# US 12,225,129 B2 · Compliance platform for use with identity data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,225,129 B2
- Document ID: US12225129B2
- Status: Granted
- Kind: B2
- Application number: 18/385,470
- Filed: 2023-10-31
- Published: 2024-02-22
- Granted: 2025-02-11
- Earliest claimed: 2021-05-12
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Bryn Anthony Robinson-Morgan; Prashant Sharma; Liang Tian
- Web page: https://patentgrep.com/patent/US12225129B2

## CPC

- H04L 9/14: using a plurality of keys or algorithms
- G06F 16/9566: {URL specific, e.g. using aliases, detecting broken or misspelled links}
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 21/31: User authentication
- G06Q 30/018: Certifying business or products
- G06Q 50/265: {Personal security, identity or safety}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Various implementations described herein may refer to a compliance platform for use with identity data. In one implementation, a method may include receiving a compliance data package from a user, where the compliance data package includes encrypted evidence data corresponding to digital identity data of the user. The method may also include encrypting the compliance data package using a first cryptographic key. The method may further include generating a user key shard, a requestor key shard, and a regulator key shard based on the first cryptographic key. The method may include generating an unlock data package that includes the requestor key shard and encrypting the unlock data package using a second cryptographic key. The method may also include transmitting the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the user. The method may include transmitting the regulator key shard to a regulator.

## Claims

### Claim 1

A method, comprising:
receiving a compliance data package from a user, wherein the compliance data package comprises encrypted evidence data corresponding to digital identity data of the user;
encrypting the compliance data package using a first cryptographic key;
generating a plurality of key shards based on the first cryptographic key, wherein the plurality of key shards comprises a user key shard, a requestor key shard, and a regulator key shard;
generating an encrypted unlock data package based on the requestor key shard; and
transmitting the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the user.

### Claim 2 (depends on 1)

The method of claim 1, wherein:
the digital identity data comprises data relating to identity information of the user in a decentralized identity system;
the first cryptographic key is configured to be reconstructed based on at least two of the plurality of key shards; or
combinations thereof.

### Claim 3 (depends on 1)

The method of claim 1, wherein:
the encrypted evidence data comprises evidence data encrypted using a requestor public key of a requestor public-private key pair; and
the compliance data package further comprises a user signature generated based on the evidence data, an algorithm, a user private key of a user public-private key pair, or combinations thereof.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
receiving signature details data from the user, wherein the signature details data comprises data relating to the algorithm, the user private key, or combinations thereof; and
generating a regulator identifier corresponding to a regulator.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
receiving regulator endpoint data from the user, wherein the regulator endpoint data comprises data relating to a Uniform Resource Locator (URL) of a regulator, a name of the regulator, contact information for the regulator, or combinations thereof; and
transmitting the regulator key shard and the regulator identifier to the regulator based on the regulator endpoint data.

### Claim 6 (depends on 4)

The method of claim 4, wherein generating the encrypted unlock data package comprises:
generating an unlock data package, wherein the unlock data package comprises the requestor key shard, the signature details data, and the regulator identifier; and
encrypting the unlock data package using a platform public key of a platform public-private key pair.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
receiving the encrypted unlock data package from a requestor;
decrypting the received encrypted unlock data package using a platform private key of the platform public-private key pair;
retrieving the regulator identifier from the decrypted unlock data package; and
transmitting the retrieved regulator identifier to the requestor.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
receiving the regulator key shard, the encrypted unlock data package, and the encrypted compliance data package from the requestor;
retrieving the requestor key shard and the signature details data from the decrypted unlock data package;
reconstructing the first cryptographic key based on the received regulator key shard and the retrieved requestor key shard;
decrypting the encrypted compliance data package using the reconstructed first cryptographic key;
retrieving the user signature and the encrypted evidence data from the decrypted compliance data package;
validating the retrieved user signature based on the retrieved signature details data; and
transmitting the retrieved encrypted evidence data to the requestor based on the validation.

### Claim 9 (depends on 6)

The method of claim 6, further comprising:
receiving the user key shard, the encrypted unlock data package, and the encrypted compliance data package from a requestor;
decrypting the received encrypted unlock data package using a platform private key of the platform public-private key pair;
retrieving the requestor key shard and the signature details data from the decrypted unlock data package;
reconstructing the first cryptographic key based on the received user key shard and the retrieved requestor key shard;
decrypting the encrypted compliance data package using the reconstructed first cryptographic key;
retrieving the user signature and the encrypted evidence data from the decrypted compliance data package;
validating the retrieved user signature based on the retrieved signature details data; and
transmitting the retrieved encrypted evidence data to the requestor based on the validation.

### Claim 10

A method, comprising:
transmitting identity request data to a user, wherein the identity request data comprises data indicating a request for digital identity data of the user and a compliance data package, and wherein the compliance data package comprises encrypted evidence data corresponding to the digital identity data;
receiving the digital identity data, an encrypted unlock data package, and an encrypted compliance data package from the user, wherein:
the encrypted compliance data package comprises the compliance data package encrypted using a first cryptographic key of a compliance platform; and
the encrypted unlock data package comprises an unlock data package encrypted using a second cryptographic key of the compliance platform, and wherein the unlock data package comprises a requestor key shard corresponding to the first cryptographic key; and
storing the digital identity data, the encrypted unlock data package, and the encrypted compliance data package.

### Claim 11 (depends on 10)

The method of claim 10, wherein transmitting the identity request data comprises:
receiving access request data from the user, wherein the access request data comprises data indicating a request by the user for access to one or more resources; and
transmitting the identity request data to the user in response to the access request data.

### Claim 12 (depends on 10)

The method of claim 10, wherein the second cryptographic key comprises a platform public key of a platform public-private key pair.

### Claim 13 (depends on 10)

The method of claim 10, further comprising:
transmitting the encrypted unlock data package to the compliance platform;
receiving a regulator identifier from the compliance platform;
transmitting the regulator identifier to a regulator;
receiving a regulator key shard from the regulator, wherein the regulator key shard corresponds to the first cryptographic key; and
transmitting the regulator key shard, the encrypted unlock data package, and the encrypted compliance data package to the compliance platform.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
receiving the encrypted evidence data from the compliance platform;
decrypting the encrypted evidence data using a requestor private key of a requestor public-private key pair; and
verifying the digital identity data based on the decrypted evidence data.

### Claim 15 (depends on 10)

The method of claim 10, wherein the encrypted evidence data comprises evidence data encrypted using a requestor public key of a requestor public-private key pair.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
receiving user evidence request data from the user, wherein the user evidence request data comprises data corresponding to a request by the user for the evidence data;
transmitting user key request data to the user, wherein the user key request data comprises data corresponding to a request for a user key shard corresponding to the first cryptographic key;
receiving the user key shard from the user; and
transmitting the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the compliance platform.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
receiving the encrypted evidence data from the compliance platform;
decrypting the encrypted evidence data using a requestor private key of a requestor public-private key pair; and
transmitting the decrypted evidence data to the user.

### Claim 18

A system, comprising:
a compliance platform, comprising:
one or more first processors; and
at least a first memory comprising a plurality of first program instructions which, when executed by the one or more first processors, cause the one or more first processors to:
receive a compliance data package from a user, wherein the compliance data package comprises encrypted evidence data corresponding to digital identity data of the user;
encrypt the compliance data package using a first cryptographic key;
generate a plurality of key shards based on the first cryptographic key, wherein the plurality of key shards comprises a user key shard, a requestor key shard, and a regulator key shard;
generate an encrypted unlock data package based on the requestor key shard; and
transmit the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the user; and
a requestor, comprising:
one or more second processors; and
at least a second memory comprising a plurality of second program instructions which, when executed by the one or more second processors, cause the one or more second processors to:
transmit identity request data to the user, wherein the identity request data comprises data indicating a request for the digital identity data and the compliance data package;
receive the digital identity data, the encrypted unlock data package, and the encrypted compliance data package from the user; and
store the digital identity data, the encrypted unlock data package, and the encrypted compliance data package.

### Claim 19 (depends on 18)

The system of claim 18, wherein:
the digital identity data comprises data relating to identity information of the user in a decentralized identity system;
the first cryptographic key is configured to be reconstructed based on at least two of the plurality of key shards; or
combinations thereof.

### Claim 20 (depends on 18)

The system of claim 18, wherein:
the encrypted evidence data comprises evidence data encrypted using a requestor public key of a requestor public-private key pair; and
the compliance data package further comprises a user signature generated based on the evidence data, an algorithm, a user private key of a user public-private key pair, or combinations thereof.