System and method for electronic credentials

1. A method of provisioning a credential authentication system, the method comprising:

wirelessly conveying first data from at least one data device of a first party to an authentication server, the first data including a first party identifier, a confidential data item of a second party, and a request to process the confidential data item, wherein the confidential data item of the second party is generated at the at least one data device of the first party;

at the authentication server, initiating a session with the at least one data device of the first party and processing the first data that comprises the confidential data item to determine that a security protocol is associated with the confidential data item and determine that the request is a storage request;

at the authentication server, generating second data, wherein the second data is a result of operating on the confidential data item with a one-way function;

based on the determined security protocol and the determined storage request, storing the confidential data item and the second data at a database;

terminating the initiated session in accordance with an expiration factor associated with at least one of the confidential data item and the second data, wherein the expiration factor is selected from the group consisting of: a clock time, a number of requests to access either the confidential data or the second data, and combinations thereof;

transmitting a provisioning request to the authentication server from a data device of the second party;

retrieving a confidential data item from the authentication server based on the provisioning request;

transmitting an authentication request to the data device of the second party, wherein the authentication request prompts the second party to send an authentication message from the data device of the second party to the authentication server; and

upon receipt of the authentication message from the data device of the second party, transmitting, based on the provisioning request, the retrieved confidential data item from the authentication server to a third party database that is separate from the authentication server.

2. The method of claim 1 , further comprising:

determining, based on the first data, that a digital certificate is to be issued; requesting issuance of a digital certificate based on at least the confidential data item;

receiving the digital certificate; and

storing the digital certificate at the database.

3. The method of claim 2 , wherein the digital certificate is generated by operating on issuer data, the confidential data item, a timestamp, and an indication of whether the first party or the second party requested the issuance of the digital certificate with a one-way function.

4. The method of claim 1 , further comprising:

determining, based on the first data, that a digital certificate is to be created;

creating a digital certificate based on at least the confidential data item; and

storing the digital certificate at the database.

5. The method of claim 4 , further comprising:

transmitting a second party identifier from the at least one data device of the first party to the authentication server; and

based on receipt of the second party identifier, sending an acknowledgement message from the authentication server to a data device of the second party, wherein the acknowledgement message provides a notification that the authentication system has been provisioned for secure storage of the confidential data item.

6. The method of claim 1 , wherein said processing the first data includes comparing the confidential data item against a predetermined list of data items.

7. The method of claim 1 , wherein the confidential data item and the second data are stored in a second party profile at the database.

8. The method of claim 7 , further comprising:

transmitting a second party identifier from the at least one data device of the first party to the authentication server;

at the authentication server, generating third data, wherein the third data is a result of operating on the confidential data item and the second party identifier with a one-way function; and

storing the third data in the second party profile at the database.

9. The method of claim 8 , wherein second party profile includes a data table indexed by the second party identifier.

10. The method of claim 1 , wherein the confidential data item and the second data are stored in a first party profile at the database.

11. The method of claim 10 , wherein the first party profile includes a data table indexed by the first party identifier.

12. The method of claim 1 , further comprising sending a first acknowledgement message from the authentication server to one of the data devices of the first party, wherein the first acknowledgement message provides a notification that the authentication system has been provisioned for secure storage of the confidential data item.

13. The method of claim 12 , further comprising:

transmitting a second party identifier from the at least one data device of the first party to the authentication server; and

based on receipt of the second party identifier, sending a second acknowledgement message from the authentication server to a data device of the second party, wherein the second acknowledgement message provides a notification that the authentication system has been provisioned for secure storage of the confidential data item.

14. The method of claim 1 , further comprising:

transmitting a provisioning request to the authentication server from a third party's data device, wherein the provisioning request includes a second party identifier and a third party data device identification;

verifying at the authentication server the second party identifier and the third party data device identification;

retrieving a confidential data item from the authentication server based on the verification of the second party identifier, the verification of the third party data device identification, and the provisioning request; and

transmitting the confidential data item from the authentication server to a third party database based on the provisioning request.

15. The method of claim 1 , further comprising:

transmitting a provisioning request to the authentication server from a data device of a third party, wherein the provisioning request includes a second party identifier and a third party data device identification;

verifying at the authentication server the second party identifier and the third party data device identification;

transmitting an authentication request to a data device of the second party, wherein the authentication request prompts the second party to send an authentication message from the data device of the second party to the authentication server;

retrieving a confidential data item from the authentication server based on the verification of the second party identifier, the verification of the third party data device identification, the receipt of the authentication message, and the provisioning request; and

transmitting the confidential data item from the authentication server to a third party database based on the provisioning request.

16. A method of provisioning a credential authentication system, the method comprising:

wirelessly receiving at an authentication server first data from a data device of a first party, wherein the first data includes a first party identifier, a confidential data item of a second party wherein the confidential data item is associated with one of a plurality of predetermined security protocol levels, and a request to process the confidential data item, wherein the confidential data item of the second party is generated at the at least one data device of the first party;

at the authentication server, initiating a session with the data device of the first party and processing the first data that comprises the confidential data item to determine:

(a) a particular one of the predetermined plurality of security protocol levels is associated with the confidential data item; and

(b) that the request to process is a storage request;

at the authentication server, generating second data, wherein the second data is a result of operating on the confidential data item with a one-way function;

based on the particular one of the determined plurality of security protocol levels and the determined storage request, storing the confidential data item and the second data in a database;

terminating the initiated session in accordance with an expiration factor associated with at least one of the confidential data item and the second data, wherein the expiration factor is selected from the group consisting of: a clock time, a number of requests to access either the confidential data or the second data, and combinations thereof;

transmitting an authentication request to the data device of the second party, wherein the authentication request prompts the second party to send an authentication message from the data device of the second party to the authentication server; and

upon receipt of the authentication message from the data device of the second party, transmitting, based on the provisioning request the retrieved confidential data item from the authentication server to a third party database that is separate from the authentication server;

sending a first acknowledgement message from the authentication server to the data device of the first party, wherein the first acknowledgement message provides a notification that the authentication server has been provisioned for secure storage of the confidential data item;

transmitting a second party identifier from the data device of the first party to the authentication server; and

based on receipt of the second party identifier, sending a second acknowledgement message from the authentication server to a data device of the second party, wherein the second acknowledgement message provides a notification that the authentication server has been provisioned for secure storage of the confidential data item.