Distributed Log Authentication with Parallel HMAC Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing log authentication methods, such as CBC-MAC, do not scale well over wide area networks and can create bottlenecks due to their reliance on the last log message for MAC generation, especially in high-volume logging scenarios like PCI DSS compliance, where audit logs need to be protected from unauthorized modifications.
Innovation Solution
A distributed log authentication system using Hash Message Authentication Code (HMAC) at multiple processing entities, each with a unique chain identification number and record sequence number, to create and verify hash values, which are then stored in an audit database, allowing for scalable and resilient logging across geographically distributed systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CBC-MAC is used to secure audit logs, then log integrity is protected, but processing becomes a bottleneck and does not scale well
Solution Approach 1:
The patent segments the log authentication process by introducing multiple independent processing entities (first processing entity, second processing entity, etc.) that each handle subsets of log messages. Each entity maintains its own chain identification number and record sequence number, allowing parallel processing of log messages without requiring a single centralized MAC computation bottleneck. This segmentation enables the system to scale processing throughput while maintaining log integrity through distributed HMAC computation.
2Speed
If the last log message is kept in memory to speed up MAC generation, then processing is faster, but all log messages must go through the same process
Solution Approach 1:
The patent divides the logging system into multiple processing entities, each with its own memory space and HMAC computation capabilities. Instead of having all messages compete for a single in-memory last message buffer, each entity maintains independent buffers and computes HMACs in parallel. This eliminates the bottleneck where all messages must sequentially access the same process state, thereby improving overall logging throughput while maintaining fast MAC generation within each entity.
Solution Approach 2:
The patent introduces a new dimension of parallelism by distributing log processing across multiple entities rather than optimizing a single sequential process. Each entity operates independently with its own chain identification number and record sequence number, transforming the system from a single-threaded optimization problem into a multi-threaded parallel processing architecture. This dimensional change allows the system to scale throughput linearly with the number of processing entities.
3Device complexity
If a single process handles all log messages, then MAC computation is simplified, but the system cannot scale across distributed environments
Solution Approach 1:
The patent segments the authentication mechanism into distributed components, where each processing entity maintains local state (chain identification number, record sequence number) and computes HMACs independently. The segmentation is formalized through the use of entity-specific identifiers that allow each component to operate autonomously while contributing to the overall log integrity. This segmented architecture enables the system to scale across distributed environments without requiring a centralized authentication bottleneck.
Solution Approach 2:
The patent creates a universal authentication framework that works across diverse distributed processing entities. The HMAC-based authentication mechanism with chain identification numbers and record sequence numbers provides a standardized interface that can be implemented by any processing entity in the distributed system. This universal approach allows different entities (potentially running on different hardware, operating systems, or even cloud platforms) to participate in the same log authentication system, greatly enhancing distributed system compatibility.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The present disclosure relates to a computer-implemented method for distributed log authentication wherein logs are distributed to respective ones of a plurality of processing entities which then hash the received logs with entity-specific chain identification numbers and record sequence numbers before conveying the results to an audit database for verification.