Secure Logging Circular Buffer with Hash Chain Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current host security module (HSM) logging systems lack robustness in ensuring the integrity and efficiency of secure logging, particularly in managing event records and handling overflow situations, which can lead to data loss or corruption.
Innovation Solution
The implementation of a secure logging method that generates hashes for event records, stores them in a circular buffer with dual control for deletion, and utilizes a hybrid memory system with BBRAM for staging and overflow files to maintain data integrity and efficiency, including the use of digital signatures for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional logging systems are used in HSM, then the logging process is simple, but the integrity and security of log data cannot be ensured
Solution Approach 1:
The patent applies preliminary action by pre-defining a fixed-size circular buffer structure for log storage before logging operations begin. The buffer is initialized with a predetermined capacity, and hash chains are pre-established to link log entries. This preliminary structuring ensures data integrity through cryptographic hashing while maintaining manageable complexity through the fixed-size design that automatically overwrites oldest entries when full.
Solution Approach 2:
The patent introduces hash values as an intermediary element between log entries. Each log entry is cryptographically hashed, and the hash is stored alongside the entry in the circular buffer. This intermediary hash chain mechanism verifies data integrity without requiring complex external verification systems, thus improving reliability while keeping the logging system self-contained and manageable.
2Reliability
If log data is continuously written without overflow management, then all events are recorded, but storage space is exhausted and system fails
Solution Approach 1:
The patent implements discarding and recovering by using a fixed-size circular buffer that automatically discards the oldest log entries when the buffer reaches full capacity. New log entries overwrite the oldest entries in a cyclic manner, ensuring continuous logging operation without external intervention. This mechanism guarantees logging continuity while maintaining a bounded storage capacity, preventing system failure due to disk exhaustion.
3Reliability
If hash verification is performed for every log entry, then data integrity is ensured, but processing time increases
Solution Approach 1:
The patent applies copying by storing both the original log entry data and its cryptographic hash value in the circular buffer. This creates a redundant copy of the verification information alongside the original data, allowing integrity verification to proceed efficiently without requiring re-computation or external validation processes. The pre-computed hash copy enables fast verification while maintaining logging speed.
Data Source
AI summary
Embodiments include method, systems and computer program products for secure logging of host security module. In some embodiments, an event may be received. The event may include data to be written to a secure log file. A hash may be generated using data of the event. The hash may be stored in a first field of an event record associated with the event. The event record may be stored in the secure log file. The hash may be stored in a second field of a next event record in the secure log file.