A Centralized Safe and Trustworthy Auditing Method

Abstract

The present invention discloses a non-center safe and trusted auditing method, which includes: Step 1: Initialize the management terminal, and the management terminal forms a group of interrelated peers through strategies through several management terminal nodes; Step 2: For authentication and registration, the audited object registers the audit object information and administrator information to the management end, and the management end returns the anonymous identity and key information of the audited object and the administrator through the internal negotiation mechanism. The audited object includes audit terminals, network Device and user administrator; step 3: report the log, the audit terminal and network device encrypt the audit information with a key, calculate the summary value, and report it to the management terminal together with the identification information; step 4: store the log, the management terminal receives After the log is reported, it is synchronously backed up to each peer management end node for redundant backup and subsequent verification of tampering; Step 5: Perform log retrieval, and the registered administrator retrieves from the management end through the log retrieval function. Corresponding audit data; Step 6: Perform log audit, including legal access behavior audit and illegal behavior audit.

Description

technical field [0001] The invention belongs to the technical field of safety audit, and is a centerless safe and credible audit system. Background technique [0002] With the development of information technology, organizations such as enterprises and institutions have deployed auditing software for internal network security needs, which are used to centrally manage and audit internal network security equipment and security events generated by users' daily access, so as to monitor the overall security situation of the internal network . [0003] figure 1 Shown is the module diagram of the existing audit system, such as figure 1 As shown, the main function of the existing security audit software is to collect and analyze security events generated by security devices and various user access behaviors. Behaviors and remote access behaviors, network devices are responsible for auditing network security events and network access behaviors generated by users. The audit termin...

AI Technical Summary

Problems solved by technology

[0007] Because the operation and maintenance personnel of the management side of the centralized management mode know the database access password, they can directly access the database, modify the database, and delete the records of certain malicious behaviors, which cannot be audited

Images