Duress signatures

• US 10,110,385 B1
• Filed: 12/22/2014
• Issued: 10/23/2018
• Est. Priority Date: 12/22/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Rush, Dylan Harris, Canavor, Darren Ernest, Hitchcock, Daniel Wade, Johansson, Jesper Mikael, McClintock, Jon Arron
• Primary Examiner(s): Tran, Ellen
• Application Number:
  US14/580,118
• Time in Patent Office: 1,401 Days
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A system and method for generating a signature for a document using credentials indicating an unsanctioned signing event. The system and method includes receiving a request to generate a signature of a signatory for a document, wherein the request includes a received set of credential data for a signatory, obtaining a token identifier for at least one computing device, and determining if the received set of credential data matches credentials indicating the unsanctioned signing event. The system and method further includes receiving the signature of the signatory, the document identifier, and the token identifier, and determining based at least in part on the signature, document identifier, and the token identifier, whether the received signature is associated with the unsanctioned signing event.

Claims

1. A computer-implemented method, comprising:

under the control of one or more computer systems configured with executable instructions,

receiving a signature of a signatory, wherein the signatory is associated with a first set of credential data and a second set of credential data, wherein the first set of credential data is associated with a first duress level, and wherein the second set of credential data is associated with a second duress level;

receiving a document identifier for identifying a document, the document identifier derived based at least in part from document contents;

obtaining an identity verification identifier for identifying an identity verification token, wherein the identity verification token is registered with an identity registrar and authorized by the identity registrar to generate signatures, and wherein the identity verification identifier comprises a first private key corresponding to a first public key and a second private key corresponding to a second public key;

generating a first signature based at least in part on the document identifier, the first set of credential data, and the identity verification identifier, wherein the first signature is based at least in part on encrypting the document identifier using the first private key;

determining that the generated first signature is not a match to the received signature of the signatory;

generating a second signature based at least in part on the document identifier, the second set of credential data, and the identity verification identifier, wherein the second signature is based at least in part on encrypting the document identifier using the second private key;

determining that the generated second signature is a match to the received signature of the signatory; and

performing an action in accordance with the second duress level, wherein the action is one or more of hiding information associated with a first account, displaying information associated with a second account, notifying security personnel of a security incident indicated by the second duress level, sending a message indicating an occurrence of the second duress level, indicating the occurrence of the second duress level in a data store, or repudiating transactions associated with the document.

2. The computer-implemented method of claim 1, wherein the second set of credentials is associated with a signing event where the signatory signed the document unwillingly, and wherein determining that the generated second signature is a match to the received signature is an indication that the signatory signed the document unwillingly.

3. The computer-implemented method of claim 1, wherein the first set of credential data includes a first duress confidence score and the second set of credential data includes a second duress confidence score, wherein the second duress confidence score indicates a greater likelihood than the first duress confidence score of the signature having been made under duress.

4. A system, comprising:

at least one computing device that implements one or more services, wherein the one or more services;

receive, from a signatory, a request to generate a signature for a document, wherein the signatory is associated with multiple sets of credentials, wherein a first set of credentials is associated with a first duress level, and wherein a second set of credentials is associated with a second duress level;

obtain a document identifier for the document, the document identifier derived based at least in part from document contents;

obtain a token identifier for the at least one computing device, wherein the token identifier is registered with an identity registrar and authorized by the identity registrar to generate signatures, and wherein the token identifier comprises a first private key corresponding to a first public key and a second private key corresponding to a second public key;

generate a first signature based at least in part on the document identifier, the first set of credentials, and the identity verification identifier, wherein the first signature is based at least in part on encrypting the document identifier using the first private key;

determine that the generated first signature is not a match to the received signature of the signatory;

generate a second signature based at least in part on the document identifier, the second set of credentials, and the identity verification identifier, wherein the second signature is based at least in part on encrypting the document identifier using the second private key;

determine that the generated second signature is a match to the received signature of the signatory; and

perform an action in accordance with a duress level associated with the second set of credentials, wherein the action is one or more of hiding information associated with a first account, displaying information associated with a second account, notifying security personnel of a security incident indicated by the duress level, sending a message indicating an occurrence of the duress level, indicating the occurrence of the duress level in a data store, or repudiating transactions associated with the document.

5. The system of claim 4, wherein the one or more services further request, from the signatory, the credentials to use as part of the signature.

6. The system of claim 4, wherein:

the multiple sets of credentials include multiple sets of biometric data associated with the signatory;

at least one set of the multiple sets of biometric data includes one or more of fingerprint data or finger movement data that indicates an occurrence of a sanctioned signing event; and

at least another set of biometric data includes one or more of fingerprint data or finger movement data that indicates an occurrence of an unsanctioned signing event.

7. The system of claim 4, wherein the at least one computing device includes sensors capable of measuring one or more of:

a heart rate of the signatory,

an amount of pupil dilation of the signatory,

body temperature of the signatory,

an amount of sweat of the signatory, or

blood pressure of the signatory.

8. The system of claim 4, wherein:

the multiple sets of credentials include;

a location of a signing event corresponding to the signature; and

a set of criteria for determining whether the location of the signing event is indicative of an occurrence of an unsanctioned signing event; and

the one or more services that determine the multiple sets of credentials further determine whether the location of the signing event indicates the occurrence of the unsanctioned signing event.

9. The system of claim 4, wherein the one or more services are further configured to cause the at least one computing device to imprint the signature as an optically scannable code.

10. The system of claim 4, wherein the one or more services that generate the signature further generate the signature further based at least in part on a confidence score indicating a likelihood that the signatory is signing under duress.

11. The system of claim 4, wherein:

the multiple sets of credentials include a set of biometric data about the signatory; and

the one or more services that determine the multiple sets of credentials further determine, based at least in part on a set of criteria for determining whether the set of biometric data is indicative of an occurrence of an unsanctioned signing event, whether the set of biometric data indicates the occurrence of the unsanctioned signing event.

12. The system of claim 11, wherein the set of biometric data includes physiological biometric data and behavioral biometric data, and the set of criteria includes criteria for determining whether a combination of the physiological biometric data and the behavioral biometric data is indicative of the occurrence of the unsanctioned signing event.

13. The system of claim 4, wherein:

the request includes an indication of at least one acceptable type of credentials for signing the document;

one or more credentials of the multiple sets of credentials are of the at least one acceptable type; and

the signatory selects the credentials from the one or more credentials.

14. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:

receive a signature of a signatory, wherein the signatory is associated with a plurality of sets of credential data, wherein each set of credential data is associated with a corresponding duress level of a plurality of duress levels;

receive a document identifier for identifying a document, the document identifier derived based at least in part from document contents;

obtain a token identifier for identifying a token, wherein the token is authorized by a service provider to generate signatures and comprises a set of private keys of a public-private key scheme;

generate a first signature, using the token, wherein the signature is based at least in part on encrypting the document identifier using a first private key of the set of private keys;

determine, based at least in part on the signature, the document identifier, the token identifier, and a public key from a set of public keys corresponding to the set of private keys of the public-private key scheme;

determine that the generated first signature is not a match to the received signature of the signatory;

generate a second signature based at least in part on the document identifier, the second set of credential data, and the identity verification identifier, wherein the second signature is based at least in part on encrypting the document identifier using the second private key;

determine that the generated second signature is a match to the received signature of the signatory and that the signature received is associated with a duress level of the plurality of duress levels, wherein the duress level indicates an occurrence of an event that is;

a duress event, or

a signing event that exceeded a signing authority of the signatory; and

perform an action as a result of the event determined to have occurred.

15. The non-transitory computer-readable storage medium of claim 14, wherein the instructions include instructions that cause the computer system to determine that the signature received is associated with a signing event that exceeded a signing authority of the signatory based at least in part on criteria limiting signing authority of the signatory.

16. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to at least receive the signature include instructions that cause the system to receive the signature of the signatory by scanning an optically scannable code.

17. The non-transitory computer-readable storage medium of claim 14, wherein the instructions further include instructions that cause the computer system to, based at least in part on determining that the signature received is associated with the occurrence of the duress event, perform a different action from an action that would have been performed had the signature received been associated with an occurrence of a non-duress event.

18. The non-transitory computer-readable storage medium of claim 17, wherein the different action includes granting access to a different account than an account associated with the sanctioned signing event.

19. The non-transitory computer-readable storage medium of claim 17, wherein the different action includes not revealing one or more items of an account, wherein the one or more items would be revealed had the signature received been associated with the sanctioned signing event.

20. The non-transitory computer-readable storage medium of claim 17, wherein the different action includes a challenge-response action wherein a challenge is presented to the signatory to confirm that the duress event is actually occurring under duress.