Patent ID: 8688591

Claim:
A system for anonymous separation of duties with credentials, the system comprising: an identity provider computer, the identity provider computer programmed to issue anonymous credentials and an associated public key to a user based on one or more attributes of the user, the one or more attributes of the user comprising one or more of: membership in a company, organization, research, or business unit by the user, a role of the user in a hierarchy, an expertise of the user, and an age of the user; a service provider computer, the service provider computer programmed to obtain the user's public key from the identity provider computer, to verify the user's anonymous credentials using the public key, and to issue a pseudonym to the user based on the user's verified anonymous credentials, and further programmed to associate the user's pseudonym with a step of an instance of a business process hosted on the service provider computer, the step of the instance of the business process being completed by the user; and an auditor computer, the auditor computer programmed to obtain the user's public key from the identity provider computer and determine if the completion of the step of the instance of the business process by the user is compliant with a separation of duties policy using the public key, wherein the separation of duties policy states that one or more steps of the business process must be completed by different users; wherein the auditor computer is programmed to determine compliance with the separation of duties policy without knowledge of an identity of the user, and the service provider computer is programmed to recover the identity of the user based on a violation of the separation of duties policy.