WO2020101471A1

WO2020101471A1 - Secure framework for transaction signing

Info

Publication number: WO2020101471A1
Application number: PCT/MY2019/050084
Authority: WO
Inventors: Alwyn Goh; Kang Siong Ng; Kay Win LEE; Moesfa Soeheila Binti MOHAMAD; Dr. Geong Sen POH
Original assignee: Mimos Berhad
Priority date: 2018-11-14
Filing date: 2019-11-08
Publication date: 2020-05-22

Abstract

The present invention relates to a system (100) and method (200) for transaction signing and identification management on a secure framework. In particular, the present invention relates to an establishment of trust between the third party transaction originator (102a) at the client-side and the third party transaction processor (102b) at the server side. Subsequent to the establishment of trust between the client-side extension and server-side extension, the framework further comprises establishment of security conditions via challenge-response interaction between the at least signer component (102) and the at least one verifier component (104). The establishment of security conditions comprising signer-to-verifier challenge, verifier-to-signer response, signer-to-verifier reciprocal response, on client-side transaction interface through a local communication channel.

Description

SECURE FRAMEWORK FOR TRANSACTION SIGNING

FIELD OF INVENTION

The present invention relates to a system and method for transaction signing and identification management on a secure framework. In particular, the present invention relates to a trust establishment framework allowing third party applications and services to access transaction signing coupled with verification capabilities.

BACKGROUND OF INVENTION

Transaction signing and identification (ID) management on a mobile communication device is of interest whereby a highly secured framework is demanded to ensure a highly secured transaction signing solution is achieved. Concurrent necessity of a secured framework for transaction signing and ID management on mobile communication device is to enable ease of use as to provide thoroughness in transaction processes of interest. An example of an existing method is Know your Customer (KYC) for identifying and verifying the identity of its clients. Currently available implementations of transaction signing and ID management are often vulnerable from various forms of attacks arising from various factors which includes from hostile applications on device, insecure communication channels, and insecure server-side storage of user credentials or keys.

United States Patent No. US 9,519,899 B2 (hereinafter referred to as the US 899 B2 Patent) entitled‘SECURE MOBILE-BASED FINANCIAL TRANSACTION" having a filing date of 28 April 2015 (Patentee: AT&T Mobility II LLC) discloses systems and method for securing payment from a mobile communication device. The US 899 B2 Patent utilizes the point-of- sale device to enable the mobile communication device to communicate with a payment server for conducting a transaction. The US 899 B2 Patent provides computation of one-time digital key for authentication purposes and establishment of trust of the transaction relies on the payment server. The US 899 B2 Patent requires engagement directly with merchant with the point-of-sale device.

United States Publication No. US 2016253663 A1 (hereinafter referred to as the 663 A1 Publication) entitled "TRANSACTION SIGNING UTILIZING ASYMMETRIC CRYPTOGRAPHY” having a filing date of 26 February 2016 (Applicant: ADAM CLARK et. al) discloses systems and methods of transaction signing utilizing asymmetric cryptography and a private ledger. The US 663 A1 Publication implements PKC computation for performing transaction signing and verification wherein a transaction data is signed using a private key. The US 663 Publication enables an establishment of trust by utilizing a transaction verification and accounting module (TVAM).

United States Patent No. US 9,686,245 B2 (hereinafter referred to as the US 245 B2 Patent) entitled“SYSTEM AND METHOD FOR SECURE AUTHENTICATION" having a filing date of 16 September 2014 (Patentee: ENTERSEKT, LLC) discloses system and method for secure authentication on a mobile communication devices The 245 B2 Patent requires external communication for performing the authentication such as out-of-band communication. Furthermore, the US 245 B2 Patent provides an establishment of trust through a unique identifier which is Globally Unique Identifier (GUID) in order to identify a user of interest by utilizing public key. The US 245 B2 Patent also provides communication of the confidential information by utilising protocol handler.

Due to the drawbacks and limitation of the current system and method, the present application provides a system and method for transaction signing on a secure framework which offers an establishment of trust with multi-point assessment for assuring protections of credentials and transaction data wherein no external connectivity is required between the interaction of client- side and server-side.

SUMMARY OF INVENTION

The present invention relates to a system (100) and method (200) for transaction signing and identification management on a secure framework. In particular, the present invention relates to a trust establishment framework allowing third party applications and services to access transaction signing coupled with verification capabilities.

One aspect of the invention provides a method for establishment of security condition via challenge-response interaction between a signer component (102) and a verifier component (104) of security framework comprising: request by a third-party transaction originator to proximate a signer instance, to initiate such interaction with a particular verifier instance to be specified: assessment of such request by the signer instance of interest; computation of randomised challenge by the signer instance, if such assessment is positive; presentment by the signer instance to a transaction originator of presently issued challenge; transmission by requesting originator to corresponding a transaction processor of transaction to be signed, and furthermore signer-issued challenge, as presently associated with transaction of interest; request by a third-party processor to proximate the verifier instance, or other designated instance, to proceed with interaction of interest; assessment of such request by the verifier instance of interest; computation of response by the verifier instance, if such assessment is positive, such response comprising at least: verifier credential, as can be irrefutably verified; received challenge, as issued by the signer; randomised reciprocal challenge, as presently issued; information associated with transaction, for subsequent presentment to user of interest as associated with the signer; and authenticator computed on pair of corresponding challenges, and furthermore transaction information, as can be irrefutably verified by the signer; presentment by the verifier instance to the transaction processor of verifier credential and response; reciprocal transmission by the transaction processor to requesting originator of verifier credential and response; request by the originator to the signer instance, to continue with interaction of interest; assessment of verifier response by the signer instance of interest; presentment of transaction information as authenticated by verifier to user of interest, if such assessment is positive; assessment by a user as to whether to continue with signing on transaction presented; user action to enable computations for transaction signing and reciprocal response, if such assessment is positive; computation of signature on transaction information presented, by the signer instance; computation of reciprocal response by the signer instance, such reciprocation comprising at least: signer credential, as can be irrefutably verified; originating challenge, as previously issued by the signer; received challenge, as issued by the verifier; transaction-specific signature, as presently computed; authenticator computed on pair of corresponding challenges, and furthermore transaction signature, as can be Irrefutably verified by the verifier; encryption computed on corresponding challenges, transaction signature and reciprocal authenticator, as can be recovered exclusively by the verifier; presentment by the signer instance to the transaction originator of signer credential and encrypted reciprocation; concluding transmission by requesting originator to the transaction processor of signer credential and reciprocation; request by the transaction processor to the verifier instance, to conclude interaction of interest; decryption of signer reciprocation, and assessment thereof by the verifier instance; assessment by the verifier of transaction signature; and presentment of transaction signature by the verifier instance to the transaction processor, if such assessment is positive.

Another aspect of the invention provides that the challenge-response interaction between the signer component (102) and the verifier component (104) comprising: Zero Knowledge, ZK computation on input pre-element resulting in output element, such that pre-element cannot be feasibly derived from corresponding element; credential element as associated with component instance, as derived from such ZK computation on previously computed pre- credential; challenge element as issued by component instance, as derived from such ZK computation on previously computed pre-challenge; protection of pre-credential and prechallenge elements from exposure external to associated component; security establishment element computed in response to received challenge, as derived from equivalent ZK computation on such received challenge with interaction-specific pre-challenge as input, enabling subsequent encryption of transmitted outputs from component undertaking computation, such that only component undertaking reciprocal computation within challenge- response interaction of interest is able to undertake corresponding decryption of received inputs; and authenticator element computed in response to received challenge, as derived from equivalent ZK computation on such received challenge with component-associated precredential as input, enabling subsequent authentication of transmitted outputs from component undertaking computation, such that only component undertaking reciprocal computation within challenge-response interaction of interest is able to undertake corresponding verification of received inputs.

Yet another aspect of the invention provides that the private-key protection internal to the signer component (102), as installed on a computing platform previously associated with user of interest, and furthermore external thereof comprising component-specific private-key computation from ZK computation on multiple inputs immediately prior to transaction signing comprising: identifying element uniquely associated with the computing platform of interest, and subsequently read from platform; random element computed immediately prior to initial instance of such private-key computation, from ZK computation on multiple sensor inputs on platform of interest, and subsequently stored on platform; and user-contributed element from ZK computation on user action undertaken on component Ul, as undertaken prior to transaction signing; and furthermore interaction-specific private-key computation from ZK computation on multiple sensor inputs immediately prior to undertaking challenge-response interaction; execution of ZK computations with private-key inputs in interior of the signer component (102), so as to be not feasibly observable on the computing platform exterior thereof; encrypted transmission of ZK computation outcomes with private-key inputs to the designated verifier component (104) instance, via transmission from the proximate transaction originator on same platform to the corresponding transaction processor; and presentment only of ZK computation outcomes assessed to be correct, subsequent to decryption and verification by applicable the verifier instance, to the transaction processor of interest, at conclusion of challenge-response interaction. Still another aspect of the invention provides that the establishment of trust prior to engagement in challenge-response interaction, for the originator component and the processor component of the third-party transaction system, comprising: issue of PKC certificate, by designated trusted-third party, TTP, to be inserted into originator component prior to download and installation by the user of interest on associated the computing platform, on which the signer component (102) is also installed, such certificate comprising:

information comprising at least originator component name, origin and other information as required by the computing platform to mediate request to the signer component (102) for initiation of challenge-response interaction; validity limitations of certificate, comprising at least time interval; and TTP signature on information within certificate; insertion of root TTP public- key into the signer component (102), so as to enable validation of presented originator certificate and request, to be assessed prior to signer initiation of interaction; issue of certificate, by designated TTP, to be configured in accordance with processor component prior to commencement of any interaction; such certificate comprising: information comprising at least processor component domain name or network address as required by processor to engage in mutual authentication with designated the verifier component (104) instance, prior to any request to verifier for continuation of challenge-response interaction as initiated by the signer of interest; validity limitations of certificate, comprising at least time interval; public-key associated with the processor component, as corresponding to private-key similarly associated; and TTP signature on information within certificate; configuration of root TTP public-key in accordance with the verifier component (104), so as to enable validation of presented processor certificate and request, to be assessed prior to verifier continuation of interaction. Another aspect of the invention provides that the signer component (102) submission of PKC Certificate Signing Request, CSR to third-party registration framework comprising registration application installed and operating on the computing platform of interest, and corresponding registration server, such registration process comprising collation by a registration application of information pertaining to user of interest as required; request by the registration application to the proximate signer component (102), and conditional accession thereof, to initiate challenge-response interaction with the verifier component (104) associated with corresponding server; transmission by the registration application to a processing server of information of interest to registration process, as initiation of challenge-response interaction; assessment at registration server of information of interest; request by the registration server to the associated verifier component (104) to continue challenge-response interaction, if such assessment is positive, and conditional accession thereof; transmission by the registration server to originating application, as continuation of challenge-response interaction; request by the registration application to initiating signer, to conclude challenge response interaction; presentment on the signer user interface, Ul of verified registration information, to user of interest; assessment by the user as to whether to continue with registration of interest; initial computation within signer of signer-specific private-key and corresponding public-key, if such assessment is positive; collation by the signer of Certificate Signing Request, CSR, comprising at least registration information of interest; validity limitations of CSR, comprising at least time interval; signer-associated public-key, as presently computed; and signature computed on information within CSR, via input of private-key, as presently computed; computation by the signer of encrypted reciprocation containing CSR, and subsequent presentment to the registration application; transmission by the registration application to the processing server, and subsequent presentment to the responding verifier of encrypted reciprocation; decryption and assessment by the verifier of reciprocation and CSR therein; and presentment of CSR by the verifier to the registration server, if such assessment is positive, to conclude challenge- response interaction. A further aspect of the invention provides that the insertion into the signer component (102) of PKC certificate issued by third-party certification framework comprising a certification application installed and operating on the computing platform of interest, and a corresponding certification server; such framework either integrated into or externally associated with framework undertaking preceding registration process; with such certification process comprising: notification of the certification application by corresponding server, that certificate associated with previously submitted CSR, and as signed by designated TTP, has been issued; request by the certification application to proximate the signer component (102), and conditional accession thereof, to initiate challenge-response interaction with the verifier component (104) associated with corresponding server; transmission by the certification application to processing server of GSR information required for retrieval of corresponding certificate, as initiation of challenge-response interaction; assessment at the certification server of GSR information of interest; request by the certification server to the associated verifier component (104) to continue challenge-response interaction, if such assessment is positive, and conditional accession thereof; computation by the verifier of response containing certificate, and subsequent presentment to certification server; transmission by the certification server to originating application, as continuation of challenge-response interaction; request by the certification application to initiating signer, to conclude challenge response interaction; presentment on the signer Ul of certificate as issued, to user of interest; assessment by the user as to whether to acknowledge certification of interest; collation by the signer of certificate acknowledgement, comprising at least: GSR and certificate information of interest; Signature computed on information within acknowledgement; and presently received certificate, as contains public-key corresponding to private-key used to compute presently computed signature; storage of certificate within the signer, for subsequent inclusion in subsequent transaction-specific signatures; computation by the signer of encrypted reciprocation containing acknowledgement, and subsequent presentment to certification application; transmission by the certification application to the processing server, and subsequent presentment to the responding verifier of encrypted reciprocation; decryption and assessment by the verifier of reciprocation and acknowledgement therein; and presentment of acknowledgement by the verifier to registration server, if such assessment is positive, to conclude challenge-response interaction. Yet another aspect of the Invention provides that the transaction signing and requests thereof, as undertaken within context of a challenge response interaction, as originated and processed within third-party transaction framework comprising a transaction application installed and operating on the computing platform of interest, and a corresponding transaction server; with such transaction signing process comprising: request by the transaction application to the proximate signer component (102), and conditional accession thereof, to initiate challenge- response interaction with the verifier component (104) associated with corresponding server; transmission by the transaction application to the processing server of transaction-specific information to be signed, as initiation of challenge-response interaction; assessment at the transaction server of information to be signed; request by the transaction server to the associated verifier component (104) to continue challenge-response interaction, if such assessment is positive, and conditional accession thereof; computation by the verifier of response containing transaction information, and subsequent presentment to the transaction server; transmission by the transaction server to originating application, as continuation of challenge-response interaction; request by the transaction application to the initiating signer, to conclude challenge response interaction; presentment on the signer Ul of transaction information as verified, to the user of interest; assessment by the user as to whether to sign transaction of interest; collation by the signer of signing package, comprising at least transaction information of interest; signature computed on information within signing package; and previously issued certificate, as retrieved from storage; computation by the signer of encrypted reciprocation containing signing package, and subsequent presentment to the transaction application; transmission by the transaction application to the processing server, and subsequent presentment to the responding verifier of encrypted reciprocation; decryption and assessment by the verifier of reciprocation and signing package therein; and presentment of signing package by the verifier to the transaction server, if such assessment is positive, to conclude challenge-response Interaction; and as furthermore enables subsequent verification of signing package, by any party in receipt thereof.

Still another aspect of the invention provides that the conclusion of challenge response interaction as undertaken on transaction interface external to the computing platform of interest, with a local channel between such off-platform interface and on-platform transaction application for the challenge-response interaction between the signer component (102) and the verifier component (104) comprising interaction initiation on signer component (102) via PKC computation; response to initiation on verifier component (104) via PKC computation; reciprocation to response on signer via PKC computation, if the local channel is of sufficient data capacity; or alternatively reciprocation via additional Secret-Key Cryptography, SKC computation with further output truncation, if the local channel is of constrained capacity.

A further aspect of the invention provides a system for establishment of security condition via challenge-response interaction between signer component (102) and a verifier component (104) of security framework wherein the challenge-response interaction is based on public key Cryptographic, PKC computations between the signer component (102) and the verifier component (104) comprising Public Key Cryptographic, PKC framework as basis for ZK relationship between input pre-element and output element, such that: component instance of interest is associated with PKC key-pair, with component-associated public-key as designated credential; component instance undertakes computation of PKC key-pair specific to challenge- response interaction of interest, with interaction-specific public-key as challenge; protection of any and all private-keys from exposure external to associated component; security establishment element computed on received challenge with interaction-specific private-key as input, as resulting from Authenticated Key Establishment, AKE computation; and authenticator element computed on received challenge with component-specific private-key as input, as also resulting from AKE computation.

Another aspect of the invention provides the system for establishment of trust framework prior to engagement in challenge-response interaction, for originator application and processor server of a third-party transaction system, comprising one or more originator applications, each with inserted Public-Key Cryptography, PKC certificate as issued by respective Trusted Third-Party, TTP, as installed by a user of interest on an associated computing platform, as subsequently presented to a proximate signer component (102) as also installed on platform of interest; and one or more processor servers, as corresponds to each originator application, each configured with PKC certificate as issued by respective TTP, as subsequently presented to designated verifier component (104). A further aspect of the invention provides the system for transaction signing and requests thereof, with transaction application undertaking collation of information originating from sources external to a computing platform of interest, comprising origination of transaction information external to a computing platform on which a transaction application and a signer component (102) are installed and operating; transmission of information of interest on particular channel of interest; such channels inclusive of visual channel, as transmitted to camera integrated into platform of interest; audio channel, as transmitted to integrated microphone; radio frequency, RF channel, as transmitted to applicable receiver; and network channel, as transmitted from applicable transaction server to application of interest; with subsequent collation and processing on transaction application; subsequent to undertaking request to proximate signer component (102), to initiate challenge-response interaction.

Yet another aspect of the invention provides the system for conclusion of challenge-response interaction on transaction interface external to the computing platform of interest, comprising presentation of interaction reciprocation on on-platform transaction application in form suitable for transmission on applicable local channel, to off-platform receiver; such presentations and receivers inclusive of: visual presentation on platform display, to off-platform camera; audio presentation on platform speakers, to off-platform microphone; radio frequency, RF presentation on a platform transmitter, to off-platform receiver; and symbolic presentation on platform display, for transcription by a user of interest, to off-platform keyboard.

The present invention consists of features and a combination of parts hereinafter fully described and illustrated in the accompanying drawings, ft being understood that various changes in the details may be made without departing from the scope of the invention of sacrificing an of the advantages of the present invention .

BRIEF DESCRIPTION OF ACCOMPANING DRAWINGS

To further clarify various aspects of some embodiments of the present invention, a more particular description of the invention will be rendered by references to specific embodiments thereof, which are illustrated In the appended drawings. It is appreciated that these drawings depict only typical embodiments of the invention and are therefore not to be considered limiting of its scope. The invention will be described and explained with additional specificity and detail through the accompanying drawings.

FIG. 1.0 illustrates a general architecture of the system of the present invention which comprises of at least one signer component and at least one verifier component.

FIG. 1.0a illustrates the components which resides within the at least one signer component.

FIG. 1.0b illustrates the components which resides within the at least one verifier component.

FIG. 2.0 0 is a flowchart illustrating the general methodology of the present invention for transaction signing on a secure framework.

FIG. 2.0a illustrates the basic flow diagram of the present invention for security framework for transaction signing.

FIG. 2.0b illustrates the flow diagram for security framework for transaction signing with client- side adaption.

FIG. 3.0 is a flowchart Illustrating the steps involve in establishing trust between the third party transaction originator at the client-side and the third party transaction processor at the server- side.

FIG. 4.0 is a flowchart illustrating the step involves in inserting the root certificate TPP public- key into the at least one signer component.

FIG. 5.0 ts a flowchart illustrating the steps involves in issuing the certificate by the designated TTP for configuration with the third-party transaction processor. FIG. 6.0 is a flowchart illustrating the steps involves in establishing security conditions via challenge-response interaction between the at least one signer component and the at least one verifier component. FIG. 7.0 is a flowchart illustrating further steps involves within the challenge-response interaction in FIG 6.0 for the ZK computation between the at least one signer component and the at least one verifier component by utilizing PKC framework.

FIG. 8.0 is a flowchart illustrating the steps Involves in executing ZK computation on an input pre-element for generating an output element by utilizing PKC framework.

FIG. 9.0 is a flowchart illustrating the steps involves in protecting any and all private key from exposure external to the at least one signer component or the at least one verifier component. FIG. 10.0 is a flowchart illustrating the steps involves in computing private key specific to the at least one signer component.

FIG. 11.0 is a flowchart illustrating the steps involve in the ZK computation for submitting the PKC certificate signing request to third party registration framework.

FIG. 12.0 is a flowchart for insertion of PKC certificate issued by third party certification framework into the at least one signer component.

FIG. 13.0 is a flowchart illustrating transaction signing and request thereof as originated and processed within third party transaction framework.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The present invention relates to a system and method for transaction signing and identification management of a secure framework. In particular the present invention provides transaction signjng to be completed by utilizing a challenge-response interaction and a zero-knowledge (ZK) computation. The secure framework for the transaction signing comprises of interaction and communication between two main components namely signer component and verifier component. Thereinafter, it is to be understood that limiting the description to the preferred embodiments of the invention is merely to facilitate discussion of the present invention and it is envisioned without departing from the scope of the appended claims.

Reference is first made to FIG. 1.0, FIG. 1.0a and FIG. 1.0b; FIG. 1.0 illustrates the general architecture of the system of the present invention. As illustrated in FIG. 1.0, the system (100) of the present invention comprises a signer component (102) and a verifier component (104). FIG. 1 ,0a further illustrates in detail the signer component (102) while FIG. 1.0b illustrates the verifier component (104) in detail. As illustrated In FIG. 1.0, the system (100) of the present invention for a secure framework for transaction signing comprises at least one signer component (102) at a client-side for undertaking interaction with the off-platform module (106a) element, inclusive of browser, point-of-sale (POS) terminal and internet of things (IOT) element through local communications channel and at least one verifier component (104) at a server-side for verifying correctness of signature from client-side extension with respect to transaction of interest. The at least one signer component (102) is a client-side extension and the at least one verifier component (104) is a server-side extension. As illustrated in FIG 1 0a, at the client-side extension, the signer component (102) further comprises a third-party transaction originator (102a), a signer instance (104a) and off-platform (106a). The at least one signer component (102) is installed on a machine readable platform which associated with a user of interest, wherein the machine readable platform is preferably but not limited to a mobile device. The at least one signer component (102) acts as an application or a component which operates on the mobile device.

The third-party transaction originator (102a) interacts with the off-platform system (106a) element through a local communication channel either a high-capacity local channel or a low- capacity local channel. Further, the local communication channel for the third-party transaction originator (102a) and the off-platform system (106a) is preferably but not limited to a radio- frequency (RF) whereby wireless electromagnetic signal is used as a form of communfcation. Additionally, the local communication channel may also include a visual channel wherein the communication and interaction is achieved by inputting and displaying visuals such as text, picture, video and etc,, or an audio channel wherein the communication may be achieved by inputting and transmitting sound such that is audio signal. The communication channel may also include a network channel for transmission and transaction between the client-side extension and server-side extension. In addition, the instrument used in order for the said communication and interaction comprising an at least one off-platform camera for receiving visual representation from at least one on-platform display, at least one off-platform microphone for receiving audio presentation from at least one on-platform speaker, at least one off-platform receiver for receiving radio-frequency from at least one on-platform transmitter and at least one off-platform keyboard for transcription by the user for symbolic presentation. Furthermore, as illustrated in FIG. 1.Ob, the verifier component (104) comprises of a third-party transaction processor (102b), a verifier instance (104b) and a web redirecting server (106b). The communication and interaction between the third-party transaction processor (102b) and the verifier instance (104b) is through the web directing server. Reference is now made to FIG. 2.0, FIG. 2.0a and FIG. 2.0b. FIG. 2.0 is a flowchart illustrating the general methodology of the present invention for providing security framework for transaction signing (200). As Illustrated in FIG 2.0, the methodology of the present invention is initiated by first establishing trust between the third-party transaction originator (102a) at the client-side and a third-party transaction processor (102a) at the server-side (202). Subsequently, the method further continues by establishing security conditions via challenge- response interaction between the at least one signer component (102) and the at least one verifier component (104) (204). The methodology of the present invention is further illustrated in the FIG. 2.0a and FIG. 2.0b in detailed. FIG. 2.0a illustrates the basic flow diagram of present invention for security framework for transaction signing while FIG 2.0b illustrates the flow diagram for security framework for transaction signing with client-side adaption. FIG 2.0a and FIG. 2.0b is described comprehensively in the following description.

Reference is now made to FIG. 3.0 which is a flowchart illustrating the steps involve in establishing trust between the third-party transaction originator (102a) at the client-side and the third-party transaction processor at the server-side (102b) (300). The trust establishment is initiated first by issuing a public-key cryptography (PKC) certificate by a designated trusted party (TTP) to the third-party transaction originator (102a) (302). The TTP acts as an entity enabling the communication and interaction between the third-party transaction originator (102a) and the third-part transaction processor (102b) as trust to secure the interaction and communication. Subsequent to the issuance of the PKC certificate, the user of interest further downloads and installs the PKC certificate on the same computing platform where the signer component is installed. The PKC certificate issued by the designated TTP contains several information for establishing trust which is an information comprising of at least third-party transaction originator name, origin and other information as required by the computing platform in order to mediate request to the at least one signer component (102) for the initiation of the challenge-response interaction; The PKC certificate also contains validity limitations of the said PKC certificate wherein the validity limitations comprising at least time interval and a TTP signature on information within the certificate.

The method of establishing trust further resumes with inserting a root certificate TPP public- key into the at least one signer component (102) (304) in order to enable assessment for validation of a request and a certificate which will be presented by the third-party transaction originator (102a) prior to the commencement to any challenge-response interaction. Subsequently, the designated TTP further issues a certificate to be configured in accordance with the third-party transaction processor (102b) (306) prior to the commencement of any challenge-response interaction. The certificate issued by the designated TTP to the third-party transaction processor (102b) comprises an information comprising of at least third-party transaction processor (102b) domain name or network address requires by processor for engaging in mutual authentication with the verifier instance (104b) prior to any request made to the verifier component (104) for continuation of challenge-response interaction as initiated by the signer component. The certificate further comprises validity limitations of certificate comprising of at least time interval, public-key associated with the third-party transaction processor (102b) as corresponding to private-key similarly associated and a TTP signature on information within certificate. The last step involve in establishing trust between the third-party transaction originator (102a) at the client-side and the third-party transaction processor at the server-side (102b) is configuring a root certificate TTP public-key in accordance with the verifier component (104) (308) in order to enable validation of a request and certificate which will be presented by the third-party transaction processor (102b) prior to continuation of interaction at the server-side extension. The said root certificate mentioned earlier is similar to the PKC certificate. Reference is now made to FIG. 4.0 and FIG. 5.0. FIG. 4.0 is a flowchart illustrating the step involves in inserting the root certificate TTP public-key into the at least one signer component (102) (304). The root certificate TTP public-key is inserted into the third-party transaction originator (102a) of the at least one signer component (102) first by inserting the PKC certificate issued by the designated TTP into one or more originator applications (402) as installed by the user on associated computing platform. Subsequently after the insertion of the PKC certificate into originator applications, the PKC certificate is presented to the at least one signer component (102) which has been installed in the corresponding computing platform of interest (404>. Fig. 5.0 is a flow chart illustrating the steps involves in issuing the certificate by the designated TTP for configuration with the third-party transaction processor (306). The PKC certificate issued by the designated TTP is first configured to one or more processor server (502) as corresponds to each originator application. Subsequent to the configuration of the PKC certificate, the PKC certificate is then presented to the verifier component (104) (504),

Reference is now made to FIG: 6.0. FIG. 6.0 is a flowchart illustrating the steps involves in establishing security conditions via challenge-response interaction between the at least one signer component (102) and the at least one verifier component (104). First, the third transaction originator (102a) sends a transaction request to a signer instance (104a) in order to initiate such interaction with the verifier instance to be specified (602). Then, the method continues with the signer instances (104a) assessing the said transaction request (604) prior to computing randomized challenge on the signer instance (104a) only if the assessment result is positive (606). Next, the computed randomized challenge is presented to the third-party transactibn originator (102a) (608) prior to transmitting the challenge to the third-party transaction processor (102b) for signing (610). The third party transaction processor (102b) further submits the challenge as the request to proceed with transaction interaction to the verifier instance (104b), or other designated instance (612) and subsequently the verifier instance (104b) assesses the request for authorization (614), The verifier instance (104b) further computes a response and subsequently generates an authenticator based on the response computed if the assessment result is positive. The response comprises at least a verifier credential, the received challenge, a randomized reciprocal challenge and information of the transaction (616). Upon generating the authenticator by the verifier instance (104b), the computed authenticator is presented to the third party transaction processor (102b) (618). The third party transaction processor (102b) further furnishes a reciprocal transmission of the computed authenticator to the third party transaction originator (102a) (620). Next, the third party transaction originator (102a) continues with sending a request of the computed authenticator to the signer instance (104a) (622) and the signer instance (104a) further assess the verifier response (104a) (624).

The transaction information is then presented to the user if the said assessment is positive (626). The user further assesses the transaction information presented by the signer instance (104a) and enables further computations for transaction signing and reciprocal response if the assessment by the user is positive (628). Thereafter, the signer instance (104a) further computes a signature on the transaction information received (630) prior to computing and encrypting a reciprocal response (632), The reciprocal response having at least signer credentials, as may be irrefutably verified, an originating challenge, as issued by the signer instance (104a), a received challenge, as issued by verifier, a transaction-specific signature, as presently computed, the authenticator computed on pair of corresponding challenges and the transaction signature, as can be irrefutably verified by verifier. The computed signature and the encrypted reciprocal response are then presented to the third party transaction originator (102a) and the user (634). The encrypted reciprocal response is further transmitted to the transaction interface prior to forwarding the said encrypted reciprocal response to the third party transaction processor (102b) (636). Subsequently, the third party transaction processor (104b) submits the encrypted reciprocal response to the verifier instance (104b) (638). The verifier instance (104b) further decrypts the encrypted reciprocal response and assesses the transaction signature (640). Finally, the transaction signature status is presented to the third party transactibn processor (102b) if the assessment result is positive (642) prior to presenting the status of the transaction signature to the third party transaction originator (102a) (644).

Reference is now made to FIG. 7.0. FIG. 7.0 illustrates further step involves within the challenge-response interaction in FIG 6.0 for the ZK computation between the at least one signer component (102) and the at least one verifier component (104) by utilizing PKC framework. The method starts with execution of ZK computation on an input pre-element for generating an output element (702), wherein the said pre-element cannot be feasibly derived from corresponding element. The ZK computation further executed on a pre-credential element for generating credential element associated with the signer instance (104a) (704) and the ZK computation further executed on a pre-challenge element for generating challenge element as issued by the verifier instance (104b) (706). Subsequently, the pre-credential and pre-challenge element are protected from exposure external to associated component (708). Further, a security establishment element is computed in response to the received challenge, as derived from equivalent ZK computation on such received challenge with interaction- specific pre-challenge as input for enabling subsequent encryption of transmitted outputs from the at least one signer component (102) or the at least one verifier component (104) which has undertaken computation, such that only the component undertakes reciprocal computation within challenge-response interaction of interest is able to undertake corresponding decryption of received inputs (710). Finally, an authenticator element is also computed in response to the received challenge, as derived from equivalent ZK computation on such received challenge with component-associated pre-credential as input for enabling subsequent authentication of transmitted outputs from the at least one signer component (102) or the at least one verifier component (104) which has undertaken computation, such that only component undertaking reciprocal computation within challenge-response interaction of interest is able to undertake corresponding verification of received Inputs (712).

Reference is now made to FIG. 8.0. FIG. 8.0 is a flowchart illustrating the steps involves in executing ZK computation on an input pre-element for generating an output element by utilizing PKC framework. The steps comprising associating the signer instance (104a) or the verifier instance (104b) with PKC key-pair and TTP public key as designated credential (802) and computing PKC key-pair specific to the challenge-response interaction undertaken by the at least one signer component (102) or the at least one verifier component (104) with TTP public key as the challenge (804). The steps further comprising protecting any and all private key from exposure external to the at least one signer component (102) or the at least one verifier component (104) (806). Subsequently, the security establishment element is computed on received challenge with Interaction-specific private-key resulting from authenticated key establishment (AKE) computation as input (808). Lastly, the authenticator element is computed on received challenge with component-specific TTP private-key resulting from AKE computation as input.

Reference is now made to FIG. 9.0 and FIG. 10.0. FIG. 9.0 is a flowchart illustrating the steps involves in protecting any and all private key from exposure external to the at least one signer component (102) or the at least one verifier component (104) while FIG. 10.0 I a flowchart illustrating the steps involves in computing private key specific to the at least one signer component (102). First, component-specific private-key is computed from ZK computation on multiple inputs immediately prior to transaction signing (902); wherein the computation of the private-key further comprising identifying element uniquely associated with the machine readable platform of interest and subsequently read from platform (1002) and subsequently read form platform, computing a random element (1004) immediately prior to initial instance of such private-key computation from ZK computation on multiple sensor inputs on platform of interest (1006), storing the random element on the machine readable platform (1008) computing user-contributed element from ZK computation on user action undertaken on the at least one signer component (102) user interface (1010) as undertaken prior to transaction signing, and subsequently computing private keys from ZK computation on multiple sensor inputs prior to undertaking challenge-response interaction (1012).

Upon computing the private key, it is followed by executing ZK computation with private key inputs in the interior of the at least one signer component (102) (904) in order to not be feasibly observable on machine readable platform exterior thereof prior to encrypting transmission of ZK computation outcomes with private key inputs to the verifier instance (104b) (906) through transmission from the third party transaction originator (102a) on the same machine readable platform to the corresponding third party transaction processor (102b). The ZK computation outcomes is further decrypted and verified by the verifier instance (104b) (908) prior to presenting the said outcome to the third party transaction processor (102b) (910).

Reference is now made to FIG. 11 ,0. FIG. 11.0 illustrates the steps involved in ZK computation for submitting the PKC certificate signing request to third party registration framework. Initially, a registration application is installed and further operated on the machine readable platform of interest and a registration server for submission of said PKC certificate signing request to the third party registration framework (1102), The steps further comprising collating information related to user by the registration application (1104), requesting to initiate challenge-response interaction with the at least one verifier component (104) associated with the registration server (1106) and transmitting initiation of challenge-response interaction (1108). The steps are continue with assessing information at the registration server (1110) and requesting to continue the challenge-response interaction by the registration server to the at least one verifier component (104) if prior assessment of information is positive (1112) prior to transmitting continuation of the challenge challenge-response interaction by the registration server to the registration application (1114). Then, the registration application requests to conclude the challenge-response interaction to the at least one signer component (102) (1116) before presenting verified registration information to the user through the at least one signer component (102) user interface (1118). The user further assesses for continuation of registration by the user (1120) before computing private key and public key within the at least one signer component (102) if the prior assessment is positive (1122). Further, the at least one signer component (102) collates the certificate signing request (1124) and computes an encrypted reciprocation of certificate signing request (1126) prior to presenting the encrypted reciprocation to the registration application (1128). The encrypted reciprocation is further transmitted to processing server by the registration application (1130) and subsequently presented to the at least one verifier component (104) (1132). The at least one verifier component further decrypts and assesses the encrypted reciprocation and certificate signing request (1134). The certificate signing request is finally presented to the to the registration server if the prior assessment is positive, said certificate signing request having at least registration information of interest, validity limitations of certificate signing request comprising at least time interval, the public key as computed within the singer component, and signature computed on information within certificate signing request through input of the private key as computed within the at least one signer component (102) (1136). Reference is now made to FIG. 12.0. FIG. 12.0 is a flowchart for insertion of PKC certificate issued by third party certification framework into the at least one signer component. Initially,, certificate application is installed and further operated on the machine readable platform of interest and a certification server for insertion of PKC certificate issued by third party certification framework, wherein such framework is either integrated into or externally associated with framework undertakes preceding registration (1202) as describe for FIG. 11 .0. The steps further continue with notifying issuance of certificate by certification server (1204) prior to requesting to initiate challenge-response interaction with the at least one verifier component (104) associated with the certification server to the at least one signer component (102) (1206). The certificate signing request information is then transmitted by the certification application to processing server for retrieval of corresponding certificate (1208) and the certification server further assesses the certificate signing request (1210), The certification server then requests to continue the challenge-response interaction to the at least one verifier component (104) if the prior assessment is positive (1212). The verifier component (104) computes response comprising certificate (1214) and presents the said response to the certification server (1216) prior to transmitting the said response to certification application (1218).

The certification application further request to conclude challenge-response interaction to the at least one signer component (102) (1220) prior to presenting certificate as issued to the user through the at least one signer component (102) user interface (1222) for further assessment for acknowledgment of certification on interest (1224). The at least one signer component further collates certificate acknowledgement wherein the certificate acknowledgement having at least certificate signing request and certificate information of interest, signature computed on information within acknowledgement; and received certificate comprising public key corresponding to private key, and presently received certificate, as contains public key (1226). The certificates is then stored within the at least one signer component (102) for subsequent inclusion in subsequent transaction specific signatures (1228). The at least one signer component (102) computes encrypted reciprocation comprising an acknowledgement (1230) and presents the encrypted reciprocation to the certification application (1232) prior to transmitting the encrypted reciprocation to processing server (1234). Then, the encrypted reciprocation is presented to the at least one verifier component (104) (1236). The at least one verifier component (104) further decrypts and assesses the encrypted reciprocation and the acknowledgement (1238). Finally, the acknowledgement is presented to registration server through the at least one verifier component (104) if the prior assessment is positive (1240). Reference is now made to FIG 13,0. FIG, 13.0 is a flowchart illustrating transaction signing and request thereof as originated and processed within third party transaction framework. First, transaction application is installed and further operated on the machine readable platform of interest and correspond transaction server. After transaction application is installed, the step further continues by requesting to initiate challenge-response interaction with the at least one verifier component (104) associated with the transaction server to the at least one signer component (102) (1304) prior to transmitting transaction information to be signed to processing server through transaction application as initiation of challenge-response interaction (1306). The transaction information is further assesses at the transaction server (1308) prior to requesting to continue challenge-response interaction to the at least one verifier component (104) ff the prior assessment is positive (1310). The at least one verifier component (104) further computes response comprising transaction information (1312) and presents the said response to the transaction server (1314) . prior to transmitting the said response to transaction application (1316).

The step further continues by requesting to conclude challenge-response interaction to the at least one signer component (102) through the transaction application (1318) and presenting verified transaction information to the user on the at least one signer component (102) user interface (1320) prior to assessing for signing the verified transaction by the user (1322). The at least one signer component (102) further collates signing package wherein the signing package having at least transaction information of interest, signature computed on information within signing package and issued certificate, as retrieved from storage (1324). Next, the at least one signer component (102) computes encrypted reciprocation comprising signing package (1326) and presents the encrypted reciprocation to transaction application (1328) prior to transmitting the encrypted reciprocation to processing server (1330). The encrypted reciprocation is then presented to the at least one verifier component (104) (1332). The at least one verifier component (104) further decrypts and assesses the encrypted reciprocation and the signing package prior to presenting signing package to transaction server if the prior assessment is positive (1336).

The present invention relates to a system and methods for transaction signing and identification management on a secure framework comprising an establishment of trust between the third party transaction originator (102a) at the client-side and the third party transaction processor (102b) at the server side, Subsequent to the establishment of trust between the client-side extension and server-side extension, the framework further comprises establishment of security conditions via challenge-response interaction between the at least signer component (102) and the at least one verifier component (104). The establishment of security conditions comprising signer-to-verifier challenge, verifier-to-signer response, signer- to-verifier reciprocal response, on client-side transaction interface, through high-capacity local channel such as through protocol data unit (PDU) of interest Bluetooth, barcode or V-series encoding; or alternatively on low-capacity channel, via Hash-based Message Authentication Code (HMAC) computation and truncation thereof as well as manual transcription of shortcode reciprocal response.

Unless the context requires otherwise or specifically stated to the contrary, integers, steps or elements of the invention recited herein as singular integers, steps or elements clearly encompass both singular and plural forms of the recited integers, steps or elements.

Throughout this specification, unless the context requires otherwise, the word“comprise", or variations such as“comprises" or“comprising", will be understood to imply the inclusion of a stated step or element or integer or group of steps or elements or integers, but not the exclusion of any other step or element or integer or group of steps, elements or integers. Thus, in the context of this specification, the term "comprising" is used in an inclusive sense and thus should be understood as meaning“including principally, but not necessarily solely”.

Claims

1 . A method for establishment of security condition via challenge-response interaction between a signer component (102) and a verifier component (104) of security framework comprising:

request by a third-party transaction originator to proximate a signer instance, to initiate such interaction with a particular verifier instance to be specified;

assessment of such request by the signer instance of interest;

computation of randomised challenge by the signer instance, if such assessment is positive;

presentment by the signer instance to a transaction originator of presently issued challenge;

transmission by requesting originator to corresponding a transaction processor of transaction to be signed, and furthermore signer-issued challenge, as presently associated with transaction of interest;

request by a third-party processor to proximate the verifier instance to proceed with interaction of interest;

assessment of such request by the verifier instance of interest;

computation of response by the verifier instance, if such assessment is positive, such response comprising at least:

verifier credential, as can be irrefutably verified;

received challenge, as issued by the signer;

randomised reciprocal challenge, as presently issued;

information associated with transaction, for subsequent presentment to user of interest as associated with the signer; and authenticator computed on pair of corresponding challenges, and furthermore transaction information, as can be irrefutably verified by the signer;

presentment by the verifier instance to the transaction processor of verifier credential and response;

reciprocal transmission by the transaction processor to requesting originator of verifier credential and response;

request by the originator to the signer instance, to continue with interaction of interest; assessment of verifier response by the signer instance of interest;

presentment of transaction information as authenticated by verifier to user of interest, if such assessment is positive;

assessment by a user as to whether to continue with signing on transaction presented; user action to enable computations for transaction signing and reciprocal response, if such assessment is positive;

computation of signature on transaction information presented, by the signer instancy; computation of reciprocal response by the signer instance, such reciprocation comprising at least:

signer credential, as can be irrefutably verified;

originating challenge, as previously issued by the signer;

received challenge, as issued by the verifier;

transaction-specific signature, as presently computed;

authenticator computed on pair of corresponding challenges, and furthermore transaction signature, as can be irrefutably verified by the verifier;

encryption computed on corresponding challenges, transaction signature and reciprocal authenticator, as can be recovered exclusively by the verifier;

presentment by the signer instance to the transaction originator of signer credential and encrypted reciprocation;

concluding transmission by requesting originator to the transaction processor of signer credential and reciprocation;

request by the transaction processor to the verifier instance, to conclude interaction of interest;

decryption of signer reciprocation, and assessment thereof by the verifier instance; assessment by the verifier of transaction signature; and

presentment of transaction signature by the verifier instance to the transaction processor, if such assessment is positive.

2. The method according to claim 1 , wherein challenge-response interaction between the signer component (102) and the verifier component (104) comprising;

Zero Knowledge, ZK computation on input pre-element resulting in output element, such that pre-element cannot be feasibly derived from corresponding element;

credential element as associated with component instance, as derived from such ZK computation on previously computed pre-credential;

challenge element as issued by component instance, as derived from such ZK computation on previously computed pre-challenge;

protection of pre-credential and pre-challenge elements from exposure external to associated component; security establishment element computed in response to received challenge, as derived from equivalent ZK computation on such received challenge with interaction- specific pre-challenge as input, enabling subsequent encryption of transmitted outputs from component undertaking computation, such that only component undertaking reciprocal computation within challenge-response interaction of interest is able to undertake corresponding decryption of received inputs; and

authenticator element computed in response to received challenge, as derived from equivalent ZK computation on such received challenge with component-associated pre-credential as input, enabling subsequent authentication of transmitted outputs from component undertaking computation, such that only component undertaking reciprocal computation within challenge-response interaction of interest is able to undertake corresponding verification of received inputs.

3. The method according to claim 2, further comprising private-key protection internal to the signer component (102), as installed on a computing platform previously associated with user of interest, and furthermore external thereof comprising:

component-specific private-key computation from ZK computation on multiple inputs immediately prior to transaction signing comprising:

identifying element uniquely associated with the computing platform of interest, and subsequently read from platform;

random element computed immediately prior to initial instance of such private-key computation from ZK computation on multiple sensor inputs on platform of interest and subsequently stored on platform; and user-contributed element from ZK computation on user action undertaken on component User Interface, Ul, as undertaken prior to transaction signing; and furthermore

interaction-specific private-key computation from ZK computation on multiple sensor inputs immediately prior to undertaking challenge- response interaction;

execution of ZK computations with private-key inputs in interior of the signer component (102), so as to be not feasibly observable on the computing platform exterior thereof;

encrypted transmission of ZK computation outcomes with private-key inputs to the designated verifier component (104) instance, via transmission from the proximate transaction originator on same platform to the corresponding transaction processor; and

presentment only of ZK computation outcomes assessed to be correct, subsequent to decryption and verification by applicable the verifier instance, to the transaction processor of interest, at conclusion of challenge-response interaction.

4. The method according to claim 2, further comprising establishment of trust prior to engagement in challenge-response interaction, for the originator component and the processor component of the third-party transaction system, comprising:

issue of public key cryptographic, PKC certificate, by designated trusted-third party, TTP, to be inserted into originator component prior to download and installation by the user of Interest on associated the computing platform, on which the signer component (102) is also installed, such certificate comprising:

information comprising at least originator component name, origin and other information as required by the computing platform to mediate request to the signer component (102) for initiation of challenge- response interaction;

validity limitations of certificate, comprising at least time interval; and TTP signature on information within certificate;

insertion of root TTP public-key into the signer component (102), so as to enable validation of presented originator certificate and request, to be assessed prior to signer initiation of interaction;

issue of certificate, by designated TTP, to be configured in accordance with processor component prior to commencement of any interaction; such certificate comprising:

information comprising at least processor component domain name or network address as required by processor to engage in mutual authentication with designated the verifier component (104) instance, prior to any request to verifier for continuation of challenge-response interaction as initiated by the signer of interest;

validity limitations of certificate, comprising at least time interval;

public-key associated with the processor component, as corresponding to private-key similarly associated; and

TTP signature on information within certificate;

configuration of root TTP public-key in accordance with the verifier component (104), so as to enable validation of presented processor certificate and request, to be assessed prior to verifier continuation of interaction.

5. The method according to claim 4, further comprising the signer component (102) submission of PKC Certificate Signing Request, CSR to third-party registration framework comprising registration application installed and operating on the computing platform of interest, and corresponding registration server, such registration process comprising collation by a registration application of information pertaining to user of interest as required;

request by the registration application to the proximate signer component (102), and conditional accession thereof, to initiate challenge-response interaction with the verifier component (104) associated with corresponding server;

transmission by the registration application to a processing server of information of interest to registration process, as Initiation of challenge-response interaction;

assessment at registration server of information of interest;

request by the registration server to the associated verifier component (104) to continue challenge-response Interaction, if such assessment is positive, and conditional accession thereof;

transmission by the registration server to originating application, as continuation of challenge-response interaction;

request by the registration application to initiating signer, to conclude challenge response interaction;

presentment on the signer user interface, Ul of verified registration information, to user of interest;

assessment by the user as to whether to continue with registration of interest;

initial computation within signer of signer-specific private-key and corresponding public-key, if such assessment is positive;

collation by the signer of Certificate Signing Request, CSR, comprising at least

registration information of interest;

validity limitations of CSR, comprising at least time interval;

signer-associated public-key, as presently computed; and

signature computed on information within CSR, via input of private-key, as presently computed;

computation by the signer of encrypted reciprocation containing CSR, and subsequent presentment to the registration application;

transmission by the registration application to the processing server, and subsequent presentment to the responding verifier of encrypted reciprocation;

decryption and assessment by the verifier of reciprocation and CSR therein; and presentment of CSR by the verifier to the registration server, if such assessment is positive, to conclude challenge-response interaction.

6. The method according to claim 5, further comprising submission into the signer component (102) of PKC certificate issued by third-party certification framework comprising a certification application installed and operating on the computing platform of interest, and a corresponding certification server, such framework either integrated into or externally associated with framework undertaking preceding registration process with such certification process comprising:

notification of the certification application by corresponding server, that certificate associated with previously submitted CSR, and as signed by designated TTP, has been issued;

request by the certification application to proximate the signer component (102), and conditional accession thereof, to initiate challenge-response interaction with the verifier component (104) associated with corresponding server;

transmission by the certification application to processing server of CSR information required for retrieval of corresponding certificate, as initiation of challenge-response interaction;

assessment at the certification server of CSR information of interest;

request by the certification server to the associated verifier component (104) to continue challenge-response interaction, if such assessment is positive, and conditional accession thereof;

computation by the verifier of response containing certificate, and subsequent presentment to certification server;

transmission by the certification server to originating application, as continuation of challenge-response interaction;

request by the certification application to initiating signer, to conclude challenge response interaction;

presentment on the signer Ul of certificate as issued, to user of interest;

assessment by the user as to whether to acknowledge certification of interest;

collation by the signer of certificate acknowledgement, comprising at least:

CSR and certificate information of interest;

Signature computed on information within acknowledgement; and presently received certificate, as contains public-key corresponding to private-key used to compute presently computed signature;

storage of certificate within the signer, for subsequent inclusion ih subsequent transaction-specific signatures; computation by the signer of encrypted reciprocation containing acknowledgement, and subsequent presentment to certification application;

transmission by the certification application to the processing server, and subsequent presentment to the responding verifier of encrypted reciprocation;

decryption and assessment by the verifier of reciprocation and acknowledgement therein; and

presentment of acknowledgement by the verifier to registration server, if such assessment is positive, to conclude challenge-response interaction.

7. The method according to claim 6, wherein transaction signing and requests thereof as undertaken within context of a challenge response interaction, as originated and processed within third-party transaction framework comprising a transaction application installed and operating on the computing platform of interest, and a corresponding transaction server; with such transaction signing process comprising:

request by the transaction application to the proximate signer component (102), and conditional accession thereof, to initiate challenge-response interaction with the verifier component (104) associated with corresponding server;

transmission by the transaction application to the processing server of transaction- specific information to be signed, as initiation of challenge-response interaction;

assessment at the transaction server of information to be signed;

request by the transaction server to the associated verifier component (104) to continue challenge-response interaction, if such assessment is positive, and conditional accession thereof;

computation by the verifier of response containing transaction information, and subsequent presentment to the transaction server;

transmission by the transaction server to originating application, as continuation of challenge-response interaction;

request by the transaction application to the initiating signer, to conclude challenge response interaction;

presentment on the signer Ul of transaction information as verified, to the user of interest;

assessment by the user as to whether to sign transaction of interest;

collation by the signer of signing package, comprising at least

transaction information of interest;

signature computed on information within signing package; and previously issued certificate, as retrieved from storage; computation by the signer of encrypted reciprocation containing signing package, and subsequent presentment to the transaction application;

transmission by the transaction application to the processing server, and subsequent presentment to the responding verifier of encrypted reciprocation;

decryption and assessment by the verifier of reciprocation and signing package therein; and

presentment of signing package by the verifier to the transaction server, if such assessment is positive, to conclude challenge-response interaction; and as furthermore enables

subsequent verification of signing package, by any party in receipt thereof.

8. The method according to claim 2, wherein conclusion of challenge response interaction as undertaken on transaction interface external to the computing platform of interest, with a local channel between such off-platform interface and on-platform transaction application for the challenge-response interaction between the signer component (102) and the verifier component (104) comprising

interaction initiation on signer component (102) via PKC computation;

response to initiation on verifier component (104) via PKC computation;

reciprocation to response on signer via PKC computation, if the local channel is of sufficient data capacity; or alternatively

reciprocation via additional Secret-Key Cryptography, SKC computation with further output truncation, if the local channel is of constrained capacity.

9. A system for establishment of security condition via challenge-response interaction between signer component (102) and a verifier component (104) of security framework, wherein the challenge-response interaction is based on Public Key Cryptographic, PKC computations between the signer component (102) and the verifier component (104) further comprising

Public Key Cryptographic, PKC framework as basis for zero-knowledge, ZK relationship between input pre-element and output element, such that:

component instance of interest is associated with PKC key-pair, with component-associated public-key as designated credential;

component instance undertakes computation of PKC key-pair specific to challenge-response interaction of interest, with interaction-specific public-key as challenge;

protection of any and all private-keys from exposure external to associated component; security establishment element computed on received challenge with interaction-specific private-key as input, as resulting from Authenticated Key Establishment, AKE computation; and

authenticator element computed on received challenge with component* specific private-key as input, as also resulting from AKE computation.

10. The system according to claim 9, further comprising the system for establishment of trust framework prior to engagement in challenge-response interaction, for originator application and processor server of a third-party transaction system, comprising

one or more originator applications, each with inserted Public-Key Cryptography, PKC certificate as issued by respective Trusted Third-Party, TTP, as installed by a user of interest on an associated computing platform, as subsequently presented to a proximate signer component (102) as also installed on platform of interest; and one or more processor servers, as corresponds to each originator application, each configured with PKC certificate as issued by respective TTP, as subsequently presented to designated verifier component (104).

11. The system according to claim 10, further comprising the system for transaction signing and requests thereof as undertaken within the challenge response interaction, with transaction application undertaking collation of information originating from sources external to a computing platform of interest, comprising:

origination of transaction information external to a computing platform on which a transaction application and a signer component (102) are installed and operating; transmission of information of interest on particular channel of interest; such channels inclusive of

visual channel, as transmitted to camera integrated into platform of interest;

audio channel, as transmitted to integrated microphone;

radio frequency, RF channel, as transmitted to applicable receiver; and network channel, as transmitted from applicable transaction server to application of interest;

subsequent collation and processing on transaction application;

request to proximate signer component (102), to initiate challenge- response interaction.

12. The system according to claim 9, further comprising the system for conclusion of challenge-response interaction on transaction interface external to the computing platform of interest, comprising:

presentation of interaction reciprocation on on-platform transaction application in form suitable for transmission on applicable local channel, to off-platform receiver; such presentations and receivers inclusive of:

visual presentation on platform display, to off-platform camera; audio presentation on platform speakers, to off-platform microphone;

radio frequency, RF presentation on a platform transmitter, to off-platform receiver; and

symbolic presentation on platform display, for transcription by a user of interest, to off-platform keyboard.