METHODS AND SYSTEMS FOR IDENTITY CREATION, VERIFICATION AND MANAGEMENT

• US 20170177855A1
• Filed: 10/03/2016
• Published: 06/22/2017
• Est. Priority Date: 12/22/2015
• Status: Active Grant

• Current Assignee: Refinitiv US Organization, LLC (Refinitiv US Holdings, Inc.)
• Original Assignee: Thomson Reuters Global Resources
• Inventors: COSTA FAIDELLA, David, SCHUKAI, Robert Joseph, MANUEL, Scott Ryan, PIERLEONI, Marco, THOMAS, Jason A.
• Granted Patent: US 10,248,783 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

An embodiment of a method of providing identity services includes: receiving identity data for an individual for which the identity provider has provided an identity; generating a transaction to store an identifier representing the identity data in a data structure on a blockchain of a distributed system; sending the transaction to at least one node of the distributed system; and generating an identity token incorporating the identifier representing the identity data. An embodiment of a method of verifying an identity includes: receiving data extracted from the identity token, wherein the extracted data includes an identifier representing the identity data; determining whether a data structure containing the extracted identifier representing the identity data is stored on a blockchain of a distributed system; and outputting an indication of a validity of an identity associated with the identity data based on the determination.

Claims

1. A method of providing identity services, the method comprising:

receiving, from an identity provider system, identity data for an individual for which the identity provider has provided an identity;

generating a transaction to store an identifier representing the identity data in a data structure on a blockchain of a distributed system;

sending the transaction to at least one node of the distributed system; and

generating an identity token incorporating the identifier representing the identity data.

2. The method of claim 1, wherein the transaction invokes an identity creation function of an identity services contract stored on the blockchain.

3. The method of claim 1, further comprising generating the identifier representing the identity data by performing at least one cryptographic hash function on the identity data.

4. The method of claim 1, wherein the identity data is validated by the identity provider.

5. The method of claim 1, wherein the identity data includes at least one of:

a name of the individual, an identification number of the identity of the individual, or an address of the individual.

6. The method of claim 1, wherein the identity data includes at least one representation of a biometric trait of an individual.

7. The method of claim 6, wherein the representation of the biometric trait includes at least one of:

a picture of the individual, a fingerprint of the individual, a facial pattern of the individual, an iris pattern of the individual, a retina pattern of the individual, a representation of a voice of the individual, or a deoxyribonucleic acid (DNA) pattern of the individual.

8. The method of claim 1, wherein generating the identity token includes encoding into the token at least one of:

the identifier representing the identity data, an identification of the identity provider, or a digital signature of the identity provider.

9. The method of claim 1, further comprising providing the identity token to the individual.

10. The method of claim 1, further comprising:

receiving metadata associated with the individual;

generating a transaction to store the metadata or a representation of the metadata on the block chain in association with the identifier representing the identity data; and

sending the transaction to at least one node of the distributed system.

11. The method of claim 10, wherein the transaction invokes a metadata creation function of an identity services contract stored on the blockchain.

12. A method of verifying an identity, the method comprising:

receiving, from a restricted access system, data extracted from an identity token, wherein the extracted data includes an identifier representing identity data;

determining whether a data structure containing the extracted identifier representing the identity data is stored on a blockchain of a distributed system; and

outputting an indication of a validity of an identity associated with the identity data based on the determination.

13. The method of claim 12, wherein the determining includes invoking an identity verification function of an identity services contract stored on a blockchain, the invocation including the extracted identifier representing the identity data.

14. The method of claim 12, further comprising authorizing the individual to access the restricted access system based on the validity of the identity.

15. The method of claim 12, wherein the extracted data further includes a digital signature of the identity provider extracted from the identity token, and the method further comprises verifying the digital signature using a public key of the identity provider.

16. The method of claim 12, wherein the data extracted from the identity token includes a representation of a biometric trait of the individual, and the method further comprises verifying the representation of the extracted biometric trait against a biological feature of the individual.

17. The method of claim 16, further comprising authorizing the individual to access the restricted access system based on the validity of the identity and the verification of the biometric trait.

18. The method of claim 12, wherein the identifier representing the identity data includes data formed by performing at least one cryptographic hash function on the identity data.

19. A non-transitory, machine-readable storage medium having program instructions, which when executed by a processor perform a method of providing identity services, the method comprising:

receiving, from an identity provider system, identity data for an individual for which the identity provider has provided an identity;

generating a transaction to store an identifier representing the identity data in a data structure on a blockchain of a distributed system;

sending the transaction to at least one node of the distributed system; and

generating an identity token incorporating the identifier representing the identity data.

20. The non-transitory machine readable storage medium of claim 19, wherein the transaction invokes an identity creation function of an identity services contract stored on the blockchain.

21. The non-transitory machine readable storage medium of claim 19, the method further comprising generating the identifier representing the identity data by performing at least one cryptographic hash function on the identity data.

22. The non-transitory machine readable storage medium of claim 19, wherein generating the identity token includes encoding into the token at least one of:

the identifier representing the identity data, an identification of the identity provider, or a digital signature of the identity provider.

23. A non-transitory, machine-readable storage medium having program instructions, which when executed by a processor perform a method of verifying an identity, the method comprising:

receiving, from a restricted access system, data extracted from an identity token, wherein the extracted data includes an identifier representing identity data;

determining whether a data structure containing the extracted identifier representing the identity data is stored on a blockchain of a distributed system; and

outputting an indication of a validity an identity associated with the identity data based on the determination.

24. The non-transitory machine readable storage medium of claim 23, wherein the determining includes invoking an identity verification function of an identity services contract stored on a blockchain, the invocation including the extracted identifier representing the identity data.

25. The non-transitory machine readable storage medium of claim 23, the method further comprising authorizing the individual to access the restricted access system based on the indication of the validity of the identity.

26. The non-transitory machine readable storage medium of claim 23, wherein the extracted data further includes a digital signature of the identity provider extracted from the identity token, and the method further comprises verifying the digital signature using a public key of the identity provider.

27. The non-transitory machine readable storage medium of claim 23, wherein the data extracted from the identity token includes a representation of a biometric trait of the individual, and the method further comprises verifying the representation of the extracted biometric trait against a biological feature of the individual.