Persistent File Signatures for Non-Executable Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mechanisms lack the ability to create signatures for non-executable files such as configuration files, scripts, descriptive text files, and media files, which are often included in software distributions, compromising security and integrity in the software supply chain.
Innovation Solution
A method and system for creating a persistent, independent signature for files using a private key, certificate identifier, and hash algorithm, storing the signature in the file footer rather than the header, allowing verification of file contents and headers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional signature mechanisms are used for executable files, then security validation is achieved, but the mechanism cannot be applied to non-executable files such as configuration files, scripts, and media files
Solution Approach 1:
The patent creates a universal signature mechanism that works across all file types by using file-based attributes (header and footer) that can be extracted from any file regardless of its type. The system processes files uniformly by extracting these attributes and creating signatures based on them, making the mechanism applicable to executable files, configuration files, scripts, text files, and media files alike.
Solution Approach 2:
The patent segments files into distinct components - specifically the header and footer attributes - that can be independently extracted and processed. This segmentation allows the signature mechanism to focus on specific file portions that are consistent across different file types, enabling reliable verification without requiring type-specific processing.
2Reliability
If signatures are created for all file types using file-based attributes, then comprehensive security coverage is achieved, but the complexity of the signing and verification process increases
Solution Approach 1:
The patent applies homogeneity by using a uniform signature creation and verification process for all file types. The same algorithmic steps - extracting header and footer attributes, creating encrypted hashes, and verifying signatures - are applied consistently regardless of file type, reducing operational complexity despite the universal applicability.
Solution Approach 2:
The patent creates simplified representations (copies) of file content through hash functions. Instead of processing entire files of various types, the system creates compact hash copies of the header and footer attributes, which are then signed and verified. This copying approach simplifies the verification process while maintaining integrity checks for all file types.
3Ease of operation
If signatures are stored in the file header, then verification is straightforward, but it conflicts with existing file header structures and may corrupt file metadata
Solution Approach 1:
Instead of placing the signature in the traditional header location, the patent inverts the approach by storing signature-related information in the file footer. This reversal avoids conflicts with existing header structures and metadata while still providing accessible verification, as the footer is a less critical area that can accommodate additional data without corrupting essential file information.
Solution Approach 2:
The patent extracts the signature functionality from the file header and places it in the footer region. This extraction separates the signature storage from critical header metadata, preventing potential corruption while maintaining verification capabilities. The system takes out the signature data from its traditional location and relocates it to a safer position in the file structure.
Data Source
AI summary
A processor-based method for securing files through a persistent signature includes selecting file contents; selecting a file header associated with the file contents; selecting a private key, a certificate identifier and a hash algorithm identifier; creating an encrypted hash of the file contents and file header using the hash algorithm and private key; and creating a persistent, independent signature for the file contents and file header that identifies the certificate identifier, hash algorithm identifier, and the encrypted hash value.