# US 11,909,770 B2 · Ongoing and on-demand secure verification of audit compliance > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,770 B2 - Document ID: US11909770B2 - Status: Granted - Kind: B2 - Application number: 17/562,421 - Filed: 2021-12-27 - Published: 2022-04-21 - Granted: 2024-02-20 - Earliest claimed: 2019-01-14 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Michael T. Strosaker; Sandra P. Nava; Eric Richter; Jon P. Weiser; Matt Hartenbower; George C. Wilson - Web page: https://patentgrep.com/patent/US11909770B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 9/3247: {involving digital signatures} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Providing an accurate and on-demand status of audit compliance is disclosed. A security policy, agreed upon by a service provider and a service user, is provisioned in a compliance log. A service provider requests to add a first update to the compliance log, the first update indicating that a compliance action has been taken. The first update is added to the compliance log, and a first computational digest of the compliance log is added after adding the first update. An auditor of the compliance action requests to add a second update to the compliance log. The second update is added to the compliance log, and a second computational digest of the compliance log is added after adding the second update. Thereby, the user is provided a more current view of audit compliance that that can be trusted based on the tamper-proof compliance log. ## Claims ### Claim 1 A method of providing ongoing and on-demand secure verification of audit compliance for a security policy in a computer network, the method comprising: identifying a first update published by a service provider in a compliance log, the first update including: an indication that a compliance action has been taken, a pointer to private data of the service provider, a first digest of the compliance log, and a digital signature of the service provider; verifying, by an auditor, performance of the compliance action using the pointer to the private data of the service provider; and publishing, by the auditor, a second update to the compliance log, the second update including: an indication that the service provider is in compliance with a security policy, a second digest of the compliance log, and a digital signature of the auditor. ### Claim 2 (depends on 1) The method of claim 1 wherein the auditor and the service provider are provided with read/write access to the compliance log, and wherein a user is provided with read-only access to the compliance log. ### Claim 3 (depends on 1) The method of claim 1 wherein the first digest of the compliance log is a hash of the compliance log, and wherein the second digest of the compliance log is a hash of the compliance log. ### Claim 4 (depends on 1) The method of claim 1 wherein a plurality of copies of the compliance log are each maintained and updated independently. ### Claim 5 (depends on 1) The method of claim 1 wherein the the pointer is encrypted, and wherein the auditor decrypts the pointer. ### Claim 6 (depends on 1) The method of claim 1 wherein the compliance log includes the security policy. ### Claim 7 (depends on 1) The method of claim 1 wherein the compliance log is implemented using blockchain. ### Claim 8 An apparatus for providing ongoing and on-demand secure verification of audit compliance for a security policy in a computer network, the apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of: identifying a first update published by a service provider in a compliance log, the first update including: an indication that a compliance action has been taken, a pointer to private data of the service provider, a first digest of the compliance log, and a digital signature of the service provider; verifying, by an auditor, performance of the compliance action using the pointer to the private data of the service provider; and publishing, by the auditor, a second update to the compliance log, the second update including: an indication that the service provider is in compliance with a security policy, a second digest of the compliance log, and a digital signature of the auditor. ### Claim 9 (depends on 8) The apparatus of claim 8 wherein the auditor and the service provider are provided with read/write access to the compliance log, and wherein a user is provided with read-only access to the compliance log. ### Claim 10 (depends on 8) The apparatus of claim 8 wherein the first digest of the compliance log is a hash of the compliance log, and wherein the second digest of the compliance log is a hash of the compliance log. ### Claim 11 (depends on 8) The apparatus of claim 8 wherein a plurality of copies of the compliance log are each maintained and updated independently. ### Claim 12 (depends on 8) The apparatus of claim 8 wherein the the pointer is encrypted, and wherein the auditor decrypts the pointer. ### Claim 13 (depends on 8) The apparatus of claim 8 wherein the compliance log includes the security policy. ### Claim 14 (depends on 8) The apparatus of claim 8 wherein the compliance log is implemented using blockchain. ### Claim 15 A computer program product for providing ongoing and on-demand secure verification of audit compliance for a security policy in a computer network, the computer program product disposed upon a computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out the steps of: identifying a first update published by a service provider in a compliance log, the first update including: an indication that a compliance action has been taken, a pointer to private data of the service provider, a first digest of the compliance log, and a digital signature of the service provider; verifying, by an auditor, performance of the compliance action using the pointer to the private data of the service provider; and publishing, by the auditor, a second update to the compliance log, the second update including: an indication that the service provider is in compliance with a security policy, a second digest of the compliance log, and a digital signature of the auditor. ### Claim 16 (depends on 15) The computer program product of claim 15 wherein the auditor and the service provider are provided with read/write access to the compliance log, and wherein a user is provided with read-only access to the compliance log. ### Claim 17 (depends on 15) The computer program product of claim 15 wherein the first digest of the compliance log is a hash of the compliance log, and wherein the second digest of the compliance log is a hash of the compliance log. ### Claim 18 (depends on 15) The computer program product of claim 15 wherein a plurality of copies of the compliance log are each maintained and updated independently. ### Claim 19 (depends on 15) The computer program product of claim 15 wherein the the pointer is encrypted, and wherein the auditor decrypts the pointer. ### Claim 20 (depends on 15) The computer program product of claim 15 wherein the compliance log includes the security policy.