SYSTEM AND METHOD FOR PRE-REGISTRATION OF FIDO AUTHENTICATORS

1 . A method comprising:

confirming an identity of a user by a relying party using a first identity verification technique responsive to the user performing a first transaction with the relying party;

generating or collecting initial user verification reference data upon verification of the identity of the user through the first identity verification technique;

requesting personalization of an authenticator to be provided to the user;

receiving credential registration data of the authenticator after personalization;

receiving a transaction request from the user that requires user authentication; and

authenticating the user based on the authenticator and the credential registration data of the authenticator using a second identity verification technique.

2 . The method of claim 1 , wherein the relying party corresponds to an employer for which the identity of the user is to be verified.

3 . The method of claim 1 , wherein initial user verification reference data is injected to the authenticator as part of the personalization.

4 . The method of claim 1 , wherein personalization of the authenticator to be provided to the user is performed for an employer of the user.

5 . The method of claim 1 , wherein personalization of the authenticator to be provided to the user is performed by a manufacturer of the authenticator, a device in which the authenticator is integrated, or a facility specialized in personalization.

6 . The method of claim 1 , wherein the credential registration data of the authenticator is included in an attestation object signed using an attestation key associated with the authenticator or an authenticator model.

7 . The method of claim 1 , wherein the credential registration data of the authenticator comprises a public key of a key pair.

8 . The method of claim 1 , wherein the initial user verification reference data or data derived from the initial user verification reference data is to be provided to the user separately from the authenticator.

9 . The method of claim 1 , wherein generating or collecting the initial user verification reference data comprises obtaining a code to be entered by the user during the second identity verification technique.

10 . The method of claim 1 , wherein receiving the credential registration data of the authenticator after personalization comprises accessing a database by the relying party or an authentication server.

11 . The method of claim 1 , wherein the authenticator is personalized through printing or engraving user-related attributes into the authenticator.

12 . A data processing system comprising:

a processor coupled with a memory that store instructions that when executed by the processor, are capable of performing:

confirming an identity of a user by a relying party using a first identity verification technique responsive to the user performing a first transaction with the relying party;

generating or collecting initial user verification reference data upon verification of the identity of the user through the first identity verification technique;

requesting personalization of an authenticator to be provided to the user;

receiving credential registration data of the authenticator after personalization;

receiving a transaction request from the user that requires user authentication; and

authenticating the user based on the authenticator and the credential registration data of the authenticator using a second identity verification technique.

13 . The data processing system of claim 12 , wherein the relying party corresponds to an employer for which the identity of the user is to be verified.

14 . The data processing system of claim 12 , wherein initial user verification reference data is injected to the authenticator as part of the personalization.

15 . The data processing system of claim 12 , wherein personalization of the authenticator to be provided to the user is performed for an employer of the user.

16 . The data processing system of claim 12 , wherein personalization of the authenticator to be provided to the user is performed by a manufacturer of the authenticator, a device in which the authenticator is integrated, or a facility specialized in personalization.

17 . A non-transitory machine-readable medium that stores instructions that when executed by a processor, are capable of performing:

confirming an identity of a user by a relying party using a first identity verification technique responsive to the user performing a first transaction with the relying party;

generating or collecting initial user verification reference data upon verification of the identity of the user through the first identity verification technique;

requesting personalization of an authenticator to be provided to the user;

receiving credential registration data of the authenticator after personalization;

receiving a transaction request from the user that requires user authentication; and

authenticating the user based on the authenticator and the credential registration data of the authenticator using a second identity verification technique.

18 . The non-transitory machine-readable medium of claim 17 , wherein the credential registration data of the authenticator is included in an attestation object signed using an attestation key associated with the authenticator or an authenticator model.

19 . The non-transitory machine-readable medium of claim 17 , wherein generating or collecting the initial user verification reference data comprises obtaining a code to be entered by the user during the second identity verification technique.

20 . The non-transitory machine-readable medium of claim 17 , wherein receiving the credential registration data of the authenticator after personalization comprises accessing a database by the relying party or an authentication server.