Granted Patent B2

US 12,225,129 · App. 18/385,470 · Granted Feb 11, 2025

Inventors: Bryn Anthony Robinson-Morgan (Mosborough Village, GB); Prashant Sharma (Madison, NJ); Liang Tian (Rye Brook, NY)

Assignee: Mastercard International Incorporated

H04L9/14G06F16/9566G06Q30/018G06Q50/265H04L9/0819H04L9/0894H04L63/0428

Abstract

Claims (96)

1. A method, comprising:

receiving a compliance data package from a user, wherein the compliance data package comprises encrypted evidence data corresponding to digital identity data of the user;

encrypting the compliance data package using a first cryptographic key;

generating a plurality of key shards based on the first cryptographic key, wherein the plurality of key shards comprises a user key shard, a requestor key shard, and a regulator key shard;

generating an encrypted unlock data package based on the requestor key shard; and

transmitting the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the user.

2. The method of claim 1 , wherein:

the digital identity data comprises data relating to identity information of the user in a decentralized identity system;

the first cryptographic key is configured to be reconstructed based on at least two of the plurality of key shards; or

combinations thereof.

3. The method of claim 1 , wherein:

the encrypted evidence data comprises evidence data encrypted using a requestor public key of a requestor public-private key pair; and

the compliance data package further comprises a user signature generated based on the evidence data, an algorithm, a user private key of a user public-private key pair, or combinations thereof.

4. The method of claim 3 , further comprising:

receiving signature details data from the user, wherein the signature details data comprises data relating to the algorithm, the user private key, or combinations thereof; and

generating a regulator identifier corresponding to a regulator.

5. The method of claim 4 , further comprising:

receiving regulator endpoint data from the user, wherein the regulator endpoint data comprises data relating to a Uniform Resource Locator (URL) of a regulator, a name of the regulator, contact information for the regulator, or combinations thereof; and

transmitting the regulator key shard and the regulator identifier to the regulator based on the regulator endpoint data.

6. The method of claim 4 , wherein generating the encrypted unlock data package comprises:

generating an unlock data package, wherein the unlock data package comprises the requestor key shard, the signature details data, and the regulator identifier; and

encrypting the unlock data package using a platform public key of a platform public-private key pair.

7. The method of claim 6 , further comprising:

receiving the encrypted unlock data package from a requestor;

decrypting the received encrypted unlock data package using a platform private key of the platform public-private key pair;

retrieving the regulator identifier from the decrypted unlock data package; and

transmitting the retrieved regulator identifier to the requestor.

8. The method of claim 7 , further comprising:

receiving the regulator key shard, the encrypted unlock data package, and the encrypted compliance data package from the requestor;

retrieving the requestor key shard and the signature details data from the decrypted unlock data package;

reconstructing the first cryptographic key based on the received regulator key shard and the retrieved requestor key shard;

decrypting the encrypted compliance data package using the reconstructed first cryptographic key;

retrieving the user signature and the encrypted evidence data from the decrypted compliance data package;

validating the retrieved user signature based on the retrieved signature details data; and

transmitting the retrieved encrypted evidence data to the requestor based on the validation.

9. The method of claim 6 , further comprising:

receiving the user key shard, the encrypted unlock data package, and the encrypted compliance data package from a requestor;

decrypting the received encrypted unlock data package using a platform private key of the platform public-private key pair;

retrieving the requestor key shard and the signature details data from the decrypted unlock data package;

reconstructing the first cryptographic key based on the received user key shard and the retrieved requestor key shard;

decrypting the encrypted compliance data package using the reconstructed first cryptographic key;

retrieving the user signature and the encrypted evidence data from the decrypted compliance data package;

validating the retrieved user signature based on the retrieved signature details data; and

transmitting the retrieved encrypted evidence data to the requestor based on the validation.

10. A method, comprising:

transmitting identity request data to a user, wherein the identity request data comprises data indicating a request for digital identity data of the user and a compliance data package, and wherein the compliance data package comprises encrypted evidence data corresponding to the digital identity data;

receiving the digital identity data, an encrypted unlock data package, and an encrypted compliance data package from the user, wherein:

the encrypted compliance data package comprises the compliance data package encrypted using a first cryptographic key of a compliance platform; and

the encrypted unlock data package comprises an unlock data package encrypted using a second cryptographic key of the compliance platform, and wherein the unlock data package comprises a requestor key shard corresponding to the first cryptographic key; and

storing the digital identity data, the encrypted unlock data package, and the encrypted compliance data package.

11. The method of claim 10 , wherein transmitting the identity request data comprises:

receiving access request data from the user, wherein the access request data comprises data indicating a request by the user for access to one or more resources; and

transmitting the identity request data to the user in response to the access request data.

12. The method of claim 10 , wherein the second cryptographic key comprises a platform public key of a platform public-private key pair.

13. The method of claim 10 , further comprising:

transmitting the encrypted unlock data package to the compliance platform;

receiving a regulator identifier from the compliance platform;

transmitting the regulator identifier to a regulator;

receiving a regulator key shard from the regulator, wherein the regulator key shard corresponds to the first cryptographic key; and

transmitting the regulator key shard, the encrypted unlock data package, and the encrypted compliance data package to the compliance platform.

14. The method of claim 13 , further comprising:

receiving the encrypted evidence data from the compliance platform;

decrypting the encrypted evidence data using a requestor private key of a requestor public-private key pair; and

verifying the digital identity data based on the decrypted evidence data.

15. The method of claim 10 , wherein the encrypted evidence data comprises evidence data encrypted using a requestor public key of a requestor public-private key pair.

16. The method of claim 15 , further comprising:

receiving user evidence request data from the user, wherein the user evidence request data comprises data corresponding to a request by the user for the evidence data;

transmitting user key request data to the user, wherein the user key request data comprises data corresponding to a request for a user key shard corresponding to the first cryptographic key;

receiving the user key shard from the user; and

transmitting the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the compliance platform.

17. The method of claim 16 , further comprising:

receiving the encrypted evidence data from the compliance platform;

decrypting the encrypted evidence data using a requestor private key of a requestor public-private key pair; and

transmitting the decrypted evidence data to the user.

18. A system, comprising:

a compliance platform, comprising:

one or more first processors; and

at least a first memory comprising a plurality of first program instructions which, when executed by the one or more first processors, cause the one or more first processors to:

receive a compliance data package from a user, wherein the compliance data package comprises encrypted evidence data corresponding to digital identity data of the user;

encrypt the compliance data package using a first cryptographic key;

generate a plurality of key shards based on the first cryptographic key, wherein the plurality of key shards comprises a user key shard, a requestor key shard, and a regulator key shard;

generate an encrypted unlock data package based on the requestor key shard; and

transmit the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the user; and

a requestor, comprising:

one or more second processors; and

at least a second memory comprising a plurality of second program instructions which, when executed by the one or more second processors, cause the one or more second processors to:

transmit identity request data to the user, wherein the identity request data comprises data indicating a request for the digital identity data and the compliance data package;

receive the digital identity data, the encrypted unlock data package, and the encrypted compliance data package from the user; and

store the digital identity data, the encrypted unlock data package, and the encrypted compliance data package.

19. The system of claim 18 , wherein:

the digital identity data comprises data relating to identity information of the user in a decentralized identity system;

the first cryptographic key is configured to be reconstructed based on at least two of the plurality of key shards; or

combinations thereof.

20. The system of claim 18 , wherein:

the encrypted evidence data comprises evidence data encrypted using a requestor public key of a requestor public-private key pair; and

the compliance data package further comprises a user signature generated based on the evidence data, an algorithm, a user private key of a user public-private key pair, or combinations thereof.

Continuity (2)

References Cited (40)