Portable secure access module
Examining virtualized credentials of a holder includes verifying authenticity of a device of a relying party using a verifying device secret that is provided in a portable secure access module device that is separate from and communicates with the relying party device, authorizing a subset of credential data to be sent to the relying party device in response to the device of the relying party being authentic, where the subset of credential data depends on at least one of: a role of the relying party, selection by the holder, and contextual data of the relying party, and communicating with the device of the relying party to display at least some of the subset of credential data on a screen of the device of the relying party. The contextual data may be a privacy level setting, distance between the relying party and the holder, or geolocation of the relying party.
1. A method of examining virtualized credentials of a holder, comprising:
verifying authenticity of a device of a relying party using a verifying device secret (VDS) that is provided in a portable secure access module device that is separate from and communicates with the relying party device;
authorizing a subset of credential data to be sent to the device of the relying party in response to the device of the relying party being authentic, wherein the subset of credential data depends on at least one of: a role of the relying party, selection by the holder, and contextual data of the relying party; and
communicating with the device of the relying party to display at least some of the subset of credential data on a screen of the device of the relying party.
2. The method, according to claim 1 , wherein the contextual data is at least one of: a privacy level setting, distance between the relying party and the holder, and geolocation of the relying party.
3. The method, according to claim 1 , wherein the role of the relying party is provided by the relying party.
4. The method, according to claim 1 , further comprising:
the relying party presenting the subset of credential data to a verification service.
5. The method, according to claim 4 , wherein the subset of credential data sent to the verification service includes a cryptogram generated as a function of cryptographic information associated with a device of the holder.
6. The method, according to claim 5 , wherein the cryptographic information includes a cryptographic key stored on the device of the holder.
7. The method, according to claim 5 , wherein the cryptogram includes a variable component corresponding to at least one of: time, a counter or a randomly generated nonce.
8. The method, according to claim 4 , wherein the relying party communicates with an intermediary service that directs the relying party to a particular one of a number of possible verification services.
9. The method, according to claim 1 , wherein the secure access module device is one of: a fob or a smart card.
10. The method, according to claim 1 , further comprising:
ending communication by the device of the relying party in response to the secure access module device not being proximate to the device of the relying party.
11. A non-transitory computer-readable medium containing software that examines virtualized credentials of a holder, the software comprising:
executable code that verifies authenticity of a device of a relying party using a verifying device secret (VDS) that is provided in a portable secure access module device that is separate from and communicates with the relying party device;
executable code that authorizes a subset of credential data to be sent to the device of the relying party in response to the device of the relying party being authentic, wherein the subset of credential data depends on at least one of: a role of the relying party, selection by the holder, and contextual data of the relying party; and
executable code that communicates with the device of the relying party to display at least some of the subset of credential data on a screen of the device of the relying party.
12. The non-transitory computer-readable medium, according to claim 11 , wherein the contextual data is at least one of: a privacy level setting, distance between the relying party and the holder, and geolocation of the relying party.
13. The non-transitory computer-readable medium, according to claim 11 , wherein the role of the relying party is provided by the relying party.
14. The non-transitory computer-readable medium, according to claim 11 , wherein the relying party presents the subset of credential data to a verification service.
15. The non-transitory computer-readable medium, according to claim 14 , wherein the subset of credential data sent to the verification service includes a cryptogram generated as a function of cryptographic information associated with a device of the holder.
16. The non-transitory computer-readable medium, according to claim 15 , wherein the cryptographic information includes a cryptographic key stored on the device of the holder.
17. The non-transitory computer-readable medium, according to claim 15 , wherein the cryptogram includes a variable component corresponding to at least one of: time, a counter or a randomly generated nonce.
18. The non-transitory computer-readable medium, according to claim 14 , wherein the relying party communicates with an intermediary service that directs the relying party to a particular one of a number of possible verification services.
19. The non-transitory computer-readable medium, according to claim 11 , wherein the secure access module device is one of: a fob or a smart card.
20. The non-transitory computer-readable medium, according to claim 11 , further comprising:
executable code that ends communication by the device of the relying party in response to the secure access module device not being proximate to the device of the relying party.