Methods and systems for identity verification

• US 20100235623A1
• Filed: 03/11/2009
• Published: 09/16/2010
• Est. Priority Date: 03/11/2009
• Status: Active Grant

• Current Assignee: 2414768 Ontario Incorporated
• Original Assignee: WIC CDN Incorporated
• Inventors: Chau, Felix, Simpson, Paul
• Granted Patent: US 8,572,681 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

The present invention relates to methods and systems for identity verification. The method includes transmitting from a customer system to a customer connector server an identity verification request containing identification information for an individual. At the customer connector server, at least one verification service required for the request is identified and a data manager server is selected for each service. A verification service request is transmitted to each data manager server. At each data manager server, at least one data access service is identified and one data connector server is selected for each service. A data accesss service request is transmitted to each data connector server. At least one data source is accessed from each data connector server for each request. The identification information provided is then verified against identity information stored within the at least one data source and a response is generated and communicated to the customer system.

Claims

1. A method for verifying the identity of an individual comprising the steps of:

transmitting from a customer system to a customer connector server a request for identity verification containing identification information provided by the individual to be identified;

at the customer connector server, identifying from the request for identity verification at least one verification service required to satisfy the request for identity verification;

selecting for each verification service, based on a first set of predetermined criteria, an appropriate data manager server from a plurality of data manager servers to manage the verification service;

transmitting to each appropriate data manager server a corresponding request for verification service;

at each appropriate data manager server, identifying from the corresponding request for verification service at least one data access service required to permit the identification information provided by the individual to be verified against identity information relating to the individual contained within the at least one data source;

selecting for each data access service, based on a second set of predetermined criteria, an appropriate data connector server from a plurality of data connector servers to manage the data access service;

transmitting to each appropriate data connector server a corresponding request for data access service;

accessing from each appropriate data connector server at least one data source in connection with each request for data access service;

verifying the identification information provided by the individual against the identity information relating to the individual contained within the at least one data source;

generating a response indicating whether the identity of the individual has been authenticated; and

communicating the response to the customer system.

2. The method for identity verification of claim 1 further comprising the steps of receiving at the customer connector server the request for identity verification and authenticating the source of the request for identity verification, prior to identifying from the request for identity verification the at least one verification service.

3. The method for identity verification of claim 2 wherein:

the request for identity verification includes encrypted header, input and output xml strings; and

the method further comprises the step of decrypting and de-serializing the header, input and output xml strings, after authenticating the source of the request for identity verification.

4. The method for identity verification of claim 3 further comprising the steps of creating incoming header, input and output data holders for the data obtained from the decrypted and deserialized header, input and output xml strings and loading data into the incoming header, input and output data holders.

5. The method for identity verification of claim 4 wherein the step of identifying from the request for identity verification the at least one verification service includes obtaining from the incoming header data holder an incoming service identifier associated with at least one verification service, and determining the at least one verification service based on the incoming service identifier.

6. The method for identity verification of claim 5 further comprising, after the determining step, the steps of:

creating outbound header, input and output data holders; and

loading data from the incoming header, input and output data holders into the outbound header, input and output data holders.

7. The method for identity verification of claim 5 wherein:

the first set of predetermined criteria includes the geographic proximity of each data manager server to the customer connector server and the responsiveness of each data manager server; and

the step of selecting for each verification service an appropriate data manager server, includes the step of retrieving for each verification service a list of data manager servers capable of managing the verification service and information pertaining to the geographic proximity and responsiveness criteria for each of the data manager servers on the list.

8. The method for identity verification of claim 6 further comprising the step of serializing and encrypting the outbound header, input and output data holders.

9. The method for identity verification of claim 8 wherein the corresponding request for verification service transmitted to each appropriate data manager server includes the serialized and encrypted outbound header, input and output data holders.

10. The method for identity verification of claim 1 further comprising the steps of receiving at the appropriate data manager server the corresponding request for verification service and authenticating the source of the request for verification service, prior to identifying from the request for verification service the at least one data access service.

11. The method for identity verification of claim 10 wherein:

the request for verification service includes encrypted incoming header, input and output xml strings; and

the method further comprises the step of decrypting and de-serializing the incoming header, input and output xml strings, after authenticating the source of the request for verification service.

12. The method for identity verification of claim 11 wherein the step of identifying from the request for verification service the at least one data access service includes obtaining from the incoming header data holder an incoming service identifier associated with at least one data access service, and determining the at least one data access service based on the incoming service identifier.

13. The method for identity verification of claim 12 further comprising, after the determining step, the steps of:

creating outbound header, input and output data holders; and

loading data from the incoming header, input and output data holders into the outbound header, input and output data holders.

14. The method for identity verification of claim 13 further comprising, after the steps of creating and loading, the step of verifying whether the requestor who initiated the request for identity verification has a valid subscription to the verification service requested.

15. The method for identity verification of claim 12 wherein:

the second set of predetermined criteria includes the geographic proximity of each data connector server to the appropriate data manager server and the responsiveness of each data connector server; and

the step of selecting for each data access service an appropriate data connector server, includes the step of retrieving for each data access service a list of data connector servers capable of managing the data access service and information pertaining to the geographic proximity and responsiveness for each of the data connector servers on the list.

16. The method for identity verification of claim 13 further comprising the step of serializing and encrypting the outbound header, input and output data holders.

17. The method for identity verification of claim 15 wherein the corresponding request for data access service transmitted to each appropriate data connector server includes the serialized and encrypted outbound header, input and output data holders.

18. The method for identity verification of claim 1 further comprising the steps of receiving at the appropriate data connector server the corresponding request for data access service and authenticating the source of the request for data access service, prior to accessing from each appropriate data connector server at least one data source.

19. The method for identity verification of claim 18 wherein:

the request for data access service includes encrypted incoming header, input and output xml strings; and

the method further comprises the step of decrypting and de-serializing the incoming header, input and output xml strings, after authenticating the source of the request for data access service.

25. The identity verification system of claim 1 wherein:

the at least one data source is managed by a data service provider; and

the selected at least one data connector server is physically located at a facility of the data service provider and resides behind a firewall of the data service provider.

26. The identity verification system of claim 1 wherein:

the customer connector server, the data manager servers and the data connector servers includes a server engine for coordinating and managing the performance of a plurality of request and response processing steps, and a plurality of frameworks configured for communication with the server engine;

the plurality of frameworks having resources which may be called upon by the server engine to perform at least some of the request and response processing steps.

27. The identity verification system of claim 26 wherein the plurality of frameworks includes an engine framework, a system development framework and a system portal framework.

28. The identity verification system of claim 27 wherein the customer connector server includes:

a main process manager module;

a communication service module for receiving the request for identity verification from the customer system and for returning responses to the customer system;

a request handler module for coordinating authentication of the source of the request for identity verification and creation of a first set of incoming data holders associated with the request for identity verification received from the customer system;

a customer handler module for creating a second set of outgoing data holders based on the first set of incoming data holders for transmission to each appropriate data manager server; and

a service locator module configured for communication with the customer handler module, the service locator module being operable to select the appropriate data manager and transmit to the appropriate data manager server the outgoing data holders;

each of the communication service module, the request handler module and the customer handler module being configured for communication with the main process manager module;

the main process manager module being operable to coordinate the activities of the communication service module, the request handler module and the customer handler module.

29. The identity verification system of claim 28 wherein the server engine of the customer connector server further includes a heart beat service module configured for communication with the service locator module and co-operable therewith to transmit heart beat type messages to the plurality of data manager servers to measure the responsiveness of the plurality of data manager servers.

30. The identity verification system of claim 26 wherein the server engine of each data manager server includes:

a main process manager module;

a communication service module for receiving a request for verification service from the customer connector server and for returning responses to the customer connector server;

a request handler module for coordinating authentication of the source of the request for verification service and creation of a first set of incoming data holders associated with the request for verification service received from the customer connector server;

a service handler module for creating a second set of outgoing data holders based on the first set of incoming data holders for transmission to the appropriate data connector server; and

a service locator module configured for communication with the service handler module, the service locator module being operable to select the appropriate data connector server and transmit to the appropriate data connector server the outgoing data holders;

each of the communication service module, the request handler module and the service handler module being configured for communication with the main process manager module;

the main process manager module being operable to coordinate the activities of the communication service module, the request handler module and the service handler module.

31. The identity verification system of claim 30 wherein the server engine of each data manager server further includes a heart beat service module configured for communication with the service locator module and co-operable therewith to transmit heart beat type messages to at least some data connector servers of the plurality to measure the responsiveness of the at least some data connector servers.

32. The identity verification system of claim 31 wherein the heart beat service module is configured for communication with the main engine process module and is operable to respond to heart beat type messages originating from the customer connector server.

33. The identity verification system of claim 26 wherein the server engine of each data connector server includes:

a main process manager module;

a communication service module for receiving a request for data access service from the at least one data manager server and for returning responses to the at least one data manager server;

a request handler module for coordinating authentication of the source of the request for data access service and creation of a set of incoming data holders associated with the request for data access service received from the at least one data manager server;

a data access module capable of accessing the at least one data source; and

an interface handler module configured for communication with, and operable to actuate, the data access module;

each of the communication service module, the request handler module and the interface handler module being configured for communication with the main process manager module;

the main process manager module being operable to coordinate the activities of the communication service module, the request handler module and the interface handler module.

34. The identity verification system of claim 33 wherein the server engine of each data connector server further includes a heart beat service module configured for communication with the main process manager module, the heart beat service module being operable to respond to heart beat type messages originating from the at least one data manager server.

35. The identity verification system of claim 33 wherein the server engine of each data connector server further includes a cache database connected to the data access service module, the cache database capable of storing data extracted from the at least one data source.

36. The identity verification system of claim 35 wherein the server engine of each data connector server further includes a batch control manager connected to the data access service module and the at least one data source, the batch control manager being operable to periodically refresh the data stored on the cache database with more recent data extracted from the at least one data source.

20. A method for verifying the identity of an individual comprising the steps of:

transmitting from a customer system to a business portal a request for identity verification containing identification information provided by the individual to be identified;

at the business portal, identifying from the request for identity verification at least one verification service required to satisfy the request for identity verification;

selecting for each verification service, based on a first set of predetermined criteria, an appropriate data manager server from a plurality of data manager servers to manage the verification service;

transmitting to each appropriate data manager server a corresponding request for verification service;

at each appropriate data manager server, identifying from the corresponding request for verification service at least one data access service required to permit the identification information provided by the individual to be verified against identity information relating to the individual contained within the at least one data source;

selecting for each data access service, based on a second set of predetermined criteria, an appropriate data connector server from a plurality of data connector servers to manage the data access service;

transmitting to each appropriate data connector server a corresponding request for data access service;

accessing from each appropriate data connector server at least one data source in connection with each request for data access service;

verifying the identification information provided by the individual against the identity information relating to the individual contained within the at least one data source;

generating a response indicating whether the identification information provided by the individual matches the identity information relating to the individual contained within the at least one data source; and

communicating the response to the customer system.

21. A system for verifying the identity of an individual comprising:

a customer connector server for connecting to a customer system and for receiving therefrom a request for identity verification containing identification information provided by the individual to be identified;

a plurality of data manager servers connected the customer connector server;

a plurality of data connector servers, each data connector server being connected to at least one data manager server of the plurality and being operable to access at least one data source containing identity information relating to the individual;

the customer connector server being operable to identify from the request for identity verification at least one verification service required to satisfy the request and to select for each verification service, based on a first set of predetermined criteria, an appropriate data manager server of the plurality thereof to manage the verification service;

the customer connector server being further operable to transmit to each appropriate data manager server a corresponding request for verification service;

each appropriate data manager server being operable to identity from the corresponding request for verification service at least one data access service required to permit the identification information provided by the individual to be verified against the identity information relating to the individual contained within the at least one data source;

each appropriate data manager server being further operable to select for each data access service, based on a second set of predetermined criteria, an appropriate data connector server of the plurality thereof to manage the data access service, and to transmit to each appropriate data connector server a corresponding request for data access service.

22. The identity verification system of claim 21 wherein the customer system includes a system selected from the group consisting of:

(a) a point-of-sale system;

(b) a financial services system; and

(c) a risk management system.

23. The identity verification system of claim 21 wherein the plurality of data manager servers includes a first data manager server and a second data manager server;

the customer connector server being connected to the first data manager server;

the first data manager server being connected to the second data manager server and the second data manager server being connected to one of the data connector servers of the plurality.

24. The identity verification system of claim 21 wherein the at least one data source is selected from the group consisting of:

(a) a database system;

(b) a legacy records system; and

(c) a web service.

37. The identity verification system of claim 21 wherein the first set of predetermined criteria includes the geographic proximity of each of the data manager servers to the customer connector server and the performance index of each of the data manager servers.

38. The identity verification system of claim 37 wherein the geographic proximity criterion in the first set of predetermined criteria is given priority over the performance index criterion.

39. The identity verification system of claim 38 wherein the performance index of each of the data manager servers is calculated based on the responsiveness of each of the data manager servers.

40. The identity verification system of claim 39 wherein the responsiveness of each of the data manager servers is determined using a heart beat strategy deployed jointly by the customer connector server and each of the data manager servers.

41. The identity verification system of claim 21 wherein the second set of predetermined criteria includes the geographic proximity of each of the data connector servers to the appropriate data manager server and the performance index of each of the data connector servers.

42. The identity verification system of claim 41 wherein the geographic proximity criterion in the second set of predetermined criteria is given priority over the performance index criterion.

43. The identity verification system of claim 42 wherein the performance index of each of the data connector servers is calculated based on the responsiveness of each of the data connector servers.

44. The identity verification system of claim 43 wherein the responsiveness of each of the data connector servers is determined using a heart beat strategy deployed jointly by the appropriate data manager server and each of the data connector servers.

45. A system for verifying the identity of an individual comprising:

a business portal for connecting to a customer system and for receiving therefrom a request for identity verification containing identification information provided by the individual to be identified;

a plurality of data manager servers connected to the business portal;

a plurality of data connector servers, each data connector server being connected to at least one data manager server of the plurality and being operable to access at least one data source containing identity information relating to the individual;

the business portal being operable to identify from the request for identity verification at least one verification service required to satisfy the request and to select for each verification service, based on a first set of predetermined criteria, an appropriate data manager server of the plurality thereof to manage the verification service;

the business portal being further operable to transmit to each appropriate data manager server a corresponding request for verification service;

each appropriate data manager server being operable to identity from the corresponding request for verification service at least one data access service required to permit the identification information provided by the individual to be verified against the identity information relating to the individual contained within the at least one data source;

each appropriate data manager server being further operable to select for each data access service, based on a second set of predetermined criteria, an appropriate data connector server of the plurality thereof to manage the data access service, and to transmit to each appropriate data connector server a corresponding request for data access service.