SYSTEMS AND METHODS FOR DECENTRALIZED RECOVERY OF IDENTITY ATTRIBUTES

Systems and methods for decentralized recovery of identity attributes are disclosed. In one embodiment, a method for decentralized storage of identity data may include: (1) receiving, at an identity management computer program executed by a computer processor, identity data from a user electronic device; (2) parsing, by the identity management computer program, the identity data into a plurality of portions; (3) mapping, by the identity management computer program, each portion to one of a plurality of storage locations; and (4) storing, by the identity management computer program, the plurality of portions to the plurality of storage locations based on the mapping.

BACKGROUND OF THE INVENTION

1. Field of the Invention

Embodiments relate generally to systems and methods for decentralized recovery of identity attributes.

2. Description of the Related Art

An individual's identity information, which may include Personally Identifiable Information (PII), may be stored on various devices. Individuals often store this information on their mobile electronic devices. If the mobile electronic device is compromised or lost, the individual's identity information may also be compromised.

SUMMARY OF THE INVENTION

Systems and methods for decentralized recovery of identity attributes are disclosed. In one embodiment, a method for decentralized storage of identity data may include: (1) receiving, at an identity management computer program executed by a computer processor, identity data from a user electronic device; (2) parsing, by the identity management computer program, the identity data into a plurality of portions; (3) mapping, by the identity management computer program, each portion to one of a plurality of storage locations; and (4) storing, by the identity management computer program, the plurality of portions to the plurality of storage locations based on the mapping.

In one embodiment, the identity data may include a plurality of identity data fields, and the identity management computer program parses each identity data field into portions.

In one embodiment, one of the storage locations may include portions from two of the plurality of identity data fields.

In one embodiment, the identity data may include personally identifiable information.

In one embodiment, the identity data may include data associated with the user.

In one embodiment, e method of claim 1, wherein the identity data may be parsed so that all portions are needed to reconstruct the identity data.

In one embodiment, the identity management computer program may select the storage locations randomly.

According to another embodiment, a method for identity data recovery from decentralized identity data storage may include: (1) receiving, by an identity management computer program executed by a computer processor, a request to retrieve identity data for a user from decentralized storage, wherein the identity data may be stored as a plurality of portions in a plurality of storage locations; (2) retrieving, by the identity management computer program, a mapping of the plurality of portions of identity data to the plurality of storage locations; (3) retrieving, by the identity management computer program, the plurality of portions of identity data from the plurality of storage locations; (4) reconstructing, by the identity management computer program, the plurality of portions of identity data using the mapping; and (5) providing, by the identity management computer program, the reconstructed identity data to an electronic device for the user.

In one embodiment, the identity data may include a plurality of identity data fields, and each portion may be parsed from one of the identity data fields.

In one embodiment, the identity data may include personally identifiable information.

In one embodiment, the identity data may include data associated with the user.

In one embodiment, the identity data may be parsed so that all portions are needed to reconstruct the identity data.

In one embodiment, the electronic device for the user may be configured to save the reconstructed identity data.

According to another embodiment a system may include an electronic device comprising a memory comprising an identity management computer program; and a computer processor; and a plurality of storage locations. The identity management computer program may be configured to: receive identity data for a user from a user electronic device; parse the identity data into a plurality of portions; map each portion to one of the plurality of storage locations; and store the plurality of portions to the plurality of storage locations based on the mapping.

In one embodiment, the identity data may include a plurality of identity data fields, and the identity management computer program parses each identity data field into portions.

In one embodiment, the identity data may include personally identifiable information.

In one embodiment, the identity data may be parsed so that all portions are needed to reconstruct the identity data.

In one embodiment, the identity management computer program may select the storage locations randomly.

In one embodiment, the identity management computer program may be further configured to: receive a request to retrieve identity data for the user from the plurality of storage locations; retrieve the mapping of the plurality of portions of identity data to the plurality of storage locations; retrieve the plurality of portions of identity data from the plurality of storage locations; reconstruct the plurality of portions of identity data using the mapping; and provide the reconstructed identity data to an electronic device for the user.

In one embodiment, the electronic device may be configured to store the reconstructed identity data in an electronic wallet.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Systems and methods for decentralized recovery of identity attributes are disclosed. Identity information is highly important, as it represents an individual and is a means of access to life. It is important that this information be securely stored. Identity information is complicated, having multiple dimensions, facets, types, and quantities.

A user's identity is lifelong, and does not expire during the user's lifetime, and for some time thereafter. The user's identity may change and be updated throughout one's life, adding and/or changing user identity information.

Individuals may store decentralized identity attributes on their desktop or in a mobile wallet. Examples of such decentralized identity attributes include attestations, such as those disclosed in U.S. patent application Ser. No. 17/174,650 filed Feb. 12, 2021, U.S. Provisional Patent Application Ser. No. 62/976,262 filed Feb. 13, 2020, U.S. Provisional Patent Application Ser. No. 62/972,560 filed Feb. 10, 2020, and U.S. Provisional Patent Application Ser. No. 63/126,335 filed December 16, 2020. The disclosure of each is hereby incorporated, by reference, in its entirety. Other types of identity information may be stored as well.

Identity data may include a plurality of identity data fields. For example, a user's address may include identity data fields such as a house number, a street name, a city, a state, and a zip code. A user's name may include identity data fields, such as first name, middle name, and last name. A phone number may include identity fields such as area code, a prefix, and a line number. Each of these data fields may be parsed into separate portions.

In embodiments, the user's identity information may be stored across a plurality of random nodes, so that if a node is compromised, there is little or no risk of the user's identity being compromised. The maintenance of the user's identity information meets regulatory requirements, such as GDPR. Users may be allowed to destroy or remove their own identity information as they are self-sovereign.

Referring to FIG. 1, a system for decentralized recovery of identity attributes is disclosed according to one embodiment. System 100 may include user electronic device 110 that may be associated with user 105 and may execute user computer program or application 115. User electronic device 110 may be any suitable electronic device, including computers (e.g., workstations, laptops, desktops, tablets, etc.), smartphones, smart watches, Internet of Things (IoT) devices, etc. In one embodiment, user 105 may have a plurality of electronic devices 110.

User computer program or application 115 may be an application, a browser, etc., and may interface with identity management computer program 125 that may be executed by electronic device 120, such as a server (e.g., physical and/or cloud-based). Identity management computer program 125 may interface with a plurality of nodes 130 (e.g., node 1301, 1302, 1303 . . . 130n). Nodes 130 may be storage locations, other electronic devices, etc.

User computer program or application 115 may also access one or more website or network location, such as websites 1401, 1402, . . . 140n. User 105 may log in to one or more websites 140 using any suitable login method (e.g., biometric, userid/password, etc.). Successful login(s) at one or more website 140 may be used to authenticate user 105 to identity management computer program 125, or to prove authentication to identity management computer program 125. Other methods and mechanism for authenticating user 105 to identity management computer program 125 may be used as is necessary and/or desired.

Referring to FIG. 2, a method for identity registration or identity data update in a decentralized identity registration system is disclosed according to one embodiment.

In step 205, a user may register with an identity management computer program. In one embodiment, the user may provide a user id and password, biometric, etc. to the identity management computer program to register with the identity management computer program. Any other steps to register with the identity management computer program may be used as is necessary and/or desired.

In step 210, the identity management computer program may optionally generate an identity recovery token for the user based on the user successfully logging in to one or more website. Referring to FIG. 3, a method for generating an identity recovery token is disclosed according to an embodiment.

In step 305, the identity management computer program may present the user with one or more categories of websites to log in to. Examples of categories include social media websites, financial institution websites, utility websites, etc. In one embodiment, the identity management computer program may present popular websites for each category and the user may select one or more from each category.

In step 310, the identity management computer program may receive a selection of a website from the user.

In step 315, the identity management computer program may open a window to a login page for the website and may monitor the user's login. For example, the identity management computer program may determine whether the login was successful or not based on the message in the window from the website provider.

In step 320, if there was a successful login, in step 325, the identity management computer program may generate and store a token for the login. The token may identity the website, an IP address for the website, a timestamp, and an indication of success or failure. In one embodiment, standard authentication tokens may be used as is necessary and/or desired.

If the login was unsuccessful, in step 330, the identity management computer program may apply increasing difficulty of authentication logic and may filter the websites available for selection by the user. For example, if the user selects to login to websites that may be easy to create fake accounts on, such as a social media sites, the identity management computer program may may require the user to successfully log into additional websites (e.g., five instead of three), including ones with higher authentication requirements, such as a bank account. The process may then return to step 310.

In step 335, if additional logins are required, the process may return to step 310.

If additional logins are not required, in step 340, the identity management computer program may store the token(s). In one embodiment, the tokens may be stored in the same manner as identity data, described below.

Referring again to FIG. 2, in step 215, the user may provide identity data to the identity management computer program using the user computer program. For example, the identity data may include attestations, PII, passwords, account numbers, licenses, addresses, employer information, education information or any other data that may be associated with the user.

In step 220, the identity management computer program may parse the identity data into a plurality of portions. In one embodiment, the identity management computer program may parse individual data fields, such as a name, social security number, etc. into a plurality of portions so that one portion, if compromised, does not compromise the data field.

In step 225, the identity management computer program may store each portion of the identity data at a different node. For example, one portion may include different portions from different data fields (e.g., a first name with a house number, a street name with digits from the user's social security number, etc.). Thus, if one node is compromised, the compromised data would be meaningless.

For example, if the user's name is “Tom Jones,” Node 1 may store “Tom” and Node 2 may store “Jones.” Thus, if Node 1 were compromised, then “Tom” would mean little or nothing on its own.

In one embodiment, the identity management computer program may identify and select the nodes randomly. In one embodiment, the portions may be encrypted.

In step 230, the identity management computer program may store a mapping of identity data portions and nodes used to store the identity data portions. In one embodiment, the mapping may be used to reconstruct the identity data from the data portions when they are retrieved.

Once registered, the user may update existing information or add new identity information. For example, the user may log in to the system and amend or add new information about him or herself, thus adding to their identity. The system may store this additional identification information into additional randomly selected nodes.

Although one decentralized storage network is described above, it should be recognized that any suitable decentralized storage network, or methods of storing identity information in a decentralized manner, may be used as is necessary and/or desired.

Referring to FIG. 4, a method for decentralized recovery of identity attributes is disclosed according to one embodiment. For example, the user may be recovering his or her identity to store an up to date attestation in their wallet and/or because the user has lost some of his or her identity information.

In step 405, the user may authenticate to an identity management computer program. For example, the user may provide the userid and password, biometric, etc. that was provided during registration.

In one embodiment, in addition to logging in, the user may be required to log into the same website(s) that the user logged in to during registration. Referring to FIG. 5, a method for authentication is disclosed according to an embodiment.

In step 505, the identity management computer program may retrieve and identification of the website(s) that the user successfully logged in to during registration, and in step 510, may present the websites to the user and request that the user log in to some or all of the websites.

In step 515, the user may select a website, and the identity management computer program may open a window with a login page to the selected website.

In step 520, the identity management computer program may monitor whether the user successfully logged into the website. If, in step 525, the user was successful, in step 530, the identity management computer program may create a token for the successful login. If they user was unsuccessful, in step 535, the identity management computer program may apply increasing difficulty of authentication logic to require the user to log into a more secure website.

In step 540, if additional logins are required, the process may return to step 510. If additional logins are not required, in step 545, the identity management computer program may compare the token(s) in step 530 to the stored tokens. In one embodiment, this may involve retrieving the token(s) from decentralized storage.

If there is a match, in step 550, the user may proceed with recovery. If not, in step 555, protective actions, such as locking the user's account, sending a notification, etc. may be taken as is necessary and/or desired.

Referring again to FIG. 4, in step 410, the user may request identity data from identity management computer program.

In step 415, the identity management computer program may retrieve the mapping of identity data portions and nodes used to store the identity data portions during registration.

In step 420, the identity management computer program may retrieve the identity data portions from the plurality of nodes, and in step 425, the identity management computer program may reconstruct the identity data from identity data portions using the mapping. For example, the identity management computer program retrieves “Tom” from Node 1, “Jones” from Node 2, and first 4 digits of the user's bank account from Node 3. This will be collated.

In step 430, the identity management computer program may return the reconstructed identity data to the user computer program. In one embodiment, the identity data may then be stored in the user's wallet, the user's electronic device, etc.

Following recovery, in embodiments, additional action(s) may be taken. In one embodiment, the user's identity may be frozen. For example, if the user's mobile phone is lost, the user may log in from a web application or browser and freeze the user's identity for security purposes.

In one embodiment, the user's other registered devices may be sent an alert, a confirmation, etc. that the user's identity information is being or was recovered.

In one embodiment, identity information associated with the lost device, or that are no longer valid, may be revoked and/or invalidated.

In one embodiment, attempts to recover the user's identity information (successful and/or unsuccessful) may be recorded to the network in a similar manner as identity information may be stored. In another embodiment, attempts may be written to a different store as is necessary and/or desired.

Although multiple embodiments have been described, it should be recognized that these embodiments are not exclusive to each other, and that features from one embodiment may be used with others.