# Secure Remote Storage of Logs with Search Capabilities
## 4 Proposed Solution
### Indexing
If not, a new entry for \(T_{Ln}[i]\) is created and initialized with the respective \(L_{ni}\)```
Input :\(L_{n}\), \(TS\), \(LS_{i}\) Output :\(L_{ni}\), \(L_{En}\), \(H_{Ln}\), \(HC_{Ln}\), \(T_{Ln}\), \(LS_{i}\)
1\(LS\leftarrow\) LogSources.get(\(LS_{i}\))
2\(L_{ni}\leftarrow\) generateId()
3\(K_{Ln}\leftarrow\) HMAC.create(\(LSLS_{eK}\), \(L_{ni}\))
4\(LE_{n}\gets K_{Ln}\).encrypt([\(L_{n}\), \(TS\)])
5\(H_{Ln}\leftarrow\) HMAC.create(\(LSLS_{hK}\), \(LE_{n}+LS_{i}+L_{ni}\))
6\(HC_{Ln}\leftarrow\) HMAC.create(\(LSLS_{hK}\), \(H_{Ln}+LS_{i}HC_{Ln-1}\))
7\(LS_{i}HC_{Ln-1}\gets HC_{Ln}\)
8\(T_{Ln}\leftarrow\) []
9 ifexists(\(LS.LS_{regex}\))then
10\(L_{nparsed}\gets LS.LS_{regex}\).parse(\(L_{n}\))
11 for\(i\gets 0\)to length(\(L_{nparsed}\))do
12\(L_{nfield}\gets L_{nparsed}[i]\)
13\(L_{nfieldId}\gets LS_{nparsed}\).convert(\(L_{nfield}\))
14\(L_{ntrapdoor}\leftarrow\) HMAC.create(\(SLS_{hK}\), \(L_{nfield}\))
15\(T_{Ln}\).add([\(L_{nfieldId}\), \(L_{ntrapdoor}\)])
16 else
17\(L_{n\_{nantitized}}\gets LS_{bk}\).sanitize(\(L_{n}\))
18\(L_{nparsed}\gets LS_{bLn}\).split(\(L_{n\_{nantitized}}\))
19 for\(i\gets 0\)to length(\(L_{nparsed}\))do
20\(L_{nfield}\gets L_{nparsed}[i]\)
21\(L_{ntrapdoor}\leftarrow\) HMAC.create(\(SLS_{hK}\), \(L_{nfield}\))
22\(T_{Ln}\).add([\(L_{ntrapdoor}\)])
23\(SLaS\).index(\(L_{ni}\), \(LE_{n}\), \(H_{Ln}\), \(HC_{Ln}\), \(T_{Ln}\), \(LS_{i}\))
```

**Algorithm 1** SLS indexing algorithm

### Searching

The Search operation is assumed to be executed whenever a query over the encrypted log records is required. From the perspective of the user, he submits a clear text query and receives matching clear text log records. However, the SLS applies a series of cryptographic operations to assure that no one besides him has knowledge about the query and matching results. Algorithm 2 explains the process executed by the SLS to transform a clear text query into an encrypted query. Algorithm 3 demonstrates how the SLS, using the encrypted query, retrieves matching log records from the SLaS Application and presents them to the user. In order to enable the construction of any query supported by the search algorithm, a query syntax was envisioned. Algorithm 2 receives as input a clear text query \(Q\) comprised of operators and terms and may be represented like \"TERM OPERATOR (TERM OPERATOR TERM)\" where the \"TERM\" represents the keywords to be searched, the \"OPERATOR\" represents the Boolean operators and parentheses indicate the existence of a nested query. Regarding the OPERATOR clause, the algorithm supports the three basic Boolean operators \"AND\", \"OR\", or \"NOT\" that enable conjunctive keyword queries. The TERM clause is used to indicate what keywords shall be searched within the encrypted log records. Each term can be composed either by the single keyword value or by the combination of the keyword value and the identifier of the field where the search should focus. If only the keyword value is present, the query will test the presence of such keyword in any part of the log record, which may return results that are not relevant for the desired search. Thus, the combination of keyword value and the field identifier enables field search and consequent more accurate results. To perform a field query, the field identifier and the keyword value must be combined like \"ID=VALUE\". For instance, a query term can be either \"GET\" or \"method=GET\". The former indicates a search of the keyword \"GET\" in all the log records universe, while the latter indicates that the value \"GET\" should be only looked up on the field \"method\".