Secure service provider, secure wallet, method for issuing one or more secure wallets

An electronic transaction system (TS) comprising:

• a plurality of secure wallets (TMU-Ux) of users for directly exchanging tokens (T);
• and
• one or more service provider units (SPUx) in an electronic transaction system (TS), the secure service provider unit (SPU) comprising:
• a secure wallet issuing unit (TMU-IU) comprising one or more processors and a memory storing instructions that, when executed by the one or more processors, cause the secure wallet issuing unit (TMU-IU) to issue secure wallets (TMU-U) for users (U) in the electronic transaction system (TS), wherein each secure wallet (TMU-Ux) comprises wallet identification data (TMU-ID), the wallet identification data (TMU-ID) being assigned to a secure wallet (TMU-Ux) for uniquely identifying the secure wallet (TMU-Ux) in the electronic transaction system (TS),
• wherein the wallet identification data (TMU-ID) is used in transactions with wallets of the electronic transaction system (TS);
• wherein the secure wallet issuing unit (TMU-IU) is further configured to receive external digital identification data (D-ID-Ux) from a digital identity document of the user or from an external digital identity system, and to provide at least a part (TMU-ID-VAR) of the wallet identification data (TMU-ID) which is derived from external digital identification data (D-ID-Ux);
• wherein the secure service provider (SPU) is configured to derive at least the derived part of the wallet identification data (TMU-ID) or to receive at least the derived part from a central derivation unit (C-DER) of the electronic transaction system (TS);
• and
• wherein the external digital identification data (D-ID-Ux) is assigned to the user in an external digital identity system for uniquely identifying the user, and wherein the external digital identification data (D-ID-Ux) is encrypted with a cryptographic key to derive at least the part (TMU-ID-VAR) of the wallet identification data (TMU-ID), wherein secret inverse-derivation data comprises a corresponding cryptographic key required to decrypt the encrypted external digital identification data (D-ID-Ux).

A method for issuing one or more secure wallets (TMU-U) for users (U) in an electronic transaction system (TS), the one or more secure wallets (TMU-U) being issued by a secure service provider unit (SPU) of the electronic transaction system (TS), the secure service provider unit (SPU) comprising one or more processors and a memory storing instructions that, when executed by the one or more processors, cause the secure service provider unit (SPU) to perform the method by:

• receiving external digital identification data (D-ID-Ux) of a user from a digital identity document of the user or from an external digital identity system, wherein the external digital identification data (D-ID-Ux) is assigned to the user in the external digital identity system for uniquely identifying the user;
• providing wallet identification data (TMU-ID) including at least a part (TMU-ID-VAR) of the wallet identification data (TMU-ID) being derived based on at least the digital identification data (D-ID-Ux),
• wherein the secure service provider (SPU) derives at least the derived part of the wallet identification data (TMU-ID) or receives at least the derived part from a central derivation unit (C-DER) of the transaction system (TS);
• wherein the wallet identification data (TMU-ID) is used in transactions with other wallets of the electronic transaction system (TS);
• assigning the wallet identification data (TMU-ID) to a wallet (TMU-U) for the user to whom the secure wallet (TMU-U) is to be issued in the electronic transaction system (TS);
• and
• issuing the secure wallet (TMU-Ux) to the user (U) in the electronic transaction system (TS);
• wherein the external digital identification data (D-ID-Ux) is encrypted with a cryptographic key to derive at least the part (TMU-ID-VAR) of the wallet identification data (TMU-ID), wherein secret inverse-derivation data comprises a corresponding cryptographic key required to decrypt the encrypted external digital identification data (D-ID-Ux)
• wherein the method further comprises, prior to the receiving step:
• receiving a request for a secure wallet (TMU-U) at the secure service provider unit (SPU).