US 2009/0158393 A1 · Delegation of user's consent in federation of services and identity providers

Abstract

The present invention is aimed to provide a mechanism whereby any person can have user's attributes in a web service provider for sharing with a web service consumer, even if such person is not enabled to provide user's consent to share such user's attributes, and provided that other persons at a hierarchically higher position are enabled to provide such user's consent instead of the owner of the user's attributes, whilst respecting high requirements on privacy for both. Therefore, the present invention provides for a number of cooperating entities and a new method, the cooperating entities being configurable in such manner that delegation modules comprising different relationships of user's consent may be distributed among some of the cooperating entities, and transmitted between the number of cooperating entities, depending on the required level of privacy set on a per network basis and on a per user basis.

Claims20

Dependent claims

A Discovery Service device (IdP-DS) suitable for holding a resource offering associated with an attribute of a given user (Principal A) and for providing the resource offering to a web service consumer server (WSC), the attribute being available at a web service provider server (WSP) and the resource offering comprising a reference to address the web service provider server (WSP), the Discovery Service device (IdP-DS) having:

an input unit (U-11) for receiving a query (S-01) from the web service consumer server (WSC) asking for a resource offering;
and
an output unit (U-12) for providing (S-02;
S-12) the resource offering to the web service consumer server (WSC);
and characterized in that it further comprises:
a processing unit (U-20) for determining whether user's consent by a second user (Principal B) other than the given user (Principal A) is required before obtaining (S-06) the attributes of the given user (Principal A) from the web service provider server (WSP).

3 more elements

A web service consumer server (WSC) suitable for acting as an attribute requestor for attributes of a given user (Principal A) available at a web service provider server (WSP) acting as an attribute provider, the web service consumer server (WSC) having:

a first output unit (U-51) for sending a query (S-01) to a Discovery Service device (IdP-DS) asking for a resource offering associated with an attribute of a given user (Principal A), the resource offering comprising a reference to address the web service provider server (WSP);
a first input unit (U-52) for receiving (S-02;
S-12) the resource offering from the Discovery Service device (IdP-DS);
a second output unit (U-53) for sending a request (S-03;
S-13) to the web service provider server (WSP) for an attribute of the given user (Principal A);
and
a second input unit (U-54) for receiving (S-06) the requested attribute of the given user (Principal A) from the web service provider server (WSP);
and characterized in that:
the first input unit (U-52) includes means (U-55) for receiving (S-12) an indication on that user's consent by a second user (Principal B) other than the given user (Principal A) is required;
and
the second output unit (U-53) includes means (U-55) for sending (S-13) the indication on that user's consent by a second user (Principal B) other than the given user (Principal A) is required towards the web service provider server (WSP).

8 more elements

A method for delegating user's consent to share an attribute of a given user (Principal A) to a second user (Principal B) other than the given user, the attribute being available at a web service provider server (WSP) acting as an attribute provider for being shared with at least one web service consumer server (WSC) acting as an attribute requestor, the method including the steps of:

registering a resource offering associated with an attribute of a given user (Principal A) at a Discovery Service device (IdP-DS), the resource offering comprising a reference to address the web service provider server (WSP);
querying (S-01) the Discovery Service device (IdP-DS) from the web service consumer server (WSC) to ask for the resource offering;
providing (S-02;
S-12) the resource offering to the web service consumer server (WSC);
requesting (S-03;
S-13) from the web service consumer server (WSC) to the web service provider server (WSP) the attribute of the given user (Principal A);
and
receiving (S-06) at the web service consumer server (WSC) the requested attribute of the given user (Principal A) from the web service provider server (WSP);
and characterized in that it further comprises the steps of:
indicating (S-13;
S-23) to the web service provider server (WSP) that user's consent by a second user (Principal B) other than the given user (Principal A) is required;
and
asking (S-14, S-15;
S-24, S-25, S-26, S-27) for user's consent to the required second user (Principal B) other than the given user (Principal A).

11 more elements

Dependencies are inferred from the claim text.

Delegation of user's consent in federation of services and identity providers

Life of this patent

Delegation of user's consent in federation of services and identity providers

Life of this patent

Abstract

Claims20