SYSTEM AND METHOD FOR ESTABLISHING AND MONETIZING TRUSTED IDENTITIES IN CYBERSPACE WITH PERSONAL DATA SERVICE AND USER CONSOLE

• US 20150332029A1
• Filed: 07/01/2013
• Published: 11/19/2015
• Est. Priority Date: 06/29/2012
• Status: Active Grant

• Current Assignee: Id Dataweb, Inc.
• Original Assignee: Id Dataweb, Inc.
• Inventors: COXE, David Hemphill, COXE, Robert Lloyd, DIALS, John Joseph, MCKAY-DONOVAN, Christine W.
• Granted Patent: US 9,372,972 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A system and method for establishing and monetizing trusted identities in cyberspace relying upon user opt in. Users request to attain secure IDs by accessing parties that will rely on secure IDs to complete a transaction, for example merchants and service providers (relying parties). The relying parties (RPs) communicate with identity service providers and attribute providers via an Attribute Exchange Network (AXN) in order to obtain verified attributes associated with an entity (end user or user) that wishes to conduct business with the relying party. The relying party makes requests for verified attributes that are important to consummating business transactions for the relying party. Users are informed of requests for attributes on behalf of relying parties and users have the option to verify attributes, and add new attributes that may be useful or required for conducting business with relying parties.

Claims

1. A method for verifying an attribute asserted on line:

receiving at attribute exchange network (AXN) device a verification request from a computing device operated by a relying party (RP);

identifying by AXN device at least one attribute provider (AP) associated with the RP for purposes of attribute verification;

sending from the AXN device a verification request to a computing device operated by the at least one AP; and

sending from the AXN device a claim received by the at least one AP from a computing device operated by an end user one AP to the computing device operated by the RP via the AXN

2. The method of claim 1 further comprising:

associating by the AXN device a claim with a sign on credential being asserted by the end user.

3. The method of claim 2, wherein the credential is an OpenID credential.

4. The method of claim 1, wherein the verification request sent to the computing device operated by the AP does not contain information identifying the RP.

5. The method of claim 1, wherein information identifying the RP is passed from the AXN device to the computing device operated by the AP.

6. A method of providing access to end user-asserted attributes, the method comprising:

receiving by an at attribute acess network (AXN) device at least one end user-asserted attribute;

associating by the AXN device at least one end user-asserted attribute with an end user credential;

creating by the AXN device an encrypted token containing the user asserted attributes;

sending by the AXN device the encrypted token to a user-selected network location, wherein the user-selected location is associated with a key retained by the AXN; and

accessing by the AXN the encrypted token using the key in response to a request from a computing device operated by the user, wherein the request comprises the associated end user credential.

7. The method of claim 6, wherein the encrypted token comprises personal identifying information of the end user.

8. The method of claim 6, wherein the encrypted token comprises enterprise data.

9. The method of claim 6, wherein the encrypted token comprises preference data.

10. The method of claim 6, wherein accessing by the AXN the encrypted token using the key in response to a request from a computing device operated by the user comprises:

receiving by the AXN device a subsequent assertion of the credential from a computing device operated by a relying party (RP);

retrieving by the AXN device the encrypted token using the key; and

generating by the AXN device a web page comprising at least a portion of the at least one associated attribute; and

providing access by the AXN device to the web page by the computing device operated by the end user.

11. A method providing access to end user-asserted attributes, the method comprising:

receiving by an attribute acess network (AXN) device a first credential asserted by an end-user to one or more relying parties (RPs);

accessing by the AXN device a database;

requesting by the AXN device a first location of a first encrypted token associated with the asserted first credential from the database;

acquiring by the AXN device the first encrypted token associated with the asserted first credential from the first location;

acquiring by the AXN device from the first encrypted token a first set of attributes of the end user, wherein the first set of attributes further identifies permissions grant by the end user to the one or more RPs to view attributes selected from the first set of attributes; and

populating by the AXN device a web page with the first set of attributes and the permissions for each of the one or more RPs to view attributes selected from the first set of attributes.

12. The method of claim 11 further comprising linking by the AXN device a second credential to the first credential.

13. The method of claim 12 further comprising:

acquiring by the AXN device the second credential using the first credential;

requesting by the AXN device a second location of a second encrypted token associated with the second credential;

acquirng by the AXN device the second encrypted token associated with the second credential from the second location;

acquiring by the AXN device from the second encrypted token a second set of attributes of the end user, wherein the second set of attributes further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the second set of attributes; and

populating by the AXN device the web page with the second set of attributes and the permissions for each of the one or more RPs to view attributes selected from the second set of attributes.

14. A method for managing access to attribute verification data, the method comprising:

receiving by an attribute exchange network (AXN) device a request from a computing device operated by an end user to open a browser session, wherein the request comprises a unique identifier associated with the end user via a first credential; and

provisioning by the AXN device the user computing device to access a web page in response to the request.

15. The method of claim 14, wherein the unique identifier is supplied to a computing device of a registered relying party (RP) by the AXN device during a verification flow associated with the end user.

16. The method of claim 15, wherein the unique identifier is a meaningless but unique number.

17. The method of claim 14, wherein the web page links a permission granted by the end user to a relying party (RP) and wherein the method further comprises provisioning the computing device operated by the user to revoke the permission granted to the RP.

18. The method of claim 17 further comprising provisioning the computing device operated the user to remove the RP.

19. The method of claim 14 further comprising provisioning the computing device operated the user to the first credential with at least a second credential.