Systems and methods for tamper-resistant activity logging
AssigneePalantir Technologies Inc.
InventorsNomi Becker, Anne Ryan
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided for monitoring and logging all activity occurring in a system. The logged activity may include keystroke entries input into the system, user and/or application interactions with the system, access restriction conflicts, and the like. The logged activity may be stored in at least two datastores, at least one of which is an immutable, append-only datastore. Storage of the logged activity in the immutable, append-only datastore is performed using hash algorithms. Attempts at manipulating or at hiding malicious or unauthorized activity can be recognized due to all activity being captured in the immutable, append-only datastore.
Claims20
A system comprising:
- one or more processors;
- and
- a memory storing instructions that, when executed by the one or more processors, cause the system to perform:
- logging data manipulation activity in the system;
- storing data manipulation activity logs in an append-only datastore with associated hash codes;
- re-storing the data manipulation activity logs with the associated hash codes in a system log separate from the append-only datastore;
- deleting, responsive to a user request, a portion of a first data manipulation activity log stored in the system log in association with a first hash code;
- receiving, at the append-only datastore, a request to re-store the first data manipulation activity log as a modified version of the first data manipulation activity log with the portion deleted;
- generating a second hash code responsive to receiving the request to re-store the first data manipulation activity log as the modified version;
- re-storing the first data manipulation activity log as the modified version in the append-only datastore;
- and
- re-storing the first data manipulation activity log as the modified version in the system log in association with the second hash code,
- wherein a discrepancy between the first hash code and the second hash code indicates that the user request is associated with malicious activity.
A method being implemented by a computing system including one or more physical processors and storage media storing machine-readable instructions, the method comprising:
- logging data manipulation activity in the computing system;
- generating hash codes based on the logged data manipulation activity;
- storing data manipulation activity logs in an append-only datastore with the generated hash codes;
- re-storing the data manipulation activity logs with the generated hash codes in a system log separate from the append-only datastore;
- deleting, responsive to a user request, a portion of a first data manipulation activity log stored in the system log in association with a first hash code;
- receiving, at the append-only datastore, a request to re-store the first data manipulation activity log as a modified version of the first data manipulation activity log with the portion deleted;
- generating a second hash code responsive to receiving the request to re-store the first data manipulation activity log as the modified version;
- re-storing the first data manipulation activity log as the modified version in the append-only datastore;
- and
- re-storing the first data manipulation activity log as the modified version in the system log in association with the second hash code,
- wherein a discrepancy between the first hash code and the second hash code indicates that the user request is associated with malicious activity.
Dependencies are inferred from the claim text.