# US 10,313,376 B2 · Tamperproof logs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,376 B2 - Document ID: US10313376B2 - Status: Granted - Kind: B2 - Application number: 15/266,887 - Filed: 2016-09-15 - Published: 2018-03-15 - Granted: 2019-06-04 - Earliest claimed: 2016-09-15 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Stefan Thom; Artem Zhurid; Merzin Kapadia - Web page: https://patentgrep.com/patent/US10313376B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and devices for creating a secure log of security events may include receiving a historical digest representing approved historical security events associated with a trusted network of devices. The methods and devices may include receiving one or more new security events. The methods and devices may include calculating, when a period of time has expired, a hash based on at least the historical digest and the one or more new security events and determining if a value of the hash is less than a value threshold. The methods and devices may include storing a new security event digest corresponding to a respective hash having a respective value less than the value threshold, wherein the new security event digest is confirmed by one or more trusted devices in the trusted network of devices. ## Claims ### Claim 1 A computer device, comprising: a memory to store data and instructions; a processor in communication with the memory; and an operating system in communication with the memory and processor, wherein the operating system is configured to: receive a historical digest representing approved historical security events associated with a trusted network of devices communicating with the computer device, wherein the trusted network of devices is created by adding one or more trusted computer devices to the trusted network of devices when the one or more trusted computer devices have a trustworthy reputation; receive one or more new security events; calculate a hash based on at least the historical digest and the one or more new security events; determine if a value of the hash is less than a value threshold; and store a new security event digest corresponding to a respective hash having a respective value less than the value threshold, wherein the new security event digest is confirmed by one or more trusted devices in the trusted network of devices. ### Claim 2 (depends on 1) The computer device of claim 1, wherein the one or more new security events are published by the computer device, or at least one trusted device operating on the trusted network of devices, or a combination of the computer device and the at least one trusted device. ### Claim 3 (depends on 2) The computer device of claim 2, wherein the one or more new security events are signed by the computer device or the at least one trusted device. ### Claim 4 (depends on 1) The computer device of claim 1, wherein the trustworthy reputation is based on device performance in maintaining and validating security event logs over a time period. ### Claim 5 (depends on 1) The computer device of claim 1, wherein the respective hash having the respective value is the hash or a different hash based on a nonce published by a trusted device on the trusted network of devices. ### Claim 6 (depends on 1) The computer device of claim 1, wherein the operating system is further configured to: verify an accuracy of security information in one or more of the historical digest, the new digest, or a device log; and identify one or more trusted computer devices with incorrect security information when the security information is determined to be incorrect. ### Claim 7 (depends on 6) The computer device of claim 6, wherein the operating system is further configured to prevent the identified trusted computer devices from communicating with the computer device. ### Claim 8 (depends on 6) The computer device of claim 6, wherein the operating system is further configured to send a notification when the security information is determined to be incorrect. ### Claim 9 (depends on 1) The computer device of claim 1, wherein the operating system is further configured to transmit the hash having the value less than a value threshold to one or more trusted devices in the trusted network of devices. ### Claim 10 A method for creating a secure log of security events on a computer device, comprising: receiving, at an operating system executing on the computer device, a historical digest representing approved historical security events associated with a trusted network of devices communicating with the computer device, wherein the trusted network of devices is created by adding one or more trusted computer devices to the trusted network of devices when the one or more trusted computer devices have a trustworthy reputation; receiving, by the operating system, one or more new security events; calculating a hash based on at least the historical digest and the one or more new security events; determining if a value of the hash is less than a value threshold; and storing a new security event digest corresponding to a respective hash having a respective value less than the value threshold, wherein the new security event digest is confirmed by one or more trusted devices in the trusted network of devices. ### Claim 11 (depends on 10) The method of claim 10, wherein the one or more new security events are published by the computer device, or at least one trusted device operating on the trusted network of devices, or a combination of the computer device and the at least one trusted device. ### Claim 12 (depends on 11) The method of claim 11, wherein the one or more new security events are signed by the computer device or the at least one trusted device. ### Claim 13 (depends on 10) The method of claim 10, wherein the trustworthy reputation is based on device performance in maintaining and validating security event logs over a time period. ### Claim 14 (depends on 10) The method of claim 10, wherein the respective hash having the respective value is the hash or a different hash based on a nonce published by a trusted device on the trusted network of devices. ### Claim 15 (depends on 10) The method of claim 10, further comprising: verifying an accuracy of security information in one or more of the historical digest, the new digest, or a device log; identifying one or more trusted computer devices with incorrect security information when the security information is determined to be abnormal; and sending a notification when the security information is determined to be incorrect. ### Claim 16 (depends on 15) The method of claim 15, further comprising preventing the identified trusted computer devices from communicating with the computer device. ### Claim 17 (depends on 10) The method of claim 10, further comprising transmitting the hash having the value less than a value threshold to one or more trusted devices in the trusted network of devices. ### Claim 18 A computer-readable medium storing instructions executable by a computer device, comprising: at least one instruction for causing the computer device to receive a historical digest representing approved historical security events associated with a trusted network of devices communicating with the computer device, wherein the trusted network of devices is created by adding one or more trusted computer devices to the trusted network of devices when the one or more trusted computer devices have a trustworthy reputation; at least one instruction for causing the computer device to receive one or more new security events; at least one instruction for causing the computer device to calculate a hash based on at least the historical digest and the one or more new security events; at least one instruction for causing the computer device to determine if a value of the hash is less than a value threshold; and at least one instruction for causing the computer device to store a new security event digest corresponding to a respective hash having a respective value less than the value threshold, wherein the new security event digest is confirmed by one or more trusted devices in the trusted network of devices.