WO2002035764A2 - Process and apparatus for improving the security of digital signatures - Google Patents
Process and apparatus for improving the security of digital signatures Download PDFInfo
- Publication number
- WO2002035764A2 WO2002035764A2 PCT/US2001/032624 US0132624W WO0235764A2 WO 2002035764 A2 WO2002035764 A2 WO 2002035764A2 US 0132624 W US0132624 W US 0132624W WO 0235764 A2 WO0235764 A2 WO 0235764A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- transaction
- function
- authentication
- event
- authentication function
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2153—Using hardware token as a secondary aspect
Definitions
- the present invention relates to apparatus and method for improving the security of digital signatures and public key infrastructures, so that these technologies can move beyond mathematical techniques and software algorithms into practical, widely-used implementations including a combination of hardware, software, and cryptographic security techniques.
- the present invention relates to the use of digital signatures and public key infrastructures to legally replace, or act as a surrogate for, actual, human signatures.
- the physical signature has been around nearly as long as writing and has been implemented via an inscribed signature or certified by some token, such as a wax impression from a signet ring.
- the late 20 th century introduced the cryptographic concept of a digital signature - a mathematical function that first hashed or compressed a document and then used public key techniques to encrypt the hash of the message. This technique is a sound mathematical or software solution, but has failed to find widespread practical application even as the legal foundation for using digital signatures to replace traditional signatures has come into place.
- the smart card has actually replaced the function of a credit card (and credit card number) rather than the signature of the user, though the smart cards are used as if they replaced both.
- a critical limitation of smart cards is that they have not had the type of operational control that should be necessary to allow an individual to use them for legal signatures. On one hand, some smart cards do not have any security for the device - possession enables usage. On the other hand, some smart cards are enabled via a PIN (Personal Identification Number) . The problem with this approach is that the PIN "unlocks" the card for use as opposed to any sort of access restriction. If one was to compare this with a locked door to a house - a PIN that unlocks a smart card is like a key put into the door of a house and then not removed as long as you are inside - freely allowing others to exit and enter.
- PIN Personal Identification Number
- Digital signature solutions usually comprise hardware and/or software that will implement the digital signature function all of the time or, at best, once the application has been activated by a password or biometric authentication process (a Security Identifier) .
- This Security Identifier unlocks the digital signature process, much as turning a key in a car's ignition starts the car (or turning a key in a lock unlocks the door) .
- the "Digital Signer” or “Digital Chop” combines the digital signature technique with the token function of a smart card, but adds a novel element - a human interface that allows a user to control the activation of the digital signature for each signature event - thus enabling the use of digital signature techniques for the function of a physical, legally binding, signature.
- an apparatus for improving the security of authentication functions comprises an interface for activating an authentication function for use in a single event, wherein said authentication function is activated by triggering an actuator that implements an authorization function.
- a method for improving the security of authentication functions comprises the steps of triggering an actuator that implements an authentication function, authorizing activation of the authentication function for use in a single event, and applying the authentication function to the event.
- a business process for improving the security of authentication functions comprises the steps of implementing an authentication function, authorizing activation of the authentication function for use in a single event, applying the authentication function to the event, and conducting the event based upon the authentication function.
- a computer readable medium for storing a program for improving the security of authentication indicators, where the program includes a function for allowing a user to enable an authentication indicator, a function for authorizing activation of the authentication indicator for use in an event, and a function for applying the authentication indicator to the event.
- an •apparatus for improving the security of digital signatures comprises means for triggering an actuator that enables the digital signature for use in a transaction, means for authorizing activation of the digital signature for use in the transaction, and means for applying the digital signature to the transaction.
- Figure 1 shows the top-level traditional procedural contract transaction architecture.
- Figure 2 shows the top-level typical digital signature contract transaction architecture.
- Figure 3 shows the top-level Digital Signer/Chop digital signature contract transaction architecture.
- Figure 4 shows the top-level transaction flow chart for the Digital Signer/Chop process.
- the "Digital Signer” or “Digital Chop” combines the digital signature technique with the token function of a smart card, and adds a novel element - a human interface that allows a user to control the activation of the digital signature for each signature event - thus enabling the use of digital signature techniques for the function of a physical, legally binding signature.
- the Digital Signer/Chop solution improves upon the authorization process for digital contracts 300 by restoring the connection between the digital signature 320 and what has been signed.
- This solution introduces the control associated with contractual signatures into the digital signature domain. It does this by wrapping the digital signature process with an additional layer of physical control and security.
- the process allows the individual to obtain information about the digital contract by inserting a security token 310 into a reader 315 containing contract information.
- the individual is able to stop and consider whether to proceed with the transaction before a digital signature is authorized by activating an actuator 312.
- the Actuator 312 which may be as simple as a push-button on a smart card, is used to activate a digital signature device 310 in a reader 315 to carry out a single digital signature event.
- This component needs to be implemented so that it requires the physical intervention of an actual person and that it controls the digital signature hardware and/or software so that they will only generate a single digital signature (i.e., deactivation occurs immediately after each use) .
- Any suitable means may be used as an actuator provided it meets these guidelines.
- the actuator may be present on the Digital Signer/Chop device, or it may be separate from it. Another example of an actuator is a button on a smart card reader.
- Another aspect of the Digital Signer/Chop solution is the Indicator that indicates whether the authorized digital signature has occurred. This could be as simple as an audible “beep” or tone, a visible light, or the return of an Actuator button to a "non-pressed” state. This allows the user to determine whether to authorize and initiate another signature, or if something has failed in the process. Other indicators may also be provided on the Digital Signer/Chop device, including an indicator that the device has been disabled, an indicator that the device has been re-enabled, and indicators to show whether the digital signature event was completed successfully or if the event failed.
- the Digital Signer/Chop device can additionally use Security Identifier technology, such as a password or biometric authentication system, for the general activation of the Digital Signer/Chop device - allowing the Actuator to be a very simple button or other component or action (such as the turning action activates a car's ignition system after the key "authenticates" itself to the car) .
- Security Identifier technology such as a password or biometric authentication system
- the digital signature is authorized after the Actuator has been triggered, and after the Security Identifier technology has authenticated the User by confirming that the correct password or other information was provided.
- the Digital Signer/Chop device can optionally support additional capabilities such as the local storage of logs of transactions - either storing the entire transaction or certain key elements such as the participants, time of transaction, even a summary of key elements of the transaction, etc.
- the device may also be capable of exporting the logs to a remote system for storage or later review. Review from the external equipment is supported.
- the Digital Signer/Chop device can also optionally allow the review of the transaction to be signed directly from the device, as opposed to through a display provided by another piece of equipment that would be less trusted by the user. This ultimate level of control ensures that the user knows precisely what is being signed as well as providing total control over the signature process. Operational limitations and cost may tend to limit the practicality of this implementation.
- the architecture of the Digital Signer/Chop solution preferably also decouples the signature from the entity that is implementing the signature. Therefore, smart cards or other devices using this solution could be used for multiple transaction types, not a single type of financial, business, or personal transaction.
- the Digital Signer/Chop process comprises a generic overall transaction with several steps that are introduced to provide the desired user control. The following are relevant terms :
- Actuator - a component or action used to enable the Digital Signer/Chop function within a Security Token.
- a push button or key turn action like that used in an automobile are non- limiting examples of actuators envisioned by this invention.
- Indicator - a component or action used to make known to a user that the digital signature authorized by the Actuator has been carried out, the digital signature event was successful or the event failed, and whether the Security Token is activated or deactivated, for example.
- Digital Signature a mathematical function implemented in hardware or software that binds a piece of data to a user.
- a digital signature may include a hash function to compress a data stream down to a small size, and/or a public key encryption function that can only be carried out by a user.
- Reader - a device that communicates Transaction data and Digital Signature results with a Security Token.
- the reader may provide information related to the event to the Security Token, and may be capable of exchanging information with the Security Token using wireless communication techniques.
- Security Identifier a password, biometric identifier, or other authentication means.
- Security Token - a device, such as a smart card, USB token, or wireless communication device that implements the digital signature and Digital Signer/Chop functionality.
- a security token for purposes of this invention, could be a general-purpose device, such as a personal computer or simple credit card that supports the creation of digital signatures .
- Transaction - a contract, decision, or other interaction involving at least one User and some other party (called the Host) for purposes of this invention. Any other Users and the Host may use the device according to this invention to authorize the transaction, or they may use other means for authorizing the transaction. Transactions that are of interest are those that require some sort of explicit authorization by a User - such as a legal contract or
- the Security Token can be issued by and configured by an authority legally able to authorize a particular event type.
- the Security Token may also be configured for use with multiple organizations and systems that can authorize different event types. Such an authorizing organization has the capability to prevent completion of an event, or to revoke a completed event, and may even revoke the Security Token.
- Step 1 Any transaction begins with some preliminaries resulting in a proposed transaction being created.
- the proposed transaction information may be provided to the Security Token by means of the Reader, or by any other suitable means.
- Step 2 The User reviews the proposed transaction prior to signing it. This is identical to the process conducted today for traditional legally-binding contracts or purchases . Ideally, the means to review the transaction would be in an environment completely trusted by the User. An example would be some sort of screen or other interface provided by the Security Token. Also, the transaction information itself would be logged by the
- Step 4 the User makes a determination as to whether or not to proceed with the transaction. If the User decides to proceed, then he progresses to Step 4, otherwise, he progresses to Step 11.
- Step 4 The User will use the Actuator component or action in conjunction with the Security Token to enable the Digital Signer function. Note that the Digital Signer function is preferably only enabled for a single use.
- Step 6 Transaction and return the result to the Reader for continued processing.
- the Digital Signer device will then preferably transition to a secure state (Step 8) . vi . Process Transaction (Step 6)
- Step 8 Digital Signer is Disabled (Step 8) [0034] Once the User authorized digital signature has been generated, the Digital Signer device will disable the Security
- the device may optionally give an indication that it is disabled. This
- Security Token is preferably automatically disabled as soon as the digital signature is successfully generated.
- Step 10 The Digital Signer/Chop device is preferably returned to its initial state, and is ready to support the processing of another transaction (Step 1) .
- this Digital Signer/Chop process is not necessarily tied to a single type of transaction. Further, the Digital Signer/Chop device is not necessarily dedicated to use solely for authenticating and authorizing transactions. Thus, a single Digital Signer/Shop device could be used for all of a User's credit card transactions, check signing, and contract signing - much as one's physical signature works for all of these transactions.
- the device may also be used for ATM, debit, and bank transactions; transactions over the internet or other communications networks, including transactions conducted in a wireless environment; direct, network, or remote logins to computer or other systems; facility access; device or vehicle . enablement; and user identification transactions. xi . Terminate Transaction (Step 11)
- the Digital Signer/Chop device is never enabled, and event authorization is denied or revoked.
- the revocation may be stored in the device or in an external means as a Certified Revocation List or a Compromised Key List.
- Step 12 End Terminated Transaction
- the device is returned to an initial state, ready to process a new transaction (Step 1) .
- the Digital Signer/Chop device and process could be integrated into the traditional credit card transaction process to help reduce this security problem. Since the Digital Signer is not tied to a specific card or card number, a single authorization system could be created. This has the additional benefit of reducing the cost for adding new cards or services for a user since the infrastructure costs are reduced. Finally, the Digital Signer/Chop device and system provides a solution to the practical problem of a lost wallet - instead of a person attempting to remember which cards were lost, the only scenario that matters is if the Digital Signer/Chop device is lost, and the User can disable it by making a single call to the device issuer. • Device Enablement & Facility Access - cellular phones and even cars use PINs and other security devices to enable their activation.
- the Digital Signer/Chop device could replace these diverse tools, thereby simplifying consumers' lives as well as enabling security that is tailored to the individual to meet personal, business, legal, insurance, and law enforcement requirements.
- New services such as electronic curfews, could also be created using the device and system according to this invention.
Abstract
Description
Claims
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU2002213413A AU2002213413A1 (en) | 2000-10-24 | 2001-10-24 | Process and apparatus for improving the security of digital signatures |
JP2002538617A JP2004533730A (en) | 2000-10-24 | 2001-10-24 | Process and apparatus for improving security of digital signature and public key infrastructure for real world applications |
CA002426865A CA2426865A1 (en) | 2000-10-24 | 2001-10-24 | Process and apparatus for improving the security of digital signatures and public key infrastructures for real-world applications |
EP01981795A EP1360793A2 (en) | 2000-10-24 | 2001-10-24 | Process and apparatus for improving the security of digital signatures |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US24245800P | 2000-10-24 | 2000-10-24 | |
US60/242,458 | 2000-10-24 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2002035764A2 true WO2002035764A2 (en) | 2002-05-02 |
WO2002035764A3 WO2002035764A3 (en) | 2003-08-21 |
Family
ID=22914855
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2001/032624 WO2002035764A2 (en) | 2000-10-24 | 2001-10-24 | Process and apparatus for improving the security of digital signatures |
Country Status (7)
Country | Link |
---|---|
US (1) | US20020053028A1 (en) |
EP (1) | EP1360793A2 (en) |
JP (1) | JP2004533730A (en) |
CN (1) | CN1524363A (en) |
AU (1) | AU2002213413A1 (en) |
CA (1) | CA2426865A1 (en) |
WO (1) | WO2002035764A2 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7178724B2 (en) | 2003-04-21 | 2007-02-20 | Stmicroelectronics, Inc. | Smart card device and method used for transmitting and receiving secure e-mails |
US8302184B2 (en) | 2007-04-11 | 2012-10-30 | Fuji Xerox Co., Ltd | Information processing apparatus, information processing method and storage medium |
WO2015019821A1 (en) * | 2013-08-05 | 2015-02-12 | ソニー株式会社 | Information processing device, information processing method, and computer program |
Families Citing this family (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6973333B1 (en) * | 2001-04-10 | 2005-12-06 | At&T Corp. | Modification of portable communications device operation in vehicles |
KR20050042694A (en) * | 2003-11-04 | 2005-05-10 | 한국전자통신연구원 | Method for electronic commerce using security token and apparatus thereof |
US20050283633A1 (en) * | 2004-06-18 | 2005-12-22 | Ron Kozenitzky | Method and system for securing a device |
US7657932B2 (en) * | 2004-07-14 | 2010-02-02 | Microsoft Corporation | Extendible security token management architecture and secure message handling methods |
US8588483B2 (en) * | 2004-12-21 | 2013-11-19 | Signaturelink, Inc. | System and method for providing a real-time, online biometric signature |
US20060136731A1 (en) * | 2004-12-21 | 2006-06-22 | Signaturelink, Inc. | System and method for providing an online electronic signature |
JP2007115136A (en) * | 2005-10-21 | 2007-05-10 | Dainippon Printing Co Ltd | Ic card and ic card program |
EP2166483A1 (en) * | 2008-09-17 | 2010-03-24 | Tds Todos Data System Ab | Method and device for creating a digital signature |
CN201846343U (en) * | 2010-09-25 | 2011-05-25 | 北京天地融科技有限公司 | Electronic signature tool communicating with mobile phone through speech mode |
Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5191613A (en) * | 1990-11-16 | 1993-03-02 | Graziano James M | Knowledge based system for document authentication |
EP0676877A2 (en) * | 1994-04-05 | 1995-10-11 | International Business Machines Corporation | Method and apparatus for authentication and verification of printed documents using digital signatures and authentication codes |
EP0760565A1 (en) * | 1995-08-28 | 1997-03-05 | Feldbau, Ofra | Apparatus and method for authenticating the dispatch and contents of documents |
WO1997012460A1 (en) * | 1995-09-15 | 1997-04-03 | Document Authentication Systems, Inc. | Document authentication system and method |
WO1999008415A2 (en) * | 1997-08-06 | 1999-02-18 | Infineon Technologies Ag | System for generating electronic signatures in absolute security |
WO1999033221A1 (en) * | 1997-12-19 | 1999-07-01 | Koninklijke Philips Electronics N.V. | Secure proxy signing device and method for use |
US6021202A (en) * | 1996-12-20 | 2000-02-01 | Financial Services Technology Consortium | Method and system for processing electronic documents |
FR2791203A1 (en) * | 1999-03-17 | 2000-09-22 | Schlumberger Systems & Service | DEVICE FOR AUTHENTICATING A MESSAGE DURING A CRYPTOGRAPHIC PROCESSING OPERATION OF SAID MESSAGE |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6226743B1 (en) * | 1998-01-22 | 2001-05-01 | Yeda Research And Development Co., Ltd. | Method for authentication item |
US6085321A (en) * | 1998-08-14 | 2000-07-04 | Omnipoint Corporation | Unique digital signature |
JP2000276445A (en) * | 1999-03-23 | 2000-10-06 | Nec Corp | Authentication method and device using biometrics discrimination, authentication execution device, and recording medium recorded with authentication program |
US6871278B1 (en) * | 2000-07-06 | 2005-03-22 | Lasercard Corporation | Secure transactions with passive storage media |
-
2001
- 2001-10-24 CA CA002426865A patent/CA2426865A1/en not_active Abandoned
- 2001-10-24 WO PCT/US2001/032624 patent/WO2002035764A2/en not_active Application Discontinuation
- 2001-10-24 AU AU2002213413A patent/AU2002213413A1/en not_active Abandoned
- 2001-10-24 EP EP01981795A patent/EP1360793A2/en not_active Withdrawn
- 2001-10-24 JP JP2002538617A patent/JP2004533730A/en active Pending
- 2001-10-24 CN CNA018178626A patent/CN1524363A/en active Pending
- 2001-10-24 US US09/983,491 patent/US20020053028A1/en not_active Abandoned
Patent Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5191613A (en) * | 1990-11-16 | 1993-03-02 | Graziano James M | Knowledge based system for document authentication |
EP0676877A2 (en) * | 1994-04-05 | 1995-10-11 | International Business Machines Corporation | Method and apparatus for authentication and verification of printed documents using digital signatures and authentication codes |
EP0760565A1 (en) * | 1995-08-28 | 1997-03-05 | Feldbau, Ofra | Apparatus and method for authenticating the dispatch and contents of documents |
WO1997012460A1 (en) * | 1995-09-15 | 1997-04-03 | Document Authentication Systems, Inc. | Document authentication system and method |
US6021202A (en) * | 1996-12-20 | 2000-02-01 | Financial Services Technology Consortium | Method and system for processing electronic documents |
WO1999008415A2 (en) * | 1997-08-06 | 1999-02-18 | Infineon Technologies Ag | System for generating electronic signatures in absolute security |
WO1999033221A1 (en) * | 1997-12-19 | 1999-07-01 | Koninklijke Philips Electronics N.V. | Secure proxy signing device and method for use |
FR2791203A1 (en) * | 1999-03-17 | 2000-09-22 | Schlumberger Systems & Service | DEVICE FOR AUTHENTICATING A MESSAGE DURING A CRYPTOGRAPHIC PROCESSING OPERATION OF SAID MESSAGE |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7178724B2 (en) | 2003-04-21 | 2007-02-20 | Stmicroelectronics, Inc. | Smart card device and method used for transmitting and receiving secure e-mails |
US8302184B2 (en) | 2007-04-11 | 2012-10-30 | Fuji Xerox Co., Ltd | Information processing apparatus, information processing method and storage medium |
WO2015019821A1 (en) * | 2013-08-05 | 2015-02-12 | ソニー株式会社 | Information processing device, information processing method, and computer program |
US10447673B2 (en) | 2013-08-05 | 2019-10-15 | Sony Corporation | Information processing apparatus, information processing method, and computer program |
Also Published As
Publication number | Publication date |
---|---|
WO2002035764A3 (en) | 2003-08-21 |
CN1524363A (en) | 2004-08-25 |
CA2426865A1 (en) | 2002-05-02 |
AU2002213413A1 (en) | 2002-05-06 |
EP1360793A2 (en) | 2003-11-12 |
US20020053028A1 (en) | 2002-05-02 |
JP2004533730A (en) | 2004-11-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10616222B2 (en) | Authenticator centralization and protection based on authenticator type and authentication policy | |
US9596089B2 (en) | Method for generating a certificate | |
US6745327B1 (en) | Electronic certificate signature program | |
EP0771499B1 (en) | Method for securely using digital signatures in a commercial cryptographic system | |
CN110060037B (en) | Distributed digital identity system based on block chain | |
JP4508331B2 (en) | Authentication agent device, authentication agent method, authentication agent service system, and computer-readable recording medium | |
US8856507B2 (en) | Secure identity and personal information storage and transfer | |
US20070179903A1 (en) | Identity theft mitigation | |
US20020138769A1 (en) | System and process for conducting authenticated transactions online | |
US20130219481A1 (en) | Cyberspace Trusted Identity (CTI) Module | |
CN105608577A (en) | Method for performing non-repudiation, and payment managing server and user device therefor | |
JP2011008801A (en) | Method and apparatus for simplified audio authentication | |
JP2004519874A (en) | Trusted Authentication Digital Signature (TADS) System | |
JP2009048627A (en) | Method and apparatus for performing delegated transaction | |
CN101517562A (en) | Method for registering and certificating user of one time password by a plurality of mode and computer-readable recording medium where program executing the same method is recorded | |
JP2005050308A (en) | Personal authentication device, system, and method thereof | |
WO1996002993A9 (en) | Method for securely using digital signatures in a commercial cryptographic system | |
TWI241106B (en) | Personal authentication device and system and method thereof | |
KR100914905B1 (en) | Smart Card Having Function of One Time Password Generation and Electronic Banking System Using That | |
US20090106829A1 (en) | Method and system for electronic reauthentication of a communication party | |
KR20040075321A (en) | Method for registering and enabling pki functionalities | |
US20020053028A1 (en) | Process and apparatus for improving the security of digital signatures and public key infrastructures for real-world applications | |
CN114666045A (en) | Home entrepreneurship pre-authentication device and home entrepreneurship pre-authentication method | |
CA2613899C (en) | Secure identity and personal information storage and transfer | |
US20240129139A1 (en) | User authentication using two independent security elements |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
DFPE | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101) | ||
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2001981795 Country of ref document: EP Ref document number: 018178626 Country of ref document: CN |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2002538617 Country of ref document: JP Ref document number: 2426865 Country of ref document: CA |
|
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
WWP | Wipo information: published in national office |
Ref document number: 2001981795 Country of ref document: EP |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: 2001981795 Country of ref document: EP |