LNCS 3269 - Time-Scoped Searching of Encrypted Audit Logs

Time-Scoped Searching of Encrypted Audit Logs(Extended Abstract)1 1 2Darren Davis , Fabian Monrose ,andMichaelK.Reiter1 Johns Hopkins University, Baltimore, MD, USAddavis@jhu.edu, fabian@cs.jhu.edu2 Carnegie Mellon University, Pittsburgh, PA, USAreiter@ece.cmu.eduAbstract. In this paper we explore restricted delegation of searches onencrypted audit logs. We show how to limit the exposure of private infor-mation stored in the log during such a search and provide a technique todelegate searches on the log to an investigator. These delegated searchesare limited to authorized keywords that pertain to specific time periods,and provide guarantees of completeness to the investigator. Moreover,we show that investigators can efficiently find all relevant records, andcan authenticate retrieved records without interacting with the owner ofthe log. In addition, we provide an empirical evaluation of our techniquesusing encrypted logs consisting of approximately 27, 000 records of IDSalerts collected over a span of a few months.1 IntroductionIn this paper we present a protocol by which Alice can delegate to an investigatorthe ability to search an audit log on her server for specific keywords generatedin specific time periods. Following this delegation, the investigator can performthat search so that the server, even if corrupted by an attacker after the timeperiods being searched (but before the search itself), cannot undetectably mis-lead the investigator. The ...