Security Token Segmentation for User Visibility

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Individuals have limited control and visibility over the contents of security tokens issued by other entities, leading to potential unauthorized sharing of personal information during digital identity authentication, compromising privacy.

Innovation Solution

A system that generates security tokens with both a computational token and a display token, allowing the principal to view the display information about the claims, enabling them to review and decide on the information to be shared with relying parties.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a security token is issued by another entity for authentication, then the authentication process can be completed, but the principal loses control and visibility over the contents of the security token

Engineering Contradiction:

Improveauthentication processVSAvoidvisibility over security token contents

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The security token is divided into two distinct segments: a computational token containing the actual claims data and a display token containing human-readable display information. This segmentation allows the principal to review display information about the token contents without exposing the full computational token, thereby maintaining authentication functionality while improving visibility and control.

Inventive Principle:

Principle #1Segmentation

2Productivity

If a security token is shared with a third party for authentication, then access to goods or services can be provided, but personal information may be shared without the principal's knowledge

Engineering Contradiction:

Improveaccess provisionVSAvoidunauthorized personal information sharing

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary action by generating and presenting display information about the security token contents to the principal before the principal shares the token with a third party. This allows the principal to review what information will be shared and make an informed decision, preventing unauthorized personal information sharing while maintaining efficient authentication access.

Inventive Principle:

Principle #10Preliminary action

3Loss of information

If display information is provided to the principal, then the principal can review security token contents, but the system complexity increases

Engineering Contradiction:

Improveprincipal visibilityVSAvoidsecurity token structure

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

Instead of providing raw copies of the computational token contents, the system creates a simplified copy in the form of display information. This display token contains human-readable representations of the claims without exposing the full computational token structure, thereby providing principal visibility while managing system complexity through information abstraction.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS7788499B2Security tokens including displayable claims

Publication Date: 2010.08.31 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A system for providing a digital identity includes a claims transformer programmed to generate a security token including a computational token and a display token, the computational token including one or more claims associated with an identity of a principal, and the display token including display information about the claims in the computational token. The display information is configured to allow the principal to view the display token.