Patent Application
20140279519
This disclosed subject matter relates generally to the field of identification and/or payment systems and methods, and more particularly to obtaining and using identification information.
User identification and verification is important for many transactions with merchants and service providers. This is especially true with online transactions for large amounts of money when users and merchants or service providers are remote from each other. Traditionally, a user needs to present her identification document and verify herself with an online merchant or service provider for some transactions. The conventional mechanisms of identifying and verifying users are inconvenient and inefficient, and result in burdens for users.
In accordance with the disclosed subject matter, systems and methods are described for obtaining and using identification information.
The disclosed subject matter includes, in one aspect, a computerized method of identifying a user for transactions, which includes receiving an image of an identification document of the user during a first transaction with a first party, wherein the image is obtained using an image acquisition module of a device of the user. This method also includes receiving a device ID of the user's device and extracting identification credentials of the user from the image, as well as storing the identification credentials of the user and the device ID of the user's device on a server. The device ID can be associated with the identification credentials of the user. During a subsequent transaction with a second party, the method can include receiving the device ID of the user's device, retrieving the identification credentials of the user stored on the server based on the device ID received during the subsequent transaction, and transmitting the retrieved identification credentials to the second party to identify the user for the subsequent transaction. In some embodiments, the identification document is selected from a group consisting of an identification card, a driver's license, a passport, and a utility bill.
In some other embodiments, the computerized method of identifying a user for transactions also includes authenticating the identification credentials of the user with an authentication authority during the first transaction.
In another embodiment, the disclosed subject matter includes a computer system for identifying a user for transactions. In this embodiment, the subject matter includes a client interface configured to, during a first transaction, receive an image of an identification document of a user from a device of the user and to receive a device ID of the user's device. This embodiment can also include an identification credential extractor configured to extract identification credentials of the user from the image, and an identification credential manager configured to, during the first transaction, store both the identification credentials of the user and the device ID, wherein the device ID is associated with the identification credentials of the user. This embodiment can also include a third-party interface configured to, during the first transaction, transmit the identification credentials to a third party to identify the user. The client interface can further be configured to, during a subsequent transaction, receive the device ID, and the identification credential manager can be further configured to, during the subsequent transaction, retrieve the identification credentials of the user based on the received device ID, wherein the third-party interface is further configured to, during the subsequent transaction, transmit the retrieved identification credentials to identify the user.
In some embodiments, the computer system for identifying a user for transactions also includes an authentication authority interface configured to transmit the identification credentials of the user to an authentication server to authenticate the identification credentials of the user during the first transaction.
In still other embodiments, the disclosed subject matter includes a computerized method of identifying a user for transactions, which includes receiving identification credentials of the user during a first transaction with a first party, wherein the identification credentials are obtained using a device of the user. This method can also include receiving a device ID of the user's device, storing the identification credentials of the user and the device ID of the user's device on a server, wherein the device ID is associated with the identification credentials of the user. During a subsequent transaction with a second party, the method can include receiving the device ID of the user's device, retrieving the identification credentials of the user stored on the server based on the device ID received during the subsequent transaction, and transmitting the retrieved identification credentials to the second party to identify the user for the subsequent transaction.
The disclosed subject matter includes, in yet another aspect, a computer system for identifying a user for transactions, which includes a client interface configured to, during a first transaction with a first party, receive identification credentials of a user from a device of the user and to receive a device ID of the user's device, an identification credential manager configured to, during the first transaction, store both the identification credentials of the user and the device ID, wherein the device ID is associated with the identification credentials of the user, and a third-party interface configured to, during the first transaction, transmit the identification credentials to a third party to identify the user, wherein the client interface is further configured to, during a subsequent transaction with a second party, receive the device ID, and the identification credential manager is further configured to, during the subsequent transaction, retrieve the identification credentials of the user based on the received device ID, wherein the third-party interface is further configured to, during the subsequent transaction, transmit the retrieved identification credentials to identify the user.
The disclosed subject matter includes, in yet another aspect, a computerized method of identifying a user for transactions, which includes during a first transaction with a first party, acquiring an image of an identification document of the user from an image acquisition module of a device of the user, determining a device ID of the user's device, transmitting the image of the identification document of the user along with the device ID to a server to identify the user for the first transaction, during a subsequent transaction with a second party, transmitting the device ID to the server to identify the user for the subsequent transaction, and receiving confirmation of identification of the user based on the transmitted device ID during the subsequent transaction with the second party.
Various embodiments of the subject matter disclosed herein can provide one or more of the following capabilities. An identification credential system can provide more convenient and efficient mechanisms for obtaining and using identification information. An identification credential system can ease the burden of users and can also improve efficiency and lower cost for online merchants or service providers. Easier and quicker transactions may encourage users to engage in more online transactions—enhancing business of online merchants or service providers.
These and other capabilities of embodiments of the disclosed subject matter will be more fully understood after a review of the following figures, detailed description, and claims.
The disclosed subject matter is illustrated in the figures of the accompanying drawings which are meant to be exemplary and not limiting, in which like references are intended to refer to like or corresponding part, and in which:
In the following description, numerous specific details are set forth regarding the systems and methods of the disclosed subject matter and the environment in which such systems and methods may operate, in order to provide a thorough understanding of the disclosed subject matter. It will be apparent to one skilled in the art, however, that the disclosed subject matter may be practiced without such specific details, and that certain features, which are well known in the art, are not described in detail in order to avoid complication of the disclosed subject matter. In addition, it will be understood that the embodiments described below are only examples, and that it is contemplated that there are other systems and methods that are within the scope of the disclosed subject matter. Numerous changes in the details of implementation of the disclosed subject matter can be made without departing from the spirit and scope of the disclosed subject matter. Features of the disclosed embodiments can be combined and rearranged in various ways.
An identification credential system, according to certain embodiments of the disclosed subject matter, can provide more convenient and efficient mechanisms for obtaining and using identification information. An identification credential system can ease the burden of users. For example, a user of the identification credential system may only need to present her identification document or credentials during a first transaction; the user may not need to present her identification document or credentials again during a subsequent transaction, even if the subsequent transaction is directed to a new merchant or service provider. Some transactions require verification of identification. As examples, large online purchases may require verification of identification, as may opening a bank account or an online gambling account. An identification credential system can also improve efficiency and lower cost for online merchants or service providers. For example, an online merchant or service provider may reduce or eliminate the need of maintaining its own user identification and verification system. Easier and quicker transactions may encourage users to engage more online transactions—enhancing business of online merchants or service providers. The system can also allow merchants to obtain KYC (Know Your Customer) information easily without bother to the customer.
Embodiments of the disclosed subject matter can be implemented in a networked computing environment.
Each identification credential client 110 can communicate with the identification credential server 140 to send data to, and receive data from, the identification credential server 140, e.g., across the network 130. Each identification credential client 110 can be directly coupled to the identification credential server 140; alternatively, each identification credential client 110 can be connected to the identification credential server 140 via any other suitable device, communication network, or combination thereof. For example, each identification credential client 110 can be coupled to the identification credential server 140 via one or more routers, switches, access points, and/or communication network (as described below in connection with the network 130). Each identification credential client 110 can be in the form of, for example, a desktop computer, a mobile computer, a tablet computer, a cellular device, a smartphone, or any computing systems that are capable of performing computation.
Each identification credential client 110 can include an image acquisition module 115 and an identification credential agent 120. The image acquisition module 115 can capture an image of an identification document of a user. The identification credential client 110 can optionally process the captured image and then send the relevant information to the identification credential server 140 for further processing. As an example, the image acquisition module 115 can be the camera in an embodiment in which the identification credential client 110 is a smartphone.
The identification credential agent 120 of the client 110 can help support a service of obtaining and using identification credentials. The identification credential agent 120 can be embedded inside the identification credential client 110 as a software module, a hardware component, or a combination of both. Alternatively, the identification credential agent 120 can be separate from but coupled to the identification credential client 110. The identification credential client 110 can communicate with the identification credential server 140 directly or via its agent 120. The structures, functions, and features of the identification credential agent 120 are described in detail later in this document.
The network 130 can include the Internet, a cellular network, a telephone network, a computer network, a packet switching network, a line switching network, a local area network (LAN), a wide area network (WAN), a global area network, or any number of private networks currently referred to as an Intranet, and/or any other network or combination of networks that can accommodate data communication. Such networks may be implemented with any number of hardware and software components, transmission media and network protocols. Although
The identification credential server 140 can include an internal storage medium and can also be coupled to an external storage medium (e.g., the storage medium 150), which can be configured to store data for the identification credential server 140. Any identification credential client 110 can also store data in, and access data from, the storage medium 150 via the identification credential server 140. Although
The authentication authority 160 can provide authentication service to the identification credential client 110, the identification credential server 140, or other components of the system environment 100. The authentication authority 160 can be operated by, controlled by, or associated with the same entity that operates, controls, or is associated with the identification credential server 140; alternatively, the authentication authority 160 can be operated by, controlled by, or associated with a different entity, which may or may not be related. Although
The third party 170 can provide other relevant services to the identification credential client 110, the identification credential server 140, or other components of the system environment 100. The third party 170 can be an online merchant or retailer from which users of the system environment 100 can purchase products. For example, the third party 170 can be a retailer e-commerce web service (e.g., BestBuy.com, etc.) which may need to verify a user's identification credentials (e.g., name and address). The third party 170 can also be a service provider which can provide a service to users of the system environment 100. For example, the third party 170 can be an online entertainment provider (e.g., gambling server) which may need to verify a user's identification credentials (e.g., age and nationality) for the opening of an account. The third party 170 can also be a service provider such as a bank, which may need to verify a user's identification credentials (e.g., age, current address, and nationality) for the opening of an account. The third party 170 can be operated by, controlled by, or associated with the same entity that operates, controls, or is associated with the identification credential server 140 and/or the authentication authority 160; alternatively, the third party 170 can be operated by, controlled by, or associated with a different entity, which may or may not be related. Although
The cloud storage 180 can store data from the storage medium 150 with the same restrictions, security measures, authentication measures, policies, and other features associated with the storage medium 150.
The third party token provider (TPTP) 190 can provide tokens for the identification credential system environment 100. The TPTP 190 can be operated by, controlled by, or associated with the same entity that operates, controls, or is associated with the identification credential server 140, the authentication authority 160, and/or the third party 170; alternatively, the TPTP 190 can be operated by, controlled by, or associated with a different entity, which may or may not be related. Although
An identification credential server can provide features and functionalities to an identification credential system environment (e.g., 100 in
The identification credential server 140 can communicate with one or more identification credential agent/clients 110 through the identification credential agent interface 210. The identification credential server 140 can receive an image of an identification document or identification credentials of a user from an identification credential client (e.g., 110 in
The identification credential extractor 220 can extract identification credentials, e.g., from an image of an identification document. In some embodiments, the identification credential extractor 220 can recognize the textual information (e.g., via optical character recognition or OCR techniques) on an image. For example, the identification credential extractor 220 can extract identification credentials (e.g., name, gender, age, and address, etc.) from an image of a user's driver license. If the identification credential extractor 220 is unable to extract sufficient identification credentials, the identification credential extractor 220 can inform the identification credential client/agent 110 and/or request a new image of the identification document or an image of a new identification document, e.g., via the identification credential agent interface 210.
The identification credential manager 230 can manage identification credentials of users of an identification credential system environment (e.g., 100 in
Referring again to
The identification credential server 140 can communicate with one or more third party (e.g., 170 in
The identification credential server 140 can communicate with one or more third party token providers (TPTP) (e.g., 190 in
One or more identification credential clients can participate in an identification credential system environment (e.g., 100 in
The identification credential agent 120 can communicate with users through the user interface 410. A user can input an image of an identification document or identification credentials to the identification credential agent 120 through the user interface 410. In one example, if the user already has an image of her identification document (e.g., passport), the user may not need to capture an image of her passport. The image may have already existed on the user's device. Alternatively, the image may be stored and retrieved from other sources, such as companies like Lemon Wallet that maintain wallets and image collections. In another example, if a user already has an electronic identification document (e.g., electronic passport), the user may not need to input an image of her passport and can instead upload the electronic passport directly into the identification credential agent 120. The electronic document (e.g., passport) can be loaded from the user's device or received from other sources via various technologies (e.g., NFC). A user can also configure and customize the identification credential agent 120 via the user interface 410, subject to any system policy restrictions.
The identification credential agent 120 can communicate with its associated host (e.g., an identification credential client 110) through the host interface 420. In some embodiments, the identification credential agent 120 can receive an image of an identification document (e.g., captured by an image acquisition module 115) through the host interface 420. In some other embodiments, the identification credential agent 120 can receive identification credentials through the host interface 420. For example, if a host device already contains a copy of a user's identification credentials, the identification credentials can be uploaded into the identification credential agent 120 automatically. In some other embodiments, the identification credential agent 120 can obtain device information of the host device via the host interface. For example, the device information can include hardware information of the host device, such as a MAC address of a network interface card, an IMEI number of a smartphone, a serial number of a memory device, a serial number of a CPU, etc. These device information can be used to generate or derive a device ID of the host device.
In some embodiments, the client 110 is not able to extract identification credentials from an image of an identification document. In other embodiments, however, the client 110 is able to do so. If the client 110 is able to extract identification credentials from an image, the identification credential extractor 430 can be used to extract these identification credentials, e.g., from an image of an identification document. In some embodiments, the identification credential extractor 430 can recognize the textual information (e.g., via optical character recognition or OCR techniques) on an image. For example, the identification credential extractor 430 can extract identification credentials (e.g., name, gender, age, and address, etc.) from an image of a user's driver license. If the identification credential extractor 430 is unable to extract sufficient identification credentials, the identification credential extractor 430 can inform the identification credential client/agent 110 and/or request a new image of the identification document or an image of a new identification document, e.g., from the image acquisition module 115.
The device ID determiner 440 can determine a device ID of a user's device (i.e., the identification credential client 110). In some embodiments, the device ID determiner 440 can receive device information (e.g., hardware information) from the host interface 420 and generate a device ID based on the received device information. For example, the device ID determiner 440 can run an algorithm (e.g., a hash function) on the device information to generate a device ID, which can be a globally unique identifier (GUID). A device ID can be used to uniquely identify a device. The device ID of a device can change when one or more components of the device change. The device ID determiner 440 can re-generate the device ID of a device on demand, periodically, or automatically when certain changes are detected.
The identification credential agent 120 of the client 110 can communicate with other components of an identification credential system environment (e.g., 100 in
At step 510, an image of an identification document of the user can be acquired from a device of the user (i.e., client 110) during a first transaction. An identification document can be any identification card, a driver's license, a passport, a utility bill, or any other document containing identification information (e.g., a biometric passport). In some embodiments, the image can be captured, e.g., by an image acquisition module 115 of an identification credential client 110. In some other embodiments, the image can be received, e.g., via a host interface of an identification credential agent 120. In some other embodiments, the acquired image can be determined (e.g., locally) to be insufficient for extracting identification credentials. In these situations, another image of the identification document or an image of another identification document can be acquired from the device of the user.
At step 520, a device ID of the user's device can be determined. The device ID can be determined based on device information of a device. For example, the device information can include hardware information of a device, such as a MAC address of a network interface card, an IMEI number of a smartphone, a serial number of a memory device, a serial number of a CPU, etc. In some embodiment, the device information of a host device can be retrieved via the host interface of the host device. In some other embodiments, the device ID can be generated by running an algorithm (e.g., a hash function) on the device information. The device ID can be a globally unique identifier (GUID), which can be used to uniquely identify a device. Optionally, 3rd party tools can be used to acquire device IDs. For example, a 3rd party tool can provide a list of the user' other devices from which device IDs can be queried. In some situations, the device ID of a device which is not in the identification credential system environment 100 can be used.
At step 530, the image of the identification document of the user can be transmitted along with the device ID to an identification credential server (e.g., 140 in
At step 540, during a subsequent transaction the device ID of the device can be transmitted to the identification credential server 140. The device ID determined during the first transaction, for example, can be re-used. The device ID can be used to identify the user for the subsequent transaction, e.g., with the same or a different third party 170. In one embodiment, the first transaction described above can be performed with one third party, such as, for example, an online merchant. Later, during the subsequent transaction, the user may wish to use the same client 110 for a transaction with a different third party. In this case, the different third party may not have the identification credentials of the user. Because the identification credential server 140, however, has the client's 110 device ID and the user's identification credentials from the first transaction, that information can be used to speed up and streamline the subsequent transaction for the user, without requiring the user to enter her identification information a second time.
The operation 500 can have additional steps. For example, a request for transmitting additional identification credentials can be received from an identification credential server. In these situations, the additional identification credentials can be transmitted to the identification credential server. Optionally, the operation 500 can also have a step where a confirmation of identification of the user based on the transmitted device ID during the subsequent transaction is received.
At step 610, an image of an identification document of the user can be received during a first transaction, e.g., at an identification credential server 140. An identification document can be any identification card, a driver's license, a passport, a utility bill, or any other document containing identification information. In some embodiments, the image can be obtained using an image acquisition module of a device of the user.
At step 620, a device ID of the user's device can be received, e.g., at the identification credential server. The device ID can be determined based on device information of the user's device as described above.
At step 630, identification credentials of the user can be extracted from the received image, e.g., at the identification credential server 140. In some embodiments, textual information on the image can be recognized as described above, e.g., using optical character recognition or OCR techniques. For example, identification credentials, such as name, gender, age, and address, can be extracted from an image of a user's driver license. If the received image is determined to be insufficient for extracting identification credentials, a request for another image of the identification document or an image of another identification document can be sent, e.g., to an identification credential agent/client.
At step 640, the identification credentials of the user can be authenticated, e.g., with an authentication authority 160. For example, the identification credentials extracted from an image of a driver's license can be authenticated with a governmental authority such as Department of Motor Vehicles. In another example, the identification credentials extracted from an image of a passport can be authenticated with a passport issuing agency. The authentication status can be stored in an identification credential directory (e.g., 300 in
At step 650, the identification credentials of the user and the device ID of the user's device can be stored, e.g., at the identification credential server 140 or a storage device associated therewith. In some embodiments, the identification credentials can be stored along with the device ID of the user's device from which the identification credentials are originated. For example, an identification credential directory (ICD) can be maintained by an identification credential manager (e.g., 230 in
At step 660, during a subsequent transaction the device ID of the user's device can be received, e.g., at the identification credential server 140. The device ID received during the subsequent transaction can be the same as the device ID received during the first transaction.
At step 670, the identification credentials can be retrieved based on the device ID, e.g., at the identification credential server 140. The identification credentials can be previously stored, e.g., in an identification credential directory, on the identification credential server 140 during the first transaction. The identification credentials can be uniquely identified by the device ID.
At step 680, the retrieved identification credentials can be transmitted, e.g., to a third party 170 with which the user desires to transact. The identification credentials can be used to identify the user for the subsequent transaction.
A user can access an identification credential system environment (e.g., 100 in
Identification credential clients and servers can be implemented in various computing devices.
The computing system 800 can also optionally include a user interface (UI) 806, a file system module 808, and a communication interface 810. The UI 806 can provide an interface for users to interact with the computing system 800 in order to access the identification credential system environment 100. The file system module 808 can be configured to maintain a list of all data files, including both local data files and remote data files, in every folder in a file system. The file system module 808 can be further configured to coordinate with the memory 804 to store and cache files/data. The communication interface 810 can allow the computing system 800 to communicate with external resources (e.g., a network or a remote client/server). The computing system 800 can also include identification credential modules 812. When the computing system 800 hosts or serves as an identification credential client, the identification credential modules 812 can include an image acquisition module (e.g., 115 in
The identification system described herein can provide a number of benefits to both customers (who use the clients 110) and to merchants or service providers. In addition to the features described above, it can be used to make special offers to users of identification credential clients 110 of the system. For example, accredited users can be offered special pricing or special deals to reflect the knowledge that the customer is known from the identification credential system and is a lower risk for a fraudulent transaction. In another example, the identification system can also recommend products/services to users based on the online activity history of the users (e.g., the websites visited, the product/service purchased, etc.).
It is to be understood that the disclosed subject matter is not limited in its application to the details of construction and to the arrangements of the components set forth in the following description or illustrated in the drawings. The disclosed subject matter is capable of other embodiments and of being practiced and carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting.
For example, in additional to the features described above, an identification credential system according to certain embodiment of the disclosed subject matter can also store other transaction related information (e.g., payment information such as credit/debit card information, gift cards, store credits, and discounts, etc.). The stored payment information can be used in conjunction with the identification information to facilitate transactions. In one scenario, once an user's identification credentials are identified, the identification credentials can be sent to a merchant or service provider along with the user's payment information to complete a transaction. The payment information can be stored, for example, on the identification credential server 140 along with identification credentials for the user, and this payment information can be linked to the user through the device ID. Accordingly, when a user desired to use the client 110 for a subsequent transaction, the device ID can be used to retrieve both the payment information (e.g., credit card number, expiration date, and code) along with the identification credentials.
In addition to associating a user's identification credentials with the user via the device ID of the user' device (i.e., something the user has), the user's identification credentials can also be associated with the user via other mechanisms. For example, a user's identification credentials can be linked to something the user knows (e.g., login username/password). In particular, a user's identification credentials can be stored in a user account, e.g., maintained on an identification credential server as described above. A user can access her identification credentials when she logs in to her account, e.g., by entering a username and password pair. Once logged in, the user can view and edit her identification credentials. The user can also utilize her stored identification credentials to conduct transactions with merchants or service provider, e.g., from her user account or from other websites associated with her user account.
As such, those skilled in the art will appreciate that the conception, upon which this disclosure is based, may readily be utilized as a basis for the designing of other structures, methods, and systems for carrying out the several purposes of the disclosed subject matter. It is important, therefore, that the claims be regarded as including such equivalent constructions insofar as they do not depart from the spirit and scope of the disclosed subject matter.
Although the disclosed subject matter has been described and illustrated in the foregoing exemplary embodiments, it is understood that the present disclosure has been made only by way of example, and that numerous changes in the details of implementation of the disclosed subject matter may be made without departing from the spirit and scope of the disclosed subject matter, which is limited only by the claims which follow.
A “server,” “client,” “agent,” “module,” “interface,” and “host” is not software per se and includes at least some tangible, non-transitory hardware that is configured to execute computer readable instructions.
