System and method for bootstrapping a user binding
A system, apparatus, method, and machine readable medium are described for bootstrapping an authenticator. For example, one embodiment of a method comprising: confirming an identity of a user by a first relying party using a first identity verification technique responsive to the user acquiring a device having an authenticator; generating or collecting initial user verification reference data upon verifying the identity of the user through the first identity verification technique; securely providing the initial user verification reference data or data derived from the initial user verification reference data to the authenticator; the authenticator implementing a second identity verification technique by comparing the initial user verification reference data or data derived from the initial user verification reference data to data collected from the user or data collected from a device provided to the user; and providing proof of a successful verification of the identity of the user to a second relying party during a registration request of the authenticator with the second relying party.
1. A method comprising:
confirming an identity of a user by a first relying party using a first identity verification technique responsive to the user acquiring a first device having an authenticator;
wherein the first relying party provides the user with a subscriber identity module (SIM) inserted in the first device to communicate with the authenticator;
generating or collecting initial user verification reference data upon verifying the identity of the user through the first identity verification technique;
wherein generating initial user verification reference data comprises capturing first biometric data to be compared against second biometric data captured by the authenticator during the second identity verification technique;
securely providing, by the first relying party, the initial user verification reference data or data derived from the initial user verification reference data to the authenticator;
the authenticator implementing a second identity verification technique by comparing the initial user verification reference data or data derived from the initial user verification reference data to data collected from the user or data collected from the first device provided to the user;
and providing proof of a successful verification of the identity of the user to a second relying party prior to or during a registration request of the authenticator with the second relying party.
2. The method as in claim 1 wherein generating initial user verification reference data comprises generating a code to be entered by the user during the second identity verification technique.
3. The method as in claim 2 further comprising:
securely transmitting the code to the authenticator using encryption and securely communicating the code to the user.
4. The method as in claim 1 further comprising:
securely transmitting the first biometric data to the authenticator using encryption.
5. The method as in claim 1 wherein the proof of successful verification comprises a Boolean value or a hash of the initial user verification reference data.
6. The method as in claim 1 further comprising:
preprocessing the initial user verification reference data to generate the data derived from the initial user verification reference data.
7. The method as in claim 6 wherein the initial user verification reference data comprises a finger image and preprocessing comprises converting the finger image into a fingerprint template.
8. The method as in claim 1 wherein securely providing comprises encrypting the initial user verification reference data or the data derived from the initial user verification reference data using a first key equivalent to or associated with a second key stored by the authenticator, the authenticator to use the second key to decrypt the initial user verification reference data or the data derived from the initial user verification reference data.
9. The method as in claim 1 wherein the registration request comprises a Fast Identity Online (FIDO) registration request.
10. The method as in claim 1 further comprising:
displaying a prompt on a secure display of the first device in response to receipt of the initial user verification reference data or data derived from the initial user verification reference data, the prompt allowing the user to accept or reject processing of the initial user verification reference data or data derived from the initial user verification reference data.
11. The method as in claim 2 further comprising:
prompting the user to enter a new code to be used for subsequent authentications by the authenticator.
12. The method as in claim 1 further comprising:
ignoring any previously enrolled user verification reference data and leaving it unchanged for subsequent authentication and registration operations.
13. The method as in claim 1 further comprising:
limiting the second identity verification technique to a specific set of relying parties.
14. The method as in claim 1 further comprising:
limiting processing of the initial user verification reference data to a state in which no user has enrolled with the authenticator; and
providing an option to reset the authenticator to a factory default state.
15. The method as in claim 1 wherein the authenticator supports multiple alternative user verification methods and further supports an additional extension in the registration request that forces the use of a specific user verification method for that specific registration request.
16. The method as in claim 15 further comprising:
the relying party securely binding a specific identity to the authenticator.
17. A non-transitory machine-readable medium having program code stored thereon which, when executed by one or more machines, causes the machines to perform the operations of:
confirming an identity of a user by a first relying party using a first identity verification technique responsive to the user acquiring a first device having an authenticator;
wherein the first relying party provides the user with a subscriber identity module (SIM) inserted in the first device to communicate with the authenticator;
generating or collecting initial user verification reference data upon verifying the identity of the user through the first identity verification technique;
wherein generating initial user verification reference data comprises capturing first biometric data to be compared against second biometric data captured by the authenticator during the second identity verification technique;
securely providing, by the first relying party, the initial user verification reference data or data derived from the initial user verification reference data to the authenticator;
the authenticator implementing a second identity verification technique by comparing the initial user verification reference data or data derived from the initial user verification reference data to data collected from the user or data collected from the first device provided to the user;
and providing proof of a successful verification of the identity of the user to a second relying party prior to or during a registration request of the authenticator with the second relying party.
18. The machine-readable medium as in claim 17 wherein generating initial user verification reference data comprises generating a code to be entered by the user during the second identity verification technique.
19. The machine-readable medium as in claim 18 further comprising:
securely transmitting the code to the authenticator using encryption and securely communicating the code to the user.
20. The machine-readable medium as in claim 17 further comprising program code to cause the machines to perform the operation of:
securely transmitting the first biometric data to the authenticator using encryption.
21. The machine-readable medium as in claim 17 wherein the proof of successful verification comprises a Boolean value or a hash of the initial user verification reference data.
22. The machine-readable medium as in claim 17 further comprising program code to cause the machines to perform the operation of:
preprocessing the initial user verification reference data to generate the data derived from the initial user verification reference data.
23. The machine-readable medium as in claim 22 wherein the initial user verification reference data comprises a finger image and preprocessing comprises converting the finger image into a fingerprint template.