Identity attestation of a minor via a parent
View Patent ↗A technique allows a parentally attested security token to serve as authentication for a minor using identifying attributes of the minor child. The security token may include personally identifiable information about the child, a description of authorized activity as well as specifications of intended use of the security token. The security token may include provisions for authentication to be revoked by a parent or guardian and/or expire after a predetermined time. The security token may be stored inside a trusted execution environment of a portable computing device that may be carried by the minor and presented at physical locations where authentication is required.
1. A non-transitory machine readable medium, on which are stored instructions, comprising instructions that when executed cause a machine to:
receive information regarding initiation of a secure attestation session for a transaction with a client device associated with a minor, wherein the information includes one or more session keys that are signed with one or more digital signatures;
receive, from the client device, parent credentials indicative of an issuer of minor authentication information stored on the client device;
receive, from a remote device, a copy of the parent credentials indicative of a trusted guardian of the minor, wherein the remote device is part of a cloud service;
evaluate authenticity of the parent credentials with the copy of the parent credentials to determine authenticity of the issuer of the minor authentication information;
transmit one or more queries for the minor authentication information to the client device relating to the minor based on a determination that the parent credentials are authentic;
receive, from the client device, one or more query responses indicative of the minor authentication information, wherein the query responses are hashed and signed with one or more parent credential signatures generated from the parent credentials, wherein the one or more parent credential signatures include one or more public keys of the parent credentials;
authenticate the client device to perform the transaction based on the query responses and verification of the parent credential signatures; and
generate a notification to send to a device associated with the issuer based on a determination that the client device is denied access to perform the transaction,
wherein the minor authentication information includes information indicative of one or more physical attributes of the minor, information indicative of one or more authorized activities for the minor, information indicative of a duration of the one or more authorized activities for the minor, or combinations thereof.
2. The non-transitory machine readable medium of claim 1 , wherein the instructions to authenticate the client device comprise instructions that when executed cause the machine to:
verify the parent credential signatures with public credentials of the copy of the parent credentials; and
evaluate the query responses to determine whether the minor is authorized to perform the one or more authorized activities, wherein the query responses include answers to questions within the queries.
3. The non-transitory machine readable medium of claim 2 , wherein the instructions further comprise instructions that when executed cause the machine to deny access to the client device for the transaction based on the answers included in the query responses.
4. The non-transitory machine readable medium of claim 1 , wherein the instructions to authenticate the client device comprise instructions that when executed cause the machine to
evaluate the query responses to determine whether one or more physical attributes indicated by the queries match one or more physical attributes of the minor, wherein the query responses include answers to questions within the queries.
5. The non-transitory machine readable medium of claim 4 , wherein the instructions further comprise instruction that when executed cause the machine to deny access to the client device for the transaction in response to a determination that the one or more physical attributes indicated by the queries do not match the one or more physical attributes of the minor.
6. The non-transitory machine readable medium of claim 1 , wherein the instructions to receive from the client device the parent credentials comprise instructions that when executed cause the machine to obtain the parent credentials and the query responses from a trusted execution environment of the client device.
7. The non-transitory machine readable medium of claim 1 , wherein the instructions to receive from the client device the parent credentials comprises instructions that when executed cause the machine to obtain the parent credentials from a trusted execution environment of the client device by performing a key exchange protocol.
8. The non-transitory machine readable medium of claim 1 , wherein the queries include questions that relate to determining whether the transaction is one of the authorized activities without revealing minor identifiable information.
9. A computer system for authentication of a minor, comprising:
one or more processors; and
a memory coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause the one or more of the processors to:
receive information regarding initiation of a secure attestation session for a transaction with a client device associated with the minor, wherein the information includes one or more session keys that are signed with one or more digital signatures;
receive, from the client device, parent credentials indicative of an issuer of minor authentication information stored on the client device;
receive, from a remote device, a copy of the parent credentials indicative of a trusted guardian of the minor, wherein the remote device is part of a cloud service;
evaluate authenticity of the parent credentials with the copy of the parent credentials to determine authenticity of the issuer of the minor authentication information;
transmit one or more queries for the minor authentication information to the client device relating to the minor based on a determination that the parent credentials are authentic;
receive, from the client device, one or more query responses indicative of the minor authentication information, wherein the query responses are hashed and encoded with one or more parent credential signatures generated from the parent credentials, wherein the one or more parent credential signatures include one or more public keys of the parent credentials;
authenticate the client device to perform the transaction based on the query responses and verification of the parent credential signatures; and
generate a notification to send to a device associated with the issuer based on a determination that the client device is not authenticated to perform the transaction,
wherein the minor authentication information includes information indicative of one or more physical attributes of the minor, information indicative of one or more authorized activities for the minor, information indicative of a duration of the one or more authorized activities for the minor, or combinations thereof.
10. The computer system of claim 9 , wherein the instructions to authenticate the client device comprise instructions that when executed cause the one or more processors to:
verify the parent credential signatures with public credentials of the copy of the parent credentials; and
evaluate the query responses to determine whether the minor is authorized to perform the one or more authorized activities, wherein the query responses include answers to questions within the queries.
11. The computer system of claim 10 , wherein the instructions further comprise instruction that when executed cause the one or more processors to deny access to the client device for the transaction based on the answers included in the query responses.
12. The computer system of claim 9 , wherein the instructions to authenticate the client device comprise instructions that when executed cause the one or more processors to evaluate the query responses to determine whether one or more physical attributes indicated by the queries match one or more physical attributes of the minor, wherein the query responses include answers to questions within the queries.
13. The computer system of claim 12 , wherein the instructions further comprise instruction that when executed cause the one or more processors to deny access to the client device for the transaction in response to a determination that the one or more physical attributes indicated by the queries do not match the one or more physical attributes of the minor.
14. The computer system of claim 9 , wherein the instructions to receive from the client device comprise instructions that when executed cause the one or more processors to obtain the parent credentials and the query responses from a trusted execution environment of the client device.
15. The computer system of claim 9 , wherein the instructions to receive from the client device the parent credentials comprise instructions that when executed cause the one or more processors to obtain the parent credentials from a trusted execution environment of the client device by performing a key exchange protocol.
16. The computer system of claim 9 , wherein the queries include questions that relate to determining minor activity information without revealing minor identifiable information.
17. A method for authenticating a minor, comprising:
receiving information regarding initiation of a secure attestation session for a transaction with a client device associated with the minor, wherein the information includes one or more session keys that are signed with one or more digital signatures;
receiving, at a verifier device and from the client device, parent credentials indicative of an issuer of minor authentication information stored on the client device;
receiving, from a remote device and at the verifier device, a copy of the parent credentials indicative of a trusted guardian of the minor, wherein the remote device is part of a cloud service;
evaluating, at the verifier device, authenticity of the parent credentials with the copy of the parent credentials to determine authenticity of the issuer of the minor authentication information;
transmitting, at the verifier device, one or more queries for the minor authentication information to the client device related to the minor based on a determination that the parent credentials are authentic;
receiving, at the verifier device and from the client device, one or more query responses indicative of the minor authentication information, wherein the query responses are hashed and signed with one or more parent credential signatures generated from the parent credentials, wherein the one or more parent credential signatures include one or more public keys of the parent credentials;
authenticating, at the verifier device, the client device to perform the transaction based on query response and verification of the parent credential signatures; and
generating, at the verifier device, a notification to send to a device associated with the issuer based on a determination that the client device is denied access to perform the transaction,
wherein the minor authentication information includes information indicative of one or more physical attributes of the minor, information indicative of one or more authorized activities for the minor, information indicative of a duration of the one or more authorized activities for the minor, or
combinations thereof.
18. The method of claim 17 , wherein receiving from the client device the parent credentials comprises obtaining the parent credentials and the query responses from a trusted execution environment of the client device.
19. The method of claim 17 , wherein the queries include questions that relate to determining minor activity information without revealing minor identifiable information.
20. A computer system for authentication of a minor, comprising:
one or more processors; and
a memory coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause the one or more of the processors to:
receive, at a client device associated with a minor, parent credentials from a remote device associated with an issuer of minor activity information and minor attribute information, wherein the remote device is part of a cloud service;
receive, at the client device, the minor activity information regarding activity that is authorized for the minor from the remote device associated with the issuer;
receive, at the client device, minor attribute information regarding attributes of the minor from the remote device associated with the issuer;
initiate a secure attestation session with a verifier device that includes exchanging one or more session keys that are signed with one or more digital signatures with the verifier device;
transmit, at the client device, the parent credentials to the verifier device, wherein the parent credentials are indicative of an issuer of the minor activity information and the minor attribute information;
receive, at the client device, one or more queries from the verifier device for the minor activity information, the minor attribute information, or both after authenticating the issuer is a trusted guardian of the minor; and
transmit, to the verifier device, one or more query responses indicative of the minor activity information, the minor attribute information, or both, wherein the query responses are hashed and encoded with one or more parent credential signatures generated from the parent credentials,
wherein the one or more parent credential signatures includes one or more public keys of the parent credentials, and
wherein the query responses are configured to be evaluated to determine whether the client device is denied access to perform an activity.
21. The computer system of claim 20 , wherein the instructions further comprise instructions that when executed cause the one or more processors to receive at least one of updated minor activity information regarding the activity for the minor or updated minor attribute information regarding the attributes of the minor.
22. The computer system of claim 21 , wherein the queries include questions that relate to determining minor activity information, minor attribute information, or both without revealing minor identifiable information, and wherein the query responses include answers to the questions.
23. The computer system of claim 20 , wherein the client device receives the parent credentials, the minor activity information, and the minor attribute information from the remote device after registering a relationship between the minor and the issuer.