Distributed validation of digitally signed electronic documents

Patent metadata

Field	Value
Publication number	US-9276749-B2
Application number	US-201213562532-A
Country	US
Kind code	B2
Filing date	Jul 31, 2012
Priority date	Jul 31, 2012
Publication date	Mar 1, 2016
Grant date	Mar 1, 2016

Abstract

Systems and methods are presented for distributed validation of a digitally signed electronic document. A computing device accesses both a representation of the electronic document and a digital signature for the electronic document that includes a digest generated by the digital signature's creator by applying a one-way function to the electronic document. The computing device applies the same one-way function to the accessed representation of the electronic document to generate a new digest, and includes both the digital signature and the new digest in a request sent to a separate validation server. The request does not include the electronic document. The validation server generates validation results that depend on comparing the digest from the digital signature with the new digest, and that do not depend on having the electronic document available to the validation server. The computing device receives the validation results from the separate validation server.

First claim

What is claimed is:

1. A method, comprising:
performing, by a computing device:
accessing an electronic document and a digital signature for the electronic document, the digital signature comprising a digest of the electronic document generated from applying a one-way function to the electronic document;
generating a new digest of the electronic document, said generating the new digest comprises applying the one-way function to the accessed electronic document;
sending, for receipt by a separate validation server, a request to validate the digital signature, the request comprising the digital signature and the new digest, and does not include the electronic document; and
receiving, from the separate validation server, validation results for the digital signature, the validation results depending from a comparison of the digest from the digital signature with the new digest on the separate validation server, the comparison being:
based on a comparison of the digital signature sent by the computing device with the new digest sent by the computing device; and
independent of having the electronic document available to the validation server.

2. The method of claim 1 , wherein the one-way function is a cryptographic hash function.

3. The method of claim 1 , wherein the computing device is a mobile phone device or a tablet computer.

4. The method of claim 1 , wherein the request further comprises data collateral to core content of the electronic document, the data collateral to core content of the electronic document including one or more of: a digital certificate that cryptographically binds a signer of the electronic document to the signer's public key, a timestamp associated with the electronic document, or auxiliary document information.

5. The method of claim 1 , wherein applying the one-way function to the electronic document yields a message digest which is smaller than the electronic document.

6. The method of claim 1 , wherein the validation results indicate whether a representation of the electronic document from which the digest is generated, and a representation of the electronic document from which the new digest is generated, are equivalent representations of the electronic document.

7. The method of claim 1 , wherein the validation results indicate whether the digital signature for the electronic document is authentic.

8. The method of claim 1 , wherein said accessing a representation of the electronic document and said generating a new digest of the electronic document are performed without performing a decryption of the electronic document.

9. The method of claim 1 , further comprising decrypting the electronic document prior to said generating a new digest of the electronic document.

10. The method of claim 1 , wherein the digital signature is validated without executing the public-key encryption algorithms or public-key decryption algorithms on the computing device to obtain the digest from the digital signature.

11. The method of claim 1 , wherein the request comprises certificate revocation information transmitted to the separate validation server for use in determining revocation status for one or more digital certificates associated with the signed electronic document.

12. A system, comprising:
a processor; and
a memory coupled to the processor, wherein the memory stores program instructions executable by the processor to perform:
accessing, by a computing device, an electronic document and a digital signature for the electronic document, the digital signature comprises a digest of the electronic document generated from applying a one-way function to the electronic document;
generating, by the computing device, a new digest of the electronic document, said generating the new digest comprises applying the one-way function to the accessed electronic document;
sending, by the computing device to a separate validation server, a request to validate the digital signature, the request comprises the digital signature and the new digest, but does not include the electronic document; and
receiving, at the computing device from the separate validation server, validation results for the digital signature, the validation results depending from a comparison of the digest from the digital signature with the new digest on the separate validation server, the comparison being:
based on a comparison of the digital signature sent by the computing device with the new digest sent by the computing device; and
independent of having the electronic document available to the validation server.

13. A non-transitory computer-readable storage medium storing instructions that when executed by a computing device perform:
accessing an electronic document and a digital signature for the electronic document, the digital signature comprises a digest of the electronic document generated from applying a one-way function to the electronic document;
generating a new digest of the electronic document, said generating the new digest comprises applying the one-way function to the accessed electronic document;
sending, to a separate validation server, a request to validate the digital signature, the request comprises the digital signature and the new digest, but does not include the electronic document; and
receiving, from the separate validation server, validation results for the digital signature, the validation results depending from a comparison of the digest from the digital signature with the new digest on the separate validation server, the comparison being:
based on a comparison of the digital signature sent by the computing device with the new digest sent by the computing device; and
independent of having the electronic document available to the validation server.

14. A system, comprising:
a processor; and
a memory coupled to the processor, wherein the memory stores program instructions for a validation server executable by the processor to perform:
receiving, from a separate computing device, a request to validate a digital signature for an electronic document, such that:
the digital signature comprises a digest of the electronic document generated from applying a one-way function to the electronic document; and
the request comprises the digital signature and a new digest of the electronic document generated on the separate computing device from applying the one-way function to the electronic document, but the request does not include the electronic document;

generating validation results for the digital signature, the generating validation results depending from a comparison of the digest from the digital signature with the new digest, the comparison being:
based on a comparison of the digital signature received from the separate computing device and the new digest received from the separate computing device; and
independent of having the electronic document available to the validation server.

15. The system of claim 14 , wherein the request further includes data collateral to core content of the electronic document, the data collateral to core content of the electronic document including one or more of: a digital certificate that cryptographically binds a signer of the electronic document to the signer's public key, a timestamp associated with the electronic document, or auxiliary document information.

16. The system of claim 14 , wherein:
the request further includes certificate revocation information; and
the program instructions for performing said generating the validation results cause the validation server to determine revocation status for one or more digital certi

Assignees

• Tenenboym Isak
• Levy Philip G
• Kaufman Marc T
• Landwehr John T
• Adobe Systems Inc

Inventors

• Tenenboym Isak
• Levy Philip G
• Kaufman Marc T
• Landwehr John T

Classifications

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title