Credential Verification Using Split Presentation and Third-Party MAC Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional credential verification methods are time-consuming, error-prone, and expose sensitive user data to potential leaks, while existing solutions for verifiable credentials impose computational overheads and risk user privacy breaches.
Innovation Solution
A computer-implemented method divides user credentials into two parts: a first part containing attributes for direct verification and a second part with a randomized message authentication code verified by a third party using a secret key, ensuring privacy and reducing computational complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional verification techniques are used to verify user credentials, then verification can be performed, but sensitive user data is exposed to potential leaks and the process is time-consuming and error-prone
Solution Approach 1:
The credential verification process is segmented into two independent parts: (1) attribute verification by the verifier, and (2) authenticity verification by a third party. This segmentation allows the verifier to only handle public attributes while the third party verifies the cryptographic authenticity, eliminating the need for the verifier to access or store sensitive user data.
Solution Approach 2:
A third party is introduced as an intermediary to perform the authenticity verification of credentials. This intermediary receives the credential from the verifier, verifies its authenticity using a secret key, and returns only a verification result without exposing any sensitive user data. The third party acts as a trusted mediator that decouples the verification process from data exposure risks.
2Reliability
If verifiable credentials are used to allow users to control their data, then user privacy is protected, but the issuer revenue is limited due to periodic revocation and reissuance
Solution Approach 1:
The system enables self-service credential verification where the third party automatically verifies credential authenticity without requiring periodic revocation and reissuance. The credential contains embedded cryptographic elements that allow for continuous verification, eliminating the need for repeated credential cycles and enabling ongoing revenue generation from verification services.
Solution Approach 2:
The credential is pre-configured with cryptographic elements during issuance that enable future verification without requiring reissuance. The third party uses these pre-established cryptographic relationships to verify authenticity on-demand, allowing the issuer to charge for each verification event rather than requiring periodic credential renewal.
3Productivity
If revocation database access is locked and charged for, then issuer revenue can be generated, but verifiers can learn status of all users by paying for one check
Solution Approach 1:
The verification process extracts only the necessary authentication information from the credential and verifies it without accessing the revocation database. The third party verifies credential authenticity using cryptographic methods embedded in the credential itself, eliminating the need to query a revocation database and thereby preventing any potential information leakage about other users' credential status.
Solution Approach 2:
The system uses disposable cryptographic verification tokens embedded in each credential that can be verified independently without requiring access to a centralized revocation database. Each credential contains sufficient information for standalone verification, preventing verifiers from inferring information about other users' credential status.
4Reliability
If manual verification processes are used, then credential verification can be performed, but the process is expensive and error-prone
Solution Approach 1:
The manual verification process is replaced with an automated cryptographic verification system. The third party uses automated cryptographic algorithms to verify credential authenticity, eliminating manual inspection and reducing both cost and errors. The verification process becomes a deterministic computational operation rather than a manual review process.
Data Source
AI summary
Disclosed is a computer-implemented method of verifying credentials of a user (102) comprising receiving a verifiable presentation from the user, wherein the verifiable presentation comprises two parts; examining a first part of the verifiable presentation to identify one or more attributes of the user included in the first part; sending a second part of the verifiable presentation to a third party (106) for inspection, wherein the second part comprises a randomized message authentication code and does not contain any attributes of the user; verifying the randomized message authentication code by the third party using a secret key; and verifying the credentials of the user based on the outcome of the inspection of the second part by the third party.