Digital identity step-up
Described herein is an identity network for validating the digital identity of a user. The identity network may receive, from a relying party, an identity validation request to validate a digital identity of the user. The identity network may provide, to the relying party, a link associated with an identity provider application based on the identity validation request. The identity network may receive, from an identity provider associated with the identity provider application, a confirmation that the user has successfully accessed the identity provider application via the link. After receiving the confirmation, the identity network may receive from the identity provider, an attribute validation request to validate identity attributes of the user, where the attribute validation request includes a plurality of identity attributes of the user. The identity network may validate the digital identity of the user based on the plurality of identity attributes.
1. A method for validating a digital identity of a user, comprising:
receiving, at an identity network from a relying party, an identity validation request to validate a digital identity of the user;
providing, from the identity network to the relying party, a link associated with an identity provider application based on the identity validation request;
receiving, at the identity network from an identity provider associated with the identity provider application, a confirmation that the user has successfully accessed the identity provider application via the link;
after receiving the confirmation, receiving, at the identity network from the identity provider, an attribute validation request to validate identity attributes of the user, wherein the attribute validation request includes a plurality of identity attributes of the user; and
validating, by the identity network, the digital identity of the user based on the plurality of identity attributes.
2. The method of claim 1 , wherein validating the digital identity of the user includes comparing, by the identity network, a first identity attribute of the plurality of identity attributes to a second identity attribute of the plurality of identity attributes.
3. The method of claim 1 , further comprising receiving, at the identity network, a first identity attribute from a third-party device, wherein validating the digital identity of the user includes comparing the first identity attribute with a second identity attribute of the plurality of identity attributes.
4. The method of claim 1 , wherein:
the identity validation request includes a second identity attribute; and
validating the digital identity of the user is based on the plurality of identity attributes and the second identity attribute.
5. The method of claim 1 ,
wherein the attribute validation request includes a document, and
the method further comprises extracting, by the identity network, a first identity attribute based on the document, wherein validating the digital identity of the user is based on the plurality of identity attributes and the first identity attribute.
6. The method of claim 1 , further comprising, prior to receiving the confirmation:
receiving, at the identity network from the identity provider, a device check request, wherein the device check request includes a first device identifier associated with a user device of the user;
generating, by the identity network, a device check result by comparing the first device identifier and a second device identifier associated with the user device of the user that was previously saved by the identity network; and
providing, by the identity network, the device check result to the identity provider.
7. The method of claim 6 ,
further comprising:
in response to receiving the identity validation request, providing, from the identity network to the relying party, a first session identifier associated with the identity validation request; and
storing, by the identity network, the first session identifier in a database,
wherein:
the device check includes a second session identifier; and
generating the device check result includes comparing the first session and the second session identifier.
8. A system, comprising:
one or more computing devices; and
memory storing instructions, the instructions being executable by the one or more computing devices, wherein the one or more computing devices are configured to perform a method, comprising:
receive, at an identity network from a relying party, an identity validation request to validate a digital identity of a user;
provide, from the identity network to the relying party, a link associated with an identity provider application based on the identity validation request;
receive, at the identity network from an identity provider associated with the identity provider application, a confirmation that the user has successfully accessed the identity provider application via the link;
after receiving the confirmation, receive, at the identity network from the identity provider, an attribute validation request to validate identity attributes of the user, wherein the attribute validation request includes a plurality of identity attributes of the user; and
validating, by the identity network, the digital identity of the user based on the plurality of identity attributes.
9. The system of claim 8 , wherein validating the digital identity of the user includes comparing, by the identity network, a first identity attribute of the plurality of identity attributes to a second identity attribute of the plurality of identity attributes.
10. The system of claim 8 , further comprising receiving, at the identity network, a first identity attribute from a third-party device, wherein validating the digital identity of the user includes comparing the first identity attribute with a second identity attribute of the plurality of identity attributes.
11. The system of claim 8 , wherein:
the identity validation request includes a second identity attribute; and
validating the digital identity of the user is based on the plurality of identity attributes and the second identity attribute.
12. The system of claim 8 ,
wherein the attribute validation request includes a document, and
the method further comprises extracting, by the identity network, a first identity attribute based on the document, wherein validating the digital identity of the user is based on the plurality of identity attributes and the first identity attribute.
13. The system of claim 8 , further comprising, prior to receiving the confirmation:
receiving, at the identity network from the identity provider, a device check request, wherein the device check request includes a first device identifier associated with a user device of the user;
generating, by the identity network, a device check result by comparing the first device identifier and a second device identifier associated with the user device of the user that was previously saved by the identity network; and
providing, by the identity network, the device check result to the identity provider.
14. The system of claim 13 ,
further comprising:
in response to receiving the identity validation request, providing, from the identity network to the relying party, a first session identifier associated with the identity validation request; and
storing, by the identity network, the first session identifier in a database,
wherein:
the device check includes a second session identifier; and
generating the device check result includes comparing the first session and the second session identifier.
15. A non-transitory computing-device readable storage medium on which computing-device readable instructions of a program are stored, the instructions, when executed by one or more computing devices, causing the one or more computing devices to perform a method, comprising:
receiving, at an identity network from a relying party, an identity validation request to validate a digital identity of a user;
providing, from the identity network to the relying party, a link associated with an identity provider application based on the identity validation request;
receiving, at the identity network from an identity provider associated with the identity provider application, a confirmation that the user has successfully accessed the identity provider application via the link;
after receiving the confirmation, receiving, at the identity network from the identity provider, an attribute validation request to validate identity attributes of the user, wherein the attribute validation request includes a plurality of identity attributes of the user; and
validating, by the identity network, the digital identity of the user based on the plurality of identity attributes.
16. The non-transitory computing-device readable storage medium of claim 15 , wherein validating the digital identity of the user includes comparing, by the identity network, a first identity attribute of the plurality of identity attributes to a second identity attribute of the plurality of identity attributes.
17. The non-transitory computing-device readable storage medium of claim 15 , further comprising receiving, at the identity network, a first identity attribute from a third-party device, wherein validating the digital identity of the user includes comparing the first identity attribute with a second identity attribute of the plurality of identity attributes.
18. The non-transitory computing-device readable storage medium of claim 15 , wherein:
the identity validation request includes a second identity attribute; and
validating the digital identity of the user is based on the plurality of identity attributes and the second identity attribute.
19. The non-transitory computing-device readable storage medium of claim 15 ,
wherein the attribute validation request includes a document, and
the method further comprises extracting, by the identity network, a first identity attribute based on the document, wherein validating the digital identity of the user is based on the plurality of identity attributes and the first identity attribute.
20. The non-transitory computing-device readable storage medium of claim 15 , further comprising, prior to receiving the confirmation:
receiving, at the identity network from the identity provider, a device check request, wherein the device check request includes a first device identifier associated with a user device of the user;
generating, by the identity network, a device check result by comparing the device first identifier and a second device identifier associated with the user device of the user that was previously saved by the identity network; and
providing, by the identity network, the device check result to the identity provider.