Digital credentials for step-up authentication

A method for credential authentication, comprising:

• receiving a request from an application for authorization to access, wherein access to the application is requested by a user;
• receiving a request from the application for authorization to access a task, wherein access to the task is requested by the user;
• authenticating, using a processor, the request from the application for authorization to access;
• determining that the task comprises a sensitive task;
• determining a user authentication device;
• providing a challenge for a digital credential to the user authentication device, wherein the digital credential is backed by data stored in a distributed ledger, wherein the user authentication device:
• determines a credential request from the challenge;
• determines one or more credentials that match the credential request;
• provides a credential list including the one or more credentials to the user;
• and
• receives a selection from the user of at least one credential of the one or more credentials;
• receiving a response from the user authentication device, wherein the response comprises the at least one credential;
• determining the response is valid using the distributed ledger;
• and
• providing an authorization to access the sensitive task when the response is determined to be valid.

A computer program product for credential authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving a request from an application for authorization to access, wherein access to the application is requested by a user;
• receiving a request from the application for authorization to access a task, wherein access to the task is requested by the user;
• authenticating the request from the application for authorization to access;
• determining that the task comprises a sensitive task;
• determining a user authentication device;
• providing a challenge for a digital credential to the user authentication device, wherein the digital credential is backed by data stored in a distributed ledger, wherein the user authentication device:
• determines a credential request from the challenge;
• determines one or more credentials that match the credential request;
• provides a credential list including the one or more credentials to the user;
• and
• receives a selection from the user of at least one credential of the one or more credentials;
• receiving a response from the user authentication device, wherein the response comprises the at least one credential;
• determining the response is valid using the distributed ledger;
• and
• providing an authorization to access the sensitive task when the response is determined to be valid.