Digital Identity Provider Enrollment via Credential Vault
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face tedious and time-consuming enrollment processes for multiple accounts, often requiring repeated entry of the same data and struggling to remember diverse login credentials, leading to inefficiencies and security concerns.
Innovation Solution
A digital identity provider (IDP) system allows users to register once and share digital identities with relying parties, using a software development kit (SDK) to manage credentials securely, enabling streamlined enrollment and login across various accounts through a tokenized digital identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users create separate credentials for each account, then account security is improved, but user convenience and time efficiency deteriorate
Solution Approach 1:
The patent segments the credential management system into three distinct components: (1) a credential generation service that creates credentials, (2) a credential vault that securely stores credentials, and (3) a credential release service that controls credential sharing. This segmentation allows each component to specialize in security while collectively providing user convenience through automated management.
Solution Approach 2:
The patent introduces a credential vault as an intermediary between users and relying parties. The vault acts as a secure mediator that holds credentials and releases them through controlled mechanisms (such as biometric authentication or time-limited tokens) without exposing the actual credentials to the user or the relying party, thereby maintaining security while enabling convenient access.
2Reliability
If users remember multiple diverse credentials, then account access control is improved, but cognitive load and time management deteriorate
Solution Approach 1:
The system performs preliminary actions by automatically generating and storing credentials for multiple accounts in advance through the credential vault. When a user needs to access an account, the system retrieves and provides the pre-prepared credentials instantly, eliminating the time-consuming process of remembering or manually creating credentials at the moment of access.
Solution Approach 2:
The credential management system operates autonomously through self-service mechanisms. The credential vault automatically manages the lifecycle of credentials (generation, storage, rotation, and revocation) without requiring user intervention. Users simply authenticate through the vault's interface, and the system handles all credential-related operations automatically, saving significant time and cognitive resources.
3Ease of operation
If users reuse the same credentials across accounts, then ease of login is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The patent implements a digital credential copying mechanism where the credential vault creates secure copies of authentication credentials and distributes them to authorized relying parties. Each copy is uniquely bound to a specific account and user session, allowing the user to login conveniently to multiple accounts while maintaining security through credential isolation and revocation capabilities.
Data Source
AI summary
Systems and methods are provided for using an identity provider (IDP) to implement enrollment of a user to a relying party. One exemplary method includes receiving a login credential for a user from a relying party in connection with enrolling the user to the relying party, where the user is associated with a digital identity and the digital identity includes personal identifying information (PII) of the user. The method also includes generating a one-time-passcode (OTP) and transmitting the OTP to a communication device bound to the digital identity associated with the user, receiving an OTP from the relying party, and when the OTP generated by the computing device matches the OTP received from the relying party, compiling an enrollment file for the user including at least a portion of the PII of the user. The method then includes transmitting the enrollment file to the relying party.