Access control using a circle of trust

A method for access control, comprising:

• identifying a list of user applications authorized to access two or more data schemas, wherein the two or more data schemas comprises two or more of employment data, education data, financial data, housing data or insurance data;
• identifying a list of digital wallet applications that are trusted to hold one or more credentials of a set of credentials for users;
• defining a first circle of trust (COT), wherein the first COT is defined by associating at least issuers of the two or more data schemas, the two or more data schemas, the list of user applications, the list of digital identity wallet applications, and a set of users with access granting indications;
• receiving an access request from a first user application for permission to access a first digital identity wallet application of a user device to obtain the one or more credentials of the set of credentials of a user held by the first digital identity wallet application, wherein the access request is associated with a request data schema of the two or more data schemas;
• and
• determining, using a processor, whether to grant access for the first user application to the first digital identity wallet application, wherein access is granted for the first user application to the first digital identity wallet application in response to:
• the first user application belonging to a first COT and the first digital identity wallet application belonging to the first COT
• providing an access granting indication to the first user application to permit the first user application to access the first digital identity wallet application to obtain the one or more credentials of the user;
• subsequently, receive a request from the first user application for association with a second COT;
• in response to the request for association with the second COT, associate the first user application with the second COT;
• and
• disassociate the first user application from the first COT.

A computer program product for access control, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for access control, comprising:

• identifying a list of user applications authorized to access two or more data schemas, wherein the two or more data schemas comprises two or more of employment data, education data, financial data, housing data or insurance data;
• identifying a list of digital wallet applications that are trusted to hold one or more credentials of a set of credentials for users;
• defining a first circle of trust (COT), wherein the first COT is defined by associating at least issuers of the two or more data schemas, the two or more data schemas, the list of user applications, the list of digital wallet applications, and the users with access granting indications;
• receiving an access request from a first user application for permission to access a first digital identity wallet application of a user device to obtain the one or more credentials of the set of credentials of a user held by the first digital identity wallet application, wherein the access request is associated with a request data schema of the two or more data schemas;
• and
• determining, using a processor, whether to grant access for the first user application to the first digital identity wallet application, wherein access is granted for the first user application to the first digital identity wallet application in response to:
• the first user application belonging to a first COT and the first digital identity wallet application belonging to the first COT
• providing an access granting indication to the first user application to permit the first user application to access the first digital identity wallet application to obtain the one or more credentials of the user;
• subsequently, receive a request from the first user application for association with a second COT;
• in response to the request for association with the second COT, associate the first user application with the second COT;
• and
• disassociate the first user application from the first COT.