System and a method for managing digital identities

2:

• A system according to claim 1, wherein the access rules are selected from a plurality of at least two, such as at least three or such as at least four different access rules.

3:

• A system according to claim 1, wherein an identity comprises at least two sets of data, and wherein one of said sets of data has at least one corresponding access rule being different to the corresponding access rule(s) of the other sets of data.

4:

• A system according to claim 3, wherein the data structure of an identity comprises at least three sets of data, and wherein each of two of said sets of data has at least one corresponding access rule being different to the corresponding access rule(s) of the other sets of data.

5:

• A system according to claim 1, wherein the plurality of access rules comprises access rules representing different levels or categories of authentication of a person, an entity and/or server site requesting access to a set of data of a stored identity.

6:

• A system according to claim 1, wherein an access rule is given or identified by an access category.

7:

• A system according to claim 6, wherein an access category represents one of the categories:
• public, friend, merchant and/or private.

8:

• A system according to claim 1, wherein an identity comprises a set of data having a corresponding access rule holding information of a selected number of persons, entities and/or server sites being allowed access via said access rule to the information of said set of data.

9:

• A system according to claim 8, wherein said persons, entities and/or server sites being allowed access are represented by corresponding Personal Domain Names, PDNs, and/or Uniform Resource Locators, URLs.

10:

• A system according to claim 1, wherein at least part or all of the sets of data are items.

11:

• A system according to claim 1, wherein the sets of data or items are represented in an SQL database.

12:

• A system according to claim 11, wherein the sets of data or items are represented as an XML structure.

13:

• A system according to claim 6, wherein an access category is organised in an access category field of the corresponding set of data or item.

14:

• A system according to claim 1, wherein the identity information data of a set of data or an item is organised in a type field and/or a value field.

15:

• A system according to claim 1, wherein the system comprises a plurality of identity servers.

16:

• A system according to claim 1, wherein the plurality of different access rules comprises an access rule allowing an identity server to grant any non-authenticated person and/or entity access to a corresponding set of data.

17:

• A system according to claim 1, wherein the plurality of different access rules comprises one or more access rules allowing an identity server to grant only persons and/or entities being authenticated according to a defined authentication process access to the set(s) of data corresponding to the access rule(s).

18:

• A system according to claim 17, wherein an identity server hosting a stored identity having a so-called private set of data is adapted to only grant access to said private set of data to the owner of said stored identity upon authentication of the owner towards the hosting identity server.

19:

• A system according to claim 18, wherein said authentication is performed via a client device, said client device thereby being granted access to the private set of data.

20:

• A system according to claim 19, wherein the client device is granted access to the private set of data within a limited time after the authentication.

21:

• A system according to claim 15, wherein at least part of the network servers are adapted to communicate or interact with an identity server storing an identity having an owner, so that when the owner of the stored identity has been authenticated towards the hosting identity server, said part of the network servers can perform a verification of the authentication of the identity owner by communicating or interacting with the hosting identity server.

22:

• A system according to claim 21, wherein said servers being adapted for performing said verification comprises one or more identity servers and/or one or more merchant servers.

23:

• A system according to claim 21, wherein said identity owner can be granted access to one or more sets of data stored or hosted at a server having performed said verification.

24:

• A system according to claim 23, wherein said identity owner can be granted access to one or more sets of data of an identity hosted at an identity server having performed said verification.

25:

• A system according to claim 22, wherein the identity owner can be granted access to one or more sets of data stored or hosted at a merchant server upon said verification.

26:

• A system according to claim 25, wherein the identity owner can be granted access to a set of data comprising an account of the identity owner.

27:

• A system according to claim 17, wherein one or more network servers are adapted to be authenticated towards an identity server hosting an identity, said servers thereby being granted access to one or more sets of data of said identity, said set(s) of data having access rules being fulfilled by said authentication.

28:

• A system according to claim 1, wherein a network server is adapted to be authenticated towards an identity server hosting one or more identities, and wherein said network server when being authenticated may request access to information from an identity having an owner and stored at said hosting identity server, which information has not yet being given an access rule allowing access to the authenticated server, said hosting identity server being adapted to forward a request to the identity owner to temporarily or permanently grant access to the information to the authenticated server.

29:

• A system according to claim 28, wherein the request for granting access to the authenticated server is forwarded to a client device being used by the identity owner.

30:

• A system according to claim 29, wherein the identity owner is authenticated towards said hosting identity server via said client device.

31:

• A system according to claim 27, wherein a network server is a merchant server authenticating itself towards the hosting identity server by means of an X509 certificate and using a SSL protocol.

32:

• A system according to claim 1, wherein a communication from a client device or server to an identity server storing a given identity is established by forwarding the name string of the given identity from the client device or server into the namespace, said name string being received by a name server hosting said name string and hosting the address of the identity server storing the given identity, said identity server address being forwarded via the hosting name server to said client device or server wishing to communicate with the identity server storing the given identity.

33:

• A system according to claim 1, wherein an identity server is adapted to forward one or more sets of data of a stored identity to a client device or server being granted access to said one or more sets of data.

34:

• A system according to claim 1, wherein an identity server storing an identity is adapted to receive a message to the owner of the stored identity and to forward said message to a client device or server being used by the identity owner.

35:

• A system according to claim 1, wherein the owner of a stored identity is allowed to change the information of said identity or to store information at said identity upon authentication of the owner towards the hosting identity server.

36:

• A system according to claim 35, wherein said authentication is performed via a client device, said client device thereby being granted access to the identity of the owner.

37:

• A system according to claim 36, wherein the client device is granted access to the owned identity within a limited time after the authentication.

38:

• A system according to claim 1, wherein the name servers function according to the Domain Name System, DNS, of the Internet.

39:

• A system according to claim 1, wherein a name string is a personal domain name, PDN, reserved within the Domain Name System, DNS, so as to make it distinguishable from all other name strings reserved within the Domain Name System.

40:

• A system according to claim 1, wherein the plurality of access rules includes an access rule being at least partly fulfilled by an authentication process comprising the provision of a password.

41:

• A system according to claim 1, wherein the plurality of access rules includes an access rule being at least partly fulfilled by an authentication process comprising the provision of a smart card.

42:

• A system according to claim 1, wherein an authentication of an identity owner towards a server hosting the owned identity is performed in relation to the corresponding name string of the identity.

43:

• A system according to claim 1, wherein the access rules of a given identity are specified by the owner of said given identity.

44:

• A system according to claim 1, wherein the amount of identity information of a given identity being accessible via a corresponding access rule is specified by the owner of said given identity.

45:

• A system according to claim 1, wherein access to information or sets of data of a stored identity can be requested from all or at least part of the client devices of the network.

46:

• A system according to claim 1, wherein access to information or sets of data of a stored identity can be requested from all or at least part of the servers or server devices of the network.

47:

• A system according to claim 1, wherein when the owner of an identity has been authenticated towards the hosting identity server, the hosting identity server forwards a token for later verification to the client device from which the owner is communicating with the hosting identity server.

48:

• A system according to claim 47, wherein said verification token or a token derived from said verification token may be forwarded from the owners client device to other identity servers or network servers, whereby said other identity servers or network servers may use the obtained verification token or derived token for having the hosting identity server verifying that the owner has been properly authenticated.

49:

• A system according to claim 47, wherein said verification token and/or derived token has the form of a unique and/or unpredictable number or bit string.

50:

• A system according to claim 1, wherein the identity servers are managed on a corporate, sub-national, national or regional level, and inter-operated by means of common protocols.

51:

• A system according to claim 1, wherein the network of clients or servers is a national, a regional or a global network.

52:

• A system according to claim 1, wherein the name string acts as a global address.

55:

• A system according to claim 54, wherein each identity has at least part of said information data being structured as a number of sets of data with at least part of said sets of data having one or more corresponding access rules selected from a plurality of different access rules, said access rules of a given identity being enforced by the identity server storing said given identity.