System and methods for providing identity attribute validation in accordance with an attribute disclosure profile
First Claim
1. A method of server-based identity attribute validation, comprising:
- a computer server receiving an identity attribute validation request from one of a plurality of communication devices, and an identifier associated with the one communication device, the identity attribute validation request requesting at least one attribute for disclosure to the one communication device, the computer server further receiving a credential and being configured with at least one attribute disclosure profile, each said attribute disclosure profile being associated with a respective one of the communication devices and identifying a disclosure authorization status for the associated communication device, for at least one attribute;
the computer server determining a validity of the credential and the received identifier, and using the received identifier to locate the attribute disclosure profile associated with the one communication device; and
the computer server providing the communication device with a response to the identity attribute validation request based on an outcome of the credential and identifier validity determination and a correlation between the at least one attribute of the identity attribute validation request and the at least one attribute of the located attribute disclosure profile, the attribute validation response including attribute data associated with the credential authorized for disclosure to the one communication device by the located attribute disclosure profile but excluding attribute data associated with the credential not authorized for disclosure to the one communication device by the located attribute disclosure profile,wherein the credential is associated with a hardware token, the computer server transmits a session token to the hardware token, and the credential validity determining step comprises the computer server verifying that the hardware token generated the credential from the session token, andwherein the hardware token is configured with a private encryption key, the computer server is configured with a public encryption key corresponding to the private encryption key, and the step of verifying the credential comprises the computer server validating the credential with the public encryption key.
1 Assignment
0 Petitions
Accused Products
Abstract
A method of identity attribute validation at a computer server involves the computer server receiving an identity attribute validation request from a communication terminal. The computer server further receives a credential, and is configured with an attribute disclosure profile of attributes authorized for disclosure to the communication terminal. The computer server determines the validity of the credential, and provides the communication terminal with a response to the identity attribute validation request based on an outcome of the credential validity determination. The attribute validation response includes attributes data associated with the credential authorized for disclosure by the attribute disclosure profile but excludes attributes data associated with the credential not authorized for disclosure by the attribute disclosure profile.
-
Citations
14 Claims
-
1. A method of server-based identity attribute validation, comprising:
-
a computer server receiving an identity attribute validation request from one of a plurality of communication devices, and an identifier associated with the one communication device, the identity attribute validation request requesting at least one attribute for disclosure to the one communication device, the computer server further receiving a credential and being configured with at least one attribute disclosure profile, each said attribute disclosure profile being associated with a respective one of the communication devices and identifying a disclosure authorization status for the associated communication device, for at least one attribute; the computer server determining a validity of the credential and the received identifier, and using the received identifier to locate the attribute disclosure profile associated with the one communication device; and the computer server providing the communication device with a response to the identity attribute validation request based on an outcome of the credential and identifier validity determination and a correlation between the at least one attribute of the identity attribute validation request and the at least one attribute of the located attribute disclosure profile, the attribute validation response including attribute data associated with the credential authorized for disclosure to the one communication device by the located attribute disclosure profile but excluding attribute data associated with the credential not authorized for disclosure to the one communication device by the located attribute disclosure profile, wherein the credential is associated with a hardware token, the computer server transmits a session token to the hardware token, and the credential validity determining step comprises the computer server verifying that the hardware token generated the credential from the session token, and wherein the hardware token is configured with a private encryption key, the computer server is configured with a public encryption key corresponding to the private encryption key, and the step of verifying the credential comprises the computer server validating the credential with the public encryption key. - View Dependent Claims (2, 3, 7)
-
-
4. An issuer server comprising:
-
at least one attribute disclosure profile, each said attribute disclosure profile being associated with one of a plurality of communication devices and identifying a disclosure authorization status for the associated communication device, for at least one attribute; and an identity attribute validation request processor configured to receive from one of the communication devices an identity attribute validation request and an identifier associated with the one communication device, wherein the identity attribute validation request processor is a hardware processor, the identity attribute validation request requesting at least one attribute for disclosure to the one communication device, and to further receive a credential, the identity attribute validation request processor being further configured to determine a validity of the received credential and the identifier, to use the received identifier to locate the attribute disclosure profile associated with the one communication device, and to provide the communication device with a response to the identity attribute validation request based on an outcome of the credential and identifier validity determination and a correlation between the at least one attribute of the identity attribute validation request and the at least one attribute of the located attribute disclosure profile, the attribute validation response including attribute data associated with the credential authorized for disclosure to the one communication device by the located attribute disclosure profile but excluding attribute data associated with the credential not authorized for disclosure to the one communication device by the located attribute disclosure profile, wherein the credential is associated with a hardware token, and the identity attribute validation request processor is configured to transmit a session token to the hardware token, and to determine the validity of the credential by verifying that the hardware token generated the credential from the session token, and wherein the hardware token is configured with a private encryption key, the issuer server is configured with a public encryption key corresponding to the private encryption key, and the identity attribute validation request processor is configured to verify the credential by validating the credential with the public encryption key. - View Dependent Claims (5, 6)
-
-
8. A method of terminal-based identity attribute validation, comprising:
-
receiving, by a communication terminal, a credential from a hardware token interfaced with the communication terminal, and transmitting to a computer server the credential, an identifier associated with the communication terminal, and an identity attribute validation request, the communication terminal being configured with an attribute disclosure profile identifying a disclosure authorization status for the communication terminal, for at least one attribute; receiving, by the communication terminal, receiving a response to the identity attribute validation request from the computer server, the attribute validation response being based on an outcome of a determination of validity of the credential and the identifier by the computer server; in accordance with the attribute validation response, using, by the communication terminal, the attribute disclosure profile to interrogate the hardware token for attribute data associated with the credential authorized for disclosure to the communication terminal but excluding attribute data associated with the credential not authorized for disclosure to the communication terminal; and generating, by the communication terminal, an authorization signal in accordance with a correlation between the authorized attribute data and a predetermined criterion. - View Dependent Claims (9, 10, 14)
-
-
11. A validation terminal comprising:
-
a credential interface configured to interface with a hardware token;
an attribute disclosure profile identifying a disclosure authorization status for the validation terminal, for at least one attribute; andan identity attribute validation processor configured to (1) receive a credential from the hardware token, (2) transmit to a computer server the credential, an identifier associated with the validation terminal, and an identity attribute validation request, (3) receive a response to the identity attribute validation request from the computer server, the attribute validation response being based on an outcome of a determination of validity of the credential and the identifier by the computer server, (4) in accordance with the attribute validation response, use the attribute disclosure profile to interrogate the hardware token for attribute data associated with the credential authorized for disclosure to the communication terminal but excluding attribute data associated with the credential not authorized for disclosure to the communication terminal, and (5) generate an authorization signal in accordance with a correlation between the authorized attribute data and a predetermined criterion, the attribute validation response being based on an outcome of a determination of validity of the credential by the computer server. - View Dependent Claims (12, 13)
-
Specification