ID Token Signature Generation via Hash Combination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating electronic signatures, such as blind signatures, lack user control over data and require external systems for signature generation, leading to increased computing effort and security concerns.
Innovation Solution
An ID token system that enables complete control over data by generating signatures entirely on the ID token, eliminating the need for external systems and reducing computing effort by combining hash values after attribute transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature generation is performed on an external computer system using blind signature methods, then the signature can be generated without the user's private key, but the user loses control over which data is signed and cannot verify correspondence between transmitted attributes and hash values
Solution Approach 1:
The patent extracts the signature generation function from external computer systems and relocates it entirely to the ID token. The ID token now contains both the private key storage and the signature generation capability, allowing the user to maintain control over which attributes are signed while eliminating the need for external systems to perform cryptographic operations.
Solution Approach 2:
The ID token performs self-service by generating signatures autonomously using its own private key and the attributes provided by the user. The token independently computes hash values from transmitted attributes, combines them according to the signature request, and generates the signature without requiring external computational resources or verification of hash correspondence.
2Reliability
If hash values are generated and combined on an external computer system, then the computing effort is distributed, but the user cannot verify that the combined hash values correspond to the transmitted attribute values
Solution Approach 1:
The patent extracts the hash combination operation from external computer systems and moves it entirely to the ID token. The token receives the attribute values, computes their hash values locally, combines them according to the signature request specification, and generates the signature autonomously, ensuring the user maintains sovereignty over the entire process.
Solution Approach 2:
The ID token performs self-service by independently computing hash values from the transmitted attributes and combining them according to the signature request. This autonomous operation eliminates the need for external verification while maintaining user control over data sovereignty.
3Reliability
If the ID token stores both private keys and attribute values, then the user retains complete data sovereignty, but the token requires significant computational resources to generate signatures autonomously
Solution Approach 1:
The patent extracts the signature generation computation from external computer systems and consolidates it within the ID token. While this increases the token's computational responsibility, it eliminates the need for the token to transmit sensitive private keys or intermediate cryptographic values, potentially reducing overall system energy consumption by securing operations within the token's protected environment.
Solution Approach 2:
The ID token performs self-service by autonomously generating signatures using its stored private key and received attributes. This eliminates the need for external computational resources and ensures that all cryptographic operations occur within the secure boundary of the token, potentially improving energy efficiency by avoiding repeated authentication handshakes with external systems.
4Reliability
If blind signature methods are used where the computer system generates signatures without knowing the underlying data, then the user's private key remains secure, but the user has no way of checking whether the hash values correspond to the transmitted attribute values
Solution Approach 1:
The patent inverts the traditional blind signature approach by having the ID token generate signatures directly from the attributes provided by the user, rather than having an external system generate signatures from hash values without knowing the underlying data. This inversion eliminates the verification problem while maintaining private key security, as the user can now directly control which attributes are signed and the token can verify the correspondence between transmitted attributes and generated signatures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to an ID token (106) having a memory (118), wherein attribute values of a user (102) are stored in a first memory area (124), and hash values of the attribute values, which have been determined using a first hash algorithm, are stored in a second memory area (126), wherein means are provided in order to assign the hash values to the respective attribute values, having an interface (112) for receiving an attribute requirement (152) having an attribute specification, which specifies a plurality of attributes, and a signature request which contains the attribute specification, and for transmitting the attribute values corresponding to the attributes and an electronic signature for the attribute values, and having a processor (130), wherein the processor (130) is configured for generating a combination of the hash values of the attribute values corresponding to the attribute specification, wherein the processor is configured for generating a total hash value from the combination of the hash values by execution of a second hash algorithm after reception of the signature request, and wherein the processor is configured for generating the electronic signature from the total hash value. A system (100) for generating a signature has such an ID token (106) and a terminal computer system (104) which has an interface (110) to form a connection to the ID token (106). The invention further relates to a method for generating an electronic signature of a user (102) for an electronic document, with such an ID token (106).