Granted Patent B2

US 12,206,792 · App. 17/793,147 · Granted Jan 21, 2025

Inventors: Jaan Priisalu (Tallinn, EE); Ahto Buldas (Tallinn, EE); Mart Saarepera (Tallinn, EE)

Assignee: Planetway Corporation

H04L9/3247H04L9/085H04L9/0866

Abstract

Claims (63)

1. A system for generating a digital signature comprising:

a plurality of backend servers and a frontend server;

the frontend server configured to:

receive a signature request from a remote application server, the signature request including a total public key with a cryptographically embedded server identifier;

extract the cryptographically embedded server identifier from the total public key;

forward the signature request to the one of the plurality of backend servers that corresponds to the backend server identifier; and

wherein the one of the plurality of backend servers is configured to:

forward the signature request to a plurality of remote security devices associated with the total public key;

receive a first signature from each of the plurality of remote security devices;

generate a combined signature based on the first signatures;

generate a finalized signature based on the combined signature and a finalizing key, the finalizing key being cryptographically generated based on the backend server identifier; and

forward the finalized signature to the frontend server;

wherein the frontend server is further configured to forward the finalized signature to the application server.

2. The system of claim 1 , wherein combined signature is generated using a composite key scheme.

3. The system of claim 1 , wherein the combined signature is generated using a split key scheme.

4. The system of claim 1 , wherein the one of the plurality of backend servers is configured to initially register the plurality of remote security devices by:

associating the plurality of remote security devices with a particular user;

generating a combined public key based on first public keys received from the plurality of remote security devices;

generating the total public key by cryptographically embedding the server identifier into the combined public key; and

associating the total public key with the particular user.

5. The system of claim 4 , wherein the total public key and the finalizing key are generated using a prime number selected based on the server identifier and the combined public key.

6. A system for generating a digital signature comprising:

a plurality of backend servers and a frontend server;

the frontend server configured to:

receive a signature request from a remote application server, the signature request including a total public key with a cryptographically embedded server identifier;

extract the cryptographically embedded server identifier from the total public key; and

forward the signature request to the one of the plurality of backend servers that corresponds to the server identifier; and

wherein the one of the plurality of backend servers are configured to:

forward the signature request to a remote security device associated with the total public key;

receive a first signature from the remote security device; generate a second signature in response to authenticating an identity of a user;

generate a combined signature based on the first signature and the second signature;

generate the third signature based on the combined signature and a finalizing key, the finalizing key being cryptographically generated based on the backend server identifier; and

forward the third signature to the frontend server;

wherein the frontend server is further configured to forward the third signature to the application server.

7. The system of claim 6 , wherein the combined signature is generated using a composite key scheme.

8. The system of claim 6 , wherein the combined signature is generated using a split key scheme.

9. The system of claim 6 , wherein the one of the plurality of backend servers is configured to initially register the remote security device by:

associating the remote security device with a particular user;

generating a combined public key based on a first public key received from the remote security device and a second public key generated by the backend server;

generating the total public key by cryptographically embedding the server identifier into the combined public key; and

associating the total public key with the particular user.

10. The system of claim 9 , wherein the total public key and the finalizing key are generated using a prime number selected based on the backend server identifier and the combined public key.

11. A method for generating a digital signature comprising:

receiving, at a frontend server, a signature request from a remote application server, the signature request including a total public key with a cryptographically embedded server identifier;

extracting, at the frontend server, the cryptographically embedded server identifier from the total public key;

selecting, by the frontend server, one of a plurality of backend servers that corresponds to the server identifier

forwarding, by the frontend server, the signature request the selected backend server;

obtaining, by the selected backend server, a first signature and a second signature;

generating, by the selected backend server, a combined signature based on the first signature and second signature;

generating, by the selected backend server, a finalized signature based on the combined signature and a finalizing key, the finalizing key being cryptographically generated based on the server identifier;

forwarding, by the selected backend server, the finalized signature to the frontend server; and

forwarding, by the frontend server, the finalized signature to the remote application server to be appended to a digital document.

12. The method of claim 11 , wherein obtaining, by the selected backend server, the first signature and the second signature includes:

identifying a first remote security device and a second remote security device based on the total public key;

forwarding the signature request to the first remote security device and the second remote security device; and

receiving the first signature from the first remote security device and the second signature from the second remote security device.

13. The method of claim 11 , wherein obtaining, by the backend server, the first signature and the second signature includes:

identifying a remote security device based on the total public key;

forwarding the signature request to the remote security device;

receiving the first signature from the remote security device; and

generating the second signature using a private key associated with the total public key after authenticating an identity of a user associated with the total public key.

14. The method of claim 11 , wherein combined signature is generated using a composite key scheme.

15. The method of claim 11 , wherein the total public key and the finalizing key are generated using a prime number selected based on the server identifier and a combined public key.

Assignments (1)

Continuity (1)

References Cited (13)