Secure Audit Logging

• US 20170091463A1
• Filed: 09/25/2015
• Published: 03/30/2017
• Est. Priority Date: 09/25/2015
• Status: Active Grant

• Current Assignee: Saife Inc.
• Original Assignee: Saife Inc.
• Inventors: Lindteigen, Ty, Payne, Anthony
• Granted Patent: US 9,852,300 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

The invention includes systems and methods to asymmetrically encrypt audit logs, store a limited period of the encrypted audit logs, periodically send the encrypted audit logs to a central location for storage and further process in order to provide tamper-proof evidence of an activity. The system comprises a secure audit client enabled to perform various activities. A secure audit manager logs such activities in an audit log for uploading to a secure audit server. The secure audit server receives the audit logs from the secure audit manager. Finally a secure audit log consumer requests audit log data from the secure audit log manager to review the secure audit log.

Claims

1. A method for generating secure audit logs comprising:

a first device recording an event in an audit log;

the first device encrypting the audit log to produce an encrypted audit log, wherein the encrypted audit log can be unencrypted with a first encryption key;

the first device storing the first encryption key in a memory of the first device;

the first device transmitting the encrypted audit log to a second device;

the second device decrypting the encrypted audit log with a compatible encryption key to produce the audit log;

the first device purging the encrypted audit file and the first encryption key from the memory of the first device; and

the first device creating a second encryption key to encrypt a second audit log.

2. The method of claim 1, wherein the second device uses the secure audit log to perform a forensic root cause analysis.

3. The method of claim 1, wherein encrypting the audit log protects a chain of title for the audit log.

4. The method of claim 1, wherein the first device stores a set of encrypted audit logs.

5. The method of claim 4, wherein the first device periodically sends the set of encrypted audit logs to the second device for storage and processing.

6. A system enabled to asymmetrically encrypt an audit log comprising:

a secure audit client enabled to perform an activity;

a secure audit manager enabled to log a set of data related to the activity in the audit log;

the secure audit manager enabled to asymmetrically encrypt the audit log to produce an encrypted audit log;

the secure audit manager enabled to upload the encrypted audit log to a secure audit server;

the secure audit server enabled to receive the encrypted audit log from the secure audit manager; and

the secure audit server enabled to send the encrypted audit log to a secure audit log consumer to review the encrypted audit log.

7. The system of claim 6 wherein the secure audit client comprises a smart phone, a tablet PC'"'"'s, a notebook PC'"'"'s, a desktop PC'"'"'s, a remote monitoring device, a camera, or a sensor.

8. The system of claim 6 wherein the set of data comprises information related to the activity including a log level, a message, a time stamp, and an entry counter.

9. The system of claim 6 wherein the secure audit manager asymmetrically encrypts the audit log using an Galois/Counter Mode (GCM) encryption scheme.

10. A method for creating a secure audit log comprising:

a secure audit log manager creating a key entry;

the secure audit log manager generating an ephemeral asymmetric key pair and a Galois/Counter Mode (GCM) initialization vector to produce a symmetric Advanced Encryption Standard (AES) key;

the secure audit log manager using the symmetric AES key with the GCM initialization vector to establish an AES-GCM encryption stream for encrypting a log entry;

a secure audit client requesting the secure audit log manager to log an event;

the secure audit log manager creating the log entry;

the secure audit log manager serializing the log entry and passing the log entry through the AES-GCM encryption stream creating a secure audit log;

the secure audit log manager terminating the secure audit log when a predetermined event occurs;

the secure audit log manager adding the secure audit log to a queue of files for uploading to a secure audit log server;

the secure audit log manger uploading the queue of files to the secure audit log server via an authenticated message addressed to the secure audit log server, wherein a permanent private key of the secure audit log manager is used to sign the authenticated message to assure authenticity of the secure audit log;

the secure audit log server receiving the authenticated message, validating the signature, and accessing the secure audit log;

a secure audit log client requesting the secure audit log;

the secure audit log server processing the key entry for the secure audit log;

the secure audit log server validating the signature of the key entry;

the secure audit log server generating a symmetric key;

the secure audit log server initializing the AES-GCM encrypted stream with the GCM initialization vector from the key entry and the symmetric key; and

the secure audit log server decrypting and deserializing the key entry before presenting to the secure audit log client.

11. The method of claim 10 wherein, the key entry includes information necessary for the secure audit log server to encrypt the secure audit log.

12. The method of claim 10 wherein the ephemeral asymmetric key pair is used to execute an elliptic curve Diffie-Hellman key agreement between the ephemeral asymmetric key pair and a public key of the secure audit log manager to produce the symmetric AES key.

13. The method of claim 10 wherein the log entry comprises a log level, a message, a time stamp, and an entry counter.

14. The method of claim 10 wherein the secure audit log manger terminates the secure audit log when the secure audit log reaches a maximum size, or when the secure audit log reaches a configured time period, or when the secure audit client requests an upload.

15. The method of claim 10 wherein the secure audit log manager uploads the queue of files when a permanent private key of the secure audit log manager is unlocked, or when the secure audit log manager has access to a network connection.

16. The method of claim 10 wherein the signature is required for authentication and no further encryption is required.

17. The method of claim 10 wherein the secure audit log server generates the symmetric key by performing an elliptic curve Diffie-Hellman key agreement between the ephemeral public audit log key and the permanent private key of the secure audit log server.

18. The method of claim 10 wherein the secure audit log manager sanitizes the symmetric key and the ephemeral asymmetric key pair after terminating the secure audit log.

19. The method of claim 10 wherein the authenticated message includes the secure audit log, a creation date of the secure audit log, and an identifier for the secure audit log manager.

20. The method of claim 10, wherein the secure audit log manager creates a new secure audit log and a new key entry after the secure audit log is sent to the secure log manager.