Digital identity
Disclosed herein is an identity network that can provide a universal, digital identity for users that can be used to authenticate the user by an identity provider for relying parties. The identity network receives a request from a relying party that includes deep linking to an identity provider selected by the user. The request specifies the user as well as any other information about the user the relying party is requesting. A service of the identity network launches the application for the identity provider on the user's device using a software development kit. The user can log into the identity provider's application, which validates the user and provides the user authentication/validation and information about the user to the identity network. The identity network can then provide the indication of the user's authentication and the user information to the relying party.
1. A method for providing an authenticated, universal digital identity for a user, the method comprising:
receiving, by an identity provider, an identity assertion to validate a digital identity of a user and to provide requested information of the user from an identity network, the requested information comprising identity attributes associated with the user, wherein the identity assertion is associated with a relying party;
receiving, by the identity provider, login credentials from the user;
authenticating, by the identity provider, the digital identity of the user based at least in part of the login credentials;
providing to the user, by the identity provider, consent information and the identity attributes to be shared with the relying party, the consent information comprising a consent request for the user to consent to sharing the identity attributes with the relying party;
receiving, by the identity provider, an authorization of consent from the user in response to the consent request, the authorization of consent indicating that the user consents to the identity attributes being shared with the relying party;
receiving, by the identity provider, a request from the identity network to obtain the identity attributes for transmission to the relying party; and
in response to the request, providing, by the identity provider, the identity attributes to the identity network for subsequent transmission to the relying party.
2. The method for providing an authenticated, universal digital identity for a user of claim 1 , wherein:
the method further comprises sending, by the identity provider, a confirmation of the authorization of consent and a confirmation of authentication of the user to the identity network.
3. The method for providing an authenticated, universal digital identity for a user of claim 1 , further comprising:
encrypting, by the identity provider, the identity attributes with a key known only to the identity provider and the relying party prior to providing the identity attributes to the identity network.
4. The method for providing an authenticated, universal digital identity for a user of claim 2 , further comprising:
encrypting, by the identity provider, the confirmation of the authorization of consent and the confirmation of authentication prior to sending the confirmation of the authorization of consent and the confirmation of authentication to the identity network.
5. The method for providing an authenticated, universal digital identity for a user of claim 1 , further comprising:
determining, by the identity provider, that the identity assertion is a first identity assertion associated with the user; and
in response to determining that the identity assertion is the first identity assertion associated with the user, providing, by the identity provider, a token to the identity network that enables the identity provider to be accessed in future requests to authenticate by the user.
6. The method for providing an authenticated, universal digital identity for a user of claim 5 , further comprising:
generating the token.
7. The method for providing an authenticated, universal digital identity for a user of claim 1 , wherein:
the identity provider comprises a financial institution.
8. An identity provider for providing an authenticated, universal digital identity for a user, comprising:
one or more processors; and
a memory having stored thereon instructions that, upon execution by the one or more processors, cause the one or more processors to:
receive an identity assertion to validate a digital identity of a user and to provide requested information of the user from an identity network, the requested information comprising identity attributes associated with the user, wherein the identity assertion is associated with a relying party;
receive login credentials from the user;
authenticate the digital identity of the user based at least in part of the login credentials;
provide to the user, consent information and the identity attributes to be shared with the relying party, the consent information comprising a consent request for the user to consent to sharing the identity attributes with the relying party;
receive an authorization of consent from the user in response to the consent request, the authorization of consent indicating that the user consents to the identity attributes being shared with the relying party;
receive, by the identity provider, a request from the identity network to obtain the identity attributes for transmission to the relying party; and
in response to the request, provide the identity attributes to the identity network for subsequent transmission to the relying party.
9. The identity provider for providing an authenticated, universal digital identity for a user of claim 8 , wherein the instructions further cause the one or more processors to:
enroll in a digital identity program of the identity network.
10. The identity provider for providing an authenticated, universal digital identity for a user of claim 9 , wherein:
enrolling in the digital identity program comprises integrating a software development kit provided by the identity network into a mobile application of the identity provider.
11. The identity provider for providing an authenticated, universal digital identity for a user of claim 8 , wherein:
the instructions further cause the one or more processors to send a confirmation of the authorization of consent and a confirmation of authentication of the user to the identity network.
12. The identity provider for providing an authenticated, universal digital identity for a user of claim 8 , wherein:
the request comprises a session identity and an authentication token.
13. A non-transitory computer-readable medium having instructions stored thereon that, upon execution by one or more processors of an identity provider, cause the one or more processors to:
receive an identity assertion to validate a digital identity of a user and to provide requested information of the user from an identity network, the requested information comprising identity attributes associated with the user, wherein the identity assertion is associated with a relying party;
receive login credentials from the user;
authenticate the digital identity of the user based at least in part of the login credentials;
provide to the user, consent information and the identity attributes to be shared with the relying party, the consent information comprising a consent request for the user to consent to sharing the identity attributes with the relying party;
receive an authorization of consent from the user in response to the consent request, the authorization of consent indicating that the user consents to the identity attributes being shared with the relying party;
receive, by the identity provider, a request from the identity network to obtain the identity attributes for transmission to the relying party; and
in response to the request, provide the identity attributes to the identity network for subsequent transmission to the relying party.
14. The non-transitory computer-readable medium of claim 13 , wherein:
the instructions further cause the one or more processors to send a confirmation of the authorization of consent and a confirmation of authentication of the user to the identity network.
15. The non-transitory computer-readable medium of claim 13 , wherein the instructions further cause the one or more processors to:
encrypt the identity attributes with a key known only to the identity provider and the relying party to providing the identity attributes to the identity network.
16. The non-transitory computer-readable medium of claim 14 , wherein the instructions further cause the one or more processors to:
encrypt the confirmation of the authorization of consent and the confirmation of authentication prior to sending the confirmation of the authorization of consent and the confirmation of authentication to the identity network.