DOCUMENT VERIFICATION WITH ID AUGMENTATION

• US 20150039893A1
• Filed: 08/05/2013
• Published: 02/05/2015
• Est. Priority Date: 08/05/2013
• Status: Active Grant

• Current Assignee: Guardtime SA
• Original Assignee: Guardtime IP Holdings Limited
• Inventors: BULDAS, AHTO, TRUU, AHTO, KROONMAA, ANDRES
• Granted Patent: US 9,473,306 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

At least one node in a distributed hash tree document verification infrastructure is augmented with an identifier of an entity in a registration path. A data signature, which includes parameters for recomputation of a verifying value, and which is associated with a digital input record, will therefore also include data that identifies at least one entity in the hash tree path used for its initial registration in the infrastructure.

Claims

1. A method for authenticating digital records, comprising:

receiving a current highest-level combined output value that is formed as digital combinations of successively lower-level combined output values computed in subordinate entities as node values of a tree data structure having lowest level inputs formed as digital transformations of digital input records input by user-level entites;

computing a current calendar value as a digital combination of the current highest-level combined output values;

returning the current calendar value to at least one subordinate entity, whereupon recomputation parameters are distributed downward to the user-level entities for association with respective ones of the digital input records such that an arbitrary subsequent test digital record is considered authenticated relative to the corresponding digital input record if, applying the corresponding digital transformation to the test digital record and, using the recomputation parameters to recomputed the node values upward through the tree data structure, the same current calendar value is attained as when it was originally computed with the corresponding digital input record forming the lowest level input; and

computing an augmented node value in at least one of the subordinate entities as a digital combination of a corresponding one of the lower-level combined output values and an entity identifier, whereby the recomputation parameters distributed to entities subordinate to the entity associated with the identifier encode the identity of the identified entity in a recomputation path.

2. A method as in claim 1, in which the digital combinations are hash functions.

3. A method as in claim 1, in which the identifier is time-dependent.

4. A method as in claim 1, in which the augmented node is computed in the entity that the identifier is associated with.

5. A method as in claim 1, in which the identifier is provided from a hardware security key device.

6. A method as in claim 1, in which the identifier is provided by user input.

7. A method as in claim 1, in which the identifier for a subordinate entity is assigned to it by an immediately superior entity, in which the augmented node is computed in the superior entity using the identifier assigned to the subordinate entity.

8. A system for enabling authentication of digital records, comprising:

a core system including modules;

for receiving a current highest-level combined output value that is formed as digital combinations of successively lower-level combined output values computed in subordinate entities as node values of a tree data structure having lowest level inputs formed as digital transformations of digital input records input by user-level entites;

for computing a current calendar value as a digital combination of the current highest-level combined output values; and

for returning the current calendar value to at least one subordinate entity, whereupon recomputation parameters are distributed downward to the user-level entities for association with respective ones of the digital input records such that an arbitrary subsequent test digital record is considered authenticated relative to the corresponding digital input record if, applying the corresponding digital transformation to the test digital record and, using the recomputation parameters to recomputed the node values upward through the tree data structure, the same current calendar value is attained as when it was originally computed with the corresponding digital input record forming the lowest level input;

in which;

the current highest-level combined output encodes at least one augmented node value computed in at least one of the subordinate entities as a digital combination of a corresponding one of the lower-level combined output values and an entity identifier, whereby the recomputation parameters distributed to entities subordinate to the entity associated with the identifier encode the identity of the identified entity in a recomputation path.

9. A system as in claim 8, in which the digital combinations are hash functions.

10. A system as in claim 8, in which the identifier is provided from a hardware security key device.

11. A system as in claim 8, in which the identifier is provided by user input.

12. A system as in claim 8, in which the augmented node is computed in the entity that the identifier is associated with.

13. A system as in claim 8, in which the identifier for a subordinate entity is assigned to it by an immediately superior entity, in which the augmented node is computed in the superior entity using the identifier assigned to the subordinate entity.

14. A computer readable storage medium having data stored therein representing software executable by a computer, the software including instructions to enabling authentication of digital records, the storage medium comprising:

instructions for receiving a current highest-level combined output value that is formed as digital combinations of successively lower-level combined output values computed in subordinate entities as node values of a tree data structure having lowest level inputs formed as digital transformations of digital input records input by user-level entites;

instructions for computing a current calendar value as a digital combination of the current highest-level combined output values; and

instructions for returning the current calendar value to at least one subordinate entity, whereupon recomputation parameters are distributed downward to the user-level entities for association with respective ones of the digital input records such that an arbitrary subsequent test digital record is considered authenticated relative to the corresponding digital input record if, applying the corresponding digital transformation to the test digital record and, using the recomputation parameters to recomputed the node values upward through the tree data structure, the same current calendar value is attained as when it was originally computed with the corresponding digital input record forming the lowest level input;

in which;

the current highest-level combined output encodes at least one augmented node value computed in at least one of the subordinate entities as a digital combination of a corresponding one of the lower-level combined output values and an entity identifier, whereby the recomputation parameters distributed to entities subordinate to the entity associated with the identifier encode the identity of the identified entity in a recomputation path.

15. A storage medium as in claim 14, further comprising computer-executable instructions for computing the digital combinations as hash functions.

16. A storage medium as in claim 14, further comprising computer-executable instructions for including a function of time in the identifier.

17. A storage medium as in claim 14, further comprising computer-executable instructions for computing the augmented node in the entity that the identifier is associated with.

18. A storage medium as in claim 14, further comprising computer-executable instructions for inputting the identifier from a hardware security key device.

19. A storage medium as in claim 14, further comprising computer-executable instructions for inputting the identifier via user input.

20. A storage medium as in claim 14, further comprising computer-executable instructions for assigning the identifier for a subordinate entity from an immediately superior entity and for computing the augmented node in the superior entity using the identifier assigned to the subordinate entity.