Digital credentials for access to sensitive data

A method for credentialing, comprising:

• receiving an application access request from an application for authorization to access, wherein access to the application is requested by a user having a user authentication device;
• determining, using a processor, to authorize the user access to the application in response to the application access request, wherein determining to authorize the user access to the application includes linking the user authentication device with the user;
• receiving a sensitive data access request from the application for authorization to access a document that includes sensitive data, wherein the sensitive data request includes a blinding secret and a document encryption key encrypted with a public key associated with an identity private key stored on the user authentication device, and wherein the access to the document is requested by the user and validating the public key matches information stored on a distributed ledger;
• in response to the sensitive data access request:
• determining the user authentication device and a set of credentials satisfactory to authenticate the user to access the application;
• providing a primary request for authorization to access sensitive data to the user authentication device;
• receiving a primary response from the authentication device;
• in response to a determination that the primary response comprises a credential of the set of credentials, providing a secondary request for authorization to access sensitive data to the user authentication device, wherein the secondary request comprises the blinding secret and the encrypted document encryption key, wherein the user authentication device:
• decrypts the encrypted document encryption key to generate a document encryption key;
• and
• blinds the document encryption key using the blinding secret to generate a blinded document encryption key;
• receiving a secondary response from the user authentication device in response to the secondary request, wherein the secondary response comprises the blinded document encryption key;
• validating the secondary response;
• and
• in response to determining that the secondary response is valid, providing the secondary response to an application server associated with the application, wherein the application server encrypts the document with the document encryption key and provides the encrypted document to the user authentication device enabling the user authentication device to decrypt the encrypted document and provide the user access to the sensitive data.

A computer program product for credentialing, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving an application access request from an application for authorization to access, wherein access to the application is requested by a user having a user authentication device;
• determining to authorize the user access to the application in response to the application access request, wherein determining to authorize the user access to the application includes linking the user authentication device with the user;
• receiving a sensitive data access request from the application for authorization to access a document that includes sensitive data, wherein the sensitive data request includes a blinding secret and a document encryption key encrypted with a public key associated with an identity private key stored on the user authentication device, and wherein the access to the document is requested by the user and validating the public key matches information stored on a distributed ledger;
• in response to the sensitive data access request:
• determining the user authentication device and a set of credentials satisfactory to authenticate the user to access the application;
• providing a primary request for authorization to access sensitive data to the user authentication device;
• receiving a primary response from the authentication device;
• in response to a determination that the primary response comprises a credential of the set of credentials, providing a secondary request for authorization to access sensitive data to the user authentication device, wherein the secondary request comprises the blinding secret and the encrypted document encryption key, wherein the user authentication device:
• decrypts the encrypted document encryption key to generate a document encryption key;
• and
• blinds the document encryption key using the blinding secret to generate a blinded document encryption key;
• receiving a secondary response from the user authentication device in response to the secondary request, wherein the secondary response comprises the blinded document encryption key;
• validating the secondary response;
• and
• in response to determining that the secondary response is valid, providing the secondary response to an application server associated with the application, wherein the application server encrypts the document with the document encryption key and provides the encrypted document to the user authentication device enabling the user authentication device to decrypt the encrypted document and provide the user access to the sensitive data.