US 2026/0222225 A1Published application

System and method for privacy preserving digital signature with hashing and signing operations performed in distributed trusted rich execution environments

AssigneesJohn Kar-Kin ZAO, Fiduciaedge Technologies Co., Ltd., Taiwan-Ca Inc.

InventorsJohn Kar-Kin ZAO, Chya-Hung TSAI, Hung-Yi Tony TU, Tz-Ching YANG

Life of this patent

Estimating the term…

Loading patent…

Abstract

A distributed trusted computing system consisted of a cluster of Trusted Rich Execution Environments (T-REEs) instantiated on a network of computers, and the information processing methods performed within these T-REEs, and the information interchange methods employed by these T-REEs to communicate with one another to perform a privacy-preserving digital signature operation on electronic files are disclosed. This disclosure enables a trusted party, referred to as the Certification Authority (a.k.a. the signer), to certify the content integrity and the origin authenticity of a file submitted by the file owner (referred to as the customer) by performing a hashing operation on the file in the T-REE instantiated on the customer computers and a private key signing operation on a hash value in the T-REE instantiated on the signer computer. It enables the certification authority to certify the integrity and authenticity of the file without accessing the content thereof.

Claims18

Dependent claims

A distributed digital signature system comprising:

a customer subsystem having a rich execution environment, a first trusted rich execution environment, a second trusted rich execution environment and a first trusted execution environment;
and
a signer subsystem having a third trusted rich execution environment and a second trusted execution environment,
wherein the customer subsystem is configured to provide a file and call a signature request function with respect to the file in the rich execution environment,
wherein the customer subsystem is configured to call a hash request function with respect to the file in the first trusted rich execution environment, and compute a hash of the file in the first trusted execution environment in response to the hash request function,
wherein the customer subsystem is configured to generate a first signature of the hash,
wherein the customer subsystem is configured to establish, in the first trusted rich execution environment, an atomic and secure transaction with the signer subsystem, and the atomic and secure transaction comprises:
transmitting, by the customer subsystem in the first trusted rich execution environment, the hash and the first signature to the signer subsystem;
verifying, by the signer subsystem in the second trusted execution environment, the first signature;
generating, by the signer subsystem in the second trusted execution environment, a second signature with respect to the hash after a successful verification of the first signature;
and
transmitting, by the signer subsystem in the third trusted rich execution environment, the second signature to the customer subsystem,
wherein the customer subsystem is configured to generate, in the second trusted rich execution environment, a file blob according to the second signature of the hash and the file in response to the signature request function.

10 more elements

A distributed digital signature method comprising:

providing, by a customer subsystem in a rich execution environment, a file and calling a signature request function with respect to the file;
calling, by the customer subsystem in a first trusted rich execution environment, a hash request function with respect to the file;
computing, by the customer subsystem in a first trusted execution environment, a hash of the file in response to the hash request function;
generating, by the customer subsystem in the first trusted execution environment, a first signature of the hash;
establishing, by the customer subsystem and a signer subsystem, an atomic and secure transaction which comprises:
transmitting, by the customer subsystem, the hash and the first signature to the signer subsystem;
and
verifying, by the signer subsystem in a second trusted execution environment, the first signature;
generating, by the signer subsystem in the second trusted execution environment, a second signature of the hash after a successful verification of the first signature;
and
transmitting, by the signer subsystem in a third trusted rich execution environment, the second signature to the customer subsystem,
generating, by the customer subsystem in a second trusted rich execution environment, a file blob according to the second signature of the hash and the file in response to the signature request function.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 19/144,518Filed 29 Dec 2023
Priority: 30 Dec 2022
Published: 30 Jul 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 9/3247
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
G06F 21/57
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: certifying or…
G06F 21/64
Protecting data: protecting data integrity, e.g. using checksums, certificates or signatures
H04L 9/0825
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…: using…