System and method for field-verifiable record authentication

1. A method for authenticating a document, comprising:

in a registration phase:

receiving from an originating entity a request to certify the document, as well as an electronic representation of the document;

storing the electronic representation of the document in a database;

returning to the originating entity a document identifier associated with the stored document and mappable to a database location indicator corresponding to the location of the stored electronic representation of the document in the database;

in a verification phase:

receiving a request to return to a verification-requesting entity a copy of the electronic representation of the document stored in the database, said request including the document identifier as extracted from a marking on a purported authentic copy of the document, said marking encoding the document identifier;

returning to the verification-requesting entity the requested electronic representation of the document stored in the database, whereby a user can visually compare the purported authentic copy of the document with the returned electronic representation of the document stored in the database; and

digitally signing the electronic representation of the document by inputting the electronic representation of the document as an original input record to a keyless, hash tree-based signing infrastructure, computing a data signature including recomputation parameters to a logically uppermost value in the hash tree, said recomputation parameters encoding information from other data sets than the document to be authenticated, whereby an arbitrary subsequent test digital record is considered authenticated relative to the corresponding original input record if, using the recomputation parameters to recompute upward through the hash-tree based infrastructure, the same uppermost value is attained as when it was originally computed with the corresponding original input record.

2. A method as in claim 1 , further comprising generating an electronic version of the marking and returning to the originating entity the document identifier in the form of the marking incorporated into the requested electronic representation of the document stored in the database.

3. A method as in claim 2 , in which the marking is chosen from a group comprising a one-dimensional bar code, a two-dimensional bar code, an alphanumeric character string, data for encoding into an RFID tag or smart chip, and data extracted from the document using optical character recognition (OCR).

4. A method as in claim 1 , in which the document identifier is in the form of a portion of a Uniform Resource Location (URL) and the request is received over the Internet.

5. A method as in claim 1 , further comprising returning to the verification-requesting entity the requested electronic representation of the document stored in the database as well as its corresponding digital signature.

6. A method as in claim 1 , further comprising encoding the digital signature in the marking in addition to the document identifier.

7. A method as in claim 1 , in which the document is one of a set of documents whose electronic representations are stored in the database, further comprising:

digitally signing the set of documents stored in the database by inputting a representation of the contents of the database as an input record to a keyless, hash tree-based signing infrastructure, computing a data signature including recomputation parameters to a logically uppermost value in the hash tree, said recomputation parameters encoding information from other data sets than the document to be authenticated, said contents including a plurality of stored electronic representations of documents having been submitted in respective registrations phases.

8. A method as in claim 1 , in which the verification-requesting entity is a portable device having a camera and decoding software module configured to capture the marking on the purported authentic copy of the document, extract the network-addressable locator from the marking, and submit the request to return the copy of the electronic representation of the document stored in the database corresponding to the network-addressable locator.

9. A method as in claim 8 , in which the portable device is a network enabled device chosen from a group consisting of a telephone, a tablet computer, and a portable computer.

10. A method as in claim 1 , further comprising associating an expiration time with the stored electronic representation of the document and returning to the verification-requesting entity the requested electronic representation of the document stored in the database only if the expiration time has not been exceeded.

11. A system for authenticating a document, comprising:

a processor;

a database;

a memory;

modules comprising instructions stored in the memory which, upon execution by the processor, cause the processor:

to receive from an originating entity a request to certify the document, as well as an electronic representation of the document;

to store the electronic representation of the document in the database;

to return to the originating entity a document identifier associated with the stored document and mappable to a database location indicator corresponding to the location of the stored electronic representation of the document in the database;

to receive a request to return to a verification-requesting entity a copy of the electronic representation of the document stored in the database, said request including the document identifier as extracted from a marking on a purported authentic copy of the document, said marking encoding the document identifier;

to return to the verification-requesting entity the requested electronic representation of the document stored in the database, whereby a user can visually compare the purported authentic copy of the document with the returned electronic representation of the document stored in the database; and

to obtain a digital signature associated with the electronic representation of the document stored in the database by submitting the electronic representation of the document as an input record to a keyless, hash tree-based signing infrastructure that returns a data signature including recomputation values to a logically uppermost value in the hash tree, said recomputation values encoding information from other data sets than the document to be authenticated, whereby an arbitrary subsequent test digital record is considered authenticated relative to the corresponding original input record if, using the recomputation parameters to recompute upward through the hash-tree based infrastructure, the same uppermost value is attained as when it was originally computed with the corresponding original.

12. A system as in claim 11 , comprising a marking module including computer-executable code for generating an electronic version of the marking and returning to the originating entity the document identifier in the form of the marking incorporated into the requested electronic representation of the document stored in the database.

13. A system as in claim 12 , in which the marking is chosen from a group comprising a one-dimensional bar code, a two-dimensional bar code, an alphanumeric character string, data for encoding into an RFID tag or smart chip, and data extracted from the document using optical character recognition (OCR).

14. A system as in claim 11 , in which the document identifier is in the form of a portion of a Uniform Resource Location (URL) and the request is received over the Internet.

15. A system as in claim 11 , further comprising returning to the verification-requesting entity the requested electronic representation of the document stored in the database as well as its corresponding digital signature.

16. A system as in claim 11 , further comprising instructions for encoding the digital signature in the marking in addition to the document identifier.

17. A system as in claim 11 , in which the document is one of a set of documents whose electronic representations are stored in the database, further comprising:

digitally signing the set of documents stored in the database by submitting a representation of the contents of the database as an input record to a keyless, hash tree-based signing infrastructure that returns a data signature including recomputation values to a logically uppermost value in the hash tree, said recomputation values encoding information from other data sets than the document to be authenticated, said contents including a plurality of stored electronic representations of documents having been submitted in respective registrations phases.

18. A system as in claim 11 , in which the verification-requesting entity is a portable device having a camera and a decoding software module configured to capture the marking on the purported authentic copy of the document, extract the network-addressable locator from the marking, and submit the request to return the copy of the electronic representation of the document stored in the database corresponding to the network-addressable locator.

19. A system as in claim 18 , in which the portable device is a network enabled device chosen from a group consisting of a telephone, a tablet computer, and a portable computer.

20. A non-transitory computer-readable storage medium having data stored therein representing software executable by a computer, the software including instructions for authentication of digital records, the storage medium comprising:

instructions for receiving from an originating entity, in a registration phase, a request to certify the document, as well as an electronic representation of the document;

instructions for storing the electronic representation of the document in a database;

instructions for returning to the originating entity a document identifier associated with the stored document and mappable to a database location indicator corresponding to the location of the stored electronic representation of the document in the database;

instructions for receiving a request, in a verification phase, to return to a verification-requesting entity a copy of the electronic representation of the document stored in the database, said request including the document identifier as extracted from a marking on a purported authentic copy of the document, said marking encoding the document identifier;

instructions for returning to the verification-requesting entity the requested electronic representation of the document stored in the database, whereby a user can visually compare the purported authentic copy of the document with the returned electronic representation of the document stored in the database; and

instructions for obtaining a digital signature associated with the electronic representation of the document stored in the database, including instructions for submitting the electronic representation of the document as an input record to a keyless, hash tree-based signing infrastructure that returns a data signature, for computing validating recomputation values to a logically uppermost value in the hash tree, said recomputation values encoding information from other data sets than the document to be authenticated, whereby an arbitrary subsequent test digital record is considered authenticated relative to the corresponding original input record if, using the recomputation parameters to recompute upward through the hash-tree based infrastructure, the same uppermost value is attained as when it was originally computed with the corresponding original.

21. The computer-readable storage medium as in claim 20 , further comprising instructions for generating an electronic version of the marking and returning to the originating entity the document identifier in the form of the marking incorporated into the requested electronic representation of the document stored in the database.

22. The computer-readable storage medium as in claim 21 , in which the marking is chosen from a group comprising a one-dimensional bar code, a two-dimensional bar code, an alphanumeric character string, data for encoding into an RFID tag or smart chip, and data extracted from the document using optical character recognition (OCR).

23. The computer-readable storage medium as in claim 20 , further comprising instructions for returning to the verification-requesting entity the requested electronic representation of the document stored in the database as well as its corresponding digital signature.

24. The computer-readable storage medium as in claim 20 , further comprising instructions for encoding the digital signature in the marking in addition to the document identifier.

25. The computer-readable storage medium as in claim 20 , in which the document is one of a set of documents whose electronic representations are stored in the database, further comprising instructions for obtaining respective digital signatures for the set of documents stored in the database by submitting a representation of the contents of the database as an input record to a keyless, hash tree-based signing infrastructure that returns a data signature including recomputation values to a logically uppermost value in the hash tree, said recomputation values encoding information from other data sets than the document to be authenticated, said contents including a plurality of stored electronic representations of documents having been submitted in respective registrations phases.