Adding Availability to Log Services of Untrusted Machines

Uncorrupted log files are the critical system component for computer forensics in case of intrusion and for real time system monitoring and auditing. Protection from tampering with information can be achieved using cryptographic functions that provide authenticity, integrity, and confidentiality. However, they cannot provide the prerequisite for any further information processing, i.e., information availability. In this case, fault tolerant strategies can be of great help improving information availability in case of accidental or deliberate deletion. In this paper we propose a system that increases log files availability in case of software deletion by reliably and efficiently distributing the logs on multiple independent machines. The proposed scheme is more efficient than simple replication, both from the storage space and the network bandwidth points of view. The proposed system has been implemented and its impact on performance has been measured. Since it operates as a postproces...

• Type: Conference
• Year: 1999
• Where: ACSAC
• Authors: Arianna Arona, Danilo Bruschi, Emilia Rosti
• Keywords: ACSAC 1999, Cryptographic Functions, Information Availability, Log Files, Security Privacy