Digital notarization using a biometric identification service
A system performs digital notarization using a biometric identification service. A signature requesting service receives a request to validate a digital item with a signature for a person. The signature requesting service provides a payload that identifies the digital item and/or the person to an identity service. The identity service obtains one or more digital representations of biometrics for the person, determines an identity for the person, and returns a data structure including the payload and one or more identity attestations regarding the determined identity. The identity service encrypts at least a portion of the data structure using a private encryption key. A public encryption key for the identity service can then be used to decrypt the portion to verify that the data structure was generated by the identity service after determining the identity. In this way, validation can be verified to the full trust level of the identification service.
1. A system for digital notarization, comprising:
at least one non-transitory storage medium that stores instructions; and
at least one processor that executes the instructions to:
implement a signature requesting service module; and
use the signature requesting service module to:
receive a payload identifying a digital item from a signature requesting service;
communicate with an identification system module to obtain a data structure that includes the payload and an identity attestation generated using at least one digital representation of a biometric obtained by the identification system module; and
validate the digital item by transmitting the data structure to the signature requesting service.
2. The system of claim 1 , wherein the identity attestation is encrypted using a symmetric encryption key.
3. The system of claim 1 , wherein the data structure includes a hash of at least a portion of the payload.
4. The system of claim 3 , wherein the data structure includes information regarding a procedure used to generate the hash.
5. The system of claim 1 , wherein the payload specifies an identity attestation fidelity level.
6. The system of claim 5 , wherein the data structure specifies the identity attestation fidelity level.
7. The system of claim 1 , wherein the at least one processor is operable to:
extract at least a portion of the payload and the identity attestation from the data structure; and
use the at least the portion of the payload and the identity attestation to verify validation of the digital item.
8. The system of claim 7 , wherein extracting the at least the portion of the payload includes decrypting the at least the portion of the payload.
9. The system of claim 8 , wherein decrypting the at least the portion of the payload includes obtaining a public key associated with the identification system module.
10. The system of claim 1 , wherein the payload specifies a set of identity information to include in the identity attestation.
11. A system for digital notarization, comprising:
at least one non-transitory storage medium that stores instructions; and
at least one processor that executes the instructions to:
implement an identification system module; and
use the identification system module to:
communicate with a signature requesting service module to receive a payload identifying a digital item from a signature requesting service;
obtain a digital representation of a biometric;
generate a data structure including the payload and an identity attestation generated using at least one digital representation of the biometric; and
communicate with the signature requesting service module to validate the digital item by transmitting the data structure to the signature requesting service.
12. The system of claim 11 , wherein the identity attestation includes a liveness determination.
13. The system of claim 12 , wherein the liveness determination is generated using the at least one digital representation of the biometric.
14. The system of claim 11 , wherein at least a portion of the data structure is encrypted.
15. The system of claim 14 , wherein the at least the portion of the data structure is encrypted using an encryption key of an identification service associated with the identification system module.
16. The system of claim 15 , wherein the encryption key is a private encryption key.
17. The system of claim 14 , wherein the at least the portion of the data structure includes at least a portion of the payload.
18. The system of claim 11 , wherein the identity attestation is generated according to an identity attestation level.
19. The system of claim 18 , wherein the identification system module receives a specification of the identity attestation level from the signature requesting service module.
20. The system of claim 18 , wherein the identification system module obtains a specification of the identity attestation level from the payload.