Patent US9667427

Systems and methods for managing digital identities
[+] Show Details

US9667427

1. A computer-implemented method comprising acts of: (4) (6)

receiving a pointer to a badge for use in attesting to an identity of a user;

using the pointer to access the badge from a digital identity representation in a distributed ledger system, wherein: the digital identity representation is associated with an identifier for the user, the digital identity representation comprising program code that implements rules for attestation;

the badge comprises a plurality of attribute attestations corresponding respectively to a plurality of attributes; and

for each attribute of the plurality of attributes, the corresponding attribute attestation comprises a cryptographic proof;

receiving, via a channel outside the distributed ledger system, a plurality of values comprising, for each attribute of the plurality of attributes, a value corresponding to that attribute;

identifying, from the badge, an entity that is responsible for verifying the badge;

determining whether to trust the entity responsible for verifying the badge; and

in response to determining that the entity responsible for verifying the badge is to be trusted, checking, for each attribute attestation of the plurality of attribute attestations, whether: the attribute attestation is in a VERIFIED state;

the cryptographic proof in the attribute attestation is a valid proof of the received value corresponding to the attribute corresponding to the attribute attestation; and

the attribute attestation is electronically signed by the entity responsible for verifying the badge.

2. The computer-implemented method of claim 1, wherein (0) (1)

3. The computer-implemented method of claim 1, wherein the distributed ledger system is implemented using at least one blockchain. (0)

4. The computer-implemented method of claim 1, wherein (0) (1)

5. The computer-implemented method of claim 1, wherein: (1) (1)

the program code, when executed by at least one processor, maintains state information for the attribute attestation of each attribute of the plurality of attributes.

6. The computer-implemented method of claim 5, wherein the program code, when executed by the at least one processor, maintains an attribute attestation of the plurality of attribute attestations in a state selected from a group consisting of: PENDING, VERIFIED, EXPIRED, and INVALID. (3) (0)

10. A computer-implemented method comprising: (1) (3)

receiving, via a distributed ledger system, a request to verify a first badge, the first badge comprising a plurality of attribute attestations corresponding respectively to a plurality of attributes for a user, wherein for each attribute of the plurality of attributes, the corresponding attribute attestation comprises a cryptographic proof;

receiving, via a channel outside the distributed ledger system, a plurality of values comprising, for each attribute of the plurality of attributes, a value corresponding to that attribute; and

for at least one attribute of the plurality of attributes: identifying, from the first badge, a first attribute attestation corresponding to the at least one attribute, the first attribute attestation comprising a first cryptographic proof;

identifying, from the first attribute attestation, a pointer to a second badge;

using the pointer to access the second badge from the distributed ledger;

identifying, from the second badge, an entity that is responsible for verifying the second badge, and a second attribute attestation corresponding to the at least one attribute;

determining whether to trust the entity responsible for verifying the second badge; and

in response to determining that the entity responsible for verifying the second badge is to be trusted, checking whether: (1) the second attribute attestation is in a VERIFIED state;

(2) the second cryptographic proof is a valid proof of the received value corresponding to the at least one attribute; and

(3) the second attribute attestation is electronically signed by the entity responsible for verifying the second badge.

11. The method of claim 10, further comprising an act of checking whether: (1) (1)

(4) the first cryptographic proof is a valid proof of the received value corresponding to the at least one attribute.

12. The method of claim 11, further comprising acts of, in response to determining that (1)-(4) are satisfied: (0) (2)

13. A system comprising: (4) (2)

at least one processor;

at least one non-transitory computer-readable medium having stored thereon instructions which, when executed, cause the at least one processor to: receive a pointer to a badge for use in attesting to an identity of a user;

use the pointer to access the badge from a digital identity representation in a distributed ledger system, wherein: the digital identity representation is associated with an identifier for the user, the digital identity representation comprising program code that implements rules for attestation;

identify, from the badge, a plurality of attribute attestations corresponding respectively to a plurality of attributes;

for each attribute of the plurality of attributes, identify, from the corresponding attribute attestation, a cryptographic proof;

receive, via a channel outside the distributed ledger system, a plurality of values comprising, for each attribute of the plurality of attributes, a value corresponding to that attribute;

identify, from the badge, an entity that is responsible for verifying the badge;

determine whether to trust the entity responsible for verifying the badge; and

in response to determining that the entity responsible for verifying the badge is to be trusted, check, for each attribute attestation of the plurality of attribute attestations, whether: the attribute attestation is in a VERIFIED state;

the cryptographic proof in the attribute attestation is a valid proof of the received value corresponding to the attribute corresponding to the attribute attestation; and

the attribute attestation is electronically signed by the entity responsible for verifying the badge.

14. The system of claim 13, wherein the digital identity representation is accessed from the distributed ledger system along with an electronic signature that is generated over the digital identity representation. (0)

15. The system of claim 13, wherein the distributed ledger system is implemented using at least one blockchain. (0)

16. The system of claim 13, wherein the badge is generated according to a schema selected from a plurality of schemas for badges, the schema comprising the plurality of attributes. (0)

17. The system of claim 13, wherein the program code, when executed, maintains state information for the attribute attestation of each attribute of the plurality of attributes. (4) (0)

18. The system of claim 17, wherein the program code, when executed, maintains an attribute attestation of the plurality of attribute attestations in a state selected from a group consisting of: PENDING, VERIFIED, EXPIRED, and INVALID. (0)

19. The system of claim 17, wherein the program code, when executed, causes the attribute attestation of the plurality of attribute attestations to transition from the PENDING state to the VERIFIED state only in response to a notification from the entity responsible for verifying the badge that a corresponding attribute value has been verified by the trusted entity responsible for verifying the badge. (0)

20. The system of claim 17, wherein the program code, when executed, causes the attribute attestation of the plurality of attribute attestations to transition from the VERIFIED state to the EXPIRED state upon expiration of a timer that was set when a corresponding attribute value was last verified. (0)

21. The system of claim 17, wherein the program code, when executed, allows access to a cryptographic proof in the attribute attestation only if the attribute attestation is in the VERIFIED state. (0)

22. A system comprising: (1) (2)

at least one processor;

at least one non-transitory computer-readable medium having stored thereon instructions which, when executed, cause the at least one processor to: receive, via a distributed ledger system, a request to verify a first badge, the first badge comprising a plurality of attribute attestations corresponding respectively to a plurality of attributes for a user, wherein for each attribute of the plurality of attributes, the corresponding attribute attestation comprises a cryptographic proof;

receive, via a channel outside the distributed ledger system, a plurality of values comprising, for each attribute of the plurality of attributes, a value corresponding to that attribute; and

for at least one attribute of the plurality of attributes: identify, from the first badge, a first attribute attestation corresponding to the at least one attribute, the first attribute attestation comprising a first cryptographic proof;

identify, from the first attribute attestation, a pointer to a second badge;

use the pointer to access the second badge from the distributed ledger;

identify, from the second badge, an entity that is responsible for verifying the second badge, and a second attribute attestation corresponding to the at least one attribute;

determine whether to trust the entity responsible for verifying the second badge; and

in response to determining that the entity responsible for verifying the second badge is to be trusted, check whether: (1) the second attribute attestation is in a VERIFIED state;

(2) the second cryptographic proof is a valid proof of the received value corresponding to the at least one attribute; and

(3) the second attribute attestation is electronically signed by the entity responsible for verifying the second badge.

23. The system of claim 22, wherein the at least one processor is further programmed to check whether: (1) (1)

(4) the first cryptographic proof is a valid proof of the received value corresponding to the at least one attribute.

24. The system of claim 23, wherein the at least one processor is further programmed to, in response to determining that (1)-(4) are satisfied: (0) (2)

View Abstract and Specification Size

PDF with Images and Document Face >

Full Text Publication >

Patent US9667427

Systems and methods for managing digital identities

Patent Matrix® Search