PORTABLE VERIFIABLE CREDENTIALS AND METHODS THEREOF

• US 20170324750A1
• Filed: 02/15/2016
• Published: 11/09/2017
• Est. Priority Date: 01/12/2015
• Status: Active Grant

• Current Assignee: Sal Khan
• Original Assignee: Sal Khan
• Inventors: KHAN, SAL
• Granted Patent: US 10,171,476 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The migration of identity documents, such as driving licenses, from physical documents to electronic documents creates new problems for those seeking to verify the identity of an individual based upon the electronic document they provide. However, the inventors have established a means of binding electronic documents and electronic representations of physical documents to individuals at issuance of the document(s). Accordingly, the inventors address identity verification by providing to those seeking to verify the individual'"'"'s identity data allowing them to verify the presented electronic ID document. For example, a police officer requesting a driving license can obtain on their own electronic device through the methods of the invention the issued driving license associated with identifier information on the license provided by the individual. As such tampering with the license to change a name, date of birth, photo etc. will result in a visible mismatch to the police officer in comparing them.

Claims

1. A method of providing verification of an individual to a third party by providing to the third party a representation of the originally issued identity document associated with information provided by the individual during the verification process.

2. The method according to claim 1, wherein

the representation of the originally issued identity document is provided to a first electronic device associated with the third party in a first message from a remote server based upon information provided to the third party by a second electronic device associated with the individual.

3. The method according to claim 1, wherein

the representation of the originally issued identity document is provided to a first electronic device associated with the third party in a first message from a remote server based upon information provided by the third party to an application in execution upon a second electronic device associated with the individual.

4. The method according to claim 1, wherein

the representation of the originally issued identity document is at least one of:

a fractal image forming a predetermined portion of the originally issued identity document; and

an image of the originally issued identity document redacted according to a privacy policy relating to personal data.

5. The method according to claim 1, wherein

communications to a first electronic device associated with the third party from an authentication server together with communications from a second electronic device associated with the individual authorizing the provisioning of verification information to the authentication server are encrypted with ciphering processes exploiting cipher data stored within subscriber identity modules on the first and second electronic processes.

6. A method of providing verification of an individual to a third party by providing to the third party first data and to the individual second data, each of the first data and second data generated in dependence upon third data provided by the individual to a web based verification application;

wherein

a predetermined portion of the second data forms a predetermined portion of the first data;

the third data was provided by the individual to the web based verification application via a first electronic device associated with the individual; and

the first data was provided by the web based verification application to a second electronic device associated with the third party based upon the third data being initially provided to the third party by the individual and communicated to the web based verification application via the second electronic device.

7. The method according to claim 6, wherein

communications to a first electronic device associated with the third party from an authentication server together with communications from a second electronic device associated with the individual authorizing the provisioning of verification information to the authentication server are encrypted with ciphering processes exploiting cipher data stored within subscriber identity modules on the first and second electronic processes.

8. A method comprising:

providing to a first electronic device credential information relating to an individual associated with the first electronic device, the credential information authorizing submission of a first message to a remote server;

receiving upon the first electronic device first data, the first data provided by the remote server in response to the first message;

capturing upon a second electronic device associated with a third party seeking to verify an aspect of the identity of the individual a representation of the first data;

transmitting from the second electronic device a second message to the remote server, the second message containing a predetermined subset of the first data and relating to a request to retrieve a predetermined portion of at least one of an electronic identity document and a digital representation of a physical identity document associated with the credential information;

retrieving with the remote server in response to a request sent by the remote server second data relating to identity attribute information stored within a database associated with the issuer of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information;

transmitting to the first electronic device third data relating to the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information; and

transmitting to the second electronic device fourth data relating the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information.

9. The method according to claim 8, wherein

the third data is at least one of:

a privacy policy compliant redacted image of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information;

a unique fractal associated with the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information;

a unique fractal generated by an issuer of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information in response to the request from the remote server; and

a unique identification number generated by the remote server.

10. The method according to claim 8, wherein

the fourth data is at least one of:

an image of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information;

a privacy policy compliant redacted image of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information;

a unique fractal associated with the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information;

a unique fractal generated by an issuer of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information in response to the request from the remote server;

a unique identification number generated by the remote server; and

a predetermined portion of data stored by an issuer of the at least one of the electronic identity document and the digital representation of a physical identity document associated with the credential information.

11. The method according to claim 8, wherein

the method terminates if the second message is not received by the remote server within a predetermined time period after its receipt of the first message.

12. The method according to claim 8, wherein

the process allows validating of a non-photographically based identity document by verifying a photographically based identity document presented at the same time as the non-photographically based identity document by the same user, the verification of the photographically based identity document.

13. The method according to claim 8, wherein

communications between an electronic device associated with a party and an authentication server are encrypted with ciphering processes exploiting cipher data stored within subscriber identity modules on the first and second electronic processes.