System and method for establishing and monetizing trusted identities in cyberspace with personal data service and user console

• US 9,372,972 B2
• Filed: 07/01/2013
• Issued: 06/21/2016
• Est. Priority Date: 06/29/2012
• Status: Active Grant

• Current Assignee: Id Dataweb, Inc.
• Original Assignee: Id Dataweb, Inc.
• Inventors: Coxe, David Hemphill, Coxe, Robert Lloyd Jr., Dials, John Joseph Jr., McKay-Donovan, Christine W.
• Primary Examiner(s): Shepperd, Eric W
• Application Number:
  US14/410,305
• Publication Number:
  US 20150332029A1
• Time in Patent Office: 1,086 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A system and method for establishing and monetizing trusted identities in cyberspace relying upon user opt in. Users request to attain secure IDs for accessing parties that will rely on secure IDs to complete a transaction, for example merchants and service providers (relying parties). The relying parties (RPs) communicate with identity service providers and attribute providers via an Attribute Exchange Network (AXN) in order to obtain verified attributes associated with an entity (end user or user) that wishes to conduct business with the relying party. The relying party makes requests for verified attributes that are important to consummating business transactions for the relying party. Users are informed of requests for attributes on behalf of relying parties and users have the option to verify attributes, and add new attributes that may be useful or required for conducting business with relying parties.

Claims

1. A method providing access to end user-asserted attributes, the method comprising:

receiving, by an attribute exchange network (AXN) device, a first credential asserted by an end-user to one or more relying parties (RPs);

requesting, by the AXN device, a first location of a first encrypted token associated with the asserted first credential from a database;

acquiring, by the AXN device, the first encrypted token associated with the asserted first credential from the first location;

acquiring, by the AXN device, from the first encrypted token a first set of attributes of the end user, wherein the first set of attributes includes verified attributes and further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the first set of attributes; and

populating, by the AXN device, a web page with the first set of attributes and the permissions granted for each of the one or more RPs to view attributes selected from the first set of attributes.

2. The method of claim 1 further comprising linking, by the AXN device, a second credential to the first credential.

3. The method of claim 2 further comprising:

acquiring, by the AXN device, the second credential using the first credential;

requesting, by the AXN device, a second location of a second encrypted token associated with the second credential;

acquiring, by the AXN device, the second encrypted token associated with the second credential from the second location;

acquiring, by the AXN device, from the second encrypted token a second set of attributes of the end user, wherein the second set of attributes further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the second set of attributes; and

populating, by the AXN device, the web page with the second set of attributes and the permissions granted for each of the one or more RPs to view attributes selected from the second set of attributes.

4. An attribute exchange network (AXN) device, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

receiving a first credential asserted by an end-user to one or more relying parties (RPs);

requesting from a database a first location of a first encrypted token associated with the asserted first credential;

acquiring the first encrypted token associated with the asserted first credential from the first location;

acquiring from the first encrypted token a first set of attributes of the end user, wherein the first set of attributes includes verified attributes and further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the first set of attributes; and

populating a web page with the first set of attributes and the permissions granted for each of the one or more RPs to view attributes selected from the first set of attributes.

5. The AXN device of claim 4, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

linking a second credential to the first credential.

6. The AXN device of claim 5, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

acquiring the second credential using the first credential;

requesting a second location of a second encrypted token associated with the second credential;

acquiring the second encrypted token associated with the second credential from the second location;

acquiring from the second encrypted token a second set of attributes of the end user, wherein the second set of attributes further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the second set of attributes; and

populating the web page with the second set of attributes and the permissions granted for each of the one or more RPs to view attributes selected from the second set of attributes.

8. The AXN device of claim 4, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations comprising:

linking a second credential to the first credential.

9. The AXN device of claim 5, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations comprising:

acquiring the second credential using the first credential;

requesting a second location of a second encrypted token associated with the second credential;

acquiring the second encrypted token associated with the second credential from the second location;

acquiring from the second encrypted token a second set of attributes of the end user, wherein the second set of attributes further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the second set of attributes; and

populating the web page with the second set of attributes and the permissions granted for each of the one or more RPs to view attributes selected from the second set of attributes.

7. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in an attribute exchange network (AXN) device to perform operations comprising:

receiving a first credential asserted by an end-user to one or more relying parties (RPs);

requesting from a database a first location of a first encrypted token associated with the asserted first credential;

acquiring the first encrypted token associated with the asserted first credential from the first location;

acquiring from the first encrypted token a first set of attributes of the end user, wherein the first set of attributes includes verified attributes and further identifies permissions granted by the end user to the one or more RPs to view attributes selected from the first set of attributes; and

populating a web page with the first set of attributes and the permissions granted for each of the one or more RPs to view attributes selected from the first set of attributes.