# US 12,002,088 B2 · Identity proofing offering for customers and non-customers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,002,088 B2
- Document ID: US12002088B2
- Status: Granted
- Kind: B2
- Application number: 17/038,193
- Filed: 2020-09-30
- Published: 2021-01-14
- Granted: 2024-06-04
- Earliest claimed: 2018-10-01
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Vivek Bharatam; Meghnath Sharma; Parvez Naqvi
- Web page: https://patentgrep.com/patent/US12002088B2

## CPC

- G06Q 40/03: Credit; Loans; Processing thereof
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06Q 50/265: {Personal security, identity or safety}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols}
- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs}
- G06Q 2220/00: Business processing using cryptography
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Various embodiments are generally directed to an identity proofing platform. The platform may receive, from a user, personally identifiable information (PII) related to a consumer and determine one or more verifications requested by the user. The verifications may be one or more of a government identification (ID) verification, a credit bureau verification, or a mobile network operator verification. The platform may send a SMS message to the consumer for consent approval and receive consent from the consumer. The platform may perform the one or more verifications, generate an identity proofing result based on the performed one or more verifications, encrypt the identity proofing result, and send the identity proofing result to the user.

## Claims

### Claim 1

A system, comprising:
one or more processors operable to execute stored instructions that, when executed, causes the one or more processors to:
receive, via a first application programming interface (API), an encrypted information related to a consumer;
decrypt the received information with a decryption key associated with a key pair, the decryption key being derived using a rotatable public key and a private key in the key pair, the rotatable public key being valid during a predetermined period of time and rotated for another public key after expiration of the predetermined period of time;
generate, via the first API, a transaction identifier, the transaction identifier being representative of the decrypted received information;
determine one or more transaction attributes based on the transaction identifier, wherein the one or more transaction attributes indicate one or more verifications to be performed, and validate, using a second API different from the first API, the one or more transaction attributes, and initiate, based on validation of the one or more transaction attributes, at least one verification in the one or more verifications;
select, based on the one or more transaction attributes and the transaction identifier, the at least one verification one or more verification systems in a plurality of verification systems for performing the at least one verification;
call, via the second API, the selected one or more verification systems for performing the at least one verification, wherein the selected one or more verification systems are one or more authoritative sources for verifying an identity of the consumer and wherein the second API calls only the selected one or more verification systems corresponding to the at least one verification indicated in the one or more transaction attributes;
generate one or more identity proofing results for the at least one verification; and
select, based on the one or more transaction attributes and the transaction identifier, at least one identity proofing result in the one or more identity proofing results, and provide the selected at least one identity proofing result.

### Claim 2 (depends on 1)

The system of claim 1, wherein the one or more processors are further caused to:
send a notification to the consumer for consent approval; and
receive the consent approval from the consumer.

### Claim 3 (depends on 1)

The system of claim 1, wherein the information related to the consumer is personally identifiable information (PII) and wherein the key pair corresponds to a key agreement protocol.

### Claim 4 (depends on 1)

The system of claim 1, wherein the one or more processors are further caused to:
send the transaction identifier to the second API, and
wherein the second API performs only the at least one verification indicated by the one or more transaction attributes.

### Claim 5 (depends on 1)

The system of claim 1, wherein the at least one verification comprises a government identification (ID) verification, a credit bureau verification, and/or a mobile network operator verification.

### Claim 6 (depends on 1)

The system of claim 1, wherein the one or more processors are further caused to:
encrypt, via the first API, the identity proofing result; and
send the encrypted identity proofing result to a user.

### Claim 7 (depends on 5)

The system of claim 5, wherein the government ID verification comprises the one or more processors to:
redirect to a government ID application via at least a third API to perform the government ID verification, wherein the government ID application instructs the consumer to submit at least one government ID image and processes the at least one government ID image;
receive identity or biographical information associated with the submitted at least one government ID image; and
compare the received identity or biographical information with a personally identifiable information (PII),
wherein the credit bureau verification comprises the processing circuitry to:
send the PII to a credit reporting agency via at least the third API; and
receive a credit bureau verification result from the credit reporting agency, and wherein the mobile network operator verification comprises the one or more processors to:
send the PII to a mobile network operator via at least the third API; and
receive a mobile network operator verification result from the mobile network operator.

### Claim 8 (depends on 1)

The system of claim 1, wherein the at least one verification is performed for one or more of the following: (i) know your customer (KYC), (ii) anti-money laundering (AML), (iii) consumer credit risk, (iv) social networking, (v) anti-spamming, and (vi) an e-commerce transaction.

### Claim 9

A method, comprising:
receiving, via a first application programming interface (API), information related to a consumer;
decrypt, via one or more processors, the received information with a decryption key associated with a key pair, the decryption key being derived using a rotatable public key and a private key in the key pair, the rotatable public key being valid during a predetermined period of time and rotated for another public key after expiration of the predetermined period of time;
generating, via the first API, a transaction identifier, the transaction identifier being representative of the decrypted received information;
determining, via the one or more processors, one or more transaction attributes based on the transaction identifier, wherein the one or more transaction attributes indicate one or more verifications to be performed, and validating, using a second API different from the first API, the one or more transaction attributes, and initiate, based on validation of the one or more transaction attributes, at least one verification in the one or more verifications;
selecting, based on the one or more transaction attributes and the transaction identifier, the at least one verification and one or more verification systems in a plurality of verification systems for performing the at least one verification;
calling, via the second API, the selected one or more verification systems for performing the at least one verification, wherein the selected one or more verification systems are one or more authoritative sources for verifying an identity of the consumer and wherein the second API calls only the selected one or more verification systems corresponding to the at least one verification indicated in the one or more transaction attributes;
generating and providing, via the one or more processors, an identity proofing result for each of the at least one verification;
generating, via the one or more processors, one or more identity proofing results for each of the at least one verification; and
selecting, via the one or more processors, based on the one or more transaction attributes and the transaction identifier, at least one identity proofing result in the one or more identity proofing results, and provide the selected at least one identity proofing result.

### Claim 10 (depends on 9)

The method of claim 9, wherein the information related to the consumer is personally identifiable information (PII) and wherein the key pair corresponds to a key agreement protocol.

### Claim 11 (depends on 9)

The method of claim 9, further comprising:
sending, via the one or more processors, the transaction identifier to the second API, and
wherein the second API performs only the at least one verification indicated by the one or more transaction attributes.

### Claim 12 (depends on 9)

The method of claim 9, wherein the at least one verification comprises a government identification (ID) verification, a credit bureau verification, and/or a mobile network operator verification.

### Claim 13 (depends on 12)

The method of claim 12, wherein the government ID verification comprises:
redirecting, via the one or more processors, to a government ID application via at least a third API to perform the government ID verification, wherein the government ID application instructs the consumer to submit at least one government ID image and processes the at least one government ID image;
receiving identity or biographical information associated with the submitted at least one government ID image; and
comparing, via the one or more processors, the received identity or biographical information with a personally identifiable information (PII),
wherein the credit bureau verification comprises:
sending, via the one or more processors, the PII to a credit reporting agency via at least the third API; and
receiving a credit bureau verification result from the credit reporting agency, and wherein the mobile network operator verification comprises:
sending, via the one or more processors, the PII to a mobile network operator via at least the third API; and
receiving a mobile network operator verification result from the mobile network operator.

### Claim 14 (depends on 9)

The method of claim 9, wherein the at least one verification is performed for one or more of the following: (i) know your customer (KYC), (ii) anti-money laundering (AML), (iii) consumer credit risk, (iv) social networking, (v) anti-spamming, and (vi) an e-commerce transaction.

### Claim 15

At least one non-transitory computer-readable storage medium storing computer-readable program code executable by one or more processors to:
receive, via a first application programming interface (API), information related to a consumer;
decrypt the received information with a decryption key associated with a key pair, the decryption key being derived using a rotatable public key and a private key in the key pair, the rotatable public key being valid during a predetermined period of time and rotated for another public key after expiration of the predetermined period of time;
generate, via the first API, a transaction identifier, the transaction identifier being representative of the decrypted received information;
determine one or more transaction attributes based on the transaction identifier, wherein the one or more transaction attributes indicate one or more verifications to be performed, and validate, using a second API different from the first API, the one or more transaction attributes, and initiate, based on validation of the one or more transaction attributes, at least one verification in the one or more verifications;
select, based on the one or more transaction attributes and the transaction identifier, the at least one verification and one or more verification systems in a plurality of verification systems for performing the at least one verification;
call, via the second API, the selected one or more verification systems for performing the at least one verification, wherein the selected one or more verification systems are one or more authoritative sources for verifying an identity of the consumer and wherein the second API calls only the selected one or more verification systems corresponding to the at least one verification indicated in the one or more transaction attributes; generate one or more identity proofing results for each of the at least one verification; and
select, based on the one or more transaction attributes and the transaction identifier, at least one identity proofing result in the one or more identity proofing results, and provide the selected at least one identity proofing result.

### Claim 16 (depends on 15)

The at least one non-transitory computer-readable storage medium of claim 15, wherein the information related to the consumer is personally identifiable information (PII) and wherein the key pair corresponds to a key agreement protocol.

### Claim 17 (depends on 15)

The at least one non-transitory computer-readable storage medium of claim 15, wherein the program code causes the one or more processors to:
send the transaction identifier to the second API, and
wherein the second API performs only the at least one verification indicated by the one or more transaction attributes.

### Claim 18 (depends on 15)

The at least one non-transitory computer-readable storage medium of claim 15, wherein the at least one verification comprises a government identification (ID) verification, a credit bureau verification, and/or a mobile network operator verification.

### Claim 19 (depends on 18)

The at least one non-transitory computer-readable storage medium of claim 18, wherein the government ID verification comprises the program code causing the one or more processors to:
redirect to a government ID application via at least a third API to perform the government ID verification, wherein the government ID application instructs the consumer to submit at least one government ID image and processes the at least one government ID image;
receive identity or biographical information associated with the submitted at least one government ID image; and
compare the received identity or biographical information with a personally identifiable information (PII),
wherein the credit bureau verification comprises the program code causing the one or more processors to:
send the PII to a credit reporting agency via at least the third API; and
receive a credit bureau verification result from the credit reporting agency, and
wherein the mobile network operator verification comprises the program code causing the one or more processors to:
send the PII to a mobile network operator via at least the third API; and
receive a mobile network operator verification result from the mobile network operator.

### Claim 20 (depends on 15)

The at least one non-transitory computer-readable storage medium of claim 15, wherein the at least one verification is performed for one or more of the following: (i) know your customer (KYC), (ii) anti-money laundering (AML), (iii) consumer credit risk, (iv) social networking, (v) anti-spamming, and (vi) an e-commerce transaction.