Validation Stamps for Electronic Signatures

The present invention relates generally to the field of electronic documents and, more particularly, to signature verification on electronic documents.

In certain instances, office work productivity has significantly increased through advances in technology. Some of these advances in technology involve replacing paper documents in the workplace with electronic documents. One such advance provides office workers with the ability to send/receive and share documents electronically. Traditionally, many paper documents contain signatures to show authorship or indicate approval. Accordingly, it is also desirable to include signatures in the electronic documents, particularly when they are sent back and forth. As would understood, the inclusion of signatures in the electronic documents is easily achieved using graphic tablets, for example, which are computer peripheral devices for capturing handwritten data.

Once a signature is affixed to a document, people generally assume that the signature on a paper or electronic document is proof of authorship or approval. There is no guarantee, however, that the integrity of the signature, especially electronic ones, has not been compromised, for example, by being traced or otherwise forged. Generally, signatures on paper or electronic documents are vulnerable to two forms of deception. The first form of deception involves an invalid signature. An invalid signature is a signature created by a forger attempting to imitate the signature of another person, i.e., authorized signator. Such a signature is affixed on a document not authored or approved by the authorized signator. The second form of deception involves affixing a valid signature, which is a signature actually created by the authorized signator, on a document other than the original intended document. This form of deception, referred to herein as an invalid copy, is particularly difficult to detect when the signature has been "cut" from one electronic document and "pasted" onto a second electronic document since it looks exactly like the original signature.

For the aforementioned reasons, a number of people have reservations about allowing their signature to be captured electronically. Accordingly, there exists a need for protecting the integrity of a signature on an electronic document.

The present invention describes a validation stamp that protects the integrity of a signature affixed to an electronic document. Specifically, the validation stamp protects against deceptions relating to invalid copies and invalid signatures.

In one embodiment, the validation stamp of the present invention protects signed documents comprising a document body and a document signature against invalid copies and invalid signatures. The validation stamp is encrypted and includes a validation signature and a validation body, which is identical to the document body or portions thereof when created. The document signature and the validation signature are derived from an electronic signature captured using a graphics tablet, wherein the electronic signature is defined by geometric information and timing information. Specifically, the validation signature is derived using the timing information, and possibly the geometric information, associated with the electronic signature, and the document signature is derived using only the geometric information associated with the electronic signature. In a preferred embodiment of the present invention, the geometric information used to derive the document signature is modified such that possible reconstruction of the timing information from the original geometric information is prevented.

The integrity of the signature affixed to the electronic document is verified by decrypting the validation stamp and comparing the decrypted validation stamp and, in some instances, the document signature against the document body and the geometric and timing information associated with a signature known for an authorized signator. Specifically, the validation body is compared to the document body to determine whether the authorized signator originally intended to affix his or her signature to the electronic document, and the geometric information and the timing information contained within the electronic document are compared to the geometric and timing information associated with the signature known for the authorized signator to determine whether the signature on the electronic document is a valid signature. The signed document is a valid copy if the validation body is identical to the document body or predetermined portions thereof. The signature is a valid signature if its geometric and timing information coincide within a predetermined error distance of the geometric and timing information of the signature known for the authorized signator.

For a better understanding of the present invention, reference may be had to the following description of exemplary embodiments thereof, considered in conjunction with the accompanying drawings, in which:

FIG. 1 illustrates an electronic document E comprising a signed document D and a validation stamp V in accordance with the present invention;

FIG. 2 illustrates a flowchart depicting the steps of an exemplary validation routine for validating the electronic document E of FIG. 1;

FIG. 3 illustrates the flowchart of FIG. 3 having an additional step for verifying validation numbers; and

FIG. 4 illustrates one embodiment of a signature verification system in connection with the present invention.

The present invention is a validation stamp that protects the integrity of a signature on an electronic document. Specifically, the present invention protects against deceptions relating to invalid copies and invalid signatures, as will be described herein.

Referring to FIG. 1, there is illustrated an electronic document E 02 comprising a signed document D 04 and a validation stamp V 06 in accordance with the present invention, i.e., E=(D,V). As shown in FIG. 1, the signed document D 04 is accessible to recipients of the electronic document E 02, and includes a document body B.sub.D 10 consisting of textual and/or graphical information and a document signature S.sub.D 08 to indicate authorship or approval of the document body B.sub.D 10, i.e., D=(S.sub.D,B.sub.D).

The validation stamp V 06 provides a mechanism for verifying the integrity of the document signature S.sub.D 08 in the signed document D 04, and includes a validation signature S.sub.V 12 and a validation body B.sub.V 14, which is the same as the document body B.sub.D 10. Thus, V=(S.sub.V,B.sub.V)=(S.sub.V,B.sub.D). In an alternate embodiment of the present invention, the validation body B.sub.V 14 contains predetermined portions or segments of the document body B.sub.D 10 in lieu of the entire document body B.sub.D 10.

Unlike the signed document D 04, the validation stamp V 06 is encrypted using an encoding algorithm and is therefore unaccessible to the recipients of the electronic document E 02. Encoding algorithms, such as the Digital Signature Algorithm (DSA) standard, are well-known in the art. See American National Standards Institute (ANSI), "Working Draft X9.30-199X: Public Key Cryptography Using Irreversible Algorithms for the Financial Services Industry: Part I: The Digital Signature Algorithm (DSA)," American Bankers Association, Washington, D.C., Mar. 4, 1993.

The document signature S.sub.D 08 and the validation signature S.sub.V 12 are derived from a signature captured by a device operable to electronically record the positions of a writing device, such as a pen, on the device at given times. Such devices are referred to herein as graphics tablets, and are well-known in the art. As would be understood, the term "graphics tablet" should not be construed to limit the present invention in any manner in that other known methods of electronically capturing a signature may also be utilized. For the purposes of this application, signatures captured electronically using a graphics tablet are referred to herein as "electronic signatures," while signatures written with an ink pen on paper documents or captured electronically by a means other than a graphics tablet are referred to herein as "paper signatures."

Electronic signatures have associated with them two types of information which the present invention utilizes to determine whether the integrity of a signature on an electronic document has been compromised: geometric information S.sub.g and timing information S.sub.t. The geometric information S.sub.g describes the geometric signature features, i.e., shape of the signature, and is captured by the graphics tablet as a sequence of points (p.sub.1, . . . , p.sub.n). Each point has (x,y) coordinates.

The timing information S.sub.t defines the moment each of the points (p.sub.1, . . . , p.sub.n) are recorded electronically by the graphics tablet with reference to each other. Thus, for each point p.sub.i comprising the geometric information S.sub.t of an electronic signature, there is associated a (x.sub.i,y.sub.i) coordinate and a time t.sub.i, i.e., p.sub.i =(x.sub.i,y.sub.i,t.sub.i). The timing information S.sub.t used to derive dynamic signature features of the signator, such as the motion or speed of a writing device as a signator writes each letter of his or her name on the graphics tablet. The dynamic signature features are not apparent from a copy of the signature.

The geometric information S.sub.g and the timing information S.sub.t play somewhat complementary roles in distinguishing genuine signatures from forgeries, i.e., the more forgers try to match every detail of a signature's shape, the less likely they are to match its dynamic signature features, and vice-versa. In contrast to electronic signatures, paper signatures have associated geometric information S.sub.g only, whereby the absence of the timing information makes such signatures more vulnerable to forgery.

The validation signature S.sub.V 12 is derived using the electronic signature and contains the timing information S.sub.t and possibly the geometric information S.sub.g. In contrast, the document signature S.sub.D 08, which is also derived using the electronic signature S, contains only the geometric information S.sub.g --that is, the geometric information S.sub.g is isolated or the timing information S.sub.t is removed from the electronic signature in order to create the document signature S.sub.D. Thus, the document signature S.sub.D is equivalent to a paper signature. Since the document signature S.sub.D contains only the geometric information S.sub.g and the validation stamp V 06 is encrypted, the timing information S.sub.t is hidden from the recipients of the electronic document E 02, thereby preventing access to the dynamic signature features for imitation by a forger.

The basic assumption that enables the success of the present invention is that the timing information S.sub.t is concealed. However, this may not be the case, for instance, if the graphics tablet samples the position of the writing device at regular time intervals I.sub.n. In such a situation, the timing information S.sub.t could be easily reconstructed from the geometric information S.sub.g using the formula t.sub.i =(i-1)*I.sub.n. In order to hide the timing information S.sub.t and prevent its reconstruction from the geometric information S.sub.g, the geometric information (p.sub.1, . . . , p.sub.n) is modified before being recorded as the document signature S.sub.D. For example, the document signature S.sub.D could be computed by simply re-sampling the raw geometric information (p.sub.1, . . . , p.sub.n) to produce modified geometric information (p.sub.1 ', . . . , p.sub.n ') where adjacent points p.sub.i ' are equal arc-length distances from each other. Another example involves interpolating a random number of chosen points between adjacent points of the raw geometric information (p.sub.1, . . . , P.sub.n).

In general, signatures on electronic documents are subject to two forms of deception: invalid copy and invalid signature. An invalid copy is a signature that was actually produced by the authorized signator, i.e., valid signature, for a document other than the one on which the signature is currently affixed. In other words, the invalid copy of the signature is not on the document which the authorized signator originally affixed his or her signature. For example, a valid signature may be "cut" from one electronic document and "pasted" onto a second electronic document. The second form of deception, i.e., invalid signature, involves a forger attempting to imitate the geometric and/or dynamic signature features associated with a signature of another person. This signature is also affixed to a document not authored or approved by the authorized signator.

The present invention electronic document E 02 is operable to resist both of the aforementioned forms of deception. In operation, an authorized signator or author A would create the electronic document E and send it to recipients R. The recipients R would have access to the signed document D, but not to the encrypted validation stamp V. To verify that the integrity of the signature on the electronic document was not compromised, the recipients R would run a validation routine which compares the validation body B.sub.V and the geometric information S.sub.g and the timing information S.sub.t contained within the electronic document against the signed document D and the geometric and timing information of a signature known for the author A.

Referring to FIG. 2, there is illustrated a flowchart depicting the steps of an exemplary validation routine 20. As shown in FIG. 2, the validation routine 20, in step 200, decrypts the validation stamp V to access the encrypted validation body B.sub.V and the timing information S.sub.t, and possibly the geometric information S.sub.g, corresponding to the encrypted validation signature S.sub.V. In step 210, the validation routine checks for the first form of deception, i.e., invalid copy, by comparing the decrypted validation body B.sub.V against the document body B.sub.D of the signed document D. If the decrypted validation body B.sub.V coincides with the document body B.sub.D, then the validation routine 20 concludes that the document signature S.sub.D and the validation stamp V was not "cut" from another electronic document E and "pasted" onto the electronic document E received--that is, the document signature S.sub.D is not an invalid copy. The validation routine 20 subsequently continues to step 220. Otherwise, the validation routine 20 proceeds to step 240 where the recipients R are informed that the integrity of the document signature S.sub.D on the electronic document E received has been compromised.

In step 220, the validation routine 20 checks for the second form of deception, i.e., invalid signature, using a signature verification algorithm to validate the signature on the electronic document. Signature verification algorithms are well-known in the art. See "Statistical Methods for On-Line Signature Verification" by Winston Nelson, William Turin and Trevor Hastie in the International Journal of Pattern Recognition and Artificial Intelligence, Volume 8, Number 3, 1994. In short, signature verification involves establishing statistical information about a number of features of a given person's signature, such as average time to write a signature, average speed of pen during signing, average number of strokes, etc. This statistical information is typically established during a training phase. To verify a particular instance of a signature, the signature verification algorithm measures the features of interest and statistically tests whether the results are similar within a predetermined error distance, such as Euclidean, to those obtained during the training phase.

In other words, the signature verification algorithm compares the timing information S.sub.t of the decrypted validation signature S.sub.V and the geometric information S.sub.g of the document signature S.sub.D (or decrypted validation signature S.sub.V) against those known for the authorized signator A. If the geometric information S.sub.g and the timing information S.sub.t are similar within the predetermined error distance of the known geometric information S.sub.g and the timing information S.sub.t of the authorized signator, then the decrypted validation signature S.sub.V is determined to be actually produced by the authorized signator A, i.e., valid signature. The validation routine 20 subsequently continues to step 230 where it indicates to the recipients that the integrity of the document signature S.sub.D on the electronic document E received has not been compromised. Otherwise, the validation routine 20 proceeds to step 240 where it indicates that the integrity of the document signature S.sub.D on the electronic document E received has been compromised.

In another embodiment of the present invention, the validation stamp V further includes a validation number N for providing additional protection against invalid signatures, wherein each validation number N comprises a sequence of characters which can be used to uniquely identify a person or other type of entity. Thus, if a forger is able to successfully imitate the geometric and dynamic signature features of another persons's signature, the forger must also know the authorized signator's associated validation number N. Referring to FIG. 3, there is illustrated a flowchart depicting the steps of the validation routine 20 having a step 225 for verifying the validation number N. In an alternate embodiment of the present invention, the validation number N is included in the validation stamp V in lieu of the timing information S.sub.t.

Referring to FIG. 4, there is illustrated one embodiment of a signature verification system 40 in connection with the present invention as shown in FIG. 4, the electronic signature verification system 40 includes a computing device 42 for creating and verifying the electronic document E 02, a display 44 for providing a visual presentation, a keyboard 46 for providing typed input and a graphics tablet 48 for providing handwritten input. The display 44, the keyboard 46 and the graphics tablet 48 are electronically coupled to the computing means 42.

Although the present invention has been described in considerable detail with reference to a certain embodiment, other embodiments are also applicable. Therefore, the spirit and scope of the appended claims should not be limited to the description of the embodiment contained herein.