Mastercard International Incorporated

Mastercard Asia/pacific Pte. Ltd.

Prashant Sharma

Bryn Anthony Robinson-Morgan

Rajat Maheshwari

Liang Tian

Sandeep Malhotra

Joseph Damon Hayes

Manash Bhattacharjee

Joshua Joseph Baron

Antonio Marra

Jie Zhang

Jiaming Li

Matthew Edward Hopkins

Benjamin Charles Gilbey

Vijin Venugopalan

Rajen Srinivasa Prabhu

Charles Walton

Deepankar Bhagat

Karthik Ramanathan

Mark Richard Anderson

Michael L Friedman

Oran Cummins

Eric Alger

Bruce John Rutherford

Stephen Elder

Garry Lyons

Philip Wei Ping Yen

Michael Jason Friedman

Alan Mushing

Jenny Qian Zhang

Gregg Alan Hill

Richard Burdett

Richard David D'Erizans

Simon Collins

Stephen Whitney

Justin Thomas Katen

Cynthia Elizabeth Pilling

Frederic Fortin

John O'Neill

Tina Doran

Scott W Anderson, Jr

Matthew R Cahalin

Ryan T Dunn

James B Schelker

Ashwin Chandrasekaran

James Hicks

Zahir Khoja

David Cutler

John D O'NEILL

Richard D D'ERIZANS

Justin T Katen

Cynthia E Pilling

Systems and methods are provided for binding an IoT device with an identity of a user, whereby action by the IoT device may be attributed to the user. One example computer-implemented method includes verifying a user and, in response to the verification, compiling and storing identifying data for the user. The method also includes receiving an IoT device ID associated with an IoT device, from a communication device associated with the user, and appending the IoT device ID to the identifying data for the user. The method then includes receiving a request indicator from the IoT device, seeking authentication of the user at the communication device, and in response to the request indicator and the authentication of the user, provisioning, to the IoT device, at least a portion of the identifying data for the user.

Systems and methods for use in binding internet of things devices with identities associated with users

Systems and methods are provided for provisioning identity credentials based on interactions with verified or trusted users. One exemplary computer-implemented method includes receiving a request for a digital identity from a user, where the request includes identifying information for the user, and transmitting, to a verified user, an attestation request for the user. The method also includes receiving, from the verified user, an attestation response to the attestation request with regard to at least some of the identifying information for the user, generating the digital identity for the user based on a number of attestation responses of the identifying information for the user satisfying a threshold, and sharing a digital identity notice with the user including an identifier for the user, whereby the user is permitted to share the digital identity with a relying party via the identifier.

Systems and methods for use in provisioning credentials

Systems and methods are provided for use in appending log entries to a data structure. One exemplary method includes receiving, at a communication device, a log entry from a terminal and signing the log entry with a private key of a key pair specific to the communication device. The method also includes transmitting the signed log entry to an identity provider (IDP) and receiving, by the communication device, from the IDP, a signed, encrypted log entry. The method further includes verifying, by the communication device, a signature of the signed, encrypted log entry based on a public key associated with a key pair specific to the IDP and then appending the encrypted log entry to a digital identity included in the communication device.

Systems and methods for use in appending log entries to data structures

Systems and methods are provided for using verifiable credentials. One example computer-implemented method includes receiving, by an identity provider (IDP) computing device, an identity request from a relying party and directing the request to a user of an application at a mobile device associated with the user, where the mobile device includes a verifiable credential. The method also includes receiving, by the IDP computing device, from the mobile device, the verifiable credential, verifying the verifiable credential based on a public key associated with an issuer of the verifiable credential, and transmitting a link and a first authorization of the verifiable credential to the relying party. The method further includes receiving, by the IDP computing device, a request for identity data from the relying party including a second authorization and, in response to the first authorization matching the second authorization, returning the identity data to the relying party.

Systems and methods for use in implementing self-sovereign credentials

Systems and methods are provided for imposing self-exclusion preferences for data access. One example computer-implemented method includes, in response to a request by a user to impose a self-exclusion preference on a digital identity of the user, requesting a token for the digital identity. The method also includes receiving and storing the token and a secret associated with the token in a record associated with the user and assigning the self-exclusion preference to the token. The method then includes receiving a request to share an identity attribute of the user's digital identity with a relying party, where the request includes the token, and retrieving the self-exclusion preference assigned to the token. And, in response to validation of the request to share the identity attribute, based on the self-exclusion preference, authorizing a mobile device of the user to share the at least one identity attribute with the relying party.

Systems and methods for use in implementing self-exclusion preferences

Various implementations described herein may refer to a compliance platform for use with identity data. In one implementation, a method may include receiving a compliance data package from a user, where the compliance data package includes encrypted evidence data corresponding to digital identity data of the user. The method may also include encrypting the compliance data package using a first cryptographic key. The method may further include generating a user key shard, a requestor key shard, and a regulator key shard based on the first cryptographic key. The method may include generating an unlock data package that includes the requestor key shard and encrypting the unlock data package using a second cryptographic key. The method may also include transmitting the user key shard, the encrypted unlock data package, and the encrypted compliance data package to the user. The method may include transmitting the regulator key shard to a regulator.

Compliance platform for use with identity data

Systems and methods are provided for backing up a data file. One example computer-implemented method includes generating an L4 key and, for each contact attribute of the data file, generating an L3 file including the L4 key and an identifier of a user and encrypting the L3 file with an un-masked version of the contact attribute. The method also includes compiling the encrypted L3 file(s) and the masked version(s) of the contact attribute(s) into an L2 file, generating an L2 key, encrypting the L2 file with the L2 key, compiling the encrypted L2 file and L2 key into an L1 file, generating an L1 key, encrypting the L1 file with the L1 key, compiling an L4 file to include identity attributes of the user, encrypting the L4 file with the L4 key, and combining the encrypted L4 file and the encrypted L1 file.

Systems and methods for use in securing backup data files

Systems and methods are provided for use in provisioning accounts to mobile devices. One example method includes receiving, at a mobile device, a request to provision an account to a mobile device; prompting a user associated with the account for authentication at a wireless device associated with the account; receiving an account credential from the wireless device, via a local wireless communication between the mobile device and the wireless device, when the user is authenticated at the wireless device; transmitting the account credential toward a first party associated with the account, whereby the account credential is indicative of the authentication of the user; and provisioning the account to the mobile device, in response to an approval received from the first party.

Systems and methods for provisioning accounts

Various implementations described herein may refer to a digital rights management (DRM) platform. In one implementation, a method may include receiving first biometric data associated with a user. The method may also include generating first biometric templates based on the first biometric data using a DRM platform. The method may further include receiving access control data from the user, where the access control data includes data indicating time periods during which requestors are permitted to authenticate the user using the first biometric templates. The method may additionally include transmitting the first biometric templates and the access control data to the requestors using the DRM platform, where the first biometric templates are configured to be compared to second biometric templates based on the access control data, and where the second biometric templates are configured to be generated using the DRM platform based on second biometric data associated with the user.

Digital rights management platform

An age verification method performed at a mobile device comprises: receiving, from a point-of-sale terminal, a request for a payment credential, the request comprising a data element indicative of age requirement data; verifying, using at least one sensor, an identity of a user of the mobile device; responsive to said verifying, initiating, by a digital wallet application executing on the mobile device, an age verification request to a digital identity application, the age verification request comprising the age requirement data; generating a response message that comprises a response from the digital identity application to the age verification request; and transmitting, to the point-of-sale terminal, the response message and the payment credential for initiation of a transaction authorization request.

Proof-of-age verification in mobile payments

Systems and methods are provided for provisioning identity credentials based on interactions with verified or trusted users. One exemplary computer-implemented method includes receiving a request for a digital identity from a user, where the request includes identifying information for the user and a verified user identifier, and transmitting, to a verified user associated with the verified user identifier, an attestation request for the user. The method also includes receiving, from the verified user, an attestation in response to the attestation request with regard to at least some of the identifying information for the user, generating a digital identity for the user based on a number of attestations of the identifying information for the user, and sharing a digital identity notice with the user including an identifier for the user, whereby the user is permitted to share the digital identity with a relying party via the identifier.

Systems and methods are provided for context-based authentication, via a decentralized network. One example method includes receiving, at a mobile device, from a relying party, a request for an attribute of a user in connection with an interaction between the user and the relying party and determining a type of authentication to be used for the interaction, based on an authentication policy of the relying party and multiple context signals stored in the mobile device prior to providing the attribute to the relying party. The multiple context signals are indicative of one or more patterns indicative of the user and/or the mobile device. The method also includes soliciting authentication data from the user consistent with the determined type of authentication, receiving, by the mobile device, the solicited authentication from the user, and providing the attribute to the relying party in response to the user being authenticated at the mobile device.

Systems and methods for use in context-based authentication

Systems and methods are provided for restoring backup data files. One example computer-implemented method includes receiving a restore request including a backup data file having an L1 file, a wrapped L1 key, and an L4 file having an attribute of a user. In response, the method includes unwrapping the L1 key with a private key, decrypting the L1 file via the L1 key, and verifying a sample biometric included in the restore request against a reference biometric from the L1 file. Upon verification of the sample biometric, the method includes decrypting an L2 file of the L1 file, verifying a contact attribute from the L2 file with the user, decrypting an L3 file using the contact attribute, wrapping an L4 key from the L3 file with the public key of the restore request, and transmitting the wrapped L4 key to a mobile device of the user.

Growing community of inventors

Madison, NJ, United States of America

Prashant Sharma