Encrypted Identity Attribute Matching Across Multiple Providers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transfer of personal data between users and relying parties is problematic when identity providers lack necessary data or accuracy is uncertain, leading to potential misuse or exposure.
Innovation Solution
A method involving a server computer that encrypts and decrypts personal data using public and private keys from multiple identity providers and a relying party, ensuring secure and accurate data exchange without exposing plaintext data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If personal data is transferred from identity providers to relying parties, then the relying party can obtain necessary information for user interaction, but the user's privacy is exposed and data accuracy cannot be verified
Solution Approach 1:
The patent segments the data verification process into multiple independent identity providers, each contributing a portion of verification. Instead of relying on a single identity provider, the system divides the verification task across multiple sources (e.g., DMV, passport office, driver's license agency), where each provides encrypted confirmation of specific attributes. This segmentation allows the relying party to verify data accuracy through multiple independent sources without any single provider having access to or exposing the user's complete personal data.
Solution Approach 2:
The patent introduces an intermediary verification system that coordinates between identity providers and relying parties without exposing personal data. The intermediary manages the encrypted verification process, collecting confirmations from multiple identity providers and relaying only the verification results to the relying party. This intermediary layer ensures that neither the relying party nor individual identity providers can access plaintext personal information, while still enabling accurate verification through coordinated multi-source validation.
2Reliability
If multiple identity providers are contacted to verify data accuracy, then data reliability improves, but the complexity of the data exchange process increases
Solution Approach 1:
The patent changes the parameter of data representation from plaintext personal information to encrypted verification tokens. Each identity provider generates and returns encrypted confirmations of specific user attributes rather than transmitting actual personal data. This parameter change transforms the data exchange from complex structured personal information into simplified cryptographic proofs that are easier to handle and verify, reducing processing complexity while maintaining high reliability through multiple encrypted verification sources.
3Object-affected harmful factors
If encrypted data is used to protect user privacy, then privacy is preserved, but the relying party cannot verify the accuracy of the data
Solution Approach 1:
The patent implements a nested encryption structure where multiple layers of encryption are applied, each corresponding to a different identity provider's verification. The encrypted data from the first identity provider is further encrypted with the second identity provider's credentials, creating nested cryptographic layers. This nested structure allows the relying party to verify data accuracy by validating each encryption layer against its corresponding identity provider's public key, while the nested nature ensures that plaintext personal data never exists in transit or storage, maintaining privacy protection throughout the verification process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes receiving a first encrypted first identity attribute. A first doubly encrypted first identity attribute is formed by encrypting the first encrypted first identity attribute. A second doubly encrypted first identity attribute is formed by encrypting the first encrypted first identity attribute. They are transmitted to a user device, which removes a user layer of encryption on each to form a second encrypted first identity attribute and a third encrypted first identity attribute. Layers of encryption are added to the second encrypted first identity attribute to form a third doubly encrypted first identity attribute and the third encrypted first identity attribute to form a fourth doubly encrypted first identity attribute. The server computer receives them and transmits, to the second identity provider computer, the fourth doubly encrypted first identity attribute. The second identity provider computer obtains a first identity attribute and compares it to a second identity attribute.