A system log tamper-proofing method

Abstract

The application discloses a system log tamper-proofing method, which comprises the following steps: storing system logs and log XOR calculation results in a database; every two records of logs are subjected to binary conversion and XOR operation, and the operation result is stored in the next database; when the logs in a certain database are deleted or modified, data recovery or verification is performed on the corresponding logs in other databases through XOR operation; and when a certain database is deleted or down, data recovery can be performed from other databases. The method provided by the application improves the space utilization, and improves the data read-write performance and safety.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of log tamper-proofing technology, and in particular to a system log tamper-proofing method. BACKGROUND

[0002] System logs are information that records hardware, software and system problems in the system, and also monitors events occurring in the system. Users can check the causes of errors or find traces left by attackers when attacked through it. System logs include system logs, application logs and security logs. Under the driving of interests, some people will delete or tamper with system logs through hacking means. The log recording granularity is small, and the data volume generated in a unit of time is extremely large, so a large amount of computing resources of the server is needed by using conventional encryption means. At the same time, the backup of the log also occupies a large amount of storage space. For a small-scale application, a log storage and protection means that can balance high efficiency, low storage and high security is needed.

[0003] Technical solutions of prior art

[0004] The prior art for preventing logs from being tampered with is hot backup or incremental backup, which compares and verifies the existing data and historical backup data. For example, Figure 1 As shown in Table 1, database 1 is a master database, and database 2 is a backup database. Data is copied from database 1 to database 2 in the form of hot backup or periodic incremental backup, and when the logs of database 1 are tampered with or destroyed, database 2 is used for verification and recovery.

[0005] Table 1

[0006] Database 1 Database 2 Log A Log A Log B Log B Log C Log C … …

[0007] Disadvantages of the prior art:

[0008] (1) The backup occupies a large space, and needs to occupy 50% of the total space;

[0009] (2) The performance is low, and the master and backup databases bear different roles and cannot separate reading and writing or read and write data in parallel;

[0010] (3) The security is low, and the data security depends on the protection ability and stability of database 2; if database 2 is attacked, the logs can be tampered with. SUMMARY

[0011] To solve the above technical problems, the purpose of the present application is to provide a system log tamper-proofing method, which aims to improve the space utilization rate, reduce the backup data to occupy 33% of the total space from 50%, improve the data reading and writing performance, separate reading and writing and read and write data in parallel, improve the security, and check and repair any tampered data and rebuild the database if any database is destroyed.

[0012] The object of the present application is achieved by the following technical solutions:

[0013] A system log tamper-proofing method, comprising the following steps:

[0014] Step A stores system logs and log XOR calculation results in a database;

[0015] Step B, every two records of logs, performs binary conversion and XOR operation on two log data, and stores the operation result in the next database;

[0016] Step C, when the logs in a certain database are deleted or modified, data recovery or verification is performed on the corresponding logs in other databases through XOR operation; and when a certain database is deleted or down, data recovery can be performed from other databases.

[0017] Compared with the prior art, one or more embodiments of the present application can have the following advantages:

[0018] (1) Small capacity consumption: after every two records of logs, a log XOR operation is performed to form a log association information, which can be used for data verification and data backup. The log association information only occupies one-third of the total capacity, and the traditional log global backup or incremental backup occupies one-half of the total capacity without compression. Therefore, the method of the present application has smaller capacity consumption space.

[0019] (2) Fast backup speed: it is equivalent to performing database hot backup every moment, and the hot backup granularity is two logs, and the backup information is evenly distributed in three databases.

[0020] (3) High read-write performance: three databases are used to save logs in turn, so that reading and writing do not interfere with each other, and two logs can be continuously read or written, and theoretically, the read-write performance of a single database can be doubled.

[0021] (4) High security: the method performs XOR operation on the binary stream of the logs, and the XOR operation has the characteristics of same as 0 and different as 1. Any log can be recovered or verified by the other two associated logs, so that the log data can be prevented from being destroyed or tampered with. It is necessary to attack two databases deployed in different places to get the complete log data, and it is necessary to attack three databases deployed in different places to destroy or tamper with the logs. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a prior art structure diagram;

[0023] Figure 2 is a system log tamper-proofing method flowchart;

[0024] Figure 3 is a system log tamper-proofing method use case diagram;

[0025] Figure 4 is a system log storage distribution diagram. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with examples and drawings.

[0027] As shown in the figure, it is a system log tamper-proofing method flow, including the following steps: Figure 2

[0028] Step 10 stores the system log and the log XOR calculation result in the database;

[0029] Step 20, for every two records, the two log data are converted into binary and XOR operated, and the operation result is stored in the next database;

[0030] Step 30, when the log in a certain database is deleted or modified, the data is recovered or verified by XOR operation from the corresponding log in other databases; and when a certain database is deleted or down, the data can be recovered from other databases.

[0031] The database in step 10 above includes three parallel and geographically distributed databases, and the system log and the log XOR calculation result are stored by the three geographically distributed databases in turn (as shown in the figure); the log set is {A, B, C, D, E, F,...}, and the storage starts from database 1, as shown in Table 2 Figure 3

[0032] Table 2

[0033] Database 1 Database 2 Database 3 Log A Log B …

[0034] The result diagram of the system log storage distribution is shown in the figure. Figure 4

[0035] The binary corresponding data of the log is shown in Table 3

[0036] Table 3

[0037] Log Character form Binary form A {msg:a} 01111011011011010111001101100111001110100110000101111101 B {msg:b} 01111011011011010111001101100111001110100110001001111101 C {msg:c} 01111011011011010111001101100111001110100110001101111101 D {msg:d} 01111011011011010111001101100111001110100110010001111101 E {msg:e} 01111011011011010111001101100111001110100110010101111101 F {msg:f} 01111011011011010111001101100111001110100110011001111101

[0038] The operation result of every two log data in step 20 above is stored in the next database as a regular log, as shown in Table 4

[0039] Table 4

[0040]

[0041] ​​​Every record two logs, two log data are converted and XOR operation, the result of the operation as a regular log stored in the next database. Assume that the binary conversion of log A is 10101, assume that the binary conversion of log B is 11010. After the XOR operation result is 01111, save as log AB.

[0042] AB = f XOR (f b (A), f b (B))

[0043] XOR is the abbreviation of XOR operation, wherein, f XOR represents the XOR operation, b is the abbreviation of binary, f b is the binary conversion of the string function

[0044] The above step 30 when a log is deleted or modified, the corresponding log from the remaining two database by XOR operation data recovery or verification; When a database is deleted or down, data recovery can be carried out from the remaining two databases. Assume that log A is tampered with A', the binary data of A' is 11011, log B and log AB are XORed to obtain A", the data of A" is 10101, it is known that A'≠A", so that A is found to be tampered with, A" is the binary data of A, and A can be recovered.

[0045]

[0046] Recovery log: A = f' b (A'), f' b is the inverse function of binary conversion, that is, the binary conversion into a string.

[0047] The above step 40 process is shown in Table 5:

[0048] Table 5

[0049]

[0050] From table 4, A'≠A" in binary form, then the log {msg:aa} is not trusted, and the original data A is obtained by performing binary inverse conversion on A", and A is {msg:a}.

[0051] In the above embodiment, log AB is obtained by XOR operation of log A and log B, and log CD is obtained by XOR operation of log C and log D, and log EF is obtained by XOR operation of log E and log F.

[0052] When any one of the logs A to F is modified, it can be checked or repaired by the other two logs of the same row. For example, if log A is damaged, it can be repaired by performing an exclusive-OR operation on logs B and AB, and comparing the result with the binary data of log A. If they are not equal, it proves that A is damaged. The binary-to-character conversion of the exclusive-OR operation result can recover A.

[0053] If any one of the databases is damaged, it can be reconstructed by the other two databases. For example, if database 1 is damaged, it can be recovered by sequentially reading the data of databases 2 and 3 and performing an exclusive-OR operation.

[0054] Although the embodiments of the present application have been disclosed with reference to the above embodiments, the above description is only for the purpose of facilitating understanding of the present application, and is not intended to limit the present application. Any modification and change in the embodiments of the present application, which do not depart from the spirit and scope of the present application, can be made by any person skilled in the art, and the patent protection scope of the present application shall be subject to the scope defined by the appended claims.

Claims

1. A method for preventing tampering with system logs, characterized in that, The method includes the following steps: Step A stores the system logs and the XOR calculation results in the database; Step B records two log entries, performs binary conversion on the two log entries and XOR operation, and stores the result in the next database. Step C: When logs in a database are deleted or modified, data recovery or verification is performed from the corresponding logs in other databases using an XOR operation; and when a database is deleted or crashes, data recovery can be performed from other databases. The database in step A includes three databases deployed in different locations, and the system logs and log XOR calculation results are stored in turn by the three databases deployed in different locations. In step B, the result of the operation on every two log data is stored as a regular log in the next database. The log set is {A, B, C, D, E, F, ...}, and is stored starting from database 1; In step B, every two logs are XORed. For example, logs A and B are converted to binary, XORed, and then saved as log AB. AB=f XOR (f b (A),f b (B)) Where f XOR This represents the XOR operation; b is an abbreviation for binary; f b It is a function that converts a string to binary. If any log is modified in step C, it can be repaired using the other two logs. For example, if log A is tampered with to A′, performing an XOR operation between log B and log AB yields A″. Since A′≠A″, it can be detected that A has been tampered with. A″ is the binary data of A, and A can be recovered. Recovery Log: A = f′ b (A′), f′ b It is the inverse function of binary conversion.

Images