WO2009127163A1

WO2009127163A1 - Method for user attribute query, method and equipment for providing service

Info

Publication number: WO2009127163A1
Application number: PCT/CN2009/071342
Authority: WO
Inventors: 杨健; 王雷; 董挺
Original assignee: 深圳华为通信技术有限公司
Priority date: 2008-04-18
Filing date: 2009-04-17
Publication date: 2009-10-22
Also published as: CN101562627A

Abstract

A method for user attribute query includes: receiving a query request for the attributes of a second user sent by service provider equipment, wherein said attribute query request includes identity information of the first user and identity information of the second user; judging whether the first user is authorized to query the attributes of the second user; performing the attribute query and returning the obtained second user's attribute information to the service provider equipment if the result of the judgment is that the first user is authorized.

Description

User attribute query method, service providing method and device

This application claims priority to Chinese Patent Application No. 200810093789.4, entitled "Method for Querying User Attributes, Method and Equipment for Providing Services", filed on April 18, 2008, the entire contents of which are hereby incorporated by reference. Combined in this application.

Technical field

The present invention relates to the field of communications, and in particular, to a method for querying user attributes, a method and device for providing a service.

Background technique

The OMA Web Service (OWSER) 1.1 defines how to expose, discover and use OMA applications with Web Service technology. OMA Web Servicel.l lists parameters for access, authentication and authorization, enabling developers to ensure the integrity of data and the transmission of confidential data. In addition, the user can also find the registered original code and service description without using OMA Web Service. Web Services Network Identity ( OMASER NI ) 1.0 provides a variety of protocols and services that enable OMA services and applications to have a federated identity in the Ligerty web services environment.

The Web Service architecture is based on interactions between three roles (service providers, service registries, and service requesters). Interaction involves publishing, finding, and binding operations. These roles and operations work together for Web service artifacts: Web services software modules and their descriptions. Typically, a service provider hosts a software module (an implementation of a Web service) that is accessible over the network. The service provider defines the service description of the web service and publishes it to the service requester or service registry. The service requester uses the lookup operation to retrieve the service description from the local or service registry, then binds to the service provider using the service description, and invokes or interacts with the web service implementation. The service provider and service requester roles are logical structures, so the service can represent two characteristics. The diagram below shows these operations, as well as the components that provide these operations and the interactions between them.

For an application that utilizes a Web service, three actions must occur: Publish the service description, query or find the service description, and bind or invoke the service based on the service description. These behaviors can occur in a single or recurring manner. These operations are specifically:

Publishing: In order for a service to be accessible, a service description needs to be published so that the service requester can look it up. The location where the service description is published can vary depending on the requirements of the application. Find: In a lookup operation, the service requester retrieves the service description directly or queries the service registry for the type of service required. For service requesters, lookup operations may be involved in two different lifecycle phases: The interface description of the service is retrieved at design time for program development, and the binding and location description of the service is retrieved at runtime for the call.

Binding: Finally, you need to call the service. In a bind operation, the service requester uses the binding details in the service description to locate, contact, and invoke the service, thereby invoking or initiating interaction with the service at runtime.

In the prior art solution, when a user completes a certain service by using an SP, it needs to authenticate by an identity provider (IdP) and complete the query of the user attribute.

In the research and practice of the prior art, the inventor found that the prior art has the following problems: When a user completes a service through the SP, it is necessary to query the attribute provider for the query, and the content of the query is the login user. I have relevant information; because the currently provided service can only query the relevant attribute information of the person, and cannot query the attribute information of other users. In fact, there is a need for one user to order a certain service or product instead of another user. For example: User A replaces User B to order a movie ticket on the network, but because the order cannot query the user. Information about B will not be able to complete the order.

Summary of the invention

The technical problem to be solved by the embodiment of the present invention is to provide a method for querying a user attribute, a method and a device for providing a web service, and can perform querying on user attribute information of other users.

The embodiment of the invention provides a method for querying user attributes, including:

Receiving, by the service provider device, an attribute query request for the second user; the attribute query request includes the user identity information of the first user and the user identity information of the second user;

Determining whether the first user has the right to query the attribute of the second user; if the result of the determining is that the right is privileged, performing an attribute query and returning the attribute information of the queried second user to the service provider device.

An embodiment of the present invention provides a method for providing a service, including:

Receiving a service request sent by the first user for the second user; the service request includes user identity information of the first user and user identity information of the second user; Sending an attribute query request to the second user to the attribute provider device; the attribute query request includes user identity information of the first user and user identity information of the second user;

Receiving attribute information of the second user returned when the attribute provider device determines that the first user has the right to query the attribute of the second user;

Providing a service to the second user according to the second user attribute information.

An embodiment of the present invention provides an attribute provider device, including: a query request receiving unit, configured to receive an attribute query request for a second user sent by a service provider device; and the attribute query request includes user identity information of the first user And user identity information of the second user;

a determining unit, configured to determine whether the first user has the right to query the attribute of the second user; the attribute querying unit is configured to: in the determining result of the determining unit, the first user has the right to query the second Querying attributes of the second user when the attributes of the user are

And a feedback unit, configured to return attribute information of the second user that is queried by the attribute query unit to the service provider device.

An embodiment of the present invention provides an identity authentication provider device, including: an identity authentication unit, configured to authenticate a user identity, and receive a request of the authenticated user; and combine the identity information of at least two users to obtain a joint Information

a storage unit, configured to save the joint information;

An information feedback unit, configured to: when the service provider device receives the identity authentication request from the service provider, in the storage unit, whether the user has joint information, and if yes, return the user association information to the Service provider equipment.

The embodiment of the invention provides a service providing system, which includes:

a service provider device, configured to receive a service request sent by the first user for the second user; the service request includes user identity information of the first user and user identity information of the second user; and sending according to the service request An attribute query request for the second user; the attribute query request includes user identity information of the first user and user identity information of the second user; the service provider device is further configured to obtain the second user After the attribute information, the second user is served according to the second user terminal attribute information; An attribute provider device, configured to receive an attribute query request for the second user sent by the service provider device, to determine whether the first user has the right to query the attribute of the second user; If there is permission, the attribute query of the second user is performed, and the attribute information of the second user that is queried is returned to the service provider device.

A service provider device, comprising:

a receiving unit, configured to receive a service request sent by the first user for the second user, where the service request includes user identity information of the first user and user identity information of the second user;

a query unit, configured to send, according to the service request received by the receiving unit, an attribute query request to the second user to the attribute provider device; the attribute query request includes user identity information of the first user and a user of the second user Identity Information;

a service providing unit, configured to receive attribute information of the second user fed back by the attribute provider device, and serve the second user according to the second user terminal attribute information.

The technical solution of the present invention is that the attribute provider device receives the attribute query request for the second user sent by the service provider device in the embodiment of the present invention; the attribute query request includes the first user. The user identity information and the user identity information of the second user; the attribute provider device determines whether the first user has the right to query the attribute of the second user; if the result of the determination is that the right is, the attribute provider device Performing an attribute query and returning the attribute information of the queried second user to the service provider device. Through the technical solution of the embodiment of the present invention, the user can query the attribute information of other users, and then one user can help other users complete the corresponding service, increase the diversity of the service provided by the SP for the user, enhance the user experience, and improve the user experience. Service efficiency.

DRAWINGS

1 is a flowchart of a method for querying a user attribute according to an embodiment of the present invention;

2 is a flowchart of a method for querying a user attribute according to Embodiment 2 of the present invention;

3 is a flowchart of a method for providing a Web service according to Embodiment 3 of the present invention;

4 is a schematic diagram of a logical structure of an attribute provider device according to Embodiment 4 of the present invention;

FIG. 5 is a schematic diagram of a logical structure of a determining unit according to Embodiment 4 of the present invention; FIG. 6 is a schematic diagram of another logical structure of a determining unit according to Embodiment 4 of the present invention;

FIG. 8 is a schematic diagram of a logical structure of an identity authentication provider device according to Embodiment 4 of the present invention; FIG. 8 is a schematic diagram of a logical structure of an identity authentication provider device according to Embodiment 5 of the present invention; Schematic diagram of the logical structure of the service delivery system;

10 is a signaling diagram between entities in a method for querying user attributes according to a seventh embodiment of the present invention; FIG. 11 is a signaling diagram between entities in a method for querying user attributes according to an embodiment of the present invention; Signaling diagram between entities of the method of user attribute query.

detailed description

The embodiment of the invention provides a method for querying a user attribute, a method and a device for providing a service, and can implement a query for a user to attribute information of other users.

The user attribute query method, the method and device for providing the service provided by the present invention are described in detail below.

Embodiment 1 A method for querying a user attribute, which is shown in FIG. 1 and includes:

B1, the attribute provider device receives an attribute query request for the second user sent by the service provider device, where the attribute query request includes the user identity information of the first user and the user identity information of the second user;

B2: The attribute provider device determines whether the first user has the right to query the attribute of the second user; if yes, proceed to step B3; if not, proceed to step B4.

B3. The attribute provider device performs an attribute query and returns the queried attribute information of the second user to the service provider device.

B4, notifying the service provider device that there is no permission to query.

The technical solution of the first embodiment of the present invention can implement the query of the user attribute information of other users, and then one user can help other users complete the corresponding service to provide corresponding services for other users after logging in to the SP, and the SP is added to provide the user with the corresponding service. The diversity of services enhances the user experience and improves service efficiency.

Embodiment 2 A method for querying a user attribute, which is shown in FIG. 2, and includes:

C1. The service provider device receives a service request sent by the first user for the second user. The service request includes second user identity information;

C2, the service provider device interacts with the identity authentication provider device to authenticate the identity information of the first user, if the authentication is passed, proceed to step C4, and if the authentication fails, proceed to step C3;

In the embodiment of the present invention, the process of authenticating the identity information of the first user includes: sending a user authentication request to the user identity authentication provider device to the service provider device; the user identity authentication provider device The first user authenticates and returns the authentication result.

C3, failing to provide the service to notify the first user that the authentication fails.

C4, the service provider device sends an attribute query request to the second user to the attribute provider device; the attribute query request includes the identity information of the second user;

It will be appreciated that the service provider can interact with the discovery server to obtain the address of the attribute provider device. The present invention emphasizes that the existing service provider device has the ability to obtain and communicate with the address of the attribute provider device, and the manner of how to obtain the attribute provider can be implemented in a conventional manner. .

C5: The attribute provider device determines whether the first user has the right to query the attribute of the second user; if yes, proceed to step C6; if not, proceed to step C7.

In the embodiment of the present invention, the determining whether the first user has the permission may take a plurality of manners. The following is a list of possible ways, and the specific manner does not constitute a limitation of the present invention.

method one:

The attribute provider device sends an authentication request to the second user; the authentication request includes user identity information of the first user;

The second user determines whether the first user equipment has a right to query attributes; and returns the determined result to the attribute provider device.

In the foregoing manner 1, the attribute provider device confirms the query authority of the first user to the second user, and the signaling between the attribute provider device and the second user device may be performed through the interaction server. Convert to communicate.

Manner 2: the attribute provider device compares the identity information of the first user with the related attribute access permission list of the second user; if the identity information of the first user belongs to the related attribute access permission list, Determining that the first user has permission to query.

It can be understood that, for the related attribute access permission list is saved in the attribute provider device, the user can interact with the attribute provider device to configure the related attribute access permission list, which specifically includes:

The first user and the second user perform negotiation and authentication, and after the authentication is performed, the second user configures a related attribute access permission list for the first user; the related attribute access list is saved in the attribute provider device. . The configuration here may be to generate an access list for related attributes or to add or modify an existing related attribute access list.

For a more detailed description of the associated attribute access list, see Example 9.

Method three:

The attribute provider device determines whether the attribute query request for the second user sent by the service provider device includes the joint information of the first user and the second user; if yes, determining the The first user has permission.

It can be understood that the joint information of the first user and the second user may be pre-configured by the user through a specific channel, for example:

Before the service provider device receives the service request sent by the first user for the second user, the method includes:

The identity authentication provider device associates the identity information of the first user with the identity information of the second user and saves the joint information;

The joint information may be used to prove the trust relationship between the second user and the first user. The joint information may include: a binding relationship between the identity information of the first user and the identity information of the second user; : the type of attribute information that the second user opens to the first user, and the like.

Step C2, the service provider device interacts with the identity authentication provider device, The process of authenticating a user may further include:

The identity authentication provider device searches for whether the first user has joint information; if yes, returns the joint information to the service provider device;

The joint information is included in the attribute query request for the second user sent by the receiving service provider device.

C6. The attribute provider device performs an attribute query and returns the queried attribute information of the second user to the service provider device.

C7, notifying the service provider device that there is no permission to query.

In the embodiment of the present invention, when the user queries the attribute of a certain user and the attribute that is consulted is the content that can be consulted only when the user agrees, the problem of trust confirmation between the users is fully considered. If the user consults other user attribute information, three specific preferred implementation methods are given to the user's query authority, and the constraints of the trust relationship between the users are explained. The technical solution of the present invention is better achieved.

Embodiment 3 is a method for providing a service. The flowchart is shown in FIG. 3, and includes:

D1, the service provider device receives the service request sent by the first user for the second user; the service request includes the user identity information of the first user and the user identity information of the second user; After receiving the service request sent by the first user for the second user, the method further includes: the service provider device authenticating the identity information of the first user, and if the authentication is passed, continuing the step D2.

The process of specifically authenticating the first user may include:

Sending a user authentication request to the user identity provider device;

The user identity provider device authenticates the first user and returns an authentication result.

It is to be understood that, after the user identity authentication provider device is sent to the user authentication request, the embodiment of the present invention may further include:

Receiving, when the identity authentication provider searches for the first user to have joint information, returning Joint information of the first user and the second user;

The joint information is included in the attribute query request sent to the attribute provider device for the second user. In general, the joint information may be returned along with the authentication result of the first user.

D2, the service provider device sends an attribute query request to the second user for the attribute provider device; the attribute query request includes user identity information of the first user and user identity information of the second user;

D3, the attribute provider device determines whether the first user has the right to query the attribute of the second user; if yes, proceed to step D5, if otherwise, continue to step D4;

D4, failing to provide the service to notify the first user that the authentication fails.

D5, the attribute provider device performs an attribute query and returns the attribute information of the queried second user to the service provider device;

D6. After obtaining the attribute information of the second user, the service provider device serves the second user according to the second user terminal attribute information.

It can be understood that, after the step D6, the method may include: returning, by the service provider device, a result of the service to the first user.

It will be understood by those skilled in the art that all or part of the steps of implementing the foregoing embodiments may be performed by a program to instruct related hardware, and the program may be stored in a computer readable storage medium. , including the following steps:

The attribute provider device receives an attribute query request for the second user sent by the service provider device; the attribute query request includes the user identity information of the first user and the user identity information of the second user; the attribute provider device determines the first Whether a user has the right to query the attribute of the second user; if the result of the determination is that the right is privileged, the attribute provider device performs an attribute query and returns the queried attribute information of the second user to the service provider. device.

The above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Embodiment 4 is an attribute provider device 500. The logical structure diagram is as shown in FIG. 4, and includes: a query request receiving unit 510, a determining unit 520, an attribute query unit 530, and a feedback unit 540. The query request receiving unit 510 is configured to: Receiving a genus of the second user sent by the service provider device a query request; the attribute query request includes user identity information of the first user and user identity information of the second user;

The determining unit 520 is configured to determine, according to the determining, whether the first user has the right to query the attribute of the second user; if the result of the determining is that the right is, the notification attribute query unit 530 queries and queries the second user. Attribute

The attribute query unit 530 is configured to perform an attribute query according to the notification of the determining unit. The feedback unit 540 is configured to return the attribute information of the second user that is queried by the attribute query unit 530 to the service provider device.

In this embodiment, the determining unit 520 can adopt different judgment manners.

Referring to FIG. 5, a schematic diagram of the logical structure of the determining unit 520 is shown;

The determining unit 520 may include: a list holding unit 521 and a comparing unit 522;

The list holding unit 521 is configured to save a list of related attribute access rights of the second user;

The comparing unit 522 is configured to compare the identity information of the first user with the related attribute access permission list of the second user saved by the list holding unit 521, if the identity information of the first user belongs to the The related attribute access permission list determines that the first user has permission to query.

Referring to FIG. 6 , another logical structure diagram of the internals of the determining unit is provided. The determining unit includes: 520: an authentication requesting unit 523 and an authentication response receiving unit 524. The authentication requesting unit 523 is configured to: Sending an authentication request to the second user; the authentication request includes user identity information of the first user;

The authentication request response unit 524 is configured to receive an authentication result returned by the second user equipment, where the authentication result indicates whether the first user has the right to query the attribute of the second user.

Referring to FIG. 7, FIG. 7 is another schematic diagram of the internal structure of the judging unit; the judging unit includes 520: joint information checking unit 525 and decision unit 526;

The joint information checking unit 525 is configured to check whether the first user and the second user are jointly included in the attribute query request of the second user received by the query request receiving unit. Joint information; and send the inspection result to the decision unit;

The determining unit 526 is configured to notify the query unit to perform an attribute query of the second user when the check result of the checking unit is that the joint information exists.

Embodiment 5, an identity authentication provider device 900, a schematic structural diagram shown in FIG. 8, comprising: an identity authentication unit 910, a storage unit 920, and an information feedback unit 930;

The identity authentication unit 910 is configured to authenticate the identity of the user, and receive the request of the authenticated user; combine the identity information of the at least two users, and save the joint information to the storage unit 920;

The storage unit 920 is configured to save joint information.

The information feedback unit 930 is configured to: when the service provider device receives the identity authentication request from the service provider, search, in the storage unit 920, whether the user has joint information, and if yes, return the user association information to The service provider device.

Embodiment 6, a service providing system, a logical structure diagram shown in FIG. 9, comprising: a service provider device 1010 and an attribute provider device 1020;

The service provider device 1010 is configured to receive a service request sent by a first user for a second user, where the service request includes user identity information of the first user and user identity information of the second user; The provider device 1020 sends an attribute query request to the second user; the attribute query request includes user identity information of the first user and user identity information of the second user; the service provider device is further configured to obtain an attribute After the attribute information of the second user returned by the provider device 1020, the second user is served according to the second user terminal attribute information;

The attribute provider device 1020 is configured to determine whether the first user has the right to query the attribute of the second user; if the result of the determination is that the right is, the attribute query is performed and the second user of the query is The attribute information is returned to the service provider device 1010.

The technical solutions of the present invention are described in detail below in conjunction with specific application scenarios. In the following embodiments, they are implemented in the OWSER NI network. Embodiment 7 is a method for querying user attributes. Through this solution, user A can log in at the SP. Then, through the authentication of the Idp, the discovery service gives the address of the attribute service provider that needs to refer to the user B. Through the authentication of the user B, the user A can obtain some attributes that the user B is allowed to access through the SP. The main idea of the solution in this embodiment is that user A can serve user B through the SP. In the usual sense, OWSERNI is a service for users to query attributes through SP, but when there is a need to serve other users through a user terminal, it is necessary to query the user attributes of the required service when the service occurs. Usually the attributes we refer to are stored in a logical address called the attribute service provider. For example, the location information of the user is an attribute, and the service provider providing the attribute may find a device such as a home user service (HSS) to determine the location information of the user. Considering privacy issues, certain attributes of the user are not directly available to others, so the user's consent is required when reviewing certain attributes. The precondition of this embodiment is that both users A and B have passed the authentication of Idp. In this embodiment, the interaction between the user A/B and the service provider SP and the interactive service belongs to the prior art. In order to be able to express the process more completely, it is also shown in the figure, respectively, using a/b/c. /d to distinguish. The signaling diagram between the entities is shown in Figure 10, including: F1, user A logs into the service provider SP;

The service provider SP makes a request for an attribute lookup to the attribute provider;

Service providers can use the mechanisms defined by the Liberty Data Service Template ( DST ) to initiate queries to attribute providers. In this case, a service provider must use the <Query> element, and the attribute provider must use the <(^6 1^8 01186> element in response to the service provider. Here is an example of < Query > , its resource is identified by the resource ID http://0 WSER-attributeprovider.com/u6gh8jlx90bt8h 1 o. For the name and home address as a query: <Query>

<ResourceID>http :〃0 WSER-attribute-provider.com/u6gh8j Ix90bt8h 1 o</Re source ID>

<Select>/pp:PP/pp:CommonName</Select>

</QueryItem>

<Select>/pp:PP/pp:AddressCard[pp:AddressType="urn:liberty:id-sis-pp:add rType:home"]</Select>

</QueryItem>

</Query>

F2, the attribute service provider needs to send a request to other users through the interactive service in order to obtain the authentication of other users;

The attribute service provider sends the <InteractionRequest> element to the interactive service. Here's an example of < InteractionRequest >:

<InteractionRequest">

<Help moreLink="http://pip.example.com/help/attribute/r ead/consent"> example.com is requesting your address. We do not have a rule that instructs us how you want us to process this request Please pick one of the given options. Note that the last two options do prevent you from being prompted this question when example.com asks for your address again. </Help>

<Label>Do you want to share your address with attribute-provider.co m?</Label>

<Hint>We won't give out your address and won't ask you again</Hint> </Item>

<Hint>We will share your address now and in the future with - 641 service-provider.com</Hint>

</Item>

</Select>

</Inquiry>

</InteractionRequest>

The above example is a request from the property service provider to the interactive service to query the user B address attribute.

F4, the interactive service sends a message to user B, asking if the attribute is queried;

The interactive service can send an inquiry message to user B via HTTP, asking B whether to allow querying user attributes. For example, in this example, the user name and address are looked up.

F5, the user feeds back the query response to the feedback interaction server;

If the user agrees to the query for the name and address, the user can feed back to the interactive service via the HTTP POST method. F6, the interactive service feeds back the query response result of the user to the attribute service provider; the interactive service sends the response message with the <InteractionResponse> element to the attribute service provider through the interaction.

<Label>Do you want to share your address with - 753

Service-provider.com?</Label>

<Value>always<A3⁄4lue>

</Select>

</Inquiry>

<ds:Signature>

.... <ds:Reference>#inquiry-3d4e2f a37213b</ds:Refere nce> ....

</ds:Signature>

</InteractionStatement>

</InteractionResponse>

F7, the attribute server returns the result of the query to the SP according to the query result of the interaction server; if the user B agrees that the user A queries the attribute of the user B, the attribute server of the step returns the attribute of the user B that is queried.

Below is a <QueryResponse:^々 example for responding to <Query>it above. The public name of the resource returns Dr.Genie Wunderkid, and another optional public name is Dr.Genie Wunder. The resource address is also given.

Tmmi

11 </QueryResponse>

F8, SP responds to user A feedback;

In this embodiment, the attribute server confirms the access of the attribute of the user B by other conventional implementation manners, and the specific manner does not constitute a limitation of the present invention. Embodiment 8 is a method for querying user attributes. In this embodiment, user A provides a service for user B through an SP. Through this scheme, User A provides service to User B after logging in to the SP. User A authenticates with User B before querying certain attributes of User B. As a result, User B agrees that User A has checked certain attributes of himself. The main idea of the solution is that when user A needs to provide services to user B through the SP, user A needs to be authenticated by user B first, so that user A can use certain attributes of user B. Next, user A can log in to the SP and then re-authenticate to obtain the relevant attributes of user B provided by the attribute service provider, and the authentication process is no longer needed, but only needs to be as convenient as user B's own operation. The following figure shows the signaling flow between entities in this embodiment as shown in FIG. 11. In this embodiment, the authentication part is indicated by a dotted line, and the solid line part is a service providing part.

G1. User A sends an authentication to Idp;

User A wants to provide service for User B, then User A needs to pass Idp authentication first. After authentication by Idp, User A indicates that it is a legitimate user within the trust.

G2. Idp authenticates user A;

Idp is a special service provider role that generates, maintains, and manages user identity information and provides authentication claims to other service providers in the authentication domain (even a trust). After authentication by Idp, User A is the trusted user within the trust. G3. User A initiates a request for authentication to User B;

When user A sends the authentication of request B, it needs to send the information indicating the identity such as its own ID to user B. The authentication result of Idp to user A needs to be sent to user B to tell user B that user A is a legitimate user authenticated by trust.

G4. User B authenticates to Idp. The authentication process may include a process; first, user B authenticates the identity of the Idp, and after the authentication, the authentication information of B is saved on the Idp for use in subsequent services;

Second, User B sends the identity information of User A and his identity information to Idp. Through this step, Idp will record that A and B are required to be combined. Here is just an example. The specific joint method can be in many ways, but the idea is consistent. The joint registration of the identity of user A and user B in Idp may be an incidental process in which user B performs the authentication process.

G5. Idp authenticates user B and records the combination of user A and user B;

After the Idp authentication, the B user confirms that the trust is a legitimate user, and in the Idp, the A and B information is bound to tell the future service that the two users have passed the Idp authentication, and they It is a help relationship.

G6. User B sends a key right message to User A;

After user A sends an authentication message to user B, user B feeds back an authentication message. After such authentication, User B can decide whether or not A needs to help himself to complete certain services.

G7. User A logs in to the SP to obtain the service;

Landing SP belongs to the prior art category. This can be done via HTTP, etc. There is not much description here. It should be noted that User A needs to bring the joint information with B into the SP when logging in to the SP to notify the SP that User A wants to assist B to obtain the service.

G8. SP authenticates A;

SP consults Idp to obtain a record of A and B.

G9. Idp feedback A and B certification records and joint records;

G10. SP queries relevant attributes according to the service required by A; The attribute queried by the SP may be the attribute of User B, so it is necessary to find the attribute of B in the attribute service provider. This step omits the process by which the SP obtains AP information from the discovery service. The SP will send the joint information of A and B to the AP.

Gi l. AP ^ A user B attribute checked back to the user A related information;

The AP confirms that A is a legitimate user authenticated by B according to the joint information confirmed by Idp, so the user

B's property server can provide such property queries for A.

G12. After the SP obtains the attribute information, it processes it and sends the final service result to the user. The result can be sent in a variety of ways, such as through the PS domain or the CS domain. No detailed explanation is given here.

The combination of user A and user B in this embodiment is only an example. If there are other ways, for example, by telephone number/email address/userlD, the same purpose can be achieved, and other methods can achieve the same purpose. It is consistent.

The ninth embodiment, a method for querying a user attribute, in this embodiment, the user A provides a service for the user B through the SP. Through this scheme, user B can set a list of related attribute access rights on the Ap, and the users listed in the table can obtain access rights of certain B attributes. In this way, User A can gain access to certain attributes in the table.

The main idea of the solution is that user A can negotiate with B for user B before obtaining certain services through SP. Through such authentication, B can generate a list of related attribute access rights for A, and user B can Send this list to the property server for saving for use by subsequent services.

The signaling process between entities is shown in Figure 12, including:

The premise of this embodiment is that user B has passed the authentication of Idp.

HI, user A needs to obtain user B's authentication first to complete the service for user B to complete the login SP; this authentication process can be completed in a variety of ways. For example, by sending a request message, the user B can be made aware that the requester is the user A; H2, and the user B logs in to the SP1; The login method can use HTTP or the like, and will not be described in detail here;

H3, SP1 checks the authentication status of user B through Idp;

H4, Idp replies with a request, including an authentication assertion describing the user authentication status;

H5, SP1 provides modified attribute services;

SP 1 proposes to modify the AP's list of trusted objects for User B, which is maintained at the attribute provider and can be modified by the SP. The service provider must use the <Modify> element, and the attribute provides User B's list of trusted objects may have a similar form as Table 1 below:

The above list of trusted objects is just an example. If there are other forms that can be represented, the principle is the same.

H6, the attribute provider feeds back the list of trusted object modification results;

The modified result may be in the form of Table 2.

User B attribute User B can trust object

Name A Address A

Location A, C, D This adds access to User A's access to User B's location properties.

H7, SP1 feeds back the modified result to user B, and the feedback method can be multiple;

H8, User B feedback user A authentication response;

After user B increases the usage rights of some attributes of user A, user B feeds back to user A.

H9, user AJ ^ from Idp certification;

HI 0 , Idp feedback authentication result to user A;

H11, User A logs in to the service provider SP2;

The result of user A logging in to SP2 is that he hopes to complete some services for user B;

H12, SP2 check the authentication status of user A;

H13, Idp feedback to the authentication status of SP2 user A, returning an authentication assertion;

H14, in order to complete the service to user B, some user B attributes are required, so SP2 searches for certain attributes of user B on the AP;

Since User B has already entered the user into the available permissions of certain attributes, User A can obtain the attributes provided by User B. This process requires the AP to compare the attribute acquisition object with a list of related attribute access rights.

H15, if the AP finds that user A can obtain the address information of user B, the AP will feed back the result to SP2;

H16, SP2 feeds back the final service result to user A, and the feedback result can be in various forms, for example, by HTTP. The related attribute access rights list in this embodiment and the maintenance of the related attribute access rights list on the AP are examples. If there is a similar way, the principle is also consistent. It can be immediately said that in the embodiment, user B can disclose some of his own attributes, so that other users can perform certain operations or services on themselves. The main idea of the solution is that User B exposes some of its common information to the Attribute Service Provider in advance, so that other users can perform certain operations or services on User B without being authenticated by User B. This embodiment is supplemented by the third embodiment, except that certain attributes are set to be public to everyone. Just make some changes on the save information of the property. Modify the attribute information that may be concentrated on the attribute provider AP. For example, it can have the form of Table 3 below:

A plurality of such user attribute lists are maintained on the AP. This table can be modified by User B, but needs to be authenticated by Idp and completed by the service provider. From the above table, you can see that the name for user B can be seen by anyone, and is read-only. For address information, it can be displayed for anyone. Check it out. Therefore, if the attribute service provider maintains such a table, if other users need to check some attributes of user B, then only need to consult such a list when accessing the attribute provider to find out whether the user agrees to the authorization. User B maintains or modifies the list exactly as in the previous embodiment. The user attribute list of the attribute service provider listed in this embodiment is only an example. If there are other ways to save the attribute information, or complete similar attribute operations, the principle is the same, and all are within the scope of protection. Embodiment 10: A service provider device, including:

And a service providing unit, configured to receive attribute information of the second user fed back by the attribute provider device, and serve the second user according to the second user terminal attribute information.

In this embodiment, the service provider device may further include: an authentication unit, configured to authenticate the identity information of the first user;

The querying unit is specifically configured to: after the authentication unit passes the authentication of the identity information of the first user, send an attribute query request to the second user according to the service request received by the receiving unit to the attribute provider device.

The authentication unit may include:

An authentication request sending unit, configured to send a user authentication request to the user identity provider device, so that the user identity provider device performs identity authentication on the first user;

An authentication result receiving unit, configured to receive the returned by the user identity provider device The authentication result of the first user for identity authentication.

The authentication unit may further include: a joint information receiving unit, configured to receive, when the identity authentication provider determines that the first user has joint information, return the first user and the second user Joint information;

The association information sent by the query unit further includes the joint information.

The method for querying user attributes provided by the present invention, the method and device for providing services. A detailed introduction, in which:

In an embodiment of the present invention, the attribute provider device receives an attribute query request for the second user sent by the service provider device; the attribute query request includes the user identity information of the first user and the user identity information of the second user; The provider device determines whether the first user has the right to query the attribute of the second user; if the result of the determination is that the user has the right, the attribute provider device performs the attribute query and queries the attribute information of the second user. Return to the service provider device. With the technical solution of the embodiment of the present invention, the user can query the attribute information of other users, and then one user can help other users complete the corresponding service to provide corresponding services for other users after logging in to the SP, and the SP is added. Users provide a variety of services, enhance the user experience, and improve service efficiency.

In other embodiments of the present invention, when the user queries the attribute of a certain user, and if the attribute to be consulted is the content that can be consulted by the user, the trust confirmation problem between the users is fully considered. If the user consults other user attribute information, three specific preferred implementation methods are given to the user's query authority, and the constraints of the trust relationship between the users are explained. The technical solution of the present invention is better realized.

For those skilled in the art, the present invention is not limited by the scope of the present invention, and the scope of the present invention is not limited by the scope of the present invention.

Claims

OP080882 WO 2009/127163 PCT/CN2009/071342 -25- Claims

A method for querying a user attribute, comprising:

The method for querying the user attribute according to claim 1, wherein the step of determining whether the first user has the right to query the attribute of the second user comprises:

Sending an authentication request to the second user; the authentication request includes user identity information of the first user;

The second user determines whether the first user equipment has permission to query attributes; and returns the determined result.

The method for querying a user attribute according to claim 1, wherein the step of determining whether the first user has the right to query the attribute of the second user comprises:

Comparing the identity information of the first user with the related attribute access permission list of the second user; if the identity information of the first user belongs to the related attribute access permission list, determining that the first user has Permission query.

The method for querying the user attribute according to claim 3, further comprising: receiving the first user to perform the negotiation authentication with the first user, and after the authentication by negotiation, the first The related attribute access permission list configured by the user.

Determining, by the service provider device, whether the attribute query request for the second user includes the joint information of the first user and the second user;

If included, it is determined that the first user has authority. OP080882

WO 2009/127163 PCT/CN2009/071342

-26-

The method for querying a user attribute according to any one of claims 1 to 5, wherein after the attribute information of the queried second user is returned to the service provider device, the method includes:

The service provider device sends the attribute information of the second user to the first user.

7. A method of providing a service, comprising:

Receiving a service request sent by the first user for the second user; the service request includes user identity information of the first user and user identity information of the second user;

Sending an attribute query request to the second user to the attribute provider device; the attribute query request includes user identity information of the first user and user identity information of the second user;

The method for providing a service according to claim 7, wherein the receiving the service request sent by the first user for the second user further comprises: performing the identity information of the first user Authentication, if the authentication is passed, continue the step of sending an attribute query request to the second user to the attribute provider device.

9. The method of providing a service according to claim 8, wherein the step of authenticating the identity information of the first user comprises:

Sending a user authentication request to the user identity provider device, so that the user identity provider device authenticates the first user;

Receiving an authentication result of authenticating the first user returned by the user identity provider device.

The method of providing a service according to claim 9, wherein the sending the user authentication request to the user identity authentication provider device further comprises:

Receiving, when the identity authentication provider determines that the first user has joint information, joint information that combines the first user and the second user; OP080882

WO 2009/127163 PCT/CN2009/071342

-27- The attribute query request further includes the joint information.

The method for providing a service according to any one of claims 8 to 10, wherein the providing the second user according to the second user attribute information comprises:

The service provider device returns a result of the service to the first user.

12. An attribute provider device, comprising:

The query request receiving unit is configured to receive an attribute query request for the second user sent by the service provider device, where the attribute query request includes the user identity information of the first user and the user identity information of the second user;

The attribute provider device according to claim 12, wherein the determining unit comprises:

a list holding unit, configured to save a related attribute access permission list of the second user; a comparison unit, configured to use the identity information of the first user and the related attribute access permission list of the second user saved by the list holding unit For comparison, if the identity information of the first user belongs to the related attribute access permission list of the second user, it is determined that the first user has the right to query the attribute of the second user.

An authentication requesting unit, configured to send an authentication request to the second user; the authentication request includes user identity information of the first user;

The authentication request response unit is configured to receive an authentication result returned by the second user equipment, where the authentication result indicates whether the first user has the right to query the attribute of the second user. OP080882

WO 2009/127163 PCT/CN2009/071342

-28-

a joint information checking unit, configured to check whether the attribute query request for the second user received by the query request receiving unit includes joint information of the first user and the second user; the decision unit is configured to The result of the checking by the checking unit is that when the joint information exists, it is determined that the first user has the right to query the attribute of the second user.

16. An identity authentication provider device, comprising:

An identity authentication unit, configured to authenticate the identity of the user, and receive the request of the authenticated user; and combine the identity information of the at least two users to obtain the joint information;

a storage unit, configured to save the joint information;

17. A service providing system, comprising:

a service provider device, configured to receive a service request sent by the first user for the second user; the service request includes user identity information of the first user and user identity information of the second user; and sending according to the service request An attribute query request for the second user; the attribute query request includes user identity information of the first user and user identity information of the second user; the service provider device is further configured to obtain the second user After the attribute information, the second user is served according to the second user terminal attribute information;

An attribute provider device, configured to receive an attribute query request for the second user sent by the service provider device, to determine whether the first user has the right to query the attribute of the second user; If there is permission, the attribute query of the second user is performed, and the attribute information of the second user that is queried is returned to the service provider device.

18. A service provider device, comprising:

a receiving unit, configured to receive a service request sent by the first user for the second user, where the service request includes user identity information of the first user and user identity information of the second user; OP080882

WO 2009/127163 PCT/CN2009/071342

a Querying unit, configured to send, according to the service request received by the receiving unit, an attribute query request to the second user to the attribute provider device; the attribute query request includes the user identity information of the first user and the second User identity information of the user;

The service provider device according to claim 18, further comprising: an authentication unit, configured to authenticate identity information of the first user;

The service provider device according to claim 19, wherein the authentication unit comprises:

And an authentication result receiving unit, configured to receive an authentication result that is performed by the user identity provider device to perform identity authentication on the first user.

The method for providing a service according to claim 20, wherein the authentication unit further comprises: a joint information receiving unit, configured to receive when the identity authentication provider determines that the first user has joint information Returned joint information that combines the first user with the second user;