Digital credentials for user device authentication

A method for credential authentication, comprising performing by a hardware processor:

• receiving a request from an application for authorization to access, wherein access to the application is requested by a user using a user device;
• providing, using a processor, an authentication request to the user device;
• receiving a device credential, wherein the device credential is backed by data stored in a distributed ledger;
• determining a user identifier and an authentication device associated with the user based at least in part on the device credential, wherein the authentication device is different from the user device;
• providing a proof request to the authentication device, wherein the proof request comprises an indication of a set of credentials that can be used to authorize access to the application;
• receiving a proof response, wherein the proof response is created by the authentication device, and wherein the proof response comprises a credential of the set of credentials;
• determining that the proof response is valid by determining that a credential signature corresponding to the device credential is valid by checking the device credential against the data stored in the distributed ledger;
• generating a lease key, wherein the lease key grants access to the user device for a predetermined period of time, and wherein the lease key is encrypted using a public key of the authentication device to create an encrypted lease key;
• providing the encrypted lease key and an authentication token to the user device, wherein the user device accesses the authentication device using a proximity communication protocol to decrypt the encrypted lease key, and wherein the authentication device decrypts the lease key and signs the authentication token using the lease key to create a signed token;
• receiving the signed token from the authentication device;
• and
• in response to a determination that the signed token is valid, generating a login token and providing the login token to the application to verify login and grant the user the requested access to the application.

A computer program product for credential authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving a request from an application for authorization to access, wherein access to the application is requested by a user using a user device;
• providing an authentication request to the user device;
• receiving a device credential, wherein the device credential is backed by data stored in a distributed ledger;
• determining a user identifier and an authentication device associated with the user based at least in part on the device credential, wherein the authentication device is different from the user device;
• providing a proof request to the authentication device, wherein the proof request comprises an indication of a set of credentials that can be used to authorize access to the application;
• receiving a proof response, wherein the proof response is created by the authentication device, and wherein the proof response comprises a credential of the set of digital credentials;
• determining that the proof response is valid by determining that a credential signature corresponding to the device credential is valid by checking the device credential against the data stored in the distributed ledger;
• generating a lease key, wherein the lease key grants access to the user device for a predetermined period of time, and wherein the lease key is encrypted using a public key of the authentication device to create an encrypted lease key;
• providing the encrypted lease key and an authentication token to the user device, wherein the user device accesses the authentication device using a proximity communication protocol to decrypt the encrypted lease key, and wherein the authentication device decrypts the lease key and signs the authentication token using the lease key to create a signed token;
• receiving the signed token from the authentication device;
• and
• in response to a determination that the signed token is valid, generating a login token and providing the login token to the application to verify login and grant the user the requested access to the application.