Privacy preserving electronic document signature service

• US 9,521,001 B2
• Filed: 04/28/2014
• Issued: 12/13/2016
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Adobe Inc.
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Follis, Benjamin David, Kaufman, Marc Thomas
• Primary Examiner(s): DOLLY, KENDALL LYNN
• Application Number:
  US14/263,811
• Publication Number:
  US 20150312227A1
• Time in Patent Office: 960 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

An electronic document signature system preserves the security of an electronic document while tracking a signature process corresponding to the electronic document. In particular, using a client application on a client device, an originating user can protect an electronic document and send the protected electronic document to a tracking server. The tracking server receives only a protected document such that the security the electronic document is preserved. Using a client applications on client devices, one or more participating users can subsequently receive the protected document from the tracking server, access the contents of the electronic document, and sign the electronic document. The tracking server can record events that occur with respect to the protected document to create an event log.

Claims

1. A method of providing a secure electronic document signature service, comprising:

receiving, by at least one server device and from a client device corresponding to an originating user, a protected electronic document and a user identity of a participant user, wherein the content of the protected electronic document is inaccessible by the at least one server device based on the at least one server device not receiving a key to unprotect the protected electronic document;

performing, by the at least one server device, a hash function on the protected electronic document to generate a first server-generated ID element;

providing, by the at least one server device, the first server-generated ID element to the client device corresponding to the originating user for verification that the server-generated ID element matches a client-generated ID element generated at the client device corresponding to the originating user;

providing, by the at least one server device, the protected electronic document to a client device corresponding to the participant user;

receiving, from the client device corresponding to the participant user, a signed version of the protected electronic document comprising an electronic signature of the participant user;

performing the hash function on the signed version of the protected electronic document to obtain a second server-generated ID element for the signed version of the protected document; and

providing, by the at least one server device, the second server-generated ID element to the client device corresponding to the participant user for verification that the second-generated ID element matches a second client-generated ID element generated at the client device corresponding to the participant user.

2. The method as recited in claim 1, further comprising receiving a verification message from the client device corresponding to the originating user, the verification message indicating that the first server-generated ID element matches the client-generated ID element.

3. The method as recited in claim 2, wherein the first server-generated ID element comprises a hash value resulting from performing the hash function on the protected document.

4. The method as recited in claim 1, wherein receiving the electronic signature from the participant user comprises receiving a digital signature from the client device corresponding to the participant user.

5. The method as recited in claim 1, wherein the electronic signature of the participant user comprises a digital representation of the participant user'"'"'s signature.

6. The method as recited in claim 1, further comprising:

receiving, from the originating user, an identification of an additional participant user; and

providing the protected electronic document to the additional participant user.

7. The method as recited in claim 6, further comprising receiving another electronic signature from the additional participant user.

8. The method as recited in claim 1, further comprising generating an event log associated with the protected electronic document, the event log comprising information associated with the received electronic signature.

9. The method as recited in claim 8, further comprising:

receiving a request for signature information; and

in response the received request for signature information, providing information from the generated event log.

10. The method as recited in claim 9, further comprising providing access to the protected electronic document and the received electronic signature.

11. The method as recited in claim 1, wherein the signed version of the protected electronic document comprises a leading edge portion that includes the protected electronic document and an append portion that comprises a digital signature.

12. The method as recited in claim 11, wherein performing the hash function on the signed version of the protected electronic document comprises performing the hash function on the leading edge portion to determine the second server-generated ID element.

13. A system of providing a secure electronic document signature service comprising:

at least one processor; and

at least one non-transitory computer readable storage medium storing instructions thereon that, when executed by the at least one processor, cause the system to;

receive by at least one server device and from a client device corresponding to an originating user, a protected electronic document and a user identity of a participant user, wherein the content of the protected electronic document is inaccessible by the at least one server device based on the at least one server device not receiving a key to unprotect the protected electronic document;

perform, by the at least one server device, a hash function on the protected electronic document to generate a first server-generated ID element;

provide, by the at least one server device, the first server-generated ID element to the client device corresponding to the originating user for verification that the first server-generated ID element matches a client-generated ID element generated at the client device corresponding to the originating user;

provide, by the at least one server device, the protected electronic document to a client device corresponding to the participant user;

receive, from the client device corresponding to the participant user, a signed version of the protected electronic document comprising an electronic signature of the participant user;

perform the hash function on the signed version of the protected electronic document to obtain a second server-generated ID element for the signed version of the protected document; and

provide, by the at least one server device, the second server-generated ID element to the client device corresponding to the participant user for verification that the second-generated ID element matches a second client-generated ID element generated at the client device corresponding to the participant user.

14. The system as recited in claim 13, wherein the electronic signature of the participant user comprises a digital representation of the participant user'"'"'s signature.

15. The system as recited in claim 14, wherein the signed version of the protected electronic document comprises a leading edge portion that includes the protected electronic document and an append portion that comprises a digital signature.

16. The system as recited in claim 15, wherein performing the hash function on the signed version of the protected electronic document comprises performing the hash function on the leading edge portion to determine the second server-generated ID element.

17. The system as recited in claim 13, further comprising receiving, from the client device associated with the originating user, an indication of a method to determine the first server-generated ID element.

18. The system as recited in claim 17, wherein the indication of a method to determine the first server-generated ID element comprises an identification of a cryptographic hash function.

19. The system as recited in claim 13, further comprising instructions that, when executed by the at least one processor, cause the system to generate an event log associated with the protected electronic document, the event log comprising information associated with the received electronic signature.

20. The system as recited in claim 19, further comprising instructions that, when executed by the at least one processor, cause the system to:

receive a request for signature information; and

in response the received request for signature information, provide information from the generated event log.