Using multiple digital identification documents to control information disclosure

• US 9,954,685 B2
• Filed: 10/19/2016
• Issued: 04/24/2018
• Est. Priority Date: 06/04/2014
• Status: Active Grant

• Current Assignee: Green Market Square Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Redpath, Richard
• Primary Examiner(s): Tolentino, Roderick
• Application Number:
  US15/297,326
• Publication Number:
  US 20170041149A1
• Time in Patent Office: 552 Days
• Field of Search: 726 17- 19
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A first digital identification document is transmitted from an identification authority to a mobile device of an identified individual. This first digital identification document is digitally signed and includes a set of attributes about the identified individual. In the same manner, a second digital identification document is also transmitted to the identified individual'"'"'s mobile device. The second digital identification document is also digitally signed but includes a different set of attributes about the identified individual. The identified individual is then confronted by a series of challengers, wherein each challenger requires a different amount of information about the identified individual. Based on the identity of each challenger, the identified individual selects an appropriate identification document and transmits it to the applicable challenger'"'"'s device. The challenger is then able to confirm both the information he needs about the identified individual and the validity of the identification document that he receives.

Claims

1. A computer program product for managing a plurality digital identification documents identifying an individual, each digital identification document of the plurality of digital identification documents including a differing set of attributes about the identified individual and a digital signature, the computer program product comprising a computer readable hardware storage device having program instructions embodied therewith, the program instructions executable by at least one computer to cause the at least one computer to:

provide a user interface whereby the identified individual can cause a first digital identification document of the plurality of digital identification documents to be created according to preferences of the identified individual by selecting for inclusion in a first of the differing sets of attributes about the identified individual a first subset of available attributes among a plurality of available attributes about the identified individual, wherein the plurality of available attributes about the identified individual are maintained in one or more databases;

in response to the selection of the first subset of available attributes for inclusion in the first of the differing sets of attributes, create the first digital identification document of the plurality of digital identification documents by adding into the first digital identification document the selected first subset of attributes that are obtained from the one or more databases the first digital identification document including the first of the differing sets of attributes and the digital signature;

transmit the plurality of digital identification documents;

receive a selected digital identification document of the plurality of digital identification documents from a first mobile device of the identified individual;

analyze the digital signature of the selected digital identification document;

confirm the validity of the selected digital identification document based on the analysis of the digital signature; and

trigger, in response to the confirmation that the selected digital identification document is valid, a visual or auditory notification indicating the confirmed validity.

2. The computer program product of claim 1, wherein at least one of an image of the identified individual, an address of the identified individual, a birth date of the identified individual, a driver'"'"'s license number of the identified individual, a name of the identified individual, or a height of the identified individual are included the plurality of available attributes and excluded from the first subset of available attributes.

3. The computer program product of claim 2, wherein at least one of an image of the identified individual, an address of the identified individual, a birth date of the identified individual, a driver'"'"'s license number of the identified individual, a name of the identified individual, or a height of the identified individual are included in each of the differing sets of attributes.

4. The computer program product of claim 1, wherein the first digital identification document and the selected digital identification document are the same.

5. The computer program product of claim 1, wherein all of the plurality of digital identification documents are transmitted to the computer of the identified individual contemporaneously.

6. The computer program product of claim 1, wherein the computer of the identified individual and the first mobile device of the identified individual are the same device.

7. The computer program product of claim 1, wherein the at least one computer comprises a computer system of a representative of an identification authority and a challenger'"'"'s device, wherein the transmitting the plurality of digital identification documents to the computer of the identified individual is from the computer system of the representative, and wherein the receiving the selected digital identification document and the analyzing the digital signature of the selected digital identification document are by the challenger'"'"'s device.

8. The computer program product of claim 7, wherein the receiving the selected digital identification document is performed via a direct wireless connection between the first mobile device and the challenger'"'"'s device.

9. The computer program product of claim 7, wherein the program instructions are executable by the at least one computer to further cause the at least one computer to:

transmit, from the computer system of the representative of the identification authority, to the challenger'"'"'s device a list of revoked digital identification documents.

10. The computer program product of claim 1, wherein the analyzing the digital signature of the selected digital identification document is performed using a public key, and wherein the program instructions are executable by the at least one computer to further cause the at least one computer to:

generate the digital signature of the selected digital identification document by signing the selected digital identification document with a private key corresponding to the public key.

11. A computer program product for managing digital identification documents, the computer program product comprising a computer readable hardware storage device having program instructions embodied therewith, the program instructions executable by at least one computer to cause the at least one computer to:

provide a first user interface, via a first mobile device of an individual, whereby the individual can cause a first digital identification document of a plurality of digital identification documents identifying the individual to be created according to preferences of the identified individual by selecting for inclusion in a first set of attributes about the identified individual a first subset of available attributes among a plurality of available attributes about the identified individual maintained in one or more databases and by causing the first mobile device of the identified individual to transmit the selection of the first subset of available attributes for inclusion in the first set of attributes to a computer system of a representative of an identification authority;

receive from the computer system of the representative of the identification authority, on the first mobile device of the identified individual, the plurality of digital identification documents, each of the plurality of digital identification documents including a differing plurality of attributes about the identified individual, wherein the plurality of digital identification documents includes the first digital identification document that was created by the computer system of the representative of the identification authority in response to the receipt of the transmission of the selection of the first subset of available attributes for inclusion in the first set of attributes, wherein the first digital identification document was created by adding into the first digital identification document the selected first subset of attributes that were obtained from the one or more databases;

provide a second user interface, via the first mobile device of the identified individual, whereby the identified individual can make a selection of a digital identification document of the plurality of digital identification documents, wherein the selected digital identification document includes a digital signature; and

transmit, based on the first selection, the selected digital identification document from the first mobile device of the identified individual to a first challenger'"'"'s device of a first challenger, whereby the first challenger is able to determine the validity of the selected digital identification document using the first challenger'"'"'s device, based on the first challenger'"'"'s device performing the steps of;

receiving the selected digital identification document;

analyzing the digital signature included with the selected digital identification document;

confirming, based on the analysis of the digital signature, that the selected digital identification document is valid; and

triggering, in response to the confirmation that the selected digital identification document is valid, a notification to the first challenger indicating the confirmed validity.

12. The computer program product of claim 11, wherein the program instructions are executable by the at least one computer to further cause the at least one computer to:

provide the second user interface, via the first mobile device of the identified individual, whereby the identified individual can make a second selection of a second digital identification document of the plurality of digital identification documents; and

transmit, based on the second selection, the second digital identification document from the first mobile device of the identified individual to a second challenger'"'"'s device of a second challenger, whereby the second challenger is able to determine the validity of the second digital identification document using the second challenger'"'"'s device.

13. The computer program product of claim 12, wherein the selection of the selected digital identification document is determined based on at least the identity of the first challenger, and wherein the second selection of the second digital identification document is determined based on at least the identity of the second challenger.

14. The computer program product of claim 12, wherein the at least one computer includes the first challenger'"'"'s device, wherein the first challenger is entitled to receive on the first challenger'"'"'s device from the computer system of the representative of the identification authority a list of digital identification documents associated with identified individuals who have had one or more privileges revoked by the identification authority, wherein the second challenger is not entitled to receive the list of digital identification documents, and wherein the program instructions are executable by the at least one computer to further cause the at least one computer to:

prior to the transmitting the selected digital identification document from the first mobile device to the first challenger'"'"'s device, receive from the computer system of the representative of the identification authority, on the first challenger'"'"'s device, the list of digital identification documents; and

analyze, using the first challenger'"'"'s device, the selected digital identification document, whereby the first challenger is able to determine that the selected digital identification document is included on the list of digital identification documents.

15. A computer program product for managing digital identification documents, the computer program product comprising a computer readable hardware storage device having program instructions embodied therewith, the program instructions executable by at least one computer to cause the at least one computer to:

provide a first user interface, via a first mobile device of an individual, whereby the individual can cause a first digital identification document of a plurality of digital identification documents identifying the individual to be created according to preferences of the identified individual by selecting for inclusion in a first set of attributes about the identified individual a first subset of available attributes among a plurality of available attributes about the identified individual maintained in one or more databases and by causing the first mobile device of the identified individual to transmit the selection of the first subset of available attributes for inclusion in the first set of attributes to a computer system of a representative of an identification authority;

receive from the computer system of the representative of the identification authority, on the first mobile device of the identified individual, the plurality of digital identification documents, each of the plurality of digital identification documents including a differing plurality of attributes about the identified individual, wherein the plurality of digital identification documents includes the first digital identification document that was created by the computer system of the representative of the identification authority in response to the receipt of the transmission of the selection of the first subset of available attributes for inclusion in the first set of attributes, wherein the first digital identification document was created by adding into the first digital identification document the selected first subset of attributes that were obtained from the one or more databases;

provide a second user interface, via the first mobile device of the identified individual, whereby the identified individual can make a selection of a digital identification document of the plurality of digital identification documents, wherein the selected digital identification document includes steganographic indicators of authenticity; and

transmit, based on the first selection, the selected digital identification document from the first mobile device of the identified individual to a first challenger'"'"'s device of a first challenger, whereby the first challenger is able to determine the validity of the selected digital identification document using the first challenger'"'"'s device, based on the first challenger'"'"'s device performing the steps of;

receiving the selected digital identification document;

detecting the steganographic indicators included with the selected digital identification document; and

presenting, by combining the detected steganographic indicators, a visually coherent image to the challenger, wherein the visual coherence is indicative of the validity of the selected digital identification document.