Verification of signed digital documents

• US 9,374,227 B2
• Filed: 11/10/2014
• Issued: 06/21/2016
• Est. Priority Date: 03/05/2001
• Status: Active Grant

• Current Assignee: Kioba Processing, LLC (IP Investments Group LLC)
• Original Assignee: Callahan Cellular LLC (Intellectual Ventures LLC)
• Inventors: Suominen, Edwin A.
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/537,629
• Publication Number:
  US 20150074416A1
• Time in Patent Office: 589 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Methods, apparatus, and systems are disclosed for, among other things, secure passphrase handling for computing devices. In one respect, a method is provided. The method includes receiving a plurality of passphrase elements from an input device. The method also includes performing a sequence of secure delay processing operations, each operation generating a delayed output value from an initial value. The passphrase is verified upon completion of the sequence of secure delay processing operations. Further, initial values of respective secure delay processing operations are based on respective passphrase elements and, for each secure delay processing operation after a first secure delay processing operation, a delayed output value from at least one other secure delay processing operations.

Claims

1. A method of verifying signed digital documents, the method comprising:

receiving a signed digital document, said signed digital document including an embedded digital signature, the embedded digital signature comprising a distinctive graphical outline and a plurality of line segments that lie along opposite sides of the embedded digital signature thereby allowing the embedded digital signature to be graphically distinguished from contents of the signed digital document, the embedded digital signature overlapping at least some contents of the signed digital document;

generating an intermediate document, said intermediate document excluding the embedded digital signature;

generating a validation output based on user authentication information identifying a signer of the signed digital document and the intermediate document, the validation output comprising a computed value representing the signed digital document before embedding of the embedded digital signature; and

verifying whether the signed digital document was signed by the signer based on a comparison of the validation output to the embedded digital signature.

2. The method of claim 1, wherein the embedded digital signature is of a predetermined size.

3. The method of claim 2, wherein generating the intermediate document comprises:

selecting a region of the signed digital document based on the predetermined size and the distinctive graphical outline of the embedded digital signature; and

removing all graphical information from the selected region in the intermediate document.

4. The method of claim 1, wherein the embedded digital signature is included in a predetermined signature field of the signed digital document.

5. The method of claim 3, wherein generating the intermediate document comprises setting the predetermined signature field contents to a known value.

6. The method of claim 1, wherein the user authentication information comprises a public encryption key.

7. The method of claim 1, wherein the signed digital document comprises a media stream.

8. The method of claim 7, wherein the embedded digital signature is included in an out-of-band frequency of the media stream.

9. The method of claim 7, wherein the media stream comprises a plurality of frames, and

wherein generating the intermediate document comprises generating a plurality of intermediate frames excluding the embedded digital signatures included in any frame of the plurality of frames, and

wherein generating the validation output based on user authentication information identifying the signer of the signed digital document signer and the intermediate document comprises generating a plurality of validation outputs for corresponding intermediate frames, and

wherein verifying the signed digital document based on the comparison of the validation output to the embedded digital signature comprises comparing each of the plurality of validation outputs to the embedded digital signature of the corresponding frame.

10. A computing device for verifying signed digital documents, the computing device comprising:

a data storage configured to store a signed digital document, said signed digital document including an embedded digital signature, the embedded digital signature comprising a distinctive graphical outline and a plurality of line segments that lie along opposite sides of the embedded digital signature thereby allowing the embedded digital signature to be graphically distinguished from contents of the signed digital document, the embedded digital signature overlapping at least some contents of the signed digital document;

a signature extractor configured to generate an intermediate document, said intermediate document excluding the embedded digital signature; and

a validation output generator configured to;

generate a validation output based on user authentication information identifying a signer of the signed digital document and the intermediate document, the validation output comprising a computed value representing the signed digital document before embedding of the embedded digital signature; and

verify whether the signed digital document was signed by the signer based on a comparison of the validation output to the embedded digital signature.

11. The computing device of claim 10, wherein the embedded digital signature is of a predetermined size.

12. The computing device of claim 11, wherein the validation output generator is configured to generate the intermediate document by:

selecting a region of the signed digital document based on the predetermined size and the distinctive graphical outline of the embedded digital signature; and

removing all graphical information from the selected region in the intermediate document.

13. The computing device of claim 10, wherein the embedded digital signature is included in a predetermined signature field of the signed digital document.

14. The computing device of claim 13, wherein generating the intermediate document comprises setting the predetermined signature field contents to a known value.

15. The computing device of claim 10, wherein the user authentication information comprises a public encryption key.

16. The computing device of claim 10, wherein the signed digital document comprises a media stream.

17. The computing device of claim 16, wherein the embedded digital signature is included in an out-of-band frequency of the media stream.

18. The computing device of claim 16, wherein the media stream comprises a plurality of frames, and

wherein generating the intermediate document comprises generating a plurality of intermediate frames excluding the embedded digital signatures included in any frame of the plurality of frames, and

wherein generating the validation output based on user authentication information identifying the signer of the signed digital document signer and the intermediate document comprises generating a plurality of validation outputs for corresponding intermediate frames, and

wherein verifying the signed digital document based on comparison of the validation output to the embedded digital signature comprises comparing each of the plurality of validation outputs to the embedded digital signature of the corresponding frame.

19. A non-transitory computer-readable storage medium including instructions executable by a processor of a device for verifying signed digital documents, the instructions causing the device to:

receive a signed digital document, said signed digital document including an embedded digital signature, the embedded digital signature comprising a distinctive graphical outline and a plurality of line segments that lie along opposite sides of the embedded digital signature thereby allowing the embedded digital signature to be graphically distinguished from contents of the signed digital document, the embedded digital signature overlapping at least some contents of the signed digital document;

generate an intermediate document, said intermediate document excluding the embedded digital signature;

generate a validation output based on user authentication information identifying a signer of the signed digital document and the intermediate document, the validation output comprising a computed value representing the signed digital document before embedding of the embedded digital signature; and

verify whether the signed digital document was signed by the signer based on a comparison of the validation output to the embedded digital signature.