Method and system for signing and authenticating electronic documents via a signature authority which may act in concert with software controlled by the signer
A system and method for signing and authenticating electronic documents using public key cryptography applied by one or more server computer clusters operated in a trustworthy manner, which may act in cooperation with trusted components controlled and operated by the signer. The system employs a presentation authority for presenting an unsigned copy of an electronic document to a signing party and a signature authority for controlling a process for affixing an electronic signature to the unsigned document to create a signed electronic document. The system provides an applet for a signing party's computer that communicates with the signature authority.
1. A method that a signature authority uses after receipt of a signature creation request from a signing party to verify that the signing party to which the signature is to be attributed authorized creation of a digital signature for a to be signed electronic document as specified in the signature creation request, comprising the steps of:
providing an Internet computer browser computer program operative on an Internet-connected computer used by a signing party for authorizing digitally signing of a to be signed electronic document, the browser program operative to execute applets provided from an external source;
providing a certification authority for the Internet-connected computer used by the signing party, the certification authority protecting a certification authority private key and a corresponding digital certificate of the signing party having the signing party as a subject thereof together with a public key of the signing party;
providing a signature authority for coordinating construction of an electronic digital signature for digitally signing the to be signed electronic document in conjunction with a signature creation request of the signing party instructing the creation of a digitally signed electronic document;
at the signing party's computer, digitally signing the signature creation request using a private key of the signing party whose corresponding public key is in the digital certificate of the signing party and inserting the digital certificate into the signature creation request;
sending the digitally signed signature creation request from the signer's computer to the signature authority;
at the signature authority, verifying the digital signature on the signature creation request;
at the signature authority, verifying that the subject of the digital certificate in the signature creation request matches the signing party associated with the signature creation request; and
at the signature authority, creating the digital signature of the signing party as specified in the signature creation request.
2. The method of claim 1 , further comprising the step of protecting the signing party's private key by storage thereof in an signing party-accessible trustworthy component on the signing party's computer for use to digitally sign the signature creation request.
3. The method of claim 2 , wherein the trustworthy component on the signing party's computer creates the digital signature on the signature creation request.
4. The method of claim 1 , wherein a trustworthy component on the signing party's computer authenticates the signing party as the owner of the private key used to digitally sign the signature creation request.
5. The method of claim 4 , wherein the trustworthy component on the signing party's computer uses a plurality of factors to authenticate the signing party as the owner of the private key used to sign the signature creation request.
6. The method of claim 1 , wherein the signature authority creates the digital signature of the signing party using a key belonging to the signature authority that is used for a plurality of signing parties.
7. The method of claim 1 , wherein the signature authority creates the digital signature of the signing party using a key belonging to the signing party, which key is reconstructed from a first key portion held by the signature authority and a second key portion held by the signing party, wherein the signing party second key portion is securely communicated to the signature authority.
8. The method of claim 1 , wherein the signature authority creates the digital signature of the signing party using a key held by the signature authority.
9. The method of claim 1 , wherein the signature authority creates the digital signature of the signing party using a key held by the signer.
10. The method of claim 7 , wherein the second key portion held by the signing party is kept on the signing party's computer.
11. The method of claim 10 , wherein the second key portion kept on the signing party's computer system is protected by at least one of one or more trustworthy client components.
12. The method of claim 7 , wherein the second key portion kept on the signing party's computer system is communicated to the signature authority in a data path that is secured with the help of a trustworthy client component.
13. The method of claim 1 , wherein of the signature creation request indicates the signing party by the subject of the digital certificate that verifies the digital signature on the signature creation request.
14. The method of claim 1 , wherein the signature creation request specifies a field of the to be signed document on which the digital signature is placed when digitally signing the to be signed electronic document.
15. The method of claim 1 , wherein the signature creation request specifies digitally signing the to be signed electronic document within a specific time period.
16. The method of claim 1 , wherein the certificate authority further comprises cryptographic hardware that protects the certification authority private key.
17. The method of claim 9 , wherein the key kept on the signing party's computer system is protected by at least one of one or more trustworthy client components.
18. The method of claim 9 , wherein the key kept on the signing party's computer system is communicated to the signature authority in a data path that is secured with a trustworthy client component.
19. The method of claim 7 , wherein the first key portion and the second key portion are each formed by dividing the key.
20. The method of claim 19 , wherein the first key portion comprises the key in its entirety.
21. The method of claim 19 , wherein the second key portion comprises the key in its entirety.
22. The method of claim 7 , wherein the first key portion and the second key portion are each formed by splitting the key.
23. The method of claim 22 , wherein the first key portion comprises the key in its entirety.
24. The method of claim 22 , wherein the second key portion comprises the key in its entirety.