Methods for Secure Enrollment and Backup of Personal Identity Credentials into Electronic Devices

1. A method, comprising: receiving at a personal identification device a public key before biometric data associated with enrollment is received; sending an identifier from the personal identification device to a party based on the public key before biometric data associated with enrollment is received, the identifier being uniquely associated with the personal identification device; receiving at the personal identification device a digital certificate from the party based on the identifier before biometric data associated with enrollment is received; and disabling functionality within the personal identification device except that the personal identification device is in a wait state associated with future enrollment.

2. The method of claim 1 , further comprising sending the public key from the personal identification device to the party after the receiving the public key.

3. The method of claim 1 , wherein the receiving the digital certificate from the party is based on the public key and the identifier.

4. The method of claim 1 , wherein the identifier is associated with an asymmetric key pair including a personal identification device public key and a personal identification device private key.

5. The method of claim 1 , further comprising producing the identifier at the personal identification device.

6. The method of claim 1 , further comprising receiving at the personal identification device the identifier from the party.

7. The method of claim 1 , wherein the digital certificate includes the public key.

8. The method of claim 1 , wherein the party is a manufacturer of the personal identification device and separate from an enrollment party authorized to enable enrollment of the biometric data at the personal identification device.

9. The method of claim 1 , wherein the party is a first party, the personal identification device being configured to enroll the biometric data from a second party different from the first party after the receiving at the personal identification device the digital certificate.

10. The method of claim 1 , wherein the digital certificate includes data associated with the personal identification device.

11. A method, comprising: sending a public key to a personal identification device; receiving an identifier from the personal identification device, the identifier being uniquely associated with the personal identification device; producing a digital certificate based on the identifier and before enrollment of biometric data; and sending the digital certificate to the personal identification device such that functionality of the personal identification device is disabled except that the personal identification device is configured to send the digital certificate to an enrollment party during future enrollment.

12. The method of claim 11 , wherein the producing of the digital certificate is based, at least in part, on the public key.

13. The method of claim 11 , wherein the receiving and the producing is performed by a first party, the method further comprising: receiving at the first party a digital certificate uniquely associated with a second party different from the first party; adding a public key of the first party to the digital certificate associated with the second party; and sending the digital certificate associated with the second party from the first party to the second party.

14. The method of claim 11 , wherein the digital certificate includes the public key.

15. The method of claim 11 , further comprising producing at the party an asymmetric key pair uniquely associated with the party.

16. The method of claim 11 , wherein the public key is associated with a manufacturer of the personal identification device and separate from the enrollment party authorized to enable enrollment of the biometric data at the personal identification device.

17. The method of claim 11 , wherein the personal identification device is configured to enroll biometric data from the enrollment party after the sending the digital certificate.

18. The method of claim 11 , wherein the producing the digital certificate is based on data associated with the personal identification device.

19. A method, comprising: receiving an encryption identifier at a personal identification device from a party during pre-enrollment; receiving a digital signature at the personal identification device from the party during pre-enrollment; the encryption identifier and the digital signature collectively configured to enable verification of the party by the personal identification device; and disabling functionality within the personal identification device except for functionality associated with future enrollment.

20. The method of claim 19 , wherein: the encryption identifier is a public key; and the receiving the digital signature including receiving a digital certificate including the digital signature.

21. A non-transitory computer-readable medium programmed with executable instructions that, when executed by a processing system, perform a method comprising: receiving at a personal identification device a public key before biometric data associated with enrollment is received; sending an identifier from the personal identification device to a party based on the public key before biometric data associated with enrollment is received, the identifier being uniquely associated with the personal identification device; receiving at the personal identification device a digital certificate from the party based on the identifier before biometric data associated with enrollment is received; and disabling functionality within the personal identification device except that the personal identification device is in a wait state associated with future enrollment.

22. The medium of claim 21 , further comprising sending the public key from the personal identification device to the party after the receiving the public key.

23. The medium of claim 21 , wherein the receiving the digital certificate from the party is based on the public key and the identifier.

24. The medium of claim 21 , wherein the identifier is associated with an asymmetric key pair including a personal identification device public key and a personal identification device private key.

25. The medium of claim 21 , further comprising producing the identifier at the personal identification device.

26. The medium of claim 21 , further comprising receiving at the personal identification device the identifier from the party.

27. The medium of claim 21 , wherein the digital certificate includes the public key.

28. The medium of claim 21 , wherein the party is a manufacturer of the personal identification device and separate from an enrollment party authorized to enable enrollment of the biometric data at the personal identification device.

29. The medium of claim 21 , wherein the party is a first party, the personal identification device being configured to enroll the biometric data from a second party different from the first party after the receiving at the personal identification device the digital certificate.

30. The medium of claim 21 , wherein the digital certificate includes data associated with the personal identification device.

31. A non-transitory computer-readable medium programmed with executable instructions that, when executed by a processing system, perform a method comprising: sending a public key to a personal identification device; receiving an identifier from the personal identification device, the identifier being uniquely associated with the personal identification device; producing a digital certificate based on the identifier and before enrollment of biometric data; and sending the digital certificate to the personal identification device such that functionality of the personal identification device is disabled except that the personal identification device is configured to send the digital certificate to an enrollment party during future enrollment.

32. The medium of claim 31 , wherein the producing of the digital certificate is based, at least in part, on the public key.

33. The medium of claim 31 , wherein the receiving and the producing is performed by a first party, the method further comprising: receiving at the first party a digital certificate uniquely associated with a second party different from the first party; adding a public key of the first party to the digital certificate associated with the second party; and sending the digital certificate associated with the second party from the first party to the second party.

34. The medium of claim 31 , wherein the digital certificate includes the public key.

35. The medium of claim 31 , further comprising producing at the party an asymmetric key pair uniquely associated with the party.

36. The medium of claim 31 , wherein the public key is associated with a manufacturer of the personal identification device and separate from the enrollment party authorized to enable enrollment of the biometric data at the personal identification device.

37. The medium of claim 31 , wherein the personal identification device is configured to enroll biometric data from the enrollment party after the sending the digital certificate.

38. The medium of claim 31 , wherein the producing the digital certificate is based on data associated with the personal identification device.

39. A non-transitory computer-readable medium programmed with executable instructions that, when executed by a processing system, perform a method comprising: receiving an encryption identifier at a personal identification device from a party during pre-enrollment; receiving a digital signature at the personal identification device from the party during pre-enrollment; the encryption identifier and the digital signature collectively configured to enable verification of the party by the personal identification device; and disabling functionality within the personal identification device except for functionality associated with future enrollment.

40. The medium of claim 39 , wherein: the encryption identifier is a public key; and the receiving the digital signature including receiving a digital certificate including the digital signature.