Identity management with high privacy features

摘要

Aspects of the subject matter described herein relate to identity technology. In aspects, a user device sends a request for access to a service. In response, the service directs the user device to a user agent that may be downloaded or that may already exist on the user device. The user agent includes code that executes on the user device to create a security boundary. The security boundary controls transmission of identity information that may be used to identify a user of the device.

主权项

1. A method implemented at least in part by a computer, the method comprising:
sending a request to a relying party to gain access to a service provided by the relying party; in response to the request, receiving a document and redirection data that indicates a source for a user agent; executing code of the user agent to erect a privacy boundary to control transmission of identity information; determining, via the code and the document, a claim required by the relying party to gain access to the service; obtaining a partially signed claim from a claims provider trusted by the relying party; under control of the code, using a function or data provided by claims provider to create a fully signed claim from the partially signed claim; and providing evidence of the fully signed claim to the relying party to gain access to the service.