Cloud Integration Tamper Protection via Critical Field Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based integration systems compromise end-to-end tamper protection and non-repudiation by invalidating digital signatures during data transformation, leading to security gaps and increased business risks for receivers.
Innovation Solution
Implementing a cloud-based integration system that extracts and digitally signs critical fields from B2B data, maintaining their integrity through normalization and fingerprinting, and verifying these fingerprints at the receiver to ensure data authenticity and prevent tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud-based integration systems perform data transformation from sender to receiver format, then data exchange between different systems is enabled, but digital signatures become invalid and tamper protection is compromised
Solution Approach 1:
The patent segments the data into critical fields that require signature protection and non-critical fields that can be transformed. By extracting and separately handling critical fields, the system maintains signature validity for essential data while allowing format transformation for other elements, thus resolving the contradiction between adaptability and reliability.
Solution Approach 2:
The patent extracts critical fields from the complete data set before transformation. This extraction allows the critical fields to be processed differently (maintained in original format with signatures) while the rest of the data undergoes format transformation, enabling both signature validity and data compatibility.
2Reliability
If local integration middleware digitally signs B2B data before transformation, then tamper protection is maintained, but the signature becomes invalid after cloud-based transformation
Solution Approach 1:
The patent applies digital signatures to extracted critical fields before the cloud-based transformation process. This preliminary action ensures that the signature is created on the original critical data structure, and subsequent transformations do not affect the signature validity since the critical fields are handled separately.
3Reliability
If the sender digitally signs the complete B2B data structure, then non-repudiation is achieved, but any transformation by the cloud system invalidates the signature
Solution Approach 1:
The patent extracts only the critical fields from the complete B2B data structure for signing. This extraction enables the signature to cover only the essential elements that require non-repudiation protection, while allowing the cloud system to freely transform non-critical fields without affecting signature validity.
4Reliability
If the cloud integration system re-signs transformed data, then tamper protection is restored, but the original sender's signature is replaced and non-repudiation is lost
Solution Approach 1:
The patent uses extracted critical fields as an intermediary that maintains the connection between the original sender's signature and the transformed data. The signature is applied to this intermediary representation rather than the complete transformed data, preserving sender identity while enabling cloud transformation.
Data Source
AI summary
The present disclosure involves systems and methods for providing end-to-end tamper protection in a cloud integration environment. One example method includes receiving, at a receiver in a cloud-based integration scenario, a B2B communication from a sender including data associated with a business transaction, the received communication in a target format. The cloud-based integration system transforms the original communication in a source format into the target format of the receiver. A digitally-signed sender fingerprint of critical fields extracted from the set of data associated with the at least one business transaction in the source format of the original B2B communication are received and verified as signed by the sender. A receiver fingerprint in the target format is generated using the critical fields from the received communication based on a pre-defined algorithm. The sender fingerprint and the generated receiver fingerprint are compared to determine if they are identical.