User authentication for digital identifications

Patent metadata

Field	Value
Publication number	US-11615199-B1
Application number	US-201815973181-A
Country	US
Kind code	B1
Filing date	May 7, 2018
Priority date	Dec 31, 2014
Publication date	Mar 28, 2023
Grant date	Mar 28, 2023

Abstract

In general, one innovative aspect of the subject matter described in this specification may be embodied in methods that may include designating specific information within a digital identification as secure user information and designating other specific information as non-secure user information, and provisioning user-specific authentication techniques to restrict unauthorized access to the secure user information. For instance, the secure user information may be prevented from being displayed on the digital identification without the submission of an access credential such as a user-specified code or a user biometric identifier.

First claim

What is claimed is:

1. A computer-implemented method comprising:
assigning, by a server system, a time-varying security status to a digital identification to be provided to a computing device of a user, the time-varying security status specifying at least (i) a first subset of personal data of the user comprising personal data that the user has selected as not representing private data, and (ii) a second subset of personal data of the user comprising personal data that the user has selected as representing private data;
selecting, by the server system and based on the first subset of personal data, a first visible indicator subset, of a plurality of visible indicators, for a first version of the digital identification;
generating, by the server system, a first access credential that permits access to the first version of the digital identification configured to provide access to the first and second subsets of personal data, wherein the first version of the digital identification includes the first visible indicator subset, and wherein the first access credential comprises a static credential that is associated with the digital identification irrespective of the time-varying security status assigned to the digital identification;
selecting, by the server system and based on the second subset of personal data, a second visible indicator subset, of the plurality of visible indicators, for a second version of the digital identification;
generating, by the server system and based on the time-varying security status assigned to the digital identification, a second access credential that permits access to the second version of the digital identification configured to provide access to the first subset of personal data and restrict access to the second subset of personal data, wherein the second version of the digital identification includes the second visible indicator subset, and wherein the second access credential comprises a variable credential that is periodically adjusted based on the time-varying security status assigned to the digital identification;
receiving, by the server system, a request to access contents of the digital identification, the request including a submitted access credential;
determining, by the server system, the submitted access credential corresponds to the first access credential or the second access credential; and
providing, by the server system and based on determining the submitted access credential corresponds to the first access credential or the second access credential, access to either the first version of the digital identification including the first visible indicator subset or the second version of the digital identification including the second visible indicator subset, wherein the first visible indicator subset is associated with a first security level, and wherein the second visible indicator subset is associated with a second security level.

2. The method of claim 1 , wherein:
determining the submitted access credential corresponds to the first access credential or the second access credential comprises determining that the submitted access credential corresponds to the first access credential; and
providing access to either the first version or the second version of the digital identification comprises providing, for output to the computing device, an instruction to display the first subset of personal data on a screen of the computing device.

3. The method of claim 1 , wherein:
determining the submitted access credential corresponds to the first access credential or the second access credential comprises determining that the submitted access credential corresponds to the second access credential; and
providing a specified type of access to the digital identification comprises providing the second subset of personal data to another device other than the computing device.

4. The method of claim 1 , wherein the first access credential or the second access credential comprises at least one of a password or a biometric input of the user.

5. The method of claim 1 , wherein the second access credential is associated with law enforcement officers.

6. The method of claim 1 , wherein
the first subset of personal data of the user comprises user data that is presented on the digital identification; and
the second subset of personal data of the user comprises user data that is used to verify a digital identity associated with the user.

7. The method of claim 1 , further comprising:
generating, by the server system, a third access credential that permits access to a third subset of personal data that is different from each of the first subset of personal data and the second subset of personal data.

8. The method of claim 1 , wherein the second subset of personal data is encrypted using the second access credential.

9. The method of claim 1 , comprising:
receiving, from the computing device, user input defining types of items in the digital identification to include in the first subset of personal data or the second subset of personal data.

10. The method of claim 1 , comprising:
receiving data defining types of items in the digital identification to include in the first subset of personal data or the second subset of personal data.

11. A system comprising:
one or more computers; and
a non-transitory computer-readable medium coupled to the one or more computers having instructions stored thereon, which, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
assigning, by a server system, a time varying security status to a digital identification to be provided to a computing device of a user, the time varying security status specifying at least (i) a first subset of personal data of the user comprising personal data that the user has selected as not representing private data, and (ii) a second subset of personal data of the user comprising personal data that the user has selected as representing private data;
selecting, by the server system and based on the first subset of personal data, a first visible indicator subset, of a plurality of visible indicators, for a first version of the digital identification;
generating, by the server system, a first access credential that permits access to the first version of the digital identification configured to provide access to the first and second subsets of personal data, wherein the first version of the digital identification includes the first visible indicator subset, and wherein the first access credential comprises a static credential that is associated with the digital identification irrespective of the time varying security status assigned to the digital identification;
selecting, by the server system and based on the second subset of personal data, a second visible indicator subset, of the plurality of visible indicators, for a second version of the digital identification;
generating, by the server system, a second access credential that permits access to the second version of the digital identification configured to provide access to the first subset of personal data and restrict access to the second subset of personal data, wherein the second version of the digital identification includes the second visible indicator subset, and wherein the second access credential comprises a variable credential that is periodically adjusted based on a particular security status assigned to the digital identification;
receiving, by the server system, a request to access contents of the digital identification, the request including a submitted access credential;
determining, by the server system, the submitted access credential corresponds to the first acce

Assignees

• Idemia Identity & Security USA LLC

Inventors

• Poder Daniel
• Huber Richard Austin

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title