Patent ID: 8078879
Filing Date: 2011-12-13
Classification: G06F,H04L

Abstract:
1. A method of certifying electronic data supplied by a user, the method comprising: receiving data to be signed, supplied by the user from a source device, at a certifying apparatus including at least a signature server providing a signing function; receiving at said signature server a hashed or encrypted password from said source device via a first communication path wherein said password is generated by an authentication system providing an authentication function separate from said signing function and wherein said password is transmitted to said source device via a second communication path whereby said signature server and said authentication system have different said communication paths with said source device; communicating a version of said hashed or encrypted password between said signature server and said authentication system, via a third communication path different to said first and said second communication path, for authenticating said user; determining at said signature server a result of said authenticating of said user by said communication between said authentication system and said signature server, wherein said determining of said result of said authenticating is performed by verification of said version of said hashed or encrypted password and wherein said verification of said version of said hashed or encrypted password is performed without said signature server verifying said actual plaintext password; signing said data to be signed using one or more elements of information secure to said signature server if said result of said authenticating indicates that said user is authenticated; and outputting said signed data from said certifying apparatus for passing to a recipient device; wherein said elements of secure information certify that the supplier of said data is said user.