# US 9,521,131 B2 · Remote access of digital identities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,131 B2 - Document ID: US9521131B2 - Status: Granted - Kind: B2 - Application number: 14/176,782 - Filed: 2014-02-10 - Published: 2014-07-31 - Granted: 2016-12-13 - Earliest claimed: 2007-01-26 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: John Shewchuk; Kim Cameron; Arun Nanda; Xiao Xie - Web page: https://patentgrep.com/patent/US9521131B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 21/33: using certificates - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for controlling distribution and use of digital identity representations (“DIRs”) increases security, usability, and oversight of DIR use. A DIR stored on a first device may be obtained by a second device for use in satisfying the security policy of a relying party. Release of the DIR to the second device requires permission from a device or entity that may be different from the device or entity attempting to access the relying party. Further, the use of the DIR to obtain an identity token may separately require permission of even a different person or entity and may be conditioned upon receiving satisfactory information relating to the intended use of the DIR (e.g., the name of the relying party, type of operation being attempted, etc.). By controlling the distribution and use of DIRs, security of the principal's identity and supervisory control over a principal's activities are enhanced. ## Claims ### Claim 1 A method of using a digital identity representation, comprising: sending, from a second device, a request to a relying party for authentication requirements of the relying party; sending to a first device a request from the second device to obtain the digital identity representation based on the authentication requirements of the relying party; receiving at the second device the digital identity representation, the digital identity representation including metadata describing at least a first claim about a principal; sending from the second device a request to use the digital identity representation; receiving at the second device permission to use the digital identity representation; using the digital identity representation to request an identity token; receiving the identity token; and providing the identity token to the relying party. ### Claim 2 (depends on 1) The method of claim 1, wherein the request to use the digital identity representation is sent to a third device that is different from the first and second devices. ### Claim 3 (depends on 1) The method of claim 1, wherein the request to use the digital identity representation is sent to a device that is controlled by a person other than the principal. ### Claim 4 (depends on 1) The method of claim 1, wherein the request to use the digital identity information includes information identifying the relying party. ### Claim 5 A system for using a digital identity representation, comprising: at least one processor; memory, operatively connected to the at least one processor and including instructions that, when executed by the at least one processor, cause the at least one processor to: send, from a second device, a request to a relying party for authentication requirements of the relying party; send to a first device a request from the second device to obtain the digital identity representation based on the authentication requirements of the relying party; receive at the second device the digital identity representation, wherein the digital identity representation includes metadata describing at least a first claim about a principal; send from the second device a request to use the digital identity representation; receive at the second device permission to use the digital identity representation; use the digital identity representation to request an identity token; receive the identity token; and provide the identity token to the relying party. ### Claim 6 (depends on 5) The system of claim 5, wherein the request to use the digital identity representation is sent to a third device that is different from the first and second devices. ### Claim 7 (depends on 5) The system of claim 5, wherein the request to use the digital identity representation is sent to a device that is controlled by a person other than the principal. ### Claim 8 (depends on 5) The system of claim 5, wherein the request to use the digital identity information includes information identifying the relying party. ### Claim 9 (depends on 5) The system of claim 5, wherein the digital identity representation is programmed to signal to an identity provider receiving the digital identity representation that permission to use the digital identity representation must be obtained from a particular person before the identity provider is permitted to provide the requesting device with an identity token. ### Claim 10 (depends on 5) The system of claim 5, wherein the digital identity representation is programmed to signal to an identity provider receiving the digital identity representation that permission to use the digital identity representation must be obtained from a particular device before the identity provider is permitted to provide the requesting device with an identity token. ### Claim 11 (depends on 5) The system of claim 5, wherein the request for permission to use the digital identity representation requires an indication of acceptance from a person controlling the device to which the request for permission is sent. ### Claim 12 (depends on 5) The system of claim 5, wherein permission to use the digital identity representation is contingent upon providing information regarding the intended use of the digital identity representation. ### Claim 13 (depends on 12) The system of claim 12, wherein the information regarding the intended use of the digital identity representation comprises the name of the relying party. ### Claim 14 (depends on 5) The system of claim 5, wherein permission to use the digital identity representation is received before the digital identity representation is sent to an identity provider. ### Claim 15 (depends on 5) The system of claim 5, wherein the digital identity representation is sent to an identity provider, and the identity provider requests and receives permission to use the digital identity representation prior to providing the identity token. ### Claim 16 (depends on 5) The system of claim 5, wherein receiving the identity token comprises receiving a pointer to the identity token that the relying party can use to obtain the identity token from another device. ### Claim 17 (depends on 5) The system of claim 5, wherein the request to obtain and use the digital identity representation are made simultaneously to a single device. ### Claim 18 (depends on 1) The method of claim 1, wherein the digital identity representation is sent to an identity provider, and the identity provider requests and receives permission to use the digital identity representation prior to providing the identity token. ### Claim 19 (depends on 1) The system of claim 1, wherein the digital identity representation is programmed to signal to an identity provider receiving the digital identity representation that permission to use the digital identity representation must be obtained from a particular device before the identity provider is permitted to provide the requesting device with an identity token. ### Claim 20 (depends on 1) The system of claim 1, wherein the digital identity representation is programmed to signal to an identity provider receiving the digital identity representation that permission to use the digital identity representation must be obtained from a particular person before the identity provider is permitted to provide the requesting device with an identity token.