Event log tamper detection

Patent metadata

Field	Value
Publication number	US-9864878-B2
Application number	US-201514809464-A
Country	US
Kind code	B2
Filing date	Jul 27, 2015
Priority date	Jul 27, 2015
Publication date	Jan 9, 2018
Grant date	Jan 9, 2018

Abstract

A computer implemented method includes generating, by a processor, a first event record in response to an event being performed by a computer; and generating, by the processor, a second event record in response to the first event record being generated, wherein the second event record comprises a signature corresponding to the first event record.

First claim

What is claimed is:

1. A computer implemented method, comprising:
securing, by a processor, a log of one or more events being performed a computer by adding tamper detection to the log, the securing comprising:
generating, by the processor, a first event record in response to an event being performed by the computer;
generating, by the processor, a second event record in response to the first event record being generated, wherein the second event record comprises:
a signature corresponding to the first event record; and
a spatial reference of the first event record, the spatial reference identifying a memory location of the first event record;

generating, by the processor, a third event record of the same type as a type of the first event record;
adding to the second event record, in response to the third event record being of the same type as the first event record, a signature corresponding to the third event record, and a spatial reference of the third event record; and
in response to a request to detect tampering of the first event record, validating the first event record based on the signature in the second event record.

2. The computer implemented method of claim 1 , wherein the signature identifies contents of the first event record.

3. The computer implemented method of claim 2 , wherein the second event record further comprises an identifier of a type of the first event record.

4. The computer implemented method of claim 2 , further comprising:
receiving, by the processor, a request to copy the first event record; and
copying, by the processor, the first event record and the second event record, which includes the spatial reference of the first event, in response to the request to copy the first event record.

5. The computer implemented method of claim 2 , further comprising:
receiving, by the processor, a request to detect tampering of the first event record; and
in response to the request, validating, by the processor, the first event record by comparing the first event record with the signature in the second event record.

6. The computer implemented method of claim 1 , further comprising:
receiving, by the processor, a request to copy the first event record;
making, by the processor, a copy of the first event record and a copy of the second event record in response to the request to copy the first event record; and
storing, by the processor, the copy of the second event record at the same spatial distance from the copy of the first event record as a spatial distance between the first event record and the second event record.

7. The computer implemented method of claim 1 , further comprising:
receiving, by the processor, a request to copy event records of the type of the first event record; and
copying, by the processor, the first event record, the third event record, and the second event record in response to the request to copy the first event record.

Assignees

• IBM

Inventors

• Sofia Anthony T
• Sutton Peter G

Classifications

• G06F21/86

  Secure or tamper-resistant housings · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/88

  Detecting or preventing theft or loss · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title