System, method and computer program product for credential provisioning in a mobile device platform

A system for provisioning of an account for a client application on a client device, the system comprising:

• a computer system that comprises one or more processors programed with computer program instructions that, when executed, cause the computer system to:
• obtain a request from a client application on a client device, the request including user information;
• and
• in response to a positive verification of the user information and a determination to proceed with provisioning of an account for the client application on the client device:
• generate a key pair using one or more parameters associated with a user;
• generate a certificate signing request using the key pair and the one or more parameters associated with the user;
• send the certificate signing request to a certificate authority;
• receive a signed certificate from the certificate authority;
• encrypt, based on a temporary encryption password, the signed certificate and the key pair, wherein the temporary encryption password does not provide user authentication, and is used by a server computer to encrypt credentials as a result of a successful provisioning request to the server computer;
• and
• send the signed certificate, the key pair, and identifying information of a key store or keychain location on the client device to the client device such that the client application on the client device stores, using the identifying information, the signed certificate and the key pair at the key store or keychain location on the client device.

A method for provisioning of an account for a client application on a client device, the method being implemented by one or more processors configured to execute one or more computer program instructions, the method comprising:

• sending a request to a server computer, the request including user information;
• and
• in response to a positive verification of the user information and a determination to proceed with provisioning of an account for the client application on the client device:
• obtaining one or more parameters associated with a user and instructions to generate a key pair;
• generating the key pair using the one or more parameters associated with the user;
• generating a certificate signing request using the key pair and the one or more parameters associated with the user;
• sending, to the server computer, a request to sign the certificate signing request;
• receiving, from the server, a signed certificate and identifying information of a key store or keychain location on the client device wherein receiving the signed certificate and the identifying information includes receiving a certificate file including the signed certificate and the identifying information, wherein the certificate file is encrypted based on a temporary encryption password, and wherein the temporary encryption password is a one-time password included in the user information, wherein the temporary encryption password does not provide user authentication, and is used by the server computer to encrypt credentials as a result of a successful provisioning request to the server computer;
• and
• storing, using the identifying information, the signed certificate and the key pair at the key store or keychain location on the client device.