# US 11,907,398 B2 · Systems and methods for use with stand-in network identities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,398 B2 - Document ID: US11907398B2 - Status: Granted - Kind: B2 - Application number: 17/834,607 - Filed: 2022-06-07 - Published: 2022-09-29 - Granted: 2024-02-20 - Earliest claimed: 2020-02-20 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Aaron Shortell; Kristen Metropoulos; Andrew Haimes; Nicole M. Yap - Web page: https://patentgrep.com/patent/US11907398B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/31: User authentication - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are provided for implementing stand-in network identities. One example computer-implemented method includes receiving, from a communication device associated with a user, an on-behalf-of (OBO) request from the user to share permission data with a relying party and, in response to the OBO request, generating a permission request for the permission data and transmitting the permission request to the communication device associated with the user. The method also includes receiving, from the communication device associated with the user, consent from the user to share the permission data with the relying party. The method then includes identifying, in a data structure, an OBO permission for the user with respect to the PII and in response to identifying the OBO permission for the user, transmitting the permission data identified in the OBO request to the relying party. ## Claims ### Claim 1 A computer-implemented method for use in implementing stand-in network identities, the method comprising: receiving, by a computing device, from a communication device associated with a user, an on-behalf-of (OBO) request from the user to share permission data with a relying party, wherein the permission data is associated with personal identifying information (PII) but does not include the PII, the user including an independent user having authorization to interact with the relying party on behalf of a dependent user; in response to the OBO request, generating, by the computing device, a permission request for the permission data and transmitting the permission request to the communication device associated with the user; receiving, at the computing device, from the communication device associated with the user, consent from the user to share the permission data with the relying party, in response to the permission request and upon authentication of the user at the communication device; identifying, by the computing device, in a data structure, an OBO permission for the user with respect to the PII; and in response to identifying the OBO permission for the user, transmitting, by the computing device, the permission data identified in the OBO request to the relying party, the permission data including an identifier for the independent user and at least one parameter associated with the authorization. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the user is a dependent user; and wherein the permission data includes an identifier for an independent user having authorization to interact with the relying party on behalf of the dependent user, and at least one parameter associated with the authorization. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the PII includes a mailing address, a phone number, and a government identification number. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein transmitting the permission request includes transmitting the permission request to an identity application included in the communication device. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, further comprising, in response to the permission request: requesting, by the identity application at the communication device, the consent from the user to share the permission data with the relying party; receiving, by the identity application at the communication device, the consent from the user; and transmitting, by the communication device, to the computing device, the consent to share the permission data with the relying party. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, further comprising, prior to requesting the consent from the user to share the permission data with the relying party: requesting, by the identity application at the communication device, an authentication input from the user; receiving, by the identity application at the communication device, the authentication input from the user; and authenticating the user. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the PII is specific to the dependent user; wherein the identity application includes a software-development kit (SDK) included in a relying party application; and wherein receiving, at the computing device, the consent from the user to share the permission data with the relying party includes receiving, at the computing device, the consent from the identity application, initiated by the relying party application at the communication device. ### Claim 8 (depends on 6) The computer-implemented method of claim 6, wherein the permission data includes one or more parameters associated with permission to share the PII with the relying party. ### Claim 9 A system for use in implementing stand-in network identities, the system comprising: a computing device including a memory, the computing device configured, by executable instructions included in the memory, to: receive, from a relying party application at a communication device associated with a user, an on-behalf-of (OBO) request from the user to share permission data with a relying party, wherein the permission data is associated with personal identifying information (PII) but does not include the PII, the user including an independent user, and the PII being specific to a dependent user; in response to the OBO request, generate a permission request for the permission data and transmit the permission request to an identity application at the communication device associated with the user; receive, from the identity application at the communication device associated with the user, consent from the user to share the permission data with the relying party, in response to the permission request and upon authentication of the user at the communication device; identify, in a data structure, an OBO permission for the user with respect to the PII; and in response to identifying the OBO permission for the user, transmit the permission data identified in the OBO request to the relying party, the permission data including one or more parameters associated with permission to share the PII with the relying party. ### Claim 10 (depends on 9) The system of claim 9, wherein the user is a dependent user; and wherein the permission data includes an identifier for an independent user having authorization to interact with the relying party on behalf of the dependent user, and at least one parameter associated with the authorization. ### Claim 11 (depends on 9) The system of claim 9, wherein the independent user has authorization to interact with the relying party on behalf of the dependent user; and wherein the permission data further includes an identifier for the independent user and at least one parameter associated with the authorization. ### Claim 12 (depends on 9) The system of claim 9, wherein the PII includes a mailing address, a phone number, and a government identification number. ### Claim 13 (depends on 9) The system of claim 9, further comprising the identity application stored in a non-transitory memory of the communication device, which, when executed by the communication device in response to the permission request, causes the communication device to: request an authentication input from the user; receive the authentication input from the user; and authenticate the user. ### Claim 14 (depends on 13) The system of claim 13, wherein the identity application, when executed by the communication device, further causes the communication device, in response to authentication of the user, to: request consent from the user to share the permission data with the relying party; receive the consent from the user; and transmit, to the computing device, the consent to share the permission data with the relying party. ### Claim 15 (depends on 14) The system of claim 14, wherein the identity application includes a software-development kit (SDK) included in the relying party application. ### Claim 16 A non-transitory computer readable storage medium including executable instructions, which when executed by a processor, cause the processor to: receive, from a relying party application at a communication device associated with a user, an on-behalf-of (OBO) request from the user to share permission data with a relying party, wherein the permission data is associated with personal identifying information (PII) but does not include the PII, the user including an independent user, and the PII being specific to a dependent user; in response to the OBO request, generate a permission request for the permission data and transmit the permission request to an identity application at the communication device associated with the user; receive, from the identity application at the communication device associated with the user, consent from the user to share the permission data with the relying party, in response to the permission request and upon authentication of the user at the communication device; identify, in a data structure, an OBO permission for the user with respect to the PII; and in response to identifying the OBO permission for the user, transmit the permission data identified in the OBO request to the relying party, the permission data including one or more parameters associated with permission to share the PII with the relying party.