Audit Log Protection via Function Segmentation and Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing systems fail to effectively prevent damage and loss of audit logs during unauthorized access attacks, as they do not adequately secure the audit logs once an attack is detected.
Innovation Solution
An information processing apparatus with a controller that records audit logs, judges unauthorized access requests, and performs stopping controls to prevent access to the affected log types, thereby securing the audit logs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is implemented to protect audit logs, then security is improved, but system functionality and ease of operation deteriorate
Solution Approach 1:
The patent segments access control by function type, creating separate control mechanisms for different audit log functions. The control unit divides the audit log system into multiple function types and applies targeted stopping controls to specific functions when unauthorized access is detected, rather than blocking all access uniformly. This allows legitimate operations to continue while preventing attacks on specific vulnerable functions.
Solution Approach 2:
The patent implements dynamic access control that adapts based on detected threats. The control unit continuously monitors access patterns and dynamically adjusts permissions by stopping specific functions when unauthorized access is detected. This dynamic response allows the system to maintain ease of operation during normal conditions while automatically tightening security when threats are identified.
2Difficulty of detecting and measuring
If continuous monitoring of access requests is implemented, then detection capability is improved, but device complexity increases
Solution Approach 1:
The patent introduces a judging unit as an intermediary component that specializes in analyzing access requests. This judging unit acts as a mediator between the access control system and the audit log, focusing computational resources on detecting unauthorized access patterns. By creating this specialized intermediary layer, the system improves detection capability without significantly increasing overall complexity, as the judging unit handles the complex analysis while other components remain relatively simple.
3Reliability
If stopping control is applied to functions upon detecting unauthorized access, then audit log integrity is improved, but productivity decreases
Solution Approach 1:
The patent applies stopping controls locally to specific function types rather than globally to the entire system. When unauthorized access is detected, the control unit identifies the specific function type under attack and stops only that particular function, allowing other functions to continue operating normally. This localized approach maintains audit log integrity for the affected function while preserving overall system productivity through continued operation of unaffected functions.
Data Source
AI summary
An information processing apparatus capable of preventing damage and loss of an audit log when an attack due to an unauthorized access is detected is provided. The information processing apparatus having one or multiple functions includes a controller configured or programmed to function as a recording unit that records an audit log for each type corresponding to the one or multiple functions, a judging unit that, when an access request to the audit log is received, judges whether or not the access request is an unauthorized access, and a control unit that, in a case that a judgement result of the judging unit indicates that the access request is the unauthorized access, performs a stopping control to stop a function related to the type of the audit log that has received the access request, among the one or multiple functions.