Method and system for decentralized identity management and data distribution
OwnerMichael William Hathawayinventor
Life of this patent
Estimating the term…
Abstract
A computing and network system employs decentralized methods to create and maintain digital identities for network connected computing devices and the distribution of information between them on public and private networks. Embodiments enable identities to be authenticated and digitally signed, and shared information to be validated by network services using locally stored information.
Claims23
A method for managing digital identities for network connected computing devices in which a server is connected to a computing device via a network connection, wherein the server is distributed across one or more systems, the method comprising the server:
- receiving, from the computing device, an access request with user credentials from a user for services on the server;
- determining whether an identity record exists for the user based on user credentials;
- when an identity record exists for the user identifying an identity tag for an authentication device in the identity record of the user, wherein the identity tag contains at least:
- an identity consisting of a unique prefix indicating a source server that issued the identity tag and a unique alpha-numeric value identifying an authentication device of the user;
- an identity tag of a registrar service that assigned the identity tag to the authentication device of the user;
- and
- a signature of the source server that issued the identity tag;
- looking up routing information for the authentication device of the user using the identity tag;
- generating a message containing, at least, a random challenge;
- transmitting the message to the authentication device using the routing information, wherein when user uses signs the random challenge on the authentication device:
- receiving the signed random challenge from the authentication device once completed by the user;
- and
- transmitting access permissions of the user for the services on the server to the computing device.
A method for distributing identity information between network connected servers and computing devices in which a source server is connected to one or more endpoint servers via a network connection or a series of one or more servers connected via a network connection, wherein the source server is distributed across one or more systems, the method comprising the server:
- maintaining an identity collection of identity tags and associated identity records on the source server;
- receiving, from an endpoint server, a change to the identity collection of the source server;
- applying the change to the identity collection of the source server;
- disseminating the change to one or more destination endpoint servers which subscribe to the type of change made to the identity collection by:
- creating a message containing, at least,
- a source server identity tag;
- a source endpoint server identity tag;
- a destination server identity tag;
- a destination endpoint server identity tag;
- a destination payload containing the change to the identity collection of the source server;
- a source endpoint server signature;
- and
- a source server signature;
- looking up routing information for the one or more destination endpoint servers using the destination server identity tag and the destination endpoint server identity tag;
- and
- transmitting the message to the one or more endpoint servers, wherein the destination endpoint servers validate the information using the source endpoint server signature and the source server signature and apply the identity collection change contained within the destination payload to identity collections of the destination endpoint servers.
A method for distributing messages between network connected servers and computing devices in which a source server is connected to one or more endpoint servers via a network connection or a series of one or more servers connected via a network connection, wherein the source server is distributed across one or more systems, the method comprising the server:
- maintaining an identity collection of identity tags and associated identity records on the source server;
- receiving, from an endpoint server, a message intended for one or more destination endpoint servers;
- disseminating the message to the one or more destination endpoint servers by:
- creating a message containing, at least:
- a source server identity tag;
- a source endpoint server identity tag;
- a destination server identity tag;
- a destination endpoint server identity tag;
- a destination payload containing the message;
- a source endpoint server signature;
- and
- a source server signature;
- looking up routing information for the one or more destination endpoint servers using the destination server identity tag and the destination endpoint server identity tag;
- and
- transmitting the message to the one or more endpoint servers, wherein the destination endpoint servers validate the information using the source endpoint server signature and the source server signature.
A method for creation and enrollment of digital identities and publishing of identity records, comprising:
- providing one or more realm servers that operate autonomous network services to create, enroll, and validate digital identities affiliated within one or more realms;
- said one or more realm servers distributing digital identity information to computing devices within the realm and with other realms within a federation of realms;
- said one or more realm servers sharing published identity records with subscribing network services for decentralized authentication and authorization of federated identities accessing network services and for verification of digitally signed data with a federated network of realm servers that distribute identity records associated with each realm;
- and
- said one or more realm servers distributing identity records on a subscription basis to computing devices within the realm and to other realms within a federation to maintain relevant identity records on realm servers which distribute said identity records to realm computing devices.
A method for creation and enrollment of digital identities and publishing of identity records, comprising:
- providing a realm hierarchy network architecture for distribution and sharing of signed records, messages, and information across public and private networks;
- using federated networks of realm servers to hierarchically distribute information across federated realms;
- and
- said realm servers forwarding subscription data to realm affiliated computing devices connected on public and private networks;
- wherein a centralized distribution service is eliminated;
- and
- wherein forwarding and routing of information is simplified and privacy and security of computing devices is maintained within a realm's private network.
A decentralized identity management system, comprising:
- a network of one or more realm servers configured to distribute identity related records and messages between servers, network services, and network connected digital devices;
- wherein said one or more realm servers comprise:
- a registrar server which issues unique digital identity tags, enrolls a digital identity record associated with the identity tag, and provides administrative services for updating identity record information;
- a messaging system with which said realm servers connect on a permissioned and subscription basis to share identity record information and forward authentication challenge messages between digital devices and software services;
- a digital signing facility wherein said realm servers use a digital identity private key to sign messages and identity records;
- and
- a signature validation facility with which said realm servers validate signatures of records and messages from digital device and server identities.
Dependencies are inferred from the claim text.