![](bg5.png)
tures. It can be conveniently used to sign arbitrary
XML or non-XML data using one of the following
signing types:
• Enveloped: The XML signature is included in the
XML document. It is contained within a child el-
ement of the XML document.
• Enveloping: The XML document is included in
the XML signature. It is contained within a a child
element of the XML signature.
• Detached: The XML signature is included in
a separate document from the signed document.
The location of the signed document is referenced
in the XML signature. This type of signature is
used for non-XML documents.
It is important to note, that when signing XML
documents, one needs to serialize it prior to sign-
ing. Thereby, this process needs to guarantee that
logically-identical documents produce exactly identi-
cal serialized representations, which do not depend on
the actual encoding, white spaces, etc. This process
is usually denoted as normalization (canonicalization)
and one representative of canonicalization methods is
C14N.
Since every modification of the document invali-
dates the digital signature, none of the above men-
tioned properties (except record suppression) can be
achieved.
4.2.2 Partial Signatures based on XML-DSig
A partial signature is a signature on an arbitrary
subdocument of an XML document. This means,
that using this approach it is possible to append
several independent signatures for subdocuments to
the XML document. Although attribute suppression
and generalization cannot be applied to partially
signed documents without invalidating the original
signature, the original signer is able to produce ad-
ditional partial signatures for specific subdocuments
that do not contain identifying attributes. This could
be used in scenarios which require the anonymization
medical documents. However, k-anonymity can
practically not be achieved, since the parts that need
to be removed from the document during the prepa-
ration depend on the actual set of CDA documents
for a specific secondary use. Clearly, the attributes
that need to be removed must have been known to
the original signer at the time of creating partial
signatures, which is usually not the case in practice.
One can conclude that the above two variants of
digital signatures cannot be reasonably used to
accomplish the before mentioned properties. The
third variant, which represents a generalization of
redactable signatures can surprisingly be used to
realize nearly all of the above mentioned properties.
But before we are going into details, we provide a
brief introduction to redactable signatures.
4.2.3 Generalized Redactable Signatures
The concept of a redactable signature scheme was
introduced in (Johnson et al., 2002) and allows any
party to remove parts of a signed document D to ob-
tain a redacted document D
0
such that a signature for
D
0
can be derived from the signature of D without co-
operation with the original signer. Consequently, it
is possible to remove certain parts of a document and
pass the remaining document to another party, who
is able to verify the integrity and authenticity of the
resulting document D
0
. It must be noted, that sev-
eral variants of signature schemes realizing compara-
ble ideas have been proposed (Ateniese et al., 2005;
Miyazaki et al., 2006; Steinfeld et al., 2001).
Redactable signatures (Johnson et al., 2002) orga-
nize the content of a document as leafs of a com-
plete binary tree. This is absolutely sufficient for un-
structured documents. However, when using a struc-
tured document like an XML document, which itself
represents a tree, then splitting up a document into
blocks of fixed size and organizing these blocks in
a binary tree is not desirable. The redactable signa-
ture of (Johnson et al., 2002) also works with vari-
able block length, however, the rule for splitting up
the document needs to be available to the redactor
(anonymizer) as well as the verifier and consequently
must be appended to the document. Thus, it is more
natural to use the existing tree structure of a struc-
tured document and thereby use inner nodes as well
as leaf nodes to hold parts of the document, instead of
organizing the parts as leafs of a binary tree. This ap-
proach is denoted as generalized redactable signatures
(Slamanig and Stingl, 2009). Subsequently, we will
present additional transformation rules for the gener-
alized redactable signature proposed in (Slamanig and
Stingl, 2009).
When representing an XML document with its inher-
ent tree structure, the resulting tree is in general nei-
ther binary nor complete. In the following we will
define a unique transformation T which maps an ar-
bitrary XML document uniquely to a N-ary tree. But,
we want to emphasize that there exist other mappings
which can also be used for this purpose. For the sake
of simplicity of the presentation we are focusing on
XML elements, attributes, attribute- and element-data
and will present the transformation rules informally:
R
1
: Element
<TAG>VALUE</TAG>
: The label of the
HEALTHINF 2010 - International Conference on Health Informatics
66