corporation Alias-free content-indexed object cache
JP2000122975A (en) * 1998-10-14 2000-04-28 Toshiba Corp User confirmation system by means of biometrics and storage medium
US6125378A (en) 1999-01-13 2000-09-26 Barbano; Paolo Emilio Method and apparatus for generating families of code signals using multiscale shuffling
GB9903124D0 (en) * 1999-02-11 1999-04-07 Nokia Telecommunications Oy An authentication method
US6687823B1 (en) * 1999-05-05 2004-02-03 Sun Microsystems, Inc. Cryptographic authorization with prioritized and weighted authentication
EP1200940B1 (en) * 1999-07-30 2007-10-10 Safewww, Inc. A system and method for secure network purchasing
US7137008B1 (en) * 2000-07-25 2006-11-14 Laurence Hamid Flexible method of user authentication
EP1195705A1 (en) * 2000-10-06 2002-04-10 Hewlett-Packard Company Method of performing transactions in an information technology network
AU2002230616A1 (en) * 2000-12-06 2002-06-18 Waveset Technologies, Inc. System and method for managing information objects
US7130466B2 (en) 2000-12-21 2006-10-31 Cobion Ag System and method for compiling images from a database and comparing the compiled images with known images
US7349970B2 (en) 2001-03-29 2008-03-25 International Business Machines Corporation Workload management of stateful program entities
US7243343B2 (en) 2001-04-10 2007-07-10 International Business Machines Corporation Method, compiler and platform independent framework for parsing and generating data structures
US7017162B2 (en) 2001-07-10 2006-03-21 Microsoft Corporation Application program interface for network software platform
US20040128508A1 (en) 2001-08-06 2004-07-01 Wheeler Lynn Henry Method and apparatus for access authentication entity
JP2003263471A (en) * 2002-03-07 2003-09-19 Progress Interactive Inc Printing data transmission/management system using personal digital assistant
US7308579B2 (en) * 2002-03-15 2007-12-11 Noel Abela Method and system for internationally providing trusted universal identification over a global communications network
US8611919B2 (en) * 2002-05-23 2013-12-17 Wounder Gmbh., Llc System, method, and computer program product for providing location based services and mobile e-commerce
US7275087B2 (en) 2002-06-19 2007-09-25 Microsoft Corporation System and method providing API interface between XML and SQL while interacting with a managed object environment
US7490332B2 (en) 2003-04-04 2009-02-10 Sesma Systems, Inc. System and method for accessing ActiveX objects in a platform dependent environment from objects in a platform independent environment
US7660864B2 (en) * 2003-05-27 2010-02-09 Nokia Corporation System and method for user notification
US7386863B2 (en) 2003-06-26 2008-06-10 International Business Machines Corporation Administering devices in dependence upon user metric vectors with multiple users

Also Published As

Publication number Publication date
US20050091264A1 (en) 2005-04-28
BRPI0406214A (en) 2005-08-09
RU2005119658A (en) 2006-01-20
JP2007519076A (en) 2007-07-12
AU2004279188A1 (en) 2006-02-16
KR20060111253A (en) 2006-10-26
CN101180825B (en) 2011-05-18
MXPA05006639A (en) 2005-08-16
EP1682966A2 (en) 2006-07-26
WO2005045577A3 (en) 2007-07-12
AU2004279188A8 (en) 2008-08-21
EP1682966A4 (en) 2012-05-30
US7631060B2 (en) 2009-12-08
CA2501848C (en) 2012-03-20
JP4660483B2 (en) 2011-03-30
RU2377641C2 (en) 2009-12-27
WO2005045577A2 (en) 2005-05-19
CN101180825A (en) 2008-05-14

Similar Documents

Publication Publication Date Title
US7853614B2 (en) Hierarchical, traceable, and association reputation assessment of email domains
CA2501848A1 (en) Identity system for use in a computing environment
CN104412272B (en) User is set to sign in the method, system and equipment of browser
US7953753B2 (en) Newsmaker verification and commenting method and system
US20060015499A1 (en) Method, data processing system, and computer program product for sectional access privileges of plain text files
CN107146012A (en) Risk case processing method and system
CN110458644A (en) A kind of information processing method and relevant device
US7577752B2 (en) Reliable page flow control
CN107808277A (en) Check card and record display methods, device, server and storage medium
CN111738837A (en) Credit card limit processing method and device
CN111611611A (en) Application method and device of credit data of transaction main body based on block chain
US9378664B1 (en) Providing financial data through real-time virtual animation
CN113987206A (en) Abnormal user identification method, device, equipment and storage medium
CN110309312B (en) Associated event acquisition method and device
CN112199434B (en) Data processing method, device, electronic equipment and storage medium
CN106997521A (en) Insure information processing method and device based on API
KR101067851B1 (en) Web page search system
CN108549728B (en) Page display method and system and big data platform
CN105786988B (en) Verification of data method and device
CN117010354A (en) Data table processing method, device, equipment and storage medium
CN106446201A (en) Processing method and device of social circle data
CN117909335A (en) Data center resource management method and system
CN111353768A (en) Book borrowing supervision method, device, equipment and storage medium
EP3020016A2 (en) A system and method for generating a random number and/or marker sentence using spoken sentence
RU17638U1 (en) COMPUTER MODELING INFORMATION MESSAGE

Legal Events

Date Code Title Description
EEER Examination request
MKLA Lapsed

Effective date: 20220301

MKLA Lapsed

Effective date: 20200831