Methods, data stores, data structures, and systems for electronic identity aggregation
View Patent ↗Methods, data stores, data structures, and systems provide techniques for aggregating identities. A schema defines an aggregated identity. The aggregated identity includes one or more identifications and one or more attributes. The identifications are acquired from identity authorities defined in the schema. Furthermore, the attributes are acquired from identity sources defined in the schema. One or more of the identifications can comprise a unique identifier or key for the aggregated identity. The aggregated identity can be stored as a record in an identity aggregation data store for rapid access and consumption.
1. A method implemented in a computer-readable medium to aggregate an identity and executed on a computer, the method comprising:
accessing, by the computer, one or more identity authorities and one or more identity stores with a single schema to acquire multiple identifiers and attributes associated with the aggregated identity, the multiple identifiers are information used to represent a single and same electronic resource identified as the aggregated identity, each of the multiple identifiers assigned to a single and same unique identity for the electronic resource and the multiple identifiers for the single and same unique identity are included in the single schema, and the identity authorities are applications that process on the computer, the identity authorities create, manage, control, and distribute the aggregated identity and other aggregated identities; and
assembling, by the computer, the acquired identifiers and attributes to aggregate into the aggregated identity.
2. The method of claim 1 wherein the single electronic resource identified by the aggregated identity is associated with at least one of an application, a resource, an entity, a policy, a decision set, and a user.
3. The method of claim 1 wherein the schema identifies the one or more identity authorities and one or more identity stores and includes logic processed by the computer for assembling the acquired identifiers and the attributes to aggregate the identity.
4. The method of claim 1 wherein the schema is represented as rules in a defined data format.
5. The method of claim 1 wherein the one or more identity authorities store at least one of the identifiers assembled to aggregate the identity.
6. The method of claim 1 wherein the one or more identity stores store at least one of the attributes associated with at least one of the identifiers assembled to aggregate the identity.
7. The method of claim 1 wherein the assembling is automatically performed when changes are detected in one or more of the identity authorities or one or more of the identity stores.
8. The method of claim 1 , further comprising storing, by the computer, the identifiers and the attributes in an identity aggregation data store for subsequent access.
9. An identity aggregation data store implemented in a computer-readable medium, residing in a computer-accessible medium and executed on a computer, the identity aggregation data store comprising:
primary keys associated with first identifications acquired, on the computer, from at least one of one or more external sources;
secondary keys associated with second identifications acquired, on the computer, from at least one of one or more of the external sources; and
attributes associated with the primary and the secondary keys and acquired, on the computer, from at least one of the one or more external sources;
wherein the primary keys, the secondary keys, and the attributes are assembled, on the computer, in fields according to a single aggregate schema that defines aggregate identity records in the identity aggregation data store via the computer, the identity aggregation data store provides access, via the computer, to the aggregated identity records to consuming applications, and wherein each identity aggregation record includes a particular first identification and a particular second identification for a particular identity, each identity aggregation record representing, on the computer, an aggregation of multiple identifiers for a single electronic resource that identifies the particular identity to which it relates, the single aggregate schema includes the particular first and second identifications for the same particular identity.
10. The identity aggregation data store of claim 9 , wherein the one or more external sources include identity authorities and identity sources.
11. The identity aggregation data store of claim 10 , wherein the identity authorities control or distribute, on the computer, one or more of the first and the second identifications.
12. The identity aggregation data store of claim 9 , wherein the aggregate schema is automatically activated and used, via the computer, to populate the aggregate identity records when changes are detected in the one or more external sources.
13. The identity aggregation data store of claim 9 , wherein the aggregate schema is periodically activated and used, via the computer, to populate the aggregate identity records at configured periods.
14. The identity aggregation data store of claim 9 , wherein the attributes are represented, on the computer, as links to external source attribute data residing on at least one of the one or more external sources.
15. The identity aggregation data store of claim 9 , wherein the identity aggregation data store is at least one of a data warehouse, a database, a directory, and an electronic file.
16. An identity aggregation system implemented in a computer-readable medium and executed on a computer, comprising:
a single aggregation schema embodied in a computer-readable medium and processed by the computer;
an identity store embodied in a computer-readable medium and processed by the computer;
an identity authority embodied in a computer-readable medium and processed by the computer; and
an identity aggregation store embodied in a computer-readable medium and processed by the computer;
wherein the single aggregation schema is for defining and formatting records of the identity aggregation store by defining access to the identity authority and to the identity store needed to generate aggregate identities that are stored in the identity aggregation store, and each aggregated identity within the identity aggregation store includes multiple identifiers for a single electronic resource representing a unique identity and those multiple identifiers are to be consumed to identify the unique identity for the single electronic resource, the single aggregation schema includes the multiple identifiers for the same unique identity.
17. The identity aggregation system of claim 16 , wherein the aggregation schema is for defining primary keys for the records of the identity aggregation store, via the computer, each primary key uniquely identifying a specific one of the aggregate identities.
18. The identity aggregation system of claim 16 , wherein the identity aggregation store is capable of being automatically or periodically updated, via the computer, to reflect changes in the identity authority and identity store.
19. The identity aggregation system of claim 16 , wherein at least one of the aggregate identities is a canonical set of decisions that are generated from enforcing a policy on the computer.
20. The identity aggregation system of claim 19 , wherein the canonical set of decisions is ordered according to a desired priority of the policy via the computer.
21. The identity aggregation system of claim 16 , wherein at least one of the aggregate identities is a global policy that includes a plurality of sub-policies.