METHOD AND SYSTEM FOR IDENTITY AND CREDENTIAL PROTECTION AND VERIFICATION VIA BLOCKCHAIN

• US 20180101684A1
• Filed: 09/26/2017
• Published: 04/12/2018
• Est. Priority Date: 10/06/2016
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: MURPHY, Anthony Paul, MATTINGLY, Timothy Warren, FLOR, Peter
• Granted Patent: US 10,503,916 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method for distributed storage of identity data includes: receiving entity data for a plurality of entities, the data including an associated public key, associated attributes, and a geographic jurisdiction, and where one entity is a subordinate; generating a data file for each entity including the associated attributes and public key, and where the subordinate entity'"'"'s data file includes a digital signature associated with a superior entity; generating an identity value for each entity via hashing the associated data file; and storing, in a distributed hash table, a key-value pair for each entity, wherein the key is the associated identity value, the value comprises the associated attributes, and the key-value pair is stored in a physical data storage device located in a geographic area corresponding to the associated geographic jurisdiction.

Claims

1. A method for distributed storage of identity data, comprising:

receiving, by a receiving device of a processing server, entity data for a plurality of entities, wherein the entity data includes at least an associated public key, one or more associated attributes, and a geographic jurisdiction, and where at least one of the plurality of entities is indicated as being a subordinate;

generating, by a generation module of the processing server, a data file for each of the plurality of entities, wherein each data file includes at least the one or more associated attributes and associated public key, and where the data file for an entity indicated as a subordinate includes a digital signature associated with a superior entity;

generating, by a hashing module of the processing server, an identity value for each of the plurality of entities via application of one or more hashing algorithms to the data file generated for the respective entity; and

executing, by a querying module of the processing server, a query on a distributed hash table to store, for each of the plurality of entities, a key-value pair, wherein the key is the identity value for the respective entity and the value comprises at least each of the one or more associated attributes for the respective entity, wherein

the distributed hash table is comprised of a plurality of physical data storage devices, each data storage device being located in a geographic area, and where each key-value pair is stored in a physical data storage device where the associated geographic area corresponds to the geographic jurisdiction included in the entity data for the respective entity.

2. The method of claim 1, wherein the entity data for each entity indicated as a subordinate includes the digital signature associated with the superior entity.

3. The method of claim 1, wherein the indication as being a subordinate is the digital signature associated with the superior entity.

4. The method of claim 1, wherein

the superior entity is one of the plurality of entities, and

the digital signature associated with the superior entity is generated using a private key corresponding to the associated public key included in the entity data for the superior entity.

5. The method of claim 4, wherein the entity data for the superior entity includes the associated digital signature.

6. A method for immutable storage of identity data, comprising:

storing, in a memory of a processing server, a blockchain, wherein the blockchain is comprised of a plurality of blocks including, each block comprised of block data and a block header that includes at least a timestamp;

receiving, by a receiving device of a processing server, entity data for a plurality of entities, wherein the entity data includes at least an associated public key, one or more associated attributes, and a geographic jurisdiction, and where at least one of the plurality of entities is indicated as being a subordinate;

generating, by a generation module of the processing server, a data file for each of the plurality of entities, wherein each data file includes at least the one or more associated attributes and associated public key, and where the data file for an entity indicated as a subordinate includes a digital signature associated with a superior entity;

generating, by a hashing module of the processing server, an identity value for each of the plurality of entities via application of one or more hashing algorithms to the data file generated for the respective entity; and

generating, by the generation module of the processing server, a new block comprised of a new block header and block data, wherein the block header includes at least a timestamp and a hash value of the block header of a most recent block of the plurality of blocks based on the timestamp included in the block header of each respective block, and wherein the block data includes at least the generated identity value for each of the plurality of entities.

7. The method of claim 6, further comprising:

executing, by a querying module of the processing server, a query on the memory to add the generated new block to the blockchain.

8. The method of claim 6, further comprising:

electronically transmitting, by a transmitting module of the processing server, the generated new block to a node associated with the blockchain.

9. The method of claim 6, wherein

the superior entity is one of the plurality of entities, and

the digital signature associated with the superior entity is generated using a private key corresponding to the associated public key included in the entity data for the superior entity.

10. The method of claim 9, wherein the entity data for the superior entity includes the associated digital signature.

11. A system for distributed storage of identity data, comprising:

a receiving device of a processing server configured to receive entity data for a plurality of entities, wherein the entity data includes at least an associated public key, one or more associated attributes, and a geographic jurisdiction, and where at least one of the plurality of entities is indicated as being a subordinate;

a generation module of the processing server configured to generate a data file for each of the plurality of entities, wherein each data file includes at least the one or more associated attributes and associated public key, and where the data file for an entity indicated as a subordinate includes a digital signature associated with a superior entity;

a hashing module of the processing server configured to generate an identity value for each of the plurality of entities via application of one or more hashing algorithms to the data file generated for the respective entity; and

a querying module of the processing server configured to execute a query on a distributed hash table to store, for each of the plurality of entities, a key-value pair, wherein the key is the identity value for the respective entity and the value comprises at least each of the one or more associated attributes for the respective entity, wherein

the distributed hash table is comprised of a plurality of physical data storage devices, each data storage device being located in a geographic area, and where each key-value pair is stored in a physical data storage device where the associated geographic area corresponds to the geographic jurisdiction included in the entity data for the respective entity.

12. The system of claim 11, wherein the entity data for each entity indicated as a subordinate includes the digital signature associated with the superior entity.

13. The system of claim 11, wherein the indication as being a subordinate is the digital signature associated with the superior entity.

14. The system of claim 11, wherein

the superior entity is one of the plurality of entities, and

the digital signature associated with the superior entity is generated using a private key corresponding to the associated public key included in the entity data for the superior entity.

15. The system of claim 14, wherein the entity data for the superior entity includes the associated digital signature.

16. A system for immutable storage of identity data, comprising:

a memory of a processing server configured to store a blockchain, wherein the blockchain is comprised of a plurality of blocks, each block comprised of block data and a block header, and wherein the block header includes at least a timestamp;

a receiving device of a processing server configured to receive entity data for a plurality of entities, wherein the entity data includes at least an associated public key, one or more associated attributes, and a geographic jurisdiction, and where at least one of the plurality of entities is indicated as being a subordinate;

a generation module of the processing server configured to generate a data file for each of the plurality of entities, wherein each data file includes at least the one or more associated attributes and associated public key, and where the data file for an entity indicated as a subordinate includes a digital signature associated with a superior entity; and

a hashing module of the processing server configured to generate an identity value for each of the plurality of entities via application of one or more hashing algorithms to the data file generated for the respective entity, wherein

the generation module of the processing server is further configured to generate a new block comprised of a new block header and block data, wherein the block header includes at least a timestamp and a hash value of the block header of a most recent block of the plurality of blocks based on the timestamp included in the block header of each respective block, and wherein the block data includes at least the generated identity value for each of the plurality of entities.

17. The system of claim 16, further comprising:

a querying module of the processing server configured to execute a query on the memory to add the generated new block to the blockchain.

18. The system of claim 16, further comprising:

a transmitting module of the processing server configured to electronically transmit the generated new block to a node associated with the blockchain.

19. The system of claim 16, wherein

the superior entity is one of the plurality of entities, and

the digital signature associated with the superior entity is generated using a private key corresponding to the associated public key included in the entity data for the superior entity.

20. The system of claim 19, wherein the entity data for the superior entity includes the associated digital signature.