TECHNICAL FIELD

This disclosure relates to computing systems, and more specifically, to logging services for computer applications.

BACKGROUND

Securing system logs for information technology (IT) systems and applications is important for assuring the integrity of transaction records. In general, logs record past events such as transactions, user events, application events, computing system statuses, and changes to data. The integrity of a log having one or more records of activity is maintained when the log remains an accurate reflection of the transactions represented in the records because no fake data is inserted, no records are modified or delegated, and the records are not reordered. A log record is authentic when it is generated by the expected party. The integrity and authenticity of a log record should be provable to parties to a transaction represented in the log record.

SUMMARY

In general, techniques are described for using zero-knowledge proofs and digital signatures to verify the authenticity of log records generated by multiple parties, at least in some cases without exposing personally identifiable information for the parties. For example, a trusted third-party, such as a regulator, may assign a decentralized identifier (DID) and a public key to a party that participates in a log verification system deployed by a provider. The party may further obtain, e.g., from the trusted third-party, credentials including a verification key and a proving key, which are associated by the trusted third-party with the DID and public key assigned to the party. The trusted third-party may store these items and credentials to an identity store. The trusted third-party may assign DIDs to multiple such parties that participate in or otherwise use the log verification system. The party generates log records of transactions between the party and other parties and sends these log records to the log verification system along with a zero-knowledge proof generated by the party using the proving key. The proof may be generated once by the party or sent by the party to the log verification system with each log record. The log verification system may not store personally-identifying information for the party, such as the DID or the public key for the party.

Multiple parties may generate log records in this way. The log verification system attaches the corresponding party proofs to the log records and may combine multiple log records and corresponding proofs into a log block of log records, which stores multiple such log records and corresponding proof from multiple separate parties. In this way, each proof generated by a party attests to the authenticity of a corresponding log record generated by the party, because only the party having the DID (i.e., the party) can generate the proof. The log verification system may also time stamp each log record. The log verification system hashes the log block and may submit the log block to be signed by the trusted third-party. The log verification system stores the log block or signed log block, and the hash. The log block may be stored as a block in a chain, such as a block in a Merkle tree.

To verify the authenticity of a log record, the log verification system obtains the log block and may submit the log block for signature verification by the trusted third-party. The log verification system sends the proof for the party that generated the log record to the trusted third-party for authenticity verification. Using the verification key for the party, which the trusted third-party may look up using the proof or public key for the party, along with the public key for the party and the proof, the trusted third-party computes the zero-knowledge proof verification algorithm to evaluate whether the proof attests that the party computed the proof using the party DID. The regulator may output an indication of whether the log record is authentic.

The techniques may provide one or more technical advantages for realizing at least one practical application. For example, by consolidating log records for multiple different parties of a log verification system provider into log blocks, the techniques may facilitate a low-latency log record verification scheme by avoiding a computationally expensive per-record signing scheme while still being tamper-resistant and permitting efficient log record extraction from multi-party log blocks. As another example, the techniques facilitate anonymity for parties by separating the personally-identifiable information for a party from the log verification system provider. While verification requests are made to the log verification system, the log verification system may not store the personally-identifiable information and instead anonymizes the log records by appending the proof and, in some cases, a public key used to generate the proof. The party receives credentials for generating the proof directly from the trusted third-party. The techniques may also have advantages over hashed chains. For example, the techniques may avoid the cost of generating per-record signatures as well as overhead associated with key management. The techniques may also preserve granularity of the log records in a multiparty/multiparty environment where ordering cannot be done based on time due to synchronous generation of logs by multiple parties, in contrast to hashed chain-based techniques.

In some examples, a method includes receiving, by a log verification system, a first log record for a first party and a first zero-knowledge proof for the first party; receiving, by the log verification system, a second log record for a second party and a second zero-knowledge proof for the second party; generating, by the log verification system, a log block comprising the first log record in association with the first zero-knowledge proof and the second log record in association with the second zero-knowledge proof; storing, by the log verification system, a signed log block comprising the log block in association with a digital signature for the log block; verifying an authenticity of the first log record using the first zero-knowledge proof and credentials for the first party, wherein the credentials for the first party were used to generate the first zero-knowledge proof; and outputting an indication of whether the first log record is authentic.

In some examples, a computing system comprises a log verification system comprising first processing circuitry coupled to first memory, the log verification system configured to: receive a first log record for a first party and a first zero-knowledge proof for the first party; receive a second log record for a second party and a second zero-knowledge proof for the second party; generate a log block comprising the first log record in association with the first zero-knowledge proof and the second log record in association with the second zero-knowledge proof; and store a signed log block comprising the log block in association with a digital signature for the log block, the computing system further comprising: a trusted third-party computing system comprising second processing circuitry coupled to second memory, the trusted third-party computing system configured to: verify an authenticity of the first log record using the first zero-knowledge proof and credentials for the first party, wherein the credentials for the first party were used to generate the first zero-knowledge proof; and output an indication of whether the first log record is authentic.

In some examples, a computer-readable storage medium is configured with instructions for causing a computing system to: receive, by a log verification system of the computing system, a first log record for a first party and a first zero-knowledge proof for the first party; receive, by the log verification system, a second log record for a second party and a second zero-knowledge proof for the second party; generate, by the log verification system, a log block comprising the first log record in association with the first zero-knowledge proof and the second log record in association with the second zero-knowledge proof; store, by the log verification system, a signed log block comprising the log block in association with a digital signature for the log block; verify an authenticity of the first log record using the first zero-knowledge proof and credentials for the first party, wherein the credentials for the first party were used to generate the first zero-knowledge proof; and output an indication of whether the first log record is authentic.

Also described are a computing system configured to perform any of the methods described in this disclosure, a computing system having means for performing any of the methods described in this disclosure, and computer-readable storage media configured with instructions for causing a computing system to perform any of the methods described in this disclosure.

The details of one or more examples of the disclosure are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the disclosure will be apparent from the description and drawings, and from the claims.

