Identity Management Service Using A Blockchain Providing Certifying Transactions Between Devices

• US 20160330027A1
• Filed: 05/04/2016
• Published: 11/10/2016
• Est. Priority Date: 05/05/2015
• Status: Active Grant

• Current Assignee: Ping Identity Corporation
• Original Assignee: Shocard, Inc.
• Inventors: Ebrahimi, Armin
• Granted Patent: US 9,722,790 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06K 19/06028 using bar codes
• CPC Class Codes: G06K 19/06037 multi-dimensional coding
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/065 using e-cash
• CPC Class Codes: G06Q 20/3276 using a pictured code, e.g. barcode or QR-code, being read by the M-device
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3827 Use of message hashing
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/302 : involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3066 : involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3236 : using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 : involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3249 : using RSA or related signature schemes, e.g. Rabin scheme
• CPC Class Codes: H04L 9/3252 : using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/50 : using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/77 : Graphical identity

Abstract

Logic on a first remote device receives a first transaction number and personal data transmitted from a second remote device. The first transaction number was received from a distributed public database in response to a transmission, from the second remote device, of a signed hash value and a first public key associated with a first private key on the second remote device. The signed hash value was created by signing a hash value with the first private key and the hash value was generated by hashing the personal data with a hashing algorithm on the second remote device. The logic uses the first transaction number to retrieve the signed hash value and the first public key from the distributed public database. The logic hashes the personal data using the hashing algorithm to create a generated hash value and verifies the signed hash value against the generated hash value.

Claims

1. A method, comprising operations of:

receiving, on a first remote device, a first transaction number and personal data transmitted from a second remote device, wherein the first transaction number was received from a distributed public database in response to a transmission, from the second remote device, of a signed hash value and a first public key associated with a first private key on the second remote device, wherein the signed hash value was created by signing a hash value with the first private key, and wherein the hash value was generated by hashing the personal data with a hashing algorithm on the second remote device;

using the first transaction number to retrieve the signed hash value and the first public key from the distributed public database,

hashing the personal data using the hashing algorithm to create a generated hash value;

verifying that the hash value in the retrieved signed hash value is the same as the generated hash value;

verifying that the retrieved signed hash value was signed with the first private key; and

creating a certification.

2. The method of claim 1, wherein the certification includes the first transaction number and the personal data or selected fields of the personal data.

3. The method of claim 1, wherein the certification is signed with a second private key on the first remote device.

4. The method of claim 1, wherein the signed certification record is transmitted, over a network, to the distributed public database for storage.

5. The method of claim 1, wherein a second transaction number is received by the first remote device from the distributed public database.

6. The method of claim 1, wherein the distributed public database is a block chain that receives data for storage from a plurality of entities, the data received for storage is configured to be processed to generate a transaction record that is dependent on previous data stored to the block chain, wherein transaction record being dependent on previous data stored to the block chain ensures that data stored to the block chain is not modifiable, as later data stored to the block chain continues to be dependent on previous data stored to the block chain.

7. The method of claim 1, wherein the remote device is one of a smartphone, or a tablet, or an electronic device.

8. The method of claim 1, wherein the identification card is one of a driver license, or a passport, or an employee badge, or a military identification, or a political identification.

9. The method of claim 1, wherein the capturing operation is performed using a digital camera, or a scanner, or a smartphone, or a keyboard, or a touchscreen, or voice recognition, or handwriting recognition, or a combination of two or more thereof.

10. The method of claim 1, wherein at least a part of the personal data is coded in a barcode or QR code.

11. A method, comprising operations of:

receiving, on a first smartphone, a first transaction number and personal data transmitted from a second smartphone, wherein the first transaction number was received from a block chain in response to a transmission, from the second smartphone, of a signed hash value and a first public key associated with a first private key on the second smartphone, wherein the signed hash value was created by signing a hash value with the first private key, and wherein the hash value was generated by hashing the personal data with a hashing algorithm on the second remote device;

using the first transaction number to retrieve the signed hash value and the first public key from the block chain,

hashing the personal data using the hashing algorithm to create a generated hash value;

verifying that the hash value in the retrieved signed hash value is the same as the generated hash value;

verifying that the retrieved signed hash value was signed with the first private key; and

creating a certification.

12. The method of claim 11, wherein the certification includes the first transaction number and the personal data or selected fields of the personal data.

13. The method of claim 12, wherein the certification is signed with a second private key on the first smartphone.

14. The method of claim 13, wherein the signed certification record is transmitted, over a network, to the block chain for storage.

15. The method of claim 14, wherein a second transaction number is received by the first smartphone from the block chain.

16. The method of claim 11, wherein the identification card is one of a driver license, or a passport, or an employee badge, or a military identification, or a political identification.

17. The method of claim 11, wherein the capturing operation is performed using a digital camera, or a scanner, or a smartphone, or a keyboard, or a touchscreen, or voice recognition, or handwriting recognition, or a combination of two or more thereof.

18. A method, comprising operations of:

receiving, on a first smartphone, a first transaction number and personal data transmitted from a second smartphone, wherein the receiving involves scanning a barcode or QR code, wherein the first transaction number was received from a block chain in response to a transmission, from the second smartphone, of a signed hash value and a first public key associated with a first private key on the second smartphone, wherein the signed hash value was created by signing a hash value with the first private key, and wherein the hash value was generated by hashing the personal data with a hashing algorithm on the second remote device;

using the first transaction number to retrieve the signed hash value and the first public key from the block chain,

hashing the personal data using the hashing algorithm to create a generated hash value;

verifying that the hash value in the retrieved signed hash value is the same as the generated hash value;

verifying that the retrieved signed hash value was signed with the first private key; and

creating a certification.

19. The method of claim 18, wherein the certification includes the first transaction number and the personal data or selected fields of the personal data.

20. The method of claim 19, wherein the certification is signed with a second private key on the first smartphone.