# US 2025/0158833 A1 · Method, apparatus, and computer-readable medium for authentication and authorization of networked data transactions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0158833 A1 - Document ID: US20250158833A1 - Status: Published application - Kind: A1 - Application number: 19/020,684 - Filed: 2025-01-14 - Published: 2025-05-15 - Earliest claimed: 2020-05-27 - Assignees: Dtcc Digital (US) Inc. - Applicants: Dtcc Digital (US) Inc. - Inventors: George Daniel Doney; Ihor Yermakov; Ilya Shkapo; Oleksii Korzhuk - Web page: https://patentgrep.com/patent/US20250158833A1 ## CPC - H04L 9/3247: {involving digital signatures} - G06F 21/31: User authentication - G06F 21/33: using certificates - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/123: {received data contents, e.g. message integrity} - G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/42: Anonymization, e.g. involving pseudonyms - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and apparatus for cryptographically linking separated authentication and authorization processes to support data transaction signing when group or corporate authority structures are required. The apparatus provides a secure, scalable model to represent authority in an entity context while conducting distributed ledger technology transactions. The method supports a range of cryptographic methods for separating the linked authentication and authorization processes including split key encryption, multi-party computation, multi-signature authorization, and execution of decentralized smart contract authorization logic. The method supports multiple models for authorization including organizational structures, consensus models including voting, and workflow processes. ## Claims ### Claim 1 A method for executing a data transaction, the method comprising: authenticating an actor; creating a cryptographically signed data packet upon authenticating the actor, wherein the cryptographically signed data packet comprises an actor ID and an authenticating service ID formulating the data transaction; authorizing the transaction by validating, via split key encryption, an authority of the actor to perform the transaction on behalf of an entity; executing the data transaction on behalf of the entity; and recording the data transaction on a decentralized ledger. ### Claim 2 (depends on 1) The method of claim 1, wherein the actor is an individual person or a group of persons. ### Claim 3 (depends on 1) The method of claim 1, wherein the data transaction represents a financial transaction. ### Claim 4 (depends on 1) The method of claim 1, wherein the cryptographically signed data packet includes a time-based expiration. ### Claim 5 (depends on 4) The method of claim 4, wherein the authenticating process is separate from the authorizing process, wherein the authenticating process and the authorizing process are linked off-chain using shared secret asymmetric encryption of the cryptographically signed data packet. ### Claim 6 (depends on 4) The method of claim 4, wherein the authenticating includes at least one of Lightweight Directory Access Protocol (LDAP) authentication, ActiveDirectory authentication, biometric authentication, and password authentication resulting in the issuing of a cryptographically signed data packet. ### Claim 7 (depends on 1) The method of claim 1, wherein signing the data transaction includes at least one of split key encryption, fragments used to encrypt a private key, a multi-signature method associated with external processes, a multi party computation method associated with an external process, and/or signing by an on-chain wallet transaction that is processed to determine authorization. ### Claim 8 (depends on 1) The method of claim 1, wherein the authorizing is based on an entity organizational structure and roles, group voting, or workflow automation. ### Claim 9 (depends on 1) The method of claim 1, wherein at least one wallet is encapsulated by a smart contract to thereby represent group authority of at least one group and wherein the at least one wallet is used to execute transactions on behalf of the at least one group. ### Claim 10 (depends on 1) The method of claim 1, wherein at least one workflow is represented as map stored on the decentralized ledger and executed via a decentralized workflow engine that includes smart contracts executed on the decentralized ledger, the workflow including workitems, routes, and tasks, and each of the workitems has a corresponding nonfungible token on the decentralized ledger, whereby a task approver can select a route for the workitem, within the workflow. ### Claim 11 A system for executing a transaction on a decentralized computer network, the system comprising: at least one computer processor; and at least one memory device operatively coupled to the at least one computer processor; wherein the at least one computer processor is configured to execute at least one set of instructions; wherein upon execution of the at least one set of instructions, the at least one computer processor is operable to: authenticate an actor; create a cryptographically signed data packet upon authentication of the actor, wherein the cryptographically signed data packet comprises an actor ID and an authenticating service ID; verify a cryptographic context for the transaction; authorize the transaction by validating via split key encryption an authority of the actor to perform the transaction on behalf of an entity; execute the transaction; and record the transaction on a decentralized ledger of the decentralized computer network. ### Claim 12 (depends on 11) The system of claim 11, wherein the actor is an individual person or a group of persons. ### Claim 13 (depends on 11) The system of claim 11 wherein the transaction represents a financial transaction. ### Claim 14 (depends on 11) The system of claim 11, wherein the authenticating and authorizing processes are linked off-chain using shared secret asymmetric encryption of the cryptographically signed data packet. ### Claim 15 (depends on 11) The system of claim 11, wherein the authenticating includes at least one of Lightweight Directory Access Protocol (LDAP) authentication, ActiveDirectory authentication, biometric authentication, and password authentication resulting in the issuing of the cryptographically signed data packet. ### Claim 16 (depends on 11) The system of claim 11, wherein the authenticating the actor includes the actor causing the transaction to be signed with a signature derived from a cryptographic wallet associated with the actor in the cryptographic context for the transaction. ### Claim 17 (depends on 11) The system of claim 11, wherein signing the transaction includes at least one of split key encryption, fragments used to encrypt a private key, a multi-signature method associated with external processes, a multi-party computation method associated with an external process, and/or signing by an on-chain wallet transaction that is processed to determine authorization. ### Claim 18 (depends on 11) The system of claim 11, wherein at least one wallet is encapsulated by a smart contract to thereby represent group authority of at least one group and wherein the at least one wallet is used to execute transactions on behalf of the at least one group. ### Claim 19 (depends on 11) The system of claim 11, wherein at least one workflow is represented as map stored on the decentralized ledger and executed via a decentralized workflow engine that includes smart contracts executed on the decentralized ledger, the workflow including workitems, routes, and tasks, and each of the workitems has a corresponding nonfungible token on the decentralized ledger, whereby the task approver can select a route for the workitem, within the workflow. ### Claim 20 A system for executing a transaction on a decentralized computer network, the system comprising: at least one computer processor; and at least one memory device operatively coupled to the at least one computer processor, wherein the at least one memory device is configured to store at least one set of instructions; wherein upon execution of the at least one set of instructions by the at least one computer processor, the at least one computer processor is operable to authenticate an actor; wherein upon authentication of the actor, the at least one computer processor is operable to create a cryptographically signed data packet; wherein upon creating a cryptographically signed data packet, the at least one computer processor is operable to verify a cryptographic context for the transaction; wherein upon verification of a cryptographic context, the at least one computer processor is operable to formulate a transaction; wherein upon formulation of the transaction, the at least one computer processor is operable to authorize the transaction by validating via split key encryption an authority of the actor to perform the transaction on behalf of the entity; and wherein upon authorization of the authority of the actor to perform the transaction on behalf of the entity, the at least one computer processor is operable to execute the transaction on behalf of the entity.