Qualified Remote Signature through a Hybrid Cloud Architecture

There are two basic electronic signature scenarios involving an individual signing a digital document: by means of her private key and qualified certificate stored on a qualified cryptographic device (usually an USB token), or by means of a private key and cloud certificate stored in the protected remote environment of a Qualified Service Provider. The simplest case is when both the document and the cryptographic device are located on the person’s computer. But what if the person needs to sign a document located on a remote location - let’s say on a document management platform - via a cloud service, but she wants to sign it using the USB token available on her computer? For the digital document to be signed on the remote platform, it must be downloaded, signed and reuploaded. This paper proposes a different approach in which the document is signed with a qualified signature, without downloading its content and without using a cloud-based private key and certificate, and still respecting the qualified signature regulations and requirements.