Portable biometric identity on a distributed data storage layer

1. A system comprising:

a data storage layer comprising linked data blocks containing data elements;

a data repository separate from the data storage layer with more restrictive access than the data storage layer;

system circuitry in communication with the data storage layer and the data repository, the system circuitry configured to:

capture biographic and/or biometric information of a user;

store the captured biographic and/or biometric information of the user in the data repository;

obtain a public key for the user;

create a digital unique identification sequence for the user seeded from the biographic and/or biometric information;

generate a token for the user based on the digital unique identification sequence;

generate an identity index for the user based on the digital unique identification sequence, wherein the identity index comprises the public key for the user and the token for the user;

digitally sign the identity index using a private key of the system and insert the signed identity index into the linked data blocks of the data storage layer;

obtain a data element identifier for the inserted identity index in the linked data blocks of the data storage layer;

generate a digital identity attestation of the identity index for the user;

digitally sign the digital identity attestation using the private key of the system;

generate a mapping between the digital unique identification sequence, the data element identifier for the inserted identity index for the user, and the biographic and/or biometric information of the user stored in the data repository;

store the mapping in the data repository while keeping the biographic and/or biometric information of a user off the linked data blocks of the data storage layer;

provide a first identity verification service based on the signed identity index stored in the linked data blocks of the data storage layer; and

provide a second identity verification service requiring higher security than the first identity verification service based on the signed identity index in stored in the linked data blocks of the data storage layer and the biographic and/or biometric information stored off the linked data blocks and in the data repository with more restrictive access.

2. The system of claim 1 , where the digital unique identification sequence is responsive to the captured biographic and/or biometric information.

3. The system of claim 1 , where the public key for the user is generated by a mobile device of the user and communicated to the system circuitry from the mobile device.

4. The system of claim 3 , where the system circuitry is further configured to securely communicate the digital identity attestation signed by the system circuitry and the data element identifier to the mobile device of the user.

5. The system of claim 1 , where the public key for the user is generated by system circuitry and where the system circuitry is further configured to:

generate a private key for the user paired with the public key for the user;

sign, using the private key of the user, the digital identity attestation signed with the private key of the system; and

securely store the digital identity attestation signed by both the private key of the user and the private key of the system in the data repository.

6. The system of claim 5 , wherein system circuitry, upon request by the user, is further configured to communicate the digital identity attestation signed using both the private key of the user and the private key of the system and the data element identifier to a service provider for an identity verification by the service provider.

7. The system of claim 1 , where the system circuitry is further configured to:

receive a consent containing digital signature by the user for a service provider to verify biographic and/or biometric information of the user;

validate the consent by verifying the digital signature of the user;

receive a set of biographic and/or biometric information captured and sent by the service provider; and

upon validation of the digital signature of the user contained in the consent:

identify the biographic and/or biometric information stored in the data repository for the user;

determine a result whether the biographic and/or biometric information stored in the data repository for the user matches the set of biographic and/or biometric information received from the service provider; and

communicate the result to the service provider.

8. The system of claim 1 , wherein the system circuitry is further configured to:

provide identity account for the user;

accept a request for access the identity account from the user; and

communicate the data element identifier and the signed attestation to a service provider upon an instruction from the user when accessing the identity account.

9. A method comprising:

in system circuitry in communication with a data storage layer comprising linked data blocks containing data elements and a data repository separate from the data storage layer with more restrictive access than the data storage layer:

capturing biographic and/or biometric information of a user;

storing the captured biographic and/or biometric information of the user in the data repository;

obtaining a public key for the user;

creating a digital unique identification sequence for the user seeded from the biographic and/or biometric information;

generating a token for the user based on the digital unique identification sequence;

generating an identity index for the user based on the digital unique identification sequence, wherein the identity index comprises the public key for the user and the token for the user;

digitally signing the identity index using a private key of the system circuitry and insert the signed identity index into the linked data blocks of the data storage layer;

obtaining a data element identifier for the inserted identity index in the linked data blocks of the data storage layer;

generating a digital identity attestation of the identity index for the user;

digitally signing the digital identity attestation using the private key of the system;

generating a mapping between the digital unique identification sequence, the data element identifier for the inserted identity index for the user, and the biographic and/or biometric information of the user stored in the data repository;

storing the mapping in the data repository while keeping the biographic and/or biometric information of a user off the linked data blocks of the data storage layer;

providing a first identity verification service based on the signed identity index stored in the linked data blocks of the data storage layer; and

providing a second identity verification service requiring higher security than the first identity verification service based on the signed identity index in stored in the linked data blocks of the data storage layer and the biographic and/or biometric information stored off the linked data blocks and in the data repository with more restrictive access.

10. The method of claim 9 , where the digital unique identification sequence is responsive to the captured biographic and/or biometric information.

11. The method of claim 9 , where the public key for the user is generated by a mobile device of the user and communicated to the system circuitry from the mobile device.

12. The method of claim 11 , further comprising securely communicating the digital identity attestation signed by the system circuitry and the data element identifier to the mobile device of the user.

13. The method of claim 9 , where the public key for the user is generated by system circuitry and where the method further comprises:

generating a private key for the user paired with the public key for the user;

signing, using the private key of the user, the digital identity attestation signed with the private key of the system; and

securely storing the digital identity attestation signed using both the private key of the user and the private key of the system in the data repository.

14. The method of claim 13 , further comprising communicating the digital identity attestation signed using both the private key of the user and the private key of the system and the data element identifier to a service provider for an identity verification by the service provider upon a user request.

15. The method of claim 9 , further comprising:

receiving a consent containing digital signature by the user for a service provider to verify biographic and/or biometric information of the user;

validating the consent by verifying the digital signature of the user;

receiving a set of biographic and/or biometric information captured and sent by the service provider; and

upon validating the digital signature of the user contained in the consent:

identifying the biographic and/or biometric information stored in the data repository for the user;

determining a result whether the biographic and/or biometric information stored in the data repository for the user matches the set of biographic and/or biometric information received from the service provider; and

communicating the result to the service provider.

16. The method of claim 9 , further comprising:

providing identity account for the user;

accepting a request for access the identity account from the user; and

communicating the data element identifier and the signed attestation to a service provider upon an instruction from the user when accessing the identity account.