PROTECT
DATA DISCLOSURE & MANIPULATION MITIGATION USING CRYPTOGRAPHY

Cryptography is the practice and study of techniques for secure communication in the presence of third parties (called adversaries) - wikipedia

In relation to mydigitalstructure the focus is on at-rest protection that can be gained via the use of cryptography - given the in-transit protection is inherent in the use of https/SSL protocols.

mydigitalstructure is non-prescriptive in the cryptography scheme you choose to implement as the application owner - mydigitalstructure does provide some helper methods for storing keys and ciphertext (hashes, encypted data etc)

The mydigitalstructure SDK has utility functions that use the crypto-js library and the AES algorithm within its _util.protect namespace.

CRYPTOGRAPHY MECHANISMS COMMONLY USED
IN ENTERPRISE APPLICATION SECURITY

• Key formats
• Sample RSA Signing
• Sample Generate Key Pair
• Hashing: AES/SHA-256/SHA-512/MD5
• Public Key: RSA
• crypto-js @ mydigitalstructure
• Developers guide to web cryptography
• An introduction to cryptography

Add hashed signature to data record using symmetric cryptographic pattern (single private key):

1. Generate a private key
2. Store on the secure local device using Web Browser localStorage API.
3. Retrieve the key and using select data record attributes (typically includes modifieddate etc) create SHA-512 hash (acting as digital signature)
4. POST to mydigitalstructure using CORE_PROTECT_HASH_MANAGE

Check hashed signature

1. Get the private key using the localStorage API
2. Get the data record and hash using SHA-512
3. Get the existing hash (signature) using CORE_PROTECT_CIPHERTEXT_SEARCH
4. Check the just created hash and existing hash and if match data is valid (un-manipulated)

If you have multiple users within the space and they need to share the data, then you need to distribute the keys to each of them, unsually in a pem formated file.

Don't use mydigitalstructure to store the private key - as it reduces the value of the protection.

Store a hashed signature of the data using symmetric cryptographic pattern (single key) and the blockchain (for immatibility):

1. Generate a key
2. Store the key on the secure mydigitalstructure service using CORE_PROTECT_KEY_MANAGE api method.
3. Store the key on the blockchain
4. Retrieve the key using CORE_PROTECT_KEY_SEARCH and using select data object attributes (typically includes modifieddate etc) create SHA-512 hash (acting as digital signature)
5. POST the actual data record to mydigitalstructure using object _MANAGE method (ie ACTION_MANAGE)
6. POST the hash to mydigitalstructure using CORE_PROTECT_CIPHERTEXT_MANAGE
7. POST the hash to the blockchain 

Check hashed signature

1. Get the key using CORE_PROTECT_KEY_SEARCH or from the blockchain (based on known public blockchain address)
2. Get the data record and hash using SHA-512 and key
3. Get the existing hash (signature) from the blockchain
4. Check the just created hash and existing hash and if match data is valid (un-manipulated)

! Note: Instead of using the browser you could do the key generation and user data hashing using a node service (or a like). 

You could use this with the MESSAGING_CONVERSATION endpoint where want message (posts & comments) integrity. ie when viewing the post/comment and with the correct private key, you can be ensured it has not been manipulated in-transit. 

Add hashed signature to data record using asymmetric cryptographic pattern (public-private key):

1. Generate a public / private key pair
2. Store the private key on the secure local device using Web Browser localStorage API.
3. Store the public key on the secure mydigitalstructure service using CORE_PROTECT_KEY_MANAGE api method. 
4. Retrieve the "public" key using CORE_PROTECT_KEY_SEARCH and using select data record attributes (typically includes modifieddate etc) create RSA/SHA-512 hash (acting as digital signature)
5. POST the actual data record to mydigitalstructure using object _MANAGE method (ie INVOICE_MANAGE)
6. POST the hash to mydigitalstructure using CORE_PROTECT_CIPHERTEXT_MANAGE

Check hashed signature

1. Get the private key using the localStorage API
2. Get the data record
3. Get the existing hash (signature) using CORE_PROTECT_CIPHERTEXT_SEARCH
4. Decrypt using the private key
5. Check the decrypted select data attributes match select data attributes retrieved.

Using a public key stored on mydigitalstructure to protect data, beyond the existing authentication and authorisation mechanisms within mydigitalstructure.

ie if need to store sensitive data in regards to an individual or organisational IP etc - store it "off-object" and merge back in (object data is meta data).

Add hashed signature to data record using asymmetric cryptographic pattern (public-private key):

1. Generate a public / private key pair
2. Store the private key on the secure local device using Web Browser localStorage API.
3. Store the public key on the secure mydigitalstructure service using CORE_PROTECT_KEY_MANAGE api method. 
4. Retrieve the "public" key using CORE_PROTECT_KEY_SEARCH and using select data record attributes (typically includes modifieddate etc) create RSA/SHA-512 encrypted data.
5. POST the hash to mydigitalstructure using CORE_PROTECT_CIPHERTEXT_MANAGE. You could also create an text type structure element and store it there - it could then be retrieved as part of the generic advanced search (although not searchable) and decrypted by the client with the private key.

Check hashed signature

1. Get the private key using the localStorage API
2. Get the data record
3. Get the data record hash using CORE_PROTECT_CIPHERTEXT_SEARCH
4. Decrypt using the private key
5. Add the data to object data record.