FIDO Remote Signature Binding for Qualified e-Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for creating remote electronic signatures, such as those using the FIDO protocol, do not provide a strong and unalterable link between the signer's FIDO authentication and their remotely stored signature key, failing to meet the level of trust required by regulations like eIDAS and draft standard prEN 419241-1:2017.
Innovation Solution
Associating a FIDO public key with a signature key within an electronic certificate, such as an X.509v3 certificate, to create a strong and secure link between the signer's identity and signing key, and using automated means to upload this information to a signature key database, ensuring high trust and compliance with regulatory standards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a whitelist is used to verify the consistency of FIDO authentication data and remotely stored signature key, then the verification process is simplified, but the link between authentication and signature key is not strong and unalterable
Solution Approach 1:
The patent introduces an electronic certificate as an intermediary element that mediates between FIDO authentication and remotely stored signature keys. The certificate contains both the FIDO public key and the remotely stored signature key, creating a trusted binding between them. This certificate acts as a mediator that provides both verification simplicity and strong unalterable linkage, resolving the contradiction between ease of operation and reliability.
2Productivity
If FIDO authentication is used for remote electronic signatures, then the authentication process is fast and user-friendly, but the legal value and trust level do not meet eIDAS regulation requirements
Solution Approach 1:
The patent merges FIDO authentication technology with traditional public key infrastructure (PKI) by combining the FIDO public key and remotely stored signature key within a single electronic certificate. This merging allows the system to maintain the speed and user-friendliness of FIDO authentication while simultaneously achieving the legal value and trust level required by eIDAS regulation through the certificate's binding mechanism.
Solution Approach 2:
The electronic certificate functions as a composite structure that integrates multiple cryptographic elements (FIDO public key, remotely stored signature key, and certificate authority signatures) into a single trusted artifact. This composite approach enables the system to leverage both the performance benefits of FIDO and the legal recognition of traditional PKI-based digital certificates.
3Device complexity
If the FIDO public key is directly associated with the signature key without a certificate, then the association process is simple, but the link is not secure and unalterable
Solution Approach 1:
The patent applies preliminary action by having a trusted certificate authority sign the electronic certificate in advance, binding the FIDO public key and remotely stored signature key together before they are used for authentication and signing operations. This pre-established binding ensures that when the association is later verified, the security and unalterability are already guaranteed by the certificate authority's digital signature, without adding complexity to the actual association process.
Data Source
Figure 1~3
Figure 4
Figure 5~6
AI summary
This is a process (1000 - 5000) for creating an electronic signature (98) remotely by a signer (72), comprising, by a signature server (34), the steps of: - calculating a digest of received data, by means of a hash function, so as to obtain a calculated digest; - decrypting a received signature value, so as to obtain a decrypted digest; - comparing the decrypted digest to the calculated digest, - if the decrypted digest is identical to the calculated digest, generating a signature of a document to be signed, by encryption, by means of a signing key of the signer, of a digest of the document to be signed obtained by a hash function, characterized in that the step of decrypting the received value is carried out by means of a FIDO public key, of the FIDO protocol, associated with the signing key of the signer.