USER AUTHENTICATION SYSTEM WITH SELF-SIGNED CERTIFICATE AND IDENTITY VERIFICATION WITH OFFLINE ROOT CERTIFICATE STORAGE

1 . A method for authenticating a user to a verifying party computer over a network, comprising:

generating a self-signed root certificate signed by a root private key on a user device;

storing the root private key externally to the user device;

generating an intermediate private key from a secure enclave on the user device;

signing an intermediate certificate with the root private key;

storing the intermediate private key in the secure enclave on the user device;

linking the intermediate certificate to the root certificate by way of signature to form a certificate chain, the certificate chain including a public key corresponding to the intermediate private key;

transmitting the certificate chain to the verifying party computer over the network;

receiving, as an input to the user device, user identification data, including at least one of a user name, user address, user email, user phone number, user tax ID, user social security number and user financial account number;

using a certificate chain as a credential to transmit user verification data to a verifying party computer;

storing the certificate chain in association with the user identification data in a database by the verifying party computer;

receiving, at the verifying party computer, a subsequent communication from the user device including the certificate chain; and

accessing the database by the verifying party computer with the certificate chain to retrieve the user identification data.

2 . The method of claim 1 further comprising:

determining that the self-signed root certificate belongs to the user by:

issuing a challenge question to the user device, by the verifying party computer, using the intermediate public key to encrypt the challenge question;

decrypting the challenge question by the user device using the intermediate private key; and

sending, by the user device, a response to the verifying computer challenge question, encrypted with the intermediate private key.

3 . The method of claim 1 wherein the self-signed root certificate is an X.509 certificate suitable for use with TLS.

4 . The method of claim 1 further comprising verifying, by the verifying computer, with TLS that the certificate chain belongs to the user device.

5 . The method of claim 1 further comprising:

storing, by the user device, the intermediate private key in a signing application in a memory of the user device.

6 . The method of claim 1 further comprising:

storing, by the user device, the root private key in an external electronic device; and

recovering the root private key from the external electronic device.

7 . The method of claim 1 , wherein the step of storing the root private key externally to the user device further comprises encoding the root private key as a visual code and printing the visual code, and further comprising:

recovering the root private key by scanning the visual code.

8 . The method of claim 7 wherein the visual code is a QR code.

9 . The method of claim 1 , wherein the step of storing the root private key externally to the user device further comprises transferring the root private key to an external memory device; and further comprising:

recovering the root private key by connecting the external memory device to the user device.

10 . The method of claim 1 , wherein the step of storing the root private key externally to the user device further comprises:

transmitting the root private key to a cloud-based credential recovery service server; and

recovering the root private key from the cloud-based credential recovery service using at least one of a login, a password, or other user identifying information.

11 . A method for authenticating a user to a verifying party computer over a network, comprising:

generating a self-signed root certificate signed by a root private key on a user device;

generating an intermediate private key from a secure enclave on the user device;

signing an intermediate certificate with the root private key;

linking the intermediate certificate to the root certificate to form a certificate chain, the certificate chain including a public key corresponding to the intermediate private key;

transmitting the certificate chain to the verifying party computer over the network;

transmitting user identification data to the verifying party computer for linking with the certificate chain; and

transmitting the certificate chain to the verifying party computer in a subsequent communication to identify the user without the user identification data.

12 . The method of claim 11 further comprising:

determining that the self-signed root certificate belongs to the user by:

issuing a challenge question to the user device, by the verifying party computer, using the user public key to encrypt the challenge question;

decrypting the challenge question by the user device using the intermediate private key; and

sending, by the user device, a response to the verifying computer challenge question, encrypted with the intermediate private key.

13 . The method of claim 11 further comprising:

storing, by the user device, the intermediate private key in a signing application in a memory of the user device.

14 . The method of claim 11 further comprising:

storing, by the user device, the root private key externally to the user device.

15 . The method of claim 14 , wherein the step of storing the root private key externally to the user device further comprises:

encoding the root private key as a visual code and printing the visual code.

16 . A non-transitory computer readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to generate control signals for authenticating a user to a verifying party computer over a network, by executing the steps comprising:

generating a self-signed root certificate signed by a root private key on a user device;

generating an intermediate private key from a secure enclave on the user device;

signing an intermediate certificate with the root private key;

linking the intermediate certificate to the root certificate to form a certificate chain, the certificate chain including a public key corresponding to the intermediate private key;

transmitting the certificate chain to the verifying party computer over the network;

transmitting user identification data to the verifying party computer for linking with the certificate chain; and

transmitting the certificate chain to the verifying party computer in a subsequent communication to identify the user without the user identification data.

17 . The non-transitory computer readable medium of claim 16 wherein the software instructions, when executed by a processor, further cause the processor to generate control signals to execute the steps comprising:

determining that the self-signed root certificate belongs to the user by:

issuing a challenge question to the user device, by the verifying party computer, using the user public key to encrypt the challenge question;

decrypting the challenge question by the user device using the intermediate private key; and

sending, by the user device, a response to the verifying computer challenge question, encrypted with the intermediate private key.

18 . The non-transitory computer readable medium of claim 16 wherein the software instructions, when executed by a processor, further cause the processor to generate control signals to execute the steps comprising:

storing, by the user device, the intermediate private key in a signing application in a memory of the user device.

19 . The non-transitory computer readable medium of claim 16 wherein the software instructions, when executed by a processor, further cause the processor to generate control signals to execute the steps comprising:

storing, by the user device, the root private key in an external electronic device.

20 . The non-transitory computer readable medium of claim 19 wherein the software instructions, when executed by a processor, further cause the processor to generate control signals to execute the steps comprising:

encoding the root private key as a visual code and printing the visual code.