Electronic Signature System with On-the-Fly Server Certificate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The electronic signature process is excessively complex, and existing systems face challenges in securely managing private keys and ensuring the confidentiality of signed information, especially in remote signing scenarios, while also requiring improved security and identity verification.
Innovation Solution
An open and secure system for processing electronic signature requests, comprising a business application that creates signature requests, a request manager service, a consent page for user authentication, and a proof manager service, which generates and manages cryptographic keys to securely sign documents using a server certificate created on the fly, ensuring secure key management and enhanced identity verification through the OpenID Connect protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional electronic signature system is used with pre-established certificates, then identity verification is established, but the system complexity and security management burden increase significantly
Solution Approach 1:
The system performs preliminary actions by pre-generating and storing cryptographic key pairs and certificates in the database before they are actually needed for signing. When a user requests to sign a document, the system retrieves these pre-prepared credentials rather than generating them on-the-fly, thus simplifying the operational complexity while maintaining strong identity verification.
Solution Approach 2:
The patent introduces a database as an intermediary component that stores cryptographic credentials (public keys, certificates, and associated metadata). This intermediary layer decouples the complexity of cryptographic key management from the signing process, allowing the signature generation to focus only on the essential encryption operation while the database handles the complex tasks of credential storage, retrieval, and validation.
2Adaptability or versatility
If private keys are stored centrally for remote signing, then remote signing capability is enabled, but security risks and confidentiality concerns increase
Solution Approach 1:
The cryptographic credentials are segmented into multiple components: private keys, public keys, certificates, and metadata, each stored separately in the database with appropriate access controls. The private key is never exposed during the signing process - only the public key and certificate are used for verification, while the private key remains securely stored and is only used locally when needed.
Solution Approach 2:
The database acts as a secure intermediary that manages private keys without exposing them. The system architecture ensures that private keys are retrieved and used only in controlled environments (either in the database itself or in a secure client environment), and never transmitted or exposed during the remote signing process. This intermediary approach enables remote signing capability while maintaining security through controlled access and minimal key exposure.
3Ease of operation
If the signature process is made simple and streamlined, then user experience improves, but the ability to provide comprehensive security and traceability may be reduced
Solution Approach 1:
The system automatically generates cryptographic credentials, manages certificate storage, handles key retrieval, and performs signature verification without requiring user intervention for these complex tasks. The user simply needs to authenticate and confirm the signing action, while the system handles all the complex security and traceability requirements in the background, including automatic logging and certificate chain validation.
Solution Approach 2:
The database serves as an intermediary that automatically manages the complex security and traceability requirements. It stores and retrieves cryptographic credentials, validates certificate chains, maintains audit logs, and ensures compliance with security policies - all without requiring the user to manually handle these complex aspects. This allows the user interface to remain simple while the database ensures comprehensive security and traceability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to an open and secure system for processing requests for electronic signatures of documents, comprising a business application responsible for creating a signature request for at least one document for a signing user, said business application being hosted by a requesting entity. The system is characterized in that it allows documents to be signed with a server certificate created on the fly and in that it further comprises three independent services: a request management service that hosts the signature requests and the attached documents;a consent page, consisting of an HTML application, capable of managing the consent protocol by interfacing with a secure user identification service and generating a client key pair (KcliPub, KcliPriv) and a proof management service, hosted by a signature provider, collecting signature proofs and including a server component hosting the signer's cryptographic key, said proof management service being capable of generating a server key pair (KservPriv and KservPub) to derive a secret key Ks using the client's public key (KcliPub) and the server's private key (KservPriv);to generate a public key (KPub) and a private key (KPriv) of the signer, to create a certificate request, to retrieve a certificate from a certification authority, and in that the secret key Ks is used to enclose the signer's private key. The invention further relates to the methods of processing and creating electronic document signatures implemented in the above system.