Database Audit Table Tamper Detection via Hash Verification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for maintaining and detecting tampering with audit records in databases face challenges due to impractical storage limitations and the inability to completely prevent all forms of attacks, as attackers with full system control can modify audit records.

Innovation Solution

Implementing a system that supports only insert and select operations on audit tables, prevents creation of duplicate audit tables, and uses a circular audit table mechanism to archive and overwrite records, while generating and storing message digest records to detect tampering through hash values.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If audit records are stored in a database with unlimited retention, then the completeness of the audit trail is improved, but the storage resource consumption increases and becomes impractical

Engineering Contradiction:
Improvecompleteness of audit trailVSAvoidstorage resource consumption
Core Design Contradiction:
ReliabilityVSQuantity of substance

Solution Approach 1:

The patent implements periodic archiving of audit records at predetermined intervals. The audit manager archives audit records from the audit table to archival storage at scheduled times, retaining only recent audit records in the active audit table. This periodic action maintains audit trail completeness while managing storage resources by moving older records to less frequently accessed archival storage.

Inventive Principle:
Principle #19Periodic action

2Adaptability or versatility

If all database operations are allowed on audit tables, then the flexibility of audit record management is improved, but the risk of unauthorized tampering increases

Engineering Contradiction:
Improveflexibility of audit record managementVSAvoidrisk of unauthorized tampering
Core Design Contradiction:
Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary anti-action by proactively preventing harmful operations before tampering can occur. The audit manager explicitly prohibits delete, update, and drop operations on audit tables, allowing only insert and select operations. This preliminary restriction on permitted operations prevents unauthorized tampering while maintaining necessary audit record management flexibility through selective operation allowance.

Inventive Principle:
Principle #9Preliminary anti-action

3Productivity

If the audit table is implemented as a circular table with fixed size, then the storage management efficiency is improved, but the loss of historical audit data increases

Engineering Contradiction:
Improvestorage management efficiencyVSAvoidloss of historical audit data
Core Design Contradiction:
ProductivityVSLoss of information

Solution Approach 1:

The patent extracts historical audit data from the active audit table and stores it in separate archival storage. The audit manager identifies and archives older audit records to external archival storage, allowing the circular audit table to maintain its fixed efficient size while preserving historical data externally. This extraction of historical records resolves the contradiction by maintaining storage efficiency while preventing information loss through external archival preservation.

Inventive Principle:
Principle #2Taking out (Extraction)

4Adaptability or versatility

If multiple audit tables with the same name and schema are allowed, then the versatility of audit record creation is improved, but the system security and integrity worsen

Engineering Contradiction:
Improveversatility of audit record creationVSAvoidsystem security and integrity
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent prevents the creation of duplicate audit tables by implementing a check before table creation. The audit manager verifies whether an audit table with the specified name and schema already exists, and if it does, prevents the creation of a new table with the same characteristics. This preliminary verification prevents security vulnerabilities associated with duplicate tables while maintaining versatility by allowing audit tables to be created with different names or schemas when appropriate.

Inventive Principle:
Principle #9Preliminary anti-action

Applied Scientific Principles

This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.

Function Achieved in This Case

This approach effectively manages audit record storage, prevents unauthorized modifications, and securely detects tampering by limiting operations on audit tables and utilizing hash values to verify record integrity.

Implementation Method 1

generating and storing message digest records to detect tampering through hash values

Methodology Applied
Scientific EffectHash function:

Data Source

PatentUS8010494B2Methods to defend against tampering of audit records
Publication Date: 2011.08.30 ORACLE INT CORP
  • US8010494B2 patent drawing
  • US8010494B2 patent drawing
  • US8010494B2 patent drawing

AI summary

Embodiments of the invention provide systems and methods for maintaining audit records for a database or other resource. According to one embodiment, a method for maintaining audit records for a database can comprise detecting an operation involving at least one record of the database. An audit record can be generated for the operation and the audit record can be stored in an audit table in the database. Insert operations and select operations for the audit table can be supported but other operations for the audit table can be prohibited. Additionally or alternatively, creation of more than one audit table having a same name and schema can be prevented.