Encryption Key Audit Log Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data-at-rest encryption technologies face challenges in managing encryption keys securely, particularly in large-scale environments, due to complexity, scalability issues, and the risk of unauthorized access, which can lead to data loss or compromise.
Innovation Solution
The proposed solution involves generating unique signatures for encryption key activity events, storing them in an audit log file, and verifying the integrity of this log file using a hash mechanism, both on-site and off-site, to ensure the log's authenticity and prevent tampering, while employing a two-factor authentication system to secure access to encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored securely with multiple access controls, then data security is improved, but system complexity and key management difficulty increase
Solution Approach 1:
The patent introduces an audit log file as an intermediary record that documents all encryption key access events. This intermediary provides a verifiable trail of key usage without requiring complex real-time monitoring systems, thus maintaining security while reducing management complexity
Solution Approach 2:
The system pre-generates hash values of audit log files and stores them securely before actual key access events occur. This preliminary preparation enables quick verification of log integrity without adding complexity to the key access process itself
2Reliability
If audit log files are verified using hash mechanisms, then log integrity is improved, but verification time and processing overhead increase
Solution Approach 1:
The system pre-calculates and stores hash values of audit log files before they are needed for verification. When verification is required, the pre-computed hash can be quickly compared against the current log state, dramatically reducing verification time
Solution Approach 2:
The patent creates and stores copies of hash values separately from the audit log file itself. This allows verification to be performed by comparing the stored hash copy against the current log, avoiding the need to re-process the entire log file
Data Source
AI summary
The techniques presented herein provide for verifying the integrity of an encryption key log file generated on a data storage system. Encryption key activity events associated with a storage system's back-end storage drives are identified. A unique signature is generated for each encryption key activity event. Each encryption key activity event and its corresponding signature are stored in an audit log file. An audit log hash file is generated using the contents of the audit log file. At an external location, the audit log file and the audit log hash file are retrieved from the storage system. The integrity of the retrieved audit log file is verified by generating a local audit log hash file and comparing the local audit log hash file to the retrieved audit log hash file and determining if the local audit log hash file matches the retrieved audit log hash file.