Systems and Methods for Registering and Acquiring E-Credentials using Proof-of-Existence and Digital Seals

• US 20180173871A1
• Filed: 02/18/2018
• Published: 06/21/2018
• Est. Priority Date: 10/01/2014
• Status: Active Grant

• Current Assignee: Kalman Csaba Toth
• Original Assignee: Kalman Csaba Toth
• Inventors: Toth, Kalman Csaba
• Granted Patent: US 10,127,378 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06K 7/1095 the scanner comprising adaptations for scanning a record carrier that is displayed on a display-screen or the like
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Described is a system and methods for registering and acquiring e-credentials using personal devices and an identity registry system that combines the method for handling digital seals with a proof-of-existence method. The identity registry system is used to register and verify e-credentials. Device owners register their e-credentials when created and updated, and verify acquired e-credentials to safeguard against tampering and errors. When registering an e-credential, the e-credential is hashed and digitally sealed creating an identifying thumbprint that is stored in the identity registry system. When verifying an acquired e-credential, the e-credential is hashed, the identity registry system is searched to locate the identifying thumbprint, and the digital seal of the thumbprint is verified. A requesting owner can request an issuing owner to proof, attest, and digitally seal an e-credential of the requester. Both the issuer and requester use the identity registry system to verify e-credentials acquired from the other party.

Claims

1. A method for registering and acquiring e-credentials comprised of:

providing personal identity devices of owners, a device of an owner having an identity engine, the identity engine of the owner having e-credentials, including e-credentials of the owner and e-credentials of other owners;

providing a method for handling digital seals applied to electronic artifacts including documents, messages and e-credentials including affixing a digital seal to an electronic artifact using an e-credential of the owner, and inspecting a digital seal affixed to an electronic artifact using an e-credential of the owner;

providing an identity registry system having a memory, said system capable of storing an identifying thumbprint of an e-credential into said memory at a memory location, said identifying thumbprint and memory location specified by means of the identity engine of an owner, said identity registry system further capable of fetching said identifying thumbprint of said e-credential from a memory location of said memory specified by means of the identity engine of an owner, whereby an e-credential is registered in the identity registry system when stored, and the registration of said e-credential is verified when fetched;

an owner registering an e-credential by means of the identity engine of the owner, selecting an e-credential of the owner or an e-credential of another owner, the e-credential to be registered, hashing at least the identifier and public encryption keys of said e-credential yielding a hash, using said hash to specify a memory location, selecting an e-credential of the owner, the registering e-credential, using the method for handling digital seals, the registering e-credential, and said hash to affix a digital seal to the hash, the hash and the affixed digital seal yielding the identifying thumbprint of the e-credential to be registered, and storing said identifying thumbprint into said memory location of the identity registry system;

whereby the identifying thumbprint of the registered e-credential does not reveal personally identifying information of said e-credential, and the owner of the registering e-credential cannot repudiate having registered the e-credential to be registered;

an owner verifying the registration of an e-credential by means of the identity engine of the owner, selecting an e-credential of the owner or an acquired e-credential of another owner, the e-credential to be verified, hashing at least the identifier and public encryption keys of said e-credential to be verified yielding the hash of the e-credential to be verified, using said hash to specify a memory location, using said memory location to fetch the contents of the memory location from the identity registry system, terminating if an identifying thumbprint cannot be found in the memory location, extracting the hash and the digital seal of the identifying thumbprint, terminating if said hash and the hash of the e-credential to be verified do not match, examining said digital seal to determine and acquire the registering e-credential, using said registering e-credential, said hash, said digital seal, and the method for handling digital seals to verify said digital seal, terminating if said digital seal does not verify, otherwise indicating that the e-credential to be verified is registered;

whereby the owner verifies that the e-credential to be verified is registered in the identity registry system by the owner of the registering e-credential.

2. The method for registering and acquiring e-credentials as in claim 1 further comprised of:

a first device owner, the requester, having an e-credential of a second device owner, the issuer, the requester verifying the registration of said e-credential of the issuer, and, if said e-credential of the issuer is registered in the identity registry system, sending an e-credential of the requester, including personally identifying information of the requester, to the issuer;

whereby the requester verifies that the e-credential of the issuer is registered in the identity registry system prior to sending an e-credential and personally identifying information to the issuer.

3. The method for registering and acquiring e-credentials as in claim 2 further comprised of:

the issuer, having received an e-credential of the requester and personally identifying information of the requester, an e-credential request, verifying the registration of the received e-credential of the requester, if said e-credential is registered in the identity registry system using the personally identifying information of the requester to proof the identity of the requester, if identity proofing of the requester is successful selecting an e-credential of the issuer, using said e-credential of the issuer and the method for handling digital seals to affix a digital seal of the issuer to the e-credential of the requester yielding a digitally sealed e-credential of the requester, registering said digitally sealed e-credential of the requester in the identity registry system using said e-credential of the issuer, verifying that said e-credential of the requester is registered in the identity registry system, and issuing said digitally sealed e-credential of the requester to the requester;

whereby the issuer registers the digitally sealed e-credential of the requester in the identity registry system and issues the digitally sealed e-credential to the requester.

4. The method for registering and acquiring e-credentials as in claim 2 further comprised of:

the requester, receiving a digitally sealed e-credential of the requester from the issuer, said e-credential digitally sealed by the issuer, verifying the registration of said digitally sealed e-credential of the requester, and, if said digitally sealed e-credential is registered in the identity registry system, sending an acknowledgement to the issuer and registering the digitally sealed e-credential of the requester in the identity registry system using said e-credential of the requester;

whereby the requester verifies that the digitally sealed e-credential of the requester received from the issuer was registered in the identity registry system by the issuer, and the requester registers said digitally sealed e-credential in the identity registry system using said e-credential of the requester.