# US 10,873,853 B2 · Systems and methods for managing digital identities associated with users > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,853 B2 - Document ID: US10873853B2 - Status: Granted - Kind: B2 - Application number: 16/280,664 - Filed: 2019-02-20 - Published: 2019-08-22 - Granted: 2020-12-22 - Earliest claimed: 2018-02-21 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Ashfaq Kamal; Charles Walton; Robert D. Reany - Web page: https://patentgrep.com/patent/US10873853B2 ## CPC - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/086: using security domains - H04W 12/12: Detection or prevention of fraud - H04W 12/40: Security arrangements using identity modules - H04W 84/042: {Public Land Mobile systems, e.g. cellular systems} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are provided for managing digital identities in multiple regions, through multiple identity providers, while providing for policy enforcement in connection with the digital identities. One exemplary method includes receiving, at an identity and access management hub (IAMH) in a first region, a request related to a digital identity from a secondary hub disposed in a second region and checking a policy associated with the digital identity. In response, the IAMH solicits at least one claim from a user, at a relying party application and/or website, based on the request and provides the at least one claim to a value-added service associated with the IAMH for verification of the at least one claim. The IAMH then transmits a result of the verification to the relying party associated with the request and provides a token, in response to the request, to a secure resource associated with the relying party. ## Claims ### Claim 1 A computer-implemented method for use in managing digital identities in multiple different countries, through multiple identity providers, while providing for policy enforcement of the different countries in connection with the digital identities, the method comprising: receiving, at an identity and access management hub (IAMH) computing device in a first country, a request related to a digital identity from a secondary hub disposed in a second country, the second country different than the first country; checking, by the IAMH computing device, a policy associated with the digital identity and specific to the second country; soliciting, by the IAMH computing device, at least one claim from a user, at a relying party application and/or a relying party website, based on the request; providing the at least one claim to a value-added service associated with the IAMH computing device for verification of the at least one claim; transmitting, by the IAMH computing device, a result of the verification to a relying party associated with the request; and providing, by the IAMH computing device, a token, in response to the request, to a secure resource associated with the relying party. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: soliciting, by the IAMH computing device, at least one initial claim associated with the request from the user; and transmitting, by the IAMH computing device, the at least one initial claim to the relying party, prior to soliciting the at least one claim from the user. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising providing a decline to the user, at the relying party application and/or website, when the request relates to data associated with the digital identity in violation of the policy. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the value-added service includes one of a fraud scoring service, a biometric service and a document verification service. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the value-added service includes one of a fraud scoring service; and wherein the result includes a score associated with the request. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the value-added service includes a document verification service; and wherein the claim includes an image of a physical document and the result includes a score associated with the verification of the physical document against a reference. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the request includes a request to authenticate the user. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the request includes a request for an attribute of the digital identity of the user. ### Claim 9 A system for use in managing digital identities in multiple countries, through multiple identity providers, while providing for policy enforcement in connection with the digital identities, the system comprising: an identity and access management hub (IAMH) computing device disposed within a first country; and at least one secondary hub computing device coupled in communication with the IAMH computing device and in communication with an identity provider (IDP) computing device including a digital identity of a user, the secondary hub computing device and the IDP computing device disposed in a second country different than the first country; wherein the IAMH computing device is configured to receive a request related to the user, the request including a request to authenticate the user, to authorize the user and/or for an attribute of the digital identity of the user; and wherein at least one of the IAMH computing device and the secondary hub computing device is configured to apply at least one policy specific to the second country to the request, thereby enforcing the at least one policy for the request across the first and second countries. ### Claim 10 (depends on 9) The system of claim 9, wherein the policy includes a limitation associated with transmission of personal identifying information (PII) associated with the request, from the first country to the second, different country. ### Claim 11 (depends on 9) The system of claim 9, wherein the at least one of the IAMH computing device and the secondary hub computing device is configured to limit the request based on the policy; and wherein the IAMH computing device is configured to: when the request violates the at least one policy, decline the request; and when the request conforms to the at least one policy, communicate at least one claim associated with the request to the IDP computing device and display the at least one claim, to the user as a website associated with a relying party interacting with the user, in response to an authentication token from the IDP computing device received in response to the communicated at least one claim. ### Claim 12 (depends on 9) The system of claim 9, wherein the IAMH computing device is further configured to provide at least one claim to a value-added service and to provide an authentication token to a relying party interacting with the user in response to a verification of the at least one claim by the value-added service. ### Claim 13 (depends on 12) The system of claim 12, wherein the value-added service includes a fraud scoring service associated with the IAMH computing device. ### Claim 14 (depends on 9) The system of claim 9, wherein the request is for the attribute of the digit identity of the user. ### Claim 15 (depends on 9) The system of claim 9, wherein the IAMH computing device is further configured to provide at least one claim to a value-added service associated with the IAMH computing device and to provide a confidence score to a relying party interacting with the user upon receipt of the confidence score from the value-added service. ### Claim 16 (depends on 15) The system of claim 15, wherein the value-added service includes a document verification service; and wherein the at least one claim includes an image of a physical document representative of an identity of the user.