ID Token Pseudonym Generation via Cryptographic Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital identity management systems face issues such as user manipulation, centralization leading to data protection concerns, and the need for separate authorization certificates for each service provider, which complicates pseudonym generation and usage.
Innovation Solution
A method for generating pseudonyms using an ID token with protected storage for a private key, allowing users to select service computer systems without requiring separate registration, using asymmetric cryptographic key pairs and Elliptic Curve Diffie Hellman method for authentication and pseudonym derivation, with a single certificate for the ID provider system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If digital identities are stored centrally in a server-based system, then user identification is simplified, but data protection is compromised and user behavior can be recorded
Solution Approach 1:
The system segments the digital identity into two parts: a permanent pseudonym stored securely in the user's ID token and a transient service-specific identifier. This segmentation allows centralized management of the pseudonym while distributing service-specific identifiers across multiple services, preventing any single point from containing the full identity and thus protecting user privacy while maintaining identification capability.
Solution Approach 2:
The patent introduces a pseudonym as an intermediary between the user's real identity and the service provider. The pseudonym acts as a mediator that enables user identification without revealing the actual identity, thus simplifying the identification process while protecting data protection. The pseudonym is stored in the user's ID token and presented to service providers, preventing them from accessing or recording the user's real identity.
2Reliability
If separate authorization certificates are required for each service provider, then service-specific authentication is enabled, but device complexity and registration burden increase
Solution Approach 1:
The patent makes the pseudonym universal across multiple service providers. Instead of requiring separate certificates for each service, the same pseudonym stored in the user's ID token can be presented to any service provider in the system. This multi-functional approach enables service-specific authentication without requiring separate registration or certificate management for each service, thus reducing device complexity and registration burden while maintaining reliable authentication.
3Ease of operation
If user identities are transmitted to service providers, then user recognition is enabled, but user anonymity and protection from profiling are lost
Solution Approach 1:
The patent applies local quality by making the pseudonym service-specific rather than universally identifying. Each service provider receives and processes only the pseudonym, not the user's real identity. This allows user recognition at the service level (enabling personalized services, session management, etc.) while maintaining anonymity from the service provider's perspective. The pseudonym has different qualities for different services - it enables recognition locally at each service without revealing global identity information.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This method enables secure, anonymous user identification across multiple service computer systems with reduced logistical and financial burdens, maintaining user pseudonyms even with ID token replacements, and prevents profiling of user behavior.
Implementation Method 1
The ID token has a protected storage area for storing a private key of a first asymmetric cryptographic key pair, which is assigned to the ID token and constitutes its identity
Implementation Method 2
using asymmetric cryptographic key pairs and Elliptic Curve Diffie Hellman method for authentication and pseudonym derivation
Implementation Method 3
The ID token has a protected storage area for storing a private key
Data Source
Figure 1~1a
Figure 1b
Figure 2
AI summary
The invention relates to a method for generating a pseudonym using an ID token (106) for a user (102), wherein the ID token is assigned to the user and the ID token has a protected memory area (122) for storing at least one private key of a first asymmetric cryptographic key pair assigned to the ID token, and wherein the user's pseudonym is assigned to a service computer system from a set of service computer systems (150, 150', 150",...), comprising the following steps: - accessing a website of one of the service computer systems selected by the user with an internet browser (112) of a user computer system (100) via a network (116), - generating a request (176) by the selected service computer system for the user's pseudonym, - transmitting the request from the service computer system to an ID provider computer system (136) via the network,- Generation of the ID token pseudonym by the ID token through cryptographic derivation of the ID token pseudonym from the private key and the public key, - temporary storage of the ID token pseudonym in the ID token, - transmission of the ID token pseudonym from the ID token to the ID provider computer system with end-to-end encryption over the network, - access to a memory (186, 188) by the ID provider computer system using the ID token pseudonym (RID) to read a virtual pseudonym (vP) of the user associated with the ID token pseudonym, - derivation of the user's pseudonym (RID') associated with the selected service computer system from the user's virtual pseudonym by the ID provider computer system using a cryptographic function specific to the selected service computer system, - signing of the derived Pseudonyms through the ID provider computer system,- Transfer of the signed pseudonym from the ID provider computer system to the selected service computer system over the network.