Method and system for signing JavaScript object notation (JSON) messages
View Patent ↗A machine-implemented method for signing a JSON message begins by constructing a reference element for each data object in the JSON message. The data object is identified by a reference identifier that includes a pointer to a digest method, and a digest generated by applying the digest method to the data object. Then, a signature information element is constructed for reference elements corresponding to data objects in the message. The signature information element includes a pointer to a signature method, as well as one or more reference elements, or a canonical form of the one or more reference elements. Then, a signature element is constructed that includes the signature information element, and a signature value generated by applying the signature method to the signature information element. The signature enables a sending entity to generate a digest on a JSON message and to secure the digests using a signing key.
1. A method for signing a JavaScript Object Notation (JSON) message, comprising:
for each data object in the JSON message to be signed, constructing a reference element, the reference element including a reference identifier, a pointer to a digest method, and a digest generated by applying the digest method to a given function of the data object;
constructing a signature information element including a pointer to a signature method, and a canonical form of one or more reference elements; and
constructing a signature element including the signature information element, and a signature value generated by applying the signature method to the signature information element;
wherein at least one of the constructing steps is performed using a processor.
2. The method as described in claim 1 wherein the signature element also includes a key information element that includes a key value for use to verify the signature value.
3. The method as described in claim 1 wherein the given function is an ordered data object generated by applying a transform operation to the data object.
4. The method as described in claim 3 wherein the transform operation is a canonicalization method.
5. The method as described in claim 4 wherein the reference element also includes a pointer to the canonicalization method.
6. The method as described in claim 1 wherein the canonical form of the one or more reference elements is generated by applying a canonicalization method to the one or more reference elements.
7. The method as described in claim 6 wherein the signature information element includes a pointer to the canonicalization method.
8. The method as described in claim 6 further including excluding given data from the signature element prior to executing the canonicalization method.
9. The method as described in claim 1 wherein the reference identifier identifies the data object in the JSON message for which the digest has been generated.
10. A method executed at a first processing device, the first processing device having a processor and adapted to exchange data with a second processing device over a communications network using structured data messages, a structured data message comprising a collection of name/value pairs, and an ordered list of values, the method comprising:
for each data object in a message to be signed, constructing a reference element, the reference element including a reference identifier, a pointer to a digest method, and a digest generated by applying the digest method to a given function of the data object;
constructing a signature element, the signature element including a signature information element associated with one or more reference elements, and a signature value generated by applying the signature method to the signature information element; and
outputting the message and the signature element;
wherein at least one of the constructing or outputting steps is carried out using the processor.
11. The method as described in claim 10 further including constructing the signature information element, the signature information element including a pointer to the signature method, and a canonical form of one or more reference elements.
12. The method as described in claim 10 wherein the message is a JSON message.
13. The method as described in claim 10 wherein the signature element is detached from the message.
14. The method as described in claim 10 wherein the signature element is enveloped within the message.
15. The method as described in claim 10 wherein the first processing device comprises one of: a Web browser, and a Web server.
16. A computer program product comprising a non-transitory computer readable medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to sign a JavaScript Object Notation (JSON) message according to the following method steps:
for each data object in the JSON message to be signed, constructing a reference element, the reference element including a reference identifier, a pointer to a digest method, and a digest generated by applying the digest method to a given function of the data object;
constructing a signature information element including a pointer to a signature method, and a canonical form of one or more reference elements; and
constructing a signature element including the signature information element, and a signature value generated by applying the signature method to the signature information element.
17. The computer program product as described in claim 16 wherein the reference identifier identifies the data object in the JSON message for which the digest has been generated.
18. The computer program product as described in claim 16 wherein the signature element also includes a key information element that includes a key value for use to verify the signature value.
19. The computer program product as described in claim 16 wherein the given function is an ordered data object generated by applying a transform operation to the data object.
20. The computer program product as described in claim 16 wherein the canonical form of the one or more reference elements is generated by applying a canonicalization method to the one or more reference elements.
21. The computer program product as described in claim 16 wherein the computer readable program comprises a set of instructions downloaded over a network from a remote data processing system.
22. The computer program product as described in claim 16 wherein the computer readable program comprises a set of instructions are stored in the computer useable medium in a server data processing system, and wherein the set of instructions are downloaded over a network to a client data processing system.
23. Apparatus, comprising:
a processor;
a computer readable medium storing computer program instructions that, when executed by the processor, perform a method of signing a JSON message, the method comprising:
for each data object in the JSON message to be signed, constructing a reference element, the reference element including a reference identifier, a pointer to a digest method, and a digest generated by applying the digest method to a given function of the data object;
constructing a signature information element including a pointer to a signature method, and a canonical form of one or more reference elements; and
constructing a signature element including the signature information element, and a signature value generated by applying the signature method to the signature information element.