Cryptographically secure record creation method

Abstract

A method is disclosed. The method includes receiving, from a user device operated by a user, a message including a payload comprising user data and a digital signature associated with a virtual identity card. The method also includes transmitting to a processing network computer, a verification request message comprising the digital signature, and receiving a verification response message comprising an indication that the digital signature is validated. The method further comprises, responsive to the indication that the digital signature is valid, creating a record using the user data.

Description

CRYPTOGRAPHICALLY SECURE RECORD CREATION METHODCROSS-REFERENCES TO RELATED APPLICATIONS

[0001] This application is a PCT application, which claims priority to U.S. Provisional Patent Application No. 63 / 676,761, filed on July 29, 2024, which is herein incorporated by reference in its entirety.BACKGROUND

[0002] Entities such as service providers that create records (e.g., accounts) for users perform many steps to authenticate the users. For example, when creating a record such as a bank account for a user, an employee of the service provider will often ask the user for many physical forms of identification. Such forms of identification can include a driver’s license, a social security card, etc. The employee will then attempt to authenticate the user using the physical forms of identification.

[0003] While conventional record creation processes can be used, they can be improved. For example, such forms of identification can be stolen or reproduced by unauthorized persons. The unauthorized persons can then use them to fraudulently open records. Once such records are opened, the unauthorized persons can use them to conduct unauthorized transactions. Once a legitimate user’s identity is fraudulently used in this manner, it is difficult for the legitimate user to rectify the damage done by the unauthorized transactions.

[0004] Further, such conventional methods require a number of steps. The steps may include manual entry of data from the physical forms of identification into a user interface on an electronic device to verify the user of the physical forms of identification. This is very time consuming.

[0005] These and other problems are addressed by embodiments of the invention, individually and collectively.SUMMARY

[0006] One embodiment of the invention includes a method. The method comprises: receiving, by a server computer from a user device operated by a user, a message comprising a payload comprising user data and a digital signature associated with a virtual identity card; transmitting, by the server computer, to a processing network computer, a verification request message comprising the digital signature; receiving, by the server computer from the processing network computer, a verification response message comprising an indication that the digital signature is validated; and responsive to the indication that the digital signature is valid, creating, by the server computer, a record using the user data.

[0007] Another embodiment of the invention includes a server computer. The server computer comprises: a processor; and a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, executable by the processor to perform a method comprising: receiving, from a user device operated by a user, a message comprising a payload comprising user data and a digital signature associated with a virtual identity card; transmitting to a processing network computer, a verification request message comprising the digital signature; receiving, from the processing network computer, a verification response message comprising an indication that the digital signature is validated; and responsive to the indication that the digital signature is valid, creating a record using the user data.

[0008] Another embodiment of the invention includes a method. The method comprises: receiving, by a processing network computer from a server computer, a registration inquiry message comprising a location code; transmitting, by the processing network computer to the server computer, a registration response message indicating that a location associated with the location code is registered with the processing network computer; receiving, by the processing network computer from the server computer, a verification request message comprising a digital signature; verifying, by the processing network computer, the digital signature with a public key corresponding to a private key stored on a user device operated by a user; and transmitting, by the processing network computer to the server computer, a verification response message comprising an indication that the digitalsignature is validated, wherein the server computer is programmed to create a record in response to receiving the verification response message.

[0009] Another embodiment of the invention includes processing network computer. The processing network computer comprises a processor, and a non- transitory computer readable medium. The non-transitory computer readable medium comprises code, executable by the processor for performing a method. The method comprises: receiving, from a server computer, a registration inquiry message comprising a location code; transmitting, to the server computer, a registration response message indicating that a location associated with the location code is registered with the processing network computer; receiving, from the server computer, a verification request message comprising a digital signature; verifying the digital signature with a public key corresponding to a private key stored on a user device operated by a user; and transmitting, to the server computer, a verification response message comprising an indication that the digital signature is validated, wherein the server computer is programmed to create a record in response to receiving the verification response message.

[0010] A better understanding of the nature and advantages of embodiments of the invention may be gained with reference to the following detailed description and accompanying drawings.BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1 illustrates a system and an overlaid flow diagram for opening an account using a virtual identity card (e.g., mobile driver’s license (mDL) according to embodiments.

[0012] FIG. 2 shows a block diagram of a user device according to an embodiment.

[0013] FIG. 3 shows a block diagram of a processing network according to an embodiment.

[0014] FIG. 4 shows a block diagram of a service provider computer according to an embodiment.DETAILED DESCRIPTION

[0015] Prior to discussing embodiments of the disclosure, some terms can be described in further detail.

[0016] A “key” may include a piece of information that is used in a cryptographic algorithm to transform input data into another representation. A cryptographic algorithm can be an encryption algorithm that transforms original data into an alternate representation, or a decryption algorithm that transforms encrypted information back to the original data. Examples of cryptographic algorithms may include triple data encryption standard (TDES), data encryption standard (DES), advanced encryption standard (AES), etc.

[0017] A “public key” may include a cryptographic key that may be shared openly and publicly. The public key may be designed to be shared and may be configured such that any information encrypted with the public key may only be decrypted using a private key associated with the public key (i.e. , a public / private key pair).

[0018] A “private key” may include any cryptographic key that may be protected and secure. A private key may be securely stored at an entity and may be used to decrypt any information that has been encrypted with an associated public key of a public / private key pair associated with the private key.

[0019] A “public / private key pair” may refer to a pair of linked cryptographic keys generated by an entity. The public key may be used for public functions such as encrypting a message to send to the entity or for verifying a digital signature which was supposedly made by the entity. The private key, on the other hand may be used for private functions such as decrypting a received message or applying a digital signature. In some embodiments, the public key may be authorized by a body known as a certification authority (CA) which stores the public key in a database and distributes it to any other entity which requests it. The private key can typically be kept in a secure storage medium and will usually only be known to the entity. Public and private keys may be in any suitable format, including those based on Rivest- Shamir-Adleman (RSA) or elliptic curve cryptography (ECC).

[0020] A “digital signature” may include any electronic signature for a message. A digital signature may be a numeric data value, an alphanumeric data value, or any other type of data. In some embodiments, a digital signature may be a unique data value generated from a message (or data packet) and a private key using a cryptographic algorithm. In some embodiments, a validation algorithm using a public key may be used to verify the signature. A digital signature may be used to demonstrate the veracity of the authority that issued credentials (e.g., a digital license) associated with the digital signature.

[0021] The term “verification” and its derivatives may refer to a process that utilizes information to determine whether an underlying subject is valid under a given set of circumstances. Verification may include any comparison of information to ensure some data or information is correct, valid, accurate, legitimate, and / or in good standing.

[0022] A "certificate" or "digital certificate" may include an electronic document and / or data file. In some cases, the certificate or the digital certificate may be a device certificate. In some embodiments, a digital certificate may use a digital signature to bind a public key with data associated with an identity. A digital certificate may be used to prove the ownership of a public key. The certificate may include one or more data fields, such as the legal name of the identity, a serial number of the certificate, a valid-from and valid-to date for the certificate, certificate related permissions, etc. A certificate may contain a "valid-from" date indicating the first date the certificate is valid, and a "valid-to" date indicating the last date the certificate is valid. A certificate may also contain a hash of the data in the certificate including the data fields. A certification authority can sign a certificate. For example, a digital certificate may be provided by a certification authority in connection with a digital license provided by an Issuing Authority. The digital certificate may help to authenticate the Issuing Authority.

[0023] A "certification authority" may include an entity that issues digital certificates. A certification authority may prove its identity using a certification authority certificate, which includes the certification authority’s public key. A certification authority certificate may be signed by another certification authority’s private key or may be signed by the same certification authority’s private key. Thelatter is known as a self-signed certificate. The certification authority may maintain a database of all certificates issued by the certification authority. The certification authority may maintain a list of revoked certificates. The certification authority may be operated by an entity, for example, a processing network entity, an issuer, an acquirer, a central bank etc.

[0024] An “Issuing Authority” may include an entity that issues credentials to a user, typically using an issuing entity computer to do so. An issuing entity may be a governmental agency, a medical service provider, a document repository, an access administrator, etc. An issuing entity may also issue credentials in form of a digital license stored on a user device, such as a cellular telephone, smart card, tablet, or laptop to the user.

[0025] A “user” may include an individual or a computational device. In some embodiments, a user may be associated with one or more personal accounts and / or user devices (e.g., mobile devices).

[0026] A “user device” may be a device that is operated by a user. Examples of user devices may include a mobile phone, a smart phone, a card, a personal digital assistant (PDA), a laptop computer, a desktop computer, a server computer, a vehicle such as an automobile, a thin-client device, a tablet PC, etc. Additionally, user devices may be any type of wearable technology device, such as a watch, earpiece, glasses, etc. The user device may include one or more processors capable of processing user input. The user device may also include one or more input sensors for receiving user input. As is known in the art, there are a variety of input sensors capable of detecting user input, such as accelerometers, cameras, microphones, etc. The user input obtained by the input sensors may be from a variety of data input types, including, but not limited to, audio data, visual data, or biometric data. The user device may comprise any electronic device that may be operated by a user, which may also provide remote communication capabilities to a network. Examples of remote communication capabilities include using a mobile phone (wireless) network, wireless data network (e.g., 3G, 4G or similar networks), Wi-Fi, Wi-Max, or any other communication medium that may provide access to a network such as the Internet or a private network.

[0027] A “server computer” is typically a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The server computer may be coupled to a database and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers.

[0028] A “processor” may include any suitable data computation device or devices. A processor may comprise one or more microprocessors working together to accomplish a desired function. The processor may include CPU comprises at least one high-speed data processor adequate to execute program components for executing user and / or system-generated requests. The CPU may be a microprocessor such as AMD’s Athlon, Duron, and / or Opteron; IBM and / or Motorola's PowerPC; IBM's and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon, and / or XScale; and / or the like processor(s).

[0029] A “memory” may be any suitable device or devices that can store electronic data. A suitable memory may comprise a non-transitory computer readable medium that stores instructions that can be executed by a processor to implement a desired method. Examples of memories may comprise one or more memory chips, disk drives, etc. Such memories may operate using any suitable electrical, optical, and / or magnetic mode of operation.

[0030] A “communication channel” can include a medium through which message(s) can be provided. A communication channel can include a physical transmission medium (e.g., a wire, a contact interface, etc.), an over-the-air communication medium (e.g., using electromagnetic signals, etc.), a logical medium (e.g., application programming interfaces (APIs), etc.), and / or a combination thereof.

[0031] A “transaction” may be any interaction or exchange between two or more parties. For example, a transaction may include a first entity requestingresources from a second entity. In this example, the transaction is completed when the resources are either provided to the first entity or the transaction is declined.

[0032] An “interaction” may include a reciprocal action or influence that involves more than one actor. An interaction can include a communication, contact, or exchange between parties, devices, and / or entities. Example interactions include a transaction between two parties and a data exchange between two devices. In some embodiments, an interaction can include a user requesting access to secure data, a secure webpage, a secure location, and the like.

[0033] An “authorizing entity” may be an entity that authorizes a request. Examples of an authorizing entity may be an issuer, a governmental agency, a document repository, an access administrator, etc. An “issuer” may typically refer to a business entity (e.g., a bank) that maintains an account for a user. An issuer may also issue payment credentials stored on a user device, such as a cellular telephone, smart card, tablet, or laptop to the consumer.

[0034] A “service provider application” may be an application developed or maintained by a service provider. The service provider application may provide a front-end interface for the user to access back-end services provided by a service provider computer. A service provider application may be downloaded from a mobile application store and installed on the mobile device.

[0035] A “storage application” can be an application which can store a virtual identity card, and other types of data. An example of a storage application can include a digital wallet or an identification application.

[0036] A “digital wallet” can include an electronic device that allows an individual to conduct electronic commerce transactions. A digital wallet may store user profile information, payment credentials, bank account information, one or more digital wallet identifiers and / or the like and can be used in a variety of transactions, such as but not limited to eCommerce, social networks, money transfer / personal payments, mobile commerce, proximity payments, gaming, and / or the like for retail purchases, digital goods purchases, utility payments, purchasing games or gaming credits from gaming websites, transferring funds between users, and / or the like. A digital wallet may be designed to streamline the purchase and payment process. Adigital wallet may allow the user to load one or more payment cards onto the digital wallet so as to make a payment without having to enter an account number or present a physical card. A digital wallet may be a transfer application.

[0037] A “virtual identity card” can be a collection of identity information about an entity (e.g., a user) that has been verified by certain authorities. A virtual identity card can include user data about the user and a digital certificate which includes information including an expiry date, the user data, an issuance date, and one or more digital signatures. The user data may include a user’s name, birthday, address, and identification card number (e.g., driver’s license number) associated with their virtual identity card. The digital signatures may include data that has been signed by an issuing authority such as a governmental entity, and data that has been signed by global authentication entity such as a payment processing network.

[0038] Embodiments include a method comprising receiving, by a server computer from a user device operated by a user, a message comprising a payload comprising user data and a digital signature associated with a virtual identity card. The user device may be a mobile device such as a mobile phone, which has a storage application which stores a virtual identity card such as a mobile driver’s license (mDL). The user data may include information which can identify the user, and may include, but is not limited to, a name of the user, a home address of the user, a birthdate of the user, a state of issuance, an issuance date, an expiration date, a biometric template and / or image of the user, a virtual identity card identifier, etc.

[0039] The method also comprises transmitting, by the server computer, to a processing network computer, a verification request message comprising the digital signature. The processing network computer can then verify the digital signature and can generate and transmit a verification response message indicating that the digital signature is validated. In some embodiments, the processing network computer could be operated by a governmental agency, or a global identity provider. The global identity provider may also operate a payment processing network in some embodiment. The method may further comprise receiving, by the server computer from the processing network computer, the verification response message comprising an indication that the digital signature is validated.

[0040] Then, responsive to the indication that the digital signature is valid, the server computer can create a record for the user using the user data. In some embodiments, the user data from the virtual identity card may be used to automatically form fill any application forms needed to create the record.

[0041] More specifically, embodiments of the invention include a method for opening a record such as an account using a virtual identity card (e.g., mobile driver’s license (mDL). According to various embodiments, the virtual identity card (e.g., mDL) is already provisioned to the user device 102 by a credential issuer such as the department of motor vehicles (DMV). The virtual identity card may include a digital certificate (e.g., the driver’s license). Prior to the provisioning of the virtual identity card, the user may be required to perform a series of authentication steps prescribed by the credential issuer.

[0042] FIG. 1 shows a system and an overlaid flow diagram illustrating methods according to embodiments of the invention. FIG. 1 shows a server computer 104 which may be operated by a service provider such as a bank, a merchant, a governmental agency, etc. The server computer 104 can be in operable communication with a user device 102 operated by a user (not shown), a client device 101 which may also be operated by a user, and a processing network computer 106. The processing network computer 106 could be operated by a payment processing organization, a governmental entity, or other entity that can validate virtual identity cards.

[0043] The entities in FIG. 1 may be in communication using any suitable communications networks. Suitable communications networks may be any one and / or the combination of the following: a direct interconnection; the Internet; a Local Area Network (LAN); a Metropolitan Area Network (MAN); an Operating Missions as Nodes on the Internet (OMNI); mesh networks, a secured custom connection; a Wide Area Network (WAN); a wireless network (e.g., employing protocols such as, but not limited to a Wireless Application Protocol (WAP), l-mode, and / or the like); and / or the like.

[0044] Referring to FIG. 1 , at step S100, the user initiates opening an account with a service provider operating a server computer 104. The user may use the clientdevice 101 to communicate with the server computer 104. The client device can have a specific service provider application (e.g., a banking application) or a general application such as a browser. The client device 101 can be a laptop computer, a terminal at the service provider, etc. As an illustration, the client device 101 can be a laptop computer with a browser, and may communicate with the server computer 104 using the browser. When in contact with the client device 101 , the server computer 104 may prompt the user using an appropriate graphical user interface on the client device 101 to input a location code for the location where they live. An example of a location code can be a zip code. At step S101, the user inputs their location code into the graphical user interface of the client device 101 , and at step S102 the location code is transmitted to the server computer 104 in a registration inquiry message.

[0045] At step S103, the server computer 104 queries the processing network computer 106 to determine if the location code is associated with an agency (e.g., state government agency) that issues virtual identity cards (e.g., mDLs). In some embodiments, the processing network computer 106 may store a plurality of public keys that can be used to validate virtual identity card (e.g., mDL) signatures. The public keys may be provided to the processing network computer 106 by various identity agencies (e.g., different state governments) associated. These public keys may be associated with specific geographic regions such as states. To check if a state supports virtual identity card processing (e.g., mDL processing), the processing network computer 106 may check a database that stores location codes and names of any agencies associated with those location codes. For example, in a registration process with the processing network computer 106, the processing network computer 106 may store the zip codes in state of California. The processing network computer 106 may further store a public key corresponding to the DMV of the state of California. Virtual identity cards issued by the state of California DMV may have a digital signature produced by a private key corresponding to the public key.

[0046] At step S104, if the zip code is associated with an agency (e.g., the California Department of Motor Vehicles) that supports virtual identity cards (e.g., mDLs), then the processing network computer 106 can notify the server computer 104 in a registration response message. At step S105, after receiving notificationfrom the processing network computer 106 that the agency supports virtual identity cards (e.g., mDLs), the server computer 104 prompts the user via the client device 101 to determine if their user device 102 has been provisioned with a virtual identity card (e.g., an mDL). At step S106, the user replies to the server computer 104 via the client device 101 with an affirmative response (e.g., “yes”).

[0047] At step S107, in the server computer 104 initiates the generation of a scannable code on the client device 101. The generation of the scannable code can be on a service provider application or browser on the client device 101. The user is prompted by the client device 101 to scan the scannable code displayed on the client device 101.

[0048] At step S108, the user scans the scannable code with a camera on the user device 102 and this may launch a storage application (e.g., a digital wallet application or driver’s license application) holding the user’s virtual identity card. In some embodiments, before accessing the storage application on the user device 102 or before allowing it to provide sensitive user data to external parties, the user may be required to supply a secret such as a PIN (personal identification number) or password, or a biometric.

[0049] At step S109, the user is asked by the storage application on the user device 102 if they wish to share user data (e.g., information in the mDL) with the server computer 104. For example, the user is shown a scannable code (e.g., QR code) on a display of the client device 101 and is prompted to scan it with their user device 102. After scanning it with the user device 102, the user can be presented with a separate interface such as a pop-up window (or an iFrame) at step S109. The pop-up window requests log-in information from the user, and once the user inputs log-in credentials, it asks if the user consents to sharing user data with the server computer 104. In some embodiments, the user may specify what types of user data they wish to share with the server computer 104 (e.g., only the user's name and driver’s license number). In some embodiments, a messaging protocol according to OpenlD for Verifiable Presentations may be used. At step S109, the user also consents to sharing their user data.

[0050] At step S111, the user device 102 then transmits a message comprising a payload comprising the virtual identity card or data associated with it to the server computer 104. The virtual identity card data may include the user data and a digital certificate with one or more digital signatures. The user data in the payload may depend on the requirements of the server computer 104. For example, service provider associated with the server computer 104 may request the user’s name, birthday, address, and driver’s license number to open a record for the user. The user data may then comprise the user’s name, birthday, address, and driver’s license number associated with their virtual identity card (e.g., mDL). In some embodiments, the message is encrypted by the user device 102 using a first cryptographic key and is decrypted by the server computer 104 using a second cryptographic key.

[0051] At step S112, after receiving the payload comprising the user data and the digital signature, the server computer 104 transmits the digital certificate with the one or more digital signatures to the processing network computer 106 for verification in a verification request message. In some embodiments, the verification request message may be encrypted with a first cryptographic key, and may be decrypted with a second cryptographic key. The processing network computer 106 can determine if the digital certificate is valid by checking, for example, its validity dates. The processing network computer 106 then determines whether or not the one or more digital signatures is / are verified and therefore validated. For example, the processing network computer 106 may validate a first digital signature using the public key corresponding to the private key associated with the virtual identity card on the user device 102 and / or the virtual identity card issuer. The processing network computer 106 may validate a second digital signature created using a private key associated with the processing network computer 106 using the corresponding public key. The processing network computer 106 can then determines a verification result based on whether or not the one or more digital signatures is / are valid.

[0052] At step S113, if the one or more digital signatures is / are validated, the processing network computer 106 transmits the verification result to the server computer 104 in a verification response message. If the digital signature is validated,then at step S114, the server computer 104 continues with opening the account using the user data. For example, the relevant user data in the payload may be used by service provider computer to automatically fill in electronic forms during the creation of an account for the user. In step S115, the user is notified that the account has been opened. If the digital signature is not validated, then the processing network computer 106 can send a message to the server computer 104 that the validation of the virtual identity card was unsuccessful, and the user can be informed accordingly.

[0053] In some embodiments, after the relevant user data is automatically filled in, it cannot be modified. As an advantage, the user data for opening the account is consistent with the user data on file with the identity agency. For example, embodiments can verify that the name, birthday, and address of a user matches their government issued driver’s license prior to opening an account for the user.

[0054] Embodiments of the invention have a number of advantages. As noted above, embodiments of the invention are much more secure. In order to generate a record (e.g., an account) for the user, the user needs to be in possession of a specific user device which was provisioned with a specific virtual identity card and a specific private key, and needs to provide a secret or biometric to a storage application holding the virtual identity card before the user data and the digital signature associated with the virtual identity card are released. A fraudulent party is not able to manually copy the virtual identity card and therefore cannot fraudulently open accounts using the information of legitimate users.

[0055] In addition, the information received by the server computer to create the record is received directly from the virtual identity card on the user device 102, and can be automatically form filled. As such, the information on such forms is accurate and can match a virtual identity card. Conventional systems can be susceptible to data entry errors, where such errors would not be present in embodiments of the invention.

[0056] FIG. 2 shows a block diagram of a user device 200 (e.g., user device 102, described above), according to an embodiment. The user device 200 can be a mobile device (e.g., mobile phone, smart watch, tablet, etc.) with a storageapplication 222 storing a virtual identity card 224, one or more others application 204 (e.g., a browser), and a cryptography module 206. The cryptography module 206 may comprise cryptographic keys and / or algorithms to perform cryptographic processing. The user device 200 may include device hardware 208 coupled to a system memory 202.

[0057] Device hardware 208 may include a processor 210, input elements 212, a short range antenna 214, a user interface 216, output elements 218, and a long range antenna 220. Examples of input elements 212 may include microphones, keypads, touch screens, sensors, and / or cameras, etc. Examples of output elements 218 may include speakers, display screens, tactile devices, and / or light emitting diodes (LEDs), etc. The processor 210 can be implemented as one or more integrated circuits (e.g., one or more single core or multicore microprocessors and / or microcontrollers), and is used to control the operation of user device 200. The processor 210 can execute a variety of programs in response to program code or computer-readable code stored in the system memory 202, and can maintain multiple concurrently executing programs or processes.

[0058] The long range antenna 220 may include one or more radio frequency (RF) transceivers and / or connectors that can be used by user device 200 to communicate with other devices and / or to connect with external networks. The input elements 212 and output elements 218 allow a user to interact with and invoke the functionalities of user device 200. The short range antenna 214 may be configured to communicate with external devices through a short range communication medium (e.g., using Bluetooth, Wi-Fi, infrared, NFC, etc.). The long range antenna 220 may be configured to communicate with a remote base station and a remote cellular or data network, over the air.

[0059] The system memory 202 can be implemented using any combination of any number of non-volatile memories (e.g., flash memory) and volatile memories (e.g., DRAM, SRAM), or any other non-transitory storage medium, or a combination thereof media. The system memory 202 may store computer code, executable by the processor 210, for performing any of the functions described herein. For example, the system memory 202 may comprise a computer readable mediumcomprising code, executable by the processor 210, for implementing a method as described herein.

[0060] FIG. 3 shows a block diagram of a processing network computer 110 (e.g., processing network computer 110 described above), according to an embodiment. The processing network computer 110 may include a processor 302, coupled to a network interface 304, a data store 316, and a computer readable medium 306.

[0061] The data store 316 can be implemented using any combination of any number of non-volatile memories (e.g., flash memory) and volatile memories (e.g., DRAM, SRAM), or any other non-transitory storage medium, or a combination thereof media. The data store 316 may store location codes (e.g., zip codes), registration information of service providers or users (e.g., names, addresses, e-mail addresses, domain names, etc.), cryptographic keys, digital certificates, account identifying information, and / or other information.

[0062] The communication module 310 may comprise code, executable by the processor 302, to communicate using network interface 304 with one or more other systems. The database search module 314 may comprise code, executable by the processor 302, to perform database searching. The cryptographic processing module 320 can perform, in conjunction with the processor 302, cryptographic processing including signature verification, digital signing, encryption, and decryption. The registration module 318 and the processor 302 can register different service providers and any users associated with them.

[0063] The computer readable medium 306 may comprise a number of software modules including a communication module 310, a database search module 314, a cryptography module, and a registration module 318. The computer readable medium 306 may also comprise code, executable by the processor 302 to perform a method comprising: receiving, from a server computer, a registration inquiry message comprising a location code; transmitting, to the server computer, a registration response message indicating that a location associated with the location code is registered with the processing network computer; receiving, from the server computer, a verification request message comprising a digital signature; verifying thedigital signature with a public key corresponding to a private key stored on a user device operated by a user; and transmitting, to the server computer, a verification response message comprising an indication that the digital signature is validated, wherein the server computer is programmed to create a record in response to receiving the verification response message.

[0064] FIG. 4 shows a block diagram of a server computer 400 (e.g., server computer 104 described above), according to an embodiment. The server computer 104 may include a processor 702, coupled to a network interface 704, a data store 716, and a computer readable medium 706.

[0065] The data store 716 can be implemented using any combination of any number of non-volatile memories (e.g., flash memory) and volatile memories (e.g., DRAM, SRAM), or any other non-transitory storage medium, or a combination thereof media. The data store 716 may store tokens, credentials, encryption keys, digital certificates, account identifying information, and / or other information as described herein.

[0066] The computer readable medium 706 may comprise a number of software modules including a communication module 710, a cryptography module 714, a record creation module 720, and an authentication module 718.

[0067] The communication module 710 may comprise code, executable by the processor 702, to communicate using network interface 704 with one or more other systems. The cryptography module 714 may comprise code, executable by the processor 702, to perform cryptographic processing including signature verification, digital signing, encryption, and decryption. The record creation module 418 may comprise code, executable by the processor 702, to create a record (e.g., an account) using user data from a virtual identity card. The record creation module 418 can comprise forms and auto-fill software for auto-filling the forms with user data from virtual identity cards. The authentication module 718 may comprise code, executable by the processor 702, to authenticate various entities.

[0068] The computer readable medium 706 may comprise code, executable by the processor, to perform a method comprising: receiving, from a user device operated by a user, a message comprising a payload comprising user data and adigital signature associated with a virtual identity card; transmitting to a processing network computer, a verification request message comprising the digital signature; receiving, from the processing network computer, a verification response message comprising an indication that the digital signature is validated; and responsive to the indication that the digital signature is valid, creating a record using the user data.

[0069] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perl or Python using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium for storage and / or transmission, suitable media include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk), flash memory, and the like. The computer readable medium may be any combination of such storage or transmission devices.

[0070] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and / or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium according to an embodiment of the present invention may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via Internet download). Any such computer readable medium may reside on or within a single computer product (e.g., a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0071] The above description is illustrative and is not restrictive. Many variations of the invention will become apparent to those skilled in the art upon review of the disclosure. The scope of the invention should, therefore, be determinednot with reference to the above description, but instead should be determined with reference to the pending claims along with their full scope or equivalents.

[0072] One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the invention.

[0073] As used herein, the use of "a," "an," or "the" is intended to mean "at least one," unless specifically indicated to the contrary.

Claims

WHAT IS CLAIMED IS:

1. A method comprising: receiving, by a server computer from a user device operated by a user, a message comprising a payload comprising user data and a digital signature associated with a virtual identity card; transmitting, by the server computer, to a processing network computer, a verification request message comprising the digital signature; receiving, by the server computer from the processing network computer, a verification response message comprising an indication that the digital signature is validated; and responsive to the indication that the digital signature is valid, creating, by the server computer, a record using the user data.

2. The method of claim 1 , wherein the method further comprises, prior to receiving the message: receiving, by the server computer, a location code from the user device; transmitting, by the server computer to the processing network computer, a registration inquiry message comprising the location code to the processing network computer; receiving, by the server computer from the processing network computer, a registration response message indicating that a location associated with the location code is registered with the processing network computer; and initiating, by the server computer, generation of a scannable code at a service provider application associated with the service provider application.

3. The method of claim 2, wherein the scannable code is configured to be captured by the user device to cause the user device to launch a storage application storing the virtual identity card, and requests consent of the user to share the user data with the server computer.

4. The method of claim 3, further comprising:receiving, by the server computer, the user data after the user provides the consent.

5. The method of claim 4, wherein the user data and the digital signature are in a digital certificate.

6. The method of claim 5, wherein the processing network computer comprises a plurality of public keys associated with different location codes, the location code being one of the different location codes.

7. The method of claim 6, wherein the processing network computer is programmed to: receive the verification request message comprising the digital signature; verify the digital signature with a public key corresponding to a private key stored on the user device; and transmit, to the server computer, the verification response message.

8. The method of claim 1 , wherein the virtual identity card is a comprises a virtual driver's license.

9. The method of claim 1 , wherein the method further comprises, prior to receiving the message: receiving a location code from the user device; transmitting, to the processing network computer, a registration inquiry message comprising the location code to the processing network computer; receiving, from the processing network computer, a registration response message indicating that a location associated with the location code is registered with the processing network computer; and initiating generation of a scannable code at a service provider application associated with the service provider application.

10. The method of claim 1 , further comprising: encrypting, using a first cryptographic key, the verification request message prior to transmitting the verification request message to the processing network computer.

11. The method of claim 1 , wherein the user device encrypts the message using a first cryptographic key on the user device, and wherein the method further comprises: decrypting, by the server computer with a second cryptographic key, the encrypted message.

12. A server computer comprising: a processor; and a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, executable by the processor to perform a method comprising: receiving, from a user device operated by a user, a message comprising a payload comprising user data and a digital signature associated with a virtual identity card; transmitting to a processing network computer, a verification request message comprising the digital signature; receiving, from the processing network computer, a verification response message comprising an indication that the digital signature is validated; and responsive to the indication that the digital signature is valid, creating a record using the user data.

13. The server computer of claim 12, wherein the method further comprises, prior to receiving the message: receiving a location code from the user device; transmitting the location code to the processing network computer;receiving, from the processing network computer, a message indicating that a location associated with the location code is registered with the processing network computer; and initiating generation of a scannable code at a service provider application associated with the service provider application.

14. The server computer of claim 12, wherein the user device encrypts the message using a first cryptographic key on the user device, and wherein the method further comprises: decrypting, by the server computer with a second cryptographic key, the encrypted message.

15. The server computer of claim 12, wherein the method further comprises: encrypting, using a first cryptographic key, the verification request message prior to transmitting the verification request message to the processing network computer.

16. A method comprising: receiving, by a processing network computer from a server computer, a registration inquiry message comprising a location code; transmitting, by the processing network computer to the server computer, a registration response message indicating that a location associated with the location code is registered with the processing network computer; receiving, by the processing network computer from the server computer, a verification request message comprising a digital signature; verify the digital signature with a public key corresponding to a private key stored on a user device operated by a user; and transmitting, by the processing network computer to the server computer, a verification response message comprising an indication that the digital signature is validated, wherein the server computer is programmed to create a record in response to receiving the verification response message.

17. The method of claim 16, wherein the processing network computer comprises a plurality of public keys associated with different location codes, the location code being one of the different location codes.

18. The method of claim 16, wherein the server computer is programmed to: receive, from the user device, a message comprising a payload comprising user data and the digital signature, the digital signature associated with a virtual identity card on the user device; and transmit, to the processing network computer, the verification request message.

19. The method of claim 16, wherein the server computer is accessible to a client computer operated by the user.

20. The method of claim 19, wherein the user device is a mobile phone.

Images