SYSTEM AND METHOD FOR ESTABLISHING SECURE SESSION WITH ONLINE DISAMBIGUATION DATA

1 . A method of using disambiguation data to confirm an association with an online web service prior to engaging in a transaction with an unresolved application executing on a mobile device, comprising:

receiving, at the unresolved application executing on a mobile device, a disambiguation payload, wherein the disambiguation payload is purportedly associated with a web service, and wherein at least a portion of the disambiguation payload is signed with a cryptographic key associated with the web service;

extracting a network location from the disambiguation payload;

obtaining verification data from a resource at the network location to verify the web service; and

validating the disambiguation payload using the verification data.

2 . The method of claim 1 , wherein the signature is an Elliptic-curve cryptograph (ECC) signature.

3 . The method of claim 1 , wherein the disambiguation payload is presented by an intermediate application for being consumed by the unresolved application.

4 . The method of claim 3 wherein the intermediate application verifies the payload before making it available or presenting it in the document.

5 . The method of claim 4 , wherein to verify the disambiguation payload, the intermediate application analyzes a signature stored in the disambiguation payload.

6 . The method of claim 1 , wherein receiving the disambiguation payload comprises:

scanning a quick response (QR) code that is displayed on a computer screen; and

decoding the QR code to obtain the disambiguation payload.

7 . The method of claim 1 , wherein receiving the disambiguation payload comprises receiving the disambiguation payload from an intermediate application through an application-to-application communication mechanism.

8 . The method of claim 1 , comprising presenting a confirmation user interface to a user of the mobile device, the confirmation user interface to confirm that the user is to connect with the web service purportedly associated with the disambiguation payload.

9 . The method of claim 8 , wherein the confirmation user interface is presented after the TLS connection has been initiated and verification data has been received from the web service.

10 . The method of claim 1 , comprising presenting a consent user interface to a user of the mobile device, the consent user interface to obtain a selection of identity credential data elements that the user consents to share with the web service.

11 . The method of claim 10 , comprising transmitting the selection of data elements from an identity document to provide the user's identity to the web service.

12 . The method of claim 1 , wherein the verification data comprises a verification key used to verify the signature associated with the web service, wherein the key is part of the disambiguation payload.

13 . The method of claim 1 , comprising:

establishing a Transport Layer Security (TLS) session between the unresolved application and the web service; and

obtaining a TLS certificate corresponding to the TLS session,

wherein the verification data comprises the TLS session key.

14 . The method of claim 1 , comprising:

establishing a Transport Layer Security (TLS) session between the unresolved mobile application and the web service; and

obtaining a TLS certificate corresponding to the TLS session,

wherein the verification data comprising TLS certificate public key.

15 . The method of claim 1 , comprising:

establishing a Transport Layer Security (TLS) session between the unresolved application and the web service; and

receiving from the web service the verification data.

16 . The method of claim 15 , comprising:

generating an ephemeral key; and

transmitting the ephemeral key to the web service to establish point-to-point encryption independent from the established TLS transport.

17 . The method of claim 1 , comprising:

generating an ephemeral key; and

transmitting the ephemeral key to the web service, the web service to generate a second disambiguation payload using the ephemeral key;

wherein obtaining verification data comprises receiving the second disambiguation payload at the mobile identification application, and

wherein validating the disambiguation payload comprises validating the second disambiguation payload using a corresponding ephemeral key.

18 . A method of using disambiguation data to confirm an association between an online web service and an unresolved application executing on a mobile device prior to engaging in a transaction using the unresolved application, the method comprising:

receiving, at the unresolved mobile application executing on the mobile device, a disambiguation payload, wherein the disambiguation payload is purportedly associated with the online web service, and wherein at least a portion of the disambiguation payload is signed with a cryptographic key from a trusted party to the unresolved application;

extracting a network location from the disambiguation payload;

confirming the signature with the cryptographic key is valid and from the trusted party;

presenting a prompt using the mobile device for consent to return requested credential data to the network location specified in the disambiguation data; and

returning the requested credential data to the network location in a response to the prompt indicating consent to return the requested credential data.

19 . A method of using disambiguation data to confirm an association between an online web service and an application, comprising:

receiving, at the application executing on a mobile device, a disambiguation payload, wherein the disambiguation payload is purportedly associated with the online web service, and wherein a portion of the disambiguation payload is signed with a signature associated with the online web service;

extracting a network location from the disambiguation payload;

obtaining verification data from a resource at the network location; and

validating the disambiguation payload using the verification data.

20 . The method of claim 19 , comprising:

establishing a Transport Layer Security (TLS) session between the application and the online web service;

obtaining a TLS certificate corresponding to the TLS session,

wherein the verification data comprises the TLS session key;

generating an ephemeral key; and

transmitting the ephemeral key to the online web service to establish point-to-point encryption.