Encrypted One-Time ID Tokens for Trust-Anchored Attribute Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems face challenges in securely providing and managing identity-related attributes stored in ID tokens, particularly in networked computer systems, due to the need for secure handling and data protection.
Innovation Solution
A method and device for generating and managing encrypted one-time ID tokens, using a trust anchor system to securely transmit and decrypt attributes from an ID token to a service provider, with end-to-end encryption and cryptographic protocols to ensure data integrity and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ID token attributes are transmitted to service providers for service provision, then service functionality is enabled, but data security and protection against unauthorized access deteriorate
Solution Approach 1:
The ID token attributes are segmented into multiple parts: the ID token itself, the one-time token, and the attribute message. Only specific attributes are extracted and transmitted to the service provider through the attribute message, while the complete ID token remains secured in the user's device. This segmentation enables service provision with necessary attributes while protecting sensitive data.
Solution Approach 2:
A trust anchor system acts as an intermediary between the user's device and the service provider. The trust anchor receives the ID token, verifies it, extracts required attributes, and forwards only those attributes to the service provider. This intermediary mechanism enables service functionality while maintaining data security by controlling what information is shared.
2Measurement precision
If ID token attributes are stored and transmitted for identity management, then identity verification is enabled, but risk of unauthorized access and data breaches increases
Solution Approach 1:
The system performs preliminary verification by requiring the user to authenticate with their ID token before any attributes are extracted or transmitted. The trust anchor verifies the ID token's validity and the user's authorization before proceeding with attribute extraction. This preliminary action ensures identity verification accuracy while preventing unauthorized access by establishing security checks before data exposure.
Solution Approach 2:
The system uses a one-time token that is valid only for a single service provision transaction. After the attributes are transmitted to the service provider, the one-time token becomes invalid and cannot be reused. This disposable approach enables precise identity verification for each service while minimizing the risk of unauthorized access, as compromised tokens cannot be exploited repeatedly.
3Adaptability or versatility
If complete ID token attributes are transmitted to service providers, then comprehensive service functionality is achieved, but data protection and user privacy deteriorate
Solution Approach 1:
The trust anchor extracts only the specific attributes required for the requested service from the complete ID token, rather than transmitting all attributes. For example, if a service only requires age verification, only the age attribute is extracted and transmitted in the attribute message, while other sensitive attributes remain secured in the user's device. This extraction approach enables necessary service functionality while preserving user privacy by minimizing data exposure.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The invention relates to a method for providing at least one attribute stored in an ID token, wherein the ID token is assigned to a user, and wherein the method comprises the following: receiving a user service request for a service of a service provider in a first computer system (3); providing an ID token assigned to the user, which has attributes, in the first computer system (3); receiving a one-time token request from the first computer system (3) in a second computer system (30), wherein the one-time token request includes the ID token; generating an encrypted one-time ID token in the second computer system (30), wherein at least one of the attributes of the ID token is read, the one-time ID token is generated having the at least one attribute, and the one-time ID token is encrypted; receiving the encrypted one-time ID token in the first computer system (3);Receiving a service request for the service provider's service from the first computer system (3) in a third computer system (20), wherein the service request comprises the encrypted one-time ID token and a service indicator indicating the service; receiving a decryption request for the encrypted one-time ID token from the third computer system (20) in the second computer system (30), wherein the decryption request comprises the encrypted one-time ID token; reading the at least one attribute from the one-time ID token in the second computer system (30), wherein the encrypted one-time ID token is decrypted; and receiving an attribute message from the second computer system (30) in the third computer system (20), wherein the attribute message comprises the at least one attribute. Furthermore, an apparatus and a computer program product are provided.