Systems and methods for establishing data provenance by generating one-time signatures
Presented herein are system and methods for establishing data provenance by generating one-time signatures. A system may include one or more processors that receive, via an application programming interface (API) request, a request for a one-time signature and data associated with the request, provide a seed identifier and the data associated with the request to an HSM in a set of HSMs, and receive a response message from the HSM, the response message including a one-time signature. In examples, the response message and the one-time signature are provided to the device that transmitted the request for the one-time signature and the data associated with the request. Methods and non-transitory computer-readable mediums are also presented.
1 . A computer-implemented method, comprising:
generating, by at least one processor, a request for a one-time signature comprises including a public certificate in the request for the one-time signature that is mapped to one or more accounts indicating an identity of a client, the request based on data to be stored on a server;
providing, by the at least one processor and via an application programming interface (API) associated with a signing environment, the request and the data to be stored on the server to the signing environment to generate the one-time signature;
receiving, by the at least one processor and via the API, a response message comprising the one-time signature in response to generation of the one-time signature by a hardware security module (HSM) for the data to be stored on the server, the HSM configured to generate the one-time signature based on a mapping between a seed and an account of a plurality of accounts;
generating, by the at least one processor, an entry for a distributed ledger associated with the server based on the one-time signature, the entry indicating an association between the data to be stored on the server and the one-time signature; and
transmitting, by the at least one processor, to the server at least a portion of the entry for inclusion in the distributed ledger associated with the server.
2 . The computer-implemented method of claim 1 , further comprising: encrypting, by the at least one processor, the request based on a predetermined encryption scheme, wherein providing the request to the signing environment comprises: providing the request to the signing environment in response to encrypting the request.
3 . The computer-implemented method of claim 1 , wherein receiving the response message comprises: receiving, by the at least one processor, the response message in response to execution of one or more operations by the HSM involving a seed value corresponding to the seed.
4 . The computer-implemented method of claim 1 , wherein generating the entry comprises: updating the data to be stored on the server by hashing at least a portion of the data; and generating the entry in response to updating the data to be stored on the server.
5 . The computer-implemented method of claim 4 , wherein the server comprises a first server, the computer-implemented method further comprising:
providing the one-time signature to a second server to establish provenance of the data stored on the first server.
6 . A system, comprising:
at least one hardware processor programmed to:
generate a request for a one-time signature, the request based on data to be stored on a server, wherein the request includes a public certificate for the one-time signature that is mapped to one or more accounts indicating an identity of a client;
provide, via an application programming interface (API) associated with a signing environment, the request and the data to be stored on the server to the signing environment to generate the one-time signature;
receive, via the API, a response message comprising the one-time signature in response to generation of the one-time signature by a hardware security module (HSM) for the data to be stored on the server, the HSM configured to generate the one-time signature based on a mapping between a seed and an account of a plurality of accounts;
generate an entry for a distributed ledger associated with the server based on the one-time signature, the entry indicating an association between the data to be stored on the server and the one-time signature; and
transmit to the server at least a portion of the entry for inclusion in the distributed ledger associated with the server.
7 . The system of claim 6 , wherein the at least one hardware processor is further programmed to: encrypt the request based on a predetermined encryption scheme, wherein the at least one hardware processor programmed to provide the request to the signing environment is programmed to: provide the request to the signing environment in response to encrypting the request.
8 . The system of claim 6 , wherein the at least one hardware processor programmed to receive the response message is programmed to: receive the response message in response to execution of one or more operations by the HSM involving a seed value corresponding to the seed.
9 . The system of claim 6 , wherein the at least one hardware processor programmed to generating the entry is programmed to: update the data to be stored on the server by hashing at least a portion of the data; and generate the entry in response to updating the data to be stored on the server.
10 . The system of claim 9 , wherein the server comprises a first server, and wherein the at least one hardware processor is further programmed to: provide the one-time signature to a second server to establish provenance of the data to be stored on the first server.
11 . A non-transitory computer-readable medium storing instructions thereon that, when executed by at least one processor, cause the at least one processor to:
generate a request for a one-time signature, the request based on data to be stored on a server;
include a public certificate in the request for the one-time signature that is mapped to one or more accounts indicating an identity of a client;
provide, via an application programming interface (API) associated with a signing environment, the request and the data to be stored on the server to the signing environment to generate the one-time signature;
receive, via the API, a response message comprising the one-time signature in response to generation of the one-time signature by a hardware security module (HSM) for the data to be stored on the server, the HSM configured to generate the one-time signature based on a mapping between a seed and an account of a plurality of accounts;
generate an entry for a distributed ledger associated with the server based on the one-time signature, the entry indicating an association between the data to be stored on the server and the one-time signature; and
transmit to the server at least a portion of the entry for inclusion in the distributed ledger associated with the server.
12 . The non-transitory computer-readable medium of claim 11 , wherein the instructions further cause the at least one processor to: encrypt the request based on a predetermined encryption scheme; and wherein the instructions that cause the at least one processor to provide the request to the signing environment cause the at least one processor to: provide the request to the signing environment in response to encrypting the request.
13 . The non-transitory computer-readable medium of claim 11 , wherein the instructions that cause the at least one processor to receive the response message cause the at least one processor to: receive the response message in response to execution of one or more operations by the HSM involving a seed value corresponding to the seed.
14 . The non-transitory computer-readable medium of claim 11 , wherein the instructions that cause the at least one processor to generate the entry cause the at least one processor to: update the data to be stored on the server by hashing at least a portion of the data; and generate the entry in response to updating the data to be stored on the server.
15 . The non-transitory computer-readable medium of claim 11 , wherein the server comprises a first server, and wherein the instructions further cause the at least one processor to: provide the one-time signature to a second server to establish provenance of the data to be stored on the first server.