Encrypted Identity Matching Across Providers Without Plaintext Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transfer of personal data between users and relying parties is problematic when identity providers lack necessary data or accuracy is uncertain, leading to potential misuse or exposure.
Innovation Solution
A method involving a server computer that encrypts and decrypts personal data using public and private keys from multiple identity providers and a relying party, ensuring secure and accurate data exchange by comparing attributes across providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If personal data is transferred directly from identity provider to relying party, then data accuracy is improved, but data security and privacy protection deteriorate
Solution Approach 1:
The patent introduces a server computer as an intermediary that receives encrypted data from the user device, verifies it against identity provider data, and communicates with the relying party without exposing plaintext personal data. This mediator architecture allows accuracy verification while maintaining security by preventing direct plaintext data exposure between parties.
Solution Approach 2:
The system performs preliminary encryption of personal data by the user device before transmission to the server. The server then performs preliminary verification by comparing encrypted data with identity provider records before any data is exposed to the relying party. This preliminary action ensures data integrity and security are established before the actual data exchange occurs.
2Measurement precision
If multiple identity providers are contacted for data verification, then data accuracy is improved, but system complexity increases
Solution Approach 1:
The patent merges the verification process for multiple identity providers into a single server-based workflow. Instead of each relying party independently contacting multiple providers, the server consolidates the verification logic, receiving encrypted data from the user device and systematically comparing it against records from multiple identity providers in a unified process.
Solution Approach 2:
The server acts as a central intermediary that manages communications with multiple identity providers. It receives encrypted personal data from the user device, systematically compares it against verified records from multiple identity providers, and coordinates the verification process. This mediator approach simplifies the system architecture by centralizing the complexity of multi-provider verification in a single server component.
3Object-affected harmful factors
If data is encrypted with multiple keys, then data security is improved, but processing time increases
Solution Approach 1:
The user device performs preliminary encryption of personal data with multiple keys (user key and relying party key) before transmission to the server. This preliminary action establishes strong security protections in advance, allowing the server to receive already-encrypted data and perform verification without needing to re-encrypt or process the data through multiple encryption layers during the verification phase.
Data Source
AI summary
A method includes receiving a first encrypted first identity attribute. A first doubly encrypted first identity attribute is formed by encrypting the first encrypted first identity attribute. A second doubly encrypted first identity attribute is formed by encrypting the first encrypted first identity attribute. They are transmitted to a user device, which removes a user layer of encryption on each to form a second encrypted first identity attribute and a third encrypted first identity attribute. Layers of encryption are added to the second encrypted first identity attribute to form a third doubly encrypted first identity attribute and the third encrypted first identity attribute to form a fourth doubly encrypted first identity attribute. The server computer receives them and transmits, to the second identity provider computer, the fourth doubly encrypted first identity attribute. The second identity provider computer obtains a first identity attribute and compares it to a second identity attribute.