MyID Derived Credentials provides NIST SP 800-157-compliant derived PIV credentials for mobile devices, extending the identity established on a physical smart card to smartphones and tablets. The MyID Authenticator app enables mobile authentication into cloud resources and corporate systems using these derived credentials or FIDO authentication, maintaining strong identity assurance without requiring users to carry and present physical smart cards for every access event.

Unsung implements derived credential solutions for UK customers in government and defence environments where users hold PKI smart cards but need to authenticate from mobile devices without compromising the assurance level of their identity credentials.

Organisations that have invested in PKI smart card authentication face a mobility challenge: smart cards provide strong authentication at desktop workstations with card readers, but users increasingly need to access systems and resources from smartphones and tablets where physical smart card readers are impractical. Simply issuing separate, unlinked mobile credentials undermines the identity assurance model because the mobile credential is not cryptographically bound to the original, vetted smart card identity.

Derived credentials solve this by creating mobile certificates that are cryptographically linked back to the user’s original PIV or smart card identity, maintaining the chain of trust whilst enabling mobile access. However, managing derived credentials — issuance, lifecycle, and revocation — requires integration between the credential management system, mobile device management, and the underlying PKI.