# US 12,015,720 B2 · Integrating identity tokens and privacy-preserving identity attribute attestations into interactions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,720 B2 - Document ID: US12015720B2 - Status: Granted - Kind: B2 - Application number: 18/044,544 - Filed: 2021-11-17 - Published: 2023-08-31 - Granted: 2024-06-18 - Earliest claimed: 2020-11-18 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Kim Wagner; Brian Sullivan; Dinah Sloan; Hao Ngo; Gaven James Watson; Sunpreet Singh Arora; Saikrishna Badrinarayanan; Srinivasan Raghuraman - Web page: https://patentgrep.com/patent/US12015720B2 ## CPC - H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method is disclosed. The method comprises receiving, by an identity network computer, a query set including a plurality of test identity attributes. After receiving the query set, the identity network computer may retrieve derivatives of identity attributes associated with a user, and an encrypted trapdoor, then compute an obscured query set using the query set, and optionally the derivatives of identity attributes. The identity network computer may transmit the obscured query set (i) and the encrypted trapdoor to a user device associated with the user, which generates and transmits a first modified trapdoor and the obscured query set to a relying party computer, or (ii) and a second modified trapdoor to the relying party computer. The relying party computer may thereafter use the obscured query set, and the first modified trapdoor or the second modified trapdoor, to determine if the identity attributes is a member of the query set. ## Claims ### Claim 1 A method comprising: receiving, by an identity network computer, a query set comprising a plurality of test identity attributes; retrieving, by the identity network computer, one or more derivatives of one or more identity attributes associated with a user, and an encrypted trapdoor; computing, by the identity network computer, an obscured query set using the query set, and the one or more derivatives of the one or more identity attributes associated with the user; and transmitting, by the identity network computer, the obscured query set and the encrypted trapdoor to a user device associated with the user, which transmits a first modified trapdoor and the obscured query set to a relying party computer, wherein the relying party computer uses the obscured query set, and the first modified trapdoor, to determine if the one or more the identity attributes of the one or more derivatives of the identity attributes is a member of the query set associated with the obscured query set. ### Claim 2 (depends on 1) The method of claim 1, wherein the obscured query set is computed using a public key encryption with equality testing scheme. ### Claim 3 (depends on 1) The method of claim 1, wherein the first modified trapdoor is a secret key. ### Claim 4 (depends on 1) The method of claim 1, wherein the relying party computer uses a decrypt to zero function of an El-Gamal encryption scheme to determine if the one or more the identity attributes of the one or more derivatives of the identity attributes is a member of the query set associated with the obscured query set. ### Claim 5 (depends on 1) The method of claim 1, wherein the query set comprises a range of ages or dates. ### Claim 6 (depends on 1) The method of claim 1, wherein the one or more derivatives of one or more identity attributes associated with the user are encrypted identity attributes associated with the user. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more derivatives of one or more identity attributes associated with the user are encrypted identity attributes received by the identity network computer from an identity provider computer. ### Claim 8 (depends on 1) The method of claim 1, wherein after the relying party computer determines the one or more the identity attributes of the one or more derivatives of the identity attributes is a member of the query set associated with the obscured query set, a relying party operating the relying party computer provides access to a resource to the user. ### Claim 9 (depends on 1) The method of claim 1, wherein the encrypted trapdoor is formed by an identity provider computer using a user public key associated with the user device. ### Claim 10 (depends on 1) The method of claim 1, wherein the one or more derivatives of one or more identity attributes associated with the user are formed using one or more identity attributes associated with the user, and a nonce. ### Claim 11 (depends on 1) The method of claim 1, wherein the obscured query set is formed by encrypting the plurality of test identity attributes of the query set with an ephemeral public key associated with the user device and permuting the encrypted test identity attributes of the query set. ### Claim 12 (depends on 1) The method of claim 1, wherein the user device is a mobile phone. ### Claim 13 An identity network computer comprising: a processor; and a non-transitory computer readable medium comprising instructions executable by the processor to perform operations including: receiving, by the identity network computer, a query set comprising a plurality of test identity attributes; retrieving, by the identity network computer, one or more derivatives of one or more identity attributes associated with a user, and an encrypted trapdoor; computing, by the identity network computer, an obscured query set using the query set, and the one or more derivatives of the one or more identity attributes associated with the user; and transmitting, by the identity network computer, the obscured query set and the encrypted trapdoor to a user device associated with the user, which transmits a first modified trapdoor and the obscured query set to a relying party computer, wherein the relying party computer uses the obscured query set, and the first modified trapdoor, to determine if the one or more the identity attributes of the one or more derivatives of the identity attributes is a member of the query set associated with the obscured query set. ### Claim 14 (depends on 13) The identity network computer of claim 13, wherein the obscured query set is computed using a public key encryption with equality testing scheme. ### Claim 15 (depends on 13) The identity network computer of claim 13, wherein the first modified trapdoor is a secret key. ### Claim 16 (depends on 13) The identity network computer of claim 13, wherein the encrypted trapdoor is formed by an identity provider computer using a user public key associated with the user device.