Method and system for identity and credential protection and verification via blockchain

• US 10,503,916 B2
• Filed: 09/26/2017
• Issued: 12/10/2019
• Est. Priority Date: 10/06/2016
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Murphy, Anthony Paul, Mattingly, Timothy Warren, Flor, Peter
• Primary Examiner(s): Lwin, Maung T
• Application Number:
  US15/715,784
• Publication Number:
  US 20180101684A1
• Time in Patent Office: 805 Days
• Field of Search: None
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method for distributed storage of identity data includes: receiving entity data for a plurality of entities, the data including an associated public key, associated attributes, and a geographic jurisdiction, and where one entity is a subordinate; generating a data file for each entity including the associated attributes and public key, and where the subordinate entity'"'"'s data file includes a digital signature associated with a superior entity; generating an identity value for each entity via hashing the associated data file; and storing, in a distributed hash table, a key-value pair for each entity, wherein the key is the associated identity value, the value comprises the associated attributes, and the key-value pair is stored in a physical data storage device located in a geographic area corresponding to the associated geographic jurisdiction.

Claims

1. A method for distributed storage of identity data, comprising:

receiving, by a receiving device of a processing server, entity data for a plurality of entities, wherein the entity data includes at least an associated public key, one or more associated attributes, and a geographic jurisdiction, and where at least one of the plurality of entities is indicated as being a subordinate;

generating, by a generation module of the processing server, a data file for each of the plurality of entities, wherein each data file includes at least the one or more associated attributes and the associated public key, and where the data file for an entity indicated as a subordinate includes a digital signature associated with a superior entity that is superior to the entity indicated as a subordinate;

generating, by a hashing module of the processing server, an identity value for each of the plurality of entities via application of one or more hashing algorithms to the data file generated for the each of the plurality of entities; and

executing, by a querying module of the processing server, a query on a distributed hash table to store, for each of the plurality of entities, a key-value pair comprised of a key and a value, wherein the key in the key-value pair is the identity value for the each of the plurality of entities and the value in the key-value pair comprises at least each of the one or more associated attributes for the each of the plurality of entities, wherein

the distributed hash table is stored across a plurality of physical data storage devices, each data storage device being located in an associated geographic area, and where each key-value pair is stored in a physical data storage device where the associated geographic area corresponds to the geographic jurisdiction included in the entity data for the each of the plurality of entities.

2. The method of claim 1, wherein the entity data for each of the plurality of entities indicated as a subordinate includes the digital signature associated with the superior entity.

3. The method of claim 1, wherein the indication as a subordinate is the digital signature associated with the superior entity.

4. The method of claim 1, wherein

the superior entity is one of the plurality of entities, and

the digital signature associated with the superior entity is generated using a private key corresponding to the associated public key included in the entity data for the superior entity.

5. The method of claim 4, wherein the entity data for the superior entity includes the associated digital signature.

6. A system for distributed storage of identity data, comprising:

a plurality of physical data storage devices, each data storage device being located in a geographic area; and

a processing server, the processing server including a receiver, processor, and non-transitory computer-readable media storing program code, wherein

the receiver receives entity data for a plurality of entities, wherein the entity data includes at least an associated public key, one or more associated attributes, and a geographic jurisdiction, and where at least one of the plurality of entities is indicated as being a subordinate,

the processor executes the program code causing the processing server to

generate a data file for each of the plurality of entities, wherein each data file includes at least the one or more associated attributes and the associated public key, and where the data file for an entity indicated as a subordinate includes a digital signature associated with a superior entity that is superior to the entity indicated as a subordinate,

generate an identity value for each of the plurality of entities via application of one or more hashing algorithms to the data file generated for the each of the plurality of entities, and

execute a query on a distributed hash table to store, for each of the plurality of entities, a key-value pair comprised of a key and a value, wherein the key in the key-value pair is the identity value for the each of the plurality of entities and the value in the key-value pair comprises at least each of the one or more associated attributes for the each of the plurality of entities, and

the distributed hash table is stored across the plurality of physical data storage devices and where each key-value pair is stored in a physical data storage device where the associated geographic area corresponds to the geographic jurisdiction included in the entity data for the each of the plurality of entities.

7. The system of claim 6, wherein the entity data for each of the plurality of entities indicated as a subordinate includes the digital signature associated with the superior entity.

8. The system of claim 6, wherein the indication as a subordinate is the digital signature associated with the superior entity.

9. The system of claim 6, wherein

the superior entity is one of the plurality of entities, and

the digital signature associated with the superior entity is generated using a private key corresponding to the associated public key included in the entity data for the superior entity.

10. The system of claim 9, wherein the entity data for the superior entity includes the associated digital signature.