# US 12,015,714 B2 · System and method for an electronic identity brokerage

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,714 B2
- Document ID: US12015714B2
- Status: Granted
- Kind: B2
- Application number: 17/509,781
- Filed: 2021-10-25
- Published: 2022-02-10
- Granted: 2024-06-18
- Earliest claimed: 2018-07-03
- Assignees: Royal Bank of Canada
- Applicants: Royal Bank of Canada
- Inventors: Edison U. Ortiz; Arya Pourtabatabaie; Margaret Inez Salter
- Web page: https://patentgrep.com/patent/US12015714B2

## CPC

- G06F 21/31: User authentication
- H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs}
- G07C 9/28: the pass enabling tracking or indicating presence
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- G07C 9/27: with central registration
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE

## Abstract

A computer implemented system for electronic verification of credentials including at least one processor and data storage is described in various embodiments. The system includes cryptographic mechanisms and electronic communication between one or more computing systems that in concert, provide verification of a prover's credentials in accordance to logical conditions of a verifier's policy without providing additional information to a verifier entity.

## Claims

### Claim 1

A computer implemented system for communicating data messages between a verifier computing device and a portable client computing device, the data messages establishing authentication of one or more characteristics of a client associated with the portable client computing device, the system comprising:
the portable client computing device including at least a client computing device processor and data storage, the data storage storing one or more token data objects received from or computed jointly in a multiparty protocol with an issuer computing device, the one or more token data objects generated using at least a issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the client associated with the portable client computing device; and
the client computing device processor configured to receive a verification request data message from the verifier computing device and, using a combination of the one or more token data objects and the verification request data message, generate one or more proof data messages without sending any data messages or requests to the issuer computing device;
wherein the verification request data message includes at least a nonce c0; and
the client computing device processor is configured to:
compute t=x−1 mod p, where x is an attribute value from the one or more token data objects, and p is an order of the discrete log group; t is a modular inverse of x mod p;
uniformly sample a first random number r1 and a second random number, r2, such that r1, r2∈p;
compute R=Cxr1hr2, where R is a commitment to random values r1 and r2, Cx is a commitment to attribute x, and h is a group generator;
compute c=H(Cx, R, c0), where c is a proof challenge, based at least on the Fiat-Shamir Heuristic;
compute z1=ct+r1 and z2=−cty+r2, where z1 and z2 are proof responses based on a Sigma protocol; and
encapsulate and transmit the one or more proof data messages including R, z1 and z2 as data objects to the verifier computing device, such that the verifier computing device is able to compute c=H(Cx, R, c0) and confirm that gcR=Cxz1hz2, the verifier computing device controlling provisioning of access to a secured resource responsive to the confirmation that gcR=Cxz1hz2.

### Claim 2 (depends on 1)

The computer implemented system of claim 1, wherein the one or more token data objects are pre-loaded into the data storage such that the generation of the proof can be conducted at a time temporally separated from when the one or more token data objects were generated or preloaded.

### Claim 3 (depends on 1)

The computer implemented system of claim 1, wherein the one or more proof data messages are generated such that the one or more proof data messages can be validated using an issuer computing device public encryption key corresponding to the issuer computing device private issuance key.

### Claim 4 (depends on 1)

The computer implemented system of claim 1, wherein gcR=Cxz1hz2 indicates that a condition established in the verification request data message is met without having to present the underlying one or more characteristics of the client associated with the portable client computing device.

### Claim 5 (depends on 1)

The computer implemented system of claim 1, wherein the verification request data message includes a blacklist data structure and the one or more proof data messages are generated to establish that the client associated with the portable client computing device does not match one or more identities stored in the blacklist data structure, or wherein the verification request data message includes a whitelist data structure and the one or more proof data messages are generated to establish that the client associated with the portable client computing device matches one or more identities stored in the blacklist data structure.

### Claim 6 (depends on 1)

The computer implemented system of claim 1, wherein the provisioning of access to the secured resource includes transmitting an electronic signal to a physical lock actuator, or to a digital challenge-response mechanism.

### Claim 7 (depends on 1)

The computer implemented system of claim 1, wherein the client computing device processor is a secure enclave processor or a trusted execution environment that is segregated from a general execution environment of the client computing device or the data storage is a secure enclave memory region that is segregated from a general memory region of the client computing device, the secure enclave memory region not accessible by general execution environment of the client computing device.

### Claim 8 (depends on 7)

The system of claim 7, wherein the secure enclave processor or the trusted execution environment is computationally restricted from the general execution environment of the client computing device.

### Claim 9 (depends on 7)

The system of claim 7, wherein the secure enclave processor or the trusted execution environment is computationally isolated from the general execution environment of the client computing device.

### Claim 10

A computer implemented method for communicating data messages between a verifier computing device and a portable client computing device, the data messages establishing authentication of one or more characteristics of a client associated with the portable client computing device, the method comprising:
storing one or more token data objects received from an issuer computing device, the one or more token data objects generated using at least a issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the client associated with the portable client computing device;
receiving a verification request data message from the verifier computing device, the verification request data message including at least a nonce c0; and
generating a proof data message by conducting a modular inverse based at least on an attribute value from the one or more token data objects, generating a first random number and a second random number, computing a first group exponentiation and a second group exponentiation based on the first random number and the second random number, and a group multiplication including at least the first group exponentiation and the second group exponentiation, the group multiplication utilized to establish proof responses in a sigma protocol that are encapsulated into the proof data message;
wherein generating the proof data message comprises:
computing t=x−1 mod p, where x is the attribute value from the one or more token data objects, and p is an order of the discrete log group t is a modular inverse of x mod p;
uniformly sampling the first random number r, and the second random number, r2, such that r1, r2∈p;
computing R=Cxr1hr2, where R is a commitment to random values r1 and r2, Cx is a commitment to attribute x, and h is a group generator;
computing c=H(Cx, R, c0), where c is a proof challenge, based at least on the Fiat-Shamir Heuristic;
computing z1=ct+r1 and z2=−cty+r2, where z1 and z2 are the proof responses in the sigma protocol; and
encapsulating and transmitting the proof data message including R, z1 and z2 as data objects to the verifier computing device, such that the verifier computing device is able to compute c=H (Cx, R, c0) and confirm that gcR=Cxz1hz2, the verifier computing device controlling provisioning of access to a secured resource responsive to the confirmation that gcR=Cxz1hz2.

### Claim 11 (depends on 10)

The method of claim 10, wherein the client computing device processor is a secure enclave processor or a trusted execution environment that is segregated from a general execution environment of the client computing device.

### Claim 12 (depends on 10)

The method of claim 10, wherein the data storage is a secure enclave memory region that is segregated from a general memory region of the client computing device, the secure enclave memory region not accessible by general execution environment of the client computing device.

### Claim 13 (depends on 10)

The method of claim 10, wherein the one or more proof data messages are generated such that the one or more proof data messages can be validated using an issuer computing device public encryption key.

### Claim 14 (depends on 10)

The method of claim 10, wherein gcR=Cxz1hz2 indicates that a condition established in the verification request data message is met without having to present the underlying one or more characteristics of the client associated with the portable client computing device.

### Claim 15 (depends on 10)

The method of claim 10, wherein the verification request data message includes a blacklist data structure and the one or more proof data messages are generated to establish that the client associated with the portable client computing device does not match one or more identities stored in the blacklist data structure.

### Claim 16 (depends on 10)

The method of claim 10, wherein the verification request data message includes a whitelist data structure and the one or more proof data messages are generated to establish that the client associated with the portable client computing device does match one or more identities stored in the whitelist data structure.

### Claim 17 (depends on 10)

The method of claim 10, wherein the proof message, upon validation, is used to generate a determination to grant access to a protected resource.

### Claim 18

A non-transitory computer readable medium storing machine interpretable instructions, which when executed, cause a processor to perform the steps of a method for communicating data messages between a verifier computing device and a portable client computing device, the data messages establishing authentication of one or more characteristics of a client associated with the portable client computing device, the method comprising:
storing one or more token data objects received from an issuer computing device, the one or more token data objects generated using at least a issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the client associated with the portable client computing device;
receiving a verification request data message from the verifier computing device, the verification request data message including at least a nonce c0; and
generating a proof data message by conducting a modular inverse based at least on an attribute value from the one or more token data objects, generating a first random number and a second random number, computing a first group exponentiation and a second group exponentiation based on the first random number and the second random number, and a group multiplication including at least the first group exponentiation and the second group exponentiation, the group multiplication utilized to establish proof responses in a sigma protocol that are encapsulated into the proof data message;
wherein generating the proof data message comprises:
computing t=x−1 mod p, where x is the attribute value from the one or more token data objects, and p is an order of the discrete log group t is a modular inverse of x mod p;
uniformly sampling the first random number r1 and the second random number, r2, such that r1, r2∈p;
computing R=Cxr1hr2, where R is a commitment to random values r1 and r2, Cx is a commitment to attribute x, and h is a group generator;
computing c=H(Cx, R, c0), where c is a proof challenge, based at least on the Fiat-Shamir Heuristic;
computing z1=ct+r1 and z2=−cty+r2, where z1 and z2 are the proof responses in the sigma protocol; and
encapsulating and transmitting the proof data message including R, z1 and z2 as data objects to the verifier computing device, such that the verifier computing device is able to compute c=H(Cx, R, c0) and confirm that gcR=Cxz1hz2, the verifier computing device controlling provisioning of access to a secured resource responsive to the confirmation that gcR=Cxz1hz2.