基于TCM的可信事件日志生成方法

系统事件日志记录是系统安全审计最重要的数据源.现有的日志保护机制主要解决事件日志生成后的数据完整性保护方面的问题,但对于日志数据生成阶段的可信生成方面还没有解决.本文主要贡献是提出了一种基于TCM模块的可信事件日志生成方法,为事件日志提供了生成时的数据完整性、可认证性等安全特性,增强了事件日志数据的可信性,通过分析证明了本方法的有效性和可实施性.

Trusted generation method for event logs based on TCM

System event log is the most important data source for system security auditing, which is vulnerable to malicious tampering or deleted, the event log data integrity protection has roused the attention of the researchers. Existing log protection mechanisms mainly solve the data integri- ty protection in the event log after it has generated, such as log data storage backup integrity pro- tection and efficiency, but they have not been solved for the log data phase of credible generation. This paper puts forward a credible event log generation approach based on TCM module. It also provides the data integrity, authentication security features and so on when the event log is gener- ating, and enhances the events log data credibility. It proves that this method is effective and practical through the analysis.