Patent ID: 8856532

Claim:
A method comprising: receiving a composite resource document, containing one or more resources, having a digital signature; obtaining an updated manifest resource, wherein the updated manifest resource lists all resources in the composite resource document; generating a hash token using the resources identified in a generated signature reference list in the digital signature to form a generated hash token; decrypting an encrypted hash token contained within the digital signature using an obtained decryption key to form a signature hash token; and responsive to at least a comparison of the generated hash token and the signature hash token, generating a signature validity result, which comprises: responsive to a determination that the generated hash token is not equal to the signature hash token, generating a signature validity result of invalid, wherein the determination further comprises determining whether a list of resources from the updated manifest resource is not equal to a list of resources identified in the generated signature reference list in the digital signature; and testing validity of the obtained decryption key using zero, one or a plurality of tests including a key expiry test, a key revocation test, a key issuer credential test and a trusted key list test.