Nested digital signatures with constant file size

• US 8,793,499 B2
• Filed: 01/20/2012
• Issued: 07/29/2014
• Est. Priority Date: 01/20/2012
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Loughry, Robert Joseph
• Primary Examiner(s): Hirl, Joseph P.
• Assistant Examiner(s): BELL, KALISH K
• Application Number:
  US13/355,210
• Publication Number:
  US 20130191642A1
• Time in Patent Office: 921 Days
• Field of Search: 713/170, 713/176, 713/189, 713/193, 726/22, 380/259, 709/246
• US Class Current: 713/176
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A system and method are provided for implementing a digital signature scheme for embedding and validating multiple nested digital signatures in digitally produced documents without modifying a file size of the digitally produced and signed documents or otherwise corrupting previously-embedded digital signatures. A number of fixed fields are included in a digitally produced document, upfront, that will be populated with multiple digital signatures. With the fixed fields in the digitally produced documents, the entire file is cryptographically “hashed” and the individual digital signatures are independently verifiable via simple cryptographic schemes. Multiple digital signatures are embedded in documents including complex file formats in a manner that does not corrupt the documents. Known cryptographic techniques such as, for example, a known hash algorithm, are applied to the digitally produced documents including the multiple sequentially input digital signatures in a process that is independently verifiable.

Claims

1. A method for implementing a digital signature scheme, comprising:

obtaining a digital document;

embedding, using a processor, a pre-determined number of pairs of data fields in the digital document and filling the pre-determined number of pairs of data fields with filler data according to a pre-determined scheme that is known to signatories of the digital document to arrive at a final digital document having a specified resultant final document size;

applying an encrypting hash scheme to the final digital document to obtain a first hash value;

encrypting the first hash value using a first encryption key to obtain a first digital signature;

substituting a first identifier associated with the first encryption key for the filler data in a first data field of a first pair of the pre-determined number of pairs of data fields in the final digital document; and

separately substituting the first digital signature for the filler data in a second data field of the first pair of the pre-determined number of pairs of data fields in the final digital document to obtain a first signed final digital document,

the first signed final digital document maintaining a same specified resultant final document size based on the substitutions of the first identifier and the first digital signature separately in the first and second data fields of the first pair of the pre-determined number of pairs of data fields.

2. The method of claim 1, the first identifier, the first encryption key and the first digital signature being associated with a document author.

3. The method of claim 1, further comprising:

applying the encrypting hash scheme to the first signed final digital document to obtain a second hash value;

encrypting the second hash value using a second encryption key to obtain a second digital signature;

substituting a second identifier associated with the second encryption key for the filler data in a first data field of a second pair of the the pre-determined number of pairs of data fields in the first signed final digital document; and

separately substituting the second digital signature for the filler data in a second data field of the second pair of the pre-determined number of pairs of data fields in the first signed final digital document to obtain a second signed final digital document,

the second signed final digital document maintaining the same specified resultant final document size based on the substitutions of the second identifier and the second digital signature separately in the first and second data fields of the second pair of the pre-determined number of pairs of data fields.

4. The method of claim 3, the second identifier, the second encryption key and the second digital signature being associated with a document reviewer.

5. The method of claim 4, further comprising:

applying the encrypting hash scheme to a current version of a signed final digital document to obtain a next in numerical order hash value;

encrypting the next in numerical order hash value using a next in numerical order encryption key to obtain a next in numerical order digital signature, and

substituting an identifier associated with the next in numerical order encryption key for the filler data in a first data field of a next in numerical order pair of the pre-determined number of pairs of data fields in the current version of the signed final digital document; and

separately substituting the next in numerical order digital signature for the filler data in a second data field of the next in numerical order pair of the pre-determined number of pairs of data fields for at least one additional document reviewer to generate a next in numerical order signed final digital document,

the next in numerical order signed final digital document maintaining the same specified resultant final document size as previous versions.

6. The method of claim 4, further comprising:

validating the second signed final digital document with the second digital signature, the validating comprising;

temporarily replacing the second identifier associated with the second encryption key with the filler data previously populating the first data field of the second pair of the pre-determined number of pairs of data fields in the second signed final digital document based on the knowledge by the signatories of the pre-determined scheme;

temporarily replacing the second digital signature with the filler data previously populating the second data field of the second pair of the pre-determined number of pairs of data fields in the second signed final digital document based on the knowledge by the signatories of the pre-determined scheme to obtain a first review final digital document;

applying the encrypting hash scheme to the first review final digital document to obtain a first review hash value;

encrypting the first review hash value using the second encryption key to obtain a first review digital signature;

comparing the first review digital signature to the second digital signature; and

rejecting the second signed final digital document when the first review digital signature and the second digital signature do not match.

7. The method of claim 6, the validating further comprising:

temporarily replacing the first identifier associated with the first encryption key with the filler data previously populating the first data field of the first pair of the pre-determined number of pairs of data fields in the first review final digital document based on the knowledge by the signatories of the pre-determined scheme;

temporarily replacing the first digital signature with the filler data previously populating the second data field of the first pair of the pre-determined number of pairs of data fields in the first review final digital document based on the knowledge by the signatories of the pre-determined scheme to obtain a second review final digital document;

applying the encrypting hash scheme to the second review final digital document to obtain a second review hash value;

encrypting the second review hash value using the first encryption key to obtain a second review digital signature;

comparing the second review digital signature to the first digital signature; and

rejecting the second signed final digital document when the second review digital signature and the first digital signature do not match.

8. The method of claim 7, further comprising:

sealing the second signed final digital document with the second digital signature when the second signed final digital document is not rejected, the sealing comprising;

reverting to the second signed digital document with the first identifier associated with the first encryption key, the first digital signature, the second identifier associated with the second encryption key and the second digital signature respectively populating the first data field and the second data field in the first pair and the second pair of the pre-determined number of pairs of data fields;

applying the encrypting hash scheme to the second signed final digital document to obtain a sealing hash value;

encrypting the sealing hash value using a separate encryption key that is associated with at least one of a system or an application that performs the digital signature scheme to obtain a sealing digital signature;

substituting a separate identifier associated with the separate encryption key for the filler data in a first data field of a next pair of the pre-determined number of pairs of data fields in the second signed final digital document; and

separately substituting the sealing digital signature for the filler data in a second data field of the next pair of the pre-determined number of data fields in the second signed final digital document to obtain a sealed digital document.

9. The method of claim 1, the digital document including a complex file format, the complex file format being a National Imagery Transmission Format (NITF).

10. A system for implementing a digital signature scheme, comprising:

an external communication interface via which a digital document is obtained from a system that generates the digital document;

a data field adding and filling device that embeds a pre-determined number of pairs of data fields in the digital document and fills the pre-determined number of pairs of data fields with filler data according to a pre-determined scheme that is known to the signatories of the digital document to arrive at a final digital document having a specified resultant final document size; and

a cryptographic scheme implementing device that applies an encrypting hash scheme to the final digital document to obtain a hash value and that encrypts the hash value using an encryption key to obtain a digital signature,

the data field adding and filling device (1) substituting an identifier associated with the encryption key for the filler data in a first data field of a first pair of the pre-determined number of pairs of data fields in the final digital document, and (2) separately substituting the digital signature for the filler data in a second data field of the first pair of the pre-determined number of pairs of data fields in the final digital document to obtain a signed final digital document, the signed final digital document maintaining the same specified final document size based on the substitutions of the identifier and the digital signature separately in the first and second data fields of the first pair of the pre-determined number of pairs of data fields.

11. The system of claim 10, the identifier, the encryption key and the digital signature being associated with a document author.

12. The system of claim 10, the cryptographic scheme implementing device applying the encrypting hash scheme to the signed final digital document to obtain another hash value and encrypting the another hash value using another encryption key to obtain another digital signature, and the data field adding and filling device (1) substituting another identifier associated with the another encryption key for the filler data in a first data field of a subsequent pair of the multiple pairs of data fields in the signed final digital document, and (2) separately substituting the another digital signature for the filler data in a second data field of the subsequent pair of the pre-determined number of pairs of data fields in the signed final digital document to obtain a multiply signed final digital document, the multiply signed final digital document maintaining the same specified final document size based on the substitutions of the another identifier and the another digital signature separately in the first and second data fields of the subsequent pair of the pre-determined number of pairs of data fields.

13. The system of claim 12, the another identifier, the another encryption key and the another digital signature being associated with a document reviewer.

14. The system of claim 10, further comprising:

a hash value/data comparing device that (1) temporarily replaces the identifier associated with the encryption key with the filler data that previously populated the first data field of the first pair of the pre-determined number of pairs of data fields of the signed final digital document based on the knowledge by the signatories of the pre-determined scheme, and (2) temporarily replaces the digital signature with the filler data that previously populated the second data field of the first pair of the pre-determined number of pairs of data fields of the signed final digital document based on the knowledge by the signatories of the pre-determined scheme to obtain a temporarily modified digital document; and

a document rejecting device,

the cryptographic scheme implementing device applying the encrypting hash scheme to the temporarily modified digital document to obtain a comparing hash value and encrypting the hash value using the encryption key to obtain a comparing digital signature,

the hash value/data comparing device comparing the comparing digital signature to the digital signature to determine whether the digital signatures match, and

the document rejecting device directing that no further processing occur with regard to the digital document when the hash value/data comparing device determines that the signatures do not match.

15. A non-transitory computer-readable medium storing instructions which, when executed by a processor, cause the processor to execute a method for implementing a digital signature scheme, comprising:

obtaining a digital document;

embedding pre-determined number of pairs of data fields in the digital document and filling the pre-determined number of pairs of data fields with filler data according to a pre-determined scheme that is known to signatories of the digital document to arrive at a final digital document having a specified resultant final document size;

applying an encrypting hash scheme to the final digital document to obtain a first hash value;

encrypting the first hash value using a first encryption key to obtain a first digital signature;

substituting a first identifier associated with the first encryption key for the filler data in a first data field of a first pair of the pre-determined number of pairs of data fields in the final digital document; and

separately substituting the first digital signature for the filler data in a second data field of the first pair of the pre-determined number of pairs of data fields in the final digital document to obtain a first signed final digital document,

the first signed final digital document maintaining a same specified resultant final document size based on the substitutions of the first identifier and the first digital signature separately in the first and second data fields of the first pair of the pre-determined number of pairs of data fields.

16. The non-transitory computer-readable medium of claim 15, the method further comprising:

applying the encrypting hash scheme to the first signed final digital document to obtain a second hash value;

encrypting the second hash value using a second encryption key to obtain a second digital signature; and

substituting a second identifier associated with the second encryption key for the filler data in a first data field of a second pair of the pre-determined number of pairs of data fields in the first signed final digital document; and

separately substituting the second digital signature for the filler data in a second data field of the second pair of the pre-determined number of pairs of data fields in the first signed final digital document to obtain a second signed final digital document,

the second signed final digital document maintaining the same specified resultant final document size based on the substitutions of the second identifier and the second digital signature separately in the first and second data fields of the second pair of the pre-determined number of pairs of data fields.

17. The non-transitory computer-readable medium of claim 16, the method further comprising:

applying the encrypting hash scheme to a current version of a signed final digital document to obtain a next in numerical order hash value,

encrypting the next in numerical order hash value using a next in numerical order encryption key to obtain a next in numerical order digital signature, and

substituting an identifier associated with the next in numerical order encryption key for the filler data in a first data field of a next in numerical order pair of the pre-determined number of pairs of data fields in the current version of the signed final digital document; and

separately substituting the next in numerical order digital signature for the filler data in a second data field of the next in numerical order pair of the pre-determined number of pairs of data fields for at least one additional document reviewer to generate a next in numerical order signed final digital document,

the next in numerical order signed final digital document maintaining the same specified resultant final document size as previous versions.

18. The non-transitory computer-readable medium of claim 17, the method further comprising:

validating the second signed final digital document with the second digital signature, the validating comprising;

temporarily replacing the second identifier associated with the second encryption key with the filler data previously populating the first data field of the second pair of the pre-determined number of pairs of data fields in the second signed final digital document based on the knowledge by the signatories of the pre-determined scheme;

temporarily replacing the second digital signature with the filler data previously populating the second data field of the second pair of the pre-determined number of pairs of data fields in the second signed final digital document based on the knowledge by the signatories of the pre-determined scheme to obtain a first review final digital document;

applying the encrypting hash scheme to the first review final digital document to obtain a first review hash value;

encrypting the first review hash value using the second encryption key to obtain a first review digital signature;

comparing the first review digital signature to the second digital signature; and

rejecting the second signed final digital document when the first review digital signature and the second digital signature do not match.

19. The non-transitory computer-readable medium of claim 18, the validating further comprising:

temporarily replacing the first identifier associated with the first encryption key with the filler data previously populating the first data field of the first pair of the pre-determined number of pairs of data fields in the first review final digital document based on the knowledge by the signatories of the pre-determined scheme;

temporarily replacing the first digital signature with the filler data previously populating the second data field of the first pair of the pre-determined number of pairs of data fields in the first review final digital document based on the knowledge by the signatories of the pre-determined scheme to obtain a second review final digital document;

applying the encrypting hash scheme to the second review final digital document to obtain a second review hash value;

encrypting the second review hash value using the first encryption key to obtain a second review digital signature;

comparing the second review digital signature to the first digital signature; and

rejecting the second signed final digital document when the second review digital signature and the first digital signature do not match.

20. The non-transitory computer-readable medium of claim 19, the method further comprising:

sealing the second signed final digital document with the second digital signature when the second signed final digital document is not rejected, the sealing comprising;

reverting to the second signed digital document with the first identifier associated with the first encryption key, the first digital signature, the second identifier associated with the second encryption key and the second digital signature respectively populating the first data field and the second data field in the first pair and the second pair of the pre-determined number of pairs of data fields;

applying the encrypting hash scheme to the second signed final digital document to obtain a sealing hash value;

encrypting the sealing hash value using a separate encryption key that is associated with at least one of a system or an application that performs the digital signature scheme to obtain a sealing digital signature;

substituting a separate identifier associated with the separate encryption key for the filler data in a first data field of a next pair of the pre-determined number of pairs of data fields in the second signed final digital document; and

separately substituting the sealing digital signature for the filler data in a second data field of the next pair of the pre-determined number of data fields in the second signed final digital document to obtain a sealed digital document.

21. The non-transitory computer-readable medium of claim 15, the digital document including a complex file format, the complex file format being a National Imagery Transmission Format (NITF).