ID Token Pseudonym Generation for Anonymous Digital Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital identity management systems face issues such as user manipulation, centralization leading to data protection concerns, and lack of anonymity, as seen in Microsoft Windows CardSpace and OPENID, respectively.
Innovation Solution
A method for generating a pseudonym using an ID token with a protected storage area for a private key, allowing users to select service computer systems without prior registration, using asymmetric cryptographic key pairs and Elliptic Curve Diffie Hellman method for pseudonym derivation, ensuring end-to-end encryption and reduced resource requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If digital identities are stored centrally in a server-based system like OPENID, then user identification is simplified, but data protection is compromised and user anonymity is lost
Solution Approach 1:
The patent segments the digital identity system by separating the identification function (performed by the ID token on the user's device) from the verification function (performed by the service computer system). This eliminates the need for a central server to store digital identities, thereby protecting user anonymity while maintaining simplified identification through the use of pseudonyms that can be verified without revealing the underlying identity.
Solution Approach 2:
The patent introduces pseudonyms as an intermediary element between the user's real identity and the service computer system. The ID token generates and manages these pseudonyms, allowing the service system to identify and verify users without ever accessing or storing their actual digital identities, thus preserving anonymity while enabling identification.
2Reliability
If a pseudonym function like ePass RID is used for anonymous login, then user anonymity is improved, but system complexity increases due to certificate management requirements
Solution Approach 1:
The ID token operates as a self-service system that autonomously generates pseudonyms and manages the cryptographic key pairs without requiring external certificate authorities or complex certificate management infrastructure. The token internally handles key generation, pseudonym creation, and verification processes, eliminating the need for users or service providers to manage certificates manually.
Solution Approach 2:
The patent extracts the certificate management functionality from the overall system and embeds it within the ID token itself. By taking out the complex certificate management requirements and placing them inside the secure element of the ID token, the system maintains strong cryptographic security and user anonymity while presenting a simplified interface to both users and service providers.
3Adaptability or versatility
If multiple service computer systems are registered with an ID provider, then service coverage is improved, but logistical and financial burdens increase
Solution Approach 1:
The ID token implements a universal pseudonym generation mechanism that works across multiple service computer systems without requiring separate registrations. The same ID token and pseudonym generation process can be used with any service system that supports the protocol, eliminating the need for individual registrations at each service and reducing logistical overhead while maintaining broad service coverage.
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
The invention relates to a method for generating a pseudonym for a user using an ID token, wherein the ID token is assigned to a user and the ID token has a protected memory area for storing at least one private key of a first asymmetric cryptographic key pair assigned to the ID token, and wherein the user's pseudonym is assigned to a service computer system from a set of service computer systems, comprising the following steps: - accessing a website of a service computer system selected by the user with an internet browser (112) of a user computer system (100) via a network (116), - generating a request by the selected service computer system for the user's pseudonym, - transmitting the request from the service computer system to an ID provider computer system (136) via the network, - authenticating the user against the ID token.- Authentication of the ID provider computer system to the ID token via the network using a certificate containing a public key from a second asymmetric cryptographic key pair and defining read access for the ID provider computer system to read an ID token pseudonym, - Generation of the ID token pseudonym by the ID token through cryptographic derivation of the ID token pseudonym from the private and public keys and temporary storage of the ID token pseudonym in the ID token, - After successful authentication of the user and the ID provider computer system to the ID token, read access by the ID provider computer system to the ID token pseudonym stored in the ID token via the network, - Transmission of the ID token pseudonym from the ID token to the ID provider computer system with end-to-end encryption over the network,- Verification of the validity of the ID token pseudonym by the ID provider computer system, - Derivation of the user's pseudonym assigned to the selected service computer system from the user's ID token pseudonym by the ID provider computer system using a cryptographic function specific to the selected service computer system, - Signing of the derived pseudonym by the ID provider computer system, - Transmission of the signed pseudonym from the ID provider computer system to the selected service computer system via the network.