Secure revisioning auditing system for electronic document files

Patent metadata

Field	Value
Publication number	US-10129032-B2
Application number	US-201615044574-A
Country	US
Kind code	B2
Filing date	Feb 16, 2016
Priority date	Feb 16, 2016
Publication date	Nov 13, 2018
Grant date	Nov 13, 2018

Abstract

Methods and systems for providing secure recording of revisions made to electronic documents, using secure methods to validate the recorded changes, are disclosed. An electronic device making a change to an electronic document can transmit the change to the network. An audit log chain is residing on the network and shared among all the nodes on the network. A node on the network can verify a change of document made by other nodes and add a new block to the chain using one-way hashes, making the chain resistant to tampering. If an invalid block is detected, the system can send an auditing alert to the network. The audit log can be strongly resistant to tampering, providing reliable evidence for use in audit compliance, investigations, and business or court record keeping.

First claim

The invention claimed is:

1. A method of securely auditing revisions to an electronic document, the method comprising:
by a system comprising a processing device, executing programming instructions that will cause the processing device of the system to:
identify a first version of an electronic document,
receive, from a user electronic device, a revised version of the electronic document,
analyze the first version and the revised version to create a diff between the first version and the revised version,
form a data packet that comprises the diff and an identifier for the user electronic device or for a user of the user electronic device,
access a private key for the user or the user electronic device,
sign the data packet with the private key,
transmit the signed data packet to a plurality of nodes on a communication network; and

by a processing device of a first node on the communication network, executing programming instructions that will cause the processing device of the first node to:
receive the signed data packet,
create a block comprising the signed data packet and a plurality of additional signed data packets,
access a chain on the communication network,
validate the block, and
upon validation of the block,
update the chain based on the validated block, and
save the updated chain to a memory so that the chain is available to a plurality of authorized additional user electronic devices via the communication network.

2. The method of claim 1 , further comprising, by the processing device of the first node on the communication network, executing additional programming instructions that will cause the processing device of the node to:
verify the signed data packet before creating the block; and
upon verification of the signed data packet, create the block comprising the signed, verified data packet and a plurality of additional signed data packets.

3. The method of claim 2 , wherein verifying the signed data packet comprises:
verifying the signed data packet against one or more rules to determine whether the one or more rules are satisfied; and
generating an alert when at least one of the one or more rules is not satisfied.

4. The method of claim 1 , further comprising, by the processing device of the system, executing programming instructions that will also cause the processing device of the system to:
receive, from a second user electronic device, a second revised version of the electronic document;
analyze the revised version and the second revised version to create a second diff;
form a second data packet that comprises the second diff and an identifier for the second user electronic device or for a second user of the second user electronic device;
identify a second private key for the second user or the second user electronic device;
sign the second data packet with the second private key; and
transmit the second signed data packet to the plurality of nodes on the communication network.

5. The method of claim 1 , wherein accessing the private key comprises receiving the private key from a key store or a wallet.

6. The method of claim 1 , wherein accessing the private key comprises generating the private key.

7. The method of claim 1 , wherein validating the block comprises:
verifying whether the block is already validated by an additional node of the system; and
abandoning the validation of the block if the block is already validated.

8. The method of claim 1 , wherein accessing the chain on the communication network comprises obtaining an updated chain from the communication network if the node on the communication network is offline for a period of time.

9. The method of claim 1 , wherein accessing the chain on the communication network comprises obtaining an updated chain from the communication network if one or more quality criteria associated with validating the block are not satisfied.

10. The method of claim 1 , wherein the signed data packet further comprises at least one of a system name, an uptime, a number of transactions processed, a number of transactions in an unassigned pool, a current time and location of the user electronic device or a user of the user electronic device.

11. The method of claim 1 , further comprising executing programming instructions that will cause the processing device of the system to validate one or more of the plurality of nodes on the communication network.

12. A system for securely auditing revisions to an electronic document, the system comprising:
a processing device; and
a hardware-based non-transitory storage medium operably connected to the processing device and configured to store a set of instructions that, when executed, cause the processing device to:
identify a first version of an electronic document,
receive, from a user electronic device, a revised version of the electronic document,
analyze the first version and the revised version to create a diff between the first version and the revised version,
form a data packet that comprises the diff and an identifier for the user electronic device or for a user of the user electronic device,
access a private key for the user or the user electronic device,
sign the data packet with the private key,
transmit the signed data packet to a plurality of nodes on a communication network, and
receive an alert from the communication network when at least one of the plurality of nodes on the communication network fails to verify the signed data packet; and
a first node on the communication network, wherein the first node is configured to execute programming instructions that will cause the first node to:
receive the signed data packet,
create a block comprising the signed data packet and a plurality of additional signed data packets,
access a chain on the communication network,
validate the block, and
upon validation of the block,
update the chain based on the validated block, and
save the updated chain to a memory so that the chain is available to a plurality of authorized additional user electronic devices via the communication network.

13. The system of claim 12 , wherein the processing device is configured to:
receive, from a second user electronic device, a second revised version of the electronic document;
analyze the revised version and the second revised version to create a second diff;
form a second data packet that comprises the second diff and an identifier for the second user electronic device or for a second user of the second user electronic device;
identify a second private key for the second user or the second user electronic device;
sign the second data packet with the second private key; and
transmit the second signed data packet to the plurality of nodes on the communication network.

14. The system of claim 12 , wherein the instructions for causing the processing device to access the private key comprises further instructions that will cause the processing device to receive the private key from a key store or a wallet.

15. The system of claim 12 , wherein the instructions for causing the processing device to access the private key comprises further instructions that will cause the processing device to generate the private key.

16. The system of claim 12 , wherein the signed data packet further comprises at least one of a system name, an uptime, a number of transactions processed, a number of transactions in an unassigned pool, a current time and location of the user electronic device or a user of the user electronic device.

17. The system of claim 15 , wherein the set of instru

Assignees

• Xerox Corp

Inventors

• Vandervort David R

Classifications

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L2209/38

  Electricity · mapped topic

• H04L9/3247 Primary

  involving digital signatures · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title