Method and system for encoding signatures to authenticate files

• US 7,711,958 B2
• Filed: 06/29/2007
• Issued: 05/04/2010
• Est. Priority Date: 09/12/2002
• Status: Active Grant

• Current Assignee: Twitter Inc (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Carro, Fernando Incertis
• Primary Examiner(s): Revak; Christopher A
• Assistant Examiner(s): ALMAMUN, ABDULLAH
• Application Number:
  US11/770,790
• Publication Number:
  US 20080016353A1
• Time in Patent Office: 1,040 Days
• Field of Search: 713/176, 713/179, 713/189
• US Class Current: 713/179
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Method and system for verifying the authenticity and integrity of files transmitted through a computer network. Authentication information is encoded in the filename of the file. In a preferred embodiment, authentication information is provided by computing a hash value of the file, computing a digital signature of the hash value using a private key, and encoding the digital signature in the filename of the file at a predetermined position or using delimiters, to create a signed filename. Upon reception of a file, the encoded digital signature is extracted from the signed filename. Then, the encoded hash value of the file is recovered using a public key and extracted digital signature, and compared with the hash value computed on the file. If the decoded and computed hash values are identical, the received file is processed as authentic.

Claims

1. A method for encoding authentication information in the filenames of computer files containing digital data, said method comprising:

computing a hash value H₀ by applying a master hash function to only the digital data comprised by a master computer file, said master computer file having an original filename;

computing a digital signature of the hash value H₀ using a private key of a sender such that the digital signature of H₀ has a predetermined fixed length;

generating a signed filename of the master computer file by encoding the computed digital signature of the hash value H₀ in the original filename of the master computer file;

associating the signed filename of the master computer file with the master computer file;

computing a hash value H₁ by applying a first hash function to only the digital data comprised by a first computer file, said first computer file having an original filename;

computing a digital signature of the hash value H₁ using the private key of the sender;

generating a signed filename of the first computer file by encoding the computed digital signature of the hash value H₁ in the original filename of the first computer file;

associating the signed filename of the first computer file with the first computer file; and

generating a composite computer file by attaching to the master computer file the first computer file and its associated signed filename; and

sending the composite computer file from the sender to a receiver.

2. The method of claim 1,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀; and

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁.

3. The method of claim 1, wherein the method further comprises:

computing a hash value H₂ by applying a second hash function to only the digital data comprised by a second computer file, said second computer file having an original filename;

computing a digital signature of the hash value H₂ using the private key of the sender;

generating a signed filename of the second computer file by encoding the computed digital signature of the hash value H₂ in the original filename of the second computer file;

associating the signed filename of the second computer file with the second computer file; and

wherein said generating the composite computer file further comprises attaching to the master computer file the second computer file and its associated signed filename.

4. The method of claim 1, wherein the master computer file is an electronic mail (e-mail).

5. A method for encoding authentication information in the filenames of computer files containing digital data, said method comprising:

computing a hash value H₀ by applying a master hash function to only the digital data comprised by a master computer file, said master computer file having an original filename;

computing a digital signature of the hash value H₀ using a private key of a sender;

generating a signed filename of the master computer file by encoding the computed digital signature of the hash value H₀ in the original filename of the master computer file;

associating the signed filename of the master computer file with the master computer file;

computing a hash value H₁ by applying a first hash function to only the digital data comprised by a first computer file, said first computer file having an original filename within a first link that points to the first computer file;

computing a digital signature of the hash value H₁ using the private key of the sender;

generating a signed filename of the first computer file by encoding the computed digital signature of the hash value H₁ in the original filename in the first link to transform the first link to a signed first link;

associating the signed first link with the first computer file; and

generating a composite computer file by attaching the signed first link to the master computer file; and

sending the composite computer file from the sender to a receiver.

6. The method of claim 5,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀; and

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁.

7. The method of claim 5, wherein the method further comprises:

computing a hash value H₂ by applying a second hash function to only the digital data comprised by a second computer file, said second computer file having an original filename within a second link that points to the second computer file;

computing a digital signature of the hash value H₂ using the private key of the sender;

generating a signed filename of the second computer file by encoding the computed digital signature of the hash value H₂ in the original filename in the second link to transform the second link to a signed second link;

associating the signed second link with the second computer file; and

wherein said generating the composite computer file further comprises attaching the signed second link to the master computer file.

8. The method of claim 7,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the original filename structured of the second computer file is structured as FNAME₂.EXT₂ such that FNAME₂ denotes an alphanumeric name portion of the original filename of the second computer file and EXT₂ denotes an alphanumeric file extension portion of the original filename of the second computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀;

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁; and

wherein the signed filename of the second computer file comprises the computed digital signature of the hash value H₂ disposed between FNAME₂ and EXT₂.

9. The method of claim 5, wherein the master computer file is an electronic mail (e-mail).

10. A method for authenticating information in the filenames of computer files containing digital data, said method comprising:

receiving, by a receiver from a sender, a composite computer file comprising a master computer file having an original filename and a first computer file having an original filename, wherein the master computer file in the composite computer file comprises an associated signed filename, wherein the first computer file in the composite computer file comprises an associated signed filename, wherein the first computer file is attached to the master computer file in the received composite computer file, wherein the signed filename associated with the master computer file comprises a master digital signature encoded in the original filename of the master computer file, wherein the master digital signature is a digital signature of a hash value H₀ of a master hash function applied to only the digital data comprised by the master computer file subject to the digital signature of H₀ having been computed using a private key of the sender, wherein the signed filename associated with the first computer file comprises a first digital signature encoded in the original filename of the first computer file, and wherein the first digital signature is a digital signature of a hash value H₁ of a first hash function applied to only the digital data comprised by the first computer file subject to the digital signature of H₁ having been computed using the private key of the sender;

extracting, by the receiver, the master digital signature from the signed filename associated with the master computer file in the received composite computer file;

recovering, by the receiver, the hash value H₀ from the extracted master digital signature using a public key of the sender associated with the private key of the sender;

computing, by the receiver, a hash value H₀□

of the master hash function applied to only the digital data comprised by the master computer file in the received composite computer file;

determining, by the receiver, that H₀□

=H₀ which authenticates the master computer file in the received composite computer file;

extracting, by the receiver, the first digital signature from the signed filename associated with the first computer file in the received composite computer file;

recovering, by the receiver, the hash value H₁ from the extracted first digital signature using the public key of the sender associated with the private key of the sender;

computing, by the receiver, a hash value H₁□

of the first hash function applied to only the digital data comprised by the first computer file in the received composite computer file;

determining, by the receiver, that H₁□

=H₁ which authenticates the first computer file in the received composite computer file.

11. The method of claim 10,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀; and

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁.

12. The method of claim 10, wherein the composite computer file further comprises a second computer file having an original filename, wherein the second computer file in the composite computer file comprises an associated signed filename, wherein the second computer file is attached to the master computer file in the received composite computer file, wherein the signed filename associated with the second computer file comprises a second digital signature encoded in the original filename of the second computer file, wherein the second digital signature is a digital signature of a hash value H₂ of a second hash function applied to only the digital data comprised by the second computer file subject to the digital signature of H₂ having been computed using the private key of the sender;

and wherein the method further comprises;

extracting, by the receiver, the second digital signature from the signed filename associated with the second computer file in the received composite computer file;

recovering, by the receiver, the hash value H₂ from the extracted second digital signature using the public key of the sender associated with the private key of the sender;

computing, by the receiver, a hash value H₂□

of the second hash function applied to only the digital data comprised by the second computer file in the received composite computer file; and

determining, by the receiver, that H₂□

=H₂ which authenticates the second computer file in the received composite computer file.

13. The method of claim 12,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the original filename structured of the second computer file is structured as FNAME₂.EXT₂ such that FNAME₂ denotes an alphanumeric name portion of the original filename of the second computer file and EXT₂ denotes an alphanumeric file extension portion of the original filename of the second computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀;

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁; and

wherein the signed filename of the second computer file comprises the computed digital signature of the hash value H₂ disposed between FNAME₂ and EXT₂.

14. The method of claim 10, wherein the master computer file is an electronic mail (e-mail).

15. A method for authenticating information in the filenames of computer files containing digital data, said method comprising:

receiving, by a receiver from a sender, a composite computer file comprising a master computer file having an original filename and a signed first link that points to a first computer file having an original filename, wherein the master computer file in the composite computer file comprises an associated signed filename, wherein the signed filename associated with the master computer file comprises a master digital signature encoded in the original filename of the master computer file, wherein the master digital signature is a digital signature of a hash value H₀ of a master hash function applied to only the digital data comprised by the master computer file subject to the digital signature of H₀ having been computed using a private key of the sender, wherein the signed first link comprises a first digital signature encoded in the original filename of the first computer file, and wherein the first digital signature is a digital signature of a hash value H₁ of a first hash function applied to only the digital data comprised by the first computer file subject to the digital signature of H₁ having been computed using the private key of the sender;

extracting, by the receiver, the master digital signature from the signed filename associated with the master computer file in the received composite computer file;

recovering, by the receiver, the hash value H₀ from the extracted master digital signature using a public key of the sender associated with the private key of the sender;

computing, by the receiver, a hash value H₀□

of the master hash function applied to only the digital data comprised by the master computer file in the received composite computer file;

determining, by the receiver, that H₀□

=H₀ which authenticates the master computer file in the received composite computer file;

extracting, by the receiver, the first digital signature from the signed first link in the received composite computer file;

recovering, by the receiver, the hash value H₁ from the extracted first digital signature using the public key of the sender associated with the private key of the sender;

computing, by the receiver, a hash value H₁□

of the first hash function applied to only the digital data comprised by the first computer file in the received composite computer file; and

determining, by the receiver, that H₁□

=H₁ which authenticates the first computer file pointed to by the signed first link in the received composite computer file.

16. The method of claim 15,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀; and

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁.

17. The method of claim 15 wherein the composite computer file further comprises a signed second link that points to a second computer file having an original filename, wherein the signed second link comprises a second digital signature encoded in the original filename of the second computer file, wherein the second digital signature is a digital signature of a hash value H₂ of a second hash function applied to only the digital data comprised by the second computer file subject to the digital signature of H₂ having been computed using the private key of the sender, and wherein the method further comprises:

extracting, by the receiver, the second digital signature from the signed second link in the received composite computer file;

recovering, by the receiver, the hash value H₂ from the extracted second digital signature using the public key of the sender associated with the private key of the sender;

computing, by the receiver, a hash value H₂□

of the second hash function applied to only the digital data comprised by the second computer file in the received composite computer file; and

determining, by the receiver, that H₂□

=H₂ which authenticates the second computer file pointed to by the signed second link in the received composite computer file.

18. The method of claim 17,

wherein the original filename of the master computer file is structured as FNAME₀.EXT₀ such that FNAME₀ denotes an alphanumeric name portion of the original filename of the master computer file and EXT₀ denotes an alphanumeric file extension portion of the original filename of the master computer file;

wherein the original filename structured of the first computer file is structured as FNAME₁.EXT₁ such that FNAME₁ denotes an alphanumeric name portion of the original filename of the first computer file and EXT₁ denotes an alphanumeric file extension portion of the original filename of the first computer file;

wherein the original filename structured of the second computer file is structured as FNAME₂.EXT₂ such that FNAME₂ denotes an alphanumeric name portion of the original filename of the second computer file and EXT₂ denotes an alphanumeric file extension portion of the original filename of the second computer file;

wherein the signed filename of the master computer file comprises the computed digital signature of the hash value H₀ disposed between FNAME₀ and EXT₀;

wherein the signed filename of the first computer file comprises the computed digital signature of the hash value H₁ disposed between FNAME₁ and EXT₁; and

wherein the signed filename of the second computer file comprises the computed digital signature of the hash value H₂ disposed between FNAME₂ and EXT₂.

19. The method of claim 15, wherein the master computer file is an electronic mail (e-mail).