A framework for verifying the integrity of IoT logs and tracing tampering based on deterministic Merkle trees

Abstract

In IoT scenarios such as industrial gateways, park security, vehicle terminals, and medical monitoring, logs are often the first materials retrieved for fault recovery and security evidence, but they are not naturally reliable. Device disconnection, gateway caching, platform script misoperation, and even intruders who obtain maintenance privileges may cause record loss, rewriting, disorder, or field rewriting. This article proposes an IoT log integrity verification and tamper tracing framework based on deterministic Merkle trees to address this issue. The framework first converts heterogeneous logs into recalcitrable canonical objects, and then establishes an evidence chain using leaf hashing, batch root hashing, external anchoring, and audit paths. The article further presents the collaborative process of devices, gateways, platforms, and audit nodes, discussing inclusion verification, consistency verification, anomaly localization, and responsibility boundary division. The research believes that this method does not need to publicly link all logs, which can improve the credibility of logs with lower storage and transmission costs, and provide an executable solution for the safe operation and post investigation of the Internet of Things.