System and method for storing and distributing consumer information
A computer implemented system for controlling access to data associated with an entity includes a data storage device having a computer memory, and one or more processors. The one or more processors are configured for: storing a secret key associated with the entity in a computer memory associated with the entity; upon receiving entity data, storing the entity data in the computer memory; and upon receiving an access grant signal, enabling communication of information relating to the entity data.
1. A computer implemented system for controlling access to data associated with an entity, the computer implemented system comprising:
a data storage device stored within a computer;
one or more processors within the computer configured for:
storing a secret key associated with the entity in a computer memory within the data storage device, wherein a public key corresponding to the secret key is stored on a client device associated with the entity;
upon receiving entity data associated with the entity, storing the entity data in the computer memory; and
upon receiving an access grant signal from the client device, the access grant signal defining the entity data to be accessed and a recipient of the entity data to be accessed and signed by the public key, enabling communication of information associated with the entity data, comprising a token or data derived from the entity data, to a recipient device in the form of data fields upon satisfaction of at least one verification condition by the recipient device in accordance with a verification sequence using the secret key stored in the computer memory.
2. The system of claim 1 , wherein the system comprises a trusted execution environment including a protected memory region, the protected memory region inaccessible to the one or more processors when operating outside the trusted execution environment; wherein at least one processor configured to operating inside the trusted execution environment is configured to:
generate the information associated with the entity data within the trusted execution environment, and passing the information associated with the entity data for communication outside the trusted execution environment.
3. The system of claim 1 , wherein the information associated with the entity data is a token, derivative data, or is encrypted data based on the entity data.
4. The system of claim 1 , wherein the entity data includes one or more token data objects received from or computed jointly in a multiparty protocol with an issuer computing device, the one or more token data objects generated using at least an issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the entity.
5. The system of claim 1 , wherein the entity data is generated by an issuer computing device using the public key associated with the entity and a key associated with the issuer.
6. The system of claim 1 , wherein the one or more processors is configured for: generating a log of activity associated with the entity data.
7. The system of claim 1 , wherein the one or more processors are configured to set, and enforce access controls based on at least one of the secret and public keys associated with the entity.
8. The system of claim 7 , wherein the one or more processors are configured to generate one or more access tokens for accessing the computer memory.
9. The system of claim 1 , wherein the at least one verification condition is met when the one or more processors generate a verification request data message, and receive a proof data message from the recipient device.
10. The system of claim 9 , wherein the verification request data message includes at least a nonce c 0 ; and a client computing device processor is configured to:
compute t=x −1 mod p, where x is an attribute value from the one or more token data objects, and p is an order of the discrete log group; t is a modular inverse of x mod p;
uniformly sample a first random number r and a second random number, r 2 , such that r 1 , r 2 ∈ p ;
compute R=C x r 1 h r 2 , where R is a commitment to random values r and r 2 , C x is a commitment to attribute x, h is a group generator;
compute c=H (C x , R, c 0 ), where c is a proof challenge, based at least on the Fiat-Shamir Heuristic;
compute z 1 =ct+r 1 and z 2 =−cty+r 2 , where z 1 and z 2 are proof responses based on a Sigma protocol; and
encapsulate and transmit the one or more proof data messages including R, z 1 and z 2 as data objects to the verifier computing device, such that the verifier computing device is able to compute c=H (C x , R, c 0 ) and confirm that g c R=C x z 1 h z 2 , the verifier computing device controlling provisioning of access to a secured resource responsive to the confirmation that g c R=C x z 1 h z 2 .
11. A method for controlling access to data associated with an entity, the method comprising:
storing a secret key associated with the entity in computer memory within a data storage device, wherein a public key corresponding to the secret key is stored on a client device associated with the entity;
upon receiving entity data associated with the entity, storing the entity data in the computer memory; and
upon receiving an access grant signal from the client device, the access grant signal defining the entity data to be accessed and a recipient of the entity data to be accessed and signed by the public key, communicating information associated with the entity data, comprising a token or data derived from the entity data, to a recipient device in the form of data fields upon satisfaction of at least one verification condition by the recipient device in accordance with a verification sequence using the secret key stored in the computer memory.
12. The method of claim 11 , comprising: generating the information associated with the entity data within a trusted execution environment, and passing the information associated with the entity data for communication outside the trusted execution environment.
13. The method of claim 11 , wherein the information associated with the entity data is a token, derivative data, or is encrypted data based on the entity data.
14. The method of claim 11 , wherein the entity data includes one or more token data objects received from or computed jointly in a multiparty protocol with an issuer computing device, the one or more token data objects generated using at least an issuer computing device private issuance key, the one or more token data objects each including one or more signed data elements representing at least one of the one or more characteristics of the entity.
15. The method of claim 11 , wherein the entity data is generated by an issuer computing device using the public key associated with the entity and a key associated with the issuer.
16. The method of claim 11 , comprising generating a log of activity associated with the entity data.
17. The method of claim 11 , comprising enforcing access controls based on at least one of the secret and public key associated with the entity.
18. The method of claim 17 , comprising generate one or more access tokens for accessing the computer memory.
19. The method of claim 11 , wherein the at least one verification condition is met when the one or more processors generate a verification request data message, and receive a proof data message from the recipient device.
20. A non-transitory computer readable medium or media having stored thereon machine interpretable instructions, which when executed, cause at least one processor to
store a secret key associated with the entity in a data storage device;
upon receiving entity data associated with the entity, store the entity data in the data storage device; and
upon receiving an access grant signal from the client device, the access grant signal defining the entity data to be accessed and a recipient of the entity data to be accessed and signed by the public key, communicating information associated with the entity data, comprising a token or data derived from the entity data, to a recipient device in the form of data fields upon satisfaction of at least one verification condition by the recipient device in accordance with a verification sequence using the secret key stored in the data storage device.