METHOD AND APPARATUS FOR REMOTE IDENTITY PROOFING SERVICE ISSUING TRUSTED IDENTITIES

• US 20160269379A1
• Filed: 11/23/2015
• Published: 09/15/2016
• Est. Priority Date: 03/09/2015
• Status: Active Grant

• Current Assignee: Michigan Health Information Network Shared Services (State of Michigan)
• Original Assignee: Michigan Health Information Network Shared Services (State of Michigan)
• Inventors: Livesay, Jeff, Pletcher, Tim, Seggie, Brian, Ward, Tony
• Granted Patent: US 9,491,160 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06V 30/418 Document matching, e.g. of document images
• CPC Class Codes: G06V 40/172 Classification, e.g. identification
• CPC Class Codes: G06V 40/70 Multimodal biometrics, e.g. combining information from different biometric modalities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

Illustrative methods, processes, and software are disclosed herein that remotely prove the identity of individuals fully compliant with identity proofing standards and policies. The embodiments may utilize photo identification and government identities using networked capabilities and capabilities within a process for end-to-end fully remote identity proofing followed by the automated provisioning and issuance of a trusted identity and optional credentials. In alternative manifestations the embodiments use automated government identity lookups including but not limited to digital imagery equipment with artificial intelligence and pattern recognition to detect fraudulent physical identification articles remotely, electronic scans of magnetic stripes and other electronic markers on government-issued identification media including but not limited to drivers licenses, government employee identities, passports, or other government-issued identities combined with real-time lookup in trusted databases. In alternative manifestations the embodiments use multiple biometric form factors for proofing, registration, recognition, and authentication.

Claims

1. A method according to a set of instructions stored on the memory of a computing device, the method comprising:

receiving, by a processor of the computing device, a request to verify an identity from an applicant device, wherein the request comprises;

a request for trusted identity information and

authentication information associated with the identity;

comparing, by the processor, the authentication information to stored identity information according to one or more identity proofing requirements;

determining, by the processor, a failed match between the authentication information and the stored identity information; and

initiating, by the processor, based on the determination of the failed match, a real time video communication session between the applicant device and a registration authority device configured to allow a registration authority to inspect identification information for determining a match between the identification information and the stored identity information.

2. The method of claim 1, wherein determining the failed match comprises:

sending, by the processor, a request for knowledge based authentication (KBA) information to the applicant device; and

receiving, by the processor, at least one reply comprising information that fails to satisfy the request for the KBA information.

3. The method of claim 1, further comprises:

receiving, by the processor, a registration authority verification of the match according to the one or more identity proofing requirements;

sending, by the processor, in response to receiving the registration authority verification, a token to an issuing trusted identity service; and

sending, by the processor, from the issuing trusted identity service and in response to the token, the trusted identity information to the applicant device.

4. The method of claim 1, wherein determining the failed match further comprises scanning a government issued identification and determining the failed match between the government issued identification and the stored identity information.

5. The method of claim 4, wherein initiating the real time video communication session occurs after scanning the government issued identification to determine the failed match.

6. The method of claim 1, wherein determining the failed match comprises determining a partial match between the authentication information and the stored identity information.

7. The method of claim 6, further comprising, in response to determining the partial match, scanning a government issued identification to determine a match between the government issued identification and the stored identity information.

8. The method of claim 1, wherein the failed match is determined and the real time video communication session initiated based on a random selection of an applicant occurring according to a specified random screening threshold.

9. The method of claim 1, further comprising applying an answer logic to determine an accuracy level of the failed match between the authentication information and the stored identity information, and further wherein:

when the accuracy level of the failed match between the authentication information and the stored identity information is less than a first threshold, the real time communication session is initiated, and

when the accuracy level of the failed match between the authentication information and the stored identity information is at least at the first threshold and less than a second threshold, scanning a government issued identification to determine a match between the government issued identification and the stored identity information is initiated.

10. The method of claim 9, further wherein when the accuracy level of the match between the authentication information and the stored identity information is greater than the second threshold, the token is sent to the issuing trusted identity service.

11. The method of claim 9, wherein the first threshold is 50% and the second threshold is 99%.

12. The method of claim 1, further comprising providing, by the processor, a referral to an in-person registration authority.

13. The method of claim 12, wherein the referral is provided in response to an indication received by the registration authority device of a failure by the registration authority to determine the match.

14. A non-transitory computer readable medium having instructions stored thereon that, upon execution by a computing device, cause the computing device to perform operations, wherein the instructions comprise:

instructions to receive a request to verify an identity from an applicant device, wherein the request comprises;

a request for trusted identity information and

authentication information associated with the identity;

instructions to compare the authentication information to stored identity information according to one or more identity proofing requirements;

instructions to determine a failed match between the authentication information and the stored identity information; and

instructions to initiate, based on the determination of the failed match, a real time video communication session between the applicant device and a registration authority device configured to allow a registration authority to inspect identification information for determining a match between the identification information and the stored identity information.

15. The non-transitory computer readable medium of claim 14, wherein the determination of the failed match between the authentication information and the stored identity information comprises:

a failed match of knowledge based authentication information (KBA) to the stored identity information;

a failed match of a government issued identification information to the stored identity information;

or

a failed match of a second form of identification to the stored identity information.

16. The non-transitory computer readable medium of claim 14, further comprising instructions to provide a referral to an in-person registration authority in response to the failed match of the KBA, the government issued identification information, or the second form of identification to the stored identity information.

17. An apparatus comprising:

a memory;

a processor coupled to the memory; and

a first set of instructions stored on the memory and configured to be executed by the processor, wherein the processor is configured to;

receive a request to verify an identity from an applicant device, wherein the request comprises;

a request for trusted identity information and

authentication information associated with the identity;

compare the authentication information to stored identity information according to one or more identity proofing requirements;

determine a failed match between the authentication information and the stored identity information; and

initiate, based on the determination of the failed match, a real time video communication session between the applicant device and a registration authority device configured to allow a registration authority to inspect identification information for determining a match between the identification information and the stored identity information.

18. The apparatus of claim 17, wherein the failed match is determined if incorrect authentication information is received from the applicant device more than a predetermined number of attempts.

19. The apparatus of claim 17, wherein the processor is further configured to determine one or more identity proofing requirements in response to the request for trusted identity information.

20. The apparatus of claim 19, wherein the processor is further configured to determine the failed match between the authentication information and the stored identity information based on the determined one or more identity proofing requirements.

21. The apparatus of claim 17, wherein after the real time video communication session is initiated, the processor is further configured to:

receive a registration authority verification of the match according to the one or more identity proofing requirements;

determine a common key identifier unique to an individual associated with the request.

22. The apparatus of claim 21, wherein the determination of the common key identifier comprises determination of a match of the stored identity information or the authentication information to identification information associated with the common key identifier as stored in a master index.

23. The apparatus of claim 21, wherein the processor is further configured to, as part of the determination of the common key identifier comprises:

generate the common key identifier in response to a failed match of the stored identity information or the authentication information to identification information as stored in a master index;

send a trusted identity service the generated common key identifier such that the common key identifier is permanently associated with the trusted identity in the master index; and

issue the trusted identity information to the applicant device.

24. The apparatus of claim 21, wherein the processor is further configured to associate the trusted identity information with the common key identifier.

25. The apparatus of claim 21, wherein the processor is further configured to associate secure messaging information with the common key identifier.