Identification and authentication management

A computer-implemented method for managing levels of access to a first user's data for at least two users, comprising:

• establishing a control relationship between a first user's authentication credential and a second user's authentication credential, the control relationship allowing the first user to specify at least one parameter of the second user's level of access to a first user's data;
• receiving, from a first user, a message at an authentication server, the first user having an authentication credential with respect to a first user's account used to interact with the first user's data through an application, the message that a second user be granted temporary access to the first user's data through the application;
• receiving, from the second user, a request at the authentication server, the request to access the first user's data through the application;
• and
• responsive to the request from the second user, granting the second user access to the first user's data through the application according to the second user's level of access as specified by the first user, by providing to the application the first user's authentication credential, wherein the first user's authentication credential is obtained from the authentication server and is not provided to the second user.

A system for granting to a second user access to a first user's data in response to a message from a first user, comprising:

• an authenticator communicatively adapted to receive over a network connection authentication credentials of the first and second users and adapted to authenticate each user from the authentication credentials;
• an access level control module, communicatively coupled to the authenticator, for defining for each user a level of access to a first user's data;
• and
• a resource interface, communicatively coupled to the access level control module, for granting the second user access to the first user's data through the resource interface by providing the first user's authentication credential to the authenticator for authentication, wherein the first user's authentication credential is obtained from an authentication server and is not provided to the second user.

In a client/server system for granting to a second user access to a first user's data in response to a message from a first user specifying that the second user be granted access to the first user's data, a server comprising:

• an authenticator, for authenticating each user according to authentication credentials;
• an access level control module, coupled to the authenticator, for defining a level of access to the first user's data for each user;
• and
• a resource interface, coupled to the access level control module, for granting to a client operated by the second user access to the first user's data through the resource interface by providing the first user's authentication credential to the authenticator, wherein the first user's authentication credential is obtained from an authentication server and is not provided to the second user.

A computer program product comprising a computer-usable medium having computer-readable code embodied therein for managing temporary access to a first user's data, comprising:

• computer-readable program code configured to cause a computer to receive a message at an authentication server from a first user, the first user having an authentication credential with respect to the first user's data, the message that a second user be granted temporary access to the first user's data;
• computer-readable program code configured to cause a computer to receive a request at the authentication server from the second user, the request to access the first user's data;
• and
• computer-readable program code configured to cause a computer to, responsive to the request from the second user, obtain the first user's authentication credential and grant the second user temporary access to the first user's data by providing the first user's authentication credential to an authenticator, wherein the first user's authentication credential is obtained from the authentication server and is not provided to the second user.

A computer-implemented computer program product for managing levels of access to a first user's data for at least two users, comprising:

• computer-readable program code configured to cause a computer to establish a control relationship between a first user's authentication credential and a second user's authentication credential, the control relationship allowing the first user to specify at least one parameter of the second user's level of access to a first user's data;
• computer-readable program code configured to cause a computer to receive, from a first user, a message at an authentication server, the first user having an authentication credential with respect to a first user's account used to interact with the first user's data through an application, the message that a second user be granted temporary access to the first user's data through the application;
• computer-readable program code configured to cause a computer to receive, from the second user, a request at the authentication server the request to access the first user's data through the application;
• and
• computer-readable program code configured to cause a computer to, responsive to the request from the second user, grant the second user access to the first user's data through the application according to the second user's level of access as specified by the first user, by providing to the application the first user's authentication credential, wherein the first user's authentication credential is obtained from the authentication server and is not provided to the second user.