Digital credentials as guest check-in for physical building access
A system for credential authentication includes an interface and a processor. The interface is configured to receive a create indication to create a guest credential representing a guest badge associated with a visitor and receive a claim indication from an authentication device to claim the guest credential. The processor is configured to provide the guest credential to the authentication device in response to the claim indication, provide a proof request to the authentication device, receive a proof response from the authentication device, validate the proof response, determine a visitor tracking system associated with a request from the authentication device to authenticate entry, and provide a check-in indication to the visitor tracking system that the visitor has checked in.
1. A system for credential authentication, comprising:
an interface configured to:
receive a create indication to create a guest credential representing a guest badge associated with a visitor; and
receive a claim indication from an authentication device associated with the visitor to claim the guest credential, wherein the claim indication comprises a one-time token; and
a processor configured to:
in response to the claim indication, generate a decentralized identifier (DID) keypair using the one-time token, wherein a private key component of the DID keypair is stored on the authentication device and public key component of the DID keypair is stored on a distributed ledger and provide the guest credential to the authentication device, wherein the guest credential comprises a DID;
receive a request to authenticate entry to a check-in site from the authentication device, wherein the request to authenticate entry comprises a check-in site identifier of the check-in site;
in response to receiving the request to authenticate entry, provide a proof request to the authentication device;
receive a proof response from the authentication device, wherein the proof response comprises the guest credential;
validate the proof response, comprising to check the public key component of the DID keypair stored on the distributed ledger matches the DID in the guest credential;
in response to validating the proof response, determine whether the check-in site identifier is valid and verify that the visitor associated with the guest credential has permission to access the check-in site; and
in response to a determination that the check-in site identifier is valid and that the visitor associated with the guest credential has permission to access the check-in site, authenticate the entry to the check-in site.
2. The system of claim 1 , wherein the create indication to create a guest credential is associated with an email address, a user ID, or a user account.
3. The system of claim 1 , wherein the processor is further configured to verify the guest credential is associated with the authentication device.
4. The system of claim 3 , wherein verifying the guest credential is associated with the authentication device comprises comparing a guest credential email address with an authentication device email address.
5. The system of claim 1 , wherein the request to authenticate entry is provided by the authentication device in response to an authentication request from the guest check-in site.
6. The system of claim 5 , wherein the authentication request from the guest check-in site is provided in response to a check-in request from the authentication device.
7. The system of claim 6 , wherein the check-in request from the authentication device is provided automatically upon detection of proximity of the authentication device to the guest check-in site.
8. The system of claim 5 , wherein the authentication device and the guest check-in site communicate using a wireless protocol.
9. The system of claim 8 , wherein the wireless protocol comprises Bluetooth, NFC, or Zigbee.
10. The system of claim 1 , wherein the proof response is signed with the authentication device private key component.
11. The system of claim 1 , wherein validating the proof response using the distributed ledger comprises determining that the guest credential is satisfactory to authenticate check-in, determining that a guest credential signature is valid, determining that the guest credential is not expired, or determining that the guest credential is not revoked by looking in the distributed ledger.
12. The system of claim 1 , wherein validating the proof response comprises determining that the visitor has a scheduled appointment or an employee authorization to enter.
13. The system of claim 1 , wherein the create indication to create a guest credential is provided by a human resources system guest setup process.
14. The system of claim 1 , wherein the claim indication from an authentication device to claim the guest credential is provided in response to an authentication device digital identification app setup.
15. The system of claim 14 , wherein the authentication device digital identification app setup is in response to an email sent as part of a human resources system guest setup process.
16. A method for credential authentication, comprising:
receiving a create indication to create a guest credential representing a guest badge associated with a visitor; and
receiving a claim indication from an authentication device associated with the visitor to claim the guest credential, wherein the claim indication comprises a one-time token; and
in response to the claim indication, generating, using a processor, a decentralized identifier (DID) keypair using the one-time token, wherein a private key component of the DID keypair is stored on the authentication device and public key component of the DID keypair is stored on a distributed ledger and providing the guest credential to the authentication device, wherein the guest credential comprises a DID;
receiving a request to authenticate entry to a check-in site from the authentication device, wherein the request to authenticate entry comprises a check-in site identifier of the check-in site;
in response to receiving the request to authenticate entry, providing a proof request to the authentication device;
receiving a proof response from the authentication device, wherein the proof response comprises the guest credential;
validating the proof response, comprising to check the public key component of the DID keypair stored on the distributed ledger matches the DID in the guest credential;
in response to validating the proof response, determining whether the check-in site identifier is valid and verifying that the visitor associated with the guest credential has permission to access the check-in site; and
in response to a determination that the check-in site identifier is valid and that the visitor associated with the guest credential has permission to access the check-in site, authenticating the entry to the check-in site.
17. A computer program product for credential authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving a create indication to create a guest credential representing a guest badge associated with a visitor; and
receiving a claim indication from an authentication device associated with the visitor to claim the guest credential, wherein the claim indication comprises a one-time token; and
in response to the claim indication, generating, using a processor, a decentralized identifier (DID) keypair using the one-time token, wherein a private key component of the DID keypair is stored on the authentication device and public key component of the DID keypair is stored on a distributed ledger and providing the guest credential to the authentication device, wherein the guest credential comprises a DID;
receiving a request to authenticate entry to a check-in site from the authentication device, wherein the request to authenticate entry comprises a check-in site identifier of the check-in site;
in response to receiving the request to authenticate entry, providing a proof request to the authentication device;
receiving a proof response from the authentication device, wherein the proof response comprises the guest credential;
validating the proof response, comprising to check the public key component of the DID keypair stored on the distributed ledger matches the DID in the guest credential;
in response to validating the proof response, determining whether the check-in site identifier is valid and verifying that the visitor associated with the guest credential has permission to access the check-in site; and
in response to a determination that the check-in site identifier is valid and that the visitor associated with the guest credential has permission to access the check-in site, authenticating the entry to the check-in site.