# US 7,610,390 B2 · Distributed network identity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,610,390 B2
- Document ID: US7610390B2
- Status: Granted
- Kind: B2
- Application number: 10/309,773
- Filed: 2002-12-03
- Published: 2003-08-07
- Granted: 2009-10-27
- Earliest claimed: 2001-12-04
- Assignees: Sun Microsystems, Inc.
- Inventors: Peter Yared; Gary Ellison; Mark Hapner; Larry Abrahams; Sheldon J. Finkelstein; Hal Stern; John D. Beatty; Aravindan Ranganathan; Sai Allavarpu
- Web page: https://patentgrep.com/patent/US7610390B2

## CPC

- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- G06F 21/41: where a single sign-on provides access to a plurality of computers
- H04L 61/4547: {for personal communications, i.e. using a personal identifier}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/102: {Entity profiles}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 63/105: {Multiple levels of security}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A distributed network identity is provided. An identity provider stores a portion of a user's personal information. A service provider accesses user information from one or more identity providers. System entities such as identity providers and service providers can be linked to enable information sharing and aggregation. User policies and privacy preferences are provided to control how information is shared. A single sign-on architecture is provided where an identity provider is used to facilitate cross-domain authentication and to enhance user convenience. Service delegation features are also provided.

## Claims

### Claim 1

A method for establishing a relationship between a first node and a second node, the method comprising:
receiving a first login from a user at the first node;
receiving a second login from the user at the second node;
authenticating the first login at the first node;
authenticating the second login at the second node;
generating a first handle corresponding to a first user account on the first node, the first handle for identifying the user at the first node;
generating a second handle corresponding to a second user account on the second node, the second handle for identifying the user at the second node;
passing the first handle to the second node; and
passing the second handle to the first node, the first handle and the second handle are combinable to identify the first user account on the first node and the second user account on the second node.

### Claim 2 (depends on 1)

The method of claim 1 wherein the first handle and the second handle comprise matching identifiers.

### Claim 3 (depends on 1)

The method of claim 1 further comprising:
storing, on the first node, the second handle in a user directory record associated with the first user account on the first node.

### Claim 4 (depends on 1)

The method of claim 1 further comprising:
storing, on the second node, the first handle in a user directory record associated with the second user account on the second node.

### Claim 5

A method for linking user accounts, the method comprising:
authenticating a user with an identity provider;
receiving, at a service provider, a first handle corresponding to the user;
updating a user directory entry associated with the user to include the first handle; generating a second handle for the user; and
passing the second handle to the identity provider, wherein the first handle and the second handle are combinable to identify an account of the user.

### Claim 6 (depends on 5)

The method of claim 5 wherein the second handle is a pseudonym for an account name.

### Claim 7 (depends on 5)

The method of claim 5 wherein the second handle is dynamically generated.

### Claim 8 (depends on 5)

The method of claim 5 wherein the second handle comprises an e-mail address.

### Claim 9 (depends on 5)

The method of claim 5 wherein the first handle and the second handle together form an identifier for differentiating the user.

### Claim 10 (depends on 5)

The method of claim 5 wherein the passing further comprises:
encrypting the second handle with a key corresponding to the identity provider.

### Claim 11 (depends on 5)

The method of claim 5 wherein the receiving further comprises:
decrypting the first handle with a key corresponding to the service provider.

### Claim 12

A method for linking user accounts, the method comprising:
generating, at an identity provider, a first handle for a user;
sending the first handle to a service provider;
receiving a second handle for the user from the service provider; and
updating a user directory entry associated with the user to include the second handle, wherein the first handle and the second handle are combinable to identify an account of the user.

### Claim 13 (depends on 12)

The method of claim 12 wherein the first handle is a pseudonym for an account name.

### Claim 14 (depends on 12)

The method of claim 12 wherein the first handle is dynamically generated.

### Claim 15 (depends on 12)

The method of claim 12 wherein the first handle comprises an e-mail address.

### Claim 16 (depends on 12)

The method of claim 12 wherein the first handle and the second handle together form a shared secret for differentiating the user.

### Claim 17 (depends on 12)

The method of claim 12 wherein the sending further comprises:
encrypting the first handle with a key corresponding to the service provider.

### Claim 18 (depends on 12)

The method of claim 12 wherein the receiving further comprises:
decrypting the second handle with a key corresponding to the identity provider.