System and method for storing and distributing consumer information
A computer implemented system for controlling access to data associated with an entity includes a data storage device having a protected memory region, and one or more processors, at least one of which is operable in the protected memory region. The one or more processors are configured for: storing a secret key associated with the entity in a portion of the protected memory region associated with the entity; upon receiving entity data, storing the entity data in the portion of the protected memory region associated with the entity; and upon receiving an access grant signal, generating a smart contract, the smart contract defining the entity data to be accessed and a recipient of the entity data to be accessed.
1. A computer implemented system for controlling access to data associated with an entity, the system comprising:
a data storage device having a protected memory region;
one or more processors, at least one of which is operable in the protected memory region and configured for:
storing a secret key associated with the entity in a portion of the protected memory region associated with the entity, wherein a public key corresponding to the secret key is stored on a client device associated with the entity;
upon receiving entity data associated with the entity, storing the entity data in the portion of the protected memory region associated with the entity; and
upon receiving an access grant signal from the client device, the access grant signal defining the entity data to be accessed and a recipient of the entity data to be accessed and signed by the public key, enabling communication of information associated with the entity data to a recipient device upon satisfaction of at least one verification condition by the recipient device in accordance with a verification sequence using the secret key stored in the portion of the protected memory region associated with the entity.
2. The system of claim 1 , wherein the system comprises a trusted execution environment including the protected memory region, the protected memory region inaccessible to the one or more processors when operating outside the trusted execution environment; wherein at least one processor configured to operating inside the trusted execution environment is configured to:
generate the information associated with the entity data within the trusted execution environment, and passing the information associated with the entity data for communication outside the trusted execution environment.
3. The system of claim 1 , wherein the information associated with the entity data is a token, derivative data, or is encrypted data based on the entity data.
4. The system of claim 1 , wherein the entity data includes one or more token data objects received from or computed jointly in a multiparty protocol with an issuer computing device, the one or more token data objects generated using at least an issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the entity.
5. The system of claim 1 , wherein the entity data is generated by an issuer computing device using the public key associated with the entity and a key associated with the issuer.
6. The system of claim 1 , wherein the at least one processor operable in the protected memory region is configured for: generating a log of activity associated with the entity data.
7. The system of claim 1 , wherein the one or more processors are configured to set, and enforce access controls based on at least one key associated with the entity.
8. The system of claim 7 , wherein the one or more processors are configured to generate one or more access tokens for accessing the portion of the protected memory region associated with the entity.
9. The system of claim 1 , wherein the at least one verification condition is met when the one or more processors generate a verification request data message, and receive a proof data message from the recipient device.
10. The system of claim 9 , wherein the verification request data message includes at least a nonce c 0 ; and a client computing device processor is configured to:
compute t=x −1 mod p, where x is an attribute value from the one or more token data objects, and p is an order of the discrete log group; t is a modular inverse of x mod p;
uniformly sample a first random number r 1 and a second random number, r 2 , such that r 1 , r 2 ∈ p ;
compute R=C x r 1 h r 2 , where R is a commitment to random values r 1 and r 2 , C x is a commitment to attribute x, h is a group generator;
compute c=H(C x , R, c 0 ), where c is a proof challenge, based at least on the Fiat-Shamir Heuristic;
compute z 1 =ct+r 1 and z 2 =−cty+r 2 , where z 1 and z 2 are proof responses based on a Sigma protocol; and
encapsulate and transmit the one or more proof data messages including R, z 1 and z 2 as data objects to the verifier computing device, such that the verifier computing device is able to compute c=H(C x , R, c 0 ) and confirm that g c R=C x z 1 h z 2 , the verifier computing device controlling provisioning of access to a secured resource responsive to the confirmation that g c R=C x z 1 h z 2 .
11. A method for controlling access to data associated with an entity, the method comprising:
storing a secret key associated with the entity in a portion of a protected memory region associated with the entity, wherein a public key corresponding to the secret key is stored on a client device associated with the entity;
upon receiving entity data associated with the entity, storing the entity data in the portion of the protected memory region associated with the entity; and
upon receiving an access grant signal from the client device, the access grant signal defining the entity data to be accessed and a recipient of the entity data to be accessed and signed by the public key, communicating information associated with the entity data to a recipient device upon satisfaction of at least one verification condition by the recipient device in accordance with a verification sequence using the secret key stored in the portion of the protected memory region associated with the entity.
12. The method of claim 11 , comprising: generating the information associated with the entity data within a trusted execution environment, and passing the information associated with the entity data for communication outside the trusted execution environment.
13. The method of claim 11 , wherein the information associated with the entity data is a token, derivative data, or is encrypted data based on the entity data.
14. The method of claim 11 , wherein the entity data includes one or more token data objects received from or computed jointly in a multiparty protocol with an issuer computing device, the one or more token data objects generated using at least an issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the entity.
15. The method of claim 11 , wherein the entity data is generated by an issuer computing device using the public key associated with the entity and a key associated with the issuer.
16. The method of claim 11 , comprising generating a log of activity associated with the entity data in the protected memory region.
17. The method of claim 11 , comprising enforcing access controls based on at least one key associated with the entity.
18. The method of claim 17 , comprising generate one or more access tokens for accessing the portion of the protected memory region associated with the entity.
19. The method of claim 11 , wherein the at least one verification condition is met when the one or more processors generate a verification request data message, and receive a proof data message from the recipient device.
20. A non-transitory computer readable medium or media having stored thereon machine interpretable instructions, which when executed, cause at least one processor to
store a secret key associated with the entity in a portion of a protected memory region associated with the entity, wherein a public key corresponding to the secret key is stored on a client device associated with the entity;
upon receiving entity data associated with the entity, store the entity data in the portion of the protected memory region associated with the entity; and
upon receiving an access grant signal from the client device, the access grant signal defining the entity data to be accessed and a recipient of the entity data to be accessed and signed by the public key, communicating information associated with the entity data to a recipient device upon satisfaction of at least one verification condition by the recipient device in accordance with a verification sequence using the secret key stored in the portion of the protected memory region associated with the entity.