Data event logging in computing platform

• US 7,194,623 B1
• Filed: 05/25/2000
• Issued: 03/20/2007
• Est. Priority Date: 05/28/1999
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Chan, David, Balacheff, Boris, Pearson, Siani Lynne, Proudler, Graeme John
• Primary Examiner(s): Barron; Gilberto
• Assistant Examiner(s): Gelagay; Shewaye
• Application Number:
  US09/979,902
• Time in Patent Office: 2,490 Days
• Field of Search: 713/200, 713/165, 713/164, 705/51, 710/261, 710/244, 726/22
• US Class Current: 713/164
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

There is disclosed a computer entity having a trusted component which compiles an event log for events occurring on a computer platform. The event log contains event data of types which are pre-specified by a user by inputting details through a dialogue display generated by the trusted component. Items which can be monitored include data files, applications drivers and the like. The trusted component operates through a monitoring agent which may be launched onto the computer platform. The monitoring agent may be periodically interrogated to make sure that it is operating correctly and responding to interrogations by the trusted component.

Claims

1. A computer entity comprising:

a computer platform comprising a data processor and at least one memory device; and

a trusted component, said trusted component comprising a data processor and at least one memory device;

wherein said data processor and said memory of said trusted component are physically and logically distinct from said data processor and memory of said computer platform; and

a software agent operating on said computer platform, for monitoring at least one event occurring on said computer platform, and reporting said event to said trusted component.

2. The computer entity as claimed in claim 1, wherein said software agent comprises a set of program code normally resident in said memory device of said trusted component, said code being transferred into said computer platform for performing monitoring functions on said computer platform.

3. The computer entity as claimed in claim 1, where said trusted component comprises an event logging component for receiving data describing a plurality of events occurring on said computer platform, and compiling said event data into secure event data.

4. The computer entity as claimed in claim 3, wherein said event logging component comprises means for applying a chaining function to said event data to produce said secure event data.

5. The computer entity as claimed in claim 1, further comprising a display interface for generating an interactive display comprising:

means for selecting an entity of said computer platform to be monitored; and

means for selecting at least one event to be monitored.

6. The computer entity as claimed in claim 1, further comprising prediction means for predicting a future value of at least one selected parameter.

7. The computer entity as claimed in claim 1, further comprising a confirmation key means connected to said trusted component, and independent of said computer platform, for confirming to said trusted component an authorisation signal of a user.

8. The computer entity as claimed in claim 1, wherein logical entities to be monitored are selected from the set comprising:

at least one data file;

at least one application; and

at least one driver component.

9. A computer entity comprising:

a computer platform having a first data processor and a first memory device; and

a trusted monitoring component comprising a second data processor and a second memory device, wherein

said trusted monitoring component stores an agent program resident in said second memory area, said agent program arranged to be copied to said first memory area for performing functions on behalf of said trusted component, under control of said first data processor.

10. A method of monitoring a computer platform comprising a first data processing means and a first memory means, said method comprising:

generating an interactive display for selecting at least one entity comprising said computer platform;

generating a display of events which can be monitored;

generating a display of entities of said computer platform;

selecting at least one said entity;

selecting at least one said event; and

monitoring a said entity for a said event.

11. A computer entity comprising:

a computer platform comprising a first data processor and a first memory device;

a trusted monitoring component comprising a second data processor and a second memory device;

a first computer program resident in said first memory area and operating said first data processor, said first computer program reporting back events concerning operation of said computer platform to said trusted monitoring component; and

a second computer program said second computer program resident in said second memory area of said trusted component, said second program operating to monitor an integrity of said first program.

12. The computer entity as claimed in claim 11, wherein said computer program monitors an integrity of said first computer program by sending to said first computer program a plurality of interrogation messages, and monitoring a reply to said interrogation messages made by said first computer program.

13. The computer entity as claimed in claim 12, wherein a said interrogation message is sent in a first format, and returned in a second format, wherein said second format is a secure format.

14. A method of monitoring a computer platform comprising a first data processor and a first memory means, said method comprising:

reading event data describing events occurring on at least one logical or physical entity comprising said computer platform; and

securing said event data in a second data processing means having an associated second memory area, said second data processing means, said second memory area being physically and logically distinct from said first data processing means and said first memory area, such that said secure event data cannot be altered without such alteration being apparent.

15. The method as claimed in claim 14, where a said event to be monitored is selected from the set of events comprising:

copying of a data file;

saving a data file;

renaming a data file;

opening a data file;

overwriting a data file;

modifying a data file;

printing a data file;

activating a driver device;

reconfiguring a driver device;

writing to a hard disk drive;

reading a hard disk drive;

opening an application; and

closing an application.

16. The method as claimed in claim 14, wherein a said entity to be monitored is selected from the set comprising:

at least one data file stored on said computer platform;

a driver device of said computer platform; and

an application program resident on said computer platform.

17. The method as claimed in claim 14, wherein said monitoring said entity comprises continuously monitoring a said entity over a pre-selected time period.

18. The method as claimed in claim 14, wherein said monitoring said entity comprises:

monitoring said entity until such time as a pre-selected event occurs on said entity.

19. The method as claimed in claim 14, wherein said monitoring said entity comprises:

monitoring a said entity for a selected event, until a predetermined time period has elapsed.

20. A method of monitoring a computer platform comprising a first data processing means and first memory means, said method comprising:

storing a monitoring program in a second memory area, said second memory area being physically and logically distinct from said first memory area;

transferring said monitoring program from said second memory area to said first memory area;

monitoring at least one entity of said computer platform from within said computer platform; and

reporting an event data from said monitoring program to said second data processor.

21. A method of monitoring a computer platform comprising a first data processing and a first memory means, said method comprising:

monitoring at least one entity comprising said computer platform from within said computer platform;

generating an event data describing a plurality of events occurring on said computer platform;

reporting said event data to a second data processing means having an associated second memory means; and

processing said event data into a secure format.