System and method for cryptographic forensic audits on lightweight IoT and digital archives
A new series of secure logging schemes that are referred to as Optimal Signatures for secure Logging (OSLO) are created. OSLO schemes are the first AS-based secure logging schemes that achieve small-constant tag and public key sizes with near-optimal signing and batch verification via various granularities. These features make them ideal for IoT-STaaS applications, wherein efficient signing and batch verification are critical for the resource-limited IoTs and cold storage servers, respectively.
1 . A system for cryptographic verifiability comprising:
a plurality of logger devices;
at least one distiller device; and
at least one cold storage server, wherein each logger device is adapted to:
generate a log, wherein the log comprises a plurality of entries and each entry is associated with a digital signature;
generate an aggregate signature for the log based on the digital signature associated with each entry, wherein the aggregate signature is an elliptic-curve based aggregate signature generated using one-time keys derived from a tree-based structure comprising a binary tree having a root seed from which child seeds are derived using pseudorandom function chains along tree paths of the tree-based structure;
provide the generated log and the aggregate signature to the at least one distiller device, wherein the at least one distiller device is adapted to:
receive a log from each of the logger devices, and for each received log from a logger device:
validate each entry in the log using the associated digital signature;
for each entry in the log that is validated:
batch the validated entries and associated digital signatures;
provide the batched validated entries to the at least one cold storage server;
for each entry in the log that is not validated:
batch the not validated entries and associated digital signatures; and
provide the batched not validated entries to the at least one cold storage server; and
wherein the at least one cold storage server is adapted to:
receive the batched validated and not validated entries;
audit at least some of the batched validated entries using a public key associated with the at least one distiller device; and
allow one or more external users to view the batched validated and not validated entries.
2 . The system of claim 1 , wherein each logger of the plurality of loggers is an internet-of-things device.
3 . The system of claim 1 , wherein the at least one distiller device is adapted to, for each received log from a logger device:
receive a public key associated with the at logger device; and
validate each entry in the log using the aggregated digital signature and the received public key.
4 . The system of claim 1 , wherein the distiller adapted to provide the batched validated entries to the at least one cold storage server comprises the distiller adapted to generate an aggregated digital signature for the batched validated entries, and provide the generated digital signature with the batched validated entries.
5 . A method for cryptographic verifiability comprising:
generating a log by a logger device of a plurality of logger devices, wherein the log comprises a plurality of entries and each entry is associated with a digital signature;
generating an aggregate signature for the log based on the digital signature associated with each entry by the logger device, wherein the aggregate signature is an elliptic-curve based aggregate signature generated using one-time keys derived from a tree-based structure comprising a binary tree having a root seed from which child seeds are derived using pseudorandom function chains along tree paths of the tree-based structure;
providing the generated log and the aggregate signature to at least one distiller device by the logger device;
receiving the log from the logger device by the at least one distiller device;
validating each entry in the log using the associated digital signature by the at least one distiller device;
for each entry in the log that is validated:
batching the validated entries and associated digital signatures by the at least one distiller device; and
providing the batched validated entries to at least one cold storage server by the at least one distiller device;
for each entry in the log that is not validated:
batching the not validated entries and associated digital signatures by the at least one distiller device; and
providing the batched not validated entries to the at least one cold storage server by the at least one distiller device;
receiving the batched validated and not validated entries by the at least one cold storage server;
auditing at least some of the batched validated entries by the at least one cold storage server; and
allowing one or more external users to view the batched validated and not validated entries by the at least one cold storage server.
6 . The method of claim 5 , wherein each logger of the plurality of loggers is an internet-of-things device.
7 . The method of claim 5 , further comprising:
receiving a public key associated with the at logger device; and
validating each entry in the log using the aggregated digital signature and the received public key.
8 . The method of claim 5 , wherein the logger generates the aggregate signature using a tree-based seed data structure.
9 . The method of claim 5 , further comprising generating an aggregated digital signature for the batched validated entries, and providing the generated digital signature with the batched validated entries.
10 . A non-transitory computer-readable medium with computer-executable instructions stored thereon that when executed by one or more computing devices cause the one or more computing devices to perform a method comprising:
generating a log by a logger device of a plurality of logger devices, wherein the log comprises a plurality of entries and each entry is associated with a digital signature;
generating an aggregate signature for the log based on the digital signature associated with each entry by the logger device, wherein the aggregate signature is an elliptic-curve based aggregate signature generated using one-time keys derived from a tree-based structure comprising a binary tree having a root seed from which child seeds are derived using pseudorandom function chains along tree paths of the tree-based structure;
providing the generated log and the aggregate signature to at least one distiller device by the logger device;
receiving the log from the logger device by the at least one distiller device;
validating each entry in the log using the associated digital signature by the at least one distiller device;
for each entry in the log that is validated:
batching the validated entries and associated digital signatures by the at least one distiller device; and
providing the batched validated entries to at least one cold storage server by the at least one distiller device;
for each entry in the log that is not validated:
batching the not validated entries and associated digital signatures by the at least one distiller device; and
providing the batched not validated entries to the at least one cold storage server by the at least one distiller device;
receiving the batched validated and not validated entries by the at least one cold storage server;
auditing at least some of the batched validated entries by the at least one cold storage server; and
allowing one or more external users to view the batched validated and not validated entries by the at least one cold storage server.
11 . The computer-readable medium of claim 10 , wherein each logger of the plurality of loggers is an internet-of-things device.
12 . The computer-readable medium of claim 10 , further comprising:
receiving a public key associated with the at logger device; and
validating each entry in the log using the aggregated digital signature and the received public key.