Digital identity sign-in
Disclosed herein is an identity network that provides a universal, digital identity for users to be authenticated by an identity provider for relying parties upon sign-in to the relying party. The identity network receives the sign-in request from a relying party for a user using a user device. The identity network can provide a session identifier to the relying party for the request and launch an identity provider application associated with the user via a software development kit in the relying party application. The user may sign-in to the identity provider via the software development kit, thereby authenticating the user for the relying party. Additionally, the identity provider may generate a risk validation score and provide it to the relying party that provides a confidence value that the user is validly using the user device and a risk score based on device activity on the identity network.
1. A method for sign-in using a universal digital identity, the method comprising:
receiving, at an identity network, a sign-in request for a user of a user device from a relying party;
providing, by the identity network, a session identifier to the relying party;
launching, by the identity network using a software development kit of a relying party application, an identity provider application of an identity provider, wherein launching the identity provider application comprises providing the session identifier;
receiving, by the identity network from the identity provider, confirmation of a digital identity of the user including the session identifier and a digital signature of the user device;
receiving, from the relying party, a confirmation request that the identity provider authenticated the user, the confirmation request including the session identifier; and
in response to receiving the confirmation request, providing, by the identity network to the relying party, the session identifier, and the digital signature of the user device.
2. The method of claim 1 , further comprising:
receiving, at the identity network from the identity provider, a request for device validation that includes the session identifier; and
providing, by the identity network, device validation information to the identity provider.
3. The method of claim 2 , wherein providing device validation information to the identity provider comprises:
identifying, by the identity network, a device identifier for the device; and
providing, by the identity network, the device identifier and the session identifier to the identity provider.
4. The method of claim 1 , further comprising:
receiving, by the identity network, a detail request from the identity provider; and
transmitting, by the identity network, details of the sign-in request to the identity provider.
5. The method of claim 1 , further comprising:
receiving, by the identity network via the software development kit of the relying party application, consent from the user.
6. The method of claim 1 , further comprising:
comparing, by the identity network, the digital signature of the user device with a stored digital signature for the user device; and
transmitting, by the identity network to the identity provider, an indication of the comparison.
7. The method of claim 1 , further comprising:
performing, by the identity network, risk validation of the user and the user device using the digital signature of the user device; and
transmitting, by the identity network to the relying party, a risk validation score with the session identifier and the digital signature of the user device.
8. The method of claim 7 , wherein performing risk validation comprises:
obtaining stored activity associated with the digital signature of the user device; and
applying a model to the stored activity and sign-in request to generate the risk validation score.
9. The method of claim 7 , wherein performing risk validation comprises:
obtaining stored activity associated with the digital signature of the user device;
applying a model to the stored activity and the sign-in request to generate a confidence value of the digital identity of the user; and
transmitting, by the identity network, the confidence value with the session identifier and the digital signature of the user device to the relying party.
10. A system for sign-in using a universal digital identity, the system comprising:
one or more processors; and
a memory having stored thereon instructions that, upon execution by the one or more processors, cause the one or more processors to:
receive a sign-in request for a user of a user device from a relying party;
provide a session identifier to the relying party;
launch, using a software development kit of a relying party application, an identity provider application of an identity provider, wherein launching the identity provider application comprises providing the session identifier;
receive, from the identity provider, confirmation of a digital identity of the user including the session identifier and a digital signature of the user device;
receive, from the relying party, a confirmation request that the identity provider authenticated the user, the confirmation request including the session identifier; and
in response to receiving the confirmation request, provide, to the relying party, the session identifier, and the digital signature of the user device.
11. The system of claim 10 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
receive, from the identity provider, a request for device validation that includes the session identifier; and
provide device validation information to the identity provider.
12. The system of claim 11 , wherein the instructions for providing device validation information to the identity provider comprises instructions that, upon execution by the one or more processors, cause the one or more processors to:
identify a device identifier for the device; and
provide the device identifier and the session identifier to the identity provider.
13. The system of claim 10 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
receive a detail request from the identity provider; and
transmit details of the sign-in request to the identity provider.
14. The system of claim 10 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
receive, via the software development kit of the relying party application, consent from the user.
15. The system of claim 10 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
compare the digital signature of the user device with a stored digital signature for the user device; and
transmit, to the identity provider, an indication of the comparison.
16. The system of claim 10 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
perform risk validation of the user and the user device using the digital signature of the user device; and
transmit, to the relying party, a risk validation score with the session identifier and the digital signature of the user device.
17. The system of claim 16 , wherein the instructions for performing risk validation comprises further instructions that, upon execution by the one or more processors, cause the one or more processors to:
obtain stored activity associated with the digital signature of the user device; and
apply a model to the stored activity and sign-in request to generate the risk validation score.
18. The system of claim 16 , wherein the instructions for performing risk validation comprises further instructions that, upon execution by the one or more processors, cause the one or more processors to:
obtain stored activity associated with the digital signature of the user device;
apply a model to the stored activity and the sign-in request to generate a confidence value of the digital identity of the user; and
transmit the confidence value with the session identifier and the digital signature of the user device to the relying party.
19. A non-transitory, computer readable memory device having stored thereon instructions that, upon execution by one or more processors, cause the one or more processors to:
receive a sign-in request for a user of a user device from a relying party;
provide a session identifier to the relying party;
launch, using a software development kit of a relying party application, an identity provider application of an identity provider, wherein launching the identity provider application comprises providing the session identifier;
receive, from the identity provider, confirmation of a digital identity of the user including the session identifier and a digital signature of the user device;
receive, from the relying party, a confirmation request that the identity provider authenticated the user, the confirmation request including the session identifier; and
in response to receiving the confirmation request, provide, to the relying party, the session identifier, and the digital signature of the user device.
20. The memory device of claim 19 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
perform risk validation of the user and the user device using the digital signature of the user device; and
transmit, to the relying party, a risk validation score with the session identifier and the digital signature of the user device.