# US 12,217,245 B2 · Systems and methods for distributed ledger-based institutional identity management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,217,245 B2
- Document ID: US12217245B2
- Status: Granted
- Kind: B2
- Application number: 17/174,650
- Filed: 2021-02-12
- Published: 2021-08-19
- Granted: 2025-02-04
- Earliest claimed: 2020-02-13
- Assignees: JPMorgan Chase Bank, N.A.
- Applicants: Jpmorgan Chase Bank, N.A.
- Inventors: Christine Moy; Tyrone Lobban; George Kassis; Vishakh Vishakh; Bhaskar Kishore; Navkiran Arneja
- Web page: https://patentgrep.com/patent/US12217245B2

## CPC

- G06Q 20/3674: {involving authentication}
- G06Q 30/018: Certifying business or products
- G06F 21/33: using certificates
- G06Q 20/02: involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
- G06Q 20/363: {with the personal data of a user}
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- G06Q 20/3825: {Use of electronic signatures}
- G06Q 20/4014: {Identity check for transactions}
- G06Q 50/265: {Personal security, identity or safety}
- H04L 9/3247: {involving digital signatures}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04W 12/106: Packet or message integrity
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods for distributed ledger-based identity management are disclosed. In one embodiment, a computer-based method for managing attestations may include: (1) receiving, by a computer program executed by an electronic device for an identity consumer and from an identity provider, a notification from an identity provider server that an attestation is available, wherein the attestation may be generated by the identity provider based on authorization from a system operator and may include a chain of trust comprising an identification of the system operator and the identity provider; (2) requesting, by the computer program, the attestation from the identity provider; and (3) downloading, by the computer program, the attestation to an identity consumer electronic wallet for the identity consumer. The identity provider may commit the downloading of the attestation to a distributed ledger, wherein the distributed ledger maintains a current status for the attestation.

## Claims

### Claim 1

A computer-based method for providing attestations for an identity consumer from an identity provider to a relying party, comprising:
providing, by the identity consumer to an identity provider server for the identity provider, identity consumer information;
validating, by the identity provider server, the identity consumer information;
receiving, by the identity provider server, a root attestation from a system operator that authorizes the identity provider server to issue identity provider attestations;
generating, by the identity provider server, an identity provider attestation comprising an attestation about the identity consumer information;
generating, by the identity provider server, a nested attestation comprising the identity provider attestation and the root attestation, wherein the nested attestation establishes a chain of trust by building the identity provider attestation on the root attestation in a single attestation;
receiving, by an identity consumer computer program executed by an electronic device for the identity consumer and from the identity provider server, a notification that the nested attestation is available;
requesting, by the identity consumer computer program, the nested attestation from the identity provider server;
downloading, by the identity consumer computer program, the nested attestation to an identity consumer electronic wallet for the identity consumer;
committing, by the identity provider server, the nested attestation to a distributed ledger, wherein the distributed ledger maintains a current status for the root attestation and the identity provider attestation;
receiving, by the identity consumer computer program and from a relying party computer application for the relying party, a request for the nested attestation;
generating, by the identity consumer computer program, a machine-readable code for the nested attestation that is stored in the identity consumer electronic wallet;
communicating, by the identity consumer computer program and to the relying party computer application, the machine-readable code for the nested attestation;
extracting, by the relying party computer application, the nested attestation from the machine-readable code;
identifying, by the relying party computer application, the root attestation and the identity provider attestation from the nested attestation;
verifying, by the relying party computer application and on the distributed ledger, that the root attestation and the identity provider attestation are valid and active; and
executing, by the relying party computer application, an action based on reliance on the verification.

### Claim 2 (depends on 1)

The computer-based method of claim 1, wherein the identity provider attestation comprises a license, a certificate, a credential, or an authorization.

### Claim 3 (depends on 1)

The computer-based method of claim 1, wherein the identity provider comprises one of a financial institution, a government agency, an employer, and a legal entity.

### Claim 4 (depends on 1)

The computer-based method of claim 1, wherein the identity provider attestation comprises an identification of an attestor, an identification of an attestee, a type of identity provider attestation, and a date of issuance.

### Claim 5 (depends on 1)

The computer-based method of claim 1, wherein the identity consumer electronic wallet comprises a wallet application, a mobile wallet, or a web-based wallet.

### Claim 6 (depends on 1)

The computer-based method of claim 1, wherein the current status of the root attestation or the identity provider attestation comprises valid, expired, or revoked.

### Claim 7 (depends on 1)

The computer-based method of claim 1, wherein the relying party computer application periodically verifies the current status of the root attestation or the identity provider attestation using the distributed ledger.

### Claim 8 (depends on 1)

The computer-based method of claim 1, wherein the relying party receives a notification that the root attestation or the identity provider attestation is revoked or expired from the distributed ledger.

### Claim 9

A computer-based method for sending an object using attestations, comprising:
providing, by an identity consumer computer program executed by an identity consumer electronic device to an identity provider server for an identity provider, identity consumer information for an identity consumer;
receiving, by the identity provider server, a root attestation from a system operator that authorizes the identity provider server to issue identity provider attestations;
generating, by the identity provider server, an identity provider attestation comprising an attestation about the identity consumer information;
generating, by the identity provider server, a nested attestation comprising the identity provider attestation and the root attestation, wherein the nested attestation establishes a chain of trust by building the identity provider attestation on the root attestation in a single attestation;
receiving, by the identity consumer computer program, an identity of an object to sign;
requesting, by the identity consumer computer program the nested attestation from the identity provider server;
receiving, by the identity consumer computer program, the nested attestation;
storing, by the identity consumer computer program, the nested attestation in an identity consumer electronic wallet for the identity consumer;
retrieving, by the identity consumer computer program, the object;
signing, by the identity consumer computer program, the object with the nested attestation that is stored in the identity consumer electronic wallet by embedding the attestation in the object;
sending, by the identity consumer computer program, the signed object to a receiving party computer program executed by an electronic device for a receiving party;
extracting, by the receiving party computer program, the nested attestation from the object; and
verifying, by the receiving party computer program and on a distributed ledger that maintains a current status for the root attestation and the identity provider attestation, that the root attestation and the identity provider attestation are valid and active.

### Claim 10 (depends on 9)

The computer-based method of claim 9, wherein the object comprises a document, and the identity provider attestation attests that the identity consumer is authorized to sign the document.

### Claim 11 (depends on 9)

The computer-based method of claim 9, wherein the object is a payment, and the identity provider attestation attests that the identity consumer is authorized to make the payment.

### Claim 12 (depends on 9)

The computer-based method of claim 9, wherein the object comprises digital currency.

### Claim 13 (depends on 9)

The computer-based method of claim 9, wherein the identity provider attestation comprises a license, a certificate, a credential, or an authorization, and further comprises an identification of an attestor, an identification of an attestee, a type of identity provider attestation, and a date of issuance.

### Claim 14 (depends on 9)

The computer-based method of claim 9, further comprising:
generating, by the identity provider server, a receiving party attestation comprising an attestation about the receiving party;
generating, by the identity provider server, a receiving party nested attestation comprising the receiving party attestation and the root attestation, wherein the nested attestation establishes a chain of trust by building the receiving party attestation on the root attestation in a single attestation;
receiving, by the identity provider computer program and from the receiving computer program, a request for the object and the receiving party nested attestation; and
verifying, by the identity consumer computer program and on the distributed ledger, that the root attestation and the receiving party attestation are valid and active before sending the object to the receiving party.

### Claim 15 (depends on 14)

The computer-based method of claim 14, wherein the receiving party attestation attests to an account for the receiving party.