Method and system for signing and authenticating electronic documents

• US 7,237,114 B1
• Filed: 04/26/2000
• Issued: 06/26/2007
• Est. Priority Date: 04/26/2000
• Status: Expired due to Term

• Current Assignee: Signix, Inc. (Fidelity National Information Services Incorporated)
• Original Assignee: ProNvest, Inc. (Old) (Fidelity National Information Services Incorporated)
• Inventors: Rosenberg, Greg
• Primary Examiner(s): ZIA, SYED
• Application Number:
  US09/559,414
• Time in Patent Office: 2,617 Days
• Field of Search: 713/155, 380/279
• US Class Current: 713/176
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/3674 involving authentication

Abstract

A system and method for signing, sorting, and authenticating electronic documents using public key cryptography. The system comprises a document service computer cluster connected to user computers, document owner server computers, and registration computers via a network such as for example, the internet or the world wide web. Document owners and system users can store electronic documents in an encrypted database located on the document service computer cluster, or on a document safe connected to the document owner server. Users can sign documents by identifying the document to be signed and sending a signing request to the document service computer cluster. The document service computer cluster retrieves the user'"'"'s private key, which is located securely in a database on the cluster, and signs the identified document. No dedicated signing software need be installed on the user computer prior to accessing the document service computer cluster.

Claims

1. In a computer environment that includes a document service cluster having a private key database, the document service cluster having secure access to a database of signature ready documents, the computer environment further including a plurality of remote computers coupled to the document service cluster over a computer network, a method for issuing requests from the remote computers to the document service cluster for signing electronic documents, and signing electronic documents using the document service cluster, the method comprising:

registering each of a plurality of users using a registration process associated with the document service cluster, wherein the registration process includes;

providing, by each user, identifying information corresponding to an identity of the user;

performing a database check of the identifying information provided by each user by comparing the identifying information provided by each user against database records; and

providing a user with service credentials for accessing the document service cluster if an outcome of the database check for the user is successful, whereby the user becomes a registered user;

securely storing a plurality of private key portions associated with the plurality of registered users in the private key database on the document service cluster;

receiving at the document service cluster a signing request and service credentials transmitted from a remote computer by a first registered user, said signing request generated in the absence of a pre-installed add-in software program configured to providing a signed message at the remote computer;

wherein the service credentials received from the first registered user are independent of the remote computer used to transmit the signing request to the document service cluster;

using the service credentials received at the document service cluster to identify the signing request as one transmitted by the first registered user, and identifying, at the document service cluster, a signature ready document, from the database of a signature ready documents, to be signed at the document service cluster in accordance with a private key portion that is associated with the first registered user and stored in the private key database;

retrieving, from the private key database at the document service cluster, the private key portion associated with the first registered user;

generating, at the document service cluster, a complete private key using the retrieved private key portion if the retrieved private key portion is not a complete private key;

retrieving at the document service cluster the signature ready document to be signed; and

signing the signature ready document at the document service cluster using the complete private key to produce a signed document;

wherein the private key portion remains on the document service cluster during the signing of the signature ready document, and no storage of the private key portion occurs on the remote computer after the signing of the signature ready document.

2. The method of claim 1 wherein the private key portion is a complete private key.

3. The method of claim 1 wherein generating a complete private key using the retrieved private key portion includes:

receiving the service credentials sent from the first user at the remote computer to the document service cluster after receiving the signing request; and

constructing a complete private key using the private key portion and the received service credentials.

4. The method of claim 1 wherein the received signing request was transmitted from the first remote computer to the document service cluster over the internet.

5. The method of claim 1 wherein the received signing request was transmitted from the first remote computer to the document service cluster over the world wide web using hypertext transport protocol, and wherein the signing request was transmitted using a browser running on the remote computer.

6. The method of claim 5 wherein the retrieving at the document service cluster the signature ready document is automatic.

7. The method of claim 5 wherein the retrieved signature ready document is a standard generalized markup language document.

8. The method of claim 1 further comprising storing the signature ready document in the database of signature ready documents.

9. The method of claim 8 further comprising prior to signing:

receiving data from the first remote computer; and

modifying the retrieved signature ready document based on the received form date.

10. The method of claim 8 wherein the database of signature ready documents is located on the document service cluster.

11. The method of claim 8 wherein the database of signature ready documents is located on a secure second remote computer.

12. The method of claim 8 further comprising storing the signed document in a second document database.

13. The method of claim 12 wherein the second database is located on a secure second computer remote computer.

14. The method of claim 12 wherein the second database is located on the document service cluster.

15. The method of claim 12 further comprising associating at least one of the signature ready documents and the signed document with a document owner.

16. The method of claim 15 further comprising notifying at least one of document owner and the first user that a signature ready document or a signed document has been signed.

17. The method of claim 1 wherein said registering includes:

verifying and recoding the identify of individuals registering;

digitizing and recording handwritten signatures of individuals registering;

associating passwords with the recorded digitized handwritten signatures and the recorded identities; and

storing the recorded digitized handwritten signatures, and the recorded identities in an identity database, the identity database being accessible to the document service cluster.

18. The method of claim 17 further comprising:

recording at least one biometric measurement other than a handwritten signature of individuals registering;

associating the at least one biometric measurement of individuals registering with the recorded identities of the individuals registering; and

storing the biometric measurements in the identity database.

19. The method of claim 18 further comprising detecting using the biometric measurements whether individuals previously registered.

20. The method of claim 17 wherein the signing comprises:

a) appending the first user'"'"'s digitized handwritten signature to the signature ready document;

b) making a hash of the signature ready document; and

c) encrypting the hash of the signature ready document with the first user'"'"'s private key.

21. The method of claim 17 further comprising:

associating and storing a secret set of recognition graphics with the passwords in the identity database;

displaying a plurality of recognition graphics, including recognition graphics from the secret set, on the first remote computer;

requesting the first user to select graphics including in the secret set using a non-keyboard selecting device attached to the first remote computer;

receiving a message from the first remote computer identifying the selected graphics;

authorizing access to the document service cluster if the selected graphics are included in the secret set.

22. The method of claim 17 further comprising:

generating the private key portions for individuals registering, wherein the private key portions can be used with the service credentials to construct complete private keys;

associating the generated private key portions with the recorded identities of individuals registering; and

storing private key portions in a private key database.