Tamperproof Audit Logs

University Of Arizona, Tucson AZ

Investigators

Abstract

An audit log enumerates the changes, and often the accesses, that have been applied to a database. Audit logs are considered good practice for business systems, and are required by federal regulations for secure systems, drug approval data, medical information disclosure, financial records, and electronic voting. Given the central role of audit logs, it is critical that they are correct and unalterable. Mechanisms are developed, for implementation within a database management system (DBMS), based on cryptographically strong one-way hash functions, that prevent an intruder, including an auditor or an employee or even an unknown bug within the DBMS itself, from silently corrupting the audit log. The DBMS thus stores additional information in the database to enable a separate audit log validator to examine the database along with this extra information and state conclusively whether the audit log has been compromised, thus supporting tamper detection. Using a secure audit log replication protocol and the validator, tamperproof audit logs result. Good performance is essential: tamperproof audit logs will only realistically be used if their overhead is small. This research will enable an important and highly desirable capability to be added to existing database management systems: tamperproof audit logs. By instituting tamperproof audit logs, US federal regulations in many domains can be more effectively applied, lending confidence to the business leaders, government officials, and citizens who depend on these critical medical, financial, and voting systems. The PI will work closely with vendors to ensure that the approaches are consistent with existing technologies. This work is being developed on the open-source BerkeleyDB and MySQL systems, as an extension of these two systems and updates will be available via the project's Web site (http://www.cs.arizona.edu/tau/Audit/).