Systems and methods for verifying a route taken by a communication
Computer systems and methods for verifying a route taken by a communication are disclosed. In one implementation, a device for verifying a route taken by a communication may include one or more processors configured to obtain a communication transmitted by a source entity. The communication may include data and digital signatures, and each of the digital signatures may be generated based on at least the data. Further, the digital signatures may include a digital signature associated with the source entity, and a set of digital signatures associated with at least a subset of intermediate entities on a route taken by the communication. The one or more processors may be further configured to verify the digital signatures included in the communication, verify whether the entities associated with the digital signatures form an expected route for the communication, and process the data.
1. A device for verifying a route taken by a communication, the device comprising:
one or more processors configured to:
obtain a communication transmitted by a source entity, wherein the communication comprises data and a set of digital signatures, wherein the set of digital signatures includes a digital signature associated with the source entity and one or more digital signatures respectively associated with at least a subset of intermediate entities on the route taken by the communication, and wherein the communication further comprises a header that specifies an order in which each signature of the set of digital signatures was included in the communication;
verify the digital signatures included in the communication;
verify that the digital signatures included in the communication were included in the communication in an expected order based at least in part on the header; and
process the data in response to verifying that the digital signatures were included in the expected order,
wherein the communication comprises a JSON Web Token (JWT) comprising a “payload” key-value pair, wherein a value of the “payload” key-value pair includes the data.
2. The device of claim 1 , wherein the one or more processors are configured to process the data after verifying that the respective entities associated with the digital signatures included in the communication form an expected route for the communication.
3. The device of claim 1 , wherein at least one digital signature of the set of digital signatures is generated further based on the digital signature associated with the source entity.
4. The device of claim 1 , wherein a digital signature of the set of digital signatures is included in the communication by an intermediate entity on the route taken by the communication after the intermediate entity verifies at least one of the digital signatures included in the communication.
5. The device of claim 1 , wherein the one or more processors are configured to process the data after verifying that one or more entities associated with the digital signatures included in the communication are authorized to communicate with the device.
6. The device of claim 1 , wherein the data is encrypted.
7. The device of claim 1 , wherein the JWT further comprises a “signatures” key-value pair, wherein a value of the “signatures” key-value pair includes an array of objects.
8. The device of claim 1 , wherein each digital signature of the set of digital signatures is generated based at least in part on the data using a private key.
9. The device of claim 8 , wherein each digital signature is generated by encrypting a hash value of the data using the private key.
10. A method for verifying a route taken by a communication, the method comprising:
obtaining a communication transmitted by a source entity, wherein the communication comprises data and a set of digital signatures, wherein the set of digital signatures includes a digital signature associated with the source entity and one or more digital signatures respectively associated with at least a subset of intermediate entities on the route taken by the communication, and wherein the communication further comprises a header that specifies an order in which each signature of the set of digital signatures was included in the communication;
verifying the digital signatures included in the communication;
verifying that the digital signatures included in the communication were included in the communication in an expected order based at least in part on the header; and
processing the data in response to verifying that the digital signatures were included in the expected order,
wherein the communication comprises a JSON Web Token (JWT) comprising a “payload” key-value pair, wherein a value of the “payload” key-value pair includes the data.
11. The method of claim 10 , further comprising determining an expected route for the communication, and wherein the processing comprises processing the data after verifying that the respective entities associated with the digital signatures included in the communication form the expected route for the communication.
12. The method of claim 10 , wherein a digital signature of the set of digital signatures is included in the communication by an intermediate entity on the route taken by the communication after the intermediate entity verifies at least one of the digital signatures included in the communication.
13. The method of claim 10 , wherein the processing comprises processing the data after verifying that one or more entities associated with the digital signatures included in the communication are authorized to communicate with a device.
14. The method of claim 10 , wherein the JWT further comprises a “signatures” key-value pair, wherein a value of the “signatures” key-value pair includes an array of objects.
15. The method of claim 10 , wherein each digital signature of the set of digital signatures is generated based at least in part on the data using a private key.
16. The method of claim 15 , wherein each digital signature is generated by encrypting a hash value of the data using the private key.
17. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for verifying a route taken by a communication, the method comprising:
obtaining a communication transmitted by a source entity, wherein the communication comprises data and a set of digital signatures, wherein the set of digital signatures includes a digital signature associated with the source entity and one or more digital signatures respectively associated with at least a subset of intermediate entities on the route taken by the communication, and wherein the communication further comprises a header that specifies an order in which each signature of the set of digital signatures was included in the communication;
verifying the digital signatures included in the communication;
verifying that the digital signatures included in the communication were included in the communication in an expected order based at least in part on the header; and
processing the data in response to verifying that the digital signatures were included in the expected order,
wherein the communication comprises a JSON Web Token (JWT) comprising a “payload” key-value pair, wherein a value of the “payload” key-value pair includes the data.
18. The non-transitory computer-readable storage medium of claim 17 , wherein a digital signature of the set of digital signatures is included in the communication by an intermediate entity on the route taken by the communication after the intermediate entity verifies at least one of the digital signatures included in the communication.
19. The non-transitory computer-readable storage medium of claim 17 , wherein the JWT further comprises a “signatures” key-value pair, wherein a value of the “signatures” key-value pair includes an array of objects.