Privacy-preserving assertion system and method

1. A method comprising:

receiving, by a server computer from a relying entity, a request for assertions associated with a target entity, wherein the request for assertions includes an identifier of the relying entity and a hash of an identifier of an account;

determining, by the server computer, an assertions model based on the identifier of the relying entity;

retrieving, by the server computer, a package of assertions associated with the account based on the assertions model and the hash of the identifier of the account, wherein the assertions model comprises one or more assertion values, and wherein the one or more assertion values are secure facts about the target entity that are based on, and different from, underlying identity attribute data;

encrypting, by the server computer, the package of assertions using a public key of the relying entity and a public key of the target entity; and

transmitting, by the server computer, the package of assertions to the relying entity.

2. The method of claim 1 , wherein the request for assertions further comprises an identifier of the target entity associated with the account, and retrieving the package of assertions by the server computer is further based on the identifier of the target entity.

3. The method of claim 2 , further comprising:

determining the target entity is associated with the account based on the identifier of the target entity and the hash of the identifier of the account.

4. The method of claim 1 , wherein the assertions model specifies a plurality of assertion types, and the method further comprises:

for each assertion type, of the plurality of assertion types:

determining a type of identity attribute corresponding to the assertion type;

obtaining identity attribute data associated with the account and the type of identity attribute; and

calculating an assertion value corresponding to the assertion type based on the identity attribute data associated with the account; and

storing the assertion value.

5. The method of claim 1 , wherein the identifier of the account is a human-recognizable moniker configured by the target entity associated with the account.

6. The method of claim 1 , wherein the identifier of the account is a primary account number associated with the account.

7. The method of claim 1 , wherein the assertions model defines assertions which the relying entity is entitled to receive.

8. The method of claim 1 , wherein the package of assertions comprises an assertion that the account is configured to accept deposits.

9. The method of claim 1 , wherein:

the request for assertions further comprises an identifier of the target entity associated with the account; and

the package of assertions further comprises an assertion that the account belongs to the target entity.

10. The method of claim 9 , wherein the package of assertions further comprises an assertion that the target entity has had a relationship with an authorizing entity associated with the account for a threshold time period.

11. The method of claim 9 , wherein the package of assertions further comprises an assertion that the target entity has current active account relationship with an authorizing entity associated with the account.

12. The method of claim 1 , wherein the package of assertions associated with the account is stored in association with a token which is a substitute value for a primary account number, and the server computer refrains from storing the primary account number.

13. The method of claim 1 , wherein retrieving the package of assertions associated with the account further comprises:

identifying a saved token stored in association with a hash value matching the hash of the identifier of the account; and

determining one or more assertions linked to the saved token.

14. The method of claim 1 , further comprising:

receiving, from the target entity associated with the account, a primary account number;

generating a token based on at least the primary account number; and

storing the token.

15. The method of claim 1 , further comprising:

calculating a strength score for the package of assertions; and

transmitting the strength score to the relying entity.

16. The method of claim 1 , wherein the package of assertions comprises a singular answer based a plurality of underlying assertion values.

17. The method of claim 1 , wherein the package of assertions comprises a plurality of assertion values, and at least one assertion value, of the plurality of assertion values, comprises an expiration date.

18. The method of claim 1 , further comprising generating an event in an event log, the event being associated with the transmitting of the package of assertions.

19. A system comprising a server computer comprising:

a processor; and

a non-transitory computer-readable medium comprising code, executable by the processor, to implement a method comprising:

receiving, from a relying entity, a request for assertions associated with a target entity, wherein the request for assertions includes an identifier of the relying entity and a hash of an identifier of an account;

determining an assertions model based on the identifier of the relying entity;

retrieving a package of assertions associated with the account based on the assertions model and the hash of the identifier of the account, wherein the assertions model comprises one or more assertion values, and wherein the one or more assertion values are secure facts about the target entity that are based on, and different from, underlying identity attribute data;

encrypting, by the server computer, the package of assertions using a public key of the relying entity and a public key of the target entity; and

transmitting the package of assertions to the relying entity.

20. A method comprising:

transmitting, by a client computer of a relying entity to a server computer, a request for assertions associated with a target entity, wherein the request for assertions includes an identifier of the relying entity and a hash of an identifier of an account; and

receiving, from the server computer, a package of assertions associated with the account, wherein the package of assertions was retrieved by the server computer based on the hash of the identifier of the account and an assertions model determined by the server computer based on the identifier of the relying entity, wherein the assertions model comprises one or more assertion values, wherein the one or more assertion values are secure facts about the target entity that are based on, and different from, underlying identity attribute data, and wherein the server computer encrypted the package of assertions using a public key of the relying entity and a public key of the target entity.