Ensuring Audit Log Accountability through Hash Based Techniques

Abstract

Audit logs are now considered good practice and a standard approach for business systems. The integrity of the auditing records themselves is critical. By simply storing all the interactions in a separate audit log does not guarantee the integrity of the log. Data tampering can be done through unauthorized access and in some cases through authorized users. Results of such action can be unpleasant for business and their clients. Therefore, a demand for audit log security is needed more than ever. This paper describes a mechanism based on cryptographic hash functions and trusted timestamping that prevents an outsider or inside intruder from silently corrupting the audit log. In addition it is shown that the proposed mechanism can be realized in database systems with little overhead and that the hash based techniques and trusted timestamping can be used efficiently and correctly to determine if the audit log has been compromised.