CA2272723A1

CA2272723A1 - Digital signature server

Info

Publication number: CA2272723A1
Application number: CA002272723A
Authority: CA
Inventors: Patrick Pavlik
Original assignee: RDM Corp
Current assignee: RDM Corp
Priority date: 1999-05-25
Filing date: 1999-05-25
Publication date: 2000-11-25
Also published as: US6807633B1

Description

Confidential and Proprietary Information of RDM
Digital Signature Server Inventor: Patrick Pavlik, Waterloo, Ontario N2L 1J6 Citizenship: Canadian Problem The distribution and management of digital certificates is a complex and challenging task. In some cases special secure hardware for application of the signature may be part of the solution and its installation and configuration can be problematic and require specially trained support resources.
Solution One solution could be to offer a service where a trusted service provider maintains digital certificates on behalf of its clients on a server. The service provider could append a client's digital signature to an electronic document following the receipt of instructions and authorization from the client over a secure communications line - and then provide the digitally signed document to the client.
Novelty We believe certain aspects of this submission including but not limited to the use of this in connection with an electronic payment and particularly in connection with the FSTC Electronic Check or "echeck" is new.
Utility See example below.
Page 1 of 3 Confidential and Proprietary Information of RDM
Example 1.
Client establishes secure connection, enters PIN number and submits electronic document .~., Client Signature % ~~ Digital Service Request / ~~~ Signature Provider Software ~ Internet ~ Server Service provider verifies PIN number, retrieves corresponding private key, calculates digital signature relative to the submitted document, returns digitally-signed electronic document and public key or certificate Step 1. Client Application. There are many schemes for how this could be done.
The most secure involve face-to-face authentication of identity using pieces of identification, preferably a photo-ID such as a passport or drivers license. Identity details are taken in the registration process. The service provider would need to establish a way of collecting validated information. Post offices, banks or vehicle license bureaus are examples of accessible channels through which a service provider might collect registration data. A
bank, national post office or automobile licensing agency may want to opearte such a service.
The client is issued a PIN number and a web site where they will be able to download a piece of software which will allow them to connect for a digital signature.
The intent is to establish a link between the individual to whom the PIN
number is issued and the individual who holds these pieces of identification.
Step 2. Client Registration. The Client's application form and the PIN number issued to that Client flow back to the service provider where the PIN number is registered in a database along with the corresponding identification info (e.g. license number and/or passport number ...). A Public-Private Key pair is generated and the Public key is inserted on a Digital Certificate signed by the Service Provider using the Service Provider's Private Key.
Step 3. Client Downloads Software. The Client connects to the service provider's web site and downloads a software module which will enable the Client to establish a secure connection and submit information for signature (for brevity "SRS" - signature request software).
The software uses any secure mechanism (e.g. SSL Secure Socket Layer) to establish a secure connection over the Internet.
Step 4. Submit a Document for Signature. The client may then click on the SRS
software button and select a document from the tree structure (or through some other mechanism) and submit it over the secure connection to the Service Provider. The service provider acknowledges receipt and asks the Client to enter their PIN number. The PIN number is used to select the correct private key from the service provider's database and use it to create the digital signature. The digital signature is then returned to the Client over the secure link and appended by the software to the document. 'The secure link is the terminated.
Note - Alternatively, the service provider could maintain a number of standard documents - for example an electronic check or echeck - and simply receive information from the Client to complete the form over the secure connection - e.g. value date, beneficiary, email and amount - and could create and sign the document and return both rather than just the digital signature.
Page 2 of 3

Claims

1. A computer based method for providing a service where the digital signature of a client is calculated relative to an electronic document at the client's request.

2. The method of claim 1 further comprising submission of a request from a remote location.

3. The method of claim 2 further comprising a secure connection from a remote location.

4. The method of claim 3 further comprising an SSL (secure socket layer) connection.

5. The method of claims 1 and 2 further comprising the requirement to enter an authorization code (e.g. a PIN number or a Password) to authorize the calculation of the electronic document.

6. The method of claim 5 further comprising a client registration process to establish the identity of the client holding the authorization code.

7. The method of claim 1 where the electronic document is submitted by the client.

8. The method of claim 1 where an electronic document or electronic document template is maintained on file, for example in a database, by the service provider at the request of the client and identified by an agreed reference submitted by the client.

9. The method of claim 8 where the service provider returns a hash of the document as the reference which the client will use when submitting requests to identify the document and the service provider will recalculate the hash on each request to verify the document selection.

10. The method of claims 1 and 2 where the service provider returns the electronic document and the digital signature to the client.

11. The method of claims 1 and 2 where the service provider returns the digital signature to the client but does not return the electronic document.

12. The method of claim 1 where the service provider sends the digitally-signed electronic document directly to a recipient identified by the client over a communication line, for example, by email.

13. The method of claims 10, 11 or 12 where the service provider also provides an electronic date/time stamp.

14. The method of claim 2 further comprising the submission of a request from a wireless device.

15. The method of claims 7 or 8 where the electronic document is an FSTC
electronic check or "echeck".

16. The method of claims 7 or 8 where the electronic document is in an FSML or XML format.

17. The method of claims 7 or 8 where the service provider enforces business signing rules governing, for example, the individual financial signing limits of a client or the joint financial signing limits of multiple clients.