# US 2019/0319939 A1 · Digital credentials for primary factor authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0319939 A1
- Document ID: US20190319939A1
- Status: Published application
- Kind: A1
- Application number: 16/365,381
- Filed: 2019-03-26
- Published: 2019-10-17
- Earliest claimed: 2018-03-14
- Assignees: Workday, Inc.
- Applicants: Workday, Inc.
- Inventors: Bjorn Hamel; Jonathan David Ruggiero
- Web page: https://patentgrep.com/patent/US20190319939A1

## CPC

- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06F 21/31: User authentication
- G06F 21/33: using certificates
- G06F 21/36: by graphic or iconic representation
- G06F 21/45: Structures or tools for the administration of authentication
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3271: {using challenge-response}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04W 12/08: Access security
- G06F 2221/2103: Challenge-response
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- H04L 2463/062: applying encryption of the keys
- H04W 12/77: Graphical identity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system for credential authentication includes and interface and a processor. The interface is configured to receive a request for authorization to access from an application. The processor is configured to determine a set of credentials that can enable authorization to access; generate a proof request challenge; receive a proof response; determine that the proof response is valid based at least in part on information stored in a distributed ledger; generate a token; and provide the token.

## Claims

### Claim 1

A system for credential authenticationing, comprising:
an interface configured to:
receive a request for authorization to access from an application; and
a processor configured to:
determine a set of credentials that can enable authorization to access;
generate a proof request challenge;
receive a proof response;
determine that the proof response is valid based at least in part on information stored in a distributed ledger;
generate a token; and
provide the token.

### Claim 2 (depends on 1)

The system of claim 1, wherein generating the proof request challenge is based upon a configured set of proof request challenge rules, wherein the configured set of proof request challenge rules comprise one or more criteria which determine the set of credentials that can enable authorization to access.

### Claim 3 (depends on 1)

The system of claim 1, wherein the proof request challenge is provided to a digital identity app.

### Claim 4 (depends on 3)

The system of claim 3, wherein the proof request challenge is provided to the digital identity app using a URI that points to the proof request challenge.

### Claim 5 (depends on 3)

The system of claim 3, wherein the digital identity app is on a mobile device.

### Claim 6 (depends on 5)

The system of claim 5, wherein the proof request challenge is provided to the mobile device using a push notification.

### Claim 7 (depends on 6)

The system of claim 6, wherein the mobile device is identified for the push notification using a secure cookie stored during a previous execution.

### Claim 8 (depends on 5)

The system of claim 5, wherein the proof request challenge is provided to the mobile device using a QR code, which comprises a URI that points to the proof request challenge.

### Claim 9 (depends on 8)

The system of claim 8, wherein the QR code is scanned by the mobile device to access the proof request challenge.

### Claim 10 (depends on 1)

The system of claim 1, wherein the proof response includes a credential.

### Claim 11 (depends on 10)

The system of claim 10, wherein the credential comprises a user selected credential.

### Claim 12 (depends on 1)

The system of claim 1, wherein the proof response is signed using a private key of an identity key pair.

### Claim 13 (depends on 12)

The system of claim 12, wherein the private key is decrypted using a mobile encryption key.

### Claim 14 (depends on 13)

The system of claim 13, wherein the mobile encryption key is accessed using a biometric.

### Claim 15 (depends on 1)

The system of claim 1, wherein the proof response is encrypted using a per channel key.

### Claim 16 (depends on 1)

The system of claim 1, wherein determining that the proof response is valid comprises determining that the proof response comprises one or more credentials of a set of credentials, wherein the set of credentials comprises credentials satisfying rules for granting access.

### Claim 17 (depends on 1)

The system of claim 1, wherein determining that the proof response is valid comprises one or more of: determining that a credential of the proof response is not expired, determining that the credential of the proof response includes a valid signature, and/or determining that a credential decentralized identifier matches a key holder associated with request.

### Claim 18 (depends on 1)

The system of claim 1, wherein determining that the proof response is valid comprises determining that a credential of the proof response is not revoked.

### Claim 19 (depends on 18)

The system of claim 18, wherein determining that the credential of the proof response is not revoked comprises querying a revocation registry of a distributed ledger.

### Claim 20 (depends on 1)

The system of claim 1, wherein the token authorizes access to the application for a user.

### Claim 21 (depends on 1)

The system of claim 1, wherein the processor is further configured to provide a secure cookie for device identification during a future execution.

### Claim 22

A method for credential authentication, comprising:
receiving a request from an application for authorization to access;
determining, using a processor, a set of credentials that can enable authorization to access;
generating a proof request challenge;
receiving a proof response;
determining that the proof response is valid based at least in part on information stored in a distributed ledger;
generating a token; and
providing the token.

### Claim 23

A computer program product for credential authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving a request from an application for authorization to access;
determining a set of credentials that can enable authorization to access;
generating a proof request challenge;
receiving a proof response;
determining that the proof response is valid based at least in part on information stored in a distributed ledger;
generating a token; and
providing the token.