# US 11,122,036 B2 · Systems and methods for managing digital identities associated with mobile devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,036 B2
- Document ID: US11122036B2
- Status: Granted
- Kind: B2
- Application number: 16/134,348
- Filed: 2018-09-18
- Published: 2019-03-21
- Granted: 2021-09-14
- Earliest claimed: 2017-09-18
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Sumeet Bhatt; Ashfaq Kamal
- Web page: https://patentgrep.com/patent/US11122036B2

## CPC

- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06Q 50/265: {Personal security, identity or safety}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04W 12/06: Authentication
- G06Q 20/34: using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/40145: {Biometric identity checks}
- H04L 63/0815: {providing single-sign-on or federations}
- H04W 12/65: Environment-dependent, e.g. using captured environmental data
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods are provided for use in enabling, providing, and managing digital identities in association with mobile communication devices. One exemplary method includes capturing an image of a physical document comprising a biometric of a user associated with the physical document, and extracting the biometric from the image and converting it to a biometric template. The method also includes capturing a biometric of the user and comparing it to the biometric template. The method then includes, when the captured biometric matches the biometric template, transmitting a message to an identification provider comprising at least the image of the physical document and the biometric template, whereby the biometric template is verified against a repository, and binding data representative of the mobile communication device, a mobile application included therein, and the biometric template and/or the captured biometric of the user into a token.

## Claims

### Claim 1

A computer-implemented method for use in providing a digital identity in association with a mobile communication device, the method comprising:
capturing, by a mobile communication device, an image of a physical document, the image including a biometric of a user associated with the physical document;
extracting, by the mobile communication device, the biometric from the image and converting the biometric to a biometric template;
capturing, by the mobile communication device, via an input device of the mobile communication device, a biometric of the user;
comparing, by the mobile communication device, the captured biometric of the user to the biometric template; and
in response to a match between the captured biometric of the user and the biometric template:
encrypting, by the mobile communication device, a message with a public key included in the mobile communication device and known to an identification provider, the message comprising at least the image of the physical document and the biometric template; and
transmitting, by the mobile communication device, the encrypted message to the identification provider, whereby the biometric template is decrypted and verified; and then
receiving, by the mobile communication device, a result from the identification provider, which is signed by the identification provider and indicative of a verification of the biometric template; and in response to the signed result:
binding, by the mobile communication device, data representative of the mobile communication device, a mobile application included in the mobile communication device, and at least one of the biometric template and the captured biometric of the user into a token; and
retaining the token in a memory of the mobile communication device as a basis to subsequently authenticate the user at the mobile communication device, wherein the memory of the mobile communication device is a trusted execution environment (TEE) of the mobile communication device, thereby enabling the mobile application to provide a digital identity associated with the user to one or more relying parties when the user is authenticated at the mobile communication device based on the token.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the physical document includes a government ID card.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, further comprising checking, by the mobile communication device, an integrity of the image of the physical document prior to converting the extracted biometric to a biometric template.

### Claim 4 (depends on 3)

The computer-implemented method of claim 3, wherein the captured biometric of the user includes a facial image of the user.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising:
generating, by the mobile communication device, a public-private key pair and
transmitting a public key of the public-private key pair to the identification provider.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, further comprising:
receiving a message from the identification provider including the result, wherein the result is signed by the identification provider with the transmitted public key; and
decrypting the message based on a private key of the public-private key pair.

### Claim 7

A non-transitory computer readable storage media comprising computer-executable instructions for managing digital identities, that when executed by at least one processor of a mobile communication device, cause the at least one processor of the mobile communication device to:
capture an image of a physical document associated with a user of the mobile communication device, the image including a biometric of the user;
extract the biometric from the image and convert the biometric to a biometric template;
capture a biometric of the user and compare the captured biometric of the user to the biometric template;
when the captured biometric of the user matches the biometric template, encrypt a message with a public key included in the mobile communication device and known to an identification provider, the encrypted message including at least the image of the physical document and the biometric template, and transmit the message to the identification provider, whereby the biometric template is verified by the identification provider against a repository of biometric data;
receive a signed result from the identification provider, the signed result indicative of verification of the biometric template; and
in response to the signed result:
bind data representative of the mobile communication device, a mobile application included in the mobile communication device, and at least one of the biometric template and the captured biometric of the user into a token; and
store the token in a trusted execution environment (TEE) of the mobile communication device, thereby enabling the mobile application to provide a digital identity associated with the user to one or more relying parties based on authentication of the user through use of the token.

### Claim 8 (depends on 7)

The non-transitory computer readable storage media of claim 7, wherein the instructions, when executed by the at least one processor of the mobile communication device, further cause the at least one processor to check an integrity of the image of the physical document prior to converting the extracted biometric to a biometric template.

### Claim 9 (depends on 8)

The non-transitory computer readable storage media of claim 8, wherein the instructions, when executed by the at least one processor of the mobile communication device, cause the at least one processor, in connection with capturing the biometric of the user, to perform a liveness validation of the user and confirm that the captured biometric is from a living person.

### Claim 10 (depends on 9)

The non-transitory computer readable storage media of claim 9, wherein the captured biometric of the user includes a facial image of the user.

### Claim 11 (depends on 7)

The non-transitory computer readable storage media of claim 7, wherein the public key includes a public key of the identification provider; and
wherein the instructions, when executed by the at least one processor of the mobile communication device, further cause the at least one processor to generate a public-private key pair and transmit a public key of the public-private key pair to the identification provider.

### Claim 12 (depends on 11)

The non-transitory computer readable storage media of claim 11, wherein the instructions, when executed by the at least one processor of the mobile communication device, further cause the at least one processor to:
receive a message from the identification provider including the signed result, wherein the signed result is signed by the identification provider with the transmitted public key; and
decrypt the message based on a private key of the public-private key pair.

### Claim 13 (depends on 1)

The computer-implemented method of claim 1, further comprising receiving a registration challenge for the user, from the identification provider; and
wherein extracting the biometric from the image includes extracting the biometric from the image in response to the registration challenge for the user.

### Claim 14 (depends on 7)

The non-transitory computer readable storage media of claim 7, wherein the computer-executable instructions define at least a portion of a software development kit (SDK) included in the mobile application.

### Claim 15 (depends on 7)

The non-transitory computer readable storage media of claim 7, wherein the computer-executable instructions, when executed by the at least one processor of the mobile communication device, cause the at least one processor to receive a registration challenge for the user, from the identification provider, and to extract the biometric from the image in response to the registration challenge.

### Claim 16

A mobile communication device comprising:
a memory including executable instructions; and
a processor coupled to the memory, wherein the processor is configured, by the executable instructions, to:
capture an image of a physical document, the image including a biometric of a user associated with the physical document;
extract the biometric from the image and convert the biometric to a biometric template;
capture, via an input device of the mobile communication device, a biometric of the user;
compare the captured biometric of the user to the biometric template; and
in response to a match between the captured biometric of the user and the biometric template:
encrypt a message with a public key included in the mobile communication device and known to an identification provider, the message comprising at least the image of the physical document and the biometric template; and
transmit the encrypted message to the identification provider, whereby the biometric template is decrypted and verified; and then
receive a result from the identification provider, which is signed by the identification provider and indicative of a verification of the biometric template; and
in response to the signed result:
bind data representative of the mobile communication device, a mobile application included in the mobile communication device, and at least one of the biometric template and the captured biometric of the user into a token; and
retain the token in a trusted execution environment (TEE) of a memory of the mobile communication device as a basis to subsequently authenticate the user at the mobile communication device, thereby enabling the mobile application to provide a digital identity associated with the user to one or more relying parties when the user is authenticated at the mobile communication device based on the token.

### Claim 17 (depends on 16)

The mobile communication device of claim 16, wherein the physical document includes a government ID card; and
wherein the captured biometric of the user includes a facial image of the user.

### Claim 18 (depends on 16)

The mobile communication device of claim 16, wherein the processor is configured, by the executable instructions, to check an integrity of the image of the physical document prior to converting the extracted biometric to a biometric template.

### Claim 19 (depends on 16)

The mobile communication device of claim 16, wherein the processor is further configured, by the executable instructions, to:
generate a public-private key pair;
transmit a public key of the public-private key pair to the identification provider; and
decrypt the result based on a private key of the public-private key pair.

### Claim 20 (depends on 16)

The mobile communication device of claim 16, wherein the executable instructions define at least a portion of a software development kit (SDK) included in the mobile application; and
wherein the mobile application includes a banking application.