Apparatus, system, and method for auditing access to secure data

1. An apparatus comprising:

a computer readable storage device storing machine readable code executed by a processor, the machine readable code comprising:

a detection module detecting an access to secure data, wherein the secure data is stored in secure data blocks of a remote storage device and the secure data blocks are identified by a secured data identifier that cannot be modified;

a record module recording an encrypted log entry describing the access to the secure data, the encrypted log entry comprising a log entry encrypted with a hash of the log entry with a secure credential, the log entry comprising a user identification; and

a verification module decrypting the encrypted log entry, determining if the log entry is modified from anomalies in the decrypted log entry, determining from the decrypted log entry if an unauthorized user accessed the secure data if the user identification is not listed in a user identification table, and verifying the secure data is securely stored in response to the log entry not being modified and the secure data not being accessed by the unauthorized user.

2. The apparatus of claim 1 , wherein the detection module is embodied in a Trusted Platform Module compliant secure subsystem.

3. The apparatus of claim 1 , wherein the log entry further comprises a time stamp and a filename.

4. A method comprising:

detecting, by use of a processor, an access to secure data, wherein the secure data is stored in secure data blocks of a remote storage device and the secure data blocks are identified by a secured data identifier that cannot be modified;

recording an encrypted log entry describing the access to the secure data, the encrypted log entry comprising a log entry encrypted with a hash of the log entry with a secure credential, the log entry comprising a user identification;

decrypting the encrypted log entry;

determining if the log entry is modified from anomalies in the decrypted log entry;

determining from the decrypted log entry if an unauthorized user accessed the secure data if the user identification is not listed in a user identification table; and

verifying the secure data is securely stored in response to the log entry not being modified and the secure data not being accessed by the unauthorized user.

5. The method of claim 4 , wherein a secure subsystem detects the access to the secure data and records the encrypted log entry.

6. The method of claim 5 , wherein the secure subsystem is a Trusted Platform Module compliant secure subsystem.

7. The method of claim 5 , wherein the encrypted log entry is recorded remotely from the secure subsystem.

8. The method of claim 4 , wherein the log entry further comprises a time stamp and a filename.

9. The method of claim 8 , wherein the user identification comprises a biometric identifier.

10. The method of claim 8 , wherein the user identification is confirmed by a secret.

11. A system comprising:

a remote storage device storing secure data in secure data blocks, wherein the secure data blocks are identified by a secured data identifier that cannot be modified;

a detection module detecting an access to the secure data on the remote storage device;

a record module recording an encrypted log entry describing the access to the secure data stored on the remote storage device, the encrypted log entry comprising a log entry encrypted with a hash of the log entry with a secure credential, the log entry comprising a user identification; and

a verification module decrypting the encrypted log entry, determining if the log entry is modified from anomalies in the decrypted log entry, determining from the decrypted log entry if an unauthorized user accessed the secure data if the user identification is not listed in a user identification table, and verifying the secure data is securely stored in response to the log entry not being modified and the secure data not being accessed by the unauthorized user.

12. The system of claim 11 , wherein the detection module is embodied in a Trusted Platform Module compliant secure subsystem and the log entry further comprises a time stamp and a filename.