User authentication with self-signed certificate and identity verification
In embodiments, an authentication server interfaces between a user device with a self-signed certificate and a verifying computer that accepts a user name and password. The user device generates a self-signed certificate signed by a private key on the user device. The self-signed certificate is transmitted to a verifying party computer over a network. The verifying party stores the self-signed certificate with user identification data, including at least one of a user name, user address, user email, user phone number, user tax identification (ID), user social security number and user financial account number. In subsequent communications, the verifying party receives a certificate chain including the self-signed certificate, and matches that with the user identification data stored in a database.
1. A method for authenticating a user to a verifying party computer over a network, comprising:
generating a self-signed root user certificate signed by a root private key on a user device, wherein the signing of the self-signed root user certificate by the root private key occurs on the user device;
generating an intermediate private key in a secure enclave on the user device;
signing an intermediate certificate with the root private key;
linking the intermediate certificate to the self-signed user root certificate by way of signature to form a certificate chain, the certificate chain including a public key corresponding to the intermediate private key;
transmitting the certificate chain to the verifying party computer over the network;
transmitting user identification data to the verifying party computer for linking with the certificate chain; and
transmitting the certificate chain to the verifying party computer in a subsequent communication to identify the user without the user identification data.
2. The method of claim 1 wherein the certificate chain is used to identify the user instead of identifying the user with a password at the verifying party computer.
3. The method of claim 1 wherein the self-signed user root certificate is an X.509 certificate suitable for use with Transport Layer Security (TLS).
4. The method of claim 1 further comprising verifying, by the verifying computer, with Transport Layer Security (TLS) that the certificate chain belongs to the user device.
5. The method of claim 1 further comprising:
storing, by the user device, the intermediate private key in a signing application in a memory of the user device.
6. The method of claim 1 further comprising:
storing, by the user device, the root private key in the secure enclave.
7. The method of claim 1 , wherein the root private key is created outside the secure enclave.
8. The method of claim 1 further comprising:
downloading a signing application; and
creating the root private key with the signing application.
9. The method of claim 1 wherein the certificate chain contains no user-specific information, with the user being verified by the public key.
10. A non-transitory computer readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to generate control signals for authenticating a user to a verifying party computer over a network, by executing the steps comprising:
generating a self-signed root user certificate signed by a root private key on a user device, wherein the signing of the self-signed root user certificate by the root private key occurs on the user device;
generating an intermediate private key in a secure enclave on the user device;
signing an intermediate certificate with the root private key;
linking the intermediate certificate to the self-signed user root certificate by way of signature to form a certificate chain, the certificate chain including a public key corresponding to the intermediate private key;
transmitting the certificate chain to the verifying party computer over the network;
transmitting user identification data to the verifying party computer for linking with the certificate chain; and
transmitting the certificate chain to the verifying party computer in a subsequent communication to identify the user without the user identification data.
11. The non-transitory computer readable medium of claim 10 wherein the steps further comprise:
storing, by the user device, the intermediate private key in a signing application in a memory of the user device.
12. The non-transitory computer readable medium of claim 10 wherein the steps further comprise:
creating the root private key with a signing application on the user device.
13. The non-transitory computer readable medium of claim 12 wherein the steps further comprise:
downloading the signing application over the network to the user device.
14. The non-transitory computer readable medium of claim 10 wherein the steps further comprise:
storing the root private key on the user device.
15. The non-transitory computer readable medium of claim 10 wherein the certificate chain is used to identify the user instead of identifying the user with a password at the verifying party computer.
16. A method of identifying a user comprising:
generating a self-signed root user certificate signed by a root private key on a user device, wherein the root private key is stored on the user device, and the signing of the self-signed root user certificate by the root private key occurs on the user device;
generating an intermediate private key in a secure enclave on the user device;
signing an intermediate certificate with the root private key;
linking the intermediate certificate to the self-signed user root certificate by way of signature to form a certificate chain, the certificate chain including a public key corresponding to the intermediate private key;
transmitting the certificate chain to a verifying party computer over a network;
transmitting user identification data to the verifying party computer for linking with the certificate chain; and
transmitting the certificate chain to the verifying party computer in a subsequent communication to identify the user without the user identification data.
17. The method of claim 16 further comprising:
storing the root private key on the user device.
18. The method of claim 17 further comprising:
storing the intermediate private key in the secure enclave on the user device.