Using opaque groups in a federated identity management environment

A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of promoting user anonymity within a federated identity management system, the system comprising identity providers configured to authenticate users and service providers configured to provide services to the users, the method comprising:

• creating an opaque group at a first identity provider to include multiple users of the federated identity management system, wherein each user has a primary identity within the system;
• storing at the first identity provider an identity of the opaque group, wherein the identity references the primary identities of the member users;
• and
• facilitating the provision of services by the service providers to members of the opaque group without allowing the service providers to know the primary identities of the members of the group.

A computer-implemented method of enabling users within a federated identity management system to access a resource of the system anonymously, the method comprising:

• establishing an identity of an opaque group at a first identity provider within the system;
• configuring said group identity to include identities of members of the group;
• and
• within the system, enabling service providers to provide services to the group without knowledge of the identities of the members of the group.

A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of enabling users within a federated identity management system to access a resource of the system anonymously, the method comprising:

• establishing an identity of an opaque group at a first identity provider within the system;
• configuring said group identity to include identities of members of the group;
• and
• within the system, enabling service providers to provide services to the group without knowledge of the identities of the members of the group.

A federated identity management system in which a service is provided to a group of anonymous users, the system comprising:

• an identity provider configured to authenticate users of the system;
• a service provider configured to:
• receive service requests from users of the system;
• and
• provide requested services to the users based on primary identities associated with the users;
• and
• a group identity stored at the identity provider and associated with an opaque group, wherein:
• said group identity comprises primary identities of members of the opaque group;
• and
• said group identity and not the members' primary identities are releasable to service providers;
• wherein the service provider is further configured to forward to the identity provider requests to provide services to the group.