Forensic analysis of database tampering

ABSTRACT

Mechanisms now exist that detect tampering of a database, through the use of cryptographically-strong hash functions. This paper addresses the next problem, that of determining who, when, and what, by providing a systematic means of performing forensic analysis after such tampering has been uncovered. We introduce a schematic representation termed a "corruption diagram" that aids in intrusion investigation. We use these diagrams to fully analyze the original proposal, that of a linked sequence of hash values. We examine the various kinds of intrusions that are possible, including retroactive, introactive, backdating, and postdating intrusions. We then introduce successively more sophisticated forensic analysis algorithms: the monochromatic, RGB, and polychromatic algorithms, and characterize the "forensic strength" of these algorithms. We show how forensic analysis can efficiently extract a good deal of information concerning a corruption event.

REFERENCES

• 1: I. Ahn , Richard Thomas Snodgrass, Partitioned storage for temporal databases, Information Systems, v.13 n.4, p.369-391, Oct. 1, 1988 [doi>10.1016/0306-4379(88)90004-X]
• 2: J. Bair, M. Böhlen, C. S. Jensen, and R. T. Snodgrass, "Notions of Upward Compatibility of Temporal Query Languages," Business Informatics (Wirtschafts Informatik) 39(1):25--34, February, 1997.
• 3: K. Fu, M. F. Kaashoek and D. Mazières, "Fast and secure distributed read-only file system," in Proceedings of the USENIX Symposium on Operating Systems Design and Implementation, pp. 181--196, October 2000.
• 4: P. A. Gerr, B. Babineau, and P. C. Gordon, "Compliance: the effect on information management and the storage industry," Enterprise Storage Group Technical Report, May 2003.
• 5: S. Haber and W. S. Stornetta, "How To Time-Stamp a Digital Document," Journal of Cryptology 3:99--111, 1999.
• 6: W. W. Hsu and S. Ong, "Fossilization: A process for establishing truly trustworthy records," IBM Research report RJ 10331, 2004.
• 7: C. S. Jensen and C. E. Dyreson (eds), "A Consensus Glossary of Temporal Database Concepts---February 1998 Version," in Temporal Databases: Research and Practice, O. Etzion, S. Jajodia, and S. Sripada (eds.), Springer-Verlag, pp. 367--405, 1998.
• 8: C. S. Jensen , Richard Thomas Snodgrass, Temporal Specialization and Generalization, IEEE Transactions on Knowledge and Data Engineering, v.6 n.6, p.954-974, December 1994 [doi>10.1109/69.334885]
• 9: Lab Compliance, www.labcompliance.com/e-signatures/overview.htm, viewed November 14, 2005.
• 10: David Lomet , Roger Barga , Mohamed F. Mokbel , German Shegalov , Rui Wang , Yunyue Zhu, Immortal DB: transaction time support for SQL server, Proceedings of the 2005 ACM SIGMOD international conference on Management of data, June 14-16, 2005, Baltimore, Maryland [doi>10.1145/1066157.1066295]
• 11: David Mazières , Michael Kaminsky , M. Frans Kaashoek , Emmett Witchel, Separating key management from file system security, Proceedings of the seventeenth ACM symposium on Operating systems principles, p.124-139, December 12-15, 1999, Charleston, South Carolina, United States
• 12: Athicha Muthitacharoen , Robert Morris , Thomer M. Gil , Benjie Chen, Ivy: a read/write peer-to-peer file system, Proceedings of the 5th symposium on Operating systems design and implementation

  Due to copyright restrictions we are not able to make the PDFs for this conference available for downloading

  , December 09-11, 2002, Boston, Massachusetts [doi>10.1145/1060289.1060293]
• 13: Oracle Corporation, "Oracle Database 10g Workspace Manager Overview," Oracle White Paper, May 2005.
• 14: Bruce Schneier , John Kelsey, Secure audit logs to support computer forensics, ACM Transactions on Information and System Security (TISSEC), v.2 n.2, p.159-176, May 1999 [doi>10.1145/317087.317089]
• 15: R. T. Snodgrass, S. S. Yao, and C. Collberg, "Tamper Detection in Audit Logs," in Proceedings of the International Conference on Very Large Databases, pp. 504--515, Toronto, Canada, September 2004.
• 16: Qingbo Zhu , Windsor W. Hsu, Fossilized index: the linchpin of trustworthy non-alterable electronic records, Proceedings of the 2005 ACM SIGMOD international conference on Management of data, June 14-16, 2005, Baltimore, Maryland [doi>10.1145/1066157.1066203]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Algorithms, Security, Verification

Keywords:
append-only, corruption diagram, cryptographic hash function, forensic strength