System Log Integrity via Nested Metadata Tracking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for ensuring the integrity of system logs, such as writing to 'write-once, read many' media and digital signing, fail to provide immediate assurance of alterations during merging, filtering, and modification processes, requiring extensive review and reconciliation.

Innovation Solution

A method that involves acquiring a data repository with associated metadata, merging or deleting items while adding metadata to track source information, collecting signatures for control statements governing these operations, and preserving this information through subsequent processing iterations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If system logs are written to WORM media and digitally signed, then log integrity is ensured, but the ability to track alterations during merging and filtering processes is lost

Engineering Contradiction:

Improvelog integrityVSAvoidalteration tracking information

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent embeds multiple layers of metadata within the log structure. First metadata identifies source systems and log generators, second metadata identifies merging and filtering operations, and third metadata contains digital signatures. This nested structure allows tracking of alterations while maintaining integrity, resolving the contradiction between reliability and information loss.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent performs preliminary actions by adding metadata identifiers and signatures to log data before merging and filtering operations occur. This allows the system to track what operations are performed on the log data, enabling alteration tracking while maintaining the integrity benefits of WORM storage and digital signing.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If extensive review and reconciliation is performed between trusted copy and final log, then alteration detection is possible, but time and resource consumption increases

Engineering Contradiction:

Improvealteration detection accuracyVSAvoidreview and reconciliation time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements feedback mechanisms through metadata that continuously tracks the provenance and transformation history of log data. The first, second, and third metadata provide ongoing information about source systems, operations performed, and digital signatures, allowing real-time verification without extensive post-processing review.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent replaces the mechanical process of extensive manual review and reconciliation with automated metadata tracking and digital signature verification. The structured metadata (first, second, third) and associated signatures enable automated validation of log alterations, dramatically reducing the time and resources required while maintaining high detection accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10229151B2Establishing a chain of trust in a system log

Publication Date: 2019.03.12 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Embodiments include a method, system, and computer program product for acquiring a data repository, the data repository being associated with a log configured to receive metadata. Then, a content of the log with respect to at least one manipulation of the data repository is modified by adding first metadata of the metadata. Further, signatures that identify control statements configured to govern the at least one manipulation of the data repository are collected by adding second metadata of the metadata into the log.