Secure sharing of stored personal information using data encryption and biometric authentication

Abstract

Systems and methods for securely sharing stored personal information using data encryption and biometric authentication techniques are disclosed. In some examples, unique items of personal information of an individual may be obtained and placed in data packets. The data packets may be encrypted and may also be encoded with the identity of the individual. A chain of the encrypted data packets may be created and stored in a data repository. A request from an authorized entity for specific personal information of the individual can be received by the system, and may include consent to the request by the individual, and a private key that may be encoded with the identity of the individual. The system can validate the request, and can thereafter decrypt the encrypted data packet containing the requested personal information using the private key and provide the requested personal information to the entity.

Description

PATENT Attorney Docket No.096923-1405749 Client Ref. No. EFX-173WO SECURE SHARING OF STORED PERSONAL INFORMATION USING DATA ENCRYPTION AND BIOMETRIC AUTHENTICATION Technical Field

[0001] The present disclosure relates generally to personal information security techniques, and more particularly, although not exclusively, to securely sharing personal information stored in a data repository using a combination of data encryption and biometric authentication techniques. Background

[0002] Personal information may be virtually any piece of information that can be used to identify an individual. For example, personal information may include, but is certainly not limited to, the name, address, telephone number, or social security number of an individual. Personal information may also be historical information, such as a work history. Access to personal information can be helpful, or even required, in various settings. For example, personal information may be used by employers to identify an applicant during a hiring process, or to verify past employment history, etc. In other settings, personal information may also be useful or required in order to initiate or complete certain financial transactions or in the course of various business dealings.

[0003] While access to personal information may be beneficial in many circumstances, it may be desirable for personal information to be protected against unintended viewing or dissemination. Additionally, when personal information is used to verify the identity of an individual, or some activity, history, etc., associated with an individual, the individual receiving and relying on the personal information should be able to rely on the authenticity of the personal information. Such requirements are a deterrent to storing personal information in manner that is accessible by third parties. Individuals are thus commonly required to repeat the process of providing personal information on a case-by- case basis, which can be time consuming and may increase the likelihood of errors in the information supplied.Attorney Docket No.096923-1405749 Summary

[0004] Various aspects of the present disclosure provide systems and methods for securely sharing personal information stored in a data repository by using a combination of data encryption and biometric authentication techniques. According to one example, a system can include a processor and a memory, such as a non-transitory computer-readable medium, which includes instructions that are executable by the processor to cause the processor to perform various operations. According to aspects of the present disclosure, the operations can include obtaining unique items of validated personal information of an individual whose identity has been verified using biometric data, and creating, for each unique item of personal information, a data packet containing an asset comprising at least the unique item of personal information. The operations may also include encrypting each data packet with a public key-private key pair, and encoding each data packet with the identity of the individual. The operations may also include, creating a chain of the encrypted data packets, and storing the chain of the encrypted data packets in a data repository. The operations may additionally include receiving, from an entity, a request for a specific asset contained in one of the encrypted data packets, the request including consent of the individual to receipt of personal information of the individual by the entity, and a private key that is usable to decrypt the encrypted data packet containing the specific asset and is generated as a result of biometric identity authentication of the individual. The operations may further include validating the request and, upon successfully validating the request, decrypting the encrypted data packet containing the specific asset using the private key and providing the specific asset to the entity.

[0005] According to another example of the present disclosure, a non- transitory computer readable medium may contain instructions that are executable by a processor to cause the processor to perform operations. According to aspects of the present disclosure, the operations can include obtaining unique items of validated personal information of an individual whose identity has been verified using biometric data, and creating, for each unique item of personal information, a data packet containing an asset comprising at least the unique item of personal information. The operations may also includeAttorney Docket No.096923-1405749 encrypting each data packet with a public key-private key pair, and encoding each data packet with the identity of the individual. The operations may also include, creating a chain of the encrypted data packets, and storing the chain of the encrypted data packets in a data repository. The operations may additionally include receiving, from an entity, a request for a specific asset contained in one of the encrypted data packets, the request including consent of the individual to receipt of personal information of the individual by the entity, and a private key that is usable to decrypt the encrypted data packet containing the specific asset and is generated as a result of biometric identity authentication of the individual. The operations may further include validating the request and, upon successfully validating the request, decrypting the encrypted data packet containing the specific asset using the private key and providing the specific asset to the entity.

[0006] According to an additional example of the present disclosure, a method of securely sharing personal information stored in a data repository. The method may include obtaining, by a processor, unique items of validated personal information of an individual whose identity has been verified using biometric data, and creating, by the processor, for each unique item of personal information, a data packet containing an asset comprising at least the unique item of personal information. The operations may also include encrypting, by the processor, each data packet with a public key-private key pair, and encoding each data packet with the identity of the individual. The operations may also include creating, by the processor, a chain of the encrypted data packets, and storing the chain of the encrypted data packets in a data repository. The operations may additionally include receiving, by the processor, from an entity, a request for a specific asset contained in one of the encrypted data packets, the request including consent of the individual to receipt of personal information of the individual by the entity, and a private key that is usable to decrypt the encrypted data packet containing the specific asset and is generated as a result of biometric identity authentication of the individual. The operations may further include validating the request by the processor, and upon successfully validating the request, decrypting, by the processor, the encrypted data packet containing the specific asset using the private key, and providing the specific asset to the entity.Attorney Docket No.096923-1405749

[0007] This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used in isolation to determine the scope of the claimed subject matter. The subject matter should be understood by reference to appropriate portions of the entire specification, any or all drawings, and each claim.

[0008] The foregoing, together with other features and examples, will become more apparent upon referring to the following specification, claims, and accompanying drawings. Brief Description of The Drawings

[0009] FIG.1 is a block diagram depicting an example of a computing system suitable for securely sharing personal information stored in a data repository by using a combination of data encryption and biometric authentication techniques according to some aspects of the present disclosure.

[0010] FIG.2 is a more detailed block diagram of one portion of the computing system of FIG.1.

[0011] FIG. 3 is a block diagram depicting an example of an operating environment in which a system can securely share personal information stored in a data repository by using a combination of data encryption and biometric authentication techniques according to some aspects of the present disclosure.

[0012] FIG. 4 is a flow chart illustrating a method for sharing personal information stored in a data repository by using a combination of data encryption and biometric authentication techniques according to some aspects of the present disclosure.

[0013] FIG.5 is a block diagram depicting an example of a computing device, which can be used to implement the embodiments described herein according to some aspects of the present disclosure. Detailed Description

[0014] Certain aspects and examples of the present disclosure relate to securely sharing personal information stored in a data repository by using a combination of data encryption and biometric authentication techniques. Personal information can be, for example, personal identifiable information (PII),Attorney Docket No.096923-1405749 which is essentially any information via which the identity of an individual can be directly or indirectly determined. For example, PII may be information such as an address or a phone number, a driver's license, passport or social security number, financial account numbers, medical (e.g., patient) identification numbers, or information (e.g., birth date, place of birth, employment or educational information, etc.) that in combination with other information can identify an individual. Alternatively, personal information may be historical information associated with an individual. For example, personal information may be or may include an employment history of an individual.

[0015] System and method examples described herein for securely sharing personal information stored in a data repository can address one or more issues associated with techniques for sharing personal information. For example, disclosed systems and methods can eliminate the need for an individual to repeatedly and manually provide the same or similar personal information to third parties as may be required in the course of an employment hiring process, to initiate or complete certain financial transactions, or in the course of various business dealings. In an employment (hiring) setting, for example, an individual applying for positions at different employers may simply grant an employer temporary, secure access to personal information of the user that is stored in a data repository. Thie is more efficient and less prone to error in comparison to other techniques of submitting the same or similar personal information to each employer by entering the personal information into various paper or electronic forms. The stored personal information can also be easily revised or augmented as needed to correct errors or to reflect changes occurring after the date of initial information submission and storage.

[0016] System and method examples described herein for securely sharing personal information stored in a data repository can also address one or more issues that may be associated with storing personal information in a manner that allows for authorized access by third parties. For example, personal information should be protected in the course of storage or distribution (sharing). Certain system aspects described herein, such as the use of both data encryption and biometric authentication may eliminate or significantly minimize security concerns.Attorney Docket No.096923-1405749

[0017] In some examples, a computing system for securely sharing personal information stored in a data repository can obtain personal information from an Individual who wishes to share their personal information with one or more authorized third parties. In some examples, the personal information can be received as one overall collection of various personal information. In other examples, the personal information may be received as multiple unique items of personal information, such as may be the result of an individual providing different types of information via corresponding different forms or templates. In still other examples, the personal information may be received as one overall collection of various personal information and thereafter separated into multiple unique items of personal information by the system.

[0018] The personal information may be verified personal information – meaning that the personal information has been subjected to a mechanism by which the accuracy, completeness, etc., of the information has been checked and confirmed. In some examples, verification of the personal information may be performed by a third party that is unrelated to the owner of the system or an entity with whom the individual may wish to share their personal information. The identity of the individual may also be verified to ensure that the personal information provided to the system is owned by or otherwise corresponds to the individual. For example, verification of the individual’s identity may be accomplished using biometric identity authentication techniques.

[0019] According to certain aspects, a system may create a data packet for each unique item of personal information within the obtained personal information. Each data packet can contain an asset comprising at least the unique item of personal information. A data packet can also contain one or more sub-packets of information. The information contained in the sub-packets of information may be related to the asset of the data packet. For example, when the asset is verified personal information, a sub-packet may include information that identifies how the personal information was verified, when the personal information was verified, by whom the personal information was verified, etc. The information in the sub-packet may be or may include a pointer to another system or to another entity. The information in the sub-packet may comprise additional assets of the data packet.Attorney Docket No.096923-1405749

[0020] In some examples, the system can encrypt each data packet with a public key-private key pair and may encode each data packet with the identity of the individual. A plurality of the encrypted data packets can be linked to create a chain of encrypted data packets. The chain may, but is not required to, be or simulate a blockchain or a hybrid blockchain. Once the chain of encrypted data packets is created, the chain may be stored in a data repository. The data repository can be a central repository of the system.

[0021] An entity may request the personal information of the individual from the system. The entity may be, for example, an employer seeking to verify or determine certain information about a job applicant, a financial institution that requires particular verified information about an individual in order to initiate or complete a financial transaction, etc. The entity requesting the personal information may have been previously onboarded to the system such that the entity possesses appropriate credentials or is otherwise authorized to request and receive personal information from the system. Further, the entity requesting the personal information may be provided with an application that runs on a user device and includes various information, instructions, etc., that facilitate communications between the entity and the system. In some examples, the application includes or accesses instructions (such as in a library) that enable the application to request the personal information using an application programming interface (API) associated with the system. The requested personal information may be directed to a specific asset contained in one of the encrypted data packets. The request may thus contain the information necessary for the system to locate the correct data packet.

[0022] For security purposes, the entity requesting the personal information may be required to obtain consent of the individual prior to submitting the request for personal information to the system. In some examples, the consent may be requested and obtained using the application running on the device of the entity. The consent may be included among other required information included in the request. The individual may also be required to submit their identity to the system before the system can provide the requested personal information to the entity. For example, the individual may perform a biometric identity authentication operation such as taking and submitting a selfie, using a face identificationAttorney Docket No.096923-1405749 application, or submitting fingerprints, for purposes of authenticating their identity. The biometric authentication operation may be performed at the same time the individual provides their consent. In some examples, identity authentication may serve as the consent.

[0023] The biometric operation used to authenticate the individual’s identity can also generate a private key. The private key can be encoded with the identity of the individual. The private key may be a dynamic private key that is never stored. The private key may be accompanied by corresponding hash information. The private key and the associated hash information can be transmitted to the system with the request for personal information and may be usable to decrypt an encrypted data packet containing requested personal information (a requested specific asset).

[0024] Prior to providing the personal information contained in a data packet to a requesting entity, the system may validate the request. Validating the request may comprise comparing information contained in the request with expected or standardized information, which may be stored in a database. For example, the system may compare one or more of parameters, entities, keys, and hashes contained in the request with stored information. Upon successful validation of the request, the system may unlock (decrypt) the data packet containing the requested specific asset using the dynamic private key and thereafter provide the specific asset to the entity.

[0025] Thus, disclosed systems and methods can be used to securely encrypt and transmit personal information. For example, the individual can provide permissions to particular personal information at a granular level once the individual is authenticated with biometric information. This provides improved security, as well as enables customization of what information an entity is provided.

[0026] These illustrative examples are given to introduce the reader to the general subject matter discussed here and are not intended to limit the scope of the disclosed concepts. The following sections describe various additional features and examples with reference to the drawings in which like numerals indicate like elements, and directional descriptions are used to describe theAttorney Docket No.096923-1405749 illustrative examples but, like the illustrative examples, should not be used to limit the present disclosure.

[0027] Referring now to the drawings, FIG.1 is a block diagram depicting an example of a computing system 100 that may operate to securely share personal information with an entity 102 using data encryption and biometric authentication techniques. The computing system 100 can be a specialized computing system that may be used for processing large amounts of data using a large number of computer processing cycles. In other examples, the computing system 100 may be or include a general-purpose computing system. The computing system may also comprise one or more physical or virtual servers of a cloud services provider.

[0028] The computing system 100 may obtain personal information from an Individual who wishes to share their personal information with one or more authorized third parties. For example, the computing system 100 may allow individuals to upload personal information to the computing system 100. The manner in which the personal information is uploaded and the format in which the personal information is uploaded may depend, at least in part, on the nature of the personal information and the intended use of the personal information. For example, when the personal information is intended to be shared in the context of the individual applying for employment or being onboarded to a new employer, the personal information may be uploaded via various templates or forms. Each template / form may dictate the format and the content of the personal information to be submitted using the template / form.

[0029] The personal information may be verified personal information. The identity of the individual submitting the personal information may also be verified to ensure that the provided personal information is owned by or otherwise corresponds to the individual. Biometric identity authentication techniques or other identity verification techniques may be used for this purpose.

[0030] As represented in FIG. 1, the system 100 may create a data packet 104 for each unique item of personal information within the obtained personal information. A unique item of personal information of a given data packet 104 can be considered an asset, or at least a part of an asset, of the data packet 104. A data packet 104 can also comprise one or more sub-packets 106 containingAttorney Docket No.096923-1405749 additional information. The information contained in the sub-packets 106 may be related to the asset of the data packet 104. For example, when the asset of a data packet 104 is verified personal information, a sub-packet 106 of the data packet 104 may include information related to verification of the personal information. The information in the sub-packet 106 may be or may include a pointer to another system or another entity that was involved in verifying the personal information. When another system or another entity is associated with a sub-packet 106, information related to the data packet 104 or the sub-packet 106 may reside at the other system or entity. The information in the sub-packet may comprise additional assets of the data packet.

[0031] The system 100 may include a data encryption layer 108. The data encryption layer 108 may be usable to create encrypted data packets 112. For example, each data packet 104 may be encrypted using a public key-private key pair. In an example, the public key-private key pair may be generated using a key generator 110 that is a part of or associated with the data encryption layer 108. Each data packet 104 can also be encoded with the identity of the individual, such that authentication of the identity of the individual will later be required in order to unlock the encrypted data packet 112.

[0032] Once the data packets 104 have been encrypted, the data encryption layer 108 can link multiple encrypted data packets 112 to create a chain 114 of the encrypted data packets 112. In some examples, the chain may be created using a blockchain or hybrid blockchain procedure. Once the chain 114 of the encrypted data packets 114 is created, it may be stored in a data repository. The data repository may be a storage location within the system 100, a database communicatively coupled to the system 100, etc. In some examples, the data repository may be a central repository of the system 100, such that all personal information of one or more individuals can be stored at a single location.

[0033] As further shown in FIG. 1, the computing system 100 may also include an application programming interface (API) 116 a request validation layer 118, and a security component 120, each of which is described in more detail below relative to securely sharing personal information between the system 100 and the entity 102.Attorney Docket No.096923-1405749

[0034] The entity 102 may be provided with an entity device 122 for communicating requests for personal information to the system 100 and for receiving personal information from the system 100. The entity device 122 may include an application(s) 124 that runs on the entity device 122 to enable communications with, and the receipt of personal information from, the system 100. The entity 102 may have also been previously onboarded to the system 100, such that the entity 102 possesses appropriate credentials or is otherwise authorized to request and receive personal information from the system 100. Various information, instructions, etc., may be made available to the application 124 to enable the above-described functionality of the entity device 122. In some examples, the information / instructions may be stored in a library 126 that is resident on the entity device 122 or is otherwise accessible thereto.

[0035] The instructions can enable the application 124 to request personal information from the system 100. The requested personal information may be directed to a specific asset contained in one of the encrypted data packets 112 or to multiple assets in multiple encrypted data packets 112. A request communication can contain information of sufficient detail to allow the system 100 to locate the appropriate encrypted data packet(s) 112 and, subsequently, the requested asset(s). For example, a request communication from the entity 102 may include a fine-grained data packet containing detailed information that can allow the system 100 to locate very specific personal information of an individual, such as information that is a subset of the personal information included in an asset, information that may be located in a sub-packet 106 of a data packet 104, or information that may reside with a third party. The detailed information may also be usable to validate that the credentials / permissions of the entity are sufficient to allow the entity to receive a particular asset requested.

[0036] In some examples, the specific asset may contain a plurality of personal information of the individual and the request can indicate a format for the specific asset. The format may be dictated by a particular form for which the personal information in the specific asset is needed. For example, the personal information contained in the specific asset may be usable to verify the identity and employment authorization of a candidate being considered for employment by the entity, and the format for the personal information may be dictated by aAttorney Docket No.096923-1405749 U.S. Form I-9. In such an example, the system 100 may populate the form (e.g., the Form I-9) with the plurality of personal information of the individual contained in the specific asset and can then provide the populated form to the entity.

[0037] In some examples, an asset can be requested from the system 100 using the API 116. For example, as illustrated in FIG.1, the instructions in the library 126 that is stored on or otherwise accessible by the application 124 of the entity device 122, can enable the application 124 to communicate with the API 116. The API 116 can be configured such that the API understands the encryption mechanism used by the system 100 to create the encrypted data packets 112. As such, the API 116 may serve as an effective interface between the entity 102 and the system 100.

[0038] In some examples of the system 100, the aforementioned request validation layer 118 may be interposed between the API 116 and the chain 112 of encrypted data packets, and may be used to ensure that the request for personal information received by the API 116 from the entity 102 is a valid request. The request validation layer 118 may, for example, validate the request by comparing information contained in the request with stored information. For example, the validation layer 118 may validate the request by confirming that one or more parameters, entities, keys, hashes, or combinations thereof that are contained in information transmitted with the request correspond with parameters, entities, keys, and hashes expected by the system 100. Such a validation operation can serve to, for example, authenticate the entity 102 and ensure that the entity 102 is authorized to receive personal information from the system 100.

[0039] Personal information may be assigned a security class (e.g., Class 1, Class 2, etc.) based on the sensitivity of the personal information. The more sensitive the personal information, the higher the security class typically assigned thereto. When security classes are assigned to personal information of the data packet 104 assets, it may be possible in some cases that the entity 102 is not authorized to receive a particular asset even though the entity 102 is in general authorized to receive personal information from the system 100. In this regard, the aforementioned security component 120 may be interposed between the request validation layer 118 and the chain 112 of encrypted data packets.Attorney Docket No.096923-1405749 The security component 120 can be used to validate that the entity 102 is authorized to receive a specific asset given a security class assigned to the asset and an authorized security level (e.g., Level 1, Level 2, etc.) assigned to the entity 102. For example, the request communication sent by the entity 102 to the system 100 may identify the authorized security level assigned to the entity 102 by the system 100. Alternatively, the system 100 may use other entity-identifying information to ascertain the authorized security level assigned to the entity by consulting a lookup table or another information source. In any case, the security component 120 of the system 100 is usable to compare an assigned security class of a requested asset to the authorized security level of the entity 102. The system 100 may determine that the entity 102 is authorized to receive a requested asset when the authorized security level of the entity 102 is found by the security component 120 to be equal to or greater than the assigned security class of the requested asset. Otherwise, the system 100 may deny the request.

[0040] Communications between the entity (e.g., entity device 122) and the system 100 (e.g., API 116) may occur over a network 128. Various types of networks may serve as the network 128 depending on the nature of the network and the identity and location of the entity 102. For example, the network 128 may be a public data network, a private data network, or some combination thereof. A data network may include one or more of a variety of network types, including a wireless network, a wired network, or a combination of a wired and wireless network. Examples of suitable networks include, without limitation, the Internet, a personal area network, a local area network (“LAN”), a wide area network (“WAN”), or a wireless local area network (“WLAN”). A wireless network may include a wireless interface or a combination of wireless interfaces. A wired network may include a wired interface. The wired or wireless networks may be implemented using routers, access points, bridges, gateways, or the like, to connect devices or components in the data network. In the example illustrated in FIG.1, the network 128 is the Internet.

[0041] The specific components depicted in FIG.1 are provided for illustrative purposes only. Different numbers and types of components may be used in other examples. Therefore, while certain components and subcomponents are shown as single components or subcomponents in FIG. 1, multiple components orAttorney Docket No.096923-1405749 subcomponents may be used instead. Similarly, it may be possible for components or subcomponents that are shown to be separate to instead be implemented in a signal component or subcomponent in other examples.

[0042] FIG. 2 is a more detailed block diagram of one portion 200 of the computing system 100 of FIG.1. As shown, the system 100 includes an overall framework 202. An encryption framework 204 may reside within the overall framework 202 and may include the data encryption layer 108 shown in FIG.1. The chain 114 of encrypted data packets 112 shown in FIG. 1 and described above may also be encompassed by the encryption framework 204.

[0043] A format specification portion 206 of the framework 202 may be configured to manage incoming requests for personal information that have been previously validated by the request validation layer 118 of the system 100. The format specification portion 206 of the framework 202 may perform a handshake operation with a device, such as the entity device 122 of the system 100 of FIG. 1. The format specification portion 206 of the framework 202 can be configured to receive and process fine-grained data packets of information included in requests for personal information.

[0044] A biometric specification portion 208 of the framework 202 may be responsible for checking the identity of an individual whose personal information has been requested. For example, the biometric specification portion 208 of the framework 202 may receive and verify biometric identity authentication information associated with an individual and encoded in a private key or otherwise included in a request for personal information sent to the system 100.

[0045] FIG. 3 is a block diagram depicting one example of a computing environment 300 that is suitable for securely sharing personal information stored in a data repository using the computing system 100 of FIG.1. As illustrated, the entity 102 transmits a request for personal information to the system 100 via the API 116. As described relative to FIG.1, the requested personal information may be an asset or a portion of an asset of an encrypted data packet 104. The requested asset may reside in a sub-packet 106 of an encrypted data packet 104.

[0046] As also shown in FIG.2, prior to communication with the API 116, the entity 102, such as through the entity device 122 and associated installedAttorney Docket No.096923-1405749 application 124 shown in FIG.1, can obtain consent 130 of the individual whose personal information will be requested. The consent 130 of the individual can be provided in various forms. For example, consent may be as simple an affirmative email or text response to a query of like type sent to the individual by the entity 102. The consent 130 of the individual may alternatively be captured by the application 124 of the entity device 122 as a result of query to the individual sent from the entity device 122. In some examples, the consent 130 of the individual may be or may include biometric data. For example, the individual may be required to utilize facial recognition, fingerprint identification, or another biometric identity identification technique when responding to a request for consent from the entity 102. In some examples, use of a biometric identity verification technique can generate the consent 130 of the individual, as well as a verification of the identity of the individual. The consent 130 may be included among other information included in the request communication from the entity 102 to the system 100. In some examples, the consent 130 of the individual may be accompanied by a consent specification that is readable by the API 116 and may identify the consent of the individual as a temporary or one-time permission that is not permitted to be stored. In this manner, it can be ensured that the consent 130 of the individual provided relative to a given request by a given entity is unusable relative to a subsequent request by the given entity (or another entity) for the same specific asset or a different asset of the individual.

[0047] If not done in relation to or at the same time as providing consent 130, the individual may otherwise be required to authenticate and submit their identity to the system 100 before the system can provide the requested personal information to the entity 102. For example, the individual may undertake a biometric identity authentication operation such as taking and submitting a selfie, using a face identification application, or submitting to fingerprint identification. The biometric identity authentication operation may be performed at the same time the individual provides their consent, and may be a same biometric operation that generates the individual’s consent.

[0048] The biometric identity authentication operation can also generate a private key in which the authenticated identity of the individual is encoded. The private key may be a dynamic private key that is never stored. The private keyAttorney Docket No.096923-1405749 may be accompanied by corresponding hash information. The private key and the associated hash information can be transmitted to the system 100 with the request for personal information. The private key may be usable to decrypt an encrypted data packet 104 containing the personal information (asset) requested by the entity 102. In some examples, where an encrypted data packet 112 includes one or more sub-packets of additional data, hash information representing the additional data may be appendable to the private key with which the encrypted data packet 112 is encrypted such that decrypting the encrypted data packet 112 also decrypts the one or more sub-packets.

[0049] With the consent 130 of the individual and the private key procured, the entity 102 may proceed to transmit the request for personal information to the system 100 using the API 116. Prior to providing the requested personal information to the entity 102, the API 116 may interact with the request validation layer 118 and the security component 120. For example, the API 116 may initiate or otherwise cause the request validation layer 118 and the security component 120 to perform the respective functions described above. Assuming the request for personal information is validated by the request validation layer 118 and the entity 102 is determined by the security component 120 to possess the security level necessary to receive the requested personal information, the API 116 may also interact with the data encryption layer 108. For example, the API 116 may cause the encrypted data packet 112 containing the requested personal information to be located and may thereafter cause the encrypted data packet 112 to be decrypted and unlocked using the private key and the authenticated identity of the individual. The requested personal information may thereafter be extracted from the decrypted data packet and provided to the entity 102 via the API 116.

[0050] One example of a method 400 for securely sharing personal information stored in a data repository by using a combination of data encryption and biometric authentication techniques is illustrated as a flow chart in FIG. 5. The example method can include, as depicted at block 402, obtaining a plurality of unique items of personal information of an individual whose identity has been verified using biometric data. The personal information can be, for example, virtually any information through which the identity of an individual can be directlyAttorney Docket No.096923-1405749 or indirectly determined. The personal information may also be historical information associated with an individual, such as an employment history of an individual. The personal information may be verified personal information. In one example, the personal information may be received from the individual in the form of a number of unique items of personal information. In another example, the personal information may be received from the individual in the form of a single large dataset, which can thereafter be separated into multiple unique items of personal information.

[0051] At block 404, a data packet may be created for each unique item of personal information. Each data packet can contain an asset comprising at least the unique item of personal information. A data packet can also contain one or more sub-packets of information. The information contained in the sub-packets of information may be related to the asset of the data packet. For example, when the asset is verified personal information, a sub-packet may include information that identifies how the personal information was verified, when the personal information was verified, by whom the personal information was verified, etc. The information in the sub-packet may be or may include a pointer to another system or to another entity. The information in the sub-packet may comprise additional assets of the data packet.

[0052] At block 406, each data packet can be encrypted. For example, each data packet may be encrypted with a public key-private key pair. An encrypted data packet can also be encoded with the identity of the individual, such that authenticated biometric identity data of the individual is required to unlock the encrypted data packet.

[0053] At block 408, a chain of the encrypted data packets can be created. The chain may include all the encrypted data packets or only some of the encrypted data packets. The chain may be, but is not required to be, created using blockchain or hybrid blockchain techniques.

[0054] According to block 410, the chain of the encrypted data packets can be stored in a data repository. The data repository may be, for example, a storage location within a computing system used to securely share the personal information, or a database communicatively coupled to the system. In some examples, the data repository may be a central repository of the system, suchAttorney Docket No.096923-1405749 that all personal information of one or more individuals can be stored at a single location.

[0055] At block 412, the method can further include receiving, from an entity, a request for a specific asset contained in one of the encrypted data packets. The entity may have also been previously onboarded to the system, such that the entity possesses appropriate credentials or is otherwise authorized to request and receive personal information from the system. In some examples, the request may be transmitted from an application that runs on an entity device and enables communications with, and the receipt of personal information from, a computing system used to securely share the personal information. In some examples, the application of the entity device can communicate with the system via an API, which may be configured to understand the encryption mechanism used by the system to create the encrypted data packets.

[0056] The request can include the consent of the individual to the receipt of personal information of the individual by the entity. The entity may obtain consent of the individual through the application on the entity device, or otherwise. The consent of the individual can be provided in various forms. For example, the consent of the individual may be or may include biometric data. In such a case, the use of a biometric identification technique can generate the consent of the individual, as well as a verification of the identity of the individual.

[0057] The request can also include a private key, which may be encoded with the authenticated identity of the individual. The private key may be accompanied by corresponding hash information. The private key may be a dynamic private key that is never stored. The private key may be usable to decrypt an encrypted data packet that is encoded with the identity of the individual and contains an asset requested by the entity. The biometric identity authentication operation may be performed by the individual at the time of or as a part of providing consent. In some examples, the biometric identity authentication may serve as consent. The nature of the biometric identity authentication operation can vary. For example, the individual may biometrically authenticate their identity by submitting a selfie, using a face identification application, or submitting a fingerprint.Attorney Docket No.096923-1405749

[0058] As indicated at block 414, the method can further include validating the request. Validating the request may comprise comparing information contained in the request with expected or standardized information, which may be stored in a database. For example, the system may compare one or more of parameters, entities, keys, and hashes contained in the request with stored information.

[0059] At block 416, upon successfully validating the request, the encrypted data packet containing a requested specific asset may be decrypted using the private key. The asset can thereafter be provided to the entity. In one example, providing the asset to the entity may comprise transmitting personal information of the individual to the entity. In another example, providing the asset to the entity may comprise allowing the entity to view but not download or otherwise store the personal information of the individual. In another example, providing the asset to the entity may comprise only confirming that given personal information of the individual already in possession of the entity is accurate (i.e., verifying personal information. For example, a yes or no response may be transmitted to the entity in reply to a requested verification of a specified mailing address of the individual.

[0060] FIG.5 is a block diagram depicting an example of a computing device 500, which can be used to implement the embodiments described herein according to some aspects of the present disclosure. As shown, the computing device 500 can include various devices for communicating with other devices in the operating environment 200, as described with respect to FIG.2. According to this example, the computing device 500 can include a processor 502 that is communicatively coupled to a memory 504. For example, the processor 502 may be communicatively coupled to the memory 504 by a bus 506. The processor 502 can execute computer-executable program code stored in the memory 504, can access information stored in the memory 504, or both. The memory 504 can store program code in the form of instructions that, when executed by the processor 502, causes the processor 502 to perform the operations described herein. Program code may include machine-executable instructions that may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment may beAttorney Docket No.096923-1405749 coupled to another code segment or a hardware circuit by passing or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc., may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, among others.

[0061] Examples of a processor 502 can include a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or any other suitable processing device. The processor 502 can include any suitable number of processing devices, including one. In addition to communicating with the memory 504, the processor 502 can include a memory.

[0062] The memory 504 can include any suitable non-transitory computer- readable medium. The computer-readable medium can include any electronic, optical, magnetic, or other storage device capable of providing a processor with computer-readable program code or other program code. Non-limiting examples of a computer-readable medium can include a magnetic disk, memory chip, optical storage, flash memory, storage class memory, ROM, RAM, an ASIC, magnetic storage, or any other medium from which a computer processor can read and execute program code. The program code may include processor- specific program code generated by a compiler or an interpreter from code written in any suitable computer-programming language. Examples of suitable programming language can include Hadoop, C, C++, C#, Visual Basic, Java, Python, Perl, JavaScript, ActionScript, etc.

[0063] The computing device 500 may also include a number of external or internal devices such as input or output devices. For example, the computing device 500 is illustrated with an input / output interface 508 that can receive input from input devices or provide output to output devices. As shown, the input / output interface 508 may be communicatively coupled to the bus 506.

[0064] In some aspects, the computing device 500 can include one or more output devices. One example of an output device can be or can include a network interface device 510. The network interface device 510 can include any device or group of devices suitable for establishing a wired or wireless data connection to one or more data networks described herein. Non-limiting examples of theAttorney Docket No.096923-1405749 network interface device 510 can include an Ethernet network adapter, a modem, etc.

[0065] Another example of an output device can include a presentation device 512. The presentation device 512 can include any device or group of devices suitable for providing visual, auditory, or other suitable sensory output. Non- limiting examples of the presentation device 512 can include a touchscreen, a monitor, a speaker, a separate mobile computing device, etc. In some aspects, the presentation device 512 can include a remote client-computing device that communicates with the computing device 500 using one or more data networks described herein. In other aspects, the presentation device 512 can be omitted.

[0066] The computing device 500 can execute program code 514 that can cause the processor 502 to securely share stored personal information of an individual with a requesting entity in any manner described above. The program code 514 may be resident in any suitable computer-readable medium and may be executed on any suitable processing device. For example, and as illustrated in FIG.5, the program code 514 for securely sharing stored personal information of an individual with a requesting entity can reside in the memory 504 of the computing device 500 along with program data 516 associated with the program code 514. Executing the program code 514 can configure the processor 502 to perform at least a portion of the operations described herein.

[0067] The foregoing description of certain examples, including illustrated examples, has been presented only for purposes of illustration and description and is not intended to be exhaustive or to limit the disclosure to the precise forms disclosed. Numerous modifications, adaptations, and uses thereof will be apparent to those skilled in the art without departing from the scope of the disclosure.

Claims

Attorney Docket No.096923-1405749 What Is Claimed Is:

1. A system comprising: a processor; and a non-transitory computer-readable medium comprising instructions that are executable by the processor for causing the processor to perform operations comprising: obtaining a plurality of unique items of personal information of an individual whose identity has been verified using biometric data; creating, for each unique item of personal information, a data packet containing an asset comprising at least the unique item of personal information; encrypting each data packet with a public key-private key pair, and encoding each encrypted data packet with the identity of the individual; creating and storing a chain of the encrypted data packets in a data repository; receiving, from an entity, a request for a specific asset contained in one of the encrypted data packets, the request including consent of the individual to receipt of personal information of the individual by the entity, and a private key that is usable to decrypt the encrypted data packet containing the specific asset and is generated as a result of biometric identity authentication of the individual; validating the request; and upon successfully validating the request, decrypting the encrypted data packet containing the specific asset using the private key and providing the specific asset to the entity.

2. The system of claim 1, wherein the operations further comprise requesting, using an application executed by the processor, the specific asset using an application programming interface (API) associated with the system.Attorney Docket No.096923-1405749 3. The system of claim 2, wherein: a security component is interposed between the API and the data repository; and the security component validates the entity as being authorized to receive the specific asset by comparing a class level assigned to the specific asset with an authorized security level of the entity.

4. The system of claim 2, wherein each data packet includes an associated consent specification, the consent specification readable by the API and identifying the consent of the individual as a temporary or one-time permission that is not permitted to be stored, such that the consent of the individual is unusable relative to a subsequent request by the entity for the same specific asset or a different asset of the individual.

5. The system of claim 1, wherein validating the request includes comparing information contained in the request with stored information, the information contained in the request selected from the group consisting of parameters, entities, keys, hashes, and combinations thereof.

6. The system of claim 1, wherein: the specific asset contains a plurality of personal information of the individual; the request indicates a format for the specific asset; and providing the specific asset to the entity comprises populating a form dictated by the format with the plurality of personal information of the individual and providing the populated form to the entity.

7. The system of claim 1, wherein an encrypted data packet includes one or more sub-packets that contain additional information related to the asset in the encrypted data packet, and a hash key representing the additional information is appendable to the private key with which the encrypted data packet is encrypted such that decrypting the encrypted data packet also decrypts the one or more sub-packets.Attorney Docket No.096923-1405749 8. A non-transitory computer-readable medium comprising instructions that are executable by a processor for causing the processor to perform operations comprising: obtaining a plurality of unique items of personal information of an individual whose identity has been verified using biometric data; creating, for each unique item of personal information, a data packet containing an asset comprising at least the unique item of personal information; encrypting each data packet with a public key-private key pair, and encoding each encrypted data packet with the identity of the individual; creating and storing a chain of the encrypted data packets in a data repository; receiving, from an entity, a request for a specific asset contained in one of the encrypted data packets, the request including consent of the individual to receipt of personal information of the individual by the entity, and a private key that is usable to decrypt the encrypted data packet containing the specific asset and is generated as a result of biometric identity authentication of the individual; validating the request; and upon successfully validating the request, decrypting the encrypted data packet containing the specific asset using the private key and providing the specific asset to the entity.

9. The non-transitory computer-readable medium of claim 8, wherein the instructions are executable by the processor for causing the processor to perform further operations comprising: communicating, via an application programming interface (API), with an application running on a device of the entity; and wherein the application has access to instructions that enable the application to request the given asset using the API.

10. The non-transitory computer-readable medium of claim 9, wherein: a security component is interposed between the API and the data repository; andAttorney Docket No.096923-1405749 the security component is usable to validate the entity as being authorized to receive the specific asset by comparing a class level assigned to the specific asset with an authorized security level of the entity.

11. The non-transitory computer-readable medium of claim 9, wherein each data packet includes an associated consent specification, the consent specification readable by the API and identifying the consent of the individual as a temporary or one time permission that is not permitted to be stored, such that the consent of the individual is unusable relative to a subsequent request by the entity for the same specific asset or a different asset of the individual.

12. The non-transitory computer-readable medium of claim 8, wherein validating the request includes comparing information contained in the request with stored information, the information contained in the request selected from the group consisting of parameters, entities, keys, hashes, and combinations thereof.

13. The non-transitory computer-readable medium of claim 8, wherein: the specific asset contains a plurality of personal information of the individual; the request indicates a format for the specific asset; and providing the specific asset to the entity comprises populating a form dictated by the format with the plurality of personal information of the individual and providing the populated form to the entity.

14. The non-transitory computer-readable medium of claim 8, wherein an encrypted data packet includes one or more sub-packets that contain additional information related to the asset in the encrypted data packet, and a hash key representing the additional information is appendable to the private key with which the encrypted data packet is encrypted such that decrypting the encrypted data packet also decrypts the one or more sub-packets.Attorney Docket No.096923-1405749 15. A method comprising: obtaining, by a processor, a plurality of unique items of personal information of an individual whose identity has been verified using biometric data; creating, by the processor, for each unique item of personal information, a data packet containing an asset comprising at least the unique item of personal information; encrypting, by the processor, each data packet with a public key-private key pair, and encoding each encrypted data packet with the identity of the individual; creating and storing, by the processor, a chain of the encrypted data packets a data repository; receiving, by the processor, from an entity, a request for a specific asset contained in one of the encrypted data packets, the request including consent of the individual to receipt of personal information of the individual by the entity, and a private key that is usable to decrypt the encrypted data packet containing the specific asset and is generated as a result of biometric identity authentication of the individual; validating the request by the processor; and upon successfully validating the request, decrypting, by the processor, the encrypted data packet containing the specific asset using the private key, and providing the specific asset to the entity.

16. The method of claim 16, wherein: a security component is interposed between the API and the data repository; and the security component validates the entity as being authorized to receive the specific asset by comparing a class level assigned to the specific asset with an authorized security level of the entity.

17. The method of claim 16, wherein each data packet includes an associated consent specification, and the API identifies the consent of the individual as a temporary or one time permission that is not permitted to be stored by reading the consent specification, such that the consent of the individual is unusableAttorney Docket No.096923-1405749 relative to a subsequent request by the entity for the same specific asset or a different asset of the individual.

18. The method of claim 15, wherein the request is validated by comparing information contained in the request with stored information, the information contained in the request selected from the group consisting of parameters, entities, keys, hashes, and combinations thereof.

19. The method of claim 15, wherein: the specific asset contains a plurality of personal information of the individual; the request indicates a format for the specific asset; and providing the specific asset to the entity comprises populating a form dictated by the format with the plurality of personal information of the individual and providing the populated form to the entity.

20. The method of claim 15, wherein an encrypted data packet includes one or more sub-packets that contain additional information related to the asset in the encrypted data packet, and a hash key representing the additional information is appended to the private key with which the encrypted data packet is encrypted, whereby the one or more sub-packets are also decrypted when the encrypted data packet is decrypted.

Images