Methods and apparatus for validating a digital signature

Patent metadata

Field	Value
Publication number	US-9768965-B2
Application number	US-47402309-A
Country	US
Kind code	B2
Filing date	May 28, 2009
Priority date	May 28, 2009
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

Various embodiments include one or more of systems, methods, software, and data structures for validating a digital signature, wherein common information in a certification chain is maintained in one entry of a Document Secure Store (DSS). The DSS separates the Long Term Validation (LTV) information from the digital signature, allowing amendment of and addition to the LTV information in the DSS after a digital signature is applied to a document.

First claim

What is claimed is:

1. A computer-implemented method comprising:
appending, to a data structure of an electronic document having at least a first digital signature and a first piece of collateral information stored therein, a second digital signature when connectivity to a certificate authority is unavailable, wherein the first piece of collateral information includes validation-related information for validating the first digital signature and is stored in a repository of collateral information operable to validate at least the first digital signature;
based on the second digital signature having been appended when connectivity to the certificate authority was unavailable, retrieving a second piece of collateral information from the certificate authority when connectivity thereto is available, the second piece of collateral information including validation-related information for validating the second digital signature;
determining that at least a portion of the second piece of collateral information is not included in the repository of collateral information;
in accordance with determining that the at least a portion of the second piece of collateral information is not included in the repository of collateral information, adding at least the portion of the second piece of collateral information to the repository of collateral information; and
storing the repository of collateral information with the electronic document in a memory storage location, the repository of collateral information being stored separate from the digital signatures within the data structure of the electronic document and operable to validate at least the first and second digital signatures.

2. The method of claim 1 , further comprising providing a computing apparatus for storing the repository of collateral information and validating at least one of the first and second digital signatures using information stored with the repository of collateral information.

3. The method of claim 1 , wherein the validation-related information includes revocation information for at least a first digital certificate.

4. The method of claim 3 , wherein the repository of collateral information comprises at least a portion of each piece of collateral information.

5. The method of claim 4 , wherein the electronic document is a portable document format type that prevents modification of digital signatures once appended to the electronic document.

6. The method of claim 5 , further comprising providing a graphical user interface to:
present an option to append at least the second digital signature to the electronic document; and
present an option to retrieve at least the second piece of collateral information specifically for validating at least the second digital signature.

7. A computer system having a processor, and memory with computer-executable instructions embodied thereon that, when executed by the processor, performs a method for implementing digital signature authentication of an electronic document, the system comprising:
at least one memory storage device configured to store the electronic document, signed by at least a first digital signature, the electronic document including a data structure having a document secure store embedded therein, wherein the document secure store is configured to maintain a repository of collateral information for validating at least the first digital signature for the signed electronic document, the repository of collateral information being configured to store at least a first piece of collateral information including validation-related information for validating the first digital signature; and
a validation engine configured to:
append a second digital signature to the electronic document to again sign the electronic document when connectivity to a certificate authority is unavailable;
based on the second digital signature having been appended when connectivity to the certificate authority was unavailable, retrieve, from the certificate authority, when connectivity thereto is available, a second piece of collateral information for verifying the second digital signature;
add different collateral information to the repository of collateral information, the different collateral information being at least a portion of the second piece of collateral information that is not included in the repository of collateral information, the repository of collateral information operable to validate at least the first and second digital signatures; and
store the electronic document signed by at least the first and second digital signatures in the at least one memory storage device.

8. The computer system of claim 7 , wherein the document secure store is maintained separately from at least the first digital signature.

9. The computer system of claim 7 , wherein at least the first digital signature is also embedded within the data structure of the signed electronic document.

10. A non-transitory machine-readable medium comprising instructions, which, when implemented by one or more machines, cause the one or more machines to:
append at least a second digital signature to an electronic document having at least a first digital signature and a first piece of collateral information stored therein, wherein the first piece of collateral information includes validation-related information for validating the first digital signature and is stored in a repository of collateral information operable to validate at least the first digital signature, the appending including embedding at least the second digital signature within a data structure of the electronic document when connectivity to a certificate authority is unavailable;
based on the second digital signature having been appended when connectivity to the certificate authority was unavailable, retrieve, for at least the second digital signature, a second piece of collateral information from the certificate authority when connectivity thereto is available, the second piece of collateral information including validation-related information for validating the second digital signature;
determine that at least a portion of the second piece of collateral information is not included in the repository of collateral information; and
store at least the portion of the second piece of collateral information in the repository of collateral information, the repository of collateral information being stored separate from the digital signatures within the data structure of the electronic document, and being operable to validate at least the first and second digital signatures.

11. A computer-implemented method comprising:
receiving an electronic document signed by at least a first digital signature, the electronic document having a single data structure including:
a content portion,
at least the first digital signature appended to the single data structure and including a first certificate, and
a document secure store separate from at least the first digital signature for maintaining a repository of collateral information including validation-related information for validating at least the first certificate;

validating the first certificate, using at least one processor, by:
retrieving a first piece of collateral information from the repository of collateral information in the document secure store upon determining that the first certificate is not from a trusted root certificate authority, and
confirming that the first certificate is valid using the first piece of collateral information; and

signing the electronic document, the signing including:
receiving and appending a second digital signature to the single data structure of the electronic document when connectivity

Assignees

• Tenenboym Isak
• Kaufman Marc T
• Levy Philip
• Adobe Systems Inc

Inventors

• Tenenboym Isak
• Kaufman Marc T
• Levy Philip

Classifications

• H04L9/3247 Primary

  involving digital signatures · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• G06F2221/2145

  Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title