Attributes in cryptographic credentials

A computer implemented method for determining, in a verifying module of a data processing computer system, whether a cryptographic credential associated with a proving module of the system certifies a specified user attribute, said cryptographic credential encoding the product E of a plurality of prime numbers each encoding a respective user attribute in accordance with a predetermined mapping of attributes to prime numbers, the method comprising the steps of:

• receiving, in an issuing module, a cryptographic credential request from the proving module, which includes the specified user attribute;
• sending a verification request from the verifying module to the proving module, wherein the verification request includes a list of at least the specified user attribute and the prime number associated therewith;
• sending a request, from the proving module, to access a specified service by communicating with the verifying module to demonstrate possession of said cryptographic credential encoding said product E;
• and
• determining whether a prime number e encoding said specified attribute in accordance with said mapping divides the value E encoded in the credential, thus certifying the specified user attribute.

A computer implemented method for proving to a verifying module of a data processing computer system that a cryptographic credential associated with a proving module of the system certifies at least one of a predetermined set of user attributes, said cryptographic credential encoding the product E of a plurality of prime numbers each prime number encoding a respective user attribute in accordance with a predetermined mapping of attributes to prime numbers, the method comprising the steps of:

• receiving, in an issuing module, a cryptographic credential request from the proving module;
• sending a verification request from the verifying module to the proving module, wherein the verification request includes a list of at least one of the set of the predetermined user attributes and the prime number associated therewith;
• sending a request, from the proving module, to access a specified service;
• demonstrating to the verifying module possession of the cryptographic credential encoding E;
• and
• communicating with the verifying module to prove possession of a secret number d which divides both the value E encoded in the credential and a value Q that is the product of respective prime numbers encoding the attributes in said set in accordance with said predetermined mapping of attributes to prime numbers, thus proving said certification.

Apparatus for generating a cryptographic credential certifying a plurality of user attributes, the apparatus comprising a processor device and control logic configured to:

• request the cryptographic credential;
• receive a verification request that includes a list identifying one or more of the plurality of user attributes and the prime numbers associated therewith;
• encode each attribute as a prime number in accordance with a predetermined mapping of attributes to prime numbers;
• request access to a specified service;
• calculate the product of the prime numbers encoding the attributes;
• and
• generate a cryptographic credential encoding said product.

A computer implemented method for determining in a verifying module of a data processing system whether a user attribute encoded in a cryptographic credential associated with a proving module of the system is a member of a predetermined set of user attributes, the cryptographic credential encoding said user attribute as a prime number E in accordance with a predetermined mapping of attributes to prime numbers, the method comprising the steps of:

• receiving, in an issuing module, a cryptographic credential request, which includes the user attribute;
• sending a verification request from the verifying module to the proving module, wherein the verification request includes a list identifying a list of at least one of the set of the predetermined user attributes and the prime number associated therewith;
• sending a request, from the proving module, to access to a specified service;
• determining, using said computer of a user, a product value Q which is the product of respective prime numbers corresponding to the attributes in said set in accordance with said predetermined mapping of attributes to prime numbers;
• communicating with the verifying module to demonstrate possession of a cryptographic credential encoding a secret value that is said prime number E;
• and
• demonstrating to the verifying module that said secret value divides the product value Q, thus demonstrating that said user attribute is a member of said set.

A computer implemented method for verifying at a verifying module of a data processing computer system whether a user attribute encoded in a cryptographic credential associated with a proving module of the system is a member of a predetermined set of user attributes, the cryptographic credential encoding said user attribute as a prime number E in accordance with a predetermined mapping of attributes to prime numbers, the method comprising the steps of:

• receiving, in an issuing module, a request from the proving module for a cryptographic credential, wherein the request includes one or more user attributes;
• receiving, in the proving module, a verification request that includes a list of at least one of the set of the predetermined user attributes and the prime number associated therewith;
• communicating with the proving module to retrieve a request to access a specified service;
• communicating with the proving module to verify possession by the proving module of a cryptographic credential encoding a secret value E;
• and
• communicating with the proving module to determine whether said secret value divides a product value Q that is the product of respective prime numbers corresponding to the attributes in said set in accordance with said predetermined mapping of attributes to prime numbers.

A proving module of a data processing computer system for proving to a verifying module of the system whether a user attribute encoded in a cryptographic credential associated with the proving module is a member of a predetermined set of user attributes, the cryptographic credential encoding said user attribute as a prime number E in accordance with a predetermined mapping of attributes to prime numbers, the proving module comprising (i) a communications interface for communicating with the verifying module and (ii) control logic configured to:

• request the cryptographic credential;
• receive, in response to the cryptographic credential request, a list of at least one of the set of the predetermined user attributes and the prime numbers associated therewith;
• determine a product value Q that is the product of respective prime numbers corresponding to the attributes in said set in accordance with said predetermined mapping of attributes to prime numbers;
• request access to a specified service;
• communicate with the verifying module via said communications interface to demonstrate possession of a cryptographic credential encoding a secret value that is said prime number E;
• and
• communicate with the verifying module via said communications interface to prove whether said secret value divides the product value Q.