Method and system for interoperable identity and interoperable credentials
The present teaching relates to generating an identifier for a person. In one example, an actual name of the person is received. The identity of the person that is associated with the actual name of the person is proved at a pre-determined level of assurance (LOA) required by an identity management system. When the identity of the person has been proved, a peripheral name is solicited from the person. An identifier that includes the actual name and the peripheral name of the person is created. Whether the identifier is unique is determined. The steps of soliciting, creating, and determining are repeated until the identifier is unique. The peripheral name is associated with the person. The identifier is associated with the person.
1. A system comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, causes the system to display a user interface for authenticating a user, the user interface configured to:
receive a personal identifier,
provide the personal identifier and a requested level of assurance to an identity service provider,
receive a list of credential types from the identity service provider, wherein each credential type in the list of credential types has a level of assurance that is equal to or higher than the requested level of assurance and each credential type is associated with a respective credential bound to a globally unique identifier (GUID) matched to the personal identifier, and wherein each credential type is representative of a type of credential verified by a respective credential service provider via a respective credential verification service agent configured to verify a credential identifier and a digital credential for the respective credential,
display the list of credential types so that each credential type in the list of credential types is selectable by the user,
receive a selection of a credential type,
obtain an asserted digital credential for the selected credential type, wherein the asserted digital credential is one of a password, a passphrase, a personal identifier number, a finger print, a voice sample, a retinal scan, a hard token, or a public key certificate,
provide the asserted digital credential and the selected credential type to the identity service provider, wherein the identity service provider uses the GUID to determine an associated credential identifier for the selected credential type and provides, for verification, the associated credential identifier and the asserted digital credential to the respective credential verification service agent for the respective credential service provider for the selected credential type, and
receive a response from the identity service provider reflecting an outcome of the verification, wherein a successful outcome authenticates the user to the system.
2. The system of claim 1 , wherein the associated credential identifier includes a user name.
3. The system of claim 1 , wherein the personal identifier includes an actual name of the user and a chosen name.
4. The system of claim 1 , wherein the user interface includes a first user interface and the memory further stores instructions that, when executed by the at least one processor, causes the system to display a second user interface for authenticating a user, the second user interface configured to:
collect a credential identifier and a digital credential; and
provide the credential identifier and the digital credential to a second verification service agent, the second verification service agent being different from the credential verification service agent associated with the selected credential type, wherein a successful outcome of a verification of the credential identifier and the digital credential by the second verification service agent authenticates the user to the system.
5. The system of claim 4 , wherein the first user interface is displayed in addition to the second user interface in a combined user interface.
6. The system of claim 1 , wherein the selected credential type includes a first credential type and responsive to an unsuccessful outcome of the verification, the user interface is further configured to:
display the list of credential types so that each credential type in the list of credential types is selectable by the user,
receive a selection of a second credential type from the list of credential types,
responsive to receiving the selection, obtaining a second asserted digital credential for the second credential type, and
provide the second asserted digital credential and the second credential type to the identity service provider, wherein the identity service provider uses the GUID to determine a second credential identifier for the second credential type and provides, for verification, the second credential identifier and the second asserted digital credential to a second credential verification service agent associated with the second credential type.
7. The system of claim 6 , wherein the first credential type is different from the second credential type.
8. A system comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, causes the system to perform operations including:
receiving a requested level of assurance from a trusted application,
identifying a list of credential types, wherein each credential type of the list of credential types has a respective level of assurance that is equal to or higher than the requested level of assurance and each credential type is representative of a type of credential verified by a credential service provider using a respective credential verification service agent that is configured to verify a credential of the credential type, the credential including a credential identifier and an asserted digital credential,
providing the list of credential types to the trusted application,
receiving, from the trusted application, a personal identifier and a selected credential type selected from the list of credential types,
identifying an identifier of the selected credential type that is also bound to a globally unique identifier (GUID) matching the personal identifier,
obtaining an asserted digital credential, wherein the asserted digital credential is one of a password, a passphrase, a personal identifier number, a finger print, a voice sample, a retinal scan, a hard token, or a public key certificate,
providing the asserted digital credential and the identified credential identifier for verification to the respective credential verification service agent for the credential service provider for the selected credential type, and
providing a verification outcome received from the respective credential verification service agent to the trusted application, wherein a successful outcome authenticates a user for accessing the trusted application.
9. The system of claim 8 , wherein the selected credential type is a first credential type and the memory stores instructions that, when executed by the at least one processor, causes the system to perform further operations including;
responsive to failure to identify a credential identifier of the first credential type that is associated with the GUID, determine a second list of credential types, each credential type of the second list of credential types having a respective level of assurance that is equal to or higher than the requested level of assurance and having a credential identifier associated with the GUID;
provide the second list of credential types to the trusted application; and
receive, from the trusted application, a selected credential type from the second list of credential types,
wherein the identifying, obtaining and providing occur using the selected credential type from the second list of credential types.
10. The system of claim 8 , wherein the memory stores instructions that, when executed by the at least one processor, causes the system to perform further operations including;
receiving a request to add a credential of a specified credential type for the GUID; and
initiating a process to associate a new credential identifier with the GUID.
11. The system of claim 10 , wherein the request to add a credential is received from an authenticated user.
12. The system of claim 8 , wherein the trusted application lacks an associated credential type.
13. The system of claim 8 , wherein the trusted application has an associated credential type that differs from the selected credential type.
14. The system of claim 8 , wherein the personal identifier is a universal name that is a concatenation of a given name, a special character, and a chosen name.
15. The system of claim 8 , wherein the level of assurance represents a level of assurance as defined by NIST document 800-61-1.
16. The system of claim 8 , further comprising:
a credential database storing a plurality of credential records, each credential record including a GUID, a level of assurance, a credential verification service agent, and a credential identifier.
17. The system of claim 8 , wherein the personal identifier and the asserted digital credential are provided via a voice recorder.
18. A method comprising:
receiving a requested level of assurance from a trusted application;
identifying a set of credential types, each credential type in the set of credential types being representative of a type of credential verified by a respective credential service provider via a respective credential verification service agent configured to verify an asserted credential of the credential type, the asserted credential including a credential identifier and verification information for the credential identifier and wherein each credential type in the set of credential types has a credential with a respective level of assurance that is equal to or higher than the requested level of assurance;
providing the set of credential types to the trusted application;
receiving, from the trusted application, a personal identifier, a selected credential type that was selected from the set of credential types, and verification information for the selected credential type, wherein the verification information is one of a password, a passphrase, a personal identifier number, a finger print, a voice sample, a retinal scan, a hard token, or a public key certificate;
determining a credential identifier of the selected credential type that is also bound to a globally unique identifier (GUID) matching the personal identifier;
obtaining a verification outcome by providing the verification information and the credential identifier as an asserted credential to the respective credential verification service agent associated with the respective credential service provider for the selected credential type; and
providing the verification outcome to the trusted application, wherein a successful verification outcome authenticates a user for access the trusted application.
19. The method of claim 18 , wherein the personal identifier and the verification information are provided via voice recorder.
20. The method of claim 18 wherein the trusted application lacks an association with a credential type.
21. The method of claim 18 , wherein a level of assurance represents a degree to which a relying party can be assured that the credential represents a person presenting the credential.
22. The system of claim 1 , wherein the level of assurance represents a level of assurance as defined by NIST document 800-61-1.