System and method for an electronic identity brokerage
AssigneeRoyal Bank of Canada
InventorsEdison U. Ortiz, Arya Pourtabatabaie, Margaret Inez Salter
Life of this patent
Estimating the term…
Abstract
A computer implemented system for electronic verification of credentials including at least one processor and data storage is described in various embodiments. The system includes cryptographic mechanisms and electronic communication between one or more computing systems that in concert, provide verification of a prover's credentials in accordance to logical conditions of a verifier's policy without providing additional information to a verifier entity.
Claims20
A computer implemented system for communicating data messages between a verifier computing device and a portable client computing device via a network, the data messages establishing authentication of one or more characteristics of a client associated with the portable client computing device, the system comprising:
- the portable client computing device including at least a client computing device processor and data storage, the data storage storing one or more token data objects received from or computed jointly in a multiparty protocol with an issuer computing device separate from the verifier computing device and the portable client computing device, the one or more token data objects generated using at least a issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the client associated with the portable client computing device;
- and
- the client computing device processor configured to:
- receive a verification request data message from the verifier computing device, the verification request data message specifying at least one characteristic of the one or more characteristics of the client for verification;
- using a combination of the one or more token data objects and the verification request data message, generate one or more proof data messages authenticating the at least one characteristic without sending any data messages or requests to the issuer computing device wherein generating the one or more proof data messages comprises:
- conducting a modular inverse based at least on an attribute value from the one or more token data objects, generating a first random number and a second random number, computing a first group exponentiation and a second group exponentiation based on the first random number and the second random number, and a group multiplication including at least the first group exponentiation and the second group exponentiation, the one or more proof data messages including proof responses based on the modular inverse, and the group multiplication;
- and
- transmit the one or more proof data messages to the verifier computing device.
A computer implemented method for communicating data messages between a verifier computing device and a portable client computing device via a network, the data messages establishing authentication of one or more characteristics of a client associated with the portable client computing device, the method comprising:
- storing, in a data storage, one or more token data objects received from an issuer computing device separate from the verifier computing device and the portable client computing device, the one or more token data objects generated using at least a issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the client associated with the portable client computing device;
- receiving, by a client computing device processor, a verification request data message from the verifier computing device, the verification request data message specifying at least one characteristic of the one or more characteristics of the client for verification using a combination of the one or more token data objects and the verification request data message, generating, by the client computing device processor, one or more proof data messages authenticating the at least one characteristic without sending any data messages or requests to the issuer computing device, wherein generating the one or more proof data messages comprises:
- conducting a modular inverse based at least on an attribute value from the one or more token data objects, generating a first random number and a second random number, computing a first group exponentiation and a second group exponentiation based on the first random number and the second random number, and a group multiplication including at least the first group exponentiation and the second group exponentiation, the one or more proof data messages including proof responses based on the modular inverse, and the group multiplication;
- and
- transmitting, by the client computing device processor, the one or more proof data messages tothe verifier computing device.
A non-transitory computer readable medium storing machine interpretable instructions, which when executed, cause a processor to perform the steps of a method for communicating data messages between a verifier computing device and a portable client computing device via a network, the data messages establishing authentication of one or more characteristics of a client associated with the portable client computing device, the method comprising:
- storing one or more token data objects received from an issuer computing device separate from the verifier computing device and the portable client computing device, the one or more token data objects generated using at least a issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the client associated with the portable client computing device;
- receiving a verification request data message from the verifier computing device, the verification request data message specifying at least one characteristic of the one or more characteristics of the client for verification;
- and
- using a combination of the one or more token data objects and the verification request data message, generate one or more proof data messages authenticating the at least one characteristic without sending any data messages or requests to the issuer computing device, wherein generating the one or more proof data messages comprises:
- conducting a modular inverse based at least on an attribute value from the one or more token data objects, generating a first random number and a second random number, computing a first group exponentiation and a second group exponentiation based on the first random number and the second random number, and a group multiplication including at least the first group exponentiation and the second group exponentiation, the one or more proof data messages including proof responses based on the modular inverse, and the group multiplication;
- and
- transmitting the one or more proof data messages to the verifier computing device.
Dependencies are inferred from the claim text.