System and method for securely hyperlinking graphic objects

• US 7,653,814 B2
• Filed: 12/10/2002
• Issued: 01/26/2010
• Est. Priority Date: 12/11/2001
• Status: Active Grant

• Current Assignee: Twitter Inc (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Carro, Fernando Incertis
• Primary Examiner(s): Revak; Christopher A
• Assistant Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US10/315,708
• Publication Number:
  US 20030110384A1
• Time in Patent Office: 2,604 Days
• Field of Search: 713/170, 713/176, 715/208
• US Class Current: 713/170
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Systems and methods and computer programs for verifying the authenticity and integrity of hyperlink addresses and files that are accessible by means of these hyperlink addresses. A system and a method are disclosed for authenticating a file such as an HTML document hyperlinked to a graphic object such as a digital image or to a graphic icon. The hyperlink network address (e.g., the URL of the hyperlink on the Internet) is encoded on a first portion of the graphic object. Checking information such as a MAC digital signature and the hyperlinked file are encoded into a second portion of the same graphic object. In accordance with another aspect of the invention, a system and a method are disclosed for verifying the authenticity and integrity of a hyperlink and a file when this hyperlink is activated.

Claims

1. A method for creating an authenticated hyperlink to access a file by means of a hyperlink address and to authenticate said hyperlink address and said file when said authenticated hyperlink is activated, said method comprising the steps of:

providing a digital image;

encoding the address of a file in a first portion of said digital image, said address of the file being a Uniform Resource Locator (URL) that includes a network address of the file;

computing a message authentication code based on the address of the file and the file;

encoding the computed message authentication code in a second portion of said digital image, wherein the message authentication code is computed using a hash function having as inputs the address of the file, the file, and a secret key K, and

after said encoding the address of a file in the first portion of said digital image and after said encoding the computed message authentication code in the second portion of said digital image, a computer workstation storing the digital image in a storage device comprised by the computer workstation.

2. The method according to claim 1, wherein the hash function comprises an additional input of a set of parameters that specify a type and format of an output of an instance of the hash function.

3. The method according to claim 1, further comprising the step of:

embedding the created authenticated hyperlink in an electronic document.

4. The method according to claim 1, wherein the file is located on a server connected to a network.

5. The method according to claim 1, wherein the hash function computes the message authentication code by forming a concatenation of the address of the file and the file, and computing a Message Authentication Code (MAC) of the formed concatenation using the secret key K.

6. The method according to claim 1, wherein the first and second portions of the digital image are different and non-overlapping portions of the digital image.

7. The method according to claim 3, wherein the address of the electronic document differs from the address encoded in the first portion of the digital image, wherein the method further comprises authenticating the address of the file encoded in the first portion of the digital image and the file upon being accessed, and wherein said authenticating comprises the steps of:

extracting and decoding the address of the file encoded in the first portion of the digital image;

extracting and decoding the computed message authentication code encoded in the second portion of the digital image;

accessing and retrieving the file through use of the decoded address of the file;

computing a cryptographic digest by using a hash function having as inputs the decoded address of the file, the retrieved file, and the secret key K, said using the hash function resulting in the cryptographic digest; and

determining that the computed cryptographic digest is equal to the decoded message authentication code.

8. A computer program product, comprising a computer readable storage medium in a computer workstation, said storage medium having a computer program stored therein, said computer program configured to be executed by a computer to perform a method for creating an authenticated hyperlink to access a file by means of a hyperlink address and to authenticate said hyperlink address and said file when said authenticated hyperlink is activated, said method comprising the steps of:

providing a digital image;

encoding the address of a file in a first portion of said digital image, said address of the file being a Uniform Resource Locator (URL) that includes a network address of the file;

computing a message authentication code based on the address of the file and the file;

encoding the computed message authentication code in a second portion of said digital image, wherein the message authentication code is computed using a hash function having as inputs the address of the file, the file, and a secret key K, and

after said encoding the address of a file in the first portion of said digital image and after said encoding the computed message authentication code in the second portion of said digital image, storing the digital image in a storage device comprised by the computer workstation.

9. The computer program product according to claim 8, wherein the hash function comprises an additional input of a set of parameters that specify a type and format of an output of an instance of the hash function.

10. The computer program product according to claim 8, further comprising the step of:

embedding the created authenticated hyperlink in an electronic document.

11. The computer program product according to claim 8, wherein the file is located on a server connected to a network.

12. The computer program product according to claim 8, wherein the hash function computes the message authentication code by forming a concatenation of the address of the file and the file, and computing a Message Authentication Code (MAC) of the formed concatenation using the secret key K.

13. The computer program product according to claim 8, wherein the first and second portions of the digital image are different and non-overlapping portions of the digital image.

14. The computer program product according to claim 10, wherein the address of the electronic document differs from the address encoded in the first portion of the digital image, wherein the method further comprises authenticating the address of the file encoded in the first portion of the digital image and the file upon being accessed, and wherein said authenticating comprises the steps of:

extracting and decoding the address of the file encoded in the first portion of the digital image;

extracting and decoding the computed message authentication code encoded in the second portion of the digital image;

accessing and retrieving the file through use of the decoded address of the file;

computing a cryptographic digest by using a hash function having as inputs the decoded address of the file, the retrieved file, and the secret key K, said using the hash function resulting in the cryptographic digest; and

determining that the computed cryptographic digest is equal to the decoded message authentication code.