DATA CERTIFICATION METHOD AND SYSTEM

• US 20120311321A1
• Filed: 11/16/2011
• Published: 12/06/2012
• Est. Priority Date: 08/10/2001
• Status: Active Grant

• Current Assignee: Cryptomathic Ltd (Cryptomathic A/S)
• Original Assignee: Cryptomathic A/S
• Inventors: Landrock, Peter, Tuliani, Jonathan Roshan
• Granted Patent: US 8,549,308 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A data certification system and method for signing electronic data with a digital signature in which a central server comprises a signature server and an authentication server. The signature server securely stores the private cryptographic keys of a number of users. The user contacts the central server using a workstation through the secure tunnel which is set up for the purpose. The user supplies a password or other token based on information previously supplied to the user by the authentication server through a separate authentication channel. The authentication server provides the signature server with a derived version of the same information through a permanent secure tunnel between the servers, which is compared with the one supplied by the user. If they match, data received from the user is signed with the user'"'"'s private key.

Claims

1. A method of certifying electronic data supplied by a user, the method comprising:

receiving the data to be certified at a certifying apparatus from a source device;

sending a request for user authentication to an authentication server via a secure tunnel from tamper resistant hardware of said certifying apparatus to tamper resistant hardware of said authentication server, wherein said secure tunnel comprises an encrypted and authenticated communication link;

sending a user identification data request in the form of a challenge from the authentication server to said user;

receiving a response to the user identification data request from said user at said certifying apparatus, said response being a one-time password which is an encryption of said challenge with an individual key held on a secure token, wherein said secure token shares said individual key with said authentication server and wherein said secure token is possessed by said user;

is receiving a derived version of said one-time password from said authentication server via the secure tunnel at said certifying apparatus to validate said user;

validating the user by comparing the one-time password which is the response to the user identification data request with the derived version of said one-time password;

certifying the electronic data supplied by the user at the certifying apparatus with one or more elements of information secure to the certifying apparatus, said elements being unique to the user; and

outputting the data so certified from the certifying apparatus, for passing to a recipient device;

wherein the elements of secure information certify that the supplier of the data is the user.

2. A method according to claim 1, wherein the request for user authentication and derived version of the response to the user identification data request are transferred via a different communication channel than the user identification data request.

3. A computer readable medium storing a computer program comprising instructions which when executed by one or more computers cause the one or more computers to perform each of the method steps of claim 1.

4. A system for use in data certification, comprising:

data certifying apparatus, the data certifying apparatus comprising a signing device adapted to certify electronic data received from a remote source device as originating from a user, wherein the certifying apparatus is arranged to receive data from the source device, certify the data as belonging to the user, using information stored in the certifying apparatus and cryptographic techniques, said information being unique to the user, and send the certified data to a recipient device; and

an authentication server, said authentication service and said data certifying apparatus each having tamper resistant hardware, said tamper-resistant hardware of said authentication server and said tamper resistant hardware of said data certifying apparatus being connected by a secure tunnel, wherein said secure tunnel comprises an encrypted and authenticated communications link; and

a secure token which shares an individual key with the authentication server and which is possessed by said user wherein

said data certifying apparatus is configured to send a request for user authentication to said authentication server via said secure tunnel;

said authentication server is configured to receive said request from said data certifying apparatus via said secure tunnel and to supply said user with a user identification data request in the form of a challenge;

said data certifying apparatus is configured to receive a response which is a one-time password which is an encryption of said challenge with the key held on the token from said user and

said authentication server is configured to supply a derived version of said one-time password to the data certifying apparatus via said secure tunnel to validate said user by comparing the one-time password which is the response to the user identification data request with the derived version of said one-time password.