Database Audit Table Tamper Detection via Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for maintaining and detecting tampering with audit records in databases face challenges due to impractical storage limitations and the inability to completely prevent all forms of attacks, as attackers with full system control can modify audit records.
Innovation Solution
Implementing a system that supports only insert and select operations on audit tables, prevents creation of duplicate audit tables, and uses a circular audit table mechanism to archive and overwrite records, while generating and storing message digest records to detect tampering through hash values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If audit records are stored in a database with unlimited retention, then the completeness of the audit trail is improved, but the storage resource consumption increases and becomes impractical
Solution Approach 1:
The patent implements periodic archiving of audit records at predetermined intervals. The audit manager archives audit records from the audit table to archival storage at scheduled times, retaining only recent audit records in the active audit table. This periodic action maintains audit trail completeness while managing storage resources by moving older records to less frequently accessed archival storage.
2Adaptability or versatility
If all database operations are allowed on audit tables, then the flexibility of audit record management is improved, but the risk of unauthorized tampering increases
Solution Approach 1:
The patent applies preliminary anti-action by proactively preventing harmful operations before tampering can occur. The audit manager explicitly prohibits delete, update, and drop operations on audit tables, allowing only insert and select operations. This preliminary restriction on permitted operations prevents unauthorized tampering while maintaining necessary audit record management flexibility through selective operation allowance.
3Productivity
If the audit table is implemented as a circular table with fixed size, then the storage management efficiency is improved, but the loss of historical audit data increases
Solution Approach 1:
The patent extracts historical audit data from the active audit table and stores it in separate archival storage. The audit manager identifies and archives older audit records to external archival storage, allowing the circular audit table to maintain its fixed efficient size while preserving historical data externally. This extraction of historical records resolves the contradiction by maintaining storage efficiency while preventing information loss through external archival preservation.
4Adaptability or versatility
If multiple audit tables with the same name and schema are allowed, then the versatility of audit record creation is improved, but the system security and integrity worsen
Solution Approach 1:
The patent prevents the creation of duplicate audit tables by implementing a check before table creation. The audit manager verifies whether an audit table with the specified name and schema already exists, and if it does, prevents the creation of a new table with the same characteristics. This preliminary verification prevents security vulnerabilities associated with duplicate tables while maintaining versatility by allowing audit tables to be created with different names or schemas when appropriate.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach effectively manages audit record storage, prevents unauthorized modifications, and securely detects tampering by limiting operations on audit tables and utilizing hash values to verify record integrity.
Implementation Method 1
generating and storing message digest records to detect tampering through hash values
Data Source
AI summary
Embodiments of the invention provide systems and methods for maintaining audit records for a database or other resource. According to one embodiment, a method for maintaining audit records for a database can comprise detecting an operation involving at least one record of the database. An audit record can be generated for the operation and the audit record can be stored in an audit table in the database. Insert operations and select operations for the audit table can be supported but other operations for the audit table can be prohibited. Additionally or alternatively, creation of more than one audit table having a same name and schema can be prevented.


