AU2006100468B4

AU2006100468B4 - Poims

Info

Publication number: AU2006100468B4
Application number: AU2006100468A
Authority: AU
Inventors: Stafford Grant
Original assignee: Individual
Current assignee: Individual
Priority date: 2006-05-31
Filing date: 2006-05-31
Publication date: 2006-07-06
Anticipated expiration: 2014-05-31
Also published as: AU2006100468A4

Description

C POIMS Specification Description POIMS provides the capability and security required to use verified personal information to complete tasks over the Internet which would otherwise require representation of original hardcopy personal documents. All information or documentation undergoes an initial manual verification process with the organisation or institution that originally produced it. It is then permanently available to be used electronically for authentication purposes by any 3rd party to which the owner O specifies. Once verified, documents and information are signed by POIMS as authentic and associated with an owners' profile. The owner should never have to reproduce or present the O hardcopies again to subscribed parties of the POIMS system.

With technology so advanced, authenticity of documentation is wholly reliant on either the inbuilt security such as watermarks etc.., or the capability of the recipient to verify its information. POIMS was developed on the premise that, in many cases, information which is communicated by documentation is more critical to confidence than the document itself. The need to constantly carry, store and show these personal documents to 3rd parties can be seen as a privacy problem not to mention the costly and time consuming aspect of replacing the document if misplaced, stolen or destroyed.

There are ofcourse some forms of documentation which provide sufficient levels of inbuilt security such as biometric passports or smart drivers licenses. Such documents can be verified in its hardcopy form, however, other documents without any security, such as birth certificates, will be thoroughly verified with originating body. Regardless though of the type of document, POIMS allows this information to be entered into and transferred securely via the Internet to authorized parties.

POIMS is a system whereby personal information is verified, copied, stored and communicated securely over the Internet. The personal information collected is fully managed by the owner and only released or viewable by 3rd parties at the discretion of the person who rightfully owns that information i.e. the owner. The system manages the information contained on documentation that is commonly used for identification purposes. e.g. passports, pay slips, birth certificates, employment history, certifications, memberships, drivers license, education etc.. The most important aspects of this system are security, longevity, integrity, confidentiality and availability of personal information.

004912150 la O In a first aspect the present invention provides a system for providing validated credential information about an entity, the system including: a database storing: _encrypted verified entity characteristic data relating to the entity, said verified entity data including, a representation of a document attesting to one or more characteristics of the 00 entity, data representative of said one or more characteristics of the entity; an entity identifier associated with the encrypted verified entity characteristic data; first decryption means configured to decrypt at least part of the encrypted verified entity characteristic data upon receipt of a data staging request, the request including an entity identifier and corresponding decryption key; re-encryption means configured to re-encrypt the data decrypted by the first decryption means to generate encrypted releasable data; temporary storage means configured to store the encrypted releasable data, and associated decryption data, key signature, and entity identifier; transmission means to transmit at least the key signature to either one or both of the entity or the third party; second decryption means responsive to a received release request including an entity identifier and an associated key signature to decrypt the corresponding encrypted releasable data stored in the temporary storage means; and release means configured to release the decrypted data to the originator of the release request.

The system can further include data selection means configured to determine which data is to be decrypted by the first decryption means on the basis of either or both of, a predetermined selection made by the entity or a selection associated with the staging request.

In a first aspect the present invention provides a method of facilitating the verification of a characteristic of an entity including; providing access to a database storing encrypted verified entity characteristic data relating to the entity, said verified entity data including, a representation of at least one document attesting to one or more characteristics of the entity, data representative of said one or more characteristics of the entity and an entity identifier associated with the encrypted verified entity characteristic data; receiving a data staging request including an entity identifier and corresponding decryption key; decrypting at least part of the encrypted verified entity characteristic data using the received decryption key; re-encrypting the decrypted data to 004912150 lb S generate encrypted releasable data; temporarily storing the encrypted releasable data, an associated decryption data, key signature, and entity identifier; and transmitting at least the key signature to either one or both of the entity or a third party.

The method can include receiving a release request including an entity identifier and an associated key signature; decrypting encrypted releasable data stored in the temporary storage 00 means that corresponds to the release request and transmitting verified entity characteristic data relating to the entity to the originator of the release request.

In a preferred for the method can include determining which data amongst the encrypted verified IND entity characteristic data relating to the entity is to be decrypted on the basis of either or both of, a predetermined selection made by the entity or a selection associated with the staging request.

1t,,I O POIMS is based on the following fundamental principles 1. The ability to provide online, real time verification services to authorized individuals and businesses alike.

2. To provide a secure centralized storage repository of personal documentation/information unless changed from its original state or expired, all information or documentation should only need to be produced in hardcopy once on the proviso that 3rd parties are enrolled and can interact with the POIMS system.

3. To provide the means for customers to fully control their personal or business identity information 4. To provide the means for customers to securely encrypt their information and to retain full and sole control over its decryption and release.

To ease the burden on persons and businesses which need to constantly provide identification documents to engage or enroll for services.

Specification Description 1. Personal information/documentation is initially supplied and verified manually for authenticity and integrity. (The form/type of information is not a critical factor) The submission of this documentation can be either in person, over the Internet or via trusted partners such as postal outlets.

2. Once verified as authentic information/documentation, it is summarized into a separate plaintext object (such as XML), electronically scanned, digitally signed by POIMS and encrypted with (the owners) public key cryptography before being archived into a database.

3. The summarized plain text is associated with the original copy of the information/documentation and created to facilitate automated querying by subscribed 3rd parties authorized by the owner.

4. The private key is given to the owner on a form of security pass, token, card, or key. This pass, token, card or key will store the private key in an encrypted state using a biometric such as a fingerprint. (Copies of the private key are able to be escrowed by request of the owner.) The public key is kept and used solely by POIMS for encrypting new documents or for communicating securely to the owner.

'C 5. The owners are assigned a member identification number (MIN). This number is unique to each owner. With this number they are able to access their verified information via the Internet (xbit SSL) alongwith submission of their private key and various passwords. (Optional component could be installed on the owners computer to verify the authenticity of the certificate from the POIMS system. Owners of information will be prevented from accessing personal information until authenticity established and transmission of the private key is guaranteed to be secure.) 00 k.C 6. If an owner of information decides to release certain information, after logging on and providing O the required security, e.g. digital certificate, password, biometric and private key, they select the relevant information or documents to be released. (Releasing information is a process whereby O personal information is able to be viewed or queried by parties which the owner needs to communicate with.) 7. The information, including its associated plain text summary, is copied into a staging area and encrypted using strong cryptography such as a One-time pad. The resultant key is then digitally signed using a hashing algorithm to create a "key signature". Key signatures are unique and can only be created by the owner. Safeguards are employed at various stages throughout POIMS to detect owners who may be under duress whilst releasing documentation or creating key signatures.

8. The key signature can be distributed by the owner or POIMS to authorised 3rd parties, allowing them to verify information. (Best illustrated in examples below) 9. The third party is able to manually verify information by entering the owners' MIN plus key signature into POIMS via the Internet.

POIMS locates the secret key by comparing the key signatures with the keys within the owners secure profile within the staging area. Only one signature can ever match one key and it is impossible to deduce the key from the signature.

11. Once located, the secret key is used to decrypt the personal information that was selected for release and now stored in the owners personal profile staging area. The owners personal information is finally displayed or otherwise communicated to the 3rd party as information or documentation that has been verified as authentic by POIMS. The 3rd party is then able to compare information to ensure that the person who is who they say they are.

0 0 Notes: 1. The key signatures are only able to be used once and are purchased from POIMS by the owner of the information. The cost of this may be dependant on the type and amount of information being released and the number of key signatures requested.

S2. Identity and/or Verification profiles are able to be setup by the owner 100 points, so 0 that groups of documents or information are easily released by the owner with the one selection.

SFor example: The owner of information can store their name, address, phone number and 0 credentials in a particular profile. This profile, essentially a reference to a group of information or documentation, can be easily selected for release and queried by 3rd parties for automatic verification easily meeting current and future requirements. For instance, if a 200 point check instead of a 100 point check became the standard, then all owners need to do is amend their POIMS profile.

3. Multiple key signatures associated to the profile can be created, thus the owner can use these to present to multiple potential customers, employers or organisations that request these similar identity requirements.

4. Material kept in the staging area is temporary and is securely deleted following a single use of the key signature or a timeout.

An owners private key is never stored by POIMS. This is an integral aspect of the system. At no time, even if requested or ordered, will it be possible for POIMS to view owner information without the owners private key. Personal information is stored and archived in an encrypted state and ONLY able to be decrypted by the owner with their private key.

Example Applications 1. A tradesperson asserts he is a member a professional body to a potential customer. On their business card is a POIMS MIN. This allows the potential customer the ability to verify the IsN membership status of the tradesperson online with a key signature. The tradesperson provides the 0 Sprospective customer with a key signature which they enter into the POIMS system along with the MIN for information verification. The customer can then be confident in what services or goods (which they may be paying a premium for) they are purchasing or otherwise receiving.

2. Creation of various accounts online in real-time. Eg. bank, stockmarket accounts etc.

00 .P 3. Real-time CV or resume verification 4. Real-time application and approval for Government services Social security etc..

Personal financial activities e.g. personal loan, home loan approvals A customer completes an application for a new bank account online. After providing the usual details (name, address, D.O.B etc..) they provide the institution their MIN and a key signature that the institution will use to compare the provided information with that received from POIMS.

Other Information on POIMS 1. Additions or amendments to information or documentation stored by or submitted to POIMS must be re-verified where appropriate before the information is able to be re-used again by the owner.

2. POIMS digitally signs all scanned copies of verified documentation, document summaries and information. Once a change has been detected then it will automatically be flagged for reverification. Only the original unchanged copy is able to be released until reverification is complete.

3. To prevent fraud, certain types of information are further secured so that printing or otherwise copying documents from the system in any meaningful or useable format are prohibited.

example: birth certificates, diplomas etc..

Claims

2. The system of claim I which further includes data selection means configured to determine which data is to be decrypted by the first decryption means on the basis of either or both of, a predetermined selection made by the entity or a selection associated with the staging request.
3. A method of facilitating the verification of a characteristic of an entity including: providing access to a database storing: 004912150 7 O encrypted verified entity characteristic data relating to the entity, said verified entity data Sincluding, a representation of at least one document attesting to one or more Scharacteristics of the entity, data representative of said one or more characteristics of the entity; an entity identifier associated with the encrypted verified entity characteristic data; 00 receiving a data staging request including an entity identifier and corresponding decryption key; decrypting at least part of the encrypted verified entity characteristic data using the received decryption key; re-encrypting the decrypted data to generate encrypted releasable data; temporarily storing the encrypted releasable data, an associated decryption data, key signature, and entity identifier; and transmitting at least the key signature to either one or both of the entity or a third party.
4. The method of claim 3 which further includes: receiving a release request including an entity identifier and an associated key signature; 1 5 decrypting encrypted releasable data stored in the temporary storage means that corresponds to the release request and transmitting verified entity characteristic data relating to the entity to the originator of the release request. The method of either of claims 4 and 5 further including: deten-nining which data amongst the encrypted verified entity characteristic data relating to the entity is to be decrypted on the basis of either or both of, a predetermined selection made by the entity or a selection associated with the staging request.