Document authentication combining digital signature verification and visual comparison

• US 20060117182A1
• Filed: 11/30/2004
• Published: 06/01/2006
• Est. Priority Date: 11/30/2004
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Wolff, Gregory J.
• Granted Patent: US 8,037,310 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A document authentication system and method combine digital and non-electronic (or visual) authentication methodologies in an integrated, unified manner. As well as providing indicia of digital authentication, the invention generates a physical artifact that can be validated by unaided human visual perception. The present invention thus provides an opportunity to improve the level of trust in authentication of documents, while preserving the advantages of both traditional and digital authentication mechanisms.

Claims

1. A method for authenticating a first document, the first document comprising a visual representation of content and a first digital fingerprint, the method comprising:

reading the first document to obtain the first digital fingerprint;

determining a storage location;

retrieving content stored at the determined storage location;

verifying the first digital fingerprint;

generating authentication indicia for the first document, the authentication indicia comprising a representation of at least a portion of the retrieved content and further comprising an assertion of the authenticity of the representation; and

outputting the authentication indicia.

2. The method of claim 1, wherein the digital fingerprint comprises a hash result.

3. The method of claim 1, wherein reading the first document to obtain the first digital fingerprint comprises scanning the first document to obtain the first digital fingerprint.

4. The method of claim 1, wherein determining the storage location comprises reading an indicator of storage location from the first document.

5. The method of claim 4, wherein the indicator of storage location comprises a uniform resource locator.

6. The method of claim 1, wherein the first digital fingerprint comprises a first digital signature.

7. The method of claim 6, wherein verifying the first digital signature comprises:

applying a hash algorithm to at least a portion of the retrieved content to derive a first hash result;

applying a public key to the first digital signature to obtain a second hash result; and

comparing the first and second hash results.

8. The method of claim 7, wherein the first document comprises the public key.

9. The method of claim 7, wherein the first document comprises a pointer to the public key.

10. The method of claim 1, wherein verifying the first digital fingerprint comprises:

applying a hash algorithm to at least a portion of the retrieved content to derive a first hash result;

comparing the first hash result with the first digital fingerprint.

11. The method of claim 1, further comprising comparing the visual representation of content on the first document with the retrieved content.

12. The method of claim 1, further comprising electronically comparing the visual representation of content on the first document with the retrieved content.

13. The method of claim 12, and wherein generating authentication indicia is performed responsive to the electronic comparison.

14. The method of claim 1, further comprising, prior to generating authentication indicia for the first document:

rendering at least a portion of the retrieved content.

15. The method of claim 14, wherein the retrieved content is in a document file format.

16. The method of claim 14, wherein the retrieved content is in a file format capable of being rendered into human-readable form.

17. The method of claim 14, wherein the retrieved content comprises at least one selected from the group consisting of:

a portable document format file;

a word processor file;

an image file;

a multimedia file;

a spreadsheet file;

a text file;

a hypertext file;

an HTML file; and

an XML file.

18. The method of claim 1, wherein the authentication indicia comprises a new version of the first document.

19. The method of claim 1, wherein outputting the authentication indicia comprises outputting a new version of the first document having a footer comprising the authentication indicia.

20. The method of claim 1, wherein outputting the authentication indicia comprises outputting a new version of the first document having a machine-readable code comprising the authentication indicia.

21. The method of claim 1, wherein outputting the authentication indicia comprises outputting a new version of the first document that is visually comparable to the first document.

22. The method of claim 1, wherein outputting the authentication indicia comprises printing a document representing the authenticated first document.

23. The method of claim 1, wherein outputting the authentication indicia comprises printing a second document comprising a representation of at least a portion of the first document.

24. The method of claim 1, wherein at least one auxiliary document is associated with the first document, and wherein the first document comprises a visual representation of at least a portion of at least one auxiliary document.

25. The method of claim 24, wherein the visual representation of at least a portion of at least one auxiliary document comprises at least one thumbnail representing the auxiliary document.

26. The method of claim 1, wherein the first digital fingerprint comprises a first digital signature, and wherein the assertion of the authenticity of the representation comprises a second digital signature.

27. The method of claim 26, wherein the authentication indicia further comprises a representation of a public key for validating the second digital signature.

28. The method of claim 26, wherein verifying the first digital signature comprises:

applying a hash algorithm to the retrieved content to derive a first hash result;

applying a public key to the first digital signature to obtain a second hash result; and

comparing the first and second hash results; and

the method further comprising, prior to generating authentication indicia, generating the second digital signature by encrypting the first hash result.

29. The method of claim 26, wherein the method is performed by a document authenticating device, and wherein the authentication indicia further comprises at least one selected from the group consisting of:

the first digital signature;

a representation of a public key for validating the first digital signature;

the second digital signature; and

a representation of a public key for validating the second digital signature.

30. The method of claim 1, wherein the first digital fingerprint comprises a first digital signature, and wherein the method is performed by a document authenticating device, and wherein the authentication indicia further comprises at least one selected from the group consisting of:

the first digital signature; and

a representation of a public key for validating the first digital signature.

31. The method of claim 1, wherein the authentication indicia further comprises an indicator of a storage location for the first document.

32. The method of claim 1, wherein the first document is a printed document.

33. The method of claim 32, wherein the first document is printed on paper.

34. The method of claim 1, wherein the first document is in electronic form.

35. The method of claim 34, wherein the first document is in a portable document format.

36. A method for authenticating a document, the document comprising a visual representation of content, the method comprising:

determining a storage location corresponding to the document;

retrieving content stored at the indicated storage location;

rendering the retrieved content; and

outputting the rendered content for visual comparison with the visual representation of content on the document.

37. The method of claim 36, wherein determining a storage location comprises reading an indicator of storage location from the document.

38. The method of claim 36, further comprising verifying a digital fingerprint associated with the document.

39. The method of claim 38, wherein the digital fingerprint comprises a digital signature.

40. The method of claim 36, further comprising verifying a digital fingerprint printed on the document.

41. The method of claim 40, wherein the digital fingerprint comprises a digital signature.

42. The method of claim 36, wherein the document is a printed document, the method further comprising scanning the printed document.

43. The method of claim 36, wherein the document is in electronic form, the method further comprising receiving the document by electronic means.

44. The method of claim 36, further comprising, comparing, by a user, the rendered content with the visual representation of content on the document.

45. The method of claim 36, further comprising determining whether a third party has attested to the authenticity of the retrieved content.

46. The method of claim 45, wherein the retrieved content comprises a digital signature, and wherein determining whether a third party has attested to the authenticity of the retrieved content comprises validating the digital signature on the retrieved content.

47. The method of claim 45, wherein determining whether a third party has attested to the authenticity of the retrieved content comprises determining whether the retrieved content is in decrypted form.

48. A method for generating a verifiable document, comprising:

receiving input representing content;

storing the content at a storage location;

generating a first digital fingerprint by applying a hash function to the content; and

outputting a document comprising;

a representation of at least a portion of the content; and

a representation of the first digital fingerprint.

49. The method of claim 48, wherein the first digital fingerprint comprises a first digital signature, and wherein generating a first digital fingerprint comprises applying a private key to the result of the hash function.

50. The method of claim 48, wherein the document further comprises a representation of the storage location.

51. The method of claim 48, further comprising:

prior to storing the content, encrypting the content using a first public key;

and wherein storing the content comprises storing the encrypted content at the storage location.

52. The method of claim 51, wherein storing the content at a storage location further comprises:

receiving, at the storage location, the content;

decrypting the content; and

responsive to verification of authenticity of the content, storing the decrypted content at the storage location.

53. The method of claim 48, wherein storing the content at a storage location further comprises:

receiving, at the storage location, the content;

decrypting the content;

responsive to verification of authenticity of the content;

applying a second digital signature to the content; and

storing the decrypted content, with the applied second digital signature, at the storage location; and

responsive to no verification of authenticity of the content;

storing the decrypted content, without a second digital signature, at the storage location.

54. The method of claim 48, wherein the content is provided on a document template comprising a representation of the first public key and a representation of the storage location, and wherein:

identifying the first public key and the storage location comprises reading the first public key and the storage location from the document template; and

receiving input representing content comprises reading the content from the document template.

55. The method of claim 54, further comprising, prior to identifying the first public key and storage location, scanning the document template comprising the representation of the first public key, the representation of the storage location, and the content.

56. The method of claim 48, wherein receiving input representing content comprises scanning a document.

57. The method of claim 48, further comprising, prior to identifying the first public key and storage location, scanning an input document comprising a representation of the first public key, a representation of the storage location, and the content.

58. The method of claim 48, wherein receiving the input comprises receiving at least one auxiliary content item.

59. The method of claim 58, wherein the representation of at least a portion of the content comprises at least one thumbnail depicting at least one received auxiliary content item.

60. The method of claim 48, wherein identifying the first public key comprises receiving user input specifying the key.

61. The method of claim 48, wherein identifying the storage location comprises identifying a storage location associated with an author of the document.

62. The method of claim 48, wherein the method is performed by a device, and wherein identifying the storage location comprises identifying a storage location associated with the device.

63. The method of claim 48, wherein the method is performed by a device, and wherein identifying the storage location comprises identifying a storage location associated with a user of the device.

64. The method of claim 48, wherein the first digital fingerprint comprises a first digital signature, and wherein the output document further comprises a representation of a second public key that can be used for verifying the first digital signature.

65. The method of claim 48, wherein the private key is associated with an individual.

66. The method of claim 48, wherein the method is performed by a device, and wherein the private key is associated with the device.

67. A computer program product for authenticating a first document, the first document comprising a visual representation of content and a first digital fingerprint, the computer program product comprising:

a computer-readable medium; and

computer program code, encoded on the medium, for;

reading the first document to obtain the first digital fingerprint;

determining a storage location;

retrieving content stored at the determined storage location;

verifying the first digital fingerprint;

generating authentication indicia for the first document, the authentication indicia comprising a representation of at least a portion of the retrieved content and further comprising an assertion of the authenticity of the representation; and

outputting the authentication indicia.

68. The computer program product of claim 67, wherein the digital fingerprint comprises a hash result.

69. The computer program product of claim 67, wherein the computer program code for determining the storage location comprises computer program code for reading an indicator of storage location from the first document.

70. The computer program product of claim 67, wherein the first digital fingerprint comprises a first digital signature.

71. The computer program product of claim 70, wherein the computer program code for verifying the first digital signature comprises computer program code for:

applying a hash algorithm to at least a portion of the retrieved content to derive a first hash result;

applying a public key to the first digital signature to obtain a second hash result; and

comparing the first and second hash results.

72. The computer program product of claim 67, further comprising computer program code for, prior to generating authentication indicia for the first document:

rendering at least a portion of the retrieved content.

73. The computer program product of claim 72, wherein the retrieved content comprises at least one selected from the group consisting of:

a portable document format file;

a word processor file;

an image file;

a multimedia file;

a spreadsheet file;

a text file;

a hypertext file;

an HTML file; and

an XML file.

74. The computer program product of claim 67, wherein the computer program code for outputting the authentication indicia comprises computer program code for outputting a new version of the first document having a footer comprising the authentication indicia.

75. The computer program product of claim 67, wherein the computer program code for outputting the authentication indicia comprises computer program code for outputting a new version of the first document having a machine-readable code comprising the authentication indicia.

76. The computer program product of claim 67, wherein the computer program code for outputting the authentication indicia comprises computer program code for outputting a new version of the first document that is visually comparable to the first document.

77. The computer program product of claim 67, wherein the computer program code for outputting the authentication indicia comprises computer program code for printing a document representing the authenticated first document.

78. The computer program product of claim 67, wherein outputting the authentication indicia comprises computer program code for printing a second document comprising a representation of at least a portion of the first document.

79. The computer program product of claim 67, wherein at least one auxiliary document is associated with the first document, and wherein the first document comprises a visual representation of at least a portion of at least one auxiliary document.

80. The computer program product of claim 67, wherein the first digital fingerprint comprises a first digital signature, and wherein the assertion of the authenticity of the representation comprises a second digital signature.

81. The computer program product of claim 80, wherein the computer program code for verifying the first digital signature comprises computer program code for:

applying a hash algorithm to the retrieved content to derive a first hash result;

applying a public key to the first digital signature to obtain a second hash result; and

comparing the first and second hash results; and

the computer program product further comprising computer program code for, prior to generating authentication indicia, generating the second digital signature by encrypting the first hash result.

82. A computer program product for authenticating a document, the document comprising a visual representation of content, the computer program product comprising:

a computer-readable medium; and

computer program code, encoded on the medium, for;

determining a storage location corresponding to the document;

retrieving content stored at the indicated storage location;

rendering the retrieved content; and

outputting the rendered content for visual comparison with the visual representation of content on the document.

83. The computer program product of claim 82, further comprising computer program code for verifying a digital fingerprint associated with the document.

84. The computer program product of claim 83, wherein the digital fingerprint comprises a digital signature.

85. A computer program product for generating a verifiable document, comprising:

a computer-readable medium; and

computer program code, encoded on the medium, for;

receiving input representing content;

storing the content at a storage location;

generating a first digital fingerprint by applying a hash function to the content; and

outputting a document comprising;

a representation of at least a portion of the content; and

a representation of the first digital fingerprint.

86. The computer program product of claim 85, wherein the first digital fingerprint comprises a first digital signature, and wherein the computer program code for generating a first digital fingerprint comprises computer program code for applying a private key to the result of the hash function.

87. The computer program product of claim 85, further comprising computer program code for:

prior to storing the content, encrypting the content using a first public key;

and wherein the computer program code for storing the content comprises computer program code for storing the encrypted content at the storage location.

88. The computer program product of claim 87, wherein the computer program code for storing the content at a storage location further comprises computer program code for:

receiving, at the storage location, the content;

decrypting the content; and

responsive to verification of authenticity of the content, storing the decrypted content at the storage location.

89. The computer program product of claim 85, wherein the computer program code for storing the content at a storage location further comprises computer program code for:

receiving, at the storage location, the content;

decrypting the content;

responsive to verification of authenticity of the content;

applying a second digital signature to the content; and

storing the decrypted content, with the applied second digital signature, at the storage location; and

responsive to no verification of authenticity of the content;

storing the decrypted content, without a second digital signature, at the storage location.

90. A system for authenticating a first document, the first document comprising a visual representation of content and a first digital fingerprint, the system comprising:

a scanner, for reading the first document to obtain the first digital fingerprint;

a storage device for storing content corresponding to the first document;

a digital fingerprint authenticator, coupled to the scanner, for verifying the first digital fingerprint;

a processor, coupled to the digital signature authenticator and communicatively coupled to the storage device, for retrieving content from the storage device, and for generating authentication indicia for the first document, the authentication indicia comprising a representation of at least a portion of the retrieved content and further comprising an assertion of the authenticity of the representation; and

an output device, coupled to the processor, for outputting the authentication indicia.

91. The system of claim 90, wherein the digital fingerprint comprises a hash result.

92. The system of claim 90, wherein the scanner reads an indicator of document storage location from the first document, wherein the indicator identifies a location within the storage device.

93. The system of claim 90, wherein the first digital fingerprint comprises a first digital signature.

94. The system of claim 93, wherein the digital signature authenticator verifies the first digital signature by:

applying a hash algorithm to at least a portion of the retrieved content to derive a first hash result;

applying a public key to the first digital signature to obtain a second hash result; and

comparing the first and second hash results.

95. The system of claim 90, further comprising a renderer for rendering at least a portion of the retrieved content.

96. The system of claim 95, wherein the retrieved content comprises at least one selected from the group consisting of:

a portable document format file;

a word processor file;

an image file;

a multimedia file;

a spreadsheet file;

a text file;

a hypertext file;

an HTML file; and

an XML file.

97. The system of claim 90, wherein the output device outputs a new version of the first document having a footer comprising the authentication indicia.

98. The system of claim 90, wherein the output device outputs a new version of the first document having a machine-readable code comprising the authentication indicia.

99. The system of claim 90, wherein the output device outputs a new version of the first document that is visually comparable to the first document.

100. The system of claim 90, wherein the output device comprises a printer, for printing a document representing the authenticated first document.

101. The system of claim 90, wherein the output device comprises a printer, for printing a second document comprising a representation of at least a portion of the first document.

102. The system of claim 90, wherein at least one auxiliary document is associated with the first document, and wherein the first document comprises a visual representation of at least a portion of at least one auxiliary document.

103. The system of claim 90, wherein the first digital fingerprint comprises a first digital signature, and wherein the assertion of the authenticity of the representation comprises a second digital signature.

104. The system of claim 103, wherein the digital signature authenticator verifies the first digital signature by:

applying a hash algorithm to the retrieved content to derive a first hash result;

applying a public key to the first digital signature to obtain a second hash result; and

comparing the first and second hash results; and

wherein the processor, prior to generating authentication indicia, generates the second digital signature by encrypting the first hash result.

105. A system for authenticating a document, the document comprising a visual representation of content, the system comprising:

a scanner, for reading the document to be authenticated;

a storage device for storing content corresponding to the document;

a renderer, communicatively coupled to the storage device, for retrieving content from the storage device and for rendering the retrieved content; and

an output device, coupled to the renderer, for outputting the rendered content for visual comparison with the visual representation of content on the document.

106. The system of claim 105, further comprising a digital fingerprint authenticator, coupled to the scanner, for verifying a digital fingerprint associated with the document.

107. The system of claim 106, wherein the digital fingerprint comprises a digital signature.

108. A system for generating a verifiable document, comprising:

a content input device, for receiving input representing content;

a storage device, communicatively coupled to the content input device, for storing the content at a storage location;

a digital fingerprint generator, coupled to the content input device, for generating a first digital fingerprint by applying a hash function to the content; and

an output device, coupled to the content input device and to the digital signature generator, for outputting a document comprising;

a representation of at least a portion of the content; and

a representation of the first digital fingerprint.

109. The system of claim 108, wherein the first digital fingerprint comprises a first digital signature, and wherein the digital fingerprint generator generates a first digital fingerprint by applying a private key to the result of the hash function.

110. The system of claim 108, further comprising an encryptor for, prior to the storage device storing the content, encrypting the content using a first public key:

and wherein the storage device stores the encrypted content at the storage location.

111. The system of claim 110, wherein the storage device receives and decrypts the content, and, responsive to verification of authenticity of the content, stores the decrypted content at the storage location.

112. The system of claim 108, further comprising:

a digital signature generator;

wherein the storage device receives and decrypts the content, and;

responsive to verification of authenticity of the content;

the digital signature generator applies a second digital signature to the content; and

the storage device stores the decrypted content, with the applied second digital signature, at the storage location; and

responsive to no verification of authenticity of the content;

the storage device stores the decrypted content, without a second digital signature, at the storage location.