# US 12,192,362 B2 · Secure data transfer system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,362 B2 - Document ID: US12192362B2 - Status: Granted - Kind: B2 - Application number: 18/177,520 - Filed: 2023-03-02 - Published: 2023-06-29 - Granted: 2025-01-07 - Earliest claimed: 2018-08-17 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Michael Steven Bankston - Web page: https://patentgrep.com/patent/US12192362B2 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0815: {providing single-sign-on or federations} - G06F 21/31: User authentication - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - H04L 9/0847: {involving identity based encryption [IBE] schemes} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are methods and systems for securely providing identity attributes. A server computer may receive, from a relying entity, a request for identity attributes associated with a target entity, wherein the request for identity attributes includes a session identifier associated with the target entity and an identifier of the relying entity. The server computer may validate the request based on the session identifier. The server computer may identify, based on the identifier of the relying entity, a package defining types of identity attributes for the relying entity and a data access token associated with the package. Based on validating the request, the server computer may transmit, to a digital identity provider, a request for a set of identity attributes corresponding to the package, the request comprising the data access token. The server computer may receive, from the digital identity provider, the set of identity attributes. ## Claims ### Claim 1 A method comprising: receiving, by a target entity computing device of a target entity from a relying entity computer of a relying entity, a request for permission to retrieve identity attributes associated with the target entity; transmitting, by the target entity computing device to the relying entity computer, a response indicating permission to retrieve the identity attributes, thereby causing the relying entity computer to transmit a request for a plurality of identity attributes associated with the target entity to a server computer, wherein the request for identity attributes includes a session identifier associated with the target entity and an identifier of the relying entity, thereby causing the server computer to: validate the request based on the session identifier; identify, based on the identifier of the relying entity, a package defining types of identity attributes for the relying entity and a data access token associated with the package, transmit, to a digital identity provider, a request for a set of identity attributes corresponding to the package, the request comprising the data access token, receive, from the digital identity provider, the set of identity attributes, and transmit, to the relying entity computer, the set of identity attributes. ### Claim 2 (depends on 1) The method of claim 1, wherein: the target entity is assigned a first cryptographic key of a set of keys; the relying entity is assigned a second cryptographic key of the set of keys; and the set of keys is stored to a key locker, encrypted with the first cryptographic key. ### Claim 3 (depends on 1) The method of claim 1, wherein: the request for permission to retrieve the identity attributes is received and the response indicating permission to retrieve the identity attributes are transmitted during a communication session established between the target entity computing device and the relying entity computer. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, by the target entity computing device from the relying entity computer, a request for step-up authentication; and responding, by the target entity computing device, to the request for step-up authentication. ### Claim 5 (depends on 1) The method of claim 1, wherein: the identified package comprises a package of assertions associated with the target entity; and the package of assertions comprises a set of assertions about the target entity, wherein the set of identity attributes are basis for the set of assertions. ### Claim 6 (depends on 5) The method of claim 5, wherein the package of assertions specifies a set of assertion types corresponding to the set of assertions, and wherein the server computer calculates and stores assertion values corresponding to the assertion types. ### Claim 7 (depends on 1) The method of claim 1, wherein the server computer determines an assertions model based on the identifier of the relying entity, and determines the set of identity attributes associated with the relying entity based on the assertions model. ### Claim 8 A system comprising a target entity computing device of a target entity comprising: a processor; and a non-transitory computer-readable medium comprising code, executable by the processor, to implement a method comprising: receiving, from a relying entity computer of a relying entity, a request for permission to retrieve identity attributes associated with the target entity; transmitting, by the target entity computing device to the relying entity computer, a response indicating permission to retrieve the identity attributes, thereby causing the relying entity computer to transmit a request for a plurality of identity attributes associated with the target entity to a server computer, wherein the request for identity attributes includes a session identifier associated with the target entity and an identifier of the relying entity, thereby causing the server computer to: validate the request based on the session identifier; identify, based on the identifier of the relying entity, a package defining types of identity attributes for the relying entity and a data access token associated with the package, transmit a request for a set of identity attributes corresponding to the package, the request comprising the data access token, and receive the set of identity attributes. ### Claim 9 (depends on 8) The system of claim 8, wherein: the target entity is assigned a first cryptographic key of a set of keys; the relying entity is assigned a second cryptographic key of the set of keys; and the set of keys is stored to a key locker, encrypted with the first cryptographic key. ### Claim 10 (depends on 8) The system of claim 8, wherein: the request for permission to retrieve the identity attributes is received during a communication session established between the target entity computing device and the relying entity computer. ### Claim 11 (depends on 8) The system of claim 8, the method further comprising: receiving, by the target entity computing device from the relying entity computer, a request for step-up authentication; and responding, by the target entity computing device, to the request for step-up authentication. ### Claim 12 (depends on 8) The system of claim 8, wherein: the identified package comprises a package of assertions associated with the target entity; and the package of assertions comprises a set of assertions about the target entity, wherein the set of identity attributes are basis for the set of assertions. ### Claim 13 (depends on 12) The system of claim 12, wherein the package of assertions specifies a set of assertion types corresponding to the set of assertions, and wherein the server computer calculates and stores assertion values corresponding to the assertion types. ### Claim 14 (depends on 8) The system of claim 8, wherein the server computer determines an assertions model based on the identifier of the relying entity, and determines the set of identity attributes associated with the relying entity based on the assertions model. ### Claim 15 A method comprising: receiving, by a digital identity provider computer from a server computer, a request for a set of identity attributes corresponding to a package defining types of identity attributes for a relying entity, the request comprising a data access token identified based on an identifier of the relying entity, wherein the digital identity provider computer received a request for identity attributes associated with a target entity from a relying entity computer associated with the relying entity, the request comprising a session identifier associated with the target entity and the identifier of the relying entity, and wherein the request was validated by the server computer based on the session identifier; retrieving, by the digital identity provider computer using the data access token and responsive to the request, the set of identity attributes; and transmitting, by the digital identity provider computer to the server computer, the set of identity attributes. ### Claim 16 (depends on 15) The method of claim 15, wherein the digital identity provider computer receives the data access token via a push to an application programming interface (API) exposed by the digital identity provider computer. ### Claim 17 (depends on 15) The method of claim 15, wherein the server computer thereafter transmits the set of identity attributes to the relying entity computer. ### Claim 18 (depends on 17) The method of claim 17, wherein the server computer further generates an event in an event log, the event being associated with the transmitting of the set of identity attributes. ### Claim 19 (depends on 15) The method of claim 15, wherein: the package comprises a package of assertions associated with the target entity; and the package of assertions comprises a set of assertions about the target entity, wherein the set of identity attributes are basis for the set of assertions. ### Claim 20 (depends on 19) The method of claim 19, wherein the package of assertions specifies a set of assertion types corresponding to the set of assertions, and wherein the server computer calculates and stores assertion values corresponding to the assertion types, and wherein a plurality of assertion values are stored as the package of assertions in association with the data access token for retrieving the corresponding identity attributes.