By-Reference Identity Claims for Dynamic Attribute Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity claim systems face inefficiencies when handling attribute values that frequently change or are too large in size to be conveniently embedded in X.509 certificates or JSON Web Tokens, leading to unnecessary burden on users and inconvenience in data transmission.
Innovation Solution
A system and method for dynamically retrieving attribute values using a digitally signed access token, where by-reference identity claims include a URL endpoint, allowing secure and efficient retrieval of attribute values from an issuing party by a relying party.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attribute values are embedded in identity claims, then identity information is provided, but frequent updates are required when values change
Solution Approach 1:
The patent segments the identity claim into two parts: a stable reference to the issuing party and a dynamic attribute value. The identity claim contains a reference identifier that points to the issuing party, while the actual attribute value is retrieved dynamically. This segmentation allows the claim structure to remain stable while enabling frequent value updates without requiring users to obtain new claims.
Solution Approach 2:
The patent introduces an intermediary mechanism where the identity claim acts as a reference pointer rather than containing the actual value. The claiming party holds the claim as a reference, and the attribute value is retrieved from the issuing party on demand. This intermediary approach decouples the claim from the value, allowing independent updates of values without affecting claim validity.
2Loss of information
If large attribute values are embedded in identity claims, then complete information is provided, but data transmission becomes inconvenient
Solution Approach 1:
The patent extracts the actual attribute value from the identity claim, leaving only a reference identifier in the claim. The large attribute value (such as diagnostic reports or credit scores) is stored separately at the issuing party, and only the reference is transmitted in the claim. This extraction significantly reduces the size of data that needs to be transmitted while maintaining access to the complete information.
Solution Approach 2:
The patent changes the dimension of information storage from embedding values directly in claims to storing values externally and referencing them. Instead of transmitting the full attribute value within the claim structure, the system transmits a reference pointer and retrieves the value from an external source. This dimensional shift separates the claim metadata from the actual data storage.
3Loss of information
If attribute values are embedded in identity claims, then identity information is provided, but the system becomes complex when values change frequently
Solution Approach 1:
The patent introduces dynamic retrieval capability where attribute values can be updated frequently without affecting the validity of existing identity claims. The claiming party can retrieve the latest attribute value from the issuing party at any time using the reference identifier in the claim. This dynamic mechanism simplifies the system by allowing values to change independently of claim issuance.
Solution Approach 2:
The patent performs preliminary action by establishing a reference relationship between the identity claim and the issuing party before any value changes occur. The claim contains a reference identifier that is pre-configured to point to the correct issuing party. This preliminary setup enables future value updates without requiring changes to the claim structure or requiring users to manage complex update logic.
Data Source
AI summary
A processor-implemented system and method for dynamically retrieving an attribute value of an identity claim for a user using a digitally signed access token that is digitally signed by a user device, at a relying party device associated with a relying party. The method includes (i) obtaining at least one identity claim as at least one by-reference identity claim from an issuing party device; (ii) digitally signing, using a processor, an access token to obtain a digitally signed access token; (iii) obtaining an API call; and (iv) sending the at least one by-reference identity claim and the digitally signed access token that corresponds to the at least one identity claim.