WO2012053885A1

WO2012053885A1 - A method for creating and verifying digital signature in a server

Info

Publication number: WO2012053885A1
Application number: PCT/MY2010/000304
Authority: WO
Inventors: Chong Seak Sea; Fui Bee Tan; Kang Siong Ng; Rashidah Haron Galoh; Soo Sian Tan; Izyani Daud Nor
Original assignee: Mimos Bhd
Current assignee: Mimos Bhd
Priority date: 2010-10-20
Filing date: 2010-11-29
Publication date: 2012-04-26
Anticipated expiration: 2013-04-20
Also published as: MY151316A

Abstract

One embodiment of the present invention provides a method (300) for creating digital signature in a server, the method comprising the steps of logging in to the server via user's digital certificate (302), selecting at least one file for digital signature creation (304), generating at least one file of digest code [A] (306), embedding the at least one file of digest code [A] in a browser extension program at client side (308), activating the browser extension program (310), encrypting the digest code [A] with a user private key (312), transmitting the encrypted digest code [B] to the server (314), creating a digital signature at the server (316) and storing the digital signature in a database (318). Another embodiment of the present invention provides a method (400) for verifying digital signature in a server, the method comprising the steps of requesting verification of a digital signature having an encrypted digest code [B] from a database in a server (402), retrieving at least one encrypted digest code [B] from the database (404), generating at least one file of original digest code [A] (406), retrieving a user public key (408), decrypting encrypted digest code [B] from the digital signature using the user public key which produces decrypted digest code [C] (410) and comparing both digest ([A] = [C]) (412) to determine a success or failure rate of the decrypted information.

Description

W

-I

A METHOD FOR CREATING AND VERIFYING DIGITAL SIGNATURE IN A SERVER FIELD OF INVENTION

5 The present invention relates to a method for creating and verifying digital signature in a server by maintaining the user private key at the client side.

BACKGROUND ART

Digital signature provides the means for an electronic document (e.g. e-mail,0 spreadsheet, text file, etc.) to be authenticated. Digital signatures rely on certain encryption methodologies to ensure authentication between two or more parties entering into a transaction over the network. Typical file based digital signature type software application always performed as non web based application due to user private key store in hardware token at client computer, such as smart card, USB token and etc.5

At present, the main problem encountered during the digital signing process is where the user private key is stored in any hardware token at remote client side and the document(s) must reside in the server without transmitting it out. The user's private keys are not recommended to be deposited at any server while transmission across network0 is not allowed in respect of security issues.

The present invention provides a methodology for creating and verifying digital signature at the server side while maintaining the user private key at the client side. The user's private key remains at the client computer during the digital signature process wherein5 transmission of private key to the server is not allowed. A browser extension program is provided in the present invention wherein the browser extension program customizes the digital signing process at the client side wherein the private key resides in the client side.

The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in environments such as those described above. Rather, this background is only provided to illustrate one exemplary technology area where some embodiments described herein may be practice. SUMMARY OF INVENTION

One aspect of the present invention is a method for creating digital signature in a server by maintaining the user private key at the client side. The method comprising the steps of logging in to server via user's digital certificate (302); selecting at least one file for digital signature creation (304), generating at least one file of digest code [A] (306), embedding the at least one file of digest code [A] in a browser extension program at client side (308), activating the browser extension program (310), encrypting the digest code [A] with a user private key (312), transmitting the encrypted digest code [B] to the server (314) and creating a digital signature at the server (316). Thereafter, the digital signature is stored in a database (318). The method for transmitting the encrypted digest code [B] to the server (314) further comprises applying digital time stamp for creation of the digital signature. The user private key is maintained at the user and/or client side. The user private key which is maintained at the user and/or client side is not allowed to be transmitted to the server.

Another aspect of the present invention is a method (400) for verifying digital signature in a server. The method comprising the steps of requesting verification of a digital signature having an encrypted digest code [B] from a database in a server (402), retrieving at least one encrypted digest code [B] from the database (404), generating at least one file of original digest code [A] (406), retrieving a user public key (408), decrypting encrypted digest code [B] from the digital signature using the user public key which produces decrypted digest code [C] (410) and comparing both digest ([A] = [C]) (412). The method of comparing both digest ([A] = [C]) further comprises determining the success status rate and failure status rate wherein information indicative of a signature element returns a success status rate when digest code [A] matches digest code [C] in signature data (414). Else information indicative of a signature element returns a failure status rate when digest code [A] does not match digest code [C] in signature data (416).

The success rate indicates that files received has not been tampered or modified while the failure status rate indicates that files received has been tampered or modified. The present invention consists of features and a combination of parts hereinafter fully described and illustrated in the accompanying drawings, it being understood that various changes in the details may be made without departing from the scope of the invention or sacrificing any of the advantages of the present invention.

BRIEF DESCRIPTION OF ACCOMPANYING DRAWINGS

To further clarify various aspects of some embodiments of the present invention, a more particular description of the invention will be rendered by references to specific embodiments thereof, which are illustrated in the appended drawings. It is appreaated that these drawings depict only typical embodiments of the invention and are therefore not to be considered limiting of its scope. The invention will be described and explained with additional specificity and detail through the accompanying drawings in which: FIG. 1 illustrates a sequence diagram of digital signature creation in a server.

FIG. 2 illustrates a sequence diagram of digital signature verification in a server.

FIG. 3 is a flowchart illustrating a method for creating digital signature in a server.

FIG. 4 is a flowchart illustrating a method for verifying digital signature in a server

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The invention relate to a method for creating and verifying digital signature in a server by maintaining the user private key at the client side. Hereinafter, this specification will describe the present invention according to the preferred embodiments. It is to be understood that limiting the description to the preferred embodiments of the invention is merely to facilitate discussion of the present invention and it is envisioned without departing from the scope of the appended claims. Reference is first being made to FIG. 1 and FIG. 3 respectively. FIG. 1 illustrates a sequence diagram of digital signature creation in a server while FIG. 3 is a flowchart illustrating a method for creating digital signature in a server. FIG. 1 illustrates the interaction between the client side and the server side (client-server system) via a browser extension program for digitally signing data. Browser extension program which is a browser add -ons which is also known as extensions is a small (mini) computer program that extends the functionality of a browser to perform and customize the digital signing process at the user side. Browser extension program generally enhances the default functionality of the web browser.

The user first log in to a server using user's digital certificate via server side scripting in a server side channel (302) and the user first selects at least one file for digital signature creation (304). Thereafter, the server generates at least one file of digest code [A] (306). Digest codes are data generated for encoding purposes wherein the digest code includes hash value returned by a hash function. The said data is often referred to as "message", "message digest" or simply "digest". At least one file of digest code is embedded in the browser extension program at client side (308). The browser extension program is activated (310) to enable the functionality as described above to allow the transmission of the digest code to the user side. Subsequently, the digest code [A] is encrypted with a user private key (312) wherein the user private key maintains at the user and/or client side. The user private key which is maintained at the user and/or client side is not allowed to be transmitted to the server for protection of data and to avoid data losses via eavesdropping in the network, etc.

The encrypted digest code also known as digest code [B] is thereafter transmitted from client side to the server (314) to create a digital signature (316) which will be stored in a database (318). The digital signature which is created by encrypting digest code [A] with the user private key which resides at the user and/or client side is further stamped wherein digital time stamp is applied for creation of the digital signature. Therefore, the digitally signed data comprises of digest code [B] which is digitally stamped. Digital time stamp creates a unique identifier wherein time stamping presents data in a consistent format.

Reference is now being made to FIG. 2 and FIG. 4 respectively. FIG. 2 illustrates a sequence diagram of digital signature verification in a server while FIG. 4 is a flowchart illustrating a method for verifying digital signature in a server. FIG. 2 illustrates the interaction between the client side and the server side (client-server system) via a browser extension program for verifying the digitally signed data.

The user first logs in to a server using user's digital certificate via server side scripting in a server side channel for verification of the digitally signed signature. Upon successful log-in to the server, the user first request for verification of a digital signature having an encrypted digest code [B] from a database in the server (402). Thereafter, the server retrieves at least one encrypted digest code from the database (404). Subsequently, the server generates at least one file of original digest code [A] (406). The user public key is retrieved (408) to enable decryption of encrypted digest code [B] from the digital signature to obtain decrypted digest code [C] (410). Upon successful decryption of the encrypted digest code [B] via a user public key, both digest code [A] and digest code [C] is compared (412) to determine data integrity wherein success status rate indicates that files received has not been tampered or modified. Failure status rate indicates that files received has been tampered or modified.

The success status rate of the decrypted digest code [C] is determined when digest code [A] matches digest code [C] in the signature data (414) and the failure status rate of the decrypted digest code [C] is determined when digest code [A] does not match digest code [C] in the signature data (416).

The methodology of the digital signature service which provides for creating and verifying digital signature in a server operates as a web-based application. The said methodology provides for user private key which resides at the client side at all times to ensure protection of data integrity as the user private key will not be disclosed.

The present invention may be embodied in other specific forms without departing from its essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore indicated by the appended claims rather than by the foregoing description. All changes, which come within the meaning and range of equivalency of the claims, are to be embraced within their scope.

Claims

1. A method (300) for creating digital signature in a server, the method comprising the steps of: logging in to the server via user's digital certificate (302)

selecting at least one file for digital signature creation (304); generating at least one file of digest code [A] (306);

embedding the at least one file of digest code [A] in a browser extension program at a client side (308);

activating the browser extension program (310);

encrypting the digest code [A] with a user private key (312); transmitting the encrypted digest code [B] to the server (314); creating a digital signature at the server (316);

storing the digital signature in a database (318);

characterized in that

transmitting the encrypted digest code [B] to the server (314) further comprises applying digital time stamp for creation of the digital signature.

2. The method according to Claim 1, wherein the at least one file of digest code includes hash value returned by a hash function.

The method according to Claim 1, wherein the digital time stamp generates unique identifier in creating the digital signature.

4. The method according to Claim 1 , wherein the user private key maintains at the user and/or client side.

5. The method according to Claim 4, wherein the user private key is maintained at the user and/or client side is not allowed to be transmitted to the server.

6. The method according to Claim 4, wherein the method for creating digital signature in a server includes creation of digital signature for a web-based application.

7. A method (400) for verifying digital signature in a server, the method comprising the steps of: requesting verification of a digital signature having an encrypted digest code [B] from a database in a server (402);

retrieving at least one encrypted digest code [B] from the database (404); generating at least one file of original digest code [A] (406);

retrieving a user public key (408);

decrypting encrypted digest code [B] from the digital signature using the user public key which produces decrypted digest code [C] (410);

comparing both digest ([A] and [C]) (412);

information indicative of a signature element returns a success status rate when digest code [A] matches decrypted digest code [C] in signature data (414); else

information indicative of a signature element returns a failure status rate when digest code [A] does not match decrypted digest code [C] in signature data (416).

8. The method according to Claim 7, wherein the success status rate indicates that files received has not been tampered or modified.

9. The method according to Claim 7, wherein the failure status rate indicates that files received has been tampered or modified.

10. The method according to Claim 7, wherein the method for verifying digital signature in a server includes verification of digital signature for a web-based application.