Websig: a Digital Signature Framework for the Web
Total Page:16
File Type:pdf, Size:1020Kb
WEBSIG: A DIGITAL SIGNATURE FRAMEWORK FOR THE WEB By James P. McCusker A Dissertation Submitted to the Graduate Faculty of Rensselaer Polytechnic Institute in Partial Fulfillment of the Requirements for the Degree of DOCTOR OF PHILOSOPHY Major Subject: COMPUTER SCIENCE Examining Committee: Deborah L. McGuinness, Dissertation Adviser James Hendler, Member Peter Fox, Member Michel Dumontier, Member Rensselaer Polytechnic Institute Troy, New York July 2015 (For Graduation August 2015) c Copyright 2015 by James P. McCusker All Rights Reserved ii CONTENTS LIST OF TABLES . vi LIST OF FIGURES . vii ACKNOWLEDGMENT . viii ABSTRACT . .x 1. Introduction . .1 1.1 Background . .4 1.2 Legal Framework . .7 1.3 Use Case . .8 1.4 Introducing WebSig . .8 1.5 Organization . 10 2. Repudiation, Trust, and Computability in Web Documents . 11 2.1 Trusting Computable Documents on the Web . 14 2.1.1 Sufficient Qualities for Verifiable Computable Signature Schemes 16 2.2 Repudiation of a Signature . 18 2.2.1 Signatory Identification . 18 2.2.2 Intention to Sign . 19 2.2.3 Adoption of Document . 19 2.3 Minimizing Repudiation . 20 2.3.1 Signatory Identification . 21 2.3.2 Intention to Sign . 21 2.3.3 Adoption of Document . 22 3. Related Digital Signature Schemes . 23 3.1 Non-Cryptographic Signatures . 24 3.2 Basic Digital Signatures . 25 3.3 XML Digital Signatures . 26 3.4 RDF Digital Signatures . 27 3.5 Conclusions . 28 iii 4. Parallel Identities for Managing Open Government Data . 29 4.1 Introduction . 29 4.1.1 Use case: Trusting Integrated Data . 32 4.2 Related Work . 34 4.2.1 RDF Conversion Tools . 35 4.2.2 Current Provenance Models . 35 4.2.3 Models from Library Science . 36 4.2.4 Existing Content-Based Cryptographic Digests . 36 4.3 Approach . 37 4.4 Methods . 39 4.5 Results . 40 4.6 Discussion . 41 4.6.1 Future Work . 42 4.7 Conclusions . 43 5. Information Resource Provenance on the Web . 49 5.1 Introduction . 49 5.1.1 A Weather Example . 50 5.2 Background: Existing W3C Recommendations . 52 5.3 The semiotics of HTTP URLs . 53 5.4 FRBR and FRIR . 54 5.5 Explaining HTTP with FRBR, FRIR, and PROV-O . 57 5.6 Implementation . 60 5.7 Discussion . 60 5.8 Conclusion . 62 6. RDF Graph Digest Algorithm 1 . 66 6.1 Introduction . 66 6.2 Related Work . 67 6.2.1 Graph Canonicalization . 68 6.3 Implementation . 69 6.4 Evaluation Methods . 73 6.5 Evaluation . 74 6.5.1 Complexity . 75 iv 6.5.2 Algorithm Portability . 75 6.5.3 Benchmark Results . 76 6.6 Discussion . 80 6.6.1 Future Work . 81 6.7 Conclusion . 82 7. WebSig: A Digital Signature Framework for the Web . 83 7.1 Introduction . 83 7.2 The WebSig Signature Scheme . 84 7.3 Implementing WebSig . 87 7.4 Evaluation . 88 7.4.1 Use Case . 89 7.4.2 WebSig is Linkable . 94 7.4.3 WebSig is Attributable . 94 7.4.4 WebSig is Portable . 95 7.4.5 WebSig is Revisable . 96 7.4.6 WebSig is Verifiable . 96 7.4.7 Performance . 98 7.5 Conclusion . 98 8. Discussion . 99 8.1 Future Work . 102 9. Conclusion . 104 References . 105 v LIST OF TABLES 3.1 Digital signature schemes and their properties. 24 4.1 Different levels of abstraction in the FRBR stack and how they are identified . 38 5.1 The first table contains class mappings between FRBR and PROV-O. 56 6.1 178 ontologies could not be loaded from Bioportal using RDFlib . 75 vi LIST OF FIGURES 1.1 The semantic web technology stack, or \layer cake," as of 2007. .3 4.1 A simple use case where a data consumer must choose between the gov- ernment's original data or one of five data files offered by third parties. 34 4.2 The data products from the use case . 44 4.3 FRBR provenance when Data Integrators E and W retrieve two different URLs. 45 4.4 FRBR provenance when Data Integrator E converts the CSV to raw RDF...................................... 46 4.5 FRBR provenance of the CSV, raw RDF, and a conversion of the raw RDF into RDF/XML . 47 4.6 FRBR provenance applying enhancement parameters to the CSV's con- version to RDF . 48 5.1 The relationships between identifier, resource, and representation from Architecture of the World Wide Web . 51 5.2 AWWW's URL and Resource correspond to the semiotic triangle's Sym- bol and Referent, respectively. 54 5.3 Relating URIs, Resources, and Representations using FRIR, FRBR, and the semiotic triangle . 58 5.4 Results of applying pcurl.py to retrieve the weather result example . 61 5.5 An example of transcoding a histogram image from a large JPEG to a small thumbnail PNG . 64 5.6 An example of mirroring content between web sites . 65 6.1 Th runtime of graphs without blank nodes. 76 6.2 Th runtime of graphs with blank nodes . 77 6.3 Ti performance for non-blank node and blank node graphs where Ti ≈ 0:00145S (R > 0:98, p < 2:22 ∗ 10−77).................... 78 1:88 6.4 Tc performance for blank node graphs where Tc ≈ 0:00032B (R > 0:95, p < 3:0 ∗ 10−94)............................. 79 vii 7.1 A web signature is a special kind of nanopublication, where the Asser- tion and PublicationInfo are identified by their graph digest . 85 7.2 Verification of a web signature . 86 7.3 The sequence used by the signer, signature requester, and signature service agents when a signer is actively interacting with the signature requester . 88 7.4 The sequence used by the signer, signature requester, and signature ser- vice agents when a signer is not actively interacting with the signature requester . 89 7.5 An example web signature assertion that has been signed via the Prove- nance and PublicationInfo graphs. 90 7.6 An example web signature PublicationInfo Graph, that includes an at- tribution of the Assertion graph to the Signing Agent. 91 7.7 An example web signature Provenance graph, with the signature itself, the public key and PublicationInfo graph it was derived from, and the Signing Agent it was attributed to. 92 7.8 The new agreement that allows Bob to access Alice's date of birth, because it was removed from the list of restricted fields. 93 7.9 The submission request for the new agreement includes metadata that says that the new assertions are a revision of the old one, and that the old assertion was invalidated on 8/3/2014. 94 7.10 A screen shot of the signed PPO document with a description of the activities it will be used in. ..