METHOD AND SYSTEM FOR SECURE AUTHENTICATION

摘要

A method and system for accessing a resource associated with a resource control entity that includes receiving, by a ledger, a request, corresponding to a user, to access the resource; obtaining, in response to the request, user metadata; sending to the user a ledger authentication token, which a credential application uses to verify that the ledger is a valid ledger; receiving, from the credential application, a public key encrypted payload including signature entries; decrypting, by the ledger, the encrypted payload using a payload secret key to obtain the signature entries and other user data; obtaining results of a verification by successively verifying each of the signature entries until a scoring threshold associated with the resource is met, and transmitting, to the resource control entity, a notification including the results of the verification, which the resource control entity uses to determine whether to grant the user access to the resource.

主权项

1. A method for accessing a resource comprising:
receiving, by a ledger, a request, corresponding to a user, to access the resource, wherein the resource is associated with a resource control entity; in response to the request, obtaining user metadata corresponding to the user; sending, to the user, a ledger authentication token (LAT), wherein a credential application uses the LAT to verify that the ledger is a valid ledger; receiving, from the credential application executing on a user device of the user, an encrypted payload comprising a plurality of signature entries, wherein the encrypted payload is encrypted using a payload public key (PPK); decrypting, by the ledger, the encrypted payload using a payload secret key (PSK) to obtain the plurality of signature entries and other user data; obtaining results of a verification by successively verifying each of the plurality of signature entries until a scoring threshold associated with the resource is at least met; and transmitting, to the resource control entity, a notification comprising the results of the verification, wherein the resource control entity uses the results of the verification to determine whether to grant the user access to the resource.