Blockchain systems and methods for user authentication

Patent metadata

Field	Value
Publication number	US-2017366348-A1
Application number	US-201715626054-A
Country	US
Kind code	A1
Filing date	Jun 16, 2017
Priority date	Jun 17, 2016
Publication date	Dec 21, 2017
Grant date	—

Abstract

Computer-implemented methods and systems are provided for blockchain-mediated user authentication. Consistent with disclosed embodiments, authentication may comprise operations including receiving, from a user system, an authentication request for a user. The operations may also include determining a root system for the user using a blockchain, and redirecting the user system to the root system. The operations may include receiving, following redirection, a verification message indicating that the root system successfully authenticated the user, and including an authorization code for receiving, from the root system, a root system secret. The operations may include receiving from a database, identification data using the root system secret. Determining the root system may comprise identifying, using the authentication request and index information stored in the blockchain, a block of the blockchain storing root system information for the user. Receiving the identification data may comprise retrieving identification data from the database.

First claim

What is claimed is:

1 . An authentication system comprising:
at least one processor; and at least one non-transitory memory containing instructions that, when executed by the at least one processor, cause the authentication system to:
receive, from a user system, an authentication request for a user;
determine a root system for the user using a blockchain;
redirect the user system to the root system;
receive, from the root system, a root system secret; and
receive, from a database, identification data using the root system secret.

2 . The authentication system of claim 1 , wherein determining the root system comprises identifying, using the authentication request and index information stored in the blockchain, a block of the blockchain storing root system information for the user.

3 . The authentication system of claim 1 , wherein the root system secret comprises a root system key, and wherein receiving the identification data comprises retrieving encrypted identification data from the database, and decrypting the encrypted identification data using the root system key.

4 . The authentication system of claim 1 , wherein the memory contains further instructions that, when executed by the at least one processor, cause the authentication system to:
receive, following redirection, a verification message indicating that the root system successfully authenticated the user.

5 . The authentication system of claim 4 , wherein the verification message indicates multi-factor authentication of the user by the root system.

6 . The authentication system of claim 4 , wherein the verification message comprises an authorization code for receiving, from the root system, the root system secret.

7 . The authentication system of claim 1 , wherein the memory contains further instructions that, when executed by the at least one processor, cause the authentication system to:
write authentication information to the blockchain, the authentication information comprising index information and an authentication record.

8 . The authentication system of claim 7 , wherein the authentication record comprises an indication of the at least one of the user, the authentication system, the root system, a purpose of the authentication request, and a result of the authentication request.

9 . The authentication system of claim 7 , wherein writing the authentication information to the blockchain comprises providing the authentication information to an authorized system that adds a block storing the authentication information to the blockchain.

10 . The authentication system of claim 7 , wherein writing the authentication information to the blockchain comprises adding a block storing the authentication information to the blockchain, the block satisfying at least one of a proof-of-work condition and a digital signature condition.

11 . The authentication system of claim 1 , wherein the root system secret comprises an authorization token for receiving, from the database, the identification data.

12 . The authentication system of claim 11 , wherein the root system comprises an OIDC endpoint, and wherein the authorization token comprises an OAuth Authorization Security Token.

13 . An authentication system comprising:
at least one processor; and at least one non-transitory memory containing instructions that, when executed by the at least one processor, cause the authentication system to:
receive personal information for a user;
generate identification data and index information for the user using the received personal information;
write the root system information and the index information to a blockchain;
encrypt the identification data using a root system key; and
store the encrypted identification data in a database.

14 . The authentication system of claim 13 , wherein writing the root system information and the index information to the blockchain comprises providing the root system information and the index information to an authorized system that adds a block storing the root system information and the index information to the blockchain.

15 . The authentication system of claim 13 , wherein writing the root system information and the index information to the blockchain comprises adding a block storing the root system information and the index information to the blockchain, the block satisfying at least one of a proof-of-work condition and a digital signature condition.

16 . The authentication system of claim 13 , wherein the memory contains further instructions that, when executed by the at least one processor, cause the authentication system to:
determine initially that the blockchain lacks a block storing root system information of the user.

17 . The authentication system of claim 13 , wherein the memory contains further instructions that, when executed by the at least one processor, cause the authentication system to:
receive, from a user system redirected by a member system, an authentication request for the user; and provide, to the member system, a verification message indicating multi-factor authentication of the user.

18 . The authentication system of claim 17 , wherein providing the verification message comprises providing an authorization code to the member system.

19 . The authentication system of claim 17 , wherein the memory contains further instructions that, when executed by the at least one processor, cause the authentication system to:
provide, to the member system, an authorization token and the root system key for decrypting the encrypted identification data.

20 . The authentication system of claim 19 , the wherein the authentication system comprises an OIDC endpoint, and wherein the authorization token is an Oauth Authorization Security Token.

21 . The authentication system of claim 19 , wherein decryption of the encrypted identification data requires a root system salt, and the operations further comprise providing, to the member system, the root system salt for decrypting the encrypted identification data.

22 . The authentication system of claim 13 , wherein the index information comprises obfuscated or encrypted non-sensitive personal information of the user.

23 . The authentication system of claim 22 , wherein generating the index information comprises encrypting the index information with a symmetric key or a private key.

24 . The authentication system of claim 22 , wherein the non-sensitive personal information of the user comprises at least one of a full name, e-mail, and phone number of the user.

25 . The authentication system of claim 13 , wherein the identification data comprises sensitive personal information of the user.

26 . The authentication system of claim 25 , wherein the sensitive personal information of the user comprises at least one of social security number, address, taxpayer identification number, and identify verification method.

Assignees

• Capital One Services Llc

Inventors

• Weimer Jonathan
• Fox Ryan

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/3213 Primary

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• G06F21/31

  User authentication · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/3247

  involving digital signatures · CPC title