Document Verification via Hash Tree ID Augmentation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for verifying the authenticity of electronic documents face challenges such as key compromise in PKI-based systems, inefficiency in publication methods, and the need for trust in service providers or clock authorities, limiting scalability and reliability.

Innovation Solution

A keyless, distributed hash tree-based verification infrastructure that uses a client-gateway-aggregator-core architecture, allowing for scalable and trust-free authentication by recomputing hash values through a binary hash tree structure, enabling identification of entities involved in document registration without relying on cryptographic keys or trusted authorities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If PKI-based digital signature schemes are used to verify document authenticity, then cryptographic security is provided, but keys can be compromised over time making signatures unreliable

Engineering Contradiction:
Improveauthenticity verificationVSAvoidkey validity period
Core Design Contradiction:
ReliabilityVSDuration of action of stationary object

Solution Approach 1:

The patent extracts the cryptographic key from the authentication process entirely. Instead of using PKI-based digital signatures that require private keys, the system uses a keyless authentication mechanism where document authenticity is verified through cryptographic hash functions and Merkle tree structures. The authentication relies on publicly verifiable hash chains and Merkle proofs rather than private-key-based digital signatures, eliminating the key compromise vulnerability while maintaining security.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent changes the fundamental parameter of authentication from key-based cryptography to hash-based cryptography. By transitioning from asymmetric cryptographic pairs to symmetric hash function families, the system achieves unlimited key validity duration. The hash function parameters (such as the Merkle tree root hash) can be updated indefinitely without compromising past or future authentications, allowing documents to remain verifiable indefinitely even as system parameters evolve.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If publication methods are used for verification without cryptographic keys, then key compromise is avoided, but the system becomes inefficiently slow and unsuitable for large document collections

Engineering Contradiction:
Improvetrust-free verificationVSAvoidverification speed
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent segments the large document collection into a hierarchical Merkle tree structure where documents are organized in batches, with each batch represented by a Merkle root hash. This segmentation allows verification to occur at multiple levels: individual document verification uses only the relevant branch of the Merkle tree, while batch verification can validate multiple documents simultaneously. The segmentation enables parallel processing and reduces the computational burden compared to verifying each document individually through slow publication methods.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary computation of Merkle tree structures and publishes the root hashes in advance. This allows verification systems to be pre-configured with the authentication structure, enabling rapid verification of individual documents without requiring slow, sequential publication of verification data. The preliminary establishment of Merkle paths and the use of incremental updates allow for fast verification while maintaining the trust-free architecture.

Inventive Principle:
Principle #10Preliminary action

3Adaptability or versatility

If distributed hash tree-based infrastructure is used for verification, then scalability and trust-free authentication are achieved, but the inability to identify entities involved in document registration limits traceability

Engineering Contradiction:
ImprovescalabilityVSAvoidentity identification
Core Design Contradiction:
Adaptability or versatilityVSLoss of information

Solution Approach 1:

The patent embeds entity identification information within the Merkle tree structure itself by incorporating entity identifiers into the leaf nodes or internal nodes of the tree. This nesting allows the authentication structure to simultaneously provide scalability through its hierarchical organization and entity traceability through the embedded identifiers. The nested structure enables verification of both document authenticity and entity involvement without requiring separate identification systems.

Inventive Principle:
Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent designs the Merkle tree structure to serve multiple functions simultaneously: it provides the cryptographic authentication mechanism for scalability and trust-free verification, while also serving as an entity identification registry. By making the authentication structure multi-functional, the system eliminates the need for separate identification mechanisms and achieves both scalability and traceability through a single unified structure that can handle both authentication and entity tracking.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3031169B1Document verification with id augmentation
Publication Date: 2018.10.10 GUARDTIME SA
  • EP3031169B1 patent drawingFigure 1
  • EP3031169B1 patent drawingFigure 2
  • EP3031169B1 patent drawingFigure 3

AI summary

At least one node in a distributed hash tree document verification infrastructure (3000, 4000, 5000) is augmented with an identifier (ID1,..., IDm) of an entity in a registration path. A data signature (8000), which includes parameters for recomputation of a verifying value, and which is associated with a digital input record, will therefore also include data that identifies at least one entity in the hash tree path used for its initial registration in the infrastructure.