Method and system for electronically signing and processing digital documents

• US 20030078880A1
• Filed: 11/19/2002
• Published: 04/24/2003
• Est. Priority Date: 10/08/1999
• Status: Abandoned Application

• Current Assignee: Wave Systems Corporation
• Original Assignee: Wave Systems Corporation
• Inventors: Kearns, Jonathan, Purcell, Kelly, Alley, Nancy
• Application Number:
  US10/299,511
• Publication Number:
  US 20030078880A1
• Time in Patent Office: Days
• US Class Current: 705/38
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/608 Watermarking
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

A method and system for managing the electronic signing of digital documents is disclosed. An electronic document created and prepared for signing by associating certain signing constraints with the document. Indicia of the signing constraints are encoded into a document information block or blocks that are embedded into the document. The information block may include indicia of a database record at a central server that stores indicia of the signing constraints in addition to or in lieu of including the signing constraint indicia in the document information block or blocks. Upon receiving the prepared document at a signing terminal, the information blocks are extracted and the signing constraints tested. If the user desires to sign the document, and if the user is permitted to sign, the document is electronically signed and transmitted to the central file server for storage.

Claims

1. A method for electronically signing a digital data file, comprising:

a) embedding in a first digital data file, at a document preparation terminal, at least one information block associated with at least one signing constraint, to form a second digital data file;

b) transmitting over a first computer network said second digital data file to a document signing terminal;

c) receiving by said document signing terminal a request from a user of said document signing terminal to electronically sign said second digital data file, said user of said document signing terminal having at least one associated digital private key;

d) determining, at said document signing computer, whether said at least one signing constraint is satisfied;

e) electronically signing said second digital data file using at least said digital private key associated with said user of said document signing terminal if the result of said step d) is that said at least one signing constraint is satisfied, thereby forming a third digital data file; and

f) transmitting said third digital data file over a second computer network from said signing terminal to a central digital file server for storage.

2. The method of claim 1, wherein said at least one signing constraint relates to an expiration date before which said second digital data file must be signed, further comprising:

g) determining, before said step d), the current date;

wherein said determining step d) comprises determining that said at least one signing constraint is satisfied if the result of said step g) is that said current date is earlier than the expiration date before which said second digital data file must be signed.

3. The method of claim 1, wherein said digital private key is associated with a digital certificate issued by a certification authority that issues digital certificates having a particular one of at least two authorization levels, and wherein said signing constraint relates to a minimum authorization level of said digital certificate, further comprising:

g) determining, before said step d), the authorization level of the digital certificate associated with said digital private key;

wherein said determining step d) comprises determining that said at least one signing constraint is satisfied if the result of said step g) is that said authorization level of the digital certificate associated with said digital private key is equal to or exceeds said minimum authorization level.

4. The method of claim 1, wherein said digital private key is associated with a digital certificate issued by a certification authority, and wherein said signing constraint relates to a list of at least one trusted certification authority, further comprising:

g) determining, before said step d), whether said digital certificate is issued by a certification authority that is in said list of at least one trusted certification authority;

wherein said determining step d) comprises determining that said at least one signing constraint is satisfied if the result of said step g) is that said digital certificate is issued by a certification authority that is in said list of at least one trusted certification authority.

5. The method of claim 1, wherein said signing constraint relates to said user of said document signing terminal consenting to treat said third digital data file as a transferable record, further comprising:

g) prompting, before said step d), said user of said document signing terminal to consent to treat said third digital data file as a transferable record,

wherein said determining step d) comprises determining that said at least one signing constraint is satisfied if said user of said document signing terminal indicated consent to treat said third digital data file as a transferable record during said step g).

6. The method of claim 1, wherein said signing constraint relates to the identity of a specific user having permission to sign said second digital data file, further comprising:

g) prompting, before said step d), said user of said document signing terminal to provide an indicia of identity,

wherein said determining step d) comprises determining that said at least one signing constraint is satisfied if said user of said document signing terminal is the specific user having permission to sign said second digital data file.

7. The method of claim 1, wherein said signing constraint relates to the identity of a class of users having permission to sign said second digital data file, further comprising:

g) prompting, before said step d), said user of said document signing terminal to provide an indicia of identity,

wherein said determining step d) comprises determining that said at least one signing constraint is satisfied if said user of said document signing terminal is a member of the class of users having permission to sign said second digital data file.

8. The method of claim 1, further comprising:

g) receiving, before said step d), from a central server, a server information block;

wherein information in said server information block is used during said step d) to determine whether said at least one signing constraint is satisfied.

9. The method of claim 1, wherein said step a) further includes embedding in said first digital data file a second information block having indicia of transactional data related to said first digital data file, further comprising:

g) extracting, after said step f), from said third digital data file, said second information block; and

h) recording in an transactional data field in a database record indicia of said transactional data related to said first digital data file.

10. The method of claim 1, wherein said step a) further includes embedding in said first digital data file a second information block having an indicia of an owner of said third digital data file, further comprising:

g) extracting, after said step f), from said third digital data file, said second information block;

h) recording in an owner data field in a database record, the owner of said third digital data file based on said extracted second information block; and

i) modifying, after said step h), said owner data field to transfer the ownership of said third digital data file.

11. The method of claim 1, wherein said first and second computer networks are both part of a single computer network.

12. The method of claim 8, wherein said central server and said central digital file server are both part of a single computer server.

13. A system for electronically signing a digital data file, comprising:

a first computer readable storage area containing a first computer code segment, said first computer code segment for actuating a processor of a document preparation terminal, said first computer code segment providing functionality for accessing a first digital data file and for embedding at least one information block associated with at least one signing constraint into said first digital data file to form a second digital data file;

an electronic document file storage device having a network interface for receiving digital data files and a digital storage medium for storing said digital data files received by said network interface device;

a second computer readable storage area containing a second computer code segment, said second computer code segment for actuating a processor of a document signing terminal, said second computer code segment providing functionality for;

(a) receiving a request from a user of said document signing terminal to electronically sign said second digital data file, (b) determining whether said user of said document signing terminal is permitted to sign said second digital data file based on at least said at least one signing constraint associated with said at least one information block, (c) electronically signing said second digital data file using at least one digital private key associated with said user of said document signing terminal if the result of said determining is that said at least one signing constraint is satisfied, said electronically signing resulting in a third digital data file, and (d) transmitting said third digital data file to said electronic document file storage device.

14. A method for electronically signing a digital data file, comprising:

a) embedding in a first digital data file, at a document preparation terminal, at least one information block identifying a database record in a central database, to form a second digital data file;

b) transmitting over a first computer network said second digital data file to a document signing terminal;

c) receiving by said document signing terminal, a request from a user of said document signing terminal to electronically sign said second digital data file, said user of said document signing terminal having at least one associated digital private key;

d) receiving by said central database, a record lookup request from said document signing terminal, the contents of said lookup request based on said at least one information block;

e) transmitting to said document signing terminal over a second computer network indicia associated with at least one signing constraint in response to said lookup request;

f) determining, at said document signing computer, whether said at least one signing constraint is satisfied;

g) electronically signing at said document signing terminal, said second digital data file using at least said at least one digital private key associated with said user of said document signing terminal if the result of said step f) is that said at least one signing constraint is satisfied, thereby forming a third digital data file; and

h) transmitting said third digital data file over a third computer network from said signing terminal to a central digital file server for storage.

15. The method of claim 14, wherein said at least one signing constraint relates to an expiration date before which said second digital data file must be signed, further comprising:

i) determining, before said step f), the current date;

wherein said determining step f) comprises determining that said at least one signing constraint is satisfied if the result of said step i) is that said current date is earlier than the expiration date before which said second digital data file must be signed.

16. The method of claim 14, wherein said digital private key is associated with a digital certificate issued by a certification authority that issues digital certificates having a particular one of at least two authorization levels, and wherein said signing constraint relates to a minimum authorization level of said digital certificate, further comprising:

i) determining, before said step f), the authorization level of the digital certificate associated with said digital private key;

wherein said determining step f) comprises determining that said at least one signing constraint is satisfied if the result of said step i) is that said authorization level of the digital certificate associated with said digital private key is equal to or exceeds said minimum authorization level.

17. The method of claim 14, wherein said digital private key is associated with a digital certificate issued by a certification authority, and wherein said signing constraint relates to a list of at least one trusted certification authority, further comprising:

i) determining, before said step f), whether said digital certificate is issued by a certification authority that is in said list of at least one trusted certification authority;

wherein said determining step f) comprises determining that said at least one signing constraint is satisfied if the result of said step i) is that said digital certificate is issued by a certification authority that is in said list of at least one trusted certification authority.

18. The method of claim 14, wherein said signing constraint relates to said user of said document signing terminal consenting to treat said third digital data file as a transferable record, further comprising:

i) prompting, before said step f), said user of said document signing terminal to consent to treat said third digital data file as a transferable record,

wherein said determining step f) comprises determining that said at least one signing constraint is satisfied if said user of said document signing terminal indicated consent to treat said third digital data file as a transferable record during said step i).

19. The method of claim 14, wherein said signing constraint relates to the identity of a specific user having permission to sign said second digital data file, further comprising:

i) prompting, before said step f), said user of said document signing terminal to provide an indicia of identity,

wherein said determining step f) comprises determining that said at least one signing constraint is satisfied if said user of said document signing terminal is the specific user having permission to sign said second digital data file.

20. The method of claim 14, wherein said signing constraint relates to the identity of a class of users having permission to sign said second digital data file, further comprising:

i) prompting, before said step f), said user of said document signing terminal to provide an indicia of identity,

wherein said determining step f) comprises determining that said at least one signing constraint is satisfied if said user of said document signing terminal is a member of the class of users having permission to sign said second digital data file.

21. The method of claim 14, further comprising:

i) receiving, before said step f), from a central server, a server information block;

wherein said server information block is used during said step f) to determine whether said at least one signing constraint is satisfied.

22. The method of claim 14, wherein said database record is associated with said first digital data file and includes at least a first data field storing indicia of at least one signing constraint and second data field storing indicia of transactional data related to said first digital data file.

23. The method of claim 14, wherein said database record is associated with said first digital data file and includes at least a first data field storing indicia of at least one signing constraint and second data field storing indicia of an owner of said third digital data file, further comprising:

i) modifying, after said step h), said owner data field to transfer the ownership of said third digital data file.

24. The method of claim 14, wherein said first, second and third computer networks are all part of a single computer network.

25. The method of claim 21, wherein said central server and said central digital file server are both part of a single computer server.

26. A system for electronically signing a digital data file, comprising:

a central database;

a first computer readable storage area containing a first computer code segment, said first computer code segment for actuating a processor of a document preparation terminal, said first computer code segment providing functionality for accessing a first digital data file and for embedding at least one information block identifying a database record in said central database, into said first digital data file to form a second digital data file;

an electronic document file storage device having a network interface for receiving digital data files and a digital storage medium for storing said digital data files received by said network interface device;

a second computer readable storage area containing a second computer code segment, said second computer code segment for actuating a processor of a document signing terminal, said second computer code segment providing functionality for;

(a) receiving a request from a user of said document signing terminal to electronically sign said second digital data file, (b) transmitting to said central database a record lookup request, the contents of said lookup request based on said at least one information block, (c) receiving from said central database, indicia associated with at least one signing constraint in response to said record lookup request, (d) determining whether said user of said document signing terminal is permitted to sign said second digital data file based on at least said at least one signing constraint, (e) electronically signing said second digital data file using at least one digital private key associated with said user of said document signing terminal if the result of said determining is that said at least one signing constraint is satisfied, said electronically signing resulting in a third digital data file, and (f) transmitting said third digital data file to said electronic document file storage device.

27. A method for electronically signing a digital data file, comprising:

a) embedding in a first digital data file, at a document preparation terminal, at least one document information block identifying at least one database record in a central database accessible by a central server, to form a second digital data file;

b) transmitting over a first computer network said second digital data file to a document signing terminal;

c) receiving by said document signing terminal, a request from a user of said document signing terminal to electronically sign said second digital data file, said request including a user identification information block identifying said user, said user of said document signing terminal having at least one associated digital private key;

d) receiving by said central server, a signing permission request from said document signing terminal, the contents of said signing permission request based on said at least one document information block and said user identification information block;

e) accessing, by said central server, said at least one database record in said central database identified by said document information block to retrieve indicia of at least one signing constraint;

f) determining, at said central server, whether said user of said document signing terminal is permitted to sign said second digital data file based on at least said user identification information block and said indicia of at least one signing constraint;

g) receiving at said document signing terminal from said central server a positive signing permission response if the result of said step f) is that said signing constraint is satisfied and receiving at said document signing terminal a negative signing permission response if the result of said step f) is that said signing constraint is not satisfied;

h) electronically signing at said document signing terminal, said second digital data file using at least said at least one digital private key associated with said user of said document signing terminal if a positive signing permission response was received in step g), thereby forming a third digital data file; and

i) transmitting said third digital data file over a second computer network from said signing terminal to a central digital file server for storage.

28. The method of claim 27, wherein said first and second computer networks are both part of a single computer network.

29. The method of claim 27, wherein said central server and said central digital file server are both part of a single server.

30. A system for electronically signing a digital data file, comprising:

a central database;

a central server coupled to and capable of accessing data records stored in said central database;

a first computer readable storage area containing a first computer code segment, said first computer code segment for actuating a processor of a document preparation terminal, said first computer code segment providing functionality for accessing a first digital data file and for embedding at least one document information block identifying at least one database record in said central database, into said first digital data file to form a second digital data file;

an electronic document file storage device having a network interface for receiving digital data files and a digital storage medium for storing said digital data files received by said network interface device;

a second computer readable storage area containing a second computer code segment, said second computer code segment for actuating a processor of a document signing terminal, said second computer code segment providing functionality for;

(a) receiving a request from a user of said document signing terminal to electronically sign said second digital data file, said request including a user identification information block identifying said user, (b) transmitting to said central server a signing permission request, the contents of said signing permission request based on said at least one document information block and said user identification information block, (c) receiving, from said central server, a response to said signing permission request, (d) electronically signing said second digital data file using at least one digital private key associated with said user of said document signing terminal if said response to said signing permission request indicates that said user is permitted to sign said second digital data file, and (f) transmitting said third digital data file to said electronic document file storage device;

wherein said central server has further functionality for receiving said signing permission request from said document signing terminal, accessing said at least one database record in said central database identified by said document information block to retrieve indicia of at least one signing constraint, determining whether said user of said document signing terminal is permitted to sign said second digital file based on at least said user identification information block and said indicia of at least one signing constraint, and transmitting a response indicating that said user is permitted to sign said second digital data file if the result of said determining is that said signing constraint is satisfied and transmitting a response indicating that said user is not permitted to sign said second digital data file if the result of said determining is that said signing constraint is not satisfied.

31. A method for electronically managing a digital data file, comprising:

a) embedding in a first digital data file, at a document preparation terminal, at least one document information block identifying at least one database record associated with said first digital data file in a central database, to form a second digital data file;

b) transmitting over a computer network said second digital data file to a document signing terminal;

c) electronically signing, at a document signing terminal, said second digital data file using at least one digital private key associated with at least one user of said document signing terminal, thereby forming a third digital data file;

d) receiving over said computer network at a central digital file server, said third digital data file from said signing terminal;

e) extracting, after said step d), said at least one document information block from said third digital data file; and

f) updating, after said step e), said at least one database record identified by said document information block.

32. The method of claim 31, wherein said step f) includes updating said at least one database record to include a date/time stamp indicating the time when said third digital data file was received at said central digital file server.

33. The method of claim 31, wherein said step f) includes updating said at least one database record to include identification information related to said at least one user of said signing terminal associated with said at least one digital private key used during said step c).

34. The method of claim 31, wherein said step f) includes updating said at least one database record to indicate a current owner of said third digital data file.