# US 2022/0286294 A1 · Secure digital signing of a document > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0286294 A1 - Document ID: US20220286294A1 - Status: Published application - Kind: A1 - Application number: 17/591,136 - Filed: 2022-02-02 - Published: 2022-09-08 - Earliest claimed: 2021-02-02 - Assignees: Nimaty Advisory LLP - Applicants: Nimaty Advisory LLP - Inventors: Jacobus GROBLER - Web page: https://patentgrep.com/patent/US20220286294A1 ## CPC - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - H04L 9/3247: {involving digital signatures} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for orchestrating secure digital signing of a document is provided. In a method a user may be required to sign a document using a digital signature. The method may include obtaining data elements, including a biometric data element and a location data element, associated with the user to verify the user. The authenticity of the data elements may be verified by means of cryptographic attestation and by comparing the biometric data element with user data stored in a user record. In response to verifying the data elements, a payload may be generated, including the data elements, and a hash algorithm may be performed on the payload. A hash of the payload obtained by the hash algorithm and a document identifier may be sent to a secure module unique to the user, via a signing application, for signing of the document. ## Claims ### Claim 1 A computer-implemented method for orchestrating digital signing of a document using embedded cryptographic verification of a signing location conducted at a signing orchestrator, the method comprising: receiving a request for data elements from a signing application and, in response to receiving the request, initiating obtaining of the data elements; receiving signed data elements, including a location data element and a biometric data element associated with a user, the data elements having been obtained from a user device configured to sign the data elements with an attestation key; verifying the authenticity of the signed data elements using a system attestation certificate and comparing the biometric data element to user data stored in a user record; in response to verifying the signed data elements, generating a payload including the location data element, the biometric data element, and data associated with the document and performing a hash algorithm on the payload to calculate a hash of the payload; and transmitting the hash of the payload and a document identifier to the signing application for signing of the document. ### Claim 2 (depends on 1) The method as claimed in claim 1, wherein initiating obtaining the data elements includes transmitting a data element request to the user device, the user device prompting the user to provide the biometric data element. ### Claim 3 (depends on 2) The method as claimed in claim 2, wherein prompting the user to provide the biometric data element includes presenting the user with a description of the document to be signed. ### Claim 4 (depends on 1) The method as claimed in claim 1, wherein the data element is signed with a system attestation key associated with the attestation certificate and stored in a secure storage of the user device. ### Claim 5 (depends on 4) The method as claimed in claim 4, wherein the attestation certificate is enrolled at the signing orchestrator and used to verify the authenticity of the data element signed with the system attestation key. ### Claim 6 (depends on 1) The method as claimed in claim 1, wherein the payload including the data element additionally includes at least one of a timestamp and the document identifier. ### Claim 7 (depends on 1) The method as claimed in claim 1, wherein the user data stored in the user record includes user biometric data and user location data obtained from the user during an enrolment process. ### Claim 8 (depends on 7) The method as claimed in claim 7, wherein the step of comparing the biometric data element to user data stored in a user record includes comparing the biometric data element to the user biometric data obtained from the user during the enrolment process. ### Claim 9 (depends on 1) The method as claimed in claim 1, including initiating a signing session in response to receiving the signing request, and wherein the signed data elements are stored in a storage location of the signing orchestrator at least for the duration of the signing session. ### Claim 10 (depends on 9) The method as claimed in claim 9, wherein if one or more additional documents are to be signed during the signing session, using the stored signed data elements to generate a payload for each of the one or more additional documents. ### Claim 11 (depends on 1) The method as claimed in claim 1, wherein the signing application is a web-based application executing on a computing device associated with the user. ### Claim 12 A computer-implemented method for orchestrating digital signing of a document using embedded cryptographic verification of a signing location, the method being conducted at a signing application executing on a computing device associated with a user and comprising: requesting data elements from a signing orchestrator for identifying the user initiating a signing request; receiving a hash of a payload including the data elements and data associated with the document, and a document identifier, wherein the signing orchestrator receives signed data elements, including a location data element and a biometric data element associated with the user, obtained from a user device configured to sign the data elements with an attestation key and verifies the authenticity of the signed data elements using a system attestation certificate and compares the biometric data element to user data stored in a user record; prompting the user for a passcode associated with a secure module; and transmitting the user passcode and the hash of the payload to the secure module configured to verify the user passcode and perform signing of the hash. ### Claim 13 (depends on 12) The method as claimed in claim 12, including receiving the signed hash from the secure module and transmitting the signed hash to the signing orchestrator, wherein the signing orchestrator stores the signed hash for subsequent use. ### Claim 14 (depends on 12) The method as claimed in claim 12, wherein the secure module is a Hardware Security Module (HSM) configured to store a private key unique to the user, and wherein the private key is used to cryptographically sign the hash. ### Claim 15 A system for orchestrating digital signing of a document using embedded cryptographic verification of a signing location including a signing orchestrator, the signing orchestrator having a memory for storing computer-readable program code and a processor for executing the computer-readable program code, the signing orchestrator comprising: a data request receiving component for receiving a request for data elements from a signing application and, in response to receiving the request, initiating obtaining of the data elements; a data element receiving component for receiving signed data elements, including a location data element and a biometric data element associated with a user, the data elements having been obtained from a user device configured to sign the data elements with an attestation key; an authenticity verifying component for verifying the authenticity of the signed data elements using a system attestation certificate and comparing the biometric data element to user data stored in a user record; a payload generating component for, in response to verifying the signed data elements, generating a payload including the location data element, the biometric data element and data associated with the document; a hash algorithm performing component for performing a hash algorithm on the payload to calculate a hash of the payload; and a hash transmitting component for transmitting the hash of the payload and a document identifier to the signing application for signing of the document. ### Claim 16 (depends on 15) The system as claimed in claim 15, wherein the signing application is executed on a computing device associated with a user, the computing device having a memory for storing computer-readable program code and a processor for executing the computer-readable program code, the computing device comprising: a data element requesting component for requesting data elements from the signing orchestrator for identifying the user initiating a signing request; a hash receiving component for receiving a hash of a payload including the data elements and data associated with the document, and a document identifier, wherein the signing orchestrator receives signed data elements, including a location data element and a biometric data element associated with the user, obtained from a user device configured to sign the data elements with an attestation key and verifies the authenticity of the signed data elements using a system attestation certificate and compares the biometric data element to user data stored in a user record; a passcode prompting component for prompting the user for a passcode associated with a secure module; and a passcode transmitting component for transmitting the user passcode and the hash of the payload to the secure module configured to verify the user passcode and perform signing of the hash. ### Claim 17 (depends on 16) The system as claimed in claim 16, wherein the secure module is directly attached to, or integral with the computing device associated with the user.