TOKEN IDENTITY AND ATTRIBUTE MANAGEMENT

• US 20180019879A1
• Filed: 05/09/2017
• Published: 01/18/2018
• Est. Priority Date: 07/12/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kravitz, David W., Ponceleon, Dulce B., Masini, Diego A., Laprida, Raul O., Garagiola, Andres, Geagan, III, John B.
• Granted Patent: US 10,700,853 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

One example method of operation may include receiving a request, from an entity, for one or more tokens based on one or more attributes, encrypting and masking the one or more attributes, adding the encrypted and masked one or more attributes to the one or more tokens, and transmitting the one or more tokens to the entity.

Claims

1. A method, comprising:

receiving a request, from an entity, for one or more tokens based on one or more attributes;

encrypting and masking the one or more attributes;

adding the encrypted and masked one or more attributes to the one or more tokens; and

transmitting the one or more tokens to the entity.

2. The method of claim 1, further comprising:

selecting the one or more attributes; and

generating a masking and attribute encryption key to use when encrypting and masking the one or more attributes.

3. The method of claim 1, further comprising repeating the adding of the encrypted and the masked one or more attributes to the one or more tokens until all the one or more attributes from the request are processed.

4. The method of claim 2, further comprising verifying validity and ownership of the attributes by the entity prior to generating the masking and attribute encryption key.

5. The method of claim 1, wherein the one or more tokens comprise a single attribute root key.

6. The method of claim 1, wherein the one or more attributes identify the entity and comprise a label and a value.

7. The method of claim 1, wherein the one or more tokens transmitted to the entity comprise one or more answers to one or more questions submitted by the entity.

8. An apparatus, comprising:

a receiver configured to receive a request, from an entity, for one or more tokens based on one or more attributes;

a processor configured to

encrypt and mask the one or more attributes;

add the encrypted and masked one or more attributes to the one or more tokens; and

a transmitter configured to transmit the one or more tokens to the entity.

9. The apparatus of claim 8, wherein the processor is further configured to

select the one or more attributes, and

generate a masking and attribute encryption key to use when the processor encrypts and masks the one or more attributes.

10. The apparatus of claim 8, wherein the processor is further configured to repeat the adding of the encrypted and the masked one or more attributes to the one or more tokens until all the one or more attributes from the request are processed.

11. The apparatus of claim 9, wherein the processor is further configured to

verify validity and ownership of the attributes by the entity prior to the generation of the masking and attribute encryption key.

12. The apparatus of claim 8, wherein the one or more tokens comprise a single attribute root key.

13. The apparatus of claim 8, wherein the one or more attributes identify the entity and comprise a label and a value.

14. The apparatus of claim 8, wherein the one or more tokens transmitted to the entity comprise one or more answers to one or more questions submitted by THe entity.

15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform:

receiving a request, from an entity, for one or more tokens based on one or more attributes;

encrypting and masking the one or more attributes;

adding the encrypted and masked one or more attributes to the one or more tokens; and

transmitting the one or more tokens to the entity.

16. The non-transitory computer readable storage medium of claim 15, wherein he processor is further configured to perform.

selecting the one or more attributes;

and

generating a masking and attribute encryption key to use when encrypting and masking the one or more attributes.

17. The non-transitory computer readable storage medium of claim 15, wherein the processor is further configured to perform:

repeating the adding of the encrypted and the masked one or more attributes to the one or more tokens until all the one or more attributes from the request are processed.

18. The non-transitory computer readable storage medium of claim 16, wherein the processor is further configured to perform:

verifying validity and ownership of the attributes by the entity prior to generating the masking and attribute encryption key.

19. The non-transitory computer readable storage medium of claim 15, wherein the one or more tokens comprise a single attribute root key.

20. The non-transitory computer readable storage medium of claim 15, wherein the one or more attributes identify the entity and comprise a label and a value, and wherein the one or more tokens transmitted to the entity comprise one or more answers to one or more questions submitted by the entity.