Self-authenticating digital identity
A system and method for a self-authenticating identity. A self-authenticating identity is a digital identity created in an embodiment by aggregating a user's verified identity information and its public key, both of which are digitally signed by the user and an identity provider. This cryptographic binding allows the user to prove it is in fact the true party that the identity was issued to, without the need for a third party to be directly involved. The identity may also contain information that conveys how the identity was verified.
1. A method of creating and applying a self-authenticating digital identity for a user having an identity, wherein the method comprises the steps of:
(a) the user requesting the self-authenticating digital identity from an identity provider;
(b) the identity provider taking steps to verify the identity of the user, including employing a third party service having verification expertise or capabilities beyond those held by the identity provider to ensure the identity of the user;
(c) the identity provider creating an identity assertion for the user, where the identity assertion includes verification data including a date the identity provider created the identity assertion, the identity of the third party service, and information describing how the identity of the user was verified;
(d) the identity provider delivering the identity assertion to the user;
(e) the user creating a first aggregated identity assertion comprising the identity assertion received from the identity provider, a date, and a public encryption key associated with the user;
(f) the user digitally signing the first aggregated identity assertion with a private encryption key associated with the user;
(g) the user delivering the digitally signed first aggregated identity assertion to the identity provider;
(h) the identity provider validating the digitally signed first aggregated identity assertion;
(i) the identity provider creating a second aggregated identity assertion comprising the first aggregated identity assertion received from the user, a date, and a public encryption key associated with the identity provider;
(j) the identity provider digitally signing the second aggregated identity assertion;
(k) the identity provider delivering the digitally signed second aggregated identity assertion to the user, wherein the digitally signed second aggregated identity assertion constitutes the self-authenticating digital identity;
(l) the user sending the self-authenticating identity to a relying party;
(m) the user verifying to the relying party that the user possesses the private encryption key associated with the user; and
(n) the relying party accessing and evaluating the verification data to provide assurance regarding the validity of the self-authenticating identity; and
(o) the relying party validating the authenticity of the self-authenticating identity by validating that the identity provider is a trusted issuer by confirming the identity provider's public key with the identity provider or by confirming the identity provider's public key with the third party service.
2. The method of claim 1 wherein the identity assertion includes a confidence level.
3. The method of claim 2 wherein one or more of the public encryption keys is a hashed public key.
4. The method of claim 3 wherein the second aggregated identity assertion is digitally signed with a private encryption key associated with the identity provider.
5. The method of claim 3 wherein the second aggregated identity assertion is digitally signed with a group or ring signature.
6. The method of claim 1 further including the step of the relying party validating the authenticity of the self-authenticating identity by making an inquiry to the third party service as to whether the self-authenticating identity is still valid.
7. The method of claim 1 further including the step of the relying party validating the authenticity of the self-authenticating identity by evaluating the verification data.