Continuous Tamper-proof Logging using TPM2.0
Arunesh Sinha, Limin Jia, PAUL J. ENGLAND, Jacob R. Lorch · 2014
Abstract. Auditing system logs is an important means of ensuring systems ’ security in situations where run-time security mechanisms are not sufficient to completely prevent potentially malicious ac-tivities. A fundamental requirement for reliable auditing is the integrity of the log entries. This paper presents an infrastructure for secure logging that is capable of detecting the tampering of logs by pow-erful adversaries residing on the device where logs are generated. We rely on novel features of trusted hardware (TPM) to ensure the continuity of the logging infrastructure across power cycles without help from a remote server. Our infrastructure also addresses practical concerns including how to han-dle high-frequency log updates, how to conserve disk space for storing logs, and how to efficiently verify an arbitrary subset of the log. Importantly, we formally state the tamper-proofness guarantee of our infrastructure and verify that our basic secure logging protocol provides the desired guaran-tee. To demonstrate that our infrastructure is practical, we implement a prototype and evaluate its performance. 1