Method and system for server based secure auditing for revisioning of electronic document files

Patent metadata

Field	Value
Publication number	US-10164952-B2
Application number	US-201615044607-A
Country	US
Kind code	B2
Filing date	Feb 16, 2016
Priority date	Feb 16, 2016
Publication date	Dec 25, 2018
Grant date	Dec 25, 2018

Abstract

Methods and systems for providing secure recording of revisions made to electronic documents, using secure methods to validate the recorded changes, are disclosed. An electronic device making a change to an electronic document can transmit the change to the network. An audit log chain is residing on the network and shared among all the nodes on the network. A node on the network can verify a change of document made by other nodes and add a new block to the chain using one-way hashes, making the chain resistant to tampering. If an invalid block is detected, the system can send an auditing alert to the network. The audit log can be strongly resistant to tampering, providing reliable evidence for use in audit compliance, investigations, and business or court record keeping.

First claim

The invention claimed is:

1. A system for securely auditing revisions to an electronic document, the system comprising:
a processing device; and
a hardware-based non-transitory storage medium operably connected to the processing device and configured to store a set of instructions that, when executed, cause the processing device to:
receive a signed data packet, wherein the signed data packet comprises:
a diff data structure that represents a difference between a first version of an electronic document and a revision of the electronic document, and
an identifier associated with a user who created the revision,
wherein the signed data packet is signed with a private key associated with the user,

create a block by grouping the signed data packet and a plurality of additional signed data packets, wherein at least one of the additional signed data packets comprises:
a second diff data structure representing either a second difference between two versions of the electronic document or a difference between two versions of a second electronic document, and
a second identifier associated with a user responsible for the second difference or the difference between two versions of the second electronic document,

access a blockchain on a communication network, validate the block,
if validation of the block succeeds, update the blockchain to include the block so that the blockchain is available to a plurality of authorized additional user electronic devices via the communication network, and
if validation of the block fails, generate an alert and transmit the alert to the communication network.

2. The system of claim 1 , wherein the instructions further comprise additional instructions that, when executed, cause the processing device to:
verify the signed data packet before creating the block; and
upon verification of the signed data packet, create the block.

3. The system of claim 2 , wherein the instructions for causing the processing device to verify the signed data packet comprise additional instructions that, when executed, cause the processing device to:
verify the signed data packet against one or more rules to determine whether the one or more rules are satisfied; and
generate an alert when at least one of the one or more rules is not satisfied.

4. The system of claim 1 , wherein the instructions for causing the processing device to validate the block further comprise instructions that will cause the processing device to:
verify if the block is already validated by an additional node of the system; and
abandon the validation of the block if the block is already validated.

5. The system of claim 1 , wherein the set of instructions further comprises instructions that will cause the processing device to obtain an updated blockchain if the processing device is offline for a period of time.

6. The system of claim 1 , wherein the set of instructions further comprises instructions that will cause the processing device to obtain an updated blockchain if one or more quality criteria associated with validating the block are not satisfied.

7. The system of claim 1 , wherein the signed data packet further comprises at least one of a system name, an uptime, a number of transactions processed, a number of transactions in an unassigned pool, a current time and location of an electronic device that includes the processing device, or a user of the electronic device that includes the processing device.

8. The system of claim 1 , wherein the set of instructions comprises further instructions that will cause the processing device to respond to a request for validation of the processing device.

9. The system of claim 1 , wherein the processing device is a component of a remote server on the communication network.

10. A method for securely auditing revisions to an electronic document, the method comprising:
receiving, by a processing device, a signed data packet, wherein the signed data packet comprises a diff data structure representing a difference between a first version of an electronic document and a revision of the electronic document, and an identifier associated with a user who created the revision, wherein the signed data packet is signed with a private key associated with the user;
creating, by the processing device, a block by grouping the signed data packet and a plurality of additional signed data packets, wherein at least one of the additional signed data packet comprises:
a second diff data structure representing either a second difference between two versions of the electronic document or a difference between two versions of a second electronic document, and
a second identifier associated with a user responsible for the second difference or the difference between two versions of the second electronic document;

accessing a blockchain on a communication network;
validating the block;
if validation of the block succeeds, updating the blockchain to include the block so that the blockchain is available to a plurality of authorized additional user electronic devices via the communication network; and
if validation of the block fails, generating an alert and transmit the alert to the communication network.

11. The method of claim 10 , further comprising:
verifying, by the processing device, the signed data packet before creating the block; and
upon verification of the signed data packet, creating the block.

12. The method of claim 11 , wherein verifying the signed data packet comprises:
verifying the signed data packet against one or more rules to determine whether the one or more rules are satisfied; and
generating an alert when at least one of the one or more rules is not satisfied.

13. The method of claim 10 , wherein validating the block comprises:
verifying if the block is already validated by an additional node of the system; and
abandoning the validation of the block if the block is already validated.

14. The method of claim 10 , further comprising obtaining an updated blockchain if the processing device is offline for a period of time.

15. The method of claim 10 , further comprising obtaining an updated blockchain if one or more quality criteria associated with validating the block are not satisfied.

16. The method of claim 10 , wherein the signed data packet further comprises at least one of a system name, an uptime, a number of transactions processed, a number of transactions in an unassigned pool, a current time and location of a user electronic device that includes the processing device, or a user of the electronic device that includes the processing device.

17. The method of claim 10 , further comprising responding to a request for validation of the processing device.

18. The method of claim 10 , wherein the processing device is a remote server on the communication network.

19. A system for securely auditing revisions to an electronic document, the system comprising:
a processing device; and
a hardware-based non-transitory storage medium operably connected to the processing device and configured to store a set of instructions that, when executed, cause the processing device to:
receive a signed data packet, wherein the signed data packet comprises:
a diff data structure representing a difference between a first version of an electronic document and a revision of the electronic document, and
an identifier associated with a user who created the revision,
wherein the signed data packet is signed with a private key associated with the user,

verify the signed data packet, and
upon verif

Assignees

• Xerox Corp

Inventors

• Vandervort David R

Classifications

• H04L2209/38

  Electricity · mapped topic

• H04L63/0442 Primary

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title