# US 11,122,031 B2 · Privacy-aware ID gateway > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,031 B2 - Document ID: US11122031B2 - Status: Granted - Kind: B2 - Application number: 16/671,778 - Filed: 2019-11-01 - Published: 2020-02-27 - Granted: 2021-09-14 - Earliest claimed: 2017-07-21 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Miki Ishikawa; Yuji Watanabe - Web page: https://patentgrep.com/patent/US11122031B2 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/102: {Entity profiles} - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - G06F 21/31: User authentication - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06F 21/445: {by mutual authentication, e.g. between devices or programs} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract At least one processor device is configured to receive a first authentication request for authenticating a first user, the first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server, determine that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being associated with a second user ID, and send a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application. ## Claims ### Claim 1 A computer program product including one or more computer readable storage mediums collectively storing program instructions that are executable by at least one processor device to cause the at least one processor device to perform operations comprising: receiving a first authentication request for authenticating a first user, the first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server; determining that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being different from the first user and being associated with a second user ID obtained based on the first user ID; and sending a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application. ### Claim 2 (depends on 1) The computer program product according to claim 1, wherein: receiving the first authentication request further includes receiving an identification of the second application with the first authentication request; and sending the second authentication request further includes sending authority information of the first user ID. ### Claim 3 (depends on 1) The computer program product according to claim 1, wherein the first user ID includes at least one of a user ID of the first user, and an identification of the first application. ### Claim 4 (depends on 1) The computer program product according to claim 1, wherein determining that the first user is authorized to access the information on the second user further includes: obtaining condition information defining a condition; and determining that the first user ID, the second application, and the second user ID satisfy the condition. ### Claim 5 (depends on 4) The computer program product according to claim 4, wherein the condition information includes at least one of a time when the information of the second user ID is recorded on the second application, and a record of the information of the second user ID on the second application. ### Claim 6 (depends on 4) The computer program product according to claim 4, wherein the operations further include: receiving an authorization of the second user from a client computer of the second user; and updating the condition information to reflect the authorization of the second user. ### Claim 7 (depends on 6) The computer program product according to claim 6, wherein the first authentication request is received from the first application. ### Claim 8 (depends on 1) The computer program product according to claim 1, wherein the operations further include receiving an authorization of the second user from the first application. ### Claim 9 (depends on 8) The computer program product according to claim 8, wherein the authorization of the second user includes a password input by the second user. ### Claim 10 An apparatus comprising: at least one computer readable storage medium having program instructions stored thereon; and at least one processor device operable to execute program instructions stored on the at least one computer readable storage medium to: receive a first authentication request for authenticating a first user, the first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server; determine that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being different from the first user and being associated with a second user ID obtained based on the first user ID; and send a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application. ### Claim 11 A system comprising: a first application server configured to execute a first application; a second application server configured to execute a second application; at least one computer readable storage medium having program instructions stored thereon; and at least one processor device operable to execute program instructions stored on the at least one computer readable storage medium to: receive a first authentication request for authenticating a first user, the first user having been authenticated on the first application with a first user identification (ID) using a first ID federation between the first application and a federation server; determine that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being different from the first user and being associated with a second user ID obtained based on the first user ID; and send a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application. ### Claim 12 (depends on 11) The system according to claim 11, wherein the second application server is further configured to: receive the second authentication request from the at least one processor device; and send a notification to a client computer of the second user in response to receiving the second authentication request from the at least one processor device. ### Claim 13 (depends on 11) The system according to claim 11, wherein the second application server is further configured to: receive the second authentication request from the at least one processor device; authorize reading of the information of the second user on the second application; and prohibit writing of the information of the second user on the second application in response to receiving the second authentication request from the at least one processor device. ### Claim 14 (depends on 11) The system according to claim 11, wherein the at least one processor device is further configured to: receive an identification of the second application with the first authentication request; and send authority information of the first user ID with the second authentication request. ### Claim 15 (depends on 11) The system according to claim 11, wherein the first user ID includes at least one of a user ID of the first user, and an identification of the first application. ### Claim 16 (depends on 11) The system according to claim 11, wherein the at least one processor device is further configured to determine that the first user is authorized to access the information on the second user by: obtaining condition information defining a condition; and determining that the first user ID, the second application, and the second user ID satisfy the condition. ### Claim 17 (depends on 16) The system according to claim 16, wherein the condition information includes at least one of a time when the information of the second user ID is recorded on the second application, and a record of the information of the second user ID on the second application. ### Claim 18 (depends on 16) The system according to claim 16, wherein the at least one processor device is further configured to execute program instructions stored on the at least one computer readable storage medium to: receive an authorization of the second user from a client computer of the second user; and update the condition information to reflect the authorization of the second user. ### Claim 19 (depends on 12) The system according to claim 12, wherein the first authentication request is received from the first application with an authorization of the second user. ### Claim 20 (depends on 19) The system according to claim 19, wherein the authorization of the second user includes a password input by the second user.