Distributed validation of digitally signed electronic documents

Patent metadata

Field	Value
Publication number	US-9800416-B2
Application number	US-201614992986-A
Country	US
Kind code	B2
Filing date	Jan 11, 2016
Priority date	Jul 31, 2012
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

Systems and methods are presented for distributed validation of a digitally signed electronic document. A computing device accesses both a representation of the electronic document and a digital signature for the electronic document that includes a digest generated by the digital signature's creator by applying a one-way function to the electronic document. The computing device applies the same one-way function to the accessed representation of the electronic document to generate a new digest, and includes both the digital signature and the new digest in a request sent to a separate validation server. The request does not include the electronic document. The validation server generates validation results that depend on comparing the digest from the digital signature with the new digest, and that do not depend on having the electronic document available to the validation server. The computing device receives the validation results from the separate validation server.

First claim

What is claimed is:

1. A method to validate a digital signature for an electronic document, comprising:
receiving, at a validation server and from a computing device, a request including the digital signature and a second digest, the digital signature including a first digest of the electronic document, the second digest being generated from a representation of the electronic document at the computing device;
comparing, by the validation server, the first digest of the electronic document with the second digest;
generating, by the validation server, a validation result for the digital signature based on the comparing, the validation result being generated independent of the electronic document being available to the validation server; and
sending, by the validation server, the validation result for the digital signature to the computing device.

2. The method of claim 1 , wherein the receiving, the comparing, the generating, and the sending are performed independent of receiving the electronic document at the validation server.

3. The method of claim 1 , wherein the first digest of the electronic document is generated from applying a one-way function to the electronic document and the second digest of the electronic document is generated, at the computing device, from applying the one-way function to the electronic document.

4. The method of claim 1 , wherein the request further includes data collateral to core content of the electronic document, the data collateral to core content of the electronic document including at least one of a digital certificate that cryptographically binds a signer of the electronic document to the signer's public key, a timestamp associated with the electronic document, or auxiliary document information.

5. The method of claim 1 , further comprising receiving certificate revocation information in the request and determining a revocation status for at least one digital certificate associated with the electronic document.

6. The method of claim 1 , further comprising extracting at least one digital certificate from the digital signature and building a certificate chain from the at least one digital certificate to establish a link between the at least one digital certificate and a trust anchor.

7. The method of claim 1 , wherein the generating the validation result for the digital signature is performed at a specific time specified by a time parameter for the electronic document.

8. The method of claim 1 , wherein the receiving and the sending are performed over a channel that is secured by a security protocol and connects the validation server and the computing device.

9. The method of claim 1 , wherein the first digest of the electronic document and the second digest are smaller than the electronic document.

10. The method of claim 1 , wherein the validation result indicates whether a representation of the electronic document from which the first digest is generated and the representation of the electronic document from which the second digest is generated are equivalent representations of the electronic document.

11. A system, comprising:
at least one processor; and
a memory, coupled to the at least one processor, storing program instructions executable by the at least one processor to perform:
generating, by a computing device, a first digest for a digital signature of an electronic document;
sending, by the computing device, the electronic document and the first digest for the digital signature to a separate computing device;
causing the separate computing device to generate a second digest of the electronic document; and
causing the separate computing device to send a request to a validation server for validation of the digital signature based on a comparison of the first digest with the second digest, independent of making the electronic document available to the validation server, the request including the first digest of the digital signature and the second digest of the electronic document.

12. The system of claim 11 , wherein the electronic document is created at the computing device.

13. The system of claim 11 , wherein the electronic document is received from a source that is different than the computing device.

14. The system of claim 11 , wherein the first digest for the digital signature is generated by applying a one-way cryptographic hash function to the digital signature of the electronic document.

15. A non-transitory computer-readable storage medium storing instructions that, when executed by a computing device, perform:
receiving, from a separate computing device, a request to validate a digital signature for an electronic document, the request including the digital signature and a second digest, the digital signature including a first digest of the electronic document, the second digest being generated from a representation of the electronic document at the separate computing device;
comparing the first digest of the electronic document with the second digest;
generating a validation result for the digital signature based on the comparison, the validation result being generated independent of the electronic document being available to the computing device; and
sending the validation result for the digital signature to the separate computing device.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the receiving, the comparing, the generating, and the sending are performed independent of receiving the electronic document at the computing device.

17. The non-transitory computer-readable storage medium of claim 15 , wherein the first digest of the electronic document is generated from applying a one-way function to the electronic document and the second digest of the electronic document is generated from applying the one-way function to the electronic document.

18. The non-transitory computer-readable storage medium of claim 15 , wherein the request further includes data collateral to core content of the electronic document, the data collateral to core content of the electronic document including at least one of a digital certificate that cryptographically binds a signer of the electronic document to the signer's public key, a timestamp associated with the electronic document, or auxiliary document information.

19. The non-transitory computer-readable storage medium of claim 15 , wherein the request includes certificate revocation information and the instructions are further executable to perform determining revocation a revocation status for at least one digital certificate associated with the electronic document.

20. The non-transitory computer-readable storage medium of claim 15 , wherein the generating the validation result for the digital signature is performed at a specific time specified by a time parameter for the electronic document.

Assignees

• Adobe Systems Inc

Inventors

• Tenenboym Isak
• Levy Philip G
• Kaufman Marc T
• Landwehr John T

Classifications

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title