Auditchain: um mecanismo para atestar a integridade de logs baseado na prova de existência em blockchain pública

Abstract

Digital data are critical to people and companies, acting as a crucial element in the decisionmaking process in different areas. Thus, attesting to data integrity is crucial because forgery can result in significant losses. Logs can track how this data changes over time and are essential to enable auditing. The traditional approach to ensure log integrity is to store them on well-kept servers, both from a physical and a digital security standpoint. However, this approach assumes that it is difficult to exploit these servers’ vulnerabilities and that these systems’ administrators can be trusted. Distributing the trust is an alternative that does not rely on these assumptions, and blockchain-based approaches are promising in that aspect. Even though the literature has already proposed some methods for attesting logs’ integrity after their storage, we found no works that identify Proof of Existence (PoE) as a potential basic block for carrying that task. PoE consists of sending the hash of an object to a public blockchain, proving that the object existed before its hash became included in the blockchain. Furthermore, we found no works that paid attention to ease the technique’s practical use by allowing for the ingestion of logs from different sources. Thus, this work’s primary goal is to propose an architecture capable of integrating PoE on public blockchains with Elasticsearch, a tool widely used today for indexing logs from different sources. We applied the case study method, an effective method to investigate and understand complex issues in real-world scenarios. The context addressed is that of computer technicians, in partnership with the Secretariat of Informatics (SIn) of the Federal University of São Carlos, to obtain results that can be generalized to other contexts. We conducted a comparative analysis between PoE Application Programmer Interfaces, resulting in the choice of OpenTimestamps for the development of our software prototype. We tested the last version of our prototype by attesting logs stored in SIn’s Elasticsearch service uninterruptedly for 10 days. We verified that the prototype was working correctly and presented a temporal resolution compatible with the transaction fulfillment rate sustained by public OpenTimestamps servers. We hope the knowledge obtained through the development of our software prototype, as documented in this work, will help to foster an understanding of how blockchain technology may contribute to log attestation and to raise awareness of the related techniques amongst system administrators.