Anais - Engenharia de Redes de Comunicação - UnB

Electronic Documents with Signature Constraints
Felipe C. Werlang 1 , Ricardo F. Custódio 1 , Roberto Araújo 2
1 Departamento de Informática e Estatística – Universidade Federal de Santa Catarina (UFSC)
Caixa Postal 476 – 88.040-900 – Florianópolis – SC – Brazil
2 Faculdade de Computação – Universidade Federal do Pará (UFPA)
Rua Augusto Corrêa, 01 - Setor Básico – 66075-110 – Belém – PA – Brazil
felipewer@inf.ufsc.br, custodio@inf.ufsc.br, rsa@ufpa.br
Abstract. X.509 Public Key Certificates and Attribute Certificates are well established
technologies. They are employed in digital signatures to prove a signatory’s
identity and authorization. However, there is no standard definition for
the way electronic documents should specify the identity and the authorization
of required signatories, nor the number of expected signatures. In this paper we
propose to bind identity and authorization requirements to a document through
a creator signature. For this, we introduce a new signed signature attribute.
Keywords: Digital Signature, Authorization, Attribute Certificates, Signature
Constraints, Electronic Documents, Authorization Requirements
1. Introduction
Modern digital signature standards employ Public Key Certificates (PKCs) to identify the
signatories. They also support the inclusion of Attribute Certificates (ACs) in signatures
to provide authorization credentials. However, these certificates only certify who signed
a given document and what his attributes were. This does not mean that the signatory had
the authorization to sign that document. We could take, for example, a court injunction.
Although anyone could sign a document containing a court injunction, it only acquires
legal value if signed by a judge. This means that applications enforcing authorization
constraints in digital signatures have to look for a predefined set of attributes in the signatory’s
AC. That attribute set, in turn, depends directly on the business process in which
the signature is used. Thus, each application ends up tied to a specific business process.
Applications designed to incorporate digital signatures in specific business processes,
with fixed authorization constraints, are quite common. Examples include management
systems and communication protocols. Many kinds of forms also tend to have
fixed authorization constraints. However, there are even more cases of documents with
dynamic content and format. Each of these documents may have different authorization
constraints for its signatures. A good example of this is a business contract.
Furthermore, there may be situations where a document has a mix of authorization
and identity constraints. For example, a contract between a company and an individual
may require the signature of the company’s director and the signature of the individual. In
this case the first signature has an authorization constraint defined by a role, i.e. Company
Director, and the second signature has an identity constraint defined by the individual’s
identity.
397