Method and system of generating immutable audit logs

1. A system to generate Immutable Audit Logs from one or more audit information sources, comprising at least one independent server (IAL server) hosting a software program, performing the following functions:

a. receiving audit information from at least one source by means of an API (Application Programming Interface) that is provided to enable the communication between said IAL server and said audit information source(s) through a communications network;

b. processing the audit information applying cryptographic routines to generate one immutable digital chain that contains at least the audit information such that only authorized auditors will be able to verify integrity of the immutable digital chain and access the audit data; and

c. storing said chain in a mass storage media comprising at least one of a hard drive, a WORM or a Storage Area Network (SAN),

wherein said immutable digital chain is generated by including at every link at least the data resulting to apply an HMAC function using a secret session key K over the result of information at current link concatenated with previous link HMAC value, so that link, will contain at least HMAC K (information of link i operated with h i-1 ) where h i-1 is HMAC K (data of link i-1 concatenated with h i-2 ),

said IAL server comprising at least a timer for adding specific links to said immutable digital chain at regular defined intervals (‘Metronome Entry’) that contain at least a timestamp and the data resulting to apply a digital signature using a private key that is always kept secret over the metronome timestamp concatenated with the previous results, and

wherein a first entry of said immutable digital chain contains at least said secret session key K encrypted with the public key of an authorized auditor and digitally signed by a private key so that an auditor can benefit from the guaranteed presence at said regular defined intervals of entries that contain at least a timestamp that is digitally signed.

2. The system according to claim 1 wherein the communication between the IAL server(s) and the information source font(s) uses as transport protocol standard HTTPS TLS/SSL calls over TCP/IP where both the IAL server and the audit information sources are node-to-node authenticated with trusted certificates.

3. The system according to claim 1 wherein the communication between the IAL server(s) and the information source font(s) uses as transport protocol standard syslog or secure syslog calls over TCP/IP.

4. The system according to claim 1 wherein one of a Hardware Security Module (HSM), a smart card or a USB token is used to generate at least one private key, which is always kept secret, and used to calculate and add digital signatures at least to one of said one or more immutable digital chains.

5. The system according to claim 1 wherein one of a Hardware Security Module (HSM) is used at least to generate and keep secure the cryptographic keys used in the method.

6. The system according to claim 1 wherein the immutable audit chains are stored as files in the IAL server hard drive or on an external mass storage media.

7. The system according to claim 1 wherein the immutable audit chains are stored in a database in the IAL server hard drive or an external mass storage media.

8. A method to generate Immutable Audit logs (IAL) using related computer means and/or computer programs comprising:

a. receiving the audit information from multiple sources, over a communication network;

b. processing the audit information by cryptographic means generating one immutable digital chain that will contain at least the audit information split among the links, optionally encrypted; and

c. storing the immutable digital chain in a massive storage media,

said immutable digital chain being generated by including at every link at least the data resulting to apply a MAC function using a secret session key K over the result of information at current link concatenated with previous link MAC value, so that link will contain at least MAC K (information of link operated with h i-1 ) where hi- 1 is MAC K (data of link i-1 concatenated with h i-2 ),

a first entry of said immutable digital chain containing at least said secret session key K encrypted with the public key of an authorized auditor and digitally signed by a private key; and

wherein specific links are added to said immutable digital chain at regular defined intervals (‘Metronome Entry’) that contain at least a timestamp and the data resulting to apply a digital signature using a private key that is always kept secret over the metronome timestamp concatenated with previous link results, so that an auditor can benefit from the guaranteed presence at said regular defined intervals of entries that contain at least a timestamp that is digitally signed.

9. The method according to claim 8 wherein the applied MAC function is an H-MAC (keyed-hash) function.

10. The method according to claim 8 wherein a Hardware Security Module is used at least to generate and keep secure the cryptographic keys.

11. The method according to claim 9 wherein a Hardware Security Module is used at least to generate and keep secure the cryptographic keys.