Digital identity system

• US 10,521,623 B2
• Filed: 12/07/2017
• Issued: 12/31/2019
• Est. Priority Date: 02/13/2015
• Status: Active Grant

• Current Assignee: Yoti Holding Ltd
• Original Assignee: Yoti Holding Ltd
• Inventors: Rodriguez, Francisco Angel Garcia, Powlesland, Piers, Greci, Paolo, Withers, Laurence, Loughlin-McHugh, Eleanor Simone Frederika, Szczesniak, Roman Edward, Zagarese, Quirino
• Primary Examiner(s): Rahim, Monjur
• Application Number:
  US15/835,301
• Publication Number:
  US 20180173906A1
• Time in Patent Office: 754 Days
• Field of Search: 726 5
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06K 7/10297 arrangements for handling protocols designed for non-contact record carriers such as RFIDs NFCs, e.g. ISO/IEC 14443 and 18092 cryptographic protocols H04L9/00; network security protocols H04L63/00; real-time communication protocols in data switching networks H04L65/00; network protocols for data switching network services H04L67/00
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A method of a digital identity system generating a sharing token for authenticating a bearer to a validator, wherein a data store of the digital identity system holds a plurality of attributes of the bearer, the method comprising implementing by the digital identity system the following steps: receiving at the digital identity system from a bearer an electronic sharing token request, wherein the token request identifies at least one of the bearer'"'"'s attributes in the data store selected for sharing with a validator; in response to the electronic token request, generating a sharing token, which is unique to that request, for presentation by the bearer to a validator; associating with the unique sharing token at the digital identity system the identified at least one bearer attribute; and issuing to the bearer the unique sharing token; and wherein later presentation of the unique sharing token to the digital identify system by a validator causes the at least one bearer attribute associated with the sharing token to be rendered available to the validator by the digital identity system.

Claims

1. A method of tracking a physical object, the method comprising:

at a recipient device operated by a recipient of the physical object, scanning a token of a bearer received with the physical object, the token of the bearer having been applied to the physical object by the bearer, the token received with the physical object having been associated at a digital identity system with a bearer address, in response to at least one electronic message received from the bearer;

transmitting, from the recipient device to a validation service of the digital identity system, a validation message comprising the scanned token of the bearer and a credential stored at the recipient device, the credential being bound to a digital identity of the recipient maintained by the digital identity system;

at the validation service, validating the credential, and if the credential is valid, using the credential and the digital identity of the recipient to create an electronic message comprising or indicating;

a unique code identifying the recipient, and/or a digital identity attribute of the digital identity of the recipient; and

transmitting the electronic message to a bearer device associated with said bearer address associated with the scanned token, at the digital identity system, wherein the electronic message confirms to the bearer receipt of the physical object by the recipient.

2. The method according to claim 1, wherein the digital identity system uses the scanned token to access at least one attribute of the physical object stored at the digital identity system, wherein the electronic message also comprises or indicates the attribute of the physical object.

3. The method according to claim 2, wherein the attribute of the physical object forms part of a digital identity of the physical object.

4. The method according to claim 1, wherein the electronic message comprises the unique code, the unique code being a composite code that is generated by combining a unique code of the bearer with a unique code of the recipient.

5. The method according to claim 1, wherein the electronic message comprises the unique code, the unique code having been made available to the bearer by the digital identity system in an earlier transaction between the recipient and the bearer.

6. The method according to claim 1, wherein the electronic message comprises the attribute, the attribute being a name or a facial image determined from the recipient'"'"'s digital identity.

7. The method according to claim 1, wherein the electronic message received at the bearer device is used to determine whether the recipient is an intended recipient of the physical object.

8. The method according to claim 7, wherein the physical object is activated if the recipient is determined to be the intended recipient.

9. The method according to claim 8, wherein the physical object is a bank card.

10. The method according to claim 1 further comprising storing, as part of the recipient'"'"'s digital identity, a unique object attribute which can be presented to other entities to confirm the recipient is in possession of a unique card attribute.

11. The method according to claim 1, wherein the token is a printed token.

12. The method according to claim 11, wherein the printed token is in the form of a printed QR code or barcode.

13. The method according to claim 1, wherein the token is scanned from an electronic chip received with the object.

14. The method according to claim 13, wherein the electronic chip is an RFID or NFC chip.

15. The method according to claim 1, wherein the digital identity attribute of the recipient is held at the digital identity system.

16. A system for tracking a physical object, the system comprising:

a digital identity system configured to maintain a digital identity of a recipient having a credential bound thereto, wherein the digital identity system is configured to receive at least one electronic message from a bearer and associate a bearer address with a token of the bearer in response; and

a recipient device comprising a scanner for scanning the token of the bearer received with the physical object, the token of the bearer having been applied to the physical object by the bearer, the token received with the physical object having been associated at the digital identity system with the bearer address, and a processor configured to transmit, from the recipient device to the digital identity system, a validation message comprising the scanned token of the bearer and the credential stored at the recipient device, the credential being bound to the digital identity of the recipient maintained by the digital identity system;

wherein the digital identity system comprises one or more processors configured to execute computer-readable instructions, which cause the one or more processors to validate the credential received in the validation message, and if the credential is valid;

use the credential and the digital identity of the recipient to create an electronic message comprising or indicating;

a unique code identifying the recipient, and/or a digital identity attribute of the digital identity of the recipient, and

transmit the electronic message to a bearer device associated with said bearer address associated with the scanned token at the digital identity system, wherein the electronic message confirms to the bearer receipt of the physical object by the recipient.

17. The system according to claim 16, wherein the electronic message comprises the unique code, the unique code being a composite code that is generated by combining a unique code of the bearer with a unique code of the recipient.

18. The system according to claim 17, wherein the digital identity system is configured to make the unique code available to the bearer in an earlier transaction between the recipient and the bearer.

19. The system according to claim 16 further comprising the bearer device, wherein the bearer device is configured to use the electronic message to determine whether the recipient is an intended recipient of the physical object.

20. The system according to claim 19, wherein the system is configured to activate the physical object if the recipient is determined to be the intended recipient.