# US 8,788,836 B1 · Method and apparatus for providing identity claim validation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,836 B1
- Document ID: US8788836B1
- Status: Granted
- Kind: B1
- Application number: 11/644,579
- Filed: 2006-12-22
- Granted: 2014-07-22
- Earliest claimed: 2006-12-22
- Assignees: Symantec Corporation
- Applicants: Brian Hernacki; Sourabh Satish; Timothy G. Brown
- Inventors: Brian Hernacki; Sourabh Satish; Timothy G. Brown
- Web page: https://patentgrep.com/patent/US8788836B1

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/31: User authentication
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/126: {the source of the received data}
- G06F 2221/2115: Third party
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and apparatus for providing claim validation without storing user information within the IDM system. During enrollment, the IDM system creates a hash representative of the identification information provided by a user. The user information is discarded, i.e., not stored within the IDM system. Only a hash representing that information is stored within the system. Upon a user providing information to a service provider, the service provider requests that the user's information be authenticated by a third party IDS system. The service provider will request such authentication from the IDM system identified by the user. The IDM system generates, from the user's information that was provided to the service provider, a signed token that is sent to the user for use by the user to access the service provider's services. In this manner, the IDM system does not store identification information of the user. Yet, the IDM system provides identification validation services to any service provider requesting such services to ensure that a user is authentic.

## Claims

### Claim 1

An apparatus for validating identity claims comprising:
an identification management system comprising at least one hardware processor and at least one memory coupled to the at least one hardware processor, the identification management system configured to:
receive at least one identity claim;
validate the at least one identity claim using a hash of verified identification information without using stored identification information, wherein the hash is created based at least in part on identification information supplied by a user, wherein the hash is stored in the at least one memory, and wherein the identification information supplied by the user is discarded; and
create a signed token using the hash based on the validated at least one identity claim, wherein the signed token supports multifactor authentication.

### Claim 2 (depends on 1)

The apparatus of claim 1 further comprising a user computer for storing the signed token.

### Claim 3 (depends on 2)

The apparatus of claim 2 further comprising a service provider that processes the signed token when provided by the user computer to authenticate the identity of the user computer.

### Claim 4

A method of processing identification information comprising:
encrypting, using at least one hardware processor, identification information supplied by a user;
returning an encryption key and the encrypted identification information to the user;
creating a hash of the encrypted identification information based at least in part on identification information supplied by the user;
discarding the encrypted identification information and the identification information;
storing the hash and a private encryption key in an identification management system for validating at least one identity claim using at least one of the hash and the private encryption key without using stored identification information; and
creating a signed token using the hash in the event the at least one identity claim is validated, wherein the signed token supports multifactor authentication.

### Claim 5 (depends on 4)

The method of claim 4 further comprising:
providing the identification information from a user; and
verifying the veracity of the identification information prior to encrypting the identification information.

### Claim 6 (depends on 4)

The method of claim 4 wherein the identification information comprises a plurality of claims, and the encrypting step further comprises separately encrypting each claim in the plurality of claims.

### Claim 7 (depends on 4)

The method of claim 4 further comprising:
receiving, at the identification management system, a request from a user for a signed token as an indicia of the veracity of specific identity claims related to the identification information;
sending a key to the requesting user;
user decrypts encrypted identification information;
user selects at least one specific claim requiring validation;
user sends to the identification management system the at least one specific claim;
identification management system uses the private encryption key to decrypt the at least one specific claim;
identification management system computes a hash for the decrypted at least one specific claim;
comparing the hash for the at least one specific claim to the stored hash; and
creating the signed token if the hashes match.

### Claim 8 (depends on 7)

The method of claim 7 further comprising authenticating the user upon receiving the request for a signed token.

### Claim 9 (depends on 7)

The method of claim 7 further comprising sending the signed token to the user.

### Claim 10

A system for performing a secure transaction comprising:
a user computer coupled to a communication network;
a service provider, coupled to the communications network, for providing services for the user computer through the communications network;
an identification management system, coupled to the communications network, for:
creating a hash based at least in part on identification information supplied via the user computer,
storing the hash for the user computer in a memory of the identification management system,
discarding the identification information supplied via the user computer, and
preparing a signed token based on the hash upon request of the user computer, wherein the signed token supports multifactor authentication.

### Claim 11 (depends on 10)

The system of claim 10 wherein the user computer stores the signed token.

### Claim 12 (depends on 11)

The system of claim 11 wherein the user computer provides the signed token to the service provider to enable services to be provided to the user computer.