Audit log storage method, verification method, device and computer equipment

Abstract

The application relates to an audit log storage method, a verification method, a device and computer equipment, which are applied to the field of information security and include the following steps: generating monotonic count information of an audit log to be stored; inserting the audit log to be stored and the monotonic count information into a current Bloom filter; when the storage state of the current Bloom filter is full, generating a signature corresponding to the current Bloom filter, determining data information of the current Bloom filter in the full state, and inserting the data information into a root Bloom filter; removing the current Bloom filter from a trusted computing environment, creating a new current Bloom filter, storing the new current Bloom filter into the trusted computing environment, obtaining a next audit log to be stored, and returning to the step of generating monotonic count information of the audit log to be stored. The method can reduce the number of signatures on the basis of ensuring the credibility of the audit log, and is convenient for large-scale credible storage of the audit log.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an audit log storage method, verification method, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] Secure storage of audit logs prioritizes the integrity of their content over confidentiality. To protect audit logs from tampering or replay attacks, they are typically hashed and the hash value is signed to ensure their integrity.

[0003] Existing secure storage based on trusted computing technology, including secure storage of audit logs, primarily uses private keys protected by hardware security chips to sign audit logs to ensure integrity. However, existing methods require binding a signature for each audit record stored, with the number of signatures matching the number of audit records. The high frequency of audit log updates leads to excessively frequent signing. Furthermore, if the entire audit log is bound and signed periodically, newly generated audit log content after the most recent signature could be tampered with or subject to replay attacks.

[0004] Therefore, neither the overall log signing method nor the single log signing method is suitable for the secure storage of large-scale audit logs. Summary of the Invention

[0005] Therefore, it is necessary to provide an audit log storage method, verification method, device, computer equipment, computer-readable storage medium, and computer program product to address the technical problem that neither the overall log signature method nor the single log signature method is suitable for the secure storage of large-scale audit logs.

[0006] Firstly, this application provides a method for storing audit logs. The method includes:

[0007] Obtain the audit logs to be stored, and generate the monotonic count information of the audit logs to be stored;

[0008] The audit log to be stored and the monotonic count information are inserted into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment.

[0009] When the storage state of the current Bloom filter is full, a signature corresponding to the current Bloom filter is generated, and the data information of the current Bloom filter in the full state is determined. The data information is then inserted into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment.

[0010] Remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, store the new current Bloom filter in the trusted computing environment, obtain the next audit log to be stored, and return to the step of generating the monotonic count information of the log to be stored.

[0011] In one embodiment, inserting the audit log to be stored and the monotonic count information into the current Bloom filter includes:

[0012] The audit log to be stored is combined with the monotonic counting information to form a tuple;

[0013] The tuple is hashed using a preset hash function to obtain the hash value corresponding to the tuple;

[0014] Based on the hash value, determine the storage location of the tuple in the current Bloom filter;

[0015] The value corresponding to the storage location is marked as a preset value to realize the storage of the audit log to be stored and the monotonic counting information.

[0016] In one embodiment, generating the signature corresponding to the current Bloom filter includes:

[0017] Obtain the monotonic count information of each audit log stored in the current Bloom filter;

[0018] Using the signature private key corresponding to the trusted computing environment, the monotonic count information of each audit log is signed to obtain the signature corresponding to the current Bloom filter.

[0019] In one embodiment, inserting the audit log to be stored and the monotonic count information after the current Bloom filter further includes:

[0020] Determine the current storage state of the Bloom filter;

[0021] When the current Bloom filter is not full, obtain the next audit log to be stored and return to the step of generating the monotonic count information of the log to be stored.

[0022] In one embodiment, the monotonic count information of the first audit log stored in the new current Bloom filter is adjacent to the monotonic count information of the last audit log stored in the current Bloom filter.

[0023] Secondly, this application provides an audit log verification method. The method includes:

[0024] Receive an audit log verification request sent by the audit terminal; the audit log verification request carries the monotonic count information of the audit log to be verified;

[0025] Based on the monotonic count information, query the current Bloom filter stored in the trusted computing environment;

[0026] If the audit log corresponding to the monotonic count information does not exist in the current Bloom filter, then based on the monotonic count information, query the Bloom filter stored outside the trusted environment to obtain the verification result corresponding to the audit log verification request;

[0027] The verification result is returned to the audit terminal.

[0028] In one embodiment, the step of querying a Bloom filter stored outside the trusted environment based on the monotonic count information to obtain the verification result corresponding to the audit log verification request includes:

[0029] Based on the monotonic counting information, the target Bloom filter is determined from the Bloom filters stored outside the trusted environment;

[0030] Query the presence of the audit log to be verified in the target Bloom filter;

[0031] When the audit log to be verified is present in the target Bloom filter, the verification result is determined to be successful.

[0032] In one embodiment, before querying the audit log to be verified for existence in the target Bloom filter, the method further includes:

[0033] Verify the signature of the target Bloom filter;

[0034] When the signature verification is successful, the existence of the data information corresponding to the target Bloom filter in the root Bloom filter is verified; the data information is the data information of the target Bloom filter in a full state, and the root Bloom filter is stored in the trusted computing environment;

[0035] If the root Bloom filter contains data information corresponding to the target Bloom filter, then based on the monotonic count information, query the existence result of the audit log to be verified in the target Bloom filter.

[0036] Thirdly, this application also provides an audit log storage device. The device includes:

[0037] The acquisition module is used to acquire the audit logs to be stored and generate monotonic count information for the audit logs to be stored.

[0038] The first storage module is used to insert the audit log to be stored and the monotonic count information into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment.

[0039] The second storage module is used to generate a signature corresponding to the current Bloom filter when the storage state of the current Bloom filter is full, determine the data information of the current Bloom filter in the full state, and insert the data information into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment;

[0040] A module is created to remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, and store the new current Bloom filter in the trusted computing environment.

[0041] Fourthly, this application also provides an audit log verification device. The device includes:

[0042] The receiving module is used to receive audit log verification requests sent by the audit terminal; the audit log verification request carries the monotonic count information of the audit log to be verified.

[0043] The first query module is used to query the current Bloom filter stored in the trusted computing environment based on the monotonic count information.

[0044] The second query module is used to query a Bloom filter stored outside the trusted environment based on the monotonic count information if the audit log corresponding to the monotonic count information does not exist in the current Bloom filter, and obtain the verification result corresponding to the audit log verification request.

[0045] The return module is used to return the verification result to the audit terminal.

[0046] Fifthly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0047] Obtain the audit logs to be stored, and generate the monotonic count information of the audit logs to be stored;

[0048] The audit log to be stored and the monotonic count information are inserted into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment.

[0049] When the storage state of the current Bloom filter is full, a signature corresponding to the current Bloom filter is generated, and the data information of the current Bloom filter in the full state is determined. The data information is then inserted into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment.

[0050] Remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, store the new current Bloom filter in the trusted computing environment, obtain the next audit log to be stored, and return to the step of generating the monotonic count information of the log to be stored.

[0051] Sixthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0052] Obtain the audit logs to be stored, and generate the monotonic count information of the audit logs to be stored;

[0053] The audit log to be stored and the monotonic count information are inserted into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment.

[0054] When the storage state of the current Bloom filter is full, a signature corresponding to the current Bloom filter is generated, and the data information of the current Bloom filter in the full state is determined. The data information is then inserted into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment.

[0055] Remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, store the new current Bloom filter in the trusted computing environment, obtain the next audit log to be stored, and return to the step of generating the monotonic count information of the log to be stored.

[0056] Seventhly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0057] Obtain the audit logs to be stored, and generate the monotonic count information of the audit logs to be stored;

[0058] The audit log to be stored and the monotonic count information are inserted into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment.

[0059] When the storage state of the current Bloom filter is full, a signature corresponding to the current Bloom filter is generated, and the data information of the current Bloom filter in the full state is determined. The data information is then inserted into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment.

[0060] Remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, store the new current Bloom filter in the trusted computing environment, obtain the next audit log to be stored, and return to the step of generating the monotonic count information of the log to be stored.

[0061] The aforementioned audit log storage method, verification method, apparatus, computer equipment, storage medium, and computer program product, on the one hand, generate monotonic count information for the audit logs to be stored, and store this monotonic count information along with the audit logs to be stored in the current Bloom filter located in the trusted computing environment to ensure the trustworthiness of the audit logs during the storage process. On the other hand, when the storage space of the current Bloom filter is full, a signature is generated, and the full Bloom filter is removed from the trusted computing environment. The data information of the current Bloom filter in its full state is then stored in the root Bloom filter located in the trusted computing environment, ensuring the integrity and trustworthiness of the audit logs stored in the Bloom filter outside the trusted environment. Simultaneously, the irrevocable nature of Bloom filters is utilized to reduce the number of signatures, achieving a reduction in the number of signatures while ensuring the trustworthiness of audit logs, facilitating large-scale trusted storage of audit logs. Attached Figure Description

[0062] Figure 1 This is a flowchart illustrating an audit log storage method in one embodiment;

[0063] Figure 2 This is a schematic diagram of a Bloom filter tree in one embodiment;

[0064] Figure 3 This is a complete flowchart of the audit log storage method in another embodiment;

[0065] Figure 4 This is a flowchart illustrating an audit log verification method in one embodiment;

[0066] Figure 5 This is a schematic diagram of an audit log storage system in one embodiment;

[0067] Figure 6 This is a structural block diagram of an audit log storage device in one embodiment;

[0068] Figure 7 This is a structural block diagram of an audit log verification device in one embodiment;

[0069] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0071] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0072] In one embodiment, such as Figure 1 As shown, an audit log storage method is provided. This embodiment illustrates the method by applying it to a terminal. It is understood that this method can also be applied to a server, and to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. The server can be a standalone server or a server cluster consisting of multiple servers. In this embodiment, the method includes the following steps:

[0073] Step S110: Obtain the audit log to be stored and generate monotonic count information for the audit log to be stored.

[0074] Among them, the monotonic count information can be the monotonic count value.

[0075] In practice, audit logs can be obtained in real time, or they can be obtained from a database that temporarily stores the generated audit logs. After obtaining the audit logs to be stored, a monotonic counter can be used to generate a monotonic count value for the audit logs to be stored, which can be used as monotonic count information.

[0076] It's important to note that a monotonic counter is used to maintain a current count value that can only increase monotonically and cannot be rolled back. It is typically used to protect the freshness of data or messages, making it difficult for attackers to exploit the system with outdated data or messages.

[0077] Step S120: Insert the audit logs to be stored and the monotonic count information into the current Bloom filter; the current Bloom filter is stored in the trusted computing environment.

[0078] The Bloom filter, used to check if an element is in a set, is essentially a long binary vector and a series of random hash functions. Its advantages include good space and time efficiency, but its disadvantages include a certain false positive rate and difficulty in deletion. This application leverages the difficulty in deletion to ensure the reliability of audit logs.

[0079] In this context, a trusted computing environment refers to a server or system that stores audit logs using hardware security chips such as TPM (Trusted Platform Module, a chip embedded inside a computer that provides a root of trust for the computer) or TCM (Trusted Cryptography Module, a hardware module of a trusted computing platform that provides cryptographic operation functions for the trusted computing platform and has protected storage space) to provide hardware-based security protection.

[0080] In the specific implementation, each audit log item to be stored and the corresponding monotonic count information count can be formed into a tuple, denoted as (item, count), and inserted into the current Bloom filter in the trusted computing environment.

[0081] More specifically, the tuple (item, count) can be hashed using a preset hash function to obtain its hash value. Based on this hash value, the storage location of the tuple within the current Bloom filter is determined, and the audit logs and monotonic count information to be stored are then stored at that location within the current Bloom filter. After storing the audit logs and monotonic count information, the storage status of the current Bloom filter is further determined to allow for appropriate measures to be taken based on this status, ensuring that the next audit log can be stored.

[0082] In this step, since attackers cannot tamper with or replace the contents of the current Bloom filter in the trusted computing environment, and the tuple (item, count) cannot be undone once inserted, the recent audit logs are complete and reliable.

[0083] Step S130: When the storage state of the current Bloom filter is full, generate the signature corresponding to the current Bloom filter, determine the data information of the current Bloom filter in the full state, and insert the data information into the root Bloom filter; the root Bloom filter is stored in a trusted computing environment.

[0084] In the specific implementation, if it is determined that the storage status of the current Bloom filter is full, a signature corresponding to the current Bloom filter can be generated based on the monotonic count information of all audit logs in the current Bloom filter. The security of the audit logs stored in the current Bloom filter is ensured by the signature, and the freshness of the audit logs is determined by the monotonic count information.

[0085] The Bloom filter can be viewed as a long binary array. Initially, all bits in the array are 0. When storing data, the data is hashed to obtain a hash value, which is then used as the array index. The corresponding bit value in the initialized array is then modified to 1, thereby achieving the storage of the data.

[0086] Therefore, after storing each audit log and monotonic count, the value of each digit in the Bloom filter may change once. After storing the last audit log, the information consisting of the values ​​of each digit when the current Bloom filter is full is used as the data information of the current Bloom filter in the full state. The hash value is obtained by hashing the data information using a hash function. Based on the hash value, the storage position of the data information in the root Bloom filter is determined, and the value of the digit corresponding to the storage position is adjusted to 1, thereby realizing the insertion of the data information of the current Bloom filter in the full state into the root Bloom filter.

[0087] In another embodiment, if it is determined that the current storage state of the Bloom filter is not full, the next audit log to be stored is obtained, and the process returns to step S110 to generate the monotonic count information of the log to be stored. This process continues until the storage space of the current Bloom filter is full, and then the process proceeds to step S130.

[0088] Step S140: Remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, store the new current Bloom filter in the trusted computing environment, obtain the next audit log to be stored, and return to the step of generating monotonic count information for the log to be stored.

[0089] In the specific implementation, while removing the current Bloom filter that is already full, a new current Bloom filter also needs to be created and stored in the trusted computing environment for subsequent storage of audit logs. After each audit log is stored, the storage status of the new current Bloom filter is determined until the new current Bloom filter is also full. Then, the new current Bloom filter is removed from the trusted computing environment, and a new current Bloom filter is created. This process is repeated to ensure that there is always one root Bloom filter and one current Bloom filter stored in the trusted computing environment. The Bloom filter that is already full is removed from the trusted computing environment through signature to reduce the storage pressure on the trusted computing environment.

[0090] In the aforementioned audit log storage method, on the one hand, monotonic count information of the audit log to be stored is generated, and this monotonic count information, along with the audit log to be stored, is stored in the current Bloom filter located in the trusted computing environment to ensure the trustworthiness of the audit log during storage. On the other hand, when the storage space of the current Bloom filter is full, a signature is generated to remove the full Bloom filter from the trusted computing environment, and the data information of the full Bloom filter is stored in the root Bloom filter located in the trusted computing environment, ensuring the integrity and trustworthiness of the audit logs stored in the Bloom filter outside the trusted environment. Simultaneously, the irrevocable nature of Bloom filters is utilized to reduce the number of signatures, achieving a reduction in the number of signatures while ensuring the trustworthiness of the audit logs, facilitating large-scale trusted storage of audit logs.

[0091] In an exemplary embodiment, step S120 above, inserting the audit log to be stored and monotonic count information into the current Bloom filter, includes:

[0092] Step S1201: Form a tuple between the audit log to be stored and the monotonic counting information;

[0093] Step S1202: The tuple is hashed using a preset hash function to obtain the hash value corresponding to the tuple;

[0094] Step S1203: Determine the storage location of the tuple in the current Bloom filter based on the hash value;

[0095] Step S1204: Mark the value corresponding to the storage location as a preset value to realize the storage of audit logs and monotonic count information to be stored.

[0096] In its implementation, a Bloom filter can be viewed as a long binary array. Initially, all bits in the array are 0. After forming a tuple (item, count) with the audit log item to be stored and the corresponding monotonic count information count, the tuple is hashed using multiple preset hash functions to obtain multiple hash values ​​corresponding to the tuple, which are used as array indices. Then, the values ​​of the corresponding bits in the initialized array are modified to 1, thereby realizing the storage of the audit log item and the monotonic count information.

[0097] In this embodiment, a Bloom filter is used to store the audit logs to be stored and their monotonic count information. By taking advantage of the irreversible nature of the Bloom filter, a signature is only required when the Bloom filter is full, instead of generating a signature after each audit log is stored, which can greatly reduce the number of signatures.

[0098] In an exemplary embodiment, step 130 above, generating the signature corresponding to the current Bloom filter, includes: obtaining the monotonic count information of each audit log stored in the current Bloom filter; and performing signature processing on the monotonic count information of each audit log using the signature private key corresponding to the trusted computing environment to obtain the signature corresponding to the current Bloom filter.

[0099] The signing private key is protected by a trusted computing environment. The protection method varies depending on the trusted computing technology, and this application does not limit it. For example, the protection method could be that the signing private key is automatically destroyed after the trusted computing environment is compromised, or the private key could be located in hardware such as a trusted chip and not appear in memory. This signing private key is the private key of the trusted computing environment in which the subject resides, representing the identity of the environment and is independent of the subject.

[0100] In the specific implementation, let the monotonic count information of each audit log in the current Bloom filter be count1, count2, ..., count... n Then, using the signature private key corresponding to the trusted computing environment, the monotonic count information of each audit log can be signed to obtain a signature for all monotonic count information: Sign(count1, count2, ..., count...). n ).

[0101] In this embodiment, by generating a signature using the monotonic count information of each audit log stored in the current Bloom filter, it is possible to ensure that the count from count1 to count... n The integrity of the list of audit logs stored by the Bloom filter.

[0102] In one exemplary embodiment, the monotonic count information of the first audit log stored in the new current Bloom filter is adjacent to the monotonic count information of the last audit log stored in the current Bloom filter.

[0103] Specifically, the monotonic count values ​​between each Bloom filter are continuous. For example, the monotonic count value of the audit logs stored in the first Bloom filter is count1-count. 50 Then the monotonic count value of the audit log stored in the second Bloom filter needs to be obtained from count. 51 It begins to increase monotonically.

[0104] In this embodiment, the monotonic count information of the first audit log stored in the new current Bloom filter is set to be adjacent to the monotonic count information of the last audit log stored in the current Bloom filter, so that subsequent checks on the count can facilitate this process. n+ 1 corresponds to (item, count) n+1The system determines whether a monotonic count is inserted into B_cur to verify whether the Bloom filter B_n corresponding to the monotonic count information is the previous Bloom filter of B_cur stored in the trusted computing environment, thereby verifying the integrity of the audit log.

[0105] refer to Figure 2 This is a schematic diagram of a Bloom filter tree shown in an exemplary embodiment, as follows: Figure 2 As shown, the Bloom filter tree is a two-level tree structure. Its leaf nodes directly record the existence of audit logs, while the root node records the existence of the leaf nodes. The audit log storage steps are as follows: Figure 3 The flowchart shown is as follows:

[0106] (1) Obtain the audit log item to be stored and generate the monotonic count value of the audit log to be stored.

[0107] (2) Form a tuple (item, count) with the current monotonic count value count and then insert the tuple into the current Bloom filter B_cur.

[0108] (2) If the storage space of the current Bloom filter B_cur is full, remove the current Bloom filter B_cur from the trusted computing environment, generate the signature of the current Bloom filter B_cur, calculate the hash value of the data information of the current Bloom filter B_cur in the full state: Hash(B_cur, count), and insert Hash(B_cur, count) into the root Bloom filter B_root.

[0109] (3) Create a new current Bloom filter B_cur' and store the new current Bloom filter B_cur' in the trusted computing environment.

[0110] (4) Obtain the next audit log to be stored and execute the step of storing it into the new current Bloom filter B_cur'.

[0111] (5) If the storage space of the current Bloom filter B_cur is not full, the next audit log to be stored can be obtained directly, and the next audit log to be stored can be stored into the current Bloom filter B_cur.

[0112] To reduce storage pressure in the trusted computing environment, only the root Bloom filter B_root and the current Bloom filter B_cur can be stored in the trusted computing environment, while... Figure 2The Bloom filters for other parts of the log are stored outside the trusted computing environment. Since attackers cannot tamper with or replace B_cur in the trusted computing environment, and the tuple (item, count) cannot be undone once inserted, recent audit logs are complete and reliable. Meanwhile, the signature Sign(count1, count2...count) is also present. n This ensures that the sequence from count1 to count... n The list of historical Bloom filters is complete, and then the completeness of each individual Bloom filter is checked using the root Bloom filter B_root. Finally, the count needs to be verified. n The corresponding B_n is the previous Bloom filter of B_cur stored in the trusted computing environment, which can be determined by checking the count. n+1 The corresponding (item, count) n+1 This can be determined by whether it has been inserted into B_cur.

[0113] In this embodiment, a Bloom filter tree and a monotonic counter are used to protect the integrity of the audit logs. Then, the signature mechanism of trusted computing and the monotonic counter are used to ensure the credibility and freshness of the above integrity.

[0114] In one embodiment, such as Figure 4 As shown, an audit log verification method is provided. This embodiment illustrates the method applied to a terminal, but it is understood that the method can also be applied to a server, and to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0115] Step S410: Receive an audit log verification request sent by the audit terminal; the audit log verification request carries the monotonic count information of the audit log to be verified.

[0116] Step S420: Based on the monotonic count information, query the current Bloom filter stored in the trusted computing environment;

[0117] Step S430: If there is no audit log corresponding to the monotonic count information in the current Bloom filter, then based on the monotonic count information, query the Bloom filter stored outside the trusted environment to obtain the verification result corresponding to the audit log verification request.

[0118] Step S440: Return the verification result to the audit terminal.

[0119] In practice, when verifying audit logs, the audit terminal sends an audit log request to the trusted verification terminal. The trusted verification terminal, based on the monotonic count information of the audit log to be verified carried in the verification request, first checks if the audit log to be verified exists in the current Bloom filter stored in the trusted computing environment. If the audit log corresponding to the monotonic count information exists in the current Bloom filter, it indicates that the audit log is complete and trustworthy, and the verification is considered successful. The verification result is then returned to the audit terminal. Conversely, if the audit log corresponding to the monotonic count information does not exist in the current Bloom filter, the verification result is obtained from a Bloom filter stored outside the trusted environment based on the monotonic count information, and then returned to the audit terminal.

[0120] In some embodiments, an audit log request may carry monotonic count information of multiple audit logs to be verified. In this case, the current Bloom filter stored in the trusted computing environment can be queried one by one according to each monotonic count information to see if there is an audit log corresponding to each monotonic count information. When the audit log corresponding to a certain monotonic count information is not in the current Bloom filter, the Bloom filter stored outside the trusted environment is further queried until the query results corresponding to each monotonic count information are obtained, which are used as the verification results corresponding to the audit log verification request.

[0121] In this embodiment, a Bloom filter is used to protect the integrity of the audit log. The existence check of the Bloom filter replaces a large number of signature and signature verification operations. The existence check operation of the Bloom filter is far more efficient than signature and signature verification operations, thus the entire solution overcomes the problem of frequent signatures and has higher efficiency. Furthermore, this solution supports integrity verification of a portion of the audit log, without needing to verify the entire audit log.

[0122] In an exemplary embodiment, step S420 can be implemented through the following steps:

[0123] Step S4201: Based on monotonic counting information, determine the target Bloom filter from Bloom filters stored outside the trusted environment;

[0124] Step S4202: Query the existence results of the audit log to be verified in the target Bloom filter;

[0125] Step S4203: When there are audit logs to be verified in the target Bloom filter, the verification result is determined to be verified successfully.

[0126] In practice, since the monotonic count information of the audit logs stored in different Bloom filters is continuously increasing, the target Bloom filter corresponding to the audit log to be verified can be determined based on the monotonic count information carried by the audit log verification request. The existence result of the audit log to be verified in the target Bloom filter can be queried. If the audit log to be verified exists in the target Bloom filter, the verification result is determined to be verified successfully; otherwise, if the audit log to be verified does not exist in the target Bloom filter, the verification result is determined to be verified unsuccessfully.

[0127] In this embodiment, the target Bloom filter corresponding to the audit log to be verified is determined by using the monotonic count information carried in the audit log verification request. Then, it is only necessary to query the existence result of the audit log to be verified in the target Bloom filter, without querying other Bloom filters, which can greatly improve the verification efficiency of audit logs.

[0128] In an exemplary embodiment, before step S4202, the method further includes: verifying the signature of the target Bloom filter; when the signature verification is successful, verifying the existence result of the data information corresponding to the target Bloom filter in the root Bloom filter; the data information is the data information of the target Bloom filter in a full state, and the root Bloom filter is stored in a trusted computing environment; if the root Bloom filter contains the data information corresponding to the target Bloom filter, then querying the existence result of the audit log to be verified in the target Bloom filter based on the monotonic counting information.

[0129] In practice, after determining the target Bloom filter, before querying the existence of the audit log to be verified in the target Bloom filter, signature verification and existence check of the target Bloom filter are also required.

[0130] For example, suppose the signature of the target Bloom filter is Sign(count1, count2...count...). n The signature can be verified using a public key. After successful signature verification, it is then checked whether the data information corresponding to the target Bloom filter exists in the root Bloom filter. More specifically, the data information corresponding to the target Bloom filter can be hashed using a hash function to obtain the hash value Hash(B_1, count). B_1 Verify the hash value Hash(B_1, count). B_1 If the target filter exists in the root Bloom filter B_root, then the audit log to be verified can be further queried.

[0131] In this embodiment, the verification of audit logs stored in a Bloom filter only requires one signature verification and an existence check of the target Bloom filter, replacing a large number of signature verification operations, thus greatly improving operational efficiency.

[0132] refer to Figure 5 A schematic diagram of an audit log storage system shown in an exemplary embodiment includes:

[0133] The log generation module is used to continuously record audit logs.

[0134] A log storage module is used to store audit logs generated by the log generation module. Unlike traditional log storage modules, the log storage module of this application needs to append the current value of a monotonic counter, count, to each audit log entry.

[0135] The trusted log module receives new logs generated by the log generation module, assigns them a current monotonic count value, and is responsible for inserting Bloom filters and replacing them with new Bloom filters when the current one is full. The trusted log module is built upon a trusted computing environment and holds a signing private key protected by the trusted computing environment. The protection method varies depending on the trusted computing technology and is not limited in this application. For example, the signing private key may be automatically destroyed after the environment is compromised, or it may reside in hardware such as a trusted chip and not appear in memory. This signing private key is the private key of the trusted computing environment in which the subject resides, representing the identity of the environment and independent of the subject. Furthermore, the trusted log module includes a monotonic counter whose value can only increase monotonically and is protected by the trusted environment, making it tamper-proof. The protection method also varies depending on the trusted computing technology and is not limited in this application. For example, the monotonic counter may be implemented in hardware such as a trusted chip.

[0136] The trusted verification module is used to receive audit log verification requests sent by the audit terminal and perform verification operations. The main verification process is as follows:

[0137] a. The trusted verification module receives audit log verification requests sent by the audit terminal.

[0138] b. The trusted verification module reads the audit logs stored in the log storage module and reads B_cur from the Bloom filter tree in the trusted computing environment. Then, it starts verification from the most recent log item in the audit log. If (item, count) is in B_cur, then the log item is complete and trusted; until (item_i, count_i) corresponding to a certain log item item_i is not in B_cur.

[0139] c. The trusted verification module further reads a portion of the Bloom filter tree outside the trusted computing environment and verifies the signature Sign(count1,count2,......countn), then verifies whether Hash(B_1,count1), Hash(B_2,count2),...Hash(B_n,countn) are in B_root. If both signature verification and B_root verification pass, the module continues to verify log items starting from (item_i,count_i) using the most recent historical Bloom filter B_n until all log items are verified to be inserted into the Bloom filter tree. The trusted verification module then returns a successful verification conclusion to the audit terminal. If any (item,count) in the audit log is not in the Bloom filter tree, the module returns a failed verification conclusion to the audit terminal.

[0140] This application implements a tamper-proof and forgery-proof trusted audit log storage method, which has the following beneficial effects:

[0141] (1) The entire solution is based on a hardware security chip, thus possessing strong security. (2) It innovatively uses Bloom filters to protect the integrity of audit logs, replacing numerous signature and signature verification operations with Bloom filter existence checks. Bloom filter existence checks are far more efficient than signature and signature verification operations, thus overcoming the problem of frequent signatures and achieving higher efficiency. (3) It innovatively constructs a Bloom filter tree structure, reducing the storage space occupied in the trusted computing environment, while also supporting integrity verification of a portion of the audit logs without verifying the entire log. For example, integrity verification of only the most recent audit logs can be performed using only B_cur. (4) The combined use of Bloom filters and monotonic counters can effectively detect replay attacks and missing audit logs. (5) Due to advantages 2 and 3, each Bloom filter can be verified independently, and signatures only occur when a new Bloom filter is created, requiring only one signature verification. Therefore, this solution is suitable for large-scale log storage.

[0142] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0143] Based on the same inventive concept, embodiments of this application also provide an audit log storage device for implementing the audit log storage method described above, and an audit log verification device for implementing the audit log verification method described above. The solutions provided by these two devices are similar to those described in the above methods. Therefore, the specific limitations in one or more audit log storage device embodiments and audit log verification devices provided below can be found in the limitations of the audit log storage method and audit log verification method described above, and will not be repeated here.

[0144] In one embodiment, such as Figure 6 As shown, an audit log storage device is provided, comprising:

[0145] The acquisition module 610 is used to acquire the audit logs to be stored and generate monotonic count information for the audit logs to be stored.

[0146] The first storage module 620 is used to insert the audit logs to be stored and monotonic count information into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment.

[0147] The second storage module 630 is used to generate a signature corresponding to the current Bloom filter when the storage state of the current Bloom filter is full, and to determine the data information of the current Bloom filter in the full state and insert the data information into the root Bloom filter; the root Bloom filter is stored in a trusted computing environment.

[0148] Create module 640 to remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, and store the new current Bloom filter in the trusted computing environment.

[0149] In one embodiment, the first storage module 620 is specifically used to form a tuple between the audit log to be stored and the monotonic counting information; to perform hash processing on the tuple using a preset hash function to obtain the hash value corresponding to the tuple; to determine the storage location of the tuple in the current Bloom filter based on the hash value; and to mark the value corresponding to the storage location as a preset value, thereby realizing the storage of the audit log to be stored and the monotonic counting information.

[0150] In one embodiment, the second storage module 630 is specifically used to obtain the monotonic count information of each audit log stored in the current Bloom filter; and to perform signature processing on the monotonic count information of each audit log using the signature private key corresponding to the trusted computing environment to obtain the signature corresponding to the current Bloom filter.

[0151] In one embodiment, the above apparatus further includes a determining module for determining the current storage state of the Bloom filter; when the current storage state of the Bloom filter is not full, obtaining the next audit log to be stored and returning the step of generating monotonic count information of the log to be stored.

[0152] In one embodiment, the monotonic count of the first audit log stored in the new current Bloom filter is adjacent to the monotonic count of the last audit log stored in the current Bloom filter.

[0153] In one embodiment, such as Figure 7 As shown, an audit log verification device is provided, comprising:

[0154] The receiving module 710 is used to receive the audit log verification request sent by the audit terminal; the audit log verification request carries the monotonic count information of the audit log to be verified;

[0155] The first query module 720 is used to query the current Bloom filter stored in the trusted computing environment based on monotonic count information;

[0156] The second query module 730 is used to query the Bloom filter stored outside the trusted environment based on the monotonic count information if there is no audit log corresponding to the monotonic count information in the current Bloom filter, and obtain the verification result corresponding to the audit log verification request.

[0157] Return module 740 is used to return the verification result to the audit terminal.

[0158] In one embodiment, the second query module 730 is further configured to determine the target Bloom filter from the Bloom filters stored outside the trusted environment based on monotonic count information; query the existence result of the audit log to be verified in the target Bloom filter; and determine the verification result as verified when the audit log to be verified exists in the target Bloom filter.

[0159] In one embodiment, the second query module 730 is further configured to verify the signature of the target Bloom filter; when the signature verification is successful, verify the existence result of the data information corresponding to the target Bloom filter in the root Bloom filter; the data information is the data information of the target Bloom filter in a full state, and the root Bloom filter is stored in a trusted computing environment; if the root Bloom filter contains the data information corresponding to the target Bloom filter, then query the existence result of the audit log to be verified in the target Bloom filter based on the monotonic counting information.

[0160] Each module in the aforementioned audit log storage device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0161] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements an audit log storage method. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0162] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0163] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0164] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0165] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0166] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0167] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An audit log storage method, characterized in that, The method includes: Obtain the audit logs to be stored, and generate the monotonic count information of the audit logs to be stored; The audit log to be stored and the monotonic count information are inserted into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment. When the storage state of the current Bloom filter is full, a signature corresponding to the current Bloom filter is generated, and the data information of the current Bloom filter in the full state is determined. The data information is then inserted into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment. The steps of removing the current Bloom filter from the trusted computing environment, creating a new current Bloom filter, storing the new current Bloom filter in the trusted computing environment, obtaining the next audit log to be stored, and returning the monotonic count information for generating the audit log to be stored; and inserting the audit log to be stored and the monotonic count information into the current Bloom filter include: The audit log to be stored is combined with the monotonic counting information to form a tuple; The tuple is hashed using a preset hash function to obtain the hash value corresponding to the tuple; Based on the hash value, determine the storage location of the tuple in the current Bloom filter; The value corresponding to the storage location is marked as a preset value to realize the storage of the audit log to be stored and the monotonic count information.

2. The method according to claim 1, characterized in that, Generating the signature corresponding to the current Bloom filter includes: Obtain the monotonic count information of each audit log stored in the current Bloom filter; Using the signature private key corresponding to the trusted computing environment, the monotonic count information of each audit log is signed to obtain the signature corresponding to the current Bloom filter.

3. The method according to claim 1, characterized in that, The step of inserting the audit log to be stored and the monotonic count information into the current Bloom filter also includes: Determine the current storage state of the Bloom filter; When the current Bloom filter is not full, the next audit log to be stored is obtained, and the step of generating the monotonic count information of the audit log to be stored is returned.

4. The method according to claim 1, characterized in that, The monotonic count information of the first audit log stored in the new current Bloom filter is adjacent to the monotonic count information of the last audit log stored in the current Bloom filter.

5. An audit log verification method, characterized in that, The method includes: Receive an audit log verification request sent by the audit terminal; the audit log verification request carries the monotonic count information of the audit log to be verified; Based on the monotonic count information, query the current Bloom filter stored in the trusted computing environment; If the audit log corresponding to the monotonic count information does not exist in the current Bloom filter, then based on the monotonic count information, a Bloom filter stored outside the trusted computing environment is queried to obtain the verification result corresponding to the audit log verification request. The verification result is returned to the audit terminal; the step of querying a Bloom filter stored outside the trusted computing environment based on the monotonic count information to obtain the verification result corresponding to the audit log verification request includes: Based on the monotonic counting information, the target Bloom filter is determined from the Bloom filters stored outside the trusted computing environment; Query the presence of the audit log to be verified in the target Bloom filter; When the audit log to be verified exists in the target Bloom filter, the verification result is determined to be successful; before querying the existence result of the audit log to be verified in the target Bloom filter, the process further includes: Verify the signature of the target Bloom filter; When the signature verification is successful, the existence of the data information corresponding to the target Bloom filter in the root Bloom filter is verified; the data information is the data information of the target Bloom filter in a full state, and the root Bloom filter is stored in the trusted computing environment; If the root Bloom filter contains data information corresponding to the target Bloom filter, then based on the monotonic count information, query the existence result of the audit log to be verified in the target Bloom filter.

6. An audit log storage device, characterized in that, The device includes: The acquisition module is used to acquire the audit logs to be stored and generate monotonic count information for the audit logs to be stored. The first storage module is used to insert the audit log to be stored and the monotonic count information into the current Bloom filter; the current Bloom filter is stored in a trusted computing environment. The second storage module is used to generate a signature corresponding to the current Bloom filter when the storage state of the current Bloom filter is full, determine the data information of the current Bloom filter in the full state, and insert the data information into the root Bloom filter; the root Bloom filter is stored in the trusted computing environment; A creation module is used to remove the current Bloom filter from the trusted computing environment, create a new current Bloom filter, and store the new current Bloom filter in the trusted computing environment; The first storage module is specifically used to form a tuple between the audit log to be stored and the monotonic counting information; to perform hash processing on the tuple using a preset hash function to obtain the hash value corresponding to the tuple; to determine the storage location of the tuple in the current Bloom filter based on the hash value; and to mark the value corresponding to the storage location as a preset value, thereby realizing the storage of the audit log to be stored and the monotonic counting information.

7. An audit log verification device, characterized in that, The device includes: The receiving module is used to receive audit log verification requests sent by the audit terminal; the audit log verification request carries the monotonic count information of the audit log to be verified. The first query module is used to query the current Bloom filter stored in the trusted computing environment based on the monotonic count information. The second query module is used to query a Bloom filter stored outside the trusted computing environment based on the monotonic count information if the audit log corresponding to the monotonic count information does not exist in the current Bloom filter, and obtain the verification result corresponding to the audit log verification request. The return module is used to return the verification result to the audit terminal; The second query module is specifically used to determine the target Bloom filter from the Bloom filters stored outside the trusted computing environment based on the monotonic count information; query the existence result of the audit log to be verified in the target Bloom filter; and determine the verification result as verified when the audit log to be verified exists in the target Bloom filter. The second query module is also used to verify the signature of the target Bloom filter; when the signature verification is successful, it verifies the existence result of the data information corresponding to the target Bloom filter in the root Bloom filter; the data information is the data information of the target Bloom filter in a full state, and the root Bloom filter is stored in the trusted computing environment; if the data information corresponding to the target Bloom filter exists in the root Bloom filter, then based on the monotonic count information, it queries the existence result of the audit log to be verified in the target Bloom filter.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 5.

Images