Techniques for attesting to content

• US 20070174406A1
• Filed: 01/24/2006
• Published: 07/26/2007
• Est. Priority Date: 01/24/2006
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Carter, Stephen, Burch, Lloyd, Kinser, Stephen, Morris, Cameron
• Granted Patent: US 7,574,479 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

Techniques for attesting to content received from an author (sender) are provided. A sender'"'"'s content is represented by a message digest. The message digest is signed by an identity service. The signed message digest represents an attestation as to the authenticity of the content from the sender. The sender transmits the signed message digest and content in a message to a recipient. The recipient verifies the signature and message digest to authenticate the content from the sender.

Claims

1. A method, comprising:

receiving content in a message from a sender;

acquiring a signed version of a message digest for the content;

validating the signed version of the message digest; and

processing policy in response to validating the signed version of the message digest.

2. The method of claim 1, wherein acquiring further includes identifying a name of a service provider that provided the signed version of the message digest from metadata associated with the message digest.

3. The method of claim 1, wherein validating further includes reproducing an independent version of the message digest and comparing that independent version to the acquired version, and if equal and if a signature associated with the signed message digest is verified, then determining the content from the sender is authenticated.

4. The method of claim 1 further comprising, requesting an identity service to assist in validating the signed version of the message digest, wherein the identity service interacts with another different identity service that originally signed the message digest on behalf of the sender.

5. The method of claim 1 further comprising, assuming the content is authentic from the sender in response to a signature included with the signed version of the message digest, wherein the signature serves as an attestation as to the authenticity of the content and the sender.

6. The method of claim 1, wherein processing policy further includes adding an identity service associated with a signature of the signed version of the message digest to a list of trusted identity services after the signed version of the message digest is validated.

7. The method of claim 1, wherein processing policy further includes notifying a sender if the signed version of the message digest is not validated indicating the content has been tampered with.

8. The method of claim 1, wherein processing policy further includes logging a signature associated with the signed version of the message digest and associating the signature with a trusted identity service.

9. A method, comprising:

submitting a message digest of content to an identity service or submitting the content, wherein if the content is submitted the identity service generates and supplies the message digest;

receiving an authorship attestation certification (AAC) from the identity service for the content; and

sending the content and the AAC to a recipient as a message.

10. The method of claim 9 further comprising, authenticating to the identity service before submitting the content.

11. The method of claim 9 further comprising, sending the message using a protocol associated with at least one of Multipurpose Internet Mail Extension (MIME), Secure MIME (S/MIME), Transmission Control Protocol (TCP), and Really Simple Syndication (RSS).

12. The method of claim 9 further comprising, sending the message as at least one of an electronic mail (email) transaction, an instant messaging (IM) transaction, and a text message transaction.

13. The method of claim 9, wherein receiving the AAC further includes receiving a signature of the identity service and the message digest as the AAC.

14. The method of claim 13, wherein receiving further includes receiving the AAC with additional metadata that identifies the identity service or includes usage limitations of the content.

15. A method, comprising:

receiving a message digest for content from a sender or receiving the content, and wherein if the content is received generating the message digest from the content;

generating a signature for the message digest;

supplying the signature and the message digest back to the sender, wherein the sender uses the message digest and the signature to attest to the authenticity of the content of the sender.

16. The method of claim 15 further comprising, authenticating the sender before receiving the message digest.

17. The method of claim 15 further comprising, augmenting the signature and message digest with metadata that includes at least one of usage limitations, attributes associated with the sender, identifiers associated with policy, and identifiers associated with the signature.

18. The method of claim 15, wherein supplying further includes supplying the signature and message digest as a Security Assertion Markup Language (SAML) assertion.

19. The method of claim 15 further comprising, receiving the signature and the message digest from a recipient that the sender sent the content to and verifying the signature for the recipient to authenticate the content.

20. The method of claim 15, receiving the signature and the message digest from a different identity service on behalf of a recipient that the sender sent the content to and verifying the signature on behalf of the different identity service.

21. A system, comprising:

an Authorship Attestation Certificate (AAC); and

an identity service, wherein the identity service is to create the AAC on behalf of a sender of content in response to a message digest for that content, and wherein the AAC is a signed copy of the message digest, signed by the identity service, and wherein the identity service is to supply the AAC back to the sender.

22. The system of claim 21, wherein the identity service augments the AAC with metadata and the metadata includes at least one of references to the identity service, attributes of the sender and usage limitations with respect to the content.

23. The system of claim 21, wherein the AAC is supplied by the identity service to the sender as an assertion, and the assertion is relied upon by one or more recipients for purposes of authenticating the content.

24. The system of claim 21, wherein the AAC and content are to be supplied by the sender to one or more recipients as at least one of an electronic mail (email) message, an instant message (IM), and a text message.

25. The system of claim 21, wherein the identity service is to subsequently verify the signature of the AAC on behalf of one or more recipients.

26. The system of claim 21, wherein the identity service is to subsequently verify the signature of the AAC on behalf of one or more different identity services communicating with one or more recipients.

27. The system of claim 21, wherein the AAC is to be tagged with the content of a message within at least one of a Multipurpose Internet Mail Extensions (MIME) protocol, Secure MIME (S/MIME) protocol, Really Simple Syndication (RSS) protocol, Transmission Control Protocol (TCP), Extensible Markup Language (XML), and Standard Generalized Markup Language (SGML).