Patent ID: 8230228

Claim:
A method of supporting tamper detection of audit log information within a computing system, comprising: configuring a tamper evidence adding proxy for adding tamper evidence information to audit information to provide tamper evident audit records by: obtaining electronically communicated audit records from at least one audit record generating source; grouping obtained audit records into subsets of audit records, each subset comprising at least two sequentially-occurring ones of the audit records; providing tamper evidence processing to the subsets of audit records utilizing a cryptographic mechanism to calculate, over each of the subsets of audit records, a digital signature using a corresponding signature definition so as to create an overlapping chain of digitally signed audit records, wherein each of the subsets of audit records contains at least one designated carryover audit record that overlaps into a next one of the subsets such that each carryover audit record is associated with at least two of the subsets and therefore with a corresponding number of the digital signatures computed over the subsets; forwarding the tamper evident audit records from the tamper evidence adding proxy to a corresponding audit log storage subsystem for storage; and storing the calculated digital signatures; and performing tamper monitoring by: retrieving an audit record of interest from the audit log storage subsystem; retrieving all audit records in an associated subset of audit records corresponding to the audit record of interest; retrieving the digital signature associated with the retrieved subset of audit records; signing the retrieved subset of audit records using the corresponding signature definition; comparing a result of signing the retrieved subset with the retrieved digital signature; and conveying whether tampering has been evidenced based upon the comparison.