EP4237957A1 - System, method and computer program product for authentication of digital service end-users - Google Patents

Abstract

An system providing an end-user authentication network for digital service providers, the system comprising a data repository e.g. blockchain stored in computer memory, which includes records or blocks, and which is typically open or accessible to plural digital service providers each typically having end-users and each typically having end-user authentication functionality, to allow the plural digital service providers to collaborate, typically relying on each others' previous end-user authentications, typically enhancing quality of and/or reducing cost of end-user authentication on the service providers' end users; and/or client side software residing in a hardware processor which typically allows an individual digital service provider to add an individual transaction typically between the service provider and an end user of the provider, e.g. as a new record or block, to the data repository e.g. blockchain, to provide an end-user authentication network or consortium e.g. for service providers.

Description

h sottvpesr:e//imgne-ddiiugmita.clo-imde/bnltoitcieksc/hain-blog/blockchain-based-authentication-of-devices-and-

WO 2022/091076 PCT/IL2021/051200

1

System, Method And Computer Program Product For Authentication Of Digital Service End-Users

FIELD OF THIS DISCLOSURE

The present invention relates generally to computer systems, and more particularly to digital services.

BACKGROUND FOR THIS DISCLOSURE

Data breaches and exposed records are an ongoing problem.

Use of blockchain technology used to store data on property exchanges, stops in a supply chain, and votes for a candidate, rather than merely financial transaction data, is known.

State of the art use of blockchain for authentication use cases is described in the following: https://www.theblockbox.io/how-blockchain-authentication-can-pave-the-way-to-self- people-c7efcfcf0b32 https://www.ibm.com/blogs/blockchain/2018/10/decentralized-identity-an-alternative- to-password-based-authentication/ https://hackernoon.com/blockchain-for-authentication-benefits-and-challenges- 94a93f034f40 https://www.acronis.com/en-us/blockchain-data-authentication/ https://www.sciencedirect.com/science/article/abs/pii/S0920548918303477 https://www.traxion.com/blog/blockchain-the-next-authentication-provider/ For example, the last reference, Traxion.com, describes that:

''blockchain can be used as an authentication provider. Imagine you can authenticate yourself at government services, banks, airports and other services with only one identity using blockchain technology. Using their key-pair, users register their identity on the blockchain. This registered identity is a piece of information that contains hashes of several identity related attributes. For example their name, governance registration number, finger print or other biometric information. After that such a user can go to a recognized party, which verify the hashes earlier registered on the blockchain and let the recognizing party “sponsor” that piece of information as the truth on the blockchain. Other parties which trust the particular recognizing party can now trust the identity on the blockchain and use it as an authentication or identification mechanism. This scenario includes a challenge as it still requires a trust between different parties ( the sponsors and parties that recognize them as a trusted sponsor) which still isn ’t ideal. It is however a nice idea and a good start.”

Token-based authentication is a known security technique that "authenticates the users who attempt to log in to a server, a network, or some other secure system, using a security token provided by the server. The service validates the security token and processes the user request" e.g. as described here: http://windowsbulletin.com/files/exe/horoquartz/token-server.

Digital onboarding is known e.g. as described here: https://precisebiometrics.com/wp-content/uploads/2019/02/YOUNiO-by-Precise-

Biometrics.pdf. This publication points out that " convenience has become one of the key factors when choosing a product or service" and complains that "Often when convenience is prioritized, the security is compromised, or vice versa".

Liveness detection algorithms, which facilitate biometric identification e.g. face or voice recognition by distinguishing live persons from photos, videos, masks or other non-live presentations, are known.

Apps whose end-users authenticate themselves via a separate organization e.g. Facebook, are known. For example, this link: https://firebase.google.com/docs/auth/web/facebook-login describes to app developers that "You can let your users authenticate with Firebase using their Facebook accounts by integrating Facebook Login into your app".

This publication: https://legal.thomsonreuters.com/en/insights/articles/synthetic- identity-fraud describes that “synthetic identity fraud (SIF) (is) a relatively new form of identity theft... In order to identify possible SIF, one needs the ability to dig beneath these surface layers of basic information to recognize patterns of behavior associated with “real” people — e.g., rental histories, legal matters, utility bills, family connections, passports, DMV records, extended social media profiles, etc. — but typically absent from a synthetic ID profile. So-called “behavioral biometrics ” would allow agencies to get a more complete and reliable view of a person ’s identity, says Entersekt ’s Singh. “The big challenge is that all the information that could verify a person ’s identity - all the pieces that collectively add up to ‘you ’ as an individual - are held in different places, ” she says, adding that a more effective system would be able to “analyze and compare contexts and behaviors ” in order to verify whether a person is who they say they are. “You need to have as much information as possible at your fingertips in order to look for inconsistencies in the data and get a holistic view of a person ’s identity, ” says Singh. Coupling that capability with other unique identifiers — e.g., biometrics (eye scans, fingerprints), dedicated personal devices (mobile phone), unique biographical details — would add an extra layer of identity assurance, she says, because such identifiers are more or less impossible to duplicate. Technology and vigilance New technologies such as blockchain also hold the promise of eventually being able to build a foolproof, unhackable system of personal identification, but adoption of such technologies at all levels of government is a long way off. “We are way behind the curve on SIF, ” says Lormel. “The government needs to upgrade and improve its technology across all agencies, ” he says, adding that at the state and local level, people need to be trained to be more vigilant.”

The disclosures of all publications and patent documents mentioned in the specification, and of the publications and patent documents cited therein directly or indirectly, are hereby incorporated by reference other than subject matter disclaimers or disavowals. If the incorporated material is inconsistent with the express disclosure herein, the interpretation is that the express disclosure herein describes certain embodiments, whereas the incorporated material describes other embodiments. Definition/s within the incorporated material may be regarded as one possible definition for the term/s in question.

SUMMARY OF CERTAIN EMBODIMENTS Certain embodiments seek to provide a network and associated data repository whose members include digital service providers and at least one authentication provider wherein data regarding ID documents and regarding behavior of bearers of the ID documents, who are now would-be end-users of a given digital service provider as well as having been, in the past, would-be or actual end-users of another digital service provider, are stored in memory thereby to generate a digital twin or entity for each enduser, and/or are shared between the members (e.g. are provided by the given provider to the other digital service provider, typically subject to a smart or automatically enforced contract governing such exchanges of data over the network.

Certain embodiments seek to provide a system, e.g. an All Inclusive Identity Management System (AIIMS) where people can own, use and protect their digital identity and/or presence.

The customer after the onboarding phase has typically registered his ID, and may then use his ID without physically presenting the ID.

Certain embodiments seek to provide a blockchain infrastructure which checks authenticity of a document, such as a passport or driving license, and/or its owner, without needing to repeatedly provide a physical/digital document e.g. to third party (e.g. authentication and/or onboarding) services, typically taking advantage of the fact that blockchain records or blocks are immutable e.g. once written, they cannot easily be deleted or modified.

Certain embodiments of the present invention seek to provide circuitry typically comprising at least one processor in communication with at least one memory, with instructions stored in such memory executed by the processor to provide functionalities which are described herein in detail. Any functionality described herein may be firmware-implemented or processor-implemented, as appropriate.

It is appreciated that any reference herein to, or recitation of, an operation being performed, e.g. if the operation is performed at least partly in software, is intended to include both an embodiment where the operation is performed in its entirety by a server A, and also to include any type of “outsourcing” or “cloud” embodiments in which the operation, or portions thereof, is or are performed by a remote processor P (or several such), which may be deployed off-shore or “on a cloud”, and an output of the operation is then communicated to, e.g. over a suitable computer network, and used by, server A. Analogously, the remote processor P may not, itself, perform all of the operations, and, instead, the remote processor P itself may receive output/s of portion/s of the operations from yet another processor/s P', may be deployed off-shore relative to P, or “on a cloud”, and so forth.

The present invention typically includes at least the following embodiments:

Embodiment 1. An system providing end-user authentication e.g. via a network e.g. for digital service providers, the system comprising: a data repository e.g. blockchain stored in computer memory, which typically includes plural records or blocks, and which is typically open or accessible to plural digital service providers each having end-users and each typically having end-user authentication functionality, thereby to allow the plural digital service providers to collaborate, e.g. relying on each others' previous end-user authentications, typically enhancing quality of and/or reducing cost of end-user authentication (typically without placing any additional burden of creating a proprietary api or equivalent device ) on the digital service providers' end users; and/or client side software typically residing in a hardware processor which may allow an individual digital service provider to add an individual transaction e.g. between the digital service provider and an end user of the provider, typically as a new record or block, to the data repository e.g. blockchain, thereby, typically, providing an end-user authentication network or consortium for digital service providers.

According to certain embodiments, the blockchain is open or accessible only to digital service providers which are end-users of a software platform or web service which registers such providers and provides each such provider (and typically only these registered providers) with a secure data communication channel to the blockchain.

Typically, transaction data stored in each block includes all or any subset of the transaction’s end user’s name, her or his credit card number and expiration date, the identity of the digital service provider p, the end-user’s authentication history e.g. Has s/he been authenticated or declined in the past via the platform, when applying to use digital services provided by p or by digital service providers, registered with the platform, other than p.

Embodiment 2. The system according to any of the preceding embodiments wherein an online/mobile ID document image authentication and onboarding platform performs initial registration.

Embodiment 3. The system according to any of the preceding embodiments wherein the initial registration includes prompting an end user aka customer to upload an image of their ID card.

Embodiment 4. The system according to any of the preceding embodiments wherein the initial registration includes prompting an end user aka customer to allow or authorize collection and checks of their biometric information.

Embodiment 5. The system according to any of the preceding embodiments wherein the biometric information includes at least one of face, liveness, voice, fingerprint.

Embodiment 6. The system according to any of the preceding embodiments wherein the initial registration includes prompting an end user aka customer to upload images of POA (proof of address) documents.

Embodiment 7. The system according to any of the preceding embodiments including functionality configured for background data drilling of customer information.

Embodiment 8. The system according to any of the preceding embodiments wherein the data drilling includes address verification vis a vis POA documents.

Embodiment 9. The system according to any of the preceding embodiments wherein the data drilling includes checking whether the customer appears on sanctions or PEPS (politically exposed persons (PEP) typically comprising current or former senior officials) lists known to the system.

Embodiment 10. The system according to any of the preceding embodiments wherein the data drilling includes EDD (Enhanced Due Diligence).

Embodiment 11. The system according to any of the preceding embodiments wherein the Due Diligence includes a credit check.

Embodiment 12. The system according to any of the preceding embodiments wherein the Due Diligence includes address database validation. Embodiment 13. The system according to any of the preceding embodiments wherein the Due Diligence includes income validation.

Embodiment 14. The system according to any of the preceding embodiments wherein the Due Diligence includes Due Diligence re employment history.

Embodiment 15. The system according to any of the preceding embodiments wherein the Due Diligence includes Due Diligence re education history.

Embodiment 16. The system according to any of the preceding embodiments and also comprising web client software which allows an end user to select a client via which the end user desires to authenticate e.g. if plural authentication providers are available.

Embodiment 17. The system according to any of the preceding embodiments and also comprising server software which authenticates or declines each end-user seeking authentication.

Typically, each authentication provider associated with the platform has its own server software.

Embodiment 18. The system according to any of the preceding embodiments wherein each end-user E, once presenting ID documents, a token certifying E's identity is computed accordingly, e.g. by a provider P from among the plural digital service providers, and is sent to the end-user E, e.g. by the provider, for storage in an electronic device e.g. Smartphone that E has, and subsequently, at least one subsequent transaction e.g. with a provider other than provider P, authenticates the user E responsive to user E's presentation of the token.

Embodiment 19. The system according to any of the preceding embodiments wherein at least some digital service providers having end-user authentication functionality, use an authentication provider, and wherein at least two of the digital service providers use the same authentication provider.

It is appreciated that some or all digital service providers may do their own in-house authentication, in contrast, some or all digital service providers may outsource their authentication to an authentication provider. Such as aulOtix BOS (e.g. by electing that authentication provider via the platform described herein). Thus, many or all digital service providers may use a single authentication provider. Embodiment 20. A method of operation for digital service providers, the method comprising: providing data regarding an entity wherein the entity includes an ID document and a bearer thereof wherein the data includes data regarding the ID document and data regarding the bearer; and determining whether or not to authenticate the entity by applying logic to the data regarding the ID document and the data regarding the bearer.

Embodiment 21. A method according to any of the preceding embodiments wherein the data regarding the bearer includes pattern characteristics of the bearer's online activity.

Embodiment 22. A method according to any of the preceding embodiments wherein the data regarding a given bearer is associated in memory with data regarding an ID card presented by the bearer, thereby to generate a digital twin of the entity, in memory.

Embodiment 23. The system of any of the preceding embodiments wherein the plural digital service providers are interconnected by a private network to which access of non-member digital service providers is restricted, and wherein a contract is provided to automatically enforce rules governing exchange of data regarding authentication of digital service would-be end-users, between member digital service providers, and wherein the exchange of data allows a request for digital services provided by a would-be end-user E to service provider P at time T to benefit from data collected by at least one service provider P' in the network other than P, responsive to at least one request for digital services by would-be end user E to at least service provider P' at at least one time t preceding time T.

Embodiment 24. The system of any of the preceding embodiments wherein an authentication provider which serves plural digital service providers in the network is also part of (e.g. a node within) the network.

Embodiment 25. A method according to any of the preceding embodiments and wherein the data is stored in a data repository e.g. blockchain which includes plural records or blocks, and which is typically open or accessible to plural digital service providers each having end-users and each having end-user authentication functionality, thereby to allow the plural digital service providers to collaborate, relying on each others' previous end-user authentications, enhancing quality of and/or reducing cost of end-user authentication without placing any additional burden on the digital service providers' end users.

Embodiment 26. A method according to any of the preceding embodiments and wherein client side software allows an individual digital service provider to add an individual transaction between the digital service provider and an end user of the provider, as a new record or block, to the data repository e.g. blockchain, thereby to provide an end-user authentication network or consortium for digital service providers.

Embodiment 27. The system of any of the preceding embodiments wherein the digital service providers are configured for providing data regarding an entity wherein the entity includes an ID document and a bearer thereof wherein the data includes data regarding the ID document and data regarding the bearer; and determining whether or not to authenticate the entity by applying logic to the data regarding the ID document and the data regarding the bearer.

Embodiment 28. The system according to any of the preceding embodiments wherein the data drilling includes social media checks.

Embodiment 29. A computer program product, comprising a non-transitory tangible computer readable medium having computer readable program code embodied therein, the computer readable program code adapted to be executed to implement a method of operation for digital service providers, the method comprising providing data regarding an entity wherein the entity includes an ID document and a bearer thereof wherein the data includes data regarding the ID document and data regarding the bearer; and determining whether or not to authenticate the entity by applying logic to the data regarding the ID document and the data regarding the bearer.

Also provided, excluding signals, is a computer program comprising computer program code means for performing any of the methods shown and described herein when the program is run on at least one computer; and a computer program product, comprising a typically non-transitory computer-usable or -readable medium e.g. non-transitory computer -usable or -readable storage medium, typically tangible, having a computer readable program code embodied therein, the computer readable program code adapted to be executed to implement any or all of the methods shown and described herein. The operations in accordance with the teachings herein may be performed by at least one computer specially constructed for the desired purposes or general purpose computer specially configured for the desired purpose by at least one computer program stored in a typically non-transitory computer readable storage medium. The term "non-transitory" is used herein to exclude transitory, propagating signals or waves, but to otherwise include any volatile or non-volatile computer memory technology suitable to the application.

Any suitable processor/s, display and input means may be used to process, display e.g. on a computer screen or other computer output device, store, and accept information such as information used by or generated by any of the methods and apparatus shown and described herein; the above processor/s, display and input means including computer programs, in accordance with all or any subset of the embodiments of the present invention. Any or all functionalities of the invention shown and described herein, such as but not limited to operations within flowcharts, may be performed by any one or more of: at least one conventional personal computer processor, workstation or other programmable device or computer or electronic computing device or processor, either general-purpose or specifically constructed, used for processing; a computer display screen and/or printer and/or speaker for displaying; machine -readable memory such as flash drives, optical disks, CDROMs, DVDs, BluRays, magnetic -optical discs or other discs; RAMs, ROMs, EPROMs, EEPROMs, magnetic or optical or other cards, for storing, and keyboard or mouse for accepting. Modules illustrated and described herein may include any one or combination or plurality of: a server, a data processor, a memory/computer storage, a communication interface (wireless (e.g. BLE) or wired (e.g. USB)), a computer program stored in memory/computer storage.

The term "process" as used above is intended to include any type of computation or manipulation or transformation of data represented as physical, e.g. electronic, phenomena which may occur or reside e.g. within registers and/or memories of at least one computer or processor. Use of nouns in singular form is not intended to be limiting; thus the term processor is intended to include a plurality of processing units which may be distributed or remote, the term server is intended to include plural typically interconnected modules running on plural respective servers, and so forth.

The above devices may communicate via any conventional wired or wireless digital communication means, e.g. via a wired or cellular telephone network, or a computer network such as the Internet.

The apparatus of the present invention may include, according to certain embodiments of the invention, machine readable memory containing or otherwise storing a program of instructions which, when executed by the machine, implements all or any subset of the apparatus, methods, features and functionalities of the invention shown and described herein. Alternatively or in addition, the apparatus of the present invention may include, according to certain embodiments of the invention, a program as above which may be written in any conventional programming language, and optionally a machine for executing the program, such as but not limited to a general purpose computer which may optionally be configured or activated in accordance with the teachings of the present invention. Any of the teachings incorporated herein may, wherever suitable, operate on signals representative of physical objects or substances.

The embodiments referred to above, and other embodiments, are described in detail in the next section.

Any trademark occurring in the text or drawings is the property of its owner and occurs herein merely to explain or illustrate one example of how an embodiment of the invention may be implemented.

Unless stated otherwise, terms such as, "processing", "computing", "estimating", "selecting", "ranking", "grading", "calculating", "determining", "generating", "reassessing", "classifying", "generating", "producing", "stereo-matching", "registering", "detecting", "associating", "superimposing", "obtaining", "providing", "accessing", "setting" or the like, refer to the action and/or processes of at least one computer/s or computing system/s, or processor/s or similar electronic computing device/s or circuitry, that manipulate and/or transform data which may be represented as physical, such as electronic, quantities e.g. within the computing system's registers and/or memories, and/or may be provided on-the-fly, into other data which may be similarly represented as physical quantities within the computing system's memories, registers or other such information storage, transmission or display devices, or may be provided to external factors e.g. via a suitable data network. The term “computer” should be broadly construed to cover any kind of electronic device with data processing capabilities, including, by way of non-limiting example, personal computers, servers, embedded cores, computing system, communication devices, processors (e.g. digital signal processor (DSP), microcontrollers, field programmable gate array (FPGA), application specific integrated circuit (ASIC), etc.) and other electronic computing devices. Any reference to a computer, controller or processor is intended to include one or more hardware devices e.g. chips, which may be co-located or remote from one another. Any controller or processor may for example comprise at least one CPU, DSP, FPGA or ASIC, suitably configured in accordance with the logic and functionalities described herein.

Any feature or logic or functionality described herein may be implemented by processor/s or controller/s configured as per the described feature or logic or functionality, even if the processor/s or controller/s are not specifically illustrated for simplicity. The controller or processor may be implemented in hardware, e.g., using one or more Application-Specific Integrated Circuits (ASICs) or Field-Programmable Gate Arrays (FPGAs), or may comprise a microprocessor that runs suitable software, or a combination of hardware and software elements.

The present invention may be described, merely for clarity, in terms of terminology specific to, or references to, particular programming languages, operating systems, browsers, system versions, individual products, protocols and the like. It will be appreciated that this terminology or such reference/s is intended to convey general principles of operation clearly and briefly, by way of example, and is not intended to limit the scope of the invention solely to a particular programming language, operating system, browser, system version, or individual product or protocol. Nonetheless, the disclosure of the standard or other professional literature defining the programming language, operating system, browser, system version, or individual product or protocol in question, is incorporated by reference herein in its entirety.

Elements separately listed herein need not be distinct components and alternatively may be the same structure. A statement that an element or feature may exist is intended to include (a) embodiments in which the element or feature exists; (b) embodiments in which the element or feature does not exist; and (c) embodiments in which the element or feature exist selectably e.g. a user may configure or select whether the element or feature does or does not exist.

Any suitable input device, such as but not limited to a sensor, may be used to generate or otherwise provide information received by the apparatus and methods shown and described herein. Any suitable output device or display may be used to display or output information generated by the apparatus and methods shown and described herein. Any suitable processor/s may be employed to compute or generate information as described herein and/or to perform functionalities described herein and/or to implement any engine, interface or other system illustrated or described herein. Any suitable computerized data storage, e.g. computer memory, may be used to store information received by or generated by the systems shown and described herein. Functionalities shown and described herein may be divided between a server computer and a plurality of client computers. These or any other computerized components shown and described herein may communicate between themselves via a suitable computer network.

The system shown and described herein may include user interface/s e.g. as described herein which may for example include all or any subset of: an interactive voice response interface, automated response tool, speech-to-text transcription system, automated digital or electronic interface having interactive visual components, web portal, visual interface loaded as web page/s or screen/s from server/s via communication network/s to a web browser or other application downloaded onto a user's device, automated speech-to-text conversion tool, including a front-end interface portion thereof and back-end logic interacting therewith. Thus the term user interface or “UI” as used herein includes also the underlying logic which controls the data presented to the user e.g. by the system display and receives and processes and/or provides to other modules herein, data entered by a user e.g. using her or his workstation/device.

BRIEF DESCRIPTION OF THE DRAWINGS

Example embodiments are illustrated in the various drawings. Specifically:

Figs, la, lb, 1c, taken together, form a main flow according to certain embodiments. All or any subset of the illustrated operations may be provided, in any suitable order e.g. as shown. Each of the illustrated embodiments may be varied e.g. as described in any of the embodiments described herein.

Certain embodiments of the present invention are illustrated in the following drawings; in the block diagrams, arrows between modules may be implemented as APIs and any suitable technology may be used for interconnecting functional components or modules illustrated herein in a suitable sequence or order e.g. via a suitable API/Interface. For example, state of the art tools may be employed, such as but not limited to Apache Thrift and Avro which provide remote call support. Or, a standard communication protocol may be employed, such as but not limited to HTTP or MQTT, and may be combined with a standard data format, such as but not limited to JSON or XML.

Methods and systems included in the scope of the present invention may include any subset or all of the functional blocks shown in the specifically illustrated implementations by way of example, in any suitable order e.g. as shown. Flows may include all or any subset of the illustrated operations, suitably ordered e.g. as shown. Tables herein may include all or any subset of the fields and/or records and/or cells and/or rows and/or columns described.

Computational, functional or logical components described and illustrated herein can be implemented in various forms, for example, as hardware circuits such as but not limited to custom VLSI circuits or gate arrays or programmable hardware devices such as but not limited to FPGAs, or as software program code stored on at least one tangible or intangible computer readable medium and executable by at least one processor, or any suitable combination thereof. A specific functional component may be formed by one particular sequence of software code, or by a plurality of such, which collectively act or behave or act as described herein with reference to the functional component in question. For example, the component may be distributed over several code sequences such as but not limited to objects, procedures, functions, routines and programs and may originate from several computer files which typically operate synergistically.

Each functionality or method herein may be implemented in software (e.g. for execution on suitable processing hardware such as a microprocessor or digital signal processor), firmware, hardware (using any conventional hardware technology such as Integrated Circuit technology), or any combination thereof.

Functionality, or operations stipulated as being software-implemented, may alternatively be wholly or fully implemented by an equivalent hardware or firmware module, and vice-versa. Firmware implementing functionality described herein, if provided, may be held in any suitable memory device and a suitable processing unit (aka processor) may be configured for executing firmware code. Alternatively, certain embodiments described herein may be implemented partly or exclusively in hardware, in which case all or any subset of the variables, parameters, and computations described herein may be in hardware.

Any module or functionality described herein may comprise a suitably configured hardware component or circuitry. Alternatively or in addition, modules or functionality described herein may be performed by a general purpose computer or more generally by a suitable microprocessor, configured in accordance with methods shown and described herein, or any suitable subset, in any suitable order, of the operations included in such methods, or in accordance with methods known in the art.

Any logical functionality described herein may be implemented as a real time application, if and as appropriate, and which may employ any suitable architectural option such as but not limited to FPGA, ASIC or DSP, or any suitable combination thereof.

Any hardware component mentioned herein may in fact include either one or more hardware devices e.g. chips, which may be co-located or remote from one another.

Any method described herein is intended to include within the scope of the embodiments of the present invention also any software or computer program performing all or any subset of the method’s operations, including a mobile application, platform or operating system e.g. as stored in a medium, as well as combining the computer program with a hardware device to perform all or any subset of the operations of the method.

Data can be stored on one or more tangible or intangible computer readable media stored at one or more different locations, different network nodes, or different storage devices at a single node or location.

It is appreciated that any computer data storage technology, including any type of storage or memory and any type of computer components and recording media that retain digital data used for computing for an interval of time, and any type of information retention technology, may be used to store the various data provided and employed herein. Suitable computer data storage or information retention apparatus may include apparatus which is primary, secondary, tertiary or off-line; which is of any type or level or amount or category of volatility, differentiation, mutability, accessibility, addressability, capacity, performance and energy use; and which is based on any suitable technologies such as semiconductor, magnetic, optical, paper and others.

DETAILED DESCRIPTION OF CERTAIN EMBODIMENTS

In this disclosure, references to “organizations” may be replaced by “digital service providers”, and vice versa, since all of these variations are within the scope of the embodiments herein. Digital services are intended to include a wide variety of services such as, say, refunds, cancelling payments, updating payment methods, purchasing or other transactions, licensing, seeking a loan, games, car registration, subscribing to a newsletter, transferring money, streaming music, etc. Typically, digital services are delivered via the Internet or electronic network (e.g. smart phone app), and are fully or partly automated; no human intervention may be required with the end-user, and the back- office may be fully automated.

A system is now described which yields or grows a community of digital service providers, such as, say, Google, Paypal, and the like, which cooperates e.g. as described herein to yield more efficient authentication of end-users, as knowledge regarding known clients or end-users (e.g. whether certain end-users have been authenticated in prior transactions) and/or known digital service providers evolves with time. According to certain embodiments, a single authentication provider serves plural or all members of the community.

According to certain embodiments, at least one authentication provider is used, often a single authentication provider, which is used by plural digital services and even for plural digital service providers, even if the data is decentralized. Typically, until the private key is compromised, the data can be updated. Typically, when an end-user loses his phone or other data carrier on which her or his private key (or other portion of her or his identity) is installed, the authentication provider may be based on blockchain technology, yet is not decentralized. Typically, the authentication provider may serve as a central facility controlling identities and/or may support an end user’s request for a new identity and/or to have her /his old identity marked as stolen or lost e.g. in the blockchain.

An authentication provider in this situation exists, only data is decentralized. Therefore, until the private key is compromised, the data can be updated. If a user loses her/his data carrier, the system may proceed with initial registration and check data according to what exits in the blockchain, so as to create a new token.

The knowledge may be stored as a blockchain. According to certain embodiments, a log is maintained to record each time that a given organization accesses the knowledge e.g. blockchain. Each block in the blockchain may include documentation of a given request by a given end-user to be authenticated to use a given digital service. And/or, each block in the blockchain may include documentation of what is known about the authenticity of a given end-user.

The authentication provider may check, e.g. using neural nets, the end-user’s online activity for patterns, since each end-user’s behavior or online activity is typically characterized by certain features e.g. his activity may occur mostly on certain days, or times of day, or may use certain currencies, or may involve points of sale in a specific geographic region. Thus, for example, if an end-user applies to be authenticated as Joe George, the authentication provider may compare the end-user seeking to be authenticated as Joe George to stored data regarding the behavior of Joe George. The authentication provider’s logic may be configured to decline to authenticate the end-user as Joe George, if the end-user seeking to be thus authenticated differs in his behavior from what is known about Joe George (typically based on system-defined (e.g. learned) rules defining thresholds, which may, if exceeded, indicate differences which are pronounced enough or large enough to suggest (e.g. at a certain level of confidence) that Joe George is not really Joe George, or is not really a person at all). For example, the end-user seeking to be thus authenticated may be found to be operating on a different day, and/or at a different time of day, and/or using a different currency, than Joe George is known from the system to normally do. Or, Joe George may be found to lack any patterns of behavior at all (his activity is found to lack any lasting or habitual characteristics e.g. no fixed currency or location or times of activity or language preference etc.), suggesting that Joe George is not a real person at all. The authentication provider’s logic may be configured to successfully authenticate the end-user as Joe George, if the behavior of the end-user seeking to be thus authenticated conforms to what is known to the system about Joe George, for example, if the end-user seeking to be thus authenticated is now operating on the same day, and time of day, and using the same currency, that Joe George normally does.

The term "blockchain" herein is intended to include any sequence or chain of blocks, wherein each n'th block, for all n, contains a cryptographic hash of a previous block e.g. of block n-1 (such that the data in any given block b, once added to the blockchain, cannot be altered retroactively without altering all blocks B > b), and/or a timestamp, and/or transaction data which may be represented as a Merkle tree. The blockchain is typically an open, distributed ledger that can record transactions between plural e.g. two parties. The blockchain is typically managed by a peer-to-peer network including plural peers, all of which adhere to a protocol for inter-node communication and/or for validating new blocks.

The method of operation of the system may include two stages: Onboarding, and/or Transactions.

The Onboarding stage is now described in detail, according to an example embodiment. End-users may onboard onto a service, typically via a digital service providing organization e.g. PayPal. Onboarding may include all or any subset of: a. Initial registration where an end user (e.g. of a digital service provider) aka customer is prompted to

• Upload an image of their ID card; and/or

• Allow or authorize collection and checks of their biometric information (face, liveness, voice, fingerprint, etc.); and/or

• Upload images of POA documents

This may for example be performed by a suitable online/mobile ID document image authentication and onboarding platform such as but not limited to BOS (Back Office Service) or platforms by, say, Onfido or civic.com. Typically, the platform may use neural nets to check the end-user’s activity (since each end-user’s behavior is typically characterized by certain features e.g. his online activity (or certain types of online activity) may occur mostly on certain days, or times of day, or may use certain currencies, or may involve points of sale in a specific geographic region. b.Background data drilling of the customer information (e.g. using Public API’s such as, say: https://www.lifewire.com/search-engines-that-top-the-web-3482269 https://www.interpol.int/en/How-we-work/Notices/View-Red-Notices This may include all or any subset of: bl. checking whether the customer appears on sanctions or PEPS (politically exposed persons. PEPS typically comprise current or former senior officials lists known to the system, b2. Social media checks (e.g. whether a given end-user was linked to criminal behavior). b3. Address verification (e.g. from POA documents); for example to check whether a given end-user, Joe, indeed lives at the address that appears on a document that Joe has presented. It is appreciated that end-users are sometimes required to provide an adequately recent Proof of Address or POA document e.g. during a verification video call. The end-user's or customer's name and current residential address appear on the POA document which is typically dated, and may, for example, be a utilities e.g. water or gas bill, an Internet bill, or a Bank Account Statement. c. EDD (Enhanced Due Diligence), which may be performed by a 3^rd party for the system of the present invention, where the EDD may be provided through an API or other suitable data link between the 3^rd party and the system of the present invention. The due diligence may include all or any subset of: credit check and/or enhanced address database validation and/or income validation and/or due diligence re employment history and/or due diligence re education history.

According to an embodiment of the invention, onboarding includes providing each end-user who onboards a given digital service, with a token.

For example, Cloud IAM is a Cloud Identity and Access Management service, by IBM, which is used to manage user logins. Each user who logs into cloud IAM may receive a token which can then be used to prove the user's identity, thus securely authenticating users for any platform services enabled to use IBM Cloud IAM for access control. This enables control of users' access to resources consistently across the IBM Cloud. Typically, an application programming interface key (API key) comprising unique code is passed to an API to identify the calling application or user. API keys may be used as a secret token for authentication. A user API key may be used to generate a token. Each user treats her or his user API key as a secret not to be shared.

Typically, during onboarding, a private certificate is generated for the onboarding end-user, e.g. on her or his mobile device. According to certain embodiments, the token is always signed with a certificate. The token may be provided by the server or by the client (e.g. depending on the business scenario).

The transactions stage is now described in detail, according to an example embodiment. An end-user or customer, aka end customer, typically initializes transaction with a digital services provider (e.g. PayPal or Google or Amazon or Uber or AirB&B or Payoneer) aka "service provider".

Typically, a customer passes the onboarding token s/he received during onboarding to the system of the present invention via the digital services provider, aka SP. The system of the present invention then extracts the customer's existing customer record from the blockchain.

Typically, the customer is prompted or directed to undergo a biometric check, thereby to generate biometric results which are compared to biometric data in the customer's existing record as extracted.

A result, typically with or without data (service level dependent), may be passed back to the provider.

A transaction may then take place. Transaction details such as date, time, amount, unique identifier of transaction and/or of end user within at least one organization, may be added to the blockchain record.

Data in the customer record may be subdivided e.g. into:

Type 1 data — PII obtained directly from the customer and/or his ID. It is appreciated that personally identifiable information (PII) may include name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information, or even an IP address. Type 2 data or secondary information which is mined e.g. by the system of the present invention, typically from public records and/or social media.

The availability of data may depend on the type, for example, Type 1 may only be available to the specific digital services provider or SP, whereas Type 2 could be shared with other digital services providers or SP's e.g. to provide a retroactive view on end users.

Typically, all data is accommodated in blockchain by different onboardings.

The system of the present invention may include all or any subset of: a. Client side - e.g. Mobile SDK (Android and iOS). Typically, private information is saved only at this user side. The client is typically the digital service provider’s or organization’s end-user.

Typically, the client or end-user interacts with a digital service of a digital service provider (SP) such as, say, Paypal. Functionality provided by the backend of a service provider may include aulOtix BOS functionality. b. Web client. Again here the client is typically the digital service provider’s or organization’s end-user. c. Server Side : all or any subset of:

1. Authentication provider (e.g. BOS available from AU10TIX) - typically, a service provider may be frontend for the customer.

2. Blockchain infrastructure (e.g. Azure Blockchain as a MS Service)

3. API between aulOtix's BOS (or equivalent)/Blockchain e.g. Azure blockchain /Client. The server side may be involved in all or any subset of operations 1, 4, 5, 6, 7 herein.

It is appreciated that Azure Blockchain Workbench allows blockchain applications to be generated that represent multi-party workflows defined by configuration and smart contract code, e.g. by performing the following activities:

• Configure a blockchain application; and/or

• Create a smart contract code file; and/or

• Add the blockchain application to Blockchain Workbench

The flow performed after onboarding, or the operations performed in stage 2 or transaction phase, may include all or any subset of the following operations, suitably ordered e.g. as follows: la. the system of the present invention forms a set e.g. pair of values for the client, including all or any subset of: a hash of the token, a hash of the client's personal data and, optionally, the token and/or a token generated by combining these hashes. The token may be a combination of hashes of an onboarding token and a personal data token. lb. the set or pair of values formed in operation la, is put or stored in a suitable digital environment e.g. an open and decentralized database such as a blockchain, which typically supports public-key cryptography, thereby to allow users to sign off for the transaction.

A smart contract (e.g. Ethereum Smart Contract) may be employed using known techniques for smart contracts in blockchain e.g. as described in the following tutorial: https://www.bitdegree.org/crypto/tutorials/what-is-a-smart-contract)

Typically, each such contract includes all or any subset of the following 3 objects:

The first object is digital signatures of each of the plural "signatories" to the smart contract, each of whom indicates whether they agree with the terms of the smart contract, using their respective digital signatures.

The second object is the contract's "subject".

The third object is terms, described using a suitable programming language appropriate for the smart contract’s environment and including requirements expected from the participating parties e.g. signatories , and/or rules, rewards and/or punishments associated with the requirements. .

2. The client or end-user applies for service in the organization or digital service provider e.g. PayPal, Google, etc. the organization e.g. PayPal or other digital service provider may be one of the signatories to the smart contract, and/or each PayPal end-user may sign a contract. Thus smart contract signatures may or may not be per organization.

3. The organization provides the client with an interface for entering personal data and choosing an API to an authentication provider via which the client would like to identify (e.g. via an AulOtix API). 4. Client or end-user is redirected to the (remote) authentication provider s/he has selected, e.g. to the AulOtix service API, for authentication (authorization).

5. The authentication provider e.g. AulOtix BOS performs authentication using its own authentication mechanism (such as but not limited to two-factor authentication and/or biometrics). Information from the blockchain may or may not be used by the authentication provider to perform this authentication.

6. If the client successfully passes the authentication, the authentication provider encrypts the client's token using the organization public key. For example, if the authentication provider is aulOtix BOS, the client or end user's token may be encrypted using the aulOtix public key.

7. The client token as encrypted is sent to the organization e.g. PayPal, Google, etc. typically via a smart contract (e.g. the contract described above) to record the fact that the token was transferred.

8a. The authentication provider, and/or the organization may be configured for creating a message with an encrypted token .

8b. Sending the message to the organization e.g. to PayPal, Google, etc.

9. The message is received and decrypted e.g. by organization, according to a suitable protocol, typically using the token's private key (of organization); key vaults may be used, or any other scheme for managing storage of private keys.

10. Organization generates and sends message aka request e.g. with a token hash and/or a hash of personal data (typically provided by the client through the organization's interface e.g. the interface of PayPal, Google, etc.) that has been stored or shared between client and organization, and/or the token; each request aka message typically includes a token hash, personal data hash, and may also include the token itself.

11. Reconciliation between: data placed by (say) the authentication provider in a smart contract in operation lb above and data transmitted to the organization e.g. in operation 8b above.

Any suitable software tool/s may be used to perform reconciliation, such as, say the tool described here: https://www.aurum-solutions.com/?gclid=EAIaIOobChMIOpyKOLb- 6AIVmLd3ChOUiwDoEAAYASAAEgJYoPD BwE

12. If reconciliation is successful, the smart contract records the fact that reconciliation was successful, and sends the response (e.g. that the client or end-user has been successfully identified) to the organization e.g. PayPal, Google, etc.

13. The organization receives the response indicating successful identification of the client.

14. Responsively, the organization e.g. PayPal, Google, etc. provides service to the client or end-user.

Thus, when an end-user applies to use the digital service, the digital service provider need not (necessarily) ask her or him "What are the 4 digits on the back of your card?" and other such processes, because the client already has the token (e.g. as received in operation 1).

It is appreciated that a single organization may include multiple, sometimes unrelated, plural digital service providers. For example, PayPal is an organization which includes the following digital service providers: Donate with PayPal PayPal Credit PayPal Ventures

PayPal Debit MasterCard®

PayPal Digital Gifts Store

PayPal Extras MasterCard®

PayPal Cashback Mastercard®

PayPal for In-Game Purchases

PayPal for Recurring Payments

PayPal Mobile Apps

PayPal Prepaid MasterCard®

PayPal Shopping

Pay your taxes with PayPal

Using the system of the present invention, it is no longer necessary for each of the above services to independently authenticate end-users (e.g. it is no longer necessary for each of the above services to separately ask end-users to scan and send in physical ID documents).

According to certain embodiments, during onboarding phase of the system herein and/or during transaction phase, active(liveness) and/or passive tests may be administered. Typically, active tests, not (or not just) passive tests are used for data comparison.

According to certain embodiments, data is encrypted and stored on a blockchain to facilitate subsequent derivation of timeline behavior anomalies; this functionality may for example be provided during, after, or before operations 5 and/or 11 described herein.

This functionality may use conventional anomaly detection techniques, and/or other data mining techniques. Conventional anomaly detection includes e.g. densitybased techniques (k-nearest neighbor, local outlier factor, isolation forests, subspace-, correlation-based or tensor-based outlier detection for high-dimensional data, one-class support vector machines, replicator neural networks, autoencoders, variational autoencoders, long short-term memory neural networks, Bayesian Networks, Hidden Markov models (HMMs), cluster analysis-based outlier detection, deviations from association rules and frequent item sets, fuzzy logic-based outlier detection and ensemble techniques, which may use feature bagging, score normalization and/or different sources of diversity.

According to any embodiment, a result (end user x was/was not authenticated) of an operation performed by an authentication provider at time t, may be stored in a block pertaining to end user x seeking to use digital service s 1 , and may be re-used when enduser x again seeks authentication at time T later than t, in order to use, again, digital service si or in order to use a digital service s2 which differs from si. Typically re-use of such a result is determined by logic which may take into account, for example, how much later is T than t, and/or the value (e.g. dollar amount) of the transaction, and so forth.

Any suitable logic may be provided to ensure privacy of would-be digital service end-users applying for digital services e.g. to obtain consent of such end-users, as part of their application to one of the digital service providers, that certain data regarding those end-users e.g. results of authentication checks about an end-user, but perhaps not (or less than all of) the input data regarding the end-user that was fed to the authentication check, may be shared between participating digital service providers. The input data regarding the end-user may include end-user characteristics describing or quantifying the end-user's data network behavior such as but not limited to the currency s/he does or does not use (or is more or less likely to use), hours or days in which s/he is more or less likely to be active, biometric data presented in the past, and the end-user's geographic or information network (topological) location. According to certain embodiments, an end-user's characteristics are immutably associated, in memory, e.g. via blockchain, with data regarding at least one identity document presented by the end-user e.g. an image of that identity document or data derived by an authentication service on behalf of a digital service provider such as the country and type (driving license, passport, etc.) and version and subversion of the identity document. This facilitates authentication of a digital entity which includes both a document and a person (hence may serve as a digital twin of the person bearing the document), an entity which is represented digitally by data regarding (e.g. derived from an image of) the document and data (historical e.g. regarding data network behavior) regarding the person. According to certain embodiments, logic is defined which determines whether or not to authenticate a certain entity (typically including an ID document and a bearer thereof who presents the ID document) typically by verifying authenticity of the ID document and also by verifying that the behavior exhibited by the bearer, and the behavior of whoever presented the same document in the past (where sameness may, say, be defined as an ID document sharing the same country, type of document and unique identifier or serial numbers and perhaps having the same photo) is consistent, using predetermined or learned definitions of consistency. Data stored regarding the bearer may include biometric data provided in the past and may include an indication of whether the biometric data was provided remotely or was obtained under supervised conditions e.g. was the photo or fingerprint sent in over Internet or obtained when the bearer visited the physical premises of a digital service provider e.g. bank. Any suitable process may be used to gather data regarding the bearer who presents a given ID document, including but not limited to data gathered during sessions of the would-be applicant with member digital service providers who have served the would-be applicant in the past (e.g. have accepted payment from her or him) or have denied the would-be applicant services in the past. Any suitable deep learning process may be used to analyze available data, including historical data, regarding ID documents and bearers thereof.

Any suitable logic may be provided to facilitate sharing, typically by consent, between owners (e.g. members or participating digital service providers), of data regarding their would-be end-users (e.g. results of authentication checks about a would- be end-user (applicant to use digital services provided by a given member) but perhaps not (or less than all of) the input data regarding the end-user that was fed to the authentication check).

Data shared between digital service providers who are members of the system or "consortium" described herein may provide (including sell) anonymized data regarding their would-be end-users (typically contingent on the end-users' having provided informed consent) to other members. Members may be connected to a point system, such that each authorization of use of data regarding a would-be end-user of theirs, rewards these members with points that can be redeemed in accordance with suitable logic e.g. if digital service provider x authorized use of data about 10 past would-be end users of theirs, digital service provider x is entitled to receive data about 10 new would-be end users of theirs, from other digital service providers.

Each "transaction" stored in the blockchain may store data regarding an application of a would-be digital service end-user to the provider of that service, and may include data regarding the would-be user including his behavior, and data regarding the would-be user's ID document, all of which may be stored in a single block and all of which may be hashed together.

References to blockchain herein are actually intended to be merely by way of example, and to include alternatives and variations of blockchain, including any system allowing digital information to be recorded and distributed, but not edited, or any ledger which may be distributed, may be decentralized and may be public. An example of a distributed database is MongoDB with replica-sets enabled, or Azure cosmosDB. IPFS is an example of a distributed filesystem. Variations within the scope of the invention include a suitable typically centralized database that may use distributed ledger technology to store data e.g. a list of records, private blockchains, public blockchains, any typically distributed ledger that typically maintains time-stamped records of every transaction, any variation described here (mutatis mutandis since the focus is on public health records: https://www.hindawi.com/iournals/scn/2019/8315614/), any available data framework such as but not limited to Ethereum, Hyperledger Fabric, Quorum, Corda, Ripple, or any open-source and/or smart contract blockchain or other data solution which is configured for integrating ledger e.g. blockchain technology into business processes e.g. authentication processes as described herein. Any user of or entrant to the network may require permission from a trusted party and/or a defined logical combination of existing users to read and/or write and/or audit the data e.g. blockchain. A single, or plural levels of access may be supported. A private Blockchain may be used for data storage and a public Blockchain to monitor transactions, or vice versa. Metadata of files may be stored on a blockchain (or variation of or alternative thereto), whereas the files themselves may be stored off-chain e.g. via DHT e.g. using a peer to-peer network. Any cryptographic algorithm may be used to digitally sign blockchain transactions, and these are packed into the blocks of the ledger. The transactions in the Blockchain may or may not, after a given period of time, be grouped into time-stamped blocks each of which may be further encrypted and may be stored in a decentralized database. Any data transfer or transaction in the network may be required to undergo a consensus protocol such as but not limited to Proof of Work (PoW) or Proof of Stake (PoS) or Proof of Authority. Typically, the system includes logic, allowing each member digital service provider the option to agree to share data they have collected regarding would-be end users of their services, with other member digital service providers. Typically, once a member digital service provider is verified as an authentic user, that member is no longer required to re-establish their identity in the network, facilitating their own transactions (e.g. sharing of data regarding would-be service end-users, which is useful for authentication thereof) with their peer service providers. Typically, once verified, members can utilize a smart contract for such transactions. Data regarding an end-user may be encoded as an address to send a blockchain transaction to, so that the data is then in the blockchain without using a payload field inside the transaction. Data may or may not be stored on every node of the blockchain. Hashes of the data (which are smaller than the data itself, typically) and/or a portion (less than the entirety of) of the data may be stored on the blockchain, instead of the data itself. Querying data from the blockchain may for example include downloading a transaction identified by its ID or hash. The transaction ID may for example be stored in a dedicated column in a relational database.

The system may operate in a cloud. Any suitable known technologies may be used for running, maintaining, operating, upgrading and monitoring the blockchain networks in a cloud-based system. Blockchain-as-a-service platforms are available from Microsoft (Azure) , IBM (blockchain platform), EDF and others.

The system may use a combined distributed/blockchain database model to yield a combined software stack, wherein the blockchain stack provides all or any subset of decentralized administration, immutability and enhanced assets, and the distributed database provides scalability and data processing speed. Distributed storage may be used. Centralized storage combined with blockchain hashes may be used e.g. by generating a platform which stores content on a server rented from a hosting company, and then, each time new data or a new document is added to the system, a transaction is recorded on the blockchain, and the data or document gets a unique hash. P2P data sharing networks e.g. IPFS (Interplanetary File Storage System), Swarm, and Arweave block weave may be used; files may be stored on individual users’ servers and drives and may each be addressed by a unique hash associated therewith. Permissioned or private blockchains may be designed in any suitable way and may define data storage to be free. The design may or may not allow the private blockchain creator to maintain full control; non-creator users may or may not have control. The system may be designed to provide data and events infrastructure that runs across company firewalls associated with the various digital service provider users. External coordination web services may or may not be used.

The system may comprise a blockchain client that operates with existing operational systems such as but not limited to Prometheus and Helm. Kubernetes may be used to operate blockchains within Monax.

Cluster administration logic may be provided e.g. to ensure that the blockchain acts as a client which conforms to a given monitoring and alerting system, and/or that the blockchain's logs can be handled by a given log management system. Any suitable technology may be used to handle key management and node identity e.g. using Kubernetes secrets or using HSM solutions. The blockchain network may be a cluster or extranet or closed system or may use a meta-blockchain protocol which moves authenticated data and/or events across plural blockchains, yielding a routing layer on top of plural extranets. The system may connect to public blockchains e.g. via meta-blockchain protocols.

Each block may store transaction data e.g. date, time the block was added to the blockchain; data about who is participating in transactions e.g. a transaction in which a would-be end-user applies to a digital service provider and is or is not authenticated, or a transaction in which one digital service provider shares data about a given would-be enduser of that provider's services, with another digital service provider. Participants' identifiers may comprise a digital signature or username. Each block may store a unique code e.g. “hash” or other cryptographic code that is not stored by any other block.

Plural transactions may be stored in a single block.

Access to identifying information on end-users may be limited to the end-users' digital signature or username.

Each block has a position on the chain or “height.” Typically, each block, once added to the end of the chain, contains its own hash, as well as the hash of at least one block before it. Any suitable tests may be used for computers that want to join and add blocks to the chain e.g. “consensus models” such as “proof of work.”

The system may or may not be fully peer-to-peer and may or may not involve a trusted third party.

System members may be required to run a program which includes a public key and a private key. The public key may represent a location where transactions are deposited to and withdrawn from and may appear on the blockchain ledger as the user’s digital signature or confidential unique identifier. The public key may be generated from, e.g. be a shortened version of, their private key. Complexity may be such as to render generation of a private key from a public key, which is practically impossible, yielding confidentiality of data. There may or may not be a central database that keeps a blockchain network’s private keys.

According to certain embodiments, data e.g. about certain end-users and/or their ID documents, is generated, signed, and written into a blockchain, encoded and stored with a private key, to limit accessibility to that data e.g. only by certain entities such as certain blockchain members, perhaps subject to certain conditions.

Any code or logic may be built into the blockchain and used as a Smart Contract to facilitate, verify, or negotiate a contract, as per conditions that blockchain members agreed to. Typically, if and when those conditions are met, the code automatically carries out terms of the agreement (e.g. automatically provides certain particulars of an end-user of one member and digital service provider, to another member.

It is appreciated that terminology such as "mandatory", "required", "need" and "must" refer to implementation choices made within the context of a particular implementation or application described herewithin for clarity and are not intended to be limiting since in an alternative implementation, the same elements might be defined as not mandatory and not required, or might even be eliminated altogether.

Components described herein as software may, alternatively, be implemented wholly or partly in hardware and/or firmware, if desired, using conventional techniques, and vice-versa. Each module or component or processor may be centralized in a single physical location or physical device or distributed over several physical locations or physical devices.

Included in the scope of the present disclosure, inter alia, are electromagnetic signals in accordance with the description herein. These may carry computer-readable instructions for performing any or all of the operations of any of the methods shown and described herein, in any suitable order including simultaneous performance of suitable groups of operations, as appropriate. Included in the scope of the present disclosure, inter alia, are machine -readable instructions for performing any or all of the operations of any of the methods shown and described herein, in any suitable order; program storage devices readable by machine, tangibly embodying a program of instructions executable by the machine to perform any or all of the operations of any of the methods shown and described herein, in any suitable order i.e. not necessarily as shown, including performing various operations in parallel or concurrently rather than sequentially as shown; a computer program product comprising a computer useable medium having computer readable program code, such as executable code, having embodied therein, and/or including computer readable program code for performing, any or all of the operations of any of the methods shown and described herein, in any suitable order; any technical effects brought about by any or all of the operations of any of the methods shown and described herein, when performed in any suitable order; any suitable apparatus or device or combination of such, programmed to perform, alone or in combination, any or all of the operations of any of the methods shown and described herein, in any suitable order; electronic devices each including at least one processor and/or cooperating input device and/or output device and operative to perform e.g. in software any operations shown and described herein; information storage devices or physical records, such as disks or hard drives, causing at least one computer or other device to be configured so as to carry out any or all of the operations of any of the methods shown and described herein, in any suitable order; at least one program pre-stored e.g. in memory or on an information network such as the Internet, before or after being downloaded, which embodies any or all of the operations of any of the methods shown and described herein, in any suitable order, and the method of uploading or downloading such, and a system including server/s and/or client/s for using such; at least one processor configured to perform any combination of the described operations or to execute any combination of the described modules; and hardware which performs any or all of the operations of any of the methods shown and described herein, in any suitable order, either alone or in conjunction with software. Any computer-readable or machine -readable media described herein is intended to include non-transitory computer- or machine -readable media.

Any computations or other forms of analysis described herein may be performed by a suitable computerized method. Any operation or functionality described herein may be wholly or partially computer-implemented e.g. by one or more processors. The invention shown and described herein may include (a) using a computerized method to identify a solution to any of the problems or for any of the objectives described herein, the solution optionally including at least one of a decision, an action, a product, a service or any other information described herein that impacts, in a positive manner, a problem or objectives described herein; and (b) outputting the solution.

The system may, if desired, be implemented as a web-based system employing software, computers, routers and telecommunications equipment, as appropriate. Any suitable deployment may be employed to provide functionalities e.g. software functionalities shown and described herein. For example, a server may store certain applications, for download to clients, which are executed at the client side, the server side serving only as a storehouse. Any or all functionalities e.g. software functionalities shown and described herein, may be deployed in a cloud environment. Clients e.g. mobile communication devices such as smartphones, may be operatively associated with, but external to the cloud.

The scope of the present invention is not limited to structures and functions specifically described herein, and is also intended to include devices which have the capacity to yield a structure, or perform a function, described herein, such that even though users of the device may not use the capacity, they are, if they so desire, able to modify the device to obtain the structure or function.

Any “if -then” logic described herein is intended to include embodiments in which a processor is programmed to repeatedly determine whether condition x, which is sometimes true and sometimes false, is currently true or false, and to perform y each time x is determined to be true, thereby to yield a processor which performs y at least once, typically on an “if and only if’ basis e.g. triggered only by determinations that x is true, and never by determinations that x is false.

Any determination of a state or condition described herein, and/or other data generated herein, may be harnessed for any suitable technical effect. For example, the determination may be transmitted or fed to any suitable hardware, firmware or software module, which is known or which is described herein to have capabilities to perform a technical operation responsive to the state or condition. The technical operation may for example comprise changing the state or condition, or may more generally cause any outcome which is technically advantageous given the state or condition or data, and/or may prevent at least one outcome which is disadvantageous given the state or condition or data. Alternatively or in addition, an alert may be provided to an appropriate human operator or to an appropriate external system.

Features of the present invention, including operations, which are described in the context of separate embodiments may also be provided in combination in a single embodiment. For example, a system embodiment is intended to include a corresponding process embodiment and vice versa. Also, each system embodiment is intended to include a server- centered “view” or client centered “view”, or “view” from any other node of the system, of the entire functionality of the system, computer-readable medium, apparatus, including only those functionalities performed at that server or client or node. Features may also be combined with features known in the art and particularly although not limited to those described in the Background section or in publications mentioned therein.

Conversely, features of the invention, including operations, which are described for brevity in the context of a single embodiment or in a certain order, may be provided separately or in any suitable sub-combination, including with features known in the art (particularly although not limited to those described in the Background section or in publications mentioned therein) or in a different order, "e.g." is used herein in the sense of a specific example which is not intended to be limiting. Each method may comprise all or any subset of the operations illustrated or described, suitably ordered e.g. as illustrated or described herein.

Devices, apparatus or systems shown coupled in any of the drawings may in fact be integrated into a single platform in certain embodiments, or may be coupled via any appropriate wired or wireless coupling such as but not limited to optical fiber, Ethernet, Wireless LAN, HomePNA, power line communication, cell phone, Smart Phone (e.g. iPhone), Tablet, Laptop, PDA, Blackberry GPRS, Satellite including GPS, or other mobile delivery. It is appreciated that in the description and drawings shown and described herein, functionalities described or illustrated as systems and sub-units thereof can also be provided as methods and operations therewithin, and functionalities described or illustrated as methods and operations therewithin can also be provided as systems and sub-units thereof. The scale used to illustrate various elements in the drawings is merely exemplary and/or appropriate for clarity of presentation and is not intended to be limiting.

Any suitable communication may be employed between separate units herein e.g. wired data communication and/or in short-range radio communication with sensors such as cameras e.g. via WiFi, Bluetooth or Zigbee.

It is appreciated that implementation via a cellular app as described herein is but an example and instead, embodiments of the present invention may be implemented, say, as a smartphone SDK; as a hardware component; as an STK application, or as suitable combinations of any of the above.

Any processing functionality illustrated (or described herein) may be executed by any device having a processor, such as but not limited to a mobile telephone, set-top- box, TV, remote desktop computer, game console, tablet, mobile e.g. laptop or other computer terminal, embedded remote unit, which may either be networked itself (may itself be a node in a conventional communication network e.g.) or may be conventionally tethered to a networked device (to a device which is a node in a conventional communication network or is tethered directly or indirectly/ultimately to such a node).

Any operation or characteristic described herein may be performed by another actor outside the scope of the patent application and the description is intended to include apparatus whether hardware, firmware or software which is configured to perform, enable or facilitate that operation or to enable, facilitate or provide that characteristic.

The terms processor or controller or module or logic as used herein are intended to include hardware such as computer microprocessors or hardware processors, which typically have digital memory and processing capacity, such as those available from, say Intel and Advanced Micro Devices (AMD), any operation or functionality or computation or logic described herein may be implemented entirely or in any part on any suitable circuitry including any such computer microprocessor/s as well as in firmware or in hardware or any combination thereof.

It is appreciated that elements illustrated in more than one drawing, and/or elements in the written description, may still be combined into a single embodiment, except if otherwise specifically clarified herewithin. Any of the systems shown and described herein may be used to implement or may be combined with, any of the operations or methods shown and described herein. Any features, properties, logic, modules, blocks, operations or functionalities described herein which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment, except where the specification or general knowledge specifically indicates that certain teachings are mutually contradictory and cannot be combined. Any of the systems shown and described herein may be used to implement or may be combined with, any of the operations or methods shown and described herein. Conversely, any modules, blocks, operations or functionalities described herein , which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination, including with features known in the art. Each element e.g. operation described herein may have all characteristics and attributes described or illustrated herein or according to other embodiments, may have any subset of the characteristics or attributes described herein. It is appreciated that apps referred to herein may include a cell app, mobile app, computer app or any other application software. Any application may be bundled with a computer and its system software, or published separately. The term "phone" and similar used herein is not intended to be limiting and may be replaced or augmented by any device having a processor, such as but not limited to a mobile telephone, or also set-top-box, TV, remote desktop computer, game console, tablet, mobile e.g. laptop or other computer terminal, embedded remote unit, which may either be networked itself (may itself be a node in a conventional communication network e.g.) or may be conventionally tethered to a networked device (to a device which is a node in a conventional communication network or is tethered directly or indirectly /ultimately to such a node). Thus the computing device may even be disconnected from e.g., WiFi, Bluetooth etc. but may be tethered directly or ultimately to a networked device.

Claims

37 CLAIMS

1. An system providing an end-user authentication network for digital service providers, the system comprising: a data repository e.g. blockchain stored in computer memory, which includes plural records or blocks, and which is typically open or accessible to plural digital service providers each having end-users and each having end-user authentication functionality, thereby to allow the plural digital service providers to collaborate, relying on each others' previous end-user authentications, enhancing quality of and/or reducing cost of end-user authentication on the digital service providers' end users); and client side software residing in a hardware processor which allows an individual digital service provider to add an individual transaction between the digital service provider and an end user of the provider, as a new record or block, to the data repository e.g. blockchain, thereby to provide an end-user authentication network or consortium for digital service providers.

2. The system according to claim 1 wherein an online/mobile ID document image authentication and onboarding platform performs initial registration.

3. The system according to claim 2 wherein said initial registration includes prompting an end user aka customer to upload an image of their ID card.

4. The system according to claim 2 wherein said initial registration includes prompting an end user aka customer to allow or authorize collection and checks of their biometric information.

5. The system according to claim 4 wherein said biometric information includes at least one of face, liveness, voice, fingerprint. 38

6. The system according to claim 2 wherein said initial registration includes prompting an end user aka customer to upload images of POA (proof of address) documents.

7. The system according to claim 1 including functionality configured for background data drilling of customer information.

8. The system according to claim 7 wherein said data drilling includes address verification vis a vis POA documents.

9. The system according to claim 7 wherein said data drilling includes checking whether the customer appears on sanctions or PEPS (politically exposed persons (PEP) typically comprising current or former senior officials) lists known to the system.

10. The system according to claim 7 wherein said data drilling includes EDD (Enhanced Due Diligence).

11. The system according to claim 10 wherein said Due Diligence includes a credit check.

12. The system according to claim 10 wherein said Due Diligence includes address database validation.

13. The system according to claim 10 wherein said Due Diligence includes income validation.

14. The system according to claim 10 wherein said Due Diligence includes Due Diligence re employment history.

15. The system according to claim 10 wherein said Due Diligence includes Due Diligence re education history.

16. The system according to claim 1 and also comprising web client software which allows an end user to select a client via which the end user desires to authenticate e.g. if plural authentication providers are available.

17. The system according to claim 1 and also comprising server software which authenticates or declines each end-user seeking authentication.

18. The system according to claim 1 wherein each end-user E, once presenting ID documents, a token certifying E's identity is computed accordingly, e.g. by a provider P from among said plural digital service providers, and is sent to the end-user E, e.g. by said provider, for storage in an electronic device e.g. Smartphone that E has, and subsequently, at least one subsequent transaction e.g. with a provider other than provider P, authenticates the user E responsive to user E's presentation of said token.

19. The system according to claim 1 wherein at least some digital service providers having end-user authentication functionality, use an authentication provider, and wherein at least two of said digital service providers use the same authentication provider.

20. A method of operation for digital service providers, the method comprising: providing data regarding an entity wherein the entity includes an ID document and a bearer thereof wherein the data includes data regarding the ID document and data regarding the bearer; and determining whether or not to authenticate the entity by applying logic to the data regarding the ID document and the data regarding the bearer.

21. A method according to claim 20 wherein said data regarding the bearer includes pattern characteristics of the bearer's online activity.

22. A method according to claim 20 or claim 21 wherein said data regarding a given bearer is associated in memory with data regarding an ID card presented by said bearer, thereby to generate a digital twin of the entity, in memory.

23. The system of claim 1 wherein the plural digital service providers are interconnected by a private network to which access of non-member digital service providers is restricted, and wherein a contract is provided to automatically enforce rules governing exchange of data regarding authentication of digital service would-be endusers, between member digital service providers, and wherein said exchange of data allows a request for digital services provided by a would-be end-user E to service provider P at time T to benefit from data collected by at least one service provider P' in the network other than P, responsive to at least one request for digital services by would-be end user E to at least service provider P' at at least one time t preceding time T.

24. The system of claim 1 wherein an authentication provider which serves plural digital service providers in the network is also part of (e.g. a node within) the network.

25. A method according to claim 20 and wherein the data is stored in a data repository e.g. blockchain which includes plural records or blocks, and which is typically open or accessible to plural digital service providers each having end-users and each having enduser authentication functionality, thereby to allow the plural digital service providers to collaborate, relying on each others' previous end-user authentications, enhancing quality of and/or reducing cost of end-user authentication without placing any additional burden on the digital service providers' end users.

26. A method according to claim 20 and wherein client side software allows an individual digital service provider to add an individual transaction between the digital service provider and an end user of the provider, as a new record or block, to the data repository e.g. blockchain, thereby to provide an end-user authentication network or consortium for digital service providers.

27. The system of claim 1 wherein the digital service providers are configured for providing data regarding an entity wherein the entity includes an ID document and a bearer thereof wherein the data includes data regarding the ID document and data regarding the bearer; and determining whether or not to authenticate the entity by applying logic to the data regarding the ID document and the data regarding the bearer.

28. The system according to claim 7 wherein said data drilling includes social media checks.

29. A computer program product, comprising a non-transitory tangible computer readable medium having computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a method of operation for digital service providers, the method comprising providing data regarding an entity wherein the entity includes an ID document and a bearer thereof wherein the data includes data regarding the ID document and data regarding the bearer; and determining whether or not to authenticate the entity by applying logic to the data regarding the ID document and the data regarding the bearer.