Scoped federations

1. A method comprising:

receiving a pre-agreed temporary identifier for a federation, at each of a plurality of security token services associated with each of a plurality of members of the federation;

receiving, at a first security token service, information comprising endpoint information relating to each of the plurality of security token services;

generating a unique identifier for the federation by the first security token service, the generating performed by a processor by taking a hash of data comprising the information and the temporary identifier;

storing, in a memory, the unique identifier associated with the federation;

storing a set of rules scoping said federation associated with said unique identifier;

upon receipt of a message containing said unique identifier, using said set of rules to determine if said message comprises a valid request; and

if said message comprises a valid request, enabling sharing of a resource associated with said federation between members of said federation.

2. A method according to claim 1 , further comprising:

if said message does not comprise a valid request, preventing sharing of said resource associated with said federation.

3. A method according to claim 1 , wherein generating said unique identifier comprises:

forming a block of data comprising said information; and

calculating a hash of said block of data.

4. A method according to claim 1 , further comprising, prior to storing said set of rules:

receiving said set of rules,

wherein said set of rules comprises at least one mapping relating to at least one of: an individual, a resource and an access right.

5. A method according to claim 1 , wherein said message comprises a claim and using said set of rules to determine if said message comprises a valid request comprises:

accessing said set of rules; and

comparing said claim to said set of rules.

6. A method according to claim 1 , wherein enabling sharing of a resource associated with said federation between members of said federation comprises:

generating a security token restricted to said federation; and providing said security token to a sender of said message.

7. A method according to claim 6 , wherein said security token restricted to said federation comprises:

at least one claim; and

a key.

8. A method according to claim 1 , wherein said message comprises a security token and enabling sharing of a resource associated with said federation between members of said federation comprises:

checking the validity of said security token using said set of rules scoping said federation and associated with said unique identifier; and sending a validation response to a sender of said message.

9. A method according to claim 8 , wherein the security token comprises a key, and wherein enabling sharing of a resource associated with said federation between members of said federation further comprises:

extracting said key from said security token; and

sending said key to said resource associated with said federation.

10. One or more computer storage devices with device-executable instructions for performing steps comprising:

receiving a pre-agreed temporary identifier for a federation, at a first security token service associated with a first member of the federation and one or more other security token services associated with one or more other members of the federation;

receiving, at the first security token service, information comprising endpoint information relating to the one or more other security token services;

generating a unique identifier for the federation by the first security token service by taking a hash of data comprising the information, the temporary identifier, and endpoint information relating to the first security token service;

storing the unique identifier associated with the federation;

storing a set of rules scoping said federation associated with said unique identifier;

using said set of rules to determine if a message comprises a valid request; and

if said message comprises a valid request, enabling sharing of a resource associated with said federation between members of said federation.

11. A system comprising:

a first security service associated with a first member of a federation; and

a first store and a second store connected to said first security service, and wherein said first security service is arranged to:

receive a pre-agreed temporary identifier for the federation;

receive information comprising endpoint information relating to another security service associated with another member of the federation;

generate a unique identifier for the federation by a processor by taking a hash of data comprising the information, the temporary identifier, and endpoint information relating to the first security token service;

store the unique identifier associated with said federation in said first store;

store a first set of rules associated with said unique identifier in said second store, said first set of rules scoping said federation and being related to said first member;

upon receipt of a first message containing said unique identifier, use said first set of rules to determine if said first message comprises a valid request; and

if said first message comprises a valid request, enable sharing of a resource associated with said federation between said first and said second member of said federation.

12. The method according to claim 1 , wherein the information comprises a security token associated with at least one of the plurality of security token services.

13. A system according to claim 11 , wherein said first store and said second store are the same.

14. A system according to claim 11 , further comprising:

a second security service associated with said second member of said federation; and a third store and a fourth store connected to said second security service, and wherein said second security service is arranged to store said unique identifier associated with said federation in said third store;

storing a second set of rules associated with said unique identifier in said fourth store, said second set of rules scoping said federation and being related to said second member;

upon receipt of a second message containing said unique identifier, use said second set of rules to determine if said second message comprises a valid request; and

if said second message comprises a valid request, enable sharing of said resource associated with said federation between said first and second members of said federation.

15. A system according to claim 14 , further comprising said resource and wherein said resource is associated with said second member and said second message is received from said resource.

16. A system according to claim 15 , wherein said first security service is further arranged to:

generate a security token restricted to said federation; and provide said security token to a sender of said first message.

17. A system according to claim 16 , wherein said second message comprises said security token and wherein said second security service is further arranged to:

check the validity of said security token using said second set of rules scoping said federation and associated with said unique identifier; and send a validation response to said resource.

18. A system according to claim 17 , wherein said second message comprises said security token and said security token comprises a key, and wherein said second security service is further arranged to:

extract said key from said security token; and

send said key to said resource; and wherein said resource is arranged, upon receipt of said validation response, to send an authenticated and encrypted message to said sender of said first message using said key.

19. A system according to claim 17 , wherein said resource is arranged, upon receipt of said validation response, to:

process said validation response; and

if said validation response is positive, to provide access to said sender of said first message.