Temporary digital signature method and system

• US 6,393,563 B1
• Filed: 11/10/1998
• Issued: 05/21/2002
• Est. Priority Date: 11/11/1997
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Maruyama, Hiroshi, Uramoto, Naohiko
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/189,203
• Time in Patent Office: 1,288 Days
• Field of Search: 380/255, 713/155, 713/156, 713/158, 713/168, 713/169, 713/171, 713/175, 713/176
• US Class Current: 713/155
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A digital signature system that employs a temporary digital ID signed by using a private key, so that the digital ID can be used as a proxy for a specific period of time and for a specific purpose. When a signature is requested by a server application, a user does not use his or her private key, but employs a temporary key generated using the private key. A temporary certificate for the temporary key is signed using the user'"'"'s private key. The temporary certificate includes information concerning the period of time during which the temporary certificate is valid and information concerning the purpose for which used. Upon receipt of a request from an application that a document be signed, a client transmits to the server a document signed using the temporary key, the temporary certificate and a user'"'"'s certificate. First, the server examines the signature; second, it determines whether the temporary certificate is still effective, i.e., whether the period of time during which valid has expired and whether the certificate is for another application; and third, confirms that the temporary certificate has been signed by an authenticated user. Finally, the server validates of the user'"'"'s certificate.

Claims

1. A digital signature system, employing public key cryptography, that provides a temporary signature without requiring the use of a private key for a user, comprising:

(a) a temporary signature key producer for producing a temporary signature key by using a private key;

(b) a temporary certificate producer for producing a temporary certificate for said temporary signature key signed by using said private key; and

(c) means for, when a signature for a document is requested, transmitting to a signature requester said temporary certificate, a document signed using said temporary signature key, and a user'"'"'s certificate.

2. The digital signature system according to claim 1, wherein said temporary certificate includes information concerning a valid period for said temporary certificate.

3. The digital signature system according to claim 1, wherein said temporary certificate includes information concerning the purpose for which used.

4. The digital signature system according to claim 1, wherein said temporary signature key producer (a) further includes (a1) means for producing a tentative temporary key using said temporary signature key;

wherein said temporary certificate producer (b) includes (b1) means for producing a temporary certificate for said tentative temporary key signed by using said private key;

wherein processing by said means (a1) and (b1) is repeated more than once, so that temporary signature key and temporary certificate production processing is performed as a plurality of separate stages.

5. The digital signature system according to claim 1, wherein said private key is stored in a smart card.

6. A digital authentication system, employing public key-cryptography, that authenticates a temporary signed document dispatched by a user, comprising:

(a) means for receiving a temporary certificate, a document signed by using a temporary signature key, and a user'"'"'s certificate;

(b) means for validating a signature on said document;

(c) means for validating said temporary certificate;

(d) means for confirming that said temporary certificate has been signed by an authenticated user; and

(e) means for validating said user'"'"'s certificate.

7. The digital authentication system according to claim 6, wherein said means (c) includes means for determining whether a time period during which said temporary certificate is valid had not yet expired.

8. The digital authentication system according to claim 6, wherein said means (c) includes means for determining whether said temporary certificate corresponds to the purpose for which used.

9. A digital signature authentication client/server system, employing public key cryptography, that performs a temporary document signing without directly using a private key, and for authenticating a signature, said system comprising:

(a) a temporary signature key producer at a client for producing a temporary signature key by using a private key;

(b) a temporary certificate producer for producing a temporary certificate, for said temporary signature key, signed using said private key;

(c) means for, when signing of a document is requested by a server, transmitting from said client to said server said temporary certificate, a document signed using said temporary signature key, and a user'"'"'s certificate;

(d) means at said server for receiving said temporary certificate, said document signed using said temporary signature key, and said user'"'"'s certificate;

(e) means at said server for validating said signature on said document;

(f) means at said server for validating said temporary certificate;

(g) means at said server for confirming that said temporary certificate has been signed by an authenticated user; and

(h) means at said server for validating said user'"'"'s certificate.

10. The digital signature authentication client/server system according to claim 9, wherein said temporary certificate includes information concerning a time period during which said temporary certificate is valid, and wherein said means (f) includes means for determining whether a time period during which said temporary certificate is invalid has not yet expired.

11. The digital signature authentication client/server system according to claim 9, wherein said temporary certificate includes information concerning the purpose for which used, and wherein said means (f) includes means for determining whether said temporary certificate corresponds to the purpose for which used.

12. The digital signature authentication client/server system according to claim 9, wherein said temporary signature key producer (a) further includes (a1) means for producing a tentative temporary key using said temporary signature key;

wherein said temporary certificate producer (b) includes (b1) means for producing a temporary certificate for said tentative temporary key signed by using said private key;

wherein processing by said means (a1) and (b1) is repeated more than once, so that temporary signature key and temporary certificate production processing is performed as a plurality of separate stages.

13. The digital signature authentication client/server system according to claim 9, wherein said private key is stored in a smart card.

14. A digital signature method, employing public key cryptography, whereby a temporary signature is provided without requiring the use of a private key for a user, comprising:

(a) a temporary signature key production step of producing a temporary signature key by using a private key;

(b) a temporary certificate production step of producing a temporary certificate for said temporary signature key signed by using said private key; and

(c) a step of, when a signature for a document is requested, transmitting to a signature requester said temporary certificate, a document signed using said temporary signature key, and a user'"'"'s certificate.

15. The digital signature method according to claim 14, wherein said temporary certificate includes information concerning a valid period for said temporary certificate.

16. The digital signature method according to claim 14, wherein said temporary certificate includes information concerning the purpose for which used.

17. The digital signature method according to claim 14, wherein said temporary signature key production step (a) further includes (a1) a step of producing a tentative temporary key using said temporary signature key;

wherein said temporary certificate production step (b) includes (b1) a step of producing a temporary certificate for said tentative temporary key signed by using said private key;

wherein processing at said steps (a1) and (b1) is repeated more than once, so that temporary signature key and temporary certificate production processing is performed as a plurality of separate stages.

18. The digital signature method according to claim 14, wherein said private key is stored in a smart card.

19. A digital authentication method, employing public key cryptography, whereby a temporary signed document dispatched by a user is authenticated, comprising the steps of:

(a) receiving a temporary certificate, a document signed by using a temporary signature key, and a user'"'"'s certificate;

(b) validating a signature on said document;

(c) validating said temporary certificate;

(d) confirming that said temporary certificate has been signed by an authenticated user; and

(e) validating said user'"'"'s certificate.

20. The digital authentication method according to claim 19, wherein said step (c) includes a step of determining whether a time period during which said temporary certificate is valid had not yet expired.

21. The digital authentication method according to claim 19, wherein said step (c) includes a step of determining whether said temporary certificate corresponds to the purpose for which used.

22. A digital signature authentication method, employing public key cryptography, whereby a temporary document signing is performed without directly using a private key for a user, and whereby a signature is authenticated, said method comprising:

(a) a temporary signature key production step by a client for producing a temporary signature key by using a private key;

(b) a temporary certificate production step of producing a temporary certificate, for said temporary signature key, signed using said private key;

(c) a step of, when signing of a document is requested by a server, transmitting from said client to said server said temporary certificate, a document signed using said temporary signature key, and a user'"'"'s certificate;

(d) a step by said server of receiving said temporary certificate, said document signed using said temporary signature key, and said user'"'"'s certificate;

(e) a step by said server of validating said signature on said document;

(f) a step by said server of validating said temporary certificate;

(g) a step by said server of confirming that said temporary certificate has been signed by an authenticated user; and

(h) a step by said server of validating said user'"'"'s certificate.

23. The digital signature authentication method according to claim 22, wherein said temporary certificate includes information concerning a time period during which said temporary certificate is valid, and wherein said step (f) includes a step of determining whether a time period during which said temporary certificate is invalid has not yet expired.

24. The digital signature authentication method according to claim 22, wherein said temporary certificate includes information concerning the purpose for which used, and wherein said step (f) includes a step of determining whether said temporary certificate corresponds to the purpose for which used.

25. The digital signature authentication method according to claim 22, wherein said temporary signature key production step (a) further includes (a1) a step of producing a tentative temporary key using said temporary signature key;

wherein said temporary certificate production step (b) includes (b1) a step of producing a temporary certificate for said tentative temporary key signed by using said private key;

wherein processing at said steps (a1) and (b1) is repeated more than once, so that temporary signature key and temporary certificate production processing is performed as a plurality of separate stages.

26. The digital signature authentication method according to claim 22, wherein said private key is stored in a smart card.

27. A storage medium for storing a digital signature program, employing public key cryptography, that provides a temporary signature without requiring the use of a private key, said program comprising:

(a) a temporary signature key production function for producing a temporary signature key by using a private key;

(b) a temporary certificate production function for producing a temporary certificate for said temporary signature key signed by using said private key; and

(c) a function for, when a signature for a document is requested, transmitting to a signature requester said temporary certificate, a document signed using said temporary signature key, and a user'"'"'s certificate.

28. A storage medium for storing a digital authentication program, employing public key cryptography, that authenticates a temporary signed document dispatched by a user, said program comprising:

(a) a function for receiving a temporary certificate, a document signed by using a temporary signature key, and a user'"'"'s certificate;

(b) a function for validating a signature on said document;

(c) a function for validating said temporary certificate;

(d) a function for confirming that said temporary certificate has been signed by an authenticated user; and

(e) a function for validating said user'"'"'s certificate.

29. The storage medium according to claim 28, wherein said function (c) includes a function for determining whether a time period during which said temporary certificate is valid had not yet expired, or whether said temporary certificate corresponds to the purpose for which used.

30. A storage medium for storing a digital signature authentication program, employing public key cryptography, that performs a temporary document signing without directly using a private key, and for authenticating a signature, said program comprising:

(a) a temporary signature key production function at a client for producing a temporary signature key by using a private key;

(b) a temporary certificate production function for producing a temporary certificate, for said temporary signature key, signed using said private key;

(c) a function for, when signing of a document is requested by a server, transmitting from said client to said server said temporary certificate, a document signed using said temporary signature key, and a user'"'"'s certificate;

(d) a function at said server for receiving said temporary certificate, said document signed using said temporary signature key, and said user'"'"'s certificate;

(e) a function at said server for validating said signature on said document;

(f) a function at said server for validating said temporary certificate;

(g) a function at said server for confirming that said temporary certificate has been signed by an authenticated user; and

(h) a function at said server for validating said user'"'"'s certificate.