Database Audit Record Tampering Detection via Hash Digests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for maintaining and detecting tampering with audit records in databases face challenges due to impractical storage limitations and the inability to completely prevent tampering, even with secure storage solutions like WORM devices, as attackers with full system control can still modify audit records.
Innovation Solution
The system generates a message digest record based on audit records using hash values, which are stored in a separate trusted data store, allowing for the detection of tampering by comparing calculated hash values from audit records with stored message digest records, and includes features like metadata inclusion and secure key management for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If audit records are stored indefinitely to maintain an infinitely long audit trail, then the completeness and reliability of the audit trail is improved, but storage requirements become impractical and excessive
Solution Approach 1:
The patent segments the audit trail verification process by dividing it into time periods, with each period having its own hash value stored in a message digest table. This allows the system to verify audit records in manageable segments rather than requiring all records to be stored and processed simultaneously, thus reducing storage requirements while maintaining verification capability.
Solution Approach 2:
The patent performs preliminary action by calculating and storing hash values of audit records in a message digest table before the actual audit records may be archived or overwritten. This pre-computed digest serves as a verification reference that allows future tampering detection without requiring the original records to be permanently retained, resolving the contradiction between long-term reliability and storage constraints.
2Reliability
If WORM devices and secured locations are used to prevent tampering with audit records, then the security and integrity of audit records is improved, but attackers with full system control can still tamper with records at the source by modifying the application
Solution Approach 1:
The patent implements feedback by creating a verification mechanism that continuously checks audit record integrity through hash comparison. The message digest table stores expected hash values, and the system periodically verifies actual audit records against these digests. This feedback loop detects tampering attempts regardless of where they occur in the system, addressing the vulnerability to application-level modifications.
Solution Approach 2:
The patent introduces an intermediary verification layer using hash functions and message digest tables. Instead of relying solely on physical security measures like WORM devices, the system uses cryptographic intermediaries (hash values) that mediate between the audit records and the verification process. This intermediary mechanism detects tampering at the data level, providing protection against application-level attacks that bypass physical security controls.
3Measurement precision
If all audit records are retained and verified to ensure complete tamper detection, then the detection capability is improved, but the complexity and computational overhead of verification becomes excessive
Solution Approach 1:
The patent extracts the essential verification information from the complete audit records by computing hash values and storing only these digests in the message digest table. This extraction process separates the verification data from the full audit records, allowing the system to maintain high tamper detection capability while significantly reducing verification complexity. The hash digests serve as compact representations that enable efficient verification without requiring processing of all original record details.
Data Source
AI summary
Embodiments of the invention provide systems and methods for detection of tampering with an audit record for a database. According to one embodiment, a method for detection of tampering with an audit record for a database can comprise reading one or more audit records for a time period from an audit table. The one or more audit records can each include a time stamp and reading the one or more audit records can comprise reading audit records having a timestamp within the time period. An encrypted record, such as a message digest record, for the time period can be generated based on the one or more audit records and including the time stamps. The message digest record can be stored in a message digest table. In some cases, the message digest table can be maintained in a trusted data store.