Tamper-Resistant Data Access Logging System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data access logging systems lack transparency and security, leading to user distrust due to the opaque nature of data usage in online services, and existing solutions are often burdensome on existing infrastructure.
Innovation Solution
Implementing a secure and verifiable data access logging system that logs each data access request and response in an auditable and tamper-resistant manner, using attribute-based encryption to provide built-in data access control and protect confidentiality, allowing users to review their data usage aligning with consented purposes without requiring new hardware or tools.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data access logging is implemented to provide transparency and auditability, then user trust and data control are improved, but system complexity and infrastructure burden increase
Solution Approach 1:
The patent introduces a logging system as an intermediary component that sits between the data processing system and users. This logging system captures data access requests and responses, creates cryptographic proofs (Merkle tree hashes), and provides these proofs to users for verification. The intermediary nature of the logging system isolates the complexity of verification from both the data processing system and users, resolving the contradiction by enabling trust without burdening existing infrastructure.
Solution Approach 2:
The patent creates cryptographic copies (hashes) of data access logs organized in a Merkle tree structure. Instead of requiring users to examine raw log data directly, the system generates condensed cryptographic proofs that verify log integrity. This copying approach maintains full auditability while significantly reducing the complexity burden on users and existing systems, as verification requires only the cryptographic proofs rather than entire log datasets.
2Reliability
If cryptographic proofs and Merkle trees are used to ensure log integrity and tamper-resistance, then log security and verifiability are improved, but computational overhead and processing time increase
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing the Merkle tree structure alongside the logs. The root hash of the Merkle tree is published in advance, allowing users to verify log integrity efficiently without requiring complex real-time computations. This preliminary setup enables fast verification later, resolving the contradiction between strong cryptographic verification and processing time.
Solution Approach 2:
The system creates condensed cryptographic copies (Merkle proof paths) that allow verification of individual log entries without requiring computation over the entire log dataset. When a user needs to verify a specific log entry, they only need to compute over the path from that entry to the root hash, rather than processing all logs. This copying approach maintains log integrity while dramatically reducing verification time.
3Loss of information
If detailed logging of all data access requests and responses is implemented, then auditability and user review capability are improved, but data storage requirements and system resource consumption increase
Solution Approach 1:
The patent implements a selective copying strategy where the complete logs are retained for full auditability, but cryptographic proofs (Merkle tree hashes and proof paths) are generated and distributed to users. These proofs are much smaller in size than the full logs yet provide equivalent verification capability. This resolves the contradiction by maintaining complete auditability while reducing the storage burden of distributed verification data.
Solution Approach 2:
The patent extracts the essential verification information (Merkle tree root hash and individual entry proofs) from the complete log dataset and provides these extracted elements to users for verification. The full logs remain stored centrally for complete auditability, but users receive only the extracted cryptographic proofs needed for verification. This extraction approach maintains full auditability while minimizing the storage requirements for distributed verification data.
Data Source
AI summary
Techniques for providing a secure and verifiable data access logging system are disclosed herein. In some embodiments, a computer system receives an indication of a data request from a client device that is requesting data of one or more users from a data server, stores a request log entry corresponding to the data request in a log file, generates a request token based on the received indication of the data request, transmits the generated request token to the client device, receives a fetch event from the data server that requests a request digest corresponding to the request token and configured to indicate that the request log entry corresponding to the data request is stored in the log file, stores a response log entry corresponding to the received fetch event in the log file, and transmits the request digest to the data server based on the received fetch event.