# US 2021/0243027 A1 · Decentralized document and entity verification engine

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0243027 A1
- Document ID: US20210243027A1
- Status: Published application
- Kind: A1
- Application number: 17/048,872
- Filed: 2019-04-19
- Published: 2021-08-05
- Earliest claimed: 2018-04-20
- Inventors: Vishal GUPTA
- Web page: https://patentgrep.com/patent/US20210243027A1

## CPC

- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- G06F 21/128: {involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java}
- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04L 67/025: for remote control or remote monitoring of applications
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 2209/127: Trusted platform modules [TPM]
- H04L 2209/60: Digital content management, e.g. content distribution
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method enabling an entity to prove its identity and provide authentic documents/data/information therein at any time required based upon data retrieved from an independent cryptographically verifiable source (ICVS) through a secured channel is disclosed. The system enables a virtual and secure browser on a user computing device allowing a user to login and retrieve authentic information pertaining to the user from the ICVS in a verifiable and untamperable manner. The retrieved information is bounded with origination information of the ICVS and the bounded information is provided to relying entities as authentic information for verification. Also, cryptographic value of the authentic information can be stored in an immutable storage such as blockchain, so that the cryptographic value is used by the relying-party to validate integrity of the authentic information.

## Claims

### Claim 1

A system comprising:
a processor; and
a memory comprising one or more routines, which when executed by the processor, cause the processor to:
configure, for a user working on a verification initiator unit (VIU) provided by a relying entity, a first session having a hyperlink that enables instantiation of a second session on a virtual browser on the VIU using a web gateway, said second session being partially configured on a remote terminal so as to operatively couple the remote terminal with the first session of the user of a first computing device;
configure the second session to open, in the virtual browser, an independent cryptographically verifiable source (ICVS) to enable said ICVS to authenticate the user;
retrieve a first set of data packets pertaining to the user from the ICVS through a secure data channel;
bind a second set of data packets that are selected from the first set of data packets with origination information of the ICVS so as to generate a third set of data packets; and
provide access of the third set of data packets to the relying entity of the first session.

### Claim 2 (depends on 1)

The system of claim 1, wherein the remote terminal runs on a trusted execution environment (TEE), wherein one or more attributes of the TEE are associated with the third set of data packets.

### Claim 3 (depends on 1)

The system of claim 1, wherein the virtual browser comprises a plug-in that receives at least session parameter that is associated with the first session, wherein said parameter relates to any or a combination of session id, user device, user, ICVS, timestamp, location, and IP address.

### Claim 4 (depends on 1)

The system of claim 1, wherein the virtual browser is a secure browser that does not allow tampering of the first set of data packets beyond what is allowed by the ICVS.

### Claim 5 (depends on 1)

The system of claim 1, wherein the first set of data packets are processed and utilized by the first session so as to match the first set of data packets containing user information with user information available in the first session.

### Claim 6 (depends on 1)

The system of claim 1, wherein the third set of data packets are shared with one or more second set of relying parties in the form of any or a combination of verifiable claims or credentials, Portable Document File (PDF) file, a decision, a JavaScript Object Notation (JSON), an Extensible Markup Language (XML), an electronic record, and a key.

### Claim 7

A device comprising:
a processor running a trusted execution environment (TEE); and
a memory comprising one or more routines, which when executed by the processor, cause the processor to:
retrieve a first set of data packets pertaining to a user from an independent cryptographically verifiable source (ICVS) through a secure data channel;
bind a second set of data packets that are selected from the first set of data packets with origination information of the ICVS so as to generate a third set of data packets that is processed to generate a cryptographic value pertaining to said third set of data packets; and
store the cryptographic value in an immutable storage, said cryptographic value being used by a third relying-party to validate integrity of the third set of data packets.

### Claim 8 (depends on 7)

The device claim 7, wherein the ICVS is any or a combination of a secure website, a Near-Field-Communication (NFC) card, a regulatory entity issued document, and a source having a certificate issued by a certified authority.

### Claim 9 (depends on 8)

The device of claim 8, wherein when the ICVS is the NFC card, the processor:
retrieves, on the device, from receiver of the NFC card, the first set of data packets; and
decrypts, on the device, the retrieved first set of data packets to enable selection of the second set of data packets and subsequent binding of the selected second set of data packets with the origination information.

### Claim 10 (depends on 7)

The device of claim 7, wherein the processor is further configured to match, at the device, data packets from any or a combination of the first, second, or third set of data packets with identity data sourced from the device, said identity data pertaining to the user.

### Claim 11 (depends on 7)

The device of claim 7, wherein the third set of data packets are associated with an identity of the user, said identity being selected from any or a combination of Public Key Infrastructures (PKIs) associated with the user, password of the user, Personal Identification Number (PIN) of the user, biometrics of the user, behavioral data of the user, non-fungible tokens (NFT) of the user, Fast Identity Online (FIDO) credentials of the user, device attributes of the user, and demographics of the user.

### Claim 12 (depends on 7)

The device claim 7, wherein the origination information of the ICVS is based on any or a combination of Secure Sockets Layer (SSL), Transport Layer Security (TLS), NFC information, IP address, domain name, who is information, certificate owner information, IP routes, forensic data pertaining to the ICVS, timestamp, sensor data pertaining to the ICVS, location information of the ICVS, and at least a portion of certificate information of the ICVS.

### Claim 13 (depends on 7)

The device claim 7, wherein the origination information of the ICVS comprises any or a combination of cryptographic proof of at least one of operating software and the TEE that is used to generate the third set of data packets, cryptographic proof of the user, cryptographic proof of entity running the TEE, cryptographic proof of verifier, and cryptographic proof of the third relying-party.

### Claim 14 (depends on 7)

The device claim 7, the first set of data packets are retrieved post successful authentication of the user through any or a combination of authenticating at the ICVS, authenticating the user at the device, authenticating using a biometric means, and authenticating using a private key.

### Claim 15 (depends on 7)

The device claim 7, the third set of data packets is associated with authentication data pertaining to the user.

### Claim 16 (depends on 7)

The device of claim 7, wherein the TEE is configured on the device or is configured virtually from the device and is operatively coupled with the device.

### Claim 17 (depends on 7)

The device of claim 7, wherein the immutable storage is selected from any or a combination of a blockchain, Distributed ledger technology (DLT), merkle tree, and a database.

### Claim 18 (depends on 7)

The device of claim 7, wherein the cryptographic value is associated with a timestamp that is based on retrieval of the first set of data packets from the ICVS.

### Claim 19 (depends on 7)

The device of claim 7, wherein the TEE comprises a secure web browser that is configured with a remote secure virtual terminal using a protocol selected from any or a combination of Remote Desktop Protocol (RDP), and Virtual Network Computing (VNC).

### Claim 20 (depends on 19)

The device of claim 19, wherein the first set of data packets are retrieved in the form of any or a combination of a web page, text, picture, context, Hypertext Markup Language (HTML), Cascading Style Sheet (CSS), Dynamic HTML (DHTML), MIME HTML (MHTML), PDF, and downloaded file that opens in the secure web browser.

### Claim 21 (depends on 19)

The device of claim 19, wherein the secure web browser does not allow tampering of the first set of data packets beyond what is allowed by the ICVS.

### Claim 22 (depends on 7)

The device of claim 7, wherein the binding of the second set of data packets with the origination information of the ICVS is performed by a cryptographically signed executable code.

### Claim 23 (depends on 7)

The device of claim 7, wherein the device digitally signs the cryptographic value based on any or a combination of hardware security module (HSM) or trusted platform module (TPM).

### Claim 24 (depends on 7)

The device of claim 7, wherein the third relying-party, upon receipt of a document whose authenticity is to be verified, generates a second cryptographic value, and matches said second cryptographic value against at least one cryptographic value that is stored in the immutable storage in order to validate the authenticity of the document.

### Claim 25 (depends on 7)

The device of claim 7, wherein the cryptographic value is associated with cryptographic signature of the user.

### Claim 26 (depends on 7)

The device of claim 7, wherein the first set of data packets comprises biometric information that is selected from any or a combination of photograph of the user, fingerprint of the user, voice of the user, and iris details of the user, said biometric information being used to authenticate the user.

### Claim 27 (depends on 7)

The device of claim 7, wherein the binding between the second set of data packets with the origination information of the ICVS is performed using any or a combination of checksum, hash function and cryptographic function.

### Claim 28 (depends on 7)

The device of claim 7, wherein the third set of data packets comprise or are associated with results of matching biometric information with the user, or results of matching authentication information with the user, or results of matching identity information with the user.

### Claim 29 (depends on 7)

The device of claim 7, wherein the ICVS is verified based on any or a combination SSL/TLS certificate where the certificate chain comprises a valid root certificate, signature of the first set of data packets that are issued from a credible root certificate authority, a presence in a whitelist, non-presence in a negative list, web ranking, a check performed by a parser.

### Claim 30 (depends on 7)

The device of claim 7, wherein the ICVS is associated with a parser to generate verifiable claims or credentials.

### Claim 31 (depends on 7)

The device of claim 7, wherein the ICVS is selected from a plurality of white-listed web portals, said plurality of white-listed web portals having one or more attributes selected from any or a combination of strength of user authentication, strength of identity proofing, types of biometrics available, population coverage, legal acceptance, types of identity attributes available, category of whitelist, region/country to which each white-listed web portal pertains, and associated standardized parser output.

### Claim 32 (depends on 7)

The device of claim 7, wherein user is an entity, a virtual user, a nominated user, or a natural person.

### Claim 33 (depends on 7)

The device of claim 7, wherein a set of verifiable credentials are generated from any or a combination of the first, second or third set of data packets, said set of verifiable credentials comprising any or a combination of source, user identity information, name, address, date of birth, city, unique identifiers, email, phone number, standardized credentials as per World Wide Web Consortium (W3C), and biometric information.

### Claim 34 (depends on 33)

The device of claim 33, wherein the set of verifiable credentials are associated with users' private key or self-sovereign identity.

### Claim 35 (depends on 7)

The device of claim 7, wherein the third set of data packets are associated with an identity of the user, said identity also being associated with a corresponding fourth set of data packets that are generated from a second ICVS.

### Claim 36 (depends on 35)

The device of claim 35, wherein the association of the user identity with the fourth set of data packets happens after user authentication that is based on any or a combination of a valid password, knowledge based authentication, biometric authentication, device based authentication, one-time password (OTP) based authentication, PKI based authentication, social authentication, Single-sign-on (SSO) based authentication, or behavioral authentication.

### Claim 37 (depends on 7)

The device of claim 7, wherein the third set of data packets are encrypted with a token, said encrypted set of third data packets being stored on a remote server, wherein the token is shared with a plurality of entities and/or the user based on users' consent.

### Claim 38 (depends on 37)

The device of claim 37, wherein the token is encrypted using public key of the user of the respective plurality of entities.

### Claim 39 (depends on 37)

The device of claim 37, wherein the token is encrypted using public key of SSL/TLS certificate of the ICVS.

### Claim 40 (depends on 37)

The device of claim 37, wherein the token is configured as a non-fungible token (NFT) on a blockchain or a DLT based on information from the first, second, or third set of data packets such that the information used to create the NFT remains unique.

### Claim 41 (depends on 40)

The device of claim 40, wherein the NFT or the token is associated with identity of the user.

### Claim 42 (depends on 7)

The device of claim 7, wherein a parallel second and third set of data packets are created using parsers to generate one of at least one of translation of the second and third set of data packets, or verifiable credentials, or a standardized output based on one or more attributes of the ICVS.

### Claim 43

A method, implemented by a processor running a trusted execution environment (TEE) comprising:
retrieving a first set of data packets pertaining to a user from an independent cryptographically verifiable source (ICVS) through a secure data channel;
binding a second set of data packets that are selected from the first set of data packets with origination information of the ICVS so as to generate a third set of data packets that is processed to generate a cryptographic value pertaining to said third set of data packets; and
storing the cryptographic value in an immutable storage, said cryptographic value being used by a third relying-party to validate integrity of the third set of data packets.

### Claim 44 (depends on 43)

The method of claim 43, wherein the method further comprises:
configuring, for the user working on a verification initiator unit (VIU) provided by the third relying entity, a first session having a hyperlink that enables instantiation of a second session on a virtual browser on the VIU using a web gateway, said second session being partially configured on a remote terminal so as to operatively couple the remote terminal with the first session of the user of a first computing device; and
configuring the second session to open, in the virtual browser, the ICVS to enable said ICVS to authenticate the user.

### Claim 45 (depends on 43)

The method of claim 43, wherein the first set of data packets are retrieved post successful authentication of the user through any or a combination of authenticating at the ICVS, authenticating the user at the device, authenticating using a biometric means, and authenticating using a private key so that the third set of data packets is associated with the authenticated user.