Token identity and attribute management

• US 10,700,853 B2
• Filed: 05/09/2017
• Issued: 06/30/2020
• Est. Priority Date: 07/12/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kravitz, David W., Ponceleon, Dulce B., Masini, Diego A., Laprida, Raul O., Garagiola, Andres, Geagan, III, John B.
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US15/590,414
• Publication Number:
  US 20180019879A1
• Time in Patent Office: 1,148 Days
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

One example method of operation may include receiving a request, from an entity, for one or more tokens based on one or more attributes, encrypting and masking the one or more attributes, adding the encrypted and masked one or more attributes to the one or more tokens, and transmitting the one or more tokens to the entity.

Claims

1. A method, comprising:

receiving a request, from an entity, for one or more tokens based on one or more attributes, the one or more attributes satisfying one or more conditions of a transaction to be recorded in a decentralized database, the one or more attributes including a first information indicating a representation of a value without indicating the value and second information providing access to the value;

encrypting and masking the one or more attributes;

adding the encrypted and masked one or more attributes to the one or more tokens; and

transmitting the one or more tokens to the entity in order to confirm the transaction before the transaction occurs, the one or more tokens transmitted by an authority of a decentralized database authorized to issue the one or more tokens to be included in the transaction to be recorded in the decentralized database.

2. The method of claim 1, further comprising:

selecting the one or more attributes; and

generating a masking and attribute encryption key to use when encrypting and masking the one or more attributes.

3. The method of claim 1, further comprising repeating the adding of the encrypted and the masked one or more attributes to the one or more tokens until all the one or more attributes from the request are processed.

4. The method of claim 2, further comprising verifying validity and ownership of the attributes by the entity prior to generating the masking and attribute encryption key.

5. The method of claim 1, wherein the one or more tokens comprise a single attribute root key.

6. The method of claim 1, wherein the one or more attributes identify the entity and comprise a label and a value.

7. The method of claim 1, wherein the one or more tokens transmitted to the entity comprise one or more answers to one or more questions submitted by the entity.

8. An apparatus, comprising:

a receiver configured to receive a request, from an entity, for one or more tokens based on one or more attributes, the one or more attributes satisfying one or more conditions of a transaction to be recorded in a decentralized database, the one or more attributes including a first information indicating a representation of a value without indicating the value and second information providing access to the value;

a processor configured to

encrypt and mask the one or more attributes;

add the encrypted and masked one or more attributes to the one or more tokens; and

a transmitter configured to transmit the one or more tokens to the entity in order to confirm the transaction before the transaction occurs, the apparatus corresponding to an authority of a decentralized database authorized to issue the one or more tokens for inclusion in the transaction to be recorded in the decentralized database.

9. The apparatus of claim 8, wherein the processor is further configured to

select the one or more attributes, and

generate a masking and attribute encryption key to use when the processor encrypts and masks the one or more attributes.

10. The apparatus of claim 8, wherein the processor is further configured to repeat the adding of the encrypted and the masked one or more attributes to the one or more tokens until all the one or more attributes from the request are processed.

11. The apparatus of claim 9, wherein the processor is further configured to verify validity and ownership of the attributes by the entity prior to the generation of the masking and attribute encryption key.

12. The apparatus of claim 8, wherein the one or more tokens comprise a single attribute root key.

13. The apparatus of claim 8, wherein the one or more attributes identify the entity and comprise a label and a value.

14. The apparatus of claim 8, wherein the one or more tokens transmitted to the entity comprise one or more answers to one or more questions submitted by the entity.

15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform:

receiving a request, from an entity, for one or more tokens based on one or more attributes, the one or more attributes satisfying one or more conditions of a transaction to be recorded in a decentralized database, the one or more attributes including a first information indicating a representation of a value without indicating the value and second information providing access to the value;

encrypting and masking the one or more attributes;

adding the encrypted and masked one or more attributes to the one or more tokens; and

transmitting the one or more tokens to the entity in order to confirm the transaction before the transaction occurs, the one or more tokens transmitted by an authority of a decentralized database authorized to issue the one or more tokens to be included in the transaction to be recorded in the decentralized database.

16. The non-transitory computer readable storage medium of claim 15, wherein the processor is further configured to perform:

selecting the one or more attributes; and

generating a masking and attribute encryption key to use when encrypting and masking the one or more attributes.

17. The non-transitory computer readable storage medium of claim 15, wherein the processor is further configured to perform:

repeating the adding of the encrypted and the masked one or more attributes to the one or more tokens until all the one or more attributes from the request are processed.

18. The non-transitory computer readable storage medium of claim 16, wherein the processor is further configured to perform:

verifying validity and ownership of the attributes by the entity prior to generating the masking and attribute encryption key.

19. The non-transitory computer readable storage medium of claim 15, wherein the one or more tokens comprise a single attribute root key.

20. The non-transitory computer readable storage medium of claim 15, wherein the one or more attributes identify the entity and comprise a label and a value, and wherein the one or more tokens transmitted to the entity comprise one or more answers to one or more questions submitted by the entity.