Efficient log authentication for forensic computing

Abstract

In this paper, an efficient log authentication scheme for forensic computing is proposed. To conduct reliable forensic computing, it is required that the logs as digital evidences be verified. To verify them, digital signatures issued by authorities are needed. However, if many logging hosts connect to the server that issues the signatures, the traffic of the server will increase. Therefore, the authors proposed an efficient log authentication scheme for forensic computing. The scheme reduces the traffic of the sign server, which signs the logs of the logging hosts, by using distributed Merkle tree algorithm among the logging hosts. The scheme's effectiveness was shown through evaluation experiments.