Log information processing method and device, electronic equipment and storage medium

Abstract

The application provides a log information processing method and device, electronic equipment and a storage medium. The method comprises the following steps: obtaining first log information, and obtaining a second hash chain value of second log information, the second log information being the previous log information of the first log information; performing a hash operation on the first log information and the second hash chain value based on a preset hash algorithm to obtain a first hash chain value of the first log information; and determining target log information corresponding to the first log information according to the first log information and the first hash chain value. The application can prevent log information from being maliciously tampered with or deleted, monitor the change of the first log information according to the first hash chain value in the target log information, and improve the security of the log information.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a log information processing method and device, electronic equipment and storage medium. BACKGROUND

[0002] Recording log is an important function of information system, which can record relevant processing behaviors of information system, so as to facilitate subsequent system behavior analysis, such as identifying attack behaviors, abnormal access behaviors, error login behaviors, responsibility identification and normal business behaviors of system. Generally, system log records are stored in system, database or log server, and distributed storage or disk redundancy technology is used to store log information. However, since the log records are not protected by cryptographic technology during storage, there is a risk of tampering, deletion and denial. Therefore, the current log record has the problem of low security. SUMMARY

[0003] The embodiments of the present application aim to provide a log information processing method and device, electronic equipment and storage medium, and solve the problem of low security of current log record.

[0004] In a first aspect, the embodiments of the present application provide a log information processing method, comprising:

[0005] obtaining first log information, and obtaining a second hash chain value of second log information, the second log information being the previous log information of the first log information;

[0006] performing hash operation on the first log information and the second hash chain value based on a preset hash algorithm, to obtain a first hash chain value of the first log information;

[0007] determining target log information corresponding to the first log information according to the first log information and the first hash chain value.

[0008] In the embodiments, the first hash chain value of the first log information is obtained by performing hash operation on the first log information and the second hash chain value, so as to record the correlation between the current log information and the previous log information by using the hash chain value. In this way, all log information is associated, so that any subsequent record can be detected when any previous record is changed, thereby preventing log information from being maliciously tampered or deleted. Finally, the target log information corresponding to the first log information is determined according to the first log information and the first hash chain value, so as to monitor the change of the first log information according to the first hash chain value in the target log information, and improve the security of the log information.

[0009] In one implementation, the first log information is obtained, comprising:

[0010] obtaining a log record and a first record number of the log record;

[0011] splicing the log record and the first record number to obtain first log information.

[0012] In the implementation process, each log record corresponds to a unique first record number, and the log record and the first record number are spliced, so that the first record number can be used as a unique identifier of the log record, facilitating subsequent association of all log records, and the continuity of the first record numbers of all log information can be checked to check whether the log record is deleted, facilitating subsequent system audit.

[0013] In an implementation manner, before determining the target log information corresponding to the first log information according to the first log information and the first hash chain value, the method further includes:

[0014] performing hash operation on the first log information based on a hash algorithm to obtain a first hash value of the first log information;

[0015] performing signature on the first hash value based on a signature algorithm and a preset signature certificate to obtain a first signature value of the first log information;

[0016] composing the signature algorithm, the signature certificate and the first signature value into signature data;

[0017] determining the target log information corresponding to the first log information according to the first log information and the first hash chain value, includes:

[0018] determining the target log information corresponding to the first log information according to the first log information, the signature data and the first hash chain value.

[0019] In the implementation process, the first hash value of the first log information is calculated, so that the first log information is signed and processed by using the first hash value in the subsequent process, and the first hash value is signed by using the signature algorithm and the signature certificate, so that the operator can be identified according to the signature certificate, to prevent the operator from denying the operation behavior.

[0020] In an implementation manner, the first hash chain value of the first log information is obtained by performing hash operation on the first log information and a second hash chain value based on a preset hash algorithm, including:

[0021] splicing the first log information and the second hash chain value to obtain a target string;

[0022] performing hash operation on the target string based on the hash algorithm to obtain the hash chain value.

[0023] In the implementation process, the first log information is concatenated with the second hash chain value and then subjected to a hash operation, so as to associate the first log information with the previous log information, and form a hash chain of all log information, facilitating subsequent system inspection.

[0024] In an implementation, the target log information corresponding to the first log information is determined according to the first log information and the first hash chain value, including:

[0025] The first log information and the first hash chain value are signed based on a signature algorithm to obtain a second signature value;

[0026] The first log information, the first hash chain value and the second signature value are taken as the target log information.

[0027] In the implementation process, for a business system with a high security requirement level, the first log information and the first hash chain value can be signed to calculate a system signature value, further improving the security of the log information.

[0028] In an implementation, after the target log information corresponding to the first log information is determined according to the first log information and the first hash chain value, the method further includes:

[0029] A third hash chain value of the first log information is calculated according to the first log information in the target log information;

[0030] It is determined whether the third hash chain value is equal to the first hash chain value;

[0031] If the third hash chain value is not equal to the first hash chain value, it is determined that the first log information has a change or a hash chain value of a previous log information corresponding to the first log information has a change.

[0032] In the implementation process, the first log information is extracted again based on the target log information, and the third hash chain value calculated from the first log information is compared with the first hash chain value in the target log information to determine the change of the first log information or the change of the hash chain value of the previous log information, so as to realize change verification of the log information and facilitate system audit.

[0033] In an implementation, after the target log information corresponding to the first log information is determined according to the first log information and the first hash chain value, the method further includes:

[0034] A second record number of the second log information is obtained;

[0035] It is determined whether a first record number of the first log information in the target log information is equal to a sum of the second record number and 1;

[0036] If the first record number is not equal to the sum of the second record number and 1, it is determined that the log record in the first log information has a change.

[0037] In the implementation process, the change of the first log information is determined by comparing the first record number of the first log information with the second record number of the second log information, so as to facilitate system auditing.

[0038] In a second aspect, an embodiment of the present application provides a log information processing apparatus, comprising:

[0039] The first obtaining module is configured to obtain the first log information and obtain a second hash chain value of the second log information, the second log information being the previous log information of the first log information.

[0040] The operation module is configured to perform hash operation on the first log information and the second hash chain value based on a preset hash algorithm, to obtain a first hash chain value of the first log information.

[0041] The first determining module is configured to determine the target log information corresponding to the first log information according to the first log information and the first hash chain value.

[0042] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor, the memory is configured to store a computer program, and the processor is configured to run the computer program to enable the electronic device to execute the log information processing method of the first aspect.

[0043] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the log information processing method of the first aspect.

[0044] It can be understood that the beneficial effects of the above-mentioned second aspect to fourth aspect can be referred to the related description of the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation to the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0046] Figure 1 The flowchart of the log information processing method provided by an embodiment of the present application is shown in the figure.

[0047] Figure 2 The flowchart of the log information processing method provided by another embodiment of the present application is shown in the figure.

[0048] Figure 3 A flowchart illustrating a log information processing method provided in another embodiment of this application;

[0049] Figure 4 This is a schematic diagram of the structure of the log information processing device provided in the embodiments of this application;

[0050] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0051] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0052] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0053] As described in the background section, log records are not protected by cryptographic techniques during storage, so they are at risk of being tampered with, deleted, or repudulated. This shows that log records have low security.

[0054] To address the problems in the prior art, this application provides a method for processing log information. By performing a hash operation on first log information and a second hash chain value, a first hash chain value for the first log information is obtained. This hash chain value is used to record the correlation between the current log information and the previous log information. This method links all log information together, ensuring that any change in a previous record can be detected in any subsequent record, thus preventing malicious tampering or deletion of log information. Finally, based on the first log information and the first hash chain value, the target log information corresponding to the first log information is determined. This allows monitoring of changes to the first log information based on the first hash chain value in the target log information, improving the security of the log information.

[0055] See Figure 1 , Figure 1 This document illustrates a flowchart of a log information processing method provided in an embodiment of this application. The log information processing method described below in this embodiment can be applied to electronic devices, including but not limited to smartphones, tablets, desktop computers, supercomputers, personal digital assistants, physical servers, and cloud servers. The log information processing method of this embodiment includes steps S101 to S103, detailed below:

[0056] In step S101, the first log information is obtained, and a second hash chain value of the second log information, which is the previous log information of the first log information, is obtained.

[0057] In the embodiment, the first log information is log information of a system log, which includes log records. Optionally, the log information further includes record numbers, and each log record corresponds to a record number. The second hash chain value is a hash chain value obtained by performing a hash operation on the second log information and a hash chain value of the previous log information of the second log information.

[0058] Optionally, obtaining the first log information includes: obtaining a log record and a first record number of the log record; and splicing the log record and the first record number to obtain the first log information. The log record includes, but is not limited to, a log operator, a log object, an operation result, an operation time, and other operation information.

[0059] For example, a counter is preset, the counter maintains a one-way increasing sequence, and the count value of the counter is increased by 1 when other computer components / units / modules collect data from the counter once. Therefore, when a log record is generated in the system, the current count value of the counter is collected, and the count value of the counter is increased by 1 after being collected, to be used as the record number of the next log record.

[0060] In the embodiment, the log record and the first record number are spliced, which can use the first record number as the unique identifier of the current log record, to facilitate subsequent association of all log records, and can check whether the log record is deleted or tampered with according to the continuity of the first record numbers of all log information, to facilitate subsequent system audit.

[0061] In step S102, a hash operation is performed on the first log information and the second hash chain value based on a preset hash algorithm, to obtain a first hash chain value of the first log information.

[0062] In the embodiment, the hash algorithm is a hash function, which can convert an input message string of an arbitrary length into an output string of a fixed length. The hash chain value is a hash value obtained by performing a hash operation on the log information and a hash chain value of the previous log information, which is essentially a hash value, but the hash value contains hash values of other log information, so it is regarded as a hash chain.

[0063] It should be noted that for the first log information, there is no previous log information, so a value can be set as an initial hash chain value, or the initial hash chain value can be obtained by other ways for the hash operation of the hash chain value of the first log information. Exemplarily, the record number 0 and the operation time of the operation of the first log information are spliced into an input string, and then the hash result of the input string is calculated by using the hash algorithm, and the obtained hash result is taken as the initial hash chain value.

[0064] In an embodiment, the hash value of the first log information can be calculated separately, and then the hash value and the second hash chain value are spliced into an input string, and the hash operation is performed again to obtain the first hash chain value.

[0065] In another embodiment, based on the preset hash algorithm, the first log information and the second hash chain value are subjected to the hash operation to obtain the first hash chain value of the first log information, including: splicing the first log information and the second hash chain value to obtain a target string; and performing the hash operation on the target string based on the hash algorithm to obtain the hash chain value.

[0066] In the embodiment, the first log information and the second hash chain value are directly spliced and subjected to the hash operation, so that the step of separately performing the hash operation on the first log information is reduced, the operation steps are simplified, and meanwhile the first log information can be associated with the previous log information, so that all the log information forms a hash chain, thereby facilitating the subsequent system check.

[0067] In step S103, the target log information corresponding to the first log information is determined according to the first log information and the first hash chain value.

[0068] In the embodiment, the target log information is the log information finally stored in the log storage system (such as a log database, a log server, etc.). Alternatively, for a business system with a lower security requirement level, the first log information and the first hash chain value can be directly spliced as the target log information.

[0069] Alternatively, for a business system with a higher security requirement level, the first log information and the first hash chain value can be signed based on a signature algorithm to obtain a second signature value; and the first log information, the first hash chain value and the second signature value are taken as the target log information. In the implementation process, the first log information and the first hash chain value are signed to calculate the system signature value, thereby further improving the security of the log information.

[0070] In Figure 1 Based on the embodiments, Figure 2 An implementation flowchart of a log information processing method provided by another embodiment is shown. As shown in FIG. 6, the method includes the following steps. Figure 2As shown, step S103 is preceded by step S201. It should be noted that step S201 is optional and can be omitted. Figure 1 The same steps as in the embodiment are not repeated here.

[0071] At S201, the first log information is signed based on a preset signature algorithm to obtain signature data of the first log information.

[0072] In this embodiment, the signature algorithm is a digital signature algorithm, which is a one-way function that processes the information to be transmitted to obtain an alphanumeric string for authenticating the source of the information and verifying whether the information has changed during transmission. The signature algorithm can be an RSA signature algorithm or an SM2 signature algorithm. The signature data includes but is not limited to the first log information, the signature algorithm, and a signature value obtained by signing the first log information using the signature algorithm.

[0073] In an embodiment, the first log information can be directly signed using the signature algorithm to obtain a signature value, and the first log information, the signature algorithm, and the signature value can be combined to form the signature data.

[0074] In another embodiment, the first log information can be subjected to a hash operation based on a hash algorithm to obtain a first hash value of the first log information; the first hash value can be signed based on the signature algorithm and a preset signature certificate to obtain a first signature value of the first log information; and the signature algorithm, the signature certificate, and the first signature value can be combined to form the signature data.

[0075] In this embodiment, the first log information is a string, which is converted into a fixed-length first hash value according to a hash function to facilitate subsequent processing operations such as signing the first log information using the first hash value. The first hash value is signed using the signature algorithm and the signature certificate, so that the operator can be identified based on the signature certificate to prevent the operator from denying his / her operation. Finally, the signature value, the signature algorithm, and the signature certificate can be packaged as the signature data.

[0076] In one possible implementation, after step S103, the following steps are further included: based on the first log information in the target log information, a second hash value of the first log information is calculated, the first signature value in the signature data is verified using the second hash value, the above-mentioned signature algorithm, and the signature certificate, and if the verification fails, it is determined that the first log information has been changed.

[0077] In the implementation process, the target log information is acquired from the log storage system, the first log information in the target log information is extracted, and the second hash value is calculated in the manner of step S201. Since the hash algorithm, the signature algorithm, and the signature certificate used in the implementation process are the same as those in step S201, the first signature value can be verified by using the second hash value, the signature algorithm, and the signature certificate. When the signature verification is passed, it indicates that the log information has not been changed. When the signature verification is not passed, it indicates that the log information has been changed, for example, the log record has been modified.

[0078] In Figure 1 Based on the embodiment, Figure 3 An implementation flowchart of a log information processing method provided by still another embodiment is shown. As Figure 3 shown, steps S301 to S303 are further included after step S103. It should be noted that the same steps as those in the Figure 1 embodiment will not be described herein.

[0079] In step S301, the third hash chain value of the first log information is calculated according to the first log information in the target log information.

[0080] In the embodiment, the target log information is acquired from the log storage system, the first log information in the target log information is extracted, and the third hash chain value of the first log information is calculated in the manner of step S103 based on the hash algorithm.

[0081] In step S302, it is determined whether the third hash chain value is equal to the first hash chain value.

[0082] In the embodiment, the third hash chain value is compared with the first hash chain value in the target log information to verify the change of the target log information, thereby facilitating system audit and other system checks.

[0083] In step S303, if the second hash chain value is not equal to the first hash chain value, it is determined that the first log information has a change or the hash chain value of the previous log information corresponding to the first log information has a change.

[0084] In the embodiment, since the hash algorithm and the algorithm input in S301 are the same as those in S102, the hash results of the two should be the same, i.e., the third hash chain value is equal to the first hash chain value, and the verification is successful. Then, the hash chain values of each log information are verified in sequence. If the hash chain values of all log information are verified successfully, it indicates that the log information has not been changed. If the third hash chain value is not equal to the first hash chain value, it indicates that the current log information or other log information has been changed, for example, a log record is deleted.

[0085] In an embodiment, after determining the target log information corresponding to the first log information according to the first log information and the first hash chain value, the method further comprises: obtaining a second record number of the second log information, determining whether the first record number of the first log information in the target log information is equal to the sum of the second record number and 1, and determining that the log record in the first log information has a change if the first record number is not equal to the sum of the second record number and 1.

[0086] In the embodiment, the record number of the current log record is m, the record number of the previous log record is x, it is verified whether m=x+1, if not, the verification fails, if yes, the record number of the previous log record is verified in turn until the record number of the first log record also satisfies the above formula, then the verification passes. If a discontinuous case occurs in the middle, it indicates that the record has been changed, resulting in the verification failure. For example, the record numbers of four consecutive log records are 1, 2, 2, and 4 in sequence, which indicates that the log record with the record number of 3 has been tampered with. If all the records are continuous, it indicates that the log information has not been deleted. The embodiment compares the first record number of the first log information with the second record number of the second log information to determine the change of the first log information, facilitating system auditing.

[0087] In order to perform the method corresponding to the above-mentioned method embodiment to achieve the corresponding functions and technical effects, a log information processing apparatus is provided below. Referring to Figure 4 , Figure 4 is a structural block diagram of a log information processing apparatus provided by an embodiment of the present application. In the embodiment, each module of the apparatus is used to perform Figures 1 to 3 each step in the corresponding embodiment, and specific reference is made to the related description in the Figures 1 to 3 and Figures 1 to 3 corresponding embodiments. For ease of illustration, only the parts related to the embodiment are shown, and the log information processing apparatus provided by the embodiment of the present application comprises:

[0088] The first obtaining module 401 is configured to obtain the first log information and obtain a second hash chain value of the second log information, the second log information being the previous log information of the first log information.

[0089] The operation module 402 is configured to perform hash operation on the first log information and the second hash chain value based on a preset hash algorithm to obtain a first hash chain value of the first log information, the second hash chain value being a hash chain value of the second log information, the second log information being the previous log information of the first log information.

[0090] The first determining module 403 is configured to determine target log information corresponding to the first log information according to the first log information and the first hash chain value.

[0091] In an embodiment, the obtaining module 401 comprises:

[0092] an obtaining unit configured to obtain the log record and a first record number of the log record;

[0093] a first concatenating unit configured to concatenate the log record and the first record number to obtain first log information.

[0094] In an embodiment, the apparatus further comprises:

[0095] a signing module configured to sign the first log information based on a preset signing algorithm to obtain signature data of the first log information;

[0096] The first determining module 403 is further configured to determine target log information corresponding to the first log information according to the first log information, the signature data, and the first hash chain value.

[0097] In an embodiment, the signing module comprises:

[0098] a first operation unit configured to perform hash operation on the first log information based on a hash algorithm to obtain a first hash value of the first log information;

[0099] a first signing unit configured to sign the first hash value based on a signing algorithm and a preset signing certificate to obtain a first signature value of the first log information;

[0100] a composing unit configured to compose the signing algorithm, the signing certificate, and the first signature value into the signature data.

[0101] In an embodiment, the operation module 402 comprises:

[0102] a second concatenating unit configured to concatenate the first log information and a second hash chain value to obtain a target string;

[0103] a second operation unit configured to perform hash operation on the target string based on a hash algorithm to obtain a hash chain value.

[0104] In an embodiment, the first determining module 403 comprises:

[0105] a second signing unit configured to sign the first log information and the first hash chain value based on a signing algorithm to obtain a second signature value;

[0106] a taking unit configured to take the first log information, the first hash chain value, and the second signature value as the target log information.

[0107] In an embodiment, the log information processing apparatus further comprises:

[0108] The computing module is configured to calculate a third hash chain value of the first log information according to the first log information in the target log information.

[0109] The second determining module is configured to determine whether the third hash chain value is equal to the first hash chain value.

[0110] The determining module is configured to determine that the first log information has a change if the third hash chain value is not equal to the first hash chain value.

[0111] In an embodiment, the log information processing apparatus further includes:

[0112] The second obtaining module is configured to obtain a second record number of the second log information.

[0113] The third determining module is configured to determine whether the first record number of the first log information in the target log information is equal to a sum of the second record number and 1.

[0114] The third determining module is configured to determine that the log record in the first log information has a change if the first record number is not equal to the sum of the second record number and 1.

[0115] The log information processing apparatus described above can implement the log information processing method of the method embodiments described above. The optional items in the method embodiments described above are also applicable to this embodiment, and will not be described in detail herein. The remaining content of the embodiments of the present application can refer to the content of the method embodiments described above, and will not be described in detail herein.

[0116] Figure 5 The structure schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 5. As shown in FIG. 5, the electronic device 5 of this embodiment includes at least one processor 50 (only one processor is shown in the figure), a memory 51, and a computer program 52 stored in the memory 51 and executable on the at least one processor 50, wherein the processor 50 implements the steps in any method embodiment described above when executing the computer program 52. Figure 5 Figure 5 The electronic device 5 can be a smart phone, a tablet computer, a desktop computer, a super computer, a personal digital assistant, a physical server, a cloud server, and the like. The electronic device can include but is not limited to the processor 50 and the memory 51. Those skilled in the art can understand that the electronic device 5 shown in the figure is only an example and does not constitute a limitation on the electronic device 5, and can include more or fewer components than those shown in the figure, or combine certain components, or different components, for example, can also include an input / output device, a network access device, and the like.

[0117] The electronic device 5 can be a smart phone, a tablet computer, a desktop computer, a super computer, a personal digital assistant, a physical server, a cloud server, and the like. The electronic device can include but is not limited to the processor 50 and the memory 51. Those skilled in the art can understand that the electronic device 5 shown in the figure is only an example and does not constitute a limitation on the electronic device 5, and can include more or fewer components than those shown in the figure, or combine certain components, or different components, for example, can also include an input / output device, a network access device, and the like. Figure 5

[0118] ​​The processor 50 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0119] The memory 51 can be an internal storage unit of the electronic device 5 in some embodiments, such as a hard disk or a memory of the electronic device 5. The memory 51 can also be an external storage device of the electronic device 5 in other embodiments, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 51 can include both an internal storage unit and an external storage device of the electronic device 5. The memory 51 is used to store an operating system, an application program, a boot loader, data, and other programs, such as program codes of the computer program, etc. The memory 51 can also be used to temporarily store data that has been output or will be output.

[0120] In addition, the embodiments of the present application further provide a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps in any of the above method embodiments.

[0121] The embodiments of the present application provide a computer program product, when the computer program product is run on an electronic device, the electronic device is caused to implement the steps in each of the above method embodiments.

[0122] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other means. The apparatus embodiments described above are only illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order from that shown in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0123] In addition, the functional modules in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0124] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0125] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0126] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0127] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one from another entity or action without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A method of processing log information, characterized by, The method comprises the following steps: obtaining first log information and second log information, and obtaining a second hash chain value of the second log information, the second log information being previous log information of the first log information; based on a preset hash algorithm, performing hash operation on the first log information and the second hash chain value to obtain a first hash chain value of the first log information; determining target log information corresponding to the first log information according to the first log information and the first hash chain value; wherein, determining target log information corresponding to the first log information according to the first log information and the first hash chain value comprises: for a business system with a lower security requirement level, the first log information and the first hash chain value can be directly concatenated as target log information in sequence; for a business system with a higher security requirement level, a second signature value can be obtained by signing the first log information and the first hash chain value based on a signature algorithm; the first log information, the first hash chain value and the second signature value are taken as target log information; wherein, after determining target log information corresponding to the first log information according to the first log information and the first hash chain value, the method further comprises: calculating a third hash chain value of the first log information according to the first log information in the target log information; determining whether the third hash chain value is equal to the first hash chain value; if the third hash chain value is not equal to the first hash chain value, it is determined that the first log information has been changed or the hash chain value of the previous log information corresponding to the first log information has been changed.

2. The method of claim 1, wherein, The method comprises the following steps: obtaining log records and first record numbers of the log records; concatenating the log records and the first record numbers to obtain first log information.

3. The method of claim 1, wherein, Before determining target log information corresponding to the first log information according to the first log information and the first hash chain value, the method further comprises: based on the hash algorithm, performing hash operation on the first log information to obtain a first hash value of the first log information; based on a preset signature algorithm and a signature certificate, signing the first hash value to obtain a first signature value of the first log information; composing signature data by using the signature algorithm, the signature certificate and the first signature value; determining target log information corresponding to the first log information according to the first log information, the signature data and the first hash chain value. The method comprises the following steps:

4. The method of claim 1, wherein, concatenating the first log information and the second hash chain value to obtain a target string; based on the hash algorithm, performing hash operation on the target string to obtain a first hash chain value. The method comprises the following steps:

5. The method of claim 1, wherein, ​ sign the first log information and the first hash chain value based on a signature algorithm to obtain a second signature value; concatenate the first log information, the first hash chain value and the second signature value as the target log information.

6. The method of claim 2, wherein, After determining the target log information corresponding to the first log information according to the first log information and the first hash chain value, the method further includes: obtaining a second record number of the second log information; determining whether a first record number of the first log information in the target log information is equal to a sum of the second record number and 1; if the first record number is not equal to the sum of the second record number and 1, determining that the log record in the first log information has a change.

7. A processing apparatus of log information, characterized by, The method includes: a first obtaining module configured to obtain first log information and a second hash chain value of second log information, the second log information being a previous log information of the first log information; an operation module configured to perform hash operation on the first log information and the second hash chain value based on a preset hash algorithm to obtain a first hash chain value of the first log information; a first determining module configured to determine a target log information corresponding to the first log information according to the first log information and the first hash chain value. The first determining module is specifically configured to, for a business system with a lower security requirement level, directly concatenate the first log information and the first hash chain value as the target log information; and for a business system with a higher security requirement level, sign the first log information and the first hash chain value based on a signature algorithm to obtain a second signature value; and concatenate the first log information, the first hash chain value and the second signature value as the target log information. The log information processing apparatus is further configured to, after determining the target log information corresponding to the first log information according to the first log information and the first hash chain value, calculate a third hash chain value of the first log information according to the first log information in the target log information; determine whether the third hash chain value is equal to the first hash chain value; and if the third hash chain value is not equal to the first hash chain value, determine that the first log information has a change or a hash chain value of a previous log information corresponding to the first log information has a change.

8. An electronic device, comprising: The electronic device includes a memory and a processor, the memory is configured to store a computer program, and the processor is configured to run the computer program to enable the electronic device to perform the log information processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer program is stored in the memory and is executed by the processor to implement the log information processing method according to any one of claims 1 to 6.

Images