Using multiple digital identification documents to control information disclosure

• US 10,291,410 B2
• Filed: 01/11/2018
• Issued: 05/14/2019
• Est. Priority Date: 06/04/2014
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Redpath, Richard
• Primary Examiner(s): Tolentino, Roderick
• Application Number:
  US15/867,871
• Publication Number:
  US 20180139058A1
• Time in Patent Office: 488 Days
• Field of Search: 726 17- 19
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A first digital identification document is transmitted from an identification authority to a mobile device of an identified individual. This first digital identification document is digitally signed and includes a set of attributes about the identified individual. In the same manner, a second digital identification document is also transmitted to the identified individual'"'"'s mobile device. The second digital identification document is also digitally signed but includes a different set of attributes about the identified individual. The identified individual is then confronted by a series of challengers, wherein each challenger requires a different amount of information about the identified individual. Based on the identity of each challenger, the identified individual selects an appropriate identification document and transmits it to the applicable challenger'"'"'s device. The challenger is then able to confirm both the information he needs about the identified individual and the validity of the identification document that he receives.

Claims

1. A computer-implemented method for managing a plurality digital identification documents identifying an individual, each digital identification document of the plurality of digital identification documents including a differing set of attributes about the identified individual and a digital signature, the method comprising:

providing, by one or more processors, a user interface whereby the identified individual can cause a first digital identification document of the plurality of digital identification documents to be created according to preferences of the identified individual by selecting for inclusion in a first of the differing sets of attributes about the identified individual a first subset of available attributes among a plurality of available attributes about the identified individual, wherein the plurality of available attributes about the identified individual are maintained in one or more databases;

in response to the selection of the first subset of available attributes for inclusion in the first of the differing sets of attributes, creating, by the one or more processors, the first digital identification document of the plurality of digital identification documents by adding into the first digital identification document the selected first subset of attributes that are obtained from the one or more databases, the first digital identification document including the first of the differing sets of attributes and the digital signature;

transmitting, by the one or more processors, the plurality of digital identification documents;

receiving, by the one or more processors, a selected digital identification document of the plurality of digital identification documents from a first mobile device of the identified individual;

analyzing, by the one or more processors, the digital signature of the selected digital identification document;

confirming, by the one or more processors, the validity of the selected digital identification document based on the analysis of the digital signature; and

triggering, by the one or more processors and in response to the confirmation that the selected digital identification document is valid, a visual or auditory notification indicating the confirmed validity.

2. The method of claim 1, wherein at least one of an image of the identified individual, an address of the identified individual, a birth date of the identified individual, a driver'"'"'s license number of the identified individual, a name of the identified individual, or a height of the identified individual are included the plurality of available attributes and excluded from the first subset of available attributes.

3. The method of claim 2, wherein at least one of an image of the identified individual, an address of the identified individual, a birth date of the identified individual, a driver'"'"'s license number of the identified individual, a name of the identified individual, or a height of the identified individual are included in each of the differing sets of attributes.

4. The method of claim 1, wherein the first digital identification document and the selected digital identification document are the same.

5. The method of claim 1, wherein all of the plurality of digital identification documents are transmitted to a computer of the identified individual contemporaneously.

6. The method of claim 5, wherein the computer of the identified individual and the first mobile device of the identified individual are the same device.

7. The method of claim 1, wherein the transmitting the plurality of digital identification documents is from a computer system of a representative of an identification authority, and wherein the receiving the selected digital identification document and the analyzing the digital signature of the selected digital identification document are by a challenger'"'"'s device.

8. The method of claim 7, wherein the receiving the selected digital identification document is performed via a direct wireless connection between the first mobile device and the challenger'"'"'s device.

9. The method of claim 7, further comprising:

transmitting, from the computer system of the representative of the identification authority, to the challenger'"'"'s device a list of revoked digital identification documents.

10. The method of claim 1, wherein the analyzing the digital signature of the selected digital identification document is performed using a public key, the method further comprising:

generating the digital signature of the selected digital identification document by signing the selected digital identification document with a private key corresponding to the public key.

11. A computer-implemented method for managing digital identification documents, the method comprising:

providing, by one or more processors, a first user interface, via a first mobile device of an individual, whereby the individual can cause a first digital identification document of a plurality of digital identification documents identifying the individual to be created according to preferences of the identified individual by selecting for inclusion in a first set of attributes about the identified individual a first subset of available attributes among a plurality of available attributes about the identified individual maintained in one or more databases and by causing the first mobile device of the identified individual to transmit the selection of the first subset of available attributes for inclusion in the first set of attributes to a computer system of a representative of an identification authority;

receiving, by the one or more processors and from the computer system of the representative of the identification authority, on the first mobile device of the identified individual, the plurality of digital identification documents, each of the plurality of digital identification documents including a differing plurality of attributes about the identified individual, wherein the plurality of digital identification documents includes the first digital identification document that was created by the computer system of the representative of the identification authority in response to the receipt of the transmission of the selection of the first subset of available attributes for inclusion in the first set of attributes, wherein the first digital identification document was created by adding into the first digital identification document the selected first subset of attributes that were obtained from the one or more databases;

providing, by the one or more processors, a second user interface, via the first mobile device of the identified individual, whereby the identified individual can make a selection of a digital identification document of the plurality of digital identification documents, wherein the selected digital identification document includes a digital signature; and

transmitting, by one or more processors and based on the first selection, the selected digital identification document from the first mobile device of the identified individual to a first challenger'"'"'s device of a first challenger, whereby the first challenger is able to determine the validity of the selected digital identification document using the first challenger'"'"'s device, based on the first challenger'"'"'s device performing the steps of;

receiving the selected digital identification document;

analyzing the digital signature included with the selected digital identification document;

confirming, based on the analysis of the digital signature, that the selected digital identification document is valid; and

triggering, in response to the confirmation that the selected digital identification document is valid, a notification to the first challenger indicating the confirmed validity.

12. The method of claim 11, further comprising:

providing the second user interface, via the first mobile device of the identified individual, whereby the identified individual can make a second selection of a second digital identification document of the plurality of digital identification documents; and

transmitting, based on the second selection, the second digital identification document from the first mobile device of the identified individual to a second challenger'"'"'s device of a second challenger, whereby the second challenger is able to determine the validity of the second digital identification document using the second challenger'"'"'s device.

13. The method of claim 12, wherein the selection of the selected digital identification document is determined based on at least the identity of the first challenger, and wherein the second selection of the second digital identification document is determined based on at least the identity of the second challenger.

14. The method of claim 12, wherein the first challenger is entitled to receive on the first challenger'"'"'s device from the computer system of the representative of the identification authority a list of digital identification documents associated with identified individuals who have had one or more privileges revoked by the identification authority, and wherein the second challenger is not entitled to receive the list of digital identification documents, the method further comprising:

prior to the transmitting the selected digital identification document from the first mobile device to the first challenger'"'"'s device, receiving from the computer system of the representative of the identification authority, on the first challenger'"'"'s device, the list of digital identification documents; and

analyzing, using the first challenger'"'"'s device, the selected digital identification document, whereby the first challenger is able to determine that the selected digital identification document is included on the list of digital identification documents.

15. A computer-implemented method for managing digital identification documents, the method comprising:

providing, by one or more processors, a first user interface, via a first mobile device of an individual, whereby the individual can cause a first digital identification document of a plurality of digital identification documents identifying the individual to be created according to preferences of the identified individual by selecting for inclusion in a first set of attributes about the identified individual a first subset of available attributes among a plurality of available attributes about the identified individual maintained in one or more databases and by causing the first mobile device of the identified individual to transmit the selection of the first subset of available attributes for inclusion in the first set of attributes to a computer system of a representative of an identification authority;

receiving, by the one or more processors, from the computer system of the representative of the identification authority, on the first mobile device of the identified individual, the plurality of digital identification documents, each of the plurality of digital identification documents including a differing plurality of attributes about the identified individual, wherein the plurality of digital identification documents includes the first digital identification document that was created by the computer system of the representative of the identification authority in response to the receipt of the transmission of the selection of the first subset of available attributes for inclusion in the first set of attributes, wherein the first digital identification document was created by adding into the first digital identification document the selected first subset of attributes that were obtained from the one or more databases;

providing, by the one or more processors, a second user interface, via the first mobile device of the identified individual, whereby the identified individual can make a selection of a digital identification document of the plurality of digital identification documents, wherein the selected digital identification document includes steganographic indicators of authenticity; and

transmitting, by one or more processors and based on the first selection, the selected digital identification document from the first mobile device of the identified individual to a first challenger'"'"'s device of a first challenger, whereby the first challenger is able to determine the validity of the selected digital identification document using the first challenger'"'"'s device, based on the first challenger'"'"'s device performing the steps of;

receiving the selected digital identification document;

detecting the steganographic indicators included with the selected digital identification document; and

presenting, by combining the detected steganographic indicators, a visually coherent image to the challenger, wherein the visual coherence is indicative of the validity of the selected digital identification document.