Operation audit method, device, electronic device and computer-readable storage medium

Abstract

The present application discloses an operation audit method, device, system, electronic device and computer-readable storage medium, the method comprising: obtaining the original operation log of the target enterprise, and extracting the elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type; performing hash calculation on the original operation log to obtain the hash value corresponding to the original operation log, and saving the mapping relationship between the original operation log and the hash value; storing the hash value and the elements in the target sub-blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target sub-blockchain network can perform operation audit on the target enterprise; wherein the parent blockchain network includes multiple sub-blockchain networks, and data isolation is performed between each sub-blockchain network. The operation audit method provided by the present application realizes real-time operation audit of enterprises.

Description

Technical Field

[0001] The present application relates to the technical field of operation auditing, and more specifically, to an operation auditing method, device, electronic device, and computer-readable storage medium. Background Art

[0002] At present, regulatory agencies do not have direct technical means to monitor how companies use user personal information internally. Instead, they rely more on companies to conduct internal audits and internal controls. Regulatory agencies determine whether companies are compliant by conducting regular spot checks, audits, and compliance checks on companies. However, there is a large blind spot, namely, the real-time nature of audits of company operations is poor.

[0003] Therefore, how to implement real-time operational auditing of an enterprise is a technical problem that technical personnel in this field need to solve. Summary of the invention

[0004] The purpose of this application is to provide an operation audit method, device, electronic device and computer-readable storage medium to achieve real-time operation audit of an enterprise.

[0005] To achieve the above objectives, the first aspect of the present application provides an operation audit method, comprising:

[0006] Obtaining the original operation log of the target enterprise, and extracting elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type;

[0007] Performing a hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saving a mapping relationship between the original operation log and the hash value;

[0008] The hash value and the elements are stored in the target sub-blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target sub-blockchain network can conduct an operational audit on the target enterprise; wherein the parent blockchain network includes multiple sub-blockchain networks, and data isolation is performed between each of the sub-blockchain networks.

[0009] To achieve the above-mentioned purpose, the second aspect of the present application provides an operation audit device, including:

[0010] An extraction module, used to obtain the original operation log of the target enterprise and extract elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type;

[0011] A calculation module, used for performing hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saving a mapping relationship between the original operation log and the hash value;

[0012] A storage module is used to store the hash value and the elements in a target sub-blockchain network corresponding to the target enterprise in a parent blockchain network, so that the regulatory blockchain node in the target sub-blockchain network can conduct an operational audit on the target enterprise; wherein the parent blockchain network includes multiple sub-blockchain networks, and data isolation is performed between each of the sub-blockchain networks.

[0013] To achieve the above-mentioned purpose, the third aspect of the present application provides an electronic device, including:

[0014] Memory for storing computer programs;

[0015] A processor is used to implement the steps of the above-mentioned operation audit method when executing the computer program.

[0016] To achieve the above objectives, the fourth aspect of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned operation audit method are implemented.

[0017] It can be seen from the above scheme that an operation audit method provided by the present application includes: obtaining the original operation log of the target enterprise, and extracting the elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type; performing hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saving the mapping relationship between the original operation log and the hash value; storing the hash value and the elements in the target child blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target child blockchain network performs an operation audit on the target enterprise; wherein the parent blockchain network includes multiple child blockchain networks, and data isolation is performed between each of the child blockchain networks.

[0018] The operation audit method provided by the present application utilizes the blockchain network to store operation information, that is, the elements extracted from the original operation log and the hash value of the original operation log. In the parent blockchain network, each child blockchain network stores the operation information of an enterprise, and only uploads the hash value to the child blockchain network instead of directly uploading the original operation log to ensure the security of the operation information. Data isolation is performed between each child blockchain network, so that the operation information of different enterprises is isolated from each other in the parent blockchain network, ensuring the security of the operation information of the enterprise. The regulatory agency that conducts operation audit on the target enterprise joins the target child blockchain network corresponding to the target enterprise as a blockchain node, obtains elements from the target child blockchain network in real time for operation audit, and can query the original operation log in the server of the target enterprise based on the hash value stored in the target child blockchain network when necessary. It can be seen that the operation audit method provided by the present application utilizes the shared account book, non-tamperable and timely synchronization characteristics of the blockchain to ensure the timeliness and non-tamperability of the enterprise operation information, break through the system barriers from the enterprise to the regulatory agency, and realize real-time operation audit of the enterprise. The present application also discloses an operation audit device, an electronic device and a computer-readable storage medium, which can also achieve the above technical effects.

[0019] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. The drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific implementation methods, they are used to explain the present disclosure, but do not constitute a limitation to the present disclosure. In the drawings:

[0021] Figure 1 An architectural diagram of an operation audit system provided in an embodiment of the present application;

[0022] Figure 2 A flowchart of an operation audit method provided in an embodiment of the present application;

[0023] Figure 3 A flowchart of another operation audit method provided in an embodiment of the present application;

[0024] Figure 4 A flowchart of another operation audit method provided in an embodiment of the present application;

[0025] Figure 5 A structural diagram of an operation audit device provided in an embodiment of the present application;

[0026] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] In order to facilitate understanding of the operation audit method provided by this application, the system used is introduced below. Figure 1 , which shows an architecture diagram of an operation audit system provided by an embodiment of the present application, such as Figure 1 As shown, it includes the log source 100 of the target enterprise, the server 200 of the target enterprise and the parent blockchain network, and the parent blockchain network includes multiple sub-blockchain networks. Each enterprise corresponds to a sub-blockchain network, that is, a sub-blockchain network is used to store the operation information of an enterprise, and data isolation is performed between each sub-blockchain network, so that the operation information of different enterprises is isolated from each other in the parent blockchain network, ensuring the security of the enterprise's operation information. Among them, the sub-blockchain network corresponding to the target enterprise is the target sub-blockchain network 300.

[0029] The number of log sources is not limited here, that is, the log source 100 may include multiple log sources, and each log source can be understood as a storage device for storing logs, such as a kafka queue or a database, etc. Each log source can maintain an original operation log generated by one system, or can maintain original operation logs generated by multiple systems, which is not specifically limited here, and these original operation logs are collectively referred to as original operation logs in subsequent embodiments.

[0030] Server 200 is a server of an enterprise's internal audit system, which includes multiple log source plug-ins. Multiple log source plug-ins can be stored in server 200 in a clustered manner. Each log source plug-in is used to obtain the original operation log in its corresponding log source and transmit it to server 200. Therefore, as the types of log sources 100 increase, the above cluster can be expanded.

[0031] The server 200 also includes multiple tag extraction plug-ins, which can be stored in the server 200 in a clustered manner. Each tag extraction plug-in is used to extract elements from the original operation log of its corresponding log type. It can be understood that as the log types increase, the cluster storing the above-mentioned tag extraction plug-ins is also an expandable cluster.

[0032] In addition, in order to extract information that is closer to the business, the server 200 may also include multiple element extension plug-ins for extracting the extended fields of each element in the management system corresponding to each element. The management system is used to record the basic information of each element. For example, the subject management system may include an HR system, etc., and the object management system may include a resource management system, etc.

[0033] The target sub-blockchain network 300 includes a regulatory blockchain node 31 for conducting an operation audit on the target enterprise, that is, the regulatory agency uses the regulatory blockchain node 31 to conduct an operation audit on the target enterprise. Of course, the target sub-blockchain network 300 also includes other blockchain nodes. The server 200 can use the blockchain node 32 to store the elements extracted from the original operation log and the hash value corresponding to the original operation log in the target sub-blockchain network 300. The regulatory blockchain node 31 can obtain elements from the target sub-blockchain network 300 for operation audit, and can also obtain hash values ​​from the target sub-blockchain network 300 when necessary, so as to query the original operation log in the server 200 for operation audit.

[0034] The embodiment of the present application discloses an operation audit method to implement real-time operation audit of an enterprise.

[0035] See also Figure 2 , a flowchart of an operation audit method provided in an embodiment of the present application, such as Figure 2 As shown, including:

[0036] S101: The server obtains the original operation log of the target enterprise from the log source;

[0037] In this step, the server obtains the original operation log from the log source. Preferably, this step includes: using the log source plug-in to obtain the original operation log from the log source. The original operation log here can include Internet application logs, instant messaging logs, data block logs, attack / scan logs, file transfer logs, remote control logs and email logs, etc. The Internet application log can include HTTP (Chinese full name: Hypertext Transfer Protocol, English full name: Hyper Text Transfer Protocol) application logs, entertainment software logs and application software usage logs based on C / S (Chinese full name: Client / Server, English full name: Client / Server) architecture, etc. The HTTP application log is a log for monitoring the content information of accessing Internet web pages, recording the keyword information set by the user, the information for HTTPUP and recording all DNS (Chinese full name: Domain Name System, English full name: Domain Name System) protocol requests, and monitoring the content information of accessing Internet web pages includes publishing and browsing based on the HTTP protocol. Instant messaging logs are logs that record the use of various instant messaging software and virtual identity information. Database logs are logs that record the operation of various data blocks and user information. Attack / scan logs are logs that record the behavior of DDOS attacks (Chinese full name: Distributed Denial of Service Attack, English full name: Distributed denial of service attack) and port scanning. File transfer logs include file transfer information performed by various download tools, FTP protocol (Chinese full name: File Transfer Protocol, English full name: File Transfer Protocol), SMB (Chinese full name: Server Message Block, English full name: Server Message Block) protocol, and also include information on point-to-point file transfer and file name of instant messaging software. Remote control logs are logs that record the use of various remote control software or protocols, including TELNET protocol (Chinese full name: Remote Terminal Protocol), WINDOWS Remote Desktop and SSH (Chinese full name: Secure Shell Protocol, English full name: Secure Shell). Email logs are logs that record SMTP protocol (Chinese full name: Simple Mail Transfer Protocol, English full name: Simple Mail Transfer Protocol), POP3 protocol (Chinese full name: Post Office Protocol-Version 3, English full name: Post Office Protocol-Version 3). 3) and the logs of mainstream web mails, including recipients, subjects, CCs, bodies, attachments, etc.

[0038] The server includes multiple log source plug-ins, each log source plug-in is used to obtain the original operation log from a log source, that is, the server uses multiple log source plug-ins to obtain the original operation log from multiple log sources. Specifically, this step may include: using the kafka source plug-in to obtain the original operation log in the kafka queue; and / or, using the data plug-in to obtain the original operation log in the database; and / or, using the reporting interface plug-in to obtain the reported original operation log through the interface.

[0039] In a specific implementation, for the original operation log stored in the Kafka queue, the original operation log can be read to the server through the Kafka source plug-in, and for the original operation log stored in the database, the original operation log can be read from the database through the data plug-in. The server can also include a reporting interface plug-in, which can be used to report the original operation log to the server through the interface.

[0040] The above-mentioned Kafka source plug-in, data plug-in and reporting interface plug-in can be stored in the server in a cluster. As the types of log sources increase, the cluster can be expanded.

[0041] S102: The server extracts elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type;

[0042] Preferably, the step of extracting the elements of the original operation log by the server includes: determining the log type of the original operation log, and extracting the elements of the original operation log using a tag extraction plug-in corresponding to the log type.

[0043] In the above log source plug-in, the original operation log will be marked with basic tags, for example, server indicates which system the original operation log is generated by, service indicates which service interface the original operation log is generated by, these tags can be obtained by the source system of the original operation log or by simply reading and analyzing the original operation log. The server can determine the log type of each original operation log based on the above tags, and the log types here can include structured types, sql types, and text types, etc. Structured log types include json structures, xml structures, etc., which are not specifically limited here.

[0044] The server includes multiple tag extraction plug-ins, each of which is used to extract elements from the original operation log of the corresponding log type, that is, the server uses different tag extraction plug-ins to extract elements of the original operation log of different log types. The elements here can include subject, object, time and operation type, that is, standard elements in this step, and can also include other user-defined elements.

[0045] Multiple tag extraction plug-ins can be stored in the server as a collection, and this collection is extensible. The server can provide a mapping table to indicate which tag extraction plug-in can process the original log of different log types, as shown in Table 1:

[0046] Table 1

[0047] Log Type Tag Extraction Plugin Structured Types Tag Extraction Plugin A sql type Tag Extraction Plugin B Text Type Tag Extraction Plugin C

[0048] It is understandable that the log types of the operation raw logs generated by different service interfaces of the same system may be different. Therefore, for the operation raw logs of the same system, multiple tag extraction plug-ins can be used at the same time to extract elements. Table 1 can be expanded to Table 2:

[0049] Table 2

[0050] server service Log Type Tag Extraction Plugin ServerA Service1 sql type Tag Extraction Plugin B ServerA Service2 Structured Types Tag Extraction Plugin A ServerB Service3 sql type Tag Extraction Plugin B ServerC Service4 Text Type Tag Extraction Plugin C

[0051] Specifically, the step of extracting the elements of the original operation log using the tag extraction plug-in corresponding to the log type may include: performing structured parsing on the original operation log, and extracting the elements of the original operation log from the parsing result; and / or, parsing the SQL statements in the original operation log through the druid library, and extracting the elements of the original operation log from the parsing result; and / or, extracting the elements of the original operation log using regular expressions.

[0052] In a specific implementation, if the log type is a structured type such as json or xml, the structure can be parsed to obtain the various elements of the original operation log. If the log type is an sql type, that is, the original operation log contains an sql statement, the sql statement can be parsed through the druid library to obtain the various elements of the original operation log. Due to the specific tags and keywords in the original operation logs of structured types and sql types, elements can be extracted by identifying tags and keywords. Druid is an open source, distributed, column-stored system suitable for real-time data analysis, which can summarize basic statistical indicators, that is, the elements in this embodiment, which can be represented by a field. If the log type is a text type, regular expressions can be used to obtain the various elements of the original operation log.

[0053] It should be noted that, for the tag extraction plug-in in this step, this embodiment does not specifically limit its implementation method. For example, it can be implemented by Java code or by Python script.

[0054] The original elements of the above-mentioned extracted operation original logs may include standard elements and custom elements. The standard elements are the four elements of operation audit, including subject, object, time and operation type. These four elements can be extracted from each operation original log. These four elements define a standard story / event for each operation original log, that is, what person (subject) did what type of operation on what object at what time. The subject represents the executor of the operation, and the object represents the object on which the operation is actually acted, such as the server host, service, product configuration, etc. The operations are introduced with the following examples:

[0055] (1) The system administrator queries a user's information. In this operation, the subject is the system administrator, the object is the user ID, and the operation type is query;

[0056] (2) The system administrator modifies the configuration of a fund. In this operation, the subject is the system administrator, the object is the fund ID, and the operation type is modification;

[0057] (3) An employee logs into a machine. In this operation, the subject is the employee ID, the object is the machine's IP address, and the operation type is login;

[0058] It should be noted that the object elements in an operation raw log can be multiple and of multiple types. For example, an employee deploys service S on machine A, machine B, and machine C respectively. Then the objects include machine A, machine B, machine C, and service S. There are a total of 4 objects in this operation.

[0059] For the object element, it can be extracted from the parameters in the request message recorded in the original operation log. For example, for the original operation log "the system administrator queries user information through user ID", the user's ID can be extracted from the parameters in the request message as the object. Of course, it can also be extracted from the parameters in the response message recorded in the original operation log. For example, for the original operation log "the system administrator initiated a range query", the response message returned an information list of 10 users, and the IDs of the 10 users in the response message can be used as the object. In other words, this step can include: using the tag extraction plug-in corresponding to the log type to extract the object of the original operation log according to the request message and response message in the original operation log.

[0060] The object elements extracted above, the parameter type at least includes the object type (type) and the object name (name). For example, the object is a user ID, the type is userId, and the name is zhangsan. It should be noted that in order to facilitate the operation audit across multiple log types, for the same object type, the naming needs to be uniformly specified. For example, for system A, the type of user ID is userId, while in system B, the type of user ID is user_account. In this embodiment, it can be unified as userId.

[0061] Of course, in addition to the above standard elements, other elements of concern to the business can be extracted as custom elements in the tag extraction plug-in. For example, for an operation raw log that records the configuration of online activities, you may be additionally concerned about the configured amount, so the amount can be extracted as a custom element. Of course, users can also set other custom elements, which are not specifically limited here.

[0062] Since different systems, or even different operations in the same system, may have different log formats, the elements of the standardized operation original logs can provide data support for subsequent operation audits. For example, for an important user, it is necessary to determine whether anyone has performed operations on him in all systems. After the object element extraction in this step, a unified standard query can be performed on heterogeneous logs to obtain results. Similarly, the subject and operation type have similar meanings, and the time element can understand the time difference of the operation and restore the order of the operation.

[0063] S103: The server performs hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saves a mapping relationship between the original operation log and the hash value;

[0064] In this step, hash calculation is performed on each operation original log to obtain the hash value corresponding to each operation original log. The specific form of the hash value is not limited here, for example, the hash value may include a hash value. The mapping relationship between each operation original log and the hash value is saved in the server. In the subsequent steps, only the hash value of the operation original log is uploaded to the target sub-blockchain network to ensure the security of the operation original log. When the regulatory agency needs the operation original log, it can obtain the hash value from the target sub-blockchain network, and determine the operation original log corresponding to the hash value in the server based on the above mapping relationship.

[0065] S104: The server stores the hash value and the elements in the target child blockchain network corresponding to the target enterprise in the parent blockchain network;

[0066] In this step, the server uploads the hash values ​​of all the original operation logs of the target enterprise and the elements extracted from the original operation logs to the target sub-blockchain network corresponding to the target enterprise in the parent blockchain network. Among them, the parent blockchain network includes multiple sub-blockchain networks, each enterprise corresponds to a sub-blockchain network, that is, a sub-blockchain network is used to store the operation information of an enterprise, and data isolation is performed between each sub-blockchain network, so that the operation information of different enterprises is isolated from each other in the parent blockchain network, ensuring the security of the enterprise's operation information.

[0067] S105: The regulatory blockchain node in the target sub-blockchain network conducts an operational audit on the target enterprise.

[0068] In a specific implementation, the target sub-blockchain network includes a regulatory blockchain node for conducting an operation audit on the target enterprise, that is, the regulatory agency uses the regulatory blockchain node to conduct an operation audit on the target enterprise. The regulatory blockchain node can obtain elements from the target sub-blockchain network for operation audit, and can also obtain hash values ​​from the target sub-blockchain network when necessary, and query the operation original log corresponding to the hash value in the server based on the mapping relationship between the operation original log and the hash value to conduct an operation audit.

[0069] The operation audit method provided in the embodiment of the present application utilizes the blockchain network to store operation information, that is, the elements extracted from the original operation log and the hash value of the original operation log. In the parent blockchain network, each child blockchain network stores the operation information of an enterprise, and only uploads the hash value to the child blockchain network without directly uploading the original operation log to ensure the security of the operation information. Data isolation is performed between each child blockchain network, so that the operation information of different enterprises is isolated from each other in the parent blockchain network, ensuring the security of the operation information of the enterprise. The regulatory agency that conducts operation audit on the target enterprise joins the target child blockchain network corresponding to the target enterprise as a blockchain node, obtains elements from the target child blockchain network in real time for operation audit, and can query the original operation log in the server of the target enterprise based on the hash value stored in the target child blockchain network when necessary. It can be seen from this that the operation audit method provided in the embodiment of the present application utilizes the shared account book, non-tamperable and timely synchronization characteristics of the blockchain to ensure the timeliness and non-tamperability of the enterprise operation information, break through the system barriers from the enterprise to the regulatory agency, and realize real-time operation audit of the enterprise.

[0070] The embodiment of the present application discloses an operation audit method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. This embodiment will be introduced with the server as the execution subject, specifically:

[0071] See also Figure 3, a flowchart of another operation audit method provided by an embodiment of the present application, such as Figure 3 As shown, including:

[0072] S201: Acquire the original operation log of the target enterprise, and extract the elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type;

[0073] S202: Determine sensitive information in the elements, and perform preprocessing operations on the sensitive information; wherein the sensitive information includes user sensitive information and / or system sensitive information of the target enterprise;

[0074] The executor of this embodiment is the server of the enterprise's internal audit system. Before the operation information is uploaded to the target sub-blockchain network, in order to ensure the security of the data, the sensitive information therein needs to be preprocessed. It can be understood that all the contents in the operation information can be divided into user information related to user operations and system information unrelated to user operations, and user information can be divided into user sensitive information and non-user sensitive information. The sensitive information in this step may include the above-mentioned user sensitive information, such as user identity information, etc., and may also include system information unrelated to user operations, that is, system sensitive information of the target enterprise, such as the target enterprise's internal IP address, internal database name, internal system naming, etc.

[0075] The specific preprocessing method is not limited here. It is only necessary to ensure that other devices connected to the target sub-blockchain network will not obtain the plain text of sensitive information. For example, for system sensitive information, the system sensitive information in the elements can be removed, or the system sensitive information can be masked. For user sensitive information, it can be encrypted. The specific encryption method is not limited here, and symmetric encryption or asymmetric encryption can be used. For symmetric encryption, shared keys are distributed between the target enterprise and various regulatory agencies in advance. The target enterprise uses the shared key to encrypt the user sensitive information and upload it to the target sub-blockchain network. The regulatory agency reads the data on the target sub-blockchain network and decrypts it. The advantage of this method is that the encryption and decryption speed is fast. For asymmetric encryption, the public key is assigned to the target enterprise for encryption, and the regulatory agency uses the private key for decryption. The advantage of this method is that the private key is not easy to leak and has higher security.

[0076] S203: performing hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saving a mapping relationship between the original operation log and the hash value;

[0077] In this step, hash calculation is performed on each operation original log to obtain the hash value corresponding to each operation original log. The specific form of the hash value is not limited here, for example, the hash value may include a hash value. The mapping relationship between each operation original log and the hash value is saved in the server. In the subsequent steps, only the hash value of the operation original log is uploaded to the target sub-blockchain network to ensure the security of the operation original log. When the regulatory agency needs the operation original log, it can obtain the hash value from the target sub-blockchain network, and determine the operation original log corresponding to the hash value in the server based on the above mapping relationship.

[0078] S204: Store the hash value and pre-processed elements in the target sub-blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target sub-blockchain network can perform an operational audit on the target enterprise; wherein, the parent blockchain network includes multiple sub-blockchain networks, and data isolation is performed between each of the sub-blockchain networks.

[0079] In this step, the server uploads the hash values ​​of all the original operation logs of the target enterprise and the elements extracted from the original operation logs to the target sub-blockchain network corresponding to the target enterprise in the parent blockchain network, and uses the shared ledger, non-tamperability and timely synchronization characteristics of the blockchain to ensure the timeliness and non-tamperability of the enterprise's operation information. The target sub-blockchain network includes a regulatory blockchain node for conducting operational audits on the target enterprise, that is, the regulatory agency uses the regulatory blockchain node to conduct operational audits on the target enterprise. The regulatory blockchain node can obtain elements from the target sub-blockchain network for operational audits, and can also obtain hash values ​​from the target sub-blockchain network when necessary. The server queries the original operation log corresponding to the hash value based on the mapping relationship between the original operation log and the hash value to conduct operational audits.

[0080] It can be seen that the operation audit method provided in this embodiment isolates data between sub-blockchain networks corresponding to different enterprises, and the security of enterprise data is relatively high. In the sub-blockchain network, only the hash value of the original operation log is uploaded, and the original operation log is not uploaded, so as to ensure the security of the original operation log of the enterprise. Pre-processing is performed on the sensitive information to be uploaded to the chain to ensure that other devices connected to the sub-blockchain network will not obtain the plain text of sensitive information, which is relatively safe.

[0081] The embodiment of the present application discloses an operation audit method. Compared with the first embodiment, this embodiment further explains and optimizes the technical solution. This embodiment will be introduced with the server as the execution subject, specifically:

[0082] See also Figure 4 , a flowchart of another operation audit method provided in an embodiment of the present application, such as Figure 4 As shown, including:

[0083] S301: Acquire the original operation log of the target enterprise, and extract the elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type;

[0084] S302: Obtaining an element extension standard from the regulatory blockchain node, and determining an extension field corresponding to each element based on the element extension standard;

[0085] In this step, the regulatory agency defines the extension fields that must be extended for each element, that is, defines the element extension standard, and publishes it to the entire target sub-blockchain network through the regulatory blockchain node. The server determines the extension field corresponding to each element based on the element extension standard. In element extension, the same extension plug-in can be used for heterogeneous logs from different sources, and each extension plug-in is distinguished according to the difference of the element. The extension plug-in can be used to expand the original operation log with more very important and business-related tags, so that the operation audit supports more powerful standardized auditing.

[0086] In a specific implementation, the subject tag extension plug-in extracts basic information by calling the subject management system. The subject management system here may include the company's HR system or organizational structure system, depending on the differences in the IT systems of each company. For example, the real identity of the subject can be extended, including the real name, ID card or equivalent identity proof, and the position of the subject in the company, the contracting unit, etc. can also be extended. The object tag extension plug-in extracts basic information by calling the object management system. The object management system here is, for example, the company's resource management system, depending on the differences in the IT systems of each company. For example, the real identity of the object can be extended, including the real name, ID card or equivalent identity proof, and the attributes of the object can also be extended. For example, when the fund information purchased by the user is queried by internal employees, relevant regulations should be formulated to expand the relevant attributes of this fund and fill in the extension field.

[0087] Preferably, the extended field of the operation type includes a category; the determining of the extended field corresponding to each of the elements based on the element extension standard includes: obtaining the operation type classification standard from the regulatory blockchain node, and determining the category of the operation type based on the operation type classification standard. In a specific implementation, servers of different companies define different URL names or interface names for operation types, which is too poorly readable for regulatory agencies. Therefore, regulatory agencies can define operation type classification standards that are convenient for auditing, and the server establishes a corresponding relationship between each supported operation type and category. For example, the category corresponding to " / api / fk_frozen" is "risk control-frozen funds". For operation types that cannot be classified, Chinese annotation tags can be added.

[0088] S303: Determine the operation summary field of the original operation log based on the standard reporting format according to each of the elements and the extended fields corresponding to each of the elements;

[0089] In a specific implementation, the server adds the extracted elements to a standard reporting format, where the standard reporting format is, for example:

[0090]

[0091]

[0092] It can be understood that "user" is the subject, "operation_type" is the operation type, "timestamp" is the time, and "object" is the object. If the elements extracted in the previous step also include custom elements, other operation summary fields can be assigned to the custom elements in the standard reporting format. In the target sub-blockchain network, the elements extracted from the original operation log are stored based on the standard reporting format, that is, each element is standardized, and the regulatory agency audits the operation information in a unified format, which is more efficient.

[0093] S304: Store the hash value and the operation summary field in the target child blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target child blockchain network can perform an operation audit on the target enterprise; wherein the parent blockchain network includes multiple child blockchain networks, and data isolation is performed between each of the child blockchain networks.

[0094] It can be seen that the operation audit method provided in this embodiment extracts unified element tags from the unformatted operation original logs collected from various systems, so that originally completely different operation original logs can use the same method to query key information, and through element extension, more very important and business-related extended information is expanded for each element based on the element extension standards defined by the regulatory agency, thereby improving the efficiency of operation auditing.

[0095] For ease of understanding, this application is introduced in conjunction with an application scenario of the present application. Figure 1 , the nodes of the target sub-blockchain network 300 include enterprise A and its affiliated enterprises, departments and multiple regulatory agencies. Different blockchain sub-networks perform data isolation so that the data of different enterprises can be isolated from each other.

[0096] The blockchain nodes of each subsidiary and department of Enterprise A collect the original operation logs through the audit system built within the enterprise. The audit system extracts four elements of information, namely subject, object, operation type and time, and expands the four elements. When expanding the four elements, it is required to expand the required fields required by the regulatory agency. The subject must expand its real identity, position in the company, contract unit, etc. The object must expand its real identity, attributes, etc. For the operation type, it is necessary to add a category identifier according to the operation type classification standard defined by the regulatory agency, and for the operation type that cannot be classified, it is necessary to add a Chinese annotation mark.

[0097] The original operation log is hashed, and only the hash value of the original operation log is uploaded to the target sub-blockchain network 300. The internal audit system of the enterprise should retain the mapping relationship between the original operation log and the hash value. When the regulatory agency requires a query, the corresponding original operation log can be queried through the hash value.

[0098] Among the extracted elements, the internal system information of the enterprise that is not related to the user operation is removed or masked to prevent the leakage of enterprise-related information. User sensitive information is encrypted. The hash value of all the original operation logs of enterprise A and the elements extracted from the original operation logs and processed as above are uploaded to the target sub-blockchain network 300. The regulatory agency can obtain elements from the target sub-blockchain network 300 for operation audit, and can also obtain hash values ​​from the target sub-blockchain network when necessary, and query the original operation log corresponding to the hash value in the server based on the mapping relationship between the original operation log and the hash value to conduct operation audit.

[0099] An operation audit device provided in an embodiment of the present application is introduced below. The operation audit device described below and the operation audit method described above can be referenced to each other.

[0100] See also Figure 5 , a structural diagram of an operation audit device provided in an embodiment of the present application, such as Figure 5 As shown, including:

[0101] The extraction module 501 is used to obtain the original operation log of the target enterprise and extract the elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type;

[0102] The calculation module 502 is used to perform hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and save a mapping relationship between the original operation log and the hash value;

[0103] The storage module 503 is used to store the hash value and the elements in the target sub-blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target sub-blockchain network can perform an operational audit on the target enterprise; wherein the parent blockchain network includes multiple sub-blockchain networks, and data isolation is performed between each of the sub-blockchain networks.

[0104] The operation audit device provided in the embodiment of the present application utilizes the blockchain network to store operation information, that is, the elements extracted from the original operation log and the hash value of the original operation log. In the parent blockchain network, each child blockchain network stores the operation information of an enterprise, and only uploads the hash value to the child blockchain network without directly uploading the original operation log to ensure the security of the operation information. Data isolation is performed between each child blockchain network, so that the operation information of different enterprises is isolated from each other in the parent blockchain network, ensuring the security of the operation information of the enterprise. The regulatory agency that conducts operation audit on the target enterprise joins the target child blockchain network corresponding to the target enterprise as a blockchain node, obtains elements from the target child blockchain network in real time for operation audit, and can query the original operation log in the server of the target enterprise based on the hash value stored in the target child blockchain network when necessary. It can be seen from this that the operation audit device provided in the embodiment of the present application utilizes the shared account book, non-tamperable and timely synchronization characteristics of the blockchain to ensure the timeliness and non-tamperability of the enterprise operation information, break through the system barriers from the enterprise to the regulatory agency, and realize real-time operation audit of the enterprise.

[0105] Based on the above embodiment, as a preferred implementation, it also includes:

[0106] A preprocessing module is used to determine sensitive information in the elements and perform preprocessing operations on the sensitive information; wherein the sensitive information includes user sensitive information and / or system sensitive information of the target enterprise.

[0107] Based on the above embodiments, as a preferred implementation mode, the pre-processing module is specifically a module for removing the system sensitive information in the elements or performing masking processing on the system sensitive information.

[0108] Based on the above embodiment, as a preferred implementation mode, the pre-processing module is specifically a module for encrypting the user sensitive information.

[0109] Based on the above embodiment, as a preferred implementation, the storage module 503 includes:

[0110] A first determining unit, configured to determine an operation summary field of the operation original log based on the elements and in a standard reporting format;

[0111] A storage unit is used to store the hash value and the operation summary field in a target child blockchain network corresponding to the target enterprise in the parent blockchain network.

[0112] Based on the above embodiment, as a preferred implementation, it also includes:

[0113] A determination module, used to obtain an element extension standard from the regulatory blockchain node, and determine an extension field corresponding to each element based on the element extension standard;

[0114] Correspondingly, the first determining unit is specifically a unit that determines the operation summary field of the original operation log based on a standard reporting format according to each of the elements and the extended field corresponding to each of the elements.

[0115] Based on the above embodiment, as a preferred implementation manner, the extended field of the operation type includes a category; and the determination module includes:

[0116] The second determination unit is used to obtain the operation type classification standard from the regulatory blockchain node, and determine the category of the operation type based on the operation type classification standard.

[0117] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0118] The present application also provides an electronic device, see Figure 6 , a structural diagram of an electronic device 60 provided in an embodiment of the present application, such as Figure 6 As shown, a processor 61 and a memory 62 may be included.

[0119] Among them, the processor 61 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 61 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 61 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 61 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 61 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0120] The memory 62 may include one or more computer-readable storage media, which may be non-transitory. The memory 62 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 62 is at least used to store the following computer program 621, wherein, after the computer program is loaded and executed by the processor 61, it can implement the relevant steps in the operation audit method performed by the electronic device side disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 62 may also include an operating system 622 and data 623, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 622 may include Windows, Unix, Linux, etc.

[0121] In some embodiments, the electronic device 60 may further include a display screen 63 , an input / output interface 64 , a communication interface 65 , a sensor 66 , a power supply 67 , and a communication bus 68 .

[0122] certainly, Figure 6 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 6 More or fewer components than shown, or combinations of certain components.

[0123] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided. When the program instructions are executed by a processor, the steps of the operation audit method executed by the server in any of the above embodiments are implemented.

[0124] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

[0125] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. An operation audit method, characterized in that: include: Obtaining the original operation log of the target enterprise, and extracting elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type; Performing a hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saving a mapping relationship between the original operation log and the hash value; Obtaining an element extension standard from a regulatory blockchain node in the target sub-blockchain network, and determining an extension field corresponding to each element based on the element extension standard; Determine the operation summary field of the original operation log based on a standard reporting format according to each of the elements and the extended fields corresponding to each of the elements; The hash value and the operation summary field are stored in the target child blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node can perform an operation audit on the target enterprise; wherein the parent blockchain network includes multiple child blockchain networks, each of which is data isolated, and each child blockchain network is used to store the operation information of an enterprise.

2. The operation audit method according to claim 1, characterized in that: After extracting the elements of the original operation log, the method further includes: Sensitive information is determined in the elements, and a preprocessing operation is performed on the sensitive information; wherein the sensitive information includes user sensitive information and / or system sensitive information of the target enterprise.

3. The operation audit method according to claim 2, characterized in that: Preprocessing the sensitive information includes: The system sensitive information in the element is removed or the system sensitive information is masked.

4. The operation audit method according to claim 2, characterized in that: Preprocessing the sensitive information includes: The user sensitive information is encrypted.

5. The operation audit method according to claim 1, characterized in that: The extended field of the operation type includes a category; the determining the extended field corresponding to each element based on the element extension standard includes: An operation type classification standard is obtained from the regulatory blockchain node, and a category of the operation type is determined based on the operation type classification standard.

6. An operation audit device, characterized in that: include: An extraction module, used to obtain the original operation log of the target enterprise and extract elements of the original operation log; wherein the elements include standard elements and custom elements, and the standard elements include subject, object, time and operation type; A calculation module, used for performing hash calculation on the original operation log to obtain a hash value corresponding to the original operation log, and saving a mapping relationship between the original operation log and the hash value; A storage module, used to store the hash value and the elements in a target sub-blockchain network corresponding to the target enterprise in the parent blockchain network, so that the regulatory blockchain node in the target sub-blockchain network can perform an operation audit on the target enterprise; wherein the parent blockchain network includes multiple sub-blockchain networks, each of which is data isolated, and each sub-blockchain network is used to store the operation information of an enterprise; The storage module comprises: A first determining unit, configured to determine an operation summary field of the operation original log based on the elements and in a standard reporting format; A storage unit, used to store the hash value and the operation summary field in a target child blockchain network corresponding to the target enterprise in the parent blockchain network; The device also includes: a determination module, configured to obtain an element extension standard from the regulatory blockchain node, and determine an extension field corresponding to each element based on the element extension standard; Correspondingly, the first determining unit is specifically a unit that determines the operation summary field of the original operation log based on a standard reporting format according to each of the elements and the extended field corresponding to each of the elements.

7. The device according to claim 6, characterized in that Also includes: A preprocessing module is used to determine sensitive information in the elements and perform preprocessing operations on the sensitive information; wherein the sensitive information includes user sensitive information and / or system sensitive information of the target enterprise.

8. The device according to claim 7, characterized in that The pre-processing module is specifically a module for removing the system sensitive information in the elements or performing masking processing on the system sensitive information.

9. The device according to claim 7, characterized in that The pre-processing module is specifically a module that performs encryption processing on the user sensitive information.

10. The device according to claim 6, characterized in that The extended field of the operation type includes a category; the determination module includes: The second determination unit is used to obtain an operation type classification standard from the regulatory blockchain node, and determine the category of the operation type based on the operation type classification standard.

11. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the operation audit method as claimed in any one of claims 1 to 5 when executing the computer program.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the operation audit method according to any one of claims 1 to 5.

Images