Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular communication authentication technique
Reexamination Certificate
1999-06-17
2003-12-30
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular communication authentication technique
C713S170000, C713S180000, C713S185000, C713S152000, C713S152000
Reexamination Certificate
active
06671805
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates generally to electronic documents, and more particularly, to a system and method for document-driven processing of digitally-signed, electronic documents.
2. Identification of Copyright
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
DESCRIPTION OF THE BACKGROUND ART
E-commerce is rapidly becoming the watchword for businesses in the next millennium. The appeal of a completely paperless transaction is obvious—reduced storage costs; instant global access to transaction data; and the merging, filtering, and mining of data. Not only will businesses benefit from paperless transactions, but also a number of other institutions, such as courts and government agencies.
A few problems need to be addressed, however, before widespread acceptance of paperless transactions is possible. First, there is a need for a system that provides a high degree of trust in electronic documents. In other words, there is a need for a system that authenticates and prevents the repudiation of electronic documents. Second, there is a need for a flexible, efficient, and auditable system for creating and processing trusted electronic documents.
The problem of establishing trust in electronic information is largely cultural. Despite the widespread use of computers, the United States still very much a paper-based society. Many eople tend to trust paper documents, while distrusting the same information stored in a computer. Similarly, many people tend to respect such traditional indicia of authenticity and non-repudiation as handwritten signatures, official seals, and the like. As a result, while growing numbers of people are willing to buy books, flowers, or Furbies™ over the Internet, they are not willing to use the same medium to buy a car, a house, or a company.
Only recently has the technical and legal framework been established for providing the same kind of trust in electronic documents. The technical framework has emerged as a result of recent advances in cryptography, such as public key cryptography and digital signatures. The legal framework has developed through such legislative reform as the Utah Digital Signature Act, which was the first legislative initiative to give clear legal recognition to digital signatures.
As noted above, the key technical framework for establishing trust in electronic information is cryptography, i.e. the science of protecting information by transforming it into an unreadable format by means of a mathematical formula. There are two basic types of cryptography—symmetric and asymmetric. In symmetric key cryptography, both the sender and receiver of a message use the same secret key, i.e. a number or code used for scrambling or unscrambling information. The sender uses the secret key to encrypt the message and the receiver uses the same secret key to decrypt the message.
The difficulty arises, however, when the sender and receiver attempt to agree on, the secret key without anyone else finding out. For example, if the sender and receiver are in separate physical locations, they must trust a courier, a telephone system, or some other transmission medium to prevent the disclosure of, the secret key. Anyone who overhears or intercepts the key in transit can later read, modify, and forge all messages encrypted or authenticated with that key. Thus, symmetric key encryption systems present a difficult problem of key management.
The other type of cryptography, assymetric or “public key” cryptography, was developed as a solution to the key management problem. In public key cryptography, two keys are used—a public key and a private key. The user publishes his public key to the world, while keeping the corresponding private key secret. Although the public and private keys are mathematically related, neither can be feasibly derived from the other.
To send a private message using public key cryptography, a message is encrypted using the recipient's public key, which is freely available, and is decrypted by the recipient using his private key, which only he knows. Thus, the need for the sender and recipient to share secret information is eliminated. A sender only needs to know the recipient's public key, and no private keys are ever transmitted or shared.
Public key cryptography offers another crucial advantage over symmetric key cryptography—a framework for creating digital signatures. One of the significant problems with cryptographic communications is determining whether an encrypted message was forged (i.e. falsely attributed to another person) or tampered with during transmission. As noted above, if a symmetric key is lost or stolen, any person in possession of the key can forge messages or modify legitimate messages.
Using public key cryptography, however, a sender can digitally “sign” a message using the sender's private key. This process involves calculating a message digest, i.e. a number that represents a summary of the entire message, and encrypting the message digest with the sender's private key. The message digest is calculated using a one-way hash function such that any change to the message will result in a different calculated message digest. While it would be possible to encrypt the entire message, it would typically be too expensive in terms of time and computing resources. Consequently, for non-private communications, encrypting just the message digest is preferable.
When the message is received, the recipient uses the sender's known public key to decrypt the message digest, thereby proving that the message was not forged, since only the sender could have encrypted the message digest with the corresponding private key. Thereafter, the recipient calculates a new message digest for the message and compares it with the original message digest. If the digests match, the message was not tampered with during transmission.
In the legal and commercial contexts, a digital signature can fulfill the same requirements of identity authentication and non-repudiation as a handwritten signature. First, the digital signature may be used to identify the sender of a message. Second, because only the sender knows his private key, it is impossible for the sender to repudiate a document signed using his private key. This fact makes it possible for digitally-signed agreements to become legally binding. In addition, unlike a handwritten signature, a digital signature can protect the integrity of the document by indicating whether the document was modified since it was signed.
Even with the availability of digital signature technology, a second problem that needs to be addressed in order to ensure widespread acceptance of paperless transactions is the development of a flexible, efficient, and auditable system for creating and processing trusted electronic documents. Unfortunately, conventional approaches have numerous drawbacks.
For example, a traditional model for creating and processing electronic information is as follows:
Paper Document→Sign→Courier→File Clerk→DBMS.
In other words, a paper document is signed and then sent by a courier, such as UPS, to a file clerk. The file clerk inputs various data from the paper document into a Database Management System (DBMS), which allows the data to be processed and displayed for a variety of purposes.
Unfortunately, such a model has several drawbacks. First, it is not very flexible. Once a typical DBMS schema is created, it is difficult to update or modify in order to accommodate the changing needs of its users. Moreover, each client computer that accesses the DBMS must be programmed with the same database schema and use compatible database software. This requires a high degree of uniformity and compatibility a
Brown Bruce E.
Israelsen D. Brent
Francissen Vernon W.
Gardner & Carton & Douglas LLP
iLumin Corporation
Peeso Thomas R.
LandOfFree
System and method for document-driven processing of... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method for document-driven processing of..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method for document-driven processing of... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3119867