Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
only used for encrypting small amounts of information, this is due to the large
calculations that are involved.
Two prototype systems will be developed, one that uses asymmetric encryption to
secure all communications between the client and server. The other will use
symmetric encryption to encrypt the bulk of the communications, but will transfer the
shared key using asymmetric encryption, this system will be faster but it should be
interesting to see if it makes any detrimental impact on the system.
To authenticate the messages HMAC will be used. RFC2104 (1997) describes HMAC
as a mechanism for message authentication using cryptographic hash functions. When
the original event is generated and had its timestamp and user tags added, it will then
go through a process of having a unique HMAC checksum generated for each event.
This will then be tagged onto the end of the event before it gets sent to the Server.
Figure 9 shows this.
………………
……………………
………………
……………………
Figure 9: Client generated XML string
The previous diagram illustrated the event information before it has been passed
through the HMAC checking process, Figure 10 below shows the same event that has
been checked and had its HMAC tags added.
………………
……………………
………………
……………………
…………………
Figure 10: Client XML string with HMAC
Figure 11 shows the event information that has been received by the Data Archiving
System where it has also been time stamped. This is how it will look when it is stored
in the event log on the Data Archiving System.
34