Identity management on a mobile device
Various systems and methods for managing identity credentials on a mobile device are described herein. A verifier device may perform operations including receiving one or more data elements associated with a credential, wherein the data elements are signed with a signature associated with an issuer of the data elements, analyzing the signature to determine a confidence score, the confidence score enumerated into a plurality of confidence levels, configuring a verification process based on the confidence score, and executing the verification process.
1. A verifier device comprising:
a memory device; and
a processor subsystem, which when configured by instructions stored on the memory device, is operable to perform operations comprising:
receiving one or more data elements associated with a credential, wherein the one or more data elements are signed with a signature associated with an issuer of the one or more data elements;
analyzing the signature to determine a confidence score, the confidence score enumerated into a plurality of confidence levels, wherein the plurality of confidence levels provide respective scores including: a score of a confidence in validity of the one or more data elements, and a score of a confidence in issuance of the one or more data elements;
configuring a verification process based on the respective scores enumerated in the confidence score; and
executing the verification process.
2. The verifier device of claim 1 , wherein the plurality of confidence levels includes a confidence level providing the score of the confidence in issuance of the one or more data elements as a numerical score, the numerical score indicating a confidence in the issuer.
3. The verifier device of claim 1 , wherein the plurality of confidence levels includes a confidence level providing the score of the confidence in issuance of the one or more data elements as a numerical score, the numerical score indicating a confidence in a process used by the issuer for vetting applicants for credentials issued by the issuer, or a confidence in a process used by the issuer for evaluating one or more data sources that provide data used for the vetting.
4. The verifier device of claim 1 , wherein the plurality of confidence levels includes a confidence level providing the score of the confidence in validity of the one or more data elements as a numerical score, the numerical score indicating the confidence in validity of the one or more data elements.
5. The verifier device of claim 1 , wherein the plurality of confidence levels includes a confidence level providing the score of the confidence in issuance of the one or more data elements as a numerical score, the numerical score indicating a confidence in an issuance process used by the issuer to issue the one or more data elements.
6. The verifier device of claim 1 , wherein the processor subsystem is operable to perform operations comprising transmitting a request for the one or more data elements, the request including a minimum confidence score for the one or more data elements.
7. The verifier device of claim 1 , wherein the plurality of confidence levels are defined by the issuer.
8. The verifier device of claim 1 , wherein at least one of the plurality of confidence levels includes an indication of a certificate class, the certificate class designating a confidence for a particular kind of document.
9. The verifier device of claim 1 , wherein the verification process includes extracting a tokenization uniform resource identifier (URI) from the credential and using the tokenization URI to validate at least one of: the signature or the one or more data elements.
10. The verifier device of claim 1 , wherein the verification process includes:
extracting a biometric data from the credential;
comparing the biometric data and a capture sample obtained from a user presenting the credential to produce a result; and
using the result of the comparison to prove that an identity card or media storing the credential is presented by a legitimate holder.
11. The verifier device of claim 10 , wherein the verification process includes:
obtaining a tokenized key, the tokenized key signed by the issuer and the tokenized key uniquely associated with at least one of: the credential, the one or more data elements, or the user presenting the credential;
validating the tokenized key using a signature of the issuer; and
using the tokenized key and the biometric data in a multifactor authentication scheme to validate the user.
12. The verifier device of claim 11 , wherein the one or more data elements include metadata identifying the tokenized key.
13. The verifier device of claim 1 , wherein the verification process includes:
determining a freshness score of the one or more data elements; and
using the freshness score to determine whether to obtain up-to-date data elements.
14. A method comprising:
receiving, at a verifier device, one or more data elements associated with a credential, wherein the one or more data elements are signed with a signature associated with an issuer of the one or more data elements;
analyzing, at the verifier device, the signature to determine a confidence score, the confidence score enumerated into a plurality of confidence levels, wherein the plurality of confidence levels provide respective scores including: a score of a confidence in validity of the one or more data elements, and a score of a confidence in issuance of the one or more data elements;
configuring a verification process based on the respective scores enumerated in the confidence score; and
executing the verification process.
15. The method of claim 14 , wherein the plurality of confidence levels includes at least one of:
a first confidence level providing a first numerical score, the first numerical score indicating a confidence in the issuer;
a second confidence level providing a second numerical score, the second numerical score indicating a confidence in a process used by the issuer for vetting applicants for credentials issued by the issuer, or a confidence in a process used by the issuer for evaluating one or more data sources that provide data used for the vetting;
a third confidence level providing a third numerical score, the third numerical score indicating the confidence in validity of the one or more data elements; or
a fourth confidence level providing a fourth numerical score, the fourth numerical score indicating a confidence in an issuance process used by the issuer to issue the one or more data elements.
16. The method of claim 14 , comprising transmitting a request for the one or more data elements, the request including a minimum confidence score for the one or more data elements.
17. The method of claim 14 , wherein the verification process includes extracting a tokenization uniform resource identifier (URI) from the credential and using the URI to validate at least one of: the signature or the one or more data elements.
18. The method of claim 14 , wherein the verification process includes:
extracting a biometric data from the credential;
comparing the biometric data and a capture sample obtained from a user presenting the credential to produce a result;
using the result of the comparison to prove that an identity card or media storing the credential is presented by a legitimate holder;
obtaining a tokenized key, the tokenized key signed by the issuer and the tokenized key uniquely associated with at least one of: the credential, the one or more data elements, or the user presenting the credential;
validating the tokenized key using a signature of the issuer; and
using the tokenized key and the biometric data in a multifactor authentication scheme to validate the user.
19. The method of claim 14 , wherein the verification process includes:
determining a freshness score of the one or more data elements; and
using the freshness score to determine whether to obtain up-to-date data elements.
20. A machine-readable medium comprising instructions, which when executed by a processor subsystem, cause the processor subsystem to perform operations of claim 14 .