Log file processing method, apparatus, system, electronic device, and storage medium

Abstract

The present disclosure provides log file processing methods, devices, systems, electronic devices and storage media, relating to the fields of artificial intelligence such as distributed storage, cloud computing and information security. The method can comprise: in response to meeting a predetermined splitting condition, a target node generating a log file using log information generated within a splitting period, the splitting period being a time period between the latest two adjacent times meeting the splitting condition, the target node being any node in a distributed service system; in response to meeting a predetermined calculation condition, the target node obtaining hash values of log files generated by each node in the distributed service system within a calculation period, the calculation period being a time period between the latest two adjacent times meeting the calculation condition, and generating a root hash corresponding to the calculation period according to the obtained hash values, the root hash being used to verify the security of the log files generated by each node within the corresponding calculation period.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and in particular to log file processing methods, apparatus, systems, electronic devices and storage media in the fields of distributed storage, cloud computing and information security. Background Technology

[0002] In a distributed service system (i.e., a distributed service architecture), there are multiple nodes, each of which maintains its own log files. These log files contain important operation and event records. Summary of the Invention

[0003] This disclosure provides methods, apparatus, systems, electronic devices, and storage media for processing log files.

[0004] A log file processing method, comprising:

[0005] In response to meeting the predetermined splitting conditions, the target node generates a log file using the log information generated during the splitting period. The splitting period is the time interval between the two most recent consecutive times that the splitting conditions are met. The target node is any node in the distributed service system.

[0006] In response to meeting predetermined computation conditions, the target node obtains the hash values ​​of log files generated by each node in the distributed service system within the computation period. The computation period is the time interval between the two most recent consecutive times that the computation conditions are met. Based on the obtained hash values, a root hash corresponding to the computation period is generated. The root hash is used by the verification device to perform security verification on the log files generated by each node within the corresponding computation period.

[0007] A log file processing method, comprising:

[0008] The verification device obtains the log file to be verified and the corresponding root hash. The log file to be verified is the log file generated by each node in the distributed service system within the computation period to be verified. The log file is generated by each node when it meets the predetermined splitting conditions, using the log information generated within the splitting period. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met. The root hash is the root hash corresponding to the computation period generated by each node when it meets the predetermined computation conditions, based on the hash value of the log file generated by each node within the obtained computation period. The computation period is the time interval between the two most recent adjacent times when the computation conditions are met.

[0009] The verification device uses the root hash corresponding to the log file to be verified to perform security verification on the log file to be verified.

[0010] A log file processing method, comprising:

[0011] The first server obtains and stores the hash value sent by the node in the distributed service system. The hash value is the hash value of the log file generated by the node using the log information generated during the splitting period when the node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met.

[0012] In response to the node meeting the predetermined calculation conditions, the first server provides the node with the hash values ​​of the log files generated by each node in the distributed service system during the calculation period. The node generates the root hash corresponding to the calculation period based on the obtained hash values. The calculation period is the time interval between the two most recent consecutive times that the calculation conditions are met. The root hash is used by the verification device to perform security verification on the log files generated by each node during the corresponding calculation period.

[0013] A log file processing method, comprising:

[0014] The second server obtains and stores the root hash sent by the nodes in the distributed service system. The root hash is the root hash of the calculation period generated by the nodes when the nodes meet the predetermined calculation conditions, based on the hash values ​​of the log files generated by each node in the distributed service system within the obtained calculation period. The calculation period is the time interval between the two most recent two consecutive times when the calculation conditions are met. The log file is the log file generated by each node when the nodes meet the predetermined splitting conditions, using the log information generated within the splitting period. The splitting period is the time interval between the two most recent two consecutive times when the splitting conditions are met.

[0015] The second server receives the acquisition request sent by the verification device, and returns the log file to be verified corresponding to the acquisition request and the root hash corresponding to the log file to be verified to the verification device, so that the verification device can perform security verification on the log file to be verified based on the acquired root hash.

[0016] A log file processing device includes: a segmentation module and a calculation module;

[0017] The segmentation module is used to generate a log file using the log information generated by the target node during the segmentation period in response to the fulfillment of the predetermined segmentation conditions. The segmentation period is the time interval between the two most recent two consecutive times that the segmentation conditions are met. The target node is any node in the distributed service system.

[0018] The calculation module is used to obtain the hash value of the log files generated by each node in the distributed service system within a calculation period in response to the fulfillment of predetermined calculation conditions. The calculation period is the time interval between the two most recent consecutive times that the calculation conditions are met. The module generates a root hash corresponding to the calculation period based on the obtained hash value. The root hash is used by the verification device to perform security verification on the log files generated by each node within the corresponding calculation period.

[0019] A log file processing device includes: an acquisition module and a verification module;

[0020] The acquisition module is used to acquire the log file to be verified and the corresponding root hash. The log file to be verified is the log file generated by each node in the distributed service system during the computing period to be verified. The log file is generated by each node using the log information generated during the splitting period when each node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met. The root hash is the root hash corresponding to the computing period generated by each node based on the hash value of the log file generated by each node during the computing period when each node meets the predetermined computing conditions. The computing period is the time interval between the two most recent adjacent times when the computing conditions are met.

[0021] The verification module is used to perform security verification on the log file to be verified using the root hash corresponding to the log file to be verified.

[0022] A log file processing apparatus includes: a first storage module and a first processing module;

[0023] The first storage module is used to obtain and store the hash value sent by the node in the distributed service system. The hash value is the hash value of the log file generated by the node using the log information generated during the splitting period when the node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met.

[0024] The first processing module is configured to, in response to the node meeting predetermined computation conditions, provide the hash values ​​of the log files generated by each node in the distributed service system during the computation period to the node, so that the node can generate the root hash corresponding to the computation period based on the obtained hash values. The computation period is the time interval between the two most recent consecutive times that the computation conditions are met. The root hash is used by the verification device to perform security verification on the log files generated by each node during the corresponding computation period.

[0025] A log file processing apparatus includes: a second storage module and a second processing module;

[0026] The second storage module is used to obtain and store the root hash sent by the nodes in the distributed service system. The root hash is the root hash of the calculation period generated by the nodes when the nodes meet the predetermined calculation conditions, based on the hash value of the log files generated by each node in the distributed service system within the obtained calculation period. The calculation period is the time interval between the two most recent two consecutive times when the calculation conditions are met. The log file is the log file generated by each node when the nodes meet the predetermined splitting conditions, using the log information generated within the splitting period. The splitting period is the time interval between the two most recent two consecutive times when the splitting conditions are met.

[0027] The second processing module is used to obtain the acquisition request sent by the verification device, and return the log file to be verified corresponding to the acquisition request and the root hash corresponding to the log file to be verified to the verification device, so that the verification device can perform security verification on the log file to be verified based on the obtained root hash.

[0028] A log file processing system includes: various log file processing devices as described above.

[0029] An electronic device, comprising:

[0030] At least one processor; and

[0031] A memory communicatively connected to the at least one processor; wherein,

[0032] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described above.

[0033] A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the methods described above.

[0034] A computer program product includes a computer program / instructions that, when executed by a processor, implement the method described above.

[0035] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0036] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0037] Figure 1 This is a flowchart of the first embodiment of the log file processing method described in this disclosure;

[0038] Figure 2 This is a schematic diagram illustrating the process of generating the root node as described in this disclosure;

[0039] Figure 3 This is a flowchart of the second embodiment of the log file processing method described in this disclosure;

[0040] Figure 4 This is a flowchart of the third embodiment of the log file processing method described in this disclosure;

[0041] Figure 5 This is a flowchart of the fourth embodiment of the log file processing method described in this disclosure;

[0042] Figure 6 This is a schematic diagram of the composition structure of the first embodiment 600 of the log file processing device described in this disclosure;

[0043] Figure 7 This is a schematic diagram of the composition structure of the second embodiment 700 of the log file processing device described in this disclosure;

[0044] Figure 8 This is a schematic diagram of the composition structure of the third embodiment 800 of the log file processing device described in this disclosure;

[0045] Figure 9 This is a schematic diagram of the composition structure of the fourth embodiment 900 of the log file processing device described in this disclosure;

[0046] Figure 10 This is a schematic diagram of the composition structure of Embodiment 1000 of the log file processing system described in this disclosure;

[0047] Figure 11 A schematic block diagram of an electronic device 1100 that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0048] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0049] Furthermore, it should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0050] Figure 1 This is a flowchart of the first embodiment of the log file processing method described in this disclosure. Figure 1 As shown, the specific implementation methods are as follows.

[0051] In step 101, in response to meeting the predetermined splitting conditions, the target node generates a log file using the log information generated during the splitting period. The splitting period is the time interval between the two most recent consecutive times that the splitting conditions are met. The target node is any node in the distributed service system.

[0052] In step 102, in response to meeting predetermined calculation conditions, the target node obtains the hash values ​​of log files generated by each node in the distributed service system within the calculation period. The calculation period is the time interval between the two most recent consecutive times that the calculation conditions are met. The root hash corresponding to the calculation period is generated based on the obtained hash values. The root hash is used by the verification device to perform security verification on the log files generated by each node within the corresponding calculation period.

[0053] As mentioned earlier, in a distributed service system, there are multiple nodes, each maintaining its own log files. To centrally manage these log files, a collector is typically used to gather log files from each node and store them in an object storage server (similar to a cloud drive). However, this approach presents the following problem: when log files stored in the object storage server are needed, it is impossible to know whether the corresponding log files have been tampered with during transmission and storage; in other words, the security of the log files cannot be guaranteed.

[0054] The scheme described in the above method embodiment can generate root hashes corresponding to different computing time periods through a series of processes. Accordingly, the generated root hashes can be used to verify the log files generated by each node within the corresponding computing time period. If the verification fails, it can be known that the log files have been tampered with during transmission and / or storage, so that targeted processing measures can be taken subsequently. If the verification passes, it means that the log files are safe and can be used with confidence. In short, the security of log files is improved through the above processing.

[0055] For ease of explanation, any node in a distributed service system will be referred to as the target node. In other words, each node in a distributed service system can be configured according to... Figure 1 Log files are processed in the manner shown.

[0056] Each time the target node determines that it meets the predetermined splitting conditions, it can generate a log file using the log information generated during the splitting period. The splitting period is the time interval between the two most recent consecutive times that the splitting conditions are met.

[0057] Preferably, the predetermined segmentation condition may include: determining that the segmentation condition is met in response to the passage of a first cycle duration, wherein the first cycle duration is equal to the duration of the segmentation period.

[0058] The specific duration of the first cycle can be determined according to actual needs, such as 10 minutes. Correspondingly, every 10 minutes, the target node can be considered to meet the splitting conditions and can perform a log split, generating a log file using the log information generated within the last 10 minutes. Thus, the target node can obtain a total of 144 log files per day. The specific format of the log files is not restricted.

[0059] In addition, each time the target node determines that it meets the predetermined calculation conditions, it can use the hash value of the log file generated by each node in the distributed service system during the calculation period to generate the root hash corresponding to the calculation period. The calculation period is the time interval between the two most recent two consecutive times that the calculation conditions are met.

[0060] Preferably, the predetermined calculation conditions may include: determining that the calculation conditions are met in response to the passage of a second cycle duration, wherein the second cycle duration is equal to the duration of the calculation period, and the second cycle duration is M times the duration of the first cycle duration, where M is a positive integer greater than one.

[0061] The duration of the second cycle and the specific value of M can be determined according to actual needs. For example, the duration of the second cycle can be one hour or one day. Taking one hour as an example, after one hour, the target node can be considered to meet the calculation conditions, and the root hash corresponding to this hour can be generated based on the hash value of the log files generated by each node in the distributed service system within this hour.

[0062] Through the above processing, the target node can periodically generate log files, and based on the generated log files, it can periodically generate root hashes corresponding to different calculation periods, thus laying a good foundation for subsequent processing.

[0063] Preferably, after the target node generates a log file using the log information generated within the segmented time period, it can also obtain the hash value of the generated log file and store the hash value in the first server. Furthermore, after the target node generates the root hash corresponding to each calculation time period based on each hash value, it can also store the root hash in the second server. Accordingly, when the target node obtains the hash value of the log file generated by each node in the distributed service system within the calculation time period, it can obtain the hash value of the log file generated by each node within the calculation time period from the first server.

[0064] Preferably, the first server can be a remote dictionary service (Redis) server, and the second server can be an object storage server.

[0065] In other words, after each log file is generated, the target node can obtain the hash value of that log file. This hash value can be calculated using a Secure Hash Algorithm (SHA) 256 or other cryptographic hash functions. The calculated hash value can then be stored on the first server, or published to a specific Redis channel. Each time the calculation conditions are met, the target node can retrieve the hash values ​​of the log files generated by each node within the calculation period from the first server. It can then generate a root hash corresponding to the calculation period based on these hash values ​​and store the generated root hash on the second server.

[0066] Assuming the second cycle duration is one hour, correspondingly, taking a day as an example, it can include 24 calculation periods such as 0:00-1:00, 1:00-2:00, ..., 23:00-24:00. Taking the calculation period from 1:00 to 2:00 as an example, the hash values ​​of the log files generated by each node in the distributed service system during the calculation period from 1:00 to 2:00 can be obtained from the first server. Then, the root hash corresponding to the calculation period from 1:00 to 2:00 can be generated based on the obtained hash values. Similarly, the root hashes corresponding to other calculation periods can be obtained respectively.

[0067] As can be seen, in the above processing method, with the help of the first server, each node can easily and quickly obtain the hash value of the log files generated by itself and other nodes, and then efficiently and accurately determine the required root hash based on the obtained hash values. In addition, the second server usually stores the log files generated by each node, and the obtained root hash can also be stored in the second server, so as to facilitate the subsequent verification of the required log files based on the content stored in the second server.

[0068] Preferably, when storing the obtained hash value in the first server, the hash value can be encrypted before being stored in the first server, and / or, when storing the obtained root hash in the second server, the root hash can be encrypted before being stored in the second server.

[0069] The specific encryption method is not limited. For example, the target node's private key can be used for signature encryption. Correspondingly, when the encrypted hash value and / or root hash are needed, decryption must be performed first. Encryption can further enhance the security of data transmission and storage.

[0070] Preferably, for any given computation period, the method by which the target node generates the root hash corresponding to that computation period based on the obtained hash values ​​may include: using each obtained hash value as a leaf node of a Merkle tree, determining the root node of the Merkle tree, i.e., the Merkle root, based on the leaf nodes, and using the hash value corresponding to the root node as the root hash corresponding to that computation period.

[0071] Preferably, the obtained hash values ​​can be sorted in ascending order according to the log file numbers corresponding to each hash value. Different log files correspond to their own unique numbers. For each sorted hash value, the following first process can be performed: each hash value in an odd position is combined with the hash value that follows and is adjacent to it to form a pair. Based on the two hash values ​​included, a hash value corresponding to each pair is generated. If the number of pairs is one, the hash value corresponding to the pair is used as the required root hash. Otherwise, the first process is repeated for the hash value corresponding to each pair.

[0072] Alternatively, preferably, in response to determining that any hash value is in an odd position and there are no other hash values ​​after it, the hash value can be combined with itself to form a pair.

[0073] The initial hash values ​​can be used as leaf nodes, and adjacent hash values ​​can be combined in pairs to generate hash values ​​of each pair, which serve as parent nodes. This process is repeated until the root node of the tree is obtained.

[0074] The above process can be illustrated with the following example:

[0075] Suppose that the distributed service system includes 2 (the number is for illustrative purposes only, and the actual number may be much larger) nodes, namely node a and node b. For a certain computing period, node a and node b each obtain 4 (the number is for illustrative purposes only, and the actual number may be much larger) hash values ​​of log files. Two of these are the hash values ​​of log files generated by node a during the computing period, and the other two are the hash values ​​of log files generated by node b during the computing period.

[0076] Figure 2 This is a schematic diagram illustrating the process of generating the root node as described in this disclosure. Figure 2 As shown, assuming the four log files are sorted in ascending order of their numbers and denoted as L1, L2, L3, and L4 respectively, then the four corresponding hash values ​​are: H(L1) = A, H(L2) = B, H(L3) = C, and H(L4) = D, where A, B, C, and D represent the hash values ​​corresponding to log files L1, L2, L3, and L4, respectively.

[0077] Then, A and B can be combined into a pair, and C and D can be combined into a pair, thus obtaining two pairs. It should be noted that if there is a hash value E in addition to A, B, C, and D, then since E is in an odd position (5) and there are no other hash values ​​after it, E can be combined with itself into a pair.

[0078] Then, the hash values ​​corresponding to each pair can be determined, namely H(H(L1)+H(L2)) and H(H(L3)+H(L4)), thus obtaining two new hash values, corresponding to... Figure 2 There are no restrictions on how to obtain the corresponding hash values ​​for each combination of "AB" and "CD" shown.

[0079] Then, for the newly obtained hash value, adjacent hash values ​​are combined again in the same way to generate higher levels of the tree. This process continues until only one hash value remains, which is the root node, or Merkle root.

[0080] like Figure 2 As shown, the root node is H(H(H(L1)+H(L2))+H(H(L3)+H(L4))), corresponding to Figure 2 The "ABCD" shown in the image.

[0081] Each node will calculate a root node in the above manner. Under normal circumstances, the root node calculated by each node is the same.

[0082] Through the above processing, the required root hash can be calculated efficiently and accurately with the help of a Merkle tree, which facilitates the subsequent security verification of the corresponding log files.

[0083] Furthermore, assuming the distributed service system includes 10 nodes, and each node generates a log file every 10 minutes, then a total of 144 * 10 = 1440 log files can be generated in one day. Each log file corresponds to its own unique number, which can be assigned by the first server to each log file, also known as a sequence number. For example, a log file can be named 2023-08-25-0100-10.log, which means that the log file was generated at 1:00 AM on August 25, 2023, and its number is 10. Then the next log file would be numbered 11, and so on. The earlier the log file is generated, the earlier its number usually appears. In particular, if different nodes generate log files at the same time, the order of these log files can be arbitrarily set. Accordingly, for the 1440 log files, as one possible implementation, their numbers can be from 1 to 1440.

[0084] Assuming the second cycle lasts for one hour, each node will calculate a root hash for any given hour. After signing and encryption, this will result in the file 2023-08-25-01.ms, which can be saved to the second server. This represents the root hash corresponding to the first hour (01) of August 25, 2023. Assuming the second cycle lasts for one day, each node will calculate a root hash for any given day. After signing and encryption, this will result in the file 2023-08-25.ms, which can be saved to the second server.

[0085] The above mainly describes the solution described in this disclosure from the perspective of the node side. The following sections will further describe the solution from the perspectives of the verification device side, the first server side, and the second server side.

[0086] Figure 3 This is a flowchart of a second embodiment of the log file processing method described in this disclosure. Figure 3 As shown, the specific implementation methods are as follows.

[0087] In step 301, the verification device obtains the log file to be verified and the corresponding root hash. The log file to be verified is the log file generated by each node in the distributed service system during the computation period to be verified. The log file is generated by each node using the log information generated during the partitioning period when each node meets the predetermined partitioning conditions. The partitioning period is the time interval between the two most recent adjacent times when the partitioning conditions are met. The root hash is the root hash corresponding to the computation period generated by each node based on the hash value of the log file generated by each node during the computation period when each node meets the predetermined computation conditions. The computation period is the time interval between the two most recent adjacent times when the computation conditions are met.

[0088] In step 302, the verification device uses the root hash corresponding to the log file to be verified to perform security verification on the log file to be verified.

[0089] Using the scheme described in the above method embodiments, root hashes corresponding to different computing time periods can be generated through a series of processes. Accordingly, the generated root hashes can be used to verify the log files generated by each node within the corresponding computing time period. If the verification fails, it can be known that the log files have been tampered with during transmission and / or storage. If the verification passes, it means that the log files are safe and can be used with confidence. In short, the security of log files is improved through the above processing.

[0090] Preferably, the method of performing security verification on the log file to be verified using the root hash corresponding to the log file to be verified may include: using the obtained root hash corresponding to the log file to be verified as a reference hash, and generating the root hash corresponding to the log file to be verified in the same way as generating the reference hash, as a comparison hash; in response to the comparison hash being consistent with the reference hash, determining that the security verification of the log file to be verified has passed; in response to the comparison hash being inconsistent with the reference hash, determining that the security verification of the log file to be verified has failed.

[0091] Assuming the computation period to be verified is from 1 AM to 2 AM on a certain day, the verification device can obtain the log files to be verified and their corresponding root hashes from the second server. The log files to be verified refer to the log files generated by each node in the distributed service system during this computation period. Assuming there are 60 log files to be verified, the verification device can obtain the hash values ​​of these 60 log files and use these 60 hash values ​​as leaf nodes of a Merkle tree. Based on the leaf nodes, the root node of the Merkle tree is determined, and the hash value corresponding to the root node is used as the required comparison hash. The comparison hash is then compared with the reference hash obtained from the second server. If they match, it can be considered that the log files to be verified have not been tampered with, thus ensuring the integrity of the log files to be verified. If they do not match, it indicates that the log files to be verified may have been tampered with and are insecure. Subsequent handling is not restricted.

[0092] Figure 4 This is a flowchart of the third embodiment of the log file processing method described in this disclosure. Figure 4 As shown, the specific implementation methods are as follows.

[0093] In step 401, the first server obtains and stores the hash value sent by the node in the distributed service system. The hash value is the hash value of the log file generated using the log information generated during the splitting period when the node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met.

[0094] In step 402, in response to the node meeting the predetermined calculation conditions, the first server provides the hash values ​​of the log files generated by each node in the distributed service system during the calculation period to the node, so that the node can generate the root hash corresponding to the calculation period based on the obtained hash values. The calculation period is the time interval between the two most recent two consecutive times that the calculation conditions are met. The root hash is used by the verification device to perform security verification on the log files generated by each node during the corresponding calculation period.

[0095] Using the scheme described in the above method embodiments, root hashes corresponding to different computing time periods can be generated through a series of processes. Accordingly, the generated root hashes can be used to verify the log files generated by each node within the corresponding computing time period. If the verification fails, it can be known that the log files have been tampered with during transmission and / or storage. If the verification passes, it means that the log files are safe and can be used with confidence. In short, the security of log files is improved through the above processing.

[0096] Preferably, the first server may also assign a unique number to each generated log file, and use the number to identify each log file.

[0097] The primary server can be a Redis server. In practical applications, Redis's secure mode can be used, and additional encryption can be applied to data sent to the Redis server (such as hash values), especially on public networks. Furthermore, since Redis is in-memory storage, to save memory and prevent data loss, older data can be persisted. Redis only stores relatively new data, such as the hash values ​​of log files generated in the last month. Persistence methods can include Redis Database Backup (RDB) or Append Only File (AOF). Moreover, for high availability, Redis Sentinel or Redis Cluster mode can be used.

[0098] Figure 5 This is a flowchart of the fourth embodiment of the log file processing method described in this disclosure. Figure 5 As shown, the specific implementation methods are as follows.

[0099] In step 501, the second server obtains and stores the root hash sent by the nodes in the distributed service system. The root hash is the root hash corresponding to the calculation period generated when the node meets the predetermined calculation conditions, based on the hash value of the log files generated by each node in the distributed service system within the obtained calculation period. The calculation period is the time interval between the two most recent two consecutive times when the calculation conditions are met. The log file is the log file generated using the log information generated within the splitting period when each node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent two consecutive times when the splitting conditions are met.

[0100] In step 502, the second server receives the acquisition request sent by the verification device, and returns the log file to be verified corresponding to the acquisition request and the root hash of the log file to be verified to the verification device, so that the verification device can perform security verification on the log file to be verified based on the acquired root hash.

[0101] Using the scheme described in the above method embodiments, root hashes corresponding to different computing time periods can be generated through a series of processes. Accordingly, the generated root hashes can be used to verify the log files generated by each node within the corresponding computing time period. If the verification fails, it can be known that the log files have been tampered with during transmission and / or storage. If the verification passes, it means that the log files are safe and can be used with confidence. In short, the security of log files is improved through the above processing.

[0102] The second server can be an object storage server, which can store log files generated by each node as collected data, and root hashes corresponding to different calculation periods calculated by each node. In response to a request from the verification device, the log file to be verified and its corresponding root hash can be returned to the verification device so that the verification device can process the data according to the specified parameters. Figure 3 The method in the illustrated embodiment performs security verification on the log file to be verified based on the obtained root hash.

[0103] Preferably, for any given computation period, if the root hash generated by any node for that computation period is different from the same root hash generated by more than half of the other nodes for that computation period, that node can be identified as a problem node and the root hash generated by that node for that computation period can be discarded.

[0104] According to the processing method in this disclosure, for any given computation period, different nodes will calculate their respective root hashes. For example, assuming there are 10 nodes, 10 root hashes will be calculated. Ideally, these 10 root hashes should be identical. However, if most nodes calculate the same root hash, while a few nodes calculate different root hashes, these nodes can be considered problematic nodes, and their calculated root hashes can be discarded. This is equivalent to using the root hashes calculated by different nodes to mutually verify each other, thereby improving the accuracy of the calculated root hashes. The subsequent handling of problematic nodes is not restricted and can be determined according to actual needs.

[0105] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this disclosure. Secondly, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this disclosure. Furthermore, for parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0106] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0107] Figure 6 This is a schematic diagram of the structural composition of the first embodiment 600 of the log file processing device described in this disclosure. Figure 6 As shown, it includes: a segmentation module 601 and a calculation module 602.

[0108] The segmentation module 601 is used to generate a log file using the log information generated by the target node during the segmentation period in response to the fulfillment of predetermined segmentation conditions. The segmentation period is the time interval between the two most recent consecutive times that the segmentation conditions are met, and the target node is any node in the distributed service system.

[0109] The calculation module 602 is used to obtain the hash value of the log files generated by each node in the distributed service system within the calculation period in response to the fulfillment of predetermined calculation conditions. The calculation period is the time interval between the two most recent consecutive times that the calculation conditions are met. The root hash is generated according to the obtained hash value. The root hash is used to verify the security of the log files generated by each node within the corresponding calculation period.

[0110] Preferably, the segmentation module 601 determines that the segmentation condition is met after each first cycle duration, where the first cycle duration is equal to the duration of the segmentation period. The calculation module 602 determines that the calculation condition is met after each second cycle duration, where the second cycle duration is equal to the duration of the calculation period. In addition, the second cycle duration is M times the first cycle duration, where M is a positive integer greater than one.

[0111] Preferably, after the segmentation module 601 generates log files using the log information generated within the segmentation period, it can also obtain the hash value of the generated log files and store the hash value in the first server. Similarly, after the calculation module 602 generates the root hash corresponding to the calculation period based on each hash value, it can also store the root hash in the second server. Accordingly, when the calculation module 602 obtains the hash value of the log files generated by each node in the distributed service system within the calculation period, it can obtain the hash value of the log files generated by each node within the calculation period from the first server.

[0112] In addition, preferably, when the segmentation module 601 stores the obtained hash value in the first server, it can encrypt the hash value before storing it in the first server, and / or, when the calculation module 602 stores the obtained root hash in the second server, it can encrypt the root hash before storing it in the second server.

[0113] Preferably, the calculation module 602 generates the root hash corresponding to any calculation period based on the obtained hash values ​​in the following ways: taking each obtained hash value as a leaf node of a Merkle tree, determining the root node of the Merkle tree, i.e., the Merkle root, based on the leaf nodes, and taking the hash value corresponding to the root node as the root hash corresponding to the calculation period.

[0114] Preferably, the calculation module 602 can sort the obtained hash values ​​according to the log file numbers corresponding to each hash value in ascending order, with different log files corresponding to their own unique numbers, and can perform the following first process for each sorted hash value: forming a combination pair with each hash value in an odd position and the hash value that follows and is adjacent to it, generating a hash value corresponding to each combination pair based on the two hash values ​​included, and taking the hash value corresponding to the combination pair as the required root hash if the number of combination pairs is one; otherwise, repeating the first process for the hash value corresponding to each combination pair.

[0115] Alternatively, preferably, in response to determining that any hash value is in an odd position and there are no other hash values ​​after it, the calculation module 602 can form a combination pair with the hash value and itself.

[0116] Figure 7 This is a schematic diagram of the structural composition of the second embodiment 700 of the log file processing apparatus described in this disclosure. Figure 7 As shown, it includes: an acquisition module 701 and a verification module 702.

[0117] The acquisition module 701 is used to acquire the log file to be verified and the corresponding root hash. The log file to be verified is the log file generated by each node in the distributed service system during the computing period to be verified. The log file is generated by each node using the log information generated during the splitting period when each node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent two times when the splitting conditions are met. The root hash is the root hash corresponding to the computing period generated by each node based on the hash value of the log file generated by each node during the computing period when each node meets the predetermined computing conditions. The computing period is the time interval between the two most recent two times when the computing conditions are met.

[0118] The verification module 702 is used to perform security verification on the log file to be verified using the root hash corresponding to the log file to be verified.

[0119] Preferably, the verification module 702 uses the root hash corresponding to the log file to be verified to perform security verification on the log file to be verified in the following ways: using the obtained root hash corresponding to the log file to be verified as a reference hash, and generating the root hash corresponding to the log file to be verified in the same way as generating the reference hash, as a comparison hash; in response to the comparison hash being consistent with the reference hash, it is determined that the security verification of the log file to be verified has passed; in response to the comparison hash being inconsistent with the reference hash, it is determined that the security verification of the log file to be verified has failed.

[0120] Figure 8 This is a schematic diagram of the structural composition of the third embodiment 800 of the log file processing apparatus described in this disclosure. Figure 8 As shown, it includes: a first storage module 801 and a first processing module 802.

[0121] The first storage module 801 is used to obtain and store the hash value sent by the node in the distributed service system. The hash value is the hash value of the log file generated by the log information generated during the splitting period when the node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met.

[0122] The first processing module 802 is used to provide the hash values ​​of the log files generated by each node in the distributed service system during the calculation period to the node in response to the node meeting the predetermined calculation conditions. The node generates the root hash corresponding to the calculation period based on the obtained hash values. The calculation period is the time interval between the two most recent two consecutive times that the calculation conditions are met. The root hash is used by the verification device to perform security verification on the log files generated by each node during the corresponding calculation period.

[0123] Preferably, the first storage module 801 may also assign a unique number to each generated log file, and use the number to identify each log file.

[0124] Figure 9 This is a schematic diagram of the structural composition of the fourth embodiment 900 of the log file processing apparatus described in this disclosure. Figure 9 As shown, it includes: a second storage module 901 and a second processing module 902.

[0125] The second storage module 901 is used to obtain and store the root hash sent by the nodes in the distributed service system. The root hash is the root hash generated by the nodes when they meet the predetermined calculation conditions, based on the hash values ​​of the log files generated by each node in the distributed service system within the obtained calculation period, and the calculation period is the time interval between the two most recent two times when the calculation conditions are met. The log file is the log file generated by each node when they meet the predetermined splitting conditions, using the log information generated within the splitting period. The splitting period is the time interval between the two most recent two times when the splitting conditions are met.

[0126] The second processing module 902 is used to obtain the acquisition request sent by the verification device, and return the log file to be verified corresponding to the acquisition request and the root hash of the log file to be verified to the verification device, so that the verification device can perform security verification on the log file to be verified based on the obtained root hash.

[0127] Preferably, for any computing period, the second storage module 901 can identify a node as a problem node and discard the root hash generated by that node for that computing period if the root hash generated by any node for that computing period is different from the same root hash generated by more than half of the other nodes for that computing period.

[0128] Figure 10 This is a schematic diagram of the structural composition of an embodiment 1000 of the log file processing system described in this disclosure. Figure 10 As shown, it includes: a first log file processing device 1001, a second log file processing device 1002, a third log file processing device 1003, and a fourth log file processing device 1004, wherein the first log file processing device 1001 may be... Figure 6 The log file processing device 600 shown is a node in the distributed service system, and the second log file processing device 1002 can be... Figure 7 The log file processing device 700 shown is the verification device, and the third log file processing device 1003 can be... Figure 8 The log file processing device 800 shown is the first server, and the fourth log file processing device 1004 may be... Figure 9 The log file processing device 900 shown is the second server.

[0129] The specific workflow of the above-described apparatus and system embodiments can be found in the relevant descriptions in the foregoing method embodiments, and will not be repeated hereafter.

[0130] In summary, by adopting the scheme described in the above-mentioned device and system embodiments, root hashes corresponding to different computing time periods can be generated through a series of processes. Accordingly, the generated root hashes can be used to verify the log files generated by each node within the corresponding computing time period. If the verification fails, it can be known that the log files have been tampered with during transmission and / or storage. If the verification passes, it indicates that the log files are safe and can be used with confidence. In short, the security of log files is improved through the above processing.

[0131] The solutions described in this disclosure can be applied to the field of artificial intelligence, particularly in areas such as distributed storage, cloud computing, and information security. Artificial intelligence is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It involves both hardware and software technologies. Artificial intelligence hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. Artificial intelligence software technologies mainly include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0132] The log files and other similar documents described in this disclosure are not specific to any particular user and do not reflect the personal information of any particular user. The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solutions of this disclosure all comply with relevant laws and regulations and do not violate public order and good morals.

[0133] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0134] Figure 11 A schematic block diagram of an electronic device 1100 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0135] like Figure 11As shown, device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in read-only memory (ROM) 1102 or a computer program loaded from storage unit 1108 into random access memory (RAM) 1103. The RAM 1103 may also store various programs and data required for the operation of device 1100. The computing unit 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. Input / output (I / O) interface 1105 is also connected to bus 1104.

[0136] Multiple components in device 1100 are connected to I / O interface 1105, including: input unit 1106, such as keyboard, mouse, etc.; output unit 1107, such as various types of monitors, speakers, etc.; storage unit 1108, such as disk, optical disk, etc.; and communication unit 1109, such as network card, modem, wireless transceiver, etc. Communication unit 1109 allows device 1100 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0137] The computing unit 1101 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above, such as those described in this disclosure. For example, in some embodiments, the methods described in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program can be loaded and / or installed on device 1100 via ROM 1102 and / or communication unit 1109. When the computer program is loaded into RAM 1103 and executed by the computing unit 1101, one or more steps of the methods described in this disclosure can be performed. Alternatively, in other embodiments, the computing unit 1101 can be configured to perform the methods described in this disclosure by any other suitable means (e.g., by means of firmware).

[0138] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0140] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0141] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0142] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0143] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0144] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0145] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A log file processing method, comprising: In response to meeting the predetermined splitting conditions, the target node generates a log file using the log information generated during the splitting period. The splitting period is the time interval between the two most recent consecutive times that the splitting conditions are met. The target node is any node in the distributed service system. In response to meeting predetermined computation conditions, the target node obtains the hash values ​​of log files generated by each node in the distributed service system within the computation period. The computation period is the time interval between the two most recent consecutive times that the computation conditions are met. Based on the obtained hash values, the target node generates a root hash corresponding to the computation period and stores the root hash in a second server. The root hash is used by the verification device to perform security verification on the log files generated by each node within the corresponding computation period. The second server is also used to: for any computation period, in response to any node generating a root hash for the computation period that is different from the same root hash generated by more than half of the other nodes for the computation period, identify the node as a problem node and discard the root hash generated by the node for the computation period.

2. The method according to claim 1, wherein, The predetermined segmentation condition includes: determining that the segmentation condition is met in response to the passage of a first cycle duration, wherein the first cycle duration is equal to the duration of the segmentation period; The predetermined calculation conditions include: in response to the passage of a second cycle duration, it is determined that the calculation conditions are met, wherein the second cycle duration is equal to the duration of the calculation period, and the second cycle duration is M times the duration of the first cycle duration, where M is a positive integer greater than one.

3. The method according to claim 1 or 2, further comprising: After generating a log file using the log information generated within the segmented time period, the hash value of the log file is obtained and stored in the first server; The step of obtaining the hash value of the log file generated by each node in the distributed service system during the computing period includes: obtaining the hash value of the log file generated by each node during the computing period from the first server.

4. The method according to claim 3, wherein, The step of storing the hash value in the first server includes: encrypting the hash value and then storing it in the first server; And / or, storing the root hash in the second server includes: encrypting the root hash and then storing it in the second server.

5. The method according to claim 1 or 2, wherein, The step of generating the root hash corresponding to the calculation period based on the obtained hash value includes: Each obtained hash value is used as a leaf node of the Merkle tree. Based on the leaf nodes, the root node of the Merkle tree is determined, and the hash value corresponding to the root node is used as the root hash.

6. The method according to claim 5, wherein, The step of determining the root node of the Merkle tree based on the leaf nodes and using the hash value corresponding to the root node as the root hash includes: The hash values ​​are sorted in ascending order of the log file numbers corresponding to each hash value, with each log file corresponding to its own unique number. For each sorted hash value, the following first process is performed: each hash value in an odd position is combined with the hash value that follows and is adjacent to it to form a pair. Based on the two hash values ​​included, a hash value corresponding to each pair is generated. If the number of pairs is one, the hash value corresponding to the pair is used as the root hash. Otherwise, the first process is repeated for the hash value corresponding to each pair.

7. The method according to claim 6, further comprising: In response to determining that any hash value is in an odd position and there are no other hash values ​​after it, the hash value is combined with itself to form a pair.

8. A log file processing method, comprising: The verification device obtains the log file to be verified and the corresponding root hash. The log file to be verified is the log file generated by each node in the distributed service system during the computation period to be verified. The log file is generated by each node using the log information generated during the partitioning period when each node meets the predetermined partitioning conditions. The partitioning period is the time interval between the two most recent adjacent times when the partitioning conditions are met. The root hash is the root hash generated by each node based on the hash value of the log file generated by each node during the computation period when each node meets the predetermined computation conditions. The computation period is the time interval between the two most recent adjacent times when the computation conditions are met. The root hash is obtained from a second server. The second server is further configured to: for any computation period, in response to any node generating a root hash for the computation period that is different from the same root hash generated by more than half of the other nodes for the computation period, identify the node as a problem node and discard the root hash generated by the node for the computation period. The verification device uses the root hash corresponding to the log file to be verified to perform security verification on the log file to be verified.

9. The method according to claim 8, wherein, The step of performing security verification on the log file to be verified using the root hash corresponding to the log file to be verified includes: The root hash corresponding to the log file to be verified is obtained and used as a reference hash. The root hash corresponding to the log file to be verified is generated in the same way as the reference hash, and used as a comparison hash. If the comparison hash matches the reference hash, the security check on the log file to be checked is determined to be successful; if the comparison hash does not match the reference hash, the security check on the log file to be checked is determined to be unsuccessful.

10. A log file processing method, comprising: The first server obtains and stores the hash value sent by the node in the distributed service system. The hash value is the hash value of the log file generated by the node using the log information generated during the splitting period when the node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met. In response to a node meeting predetermined computation conditions, the first server provides the node with the hash values ​​of log files generated by each node in the distributed service system during the computation period. The node then generates a root hash corresponding to the computation period based on the obtained hash values. The computation period is the time interval between the two most recent consecutive times the computation conditions are met. The root hash is used by a verification device to perform security checks on the log files generated by each node during the corresponding computation period. The root hash is stored in a second server. The second server is further configured to: for any computation period, if the root hash generated by any node for that computation period differs from the same root hash generated by more than half of the other nodes for that computation period, identify that node as a problematic node and discard the root hash generated by that node for that computation period.

11. The method of claim 10, further comprising: The first server assigns a unique number to each generated log file, and uses the number to identify each log file.

12. A log file processing method, comprising: The second server obtains and stores the root hash sent by the nodes in the distributed service system. The root hash is the root hash of the calculation period generated by the nodes when the nodes meet the predetermined calculation conditions, based on the hash values ​​of the log files generated by each node in the distributed service system within the obtained calculation period. The calculation period is the time interval between the two most recent two consecutive times when the calculation conditions are met. The log file is the log file generated by each node when the nodes meet the predetermined splitting conditions, using the log information generated within the splitting period. The splitting period is the time interval between the two most recent two consecutive times when the splitting conditions are met. The second server receives the acquisition request sent by the verification device, and returns to the verification device the log file to be verified corresponding to the acquisition request and the root hash corresponding to the log file to be verified, so that the verification device can perform security verification on the log file to be verified based on the acquired root hash. It also includes: for any computing period, in response to any node generating a root hash for the computing period that is different from the same root hash generated by more than half of the other nodes for the computing period, the second server identifies the node as a problem node and discards the root hash generated by the node for the computing period.

13. A log file processing apparatus, comprising: Segmentation module and calculation module; The segmentation module is used to generate a log file using the log information generated by the target node during the segmentation period in response to the fulfillment of the predetermined segmentation conditions. The segmentation period is the time interval between the two most recent two consecutive times that the segmentation conditions are met. The target node is any node in the distributed service system. The calculation module is configured to, in response to meeting predetermined calculation conditions, obtain the hash values ​​of log files generated by each node in the distributed service system within a calculation period, wherein the calculation period is the time interval between the two most recent consecutive times the calculation conditions are met; generate a root hash corresponding to the calculation period based on the obtained hash values; and store the root hash in a second server. The root hash is used by the verification device to perform security verification on the log files generated by each node within the corresponding calculation period. The second server is further configured to: for any calculation period, in response to any node generating a root hash for the calculation period that is different from the same root hash generated by more than half of the other nodes for the calculation period, identify the node as a problematic node and discard the root hash generated by the node for the calculation period.

14. The apparatus according to claim 13, wherein, The segmentation module determines that the segmentation condition is met after each first cycle duration, where the first cycle duration is equal to the duration of the segmentation period. The calculation module determines that the calculation conditions are met after each second cycle duration. The second cycle duration is equal to the duration of the calculation period, and the second cycle duration is M times the duration of the first cycle duration, where M is a positive integer greater than one.

15. The apparatus according to claim 13 or 14, wherein, The segmentation module is further configured to, after generating a log file using the log information generated by the target node during the segmentation period, obtain the hash value of the log file and store the hash value in the first server; The computing module obtains the hash values ​​of the log files generated by each node during the computing period from the first server.

16. The apparatus according to claim 15, wherein, The segmentation module is further used to encrypt the hash value and store it in the first server; And / or, the computing module is further configured to encrypt the root hash and store it in the second server.

17. The apparatus according to claim 13 or 14, wherein, The calculation module uses each hash value obtained as a leaf node of the Merkle tree, determines the root node of the Merkle tree based on the leaf nodes, and uses the hash value corresponding to the root node as the root hash.

18. The apparatus according to claim 17, wherein, The calculation module sorts the obtained hash values ​​according to the log file numbers corresponding to each hash value in ascending order. Different log files correspond to their own unique numbers. For each sorted hash value, the following first process is performed: each hash value in an odd position is combined with the hash value that follows and is adjacent to it to form a pair. Based on the two hash values ​​included, a hash value corresponding to each pair is generated. If the number of pairs is one, the hash value corresponding to the pair is used as the root hash. Otherwise, the first process is repeated for the hash value corresponding to each pair.

19. The apparatus according to claim 18, wherein, The calculation module is further configured to, in response to determining that any hash value is in an odd position and there are no other hash values ​​after it, form a combination pair between the hash value and itself.

20. A log file processing apparatus, comprising: Acquisition module and verification module; The acquisition module is used to acquire the log file to be verified and the corresponding root hash. The log file to be verified is the log file generated by each node in the distributed service system during the computing period to be verified. The log file is generated by each node using the log information generated during the splitting period when each node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent two times when the splitting conditions are met. The root hash is the root hash generated by each node based on the hash value of the log file generated by each node during the computing period and the acquired computing conditions when each node meets the predetermined computing conditions. The computing period is the time interval between the two most recent two times when the computing conditions are met. The root hash is acquired from the second server. The second server is also used to: for any computing period, in response to any node generating a root hash for the computing period that is different from the same root hash generated by more than half of the other nodes for the computing period, identify the node as a problem node and discard the root hash generated by the node for the computing period. The verification module is used to perform security verification on the log file to be verified using the root hash corresponding to the log file to be verified.

21. The apparatus according to claim 20, wherein, The verification module uses the root hash corresponding to the log file to be verified as a reference hash, and generates the root hash corresponding to the log file to be verified in the same way as generating the reference hash, as a comparison hash. In response to the comparison hash being consistent with the reference hash, it determines that the security verification of the log file to be verified has passed; in response to the comparison hash being inconsistent with the reference hash, it determines that the security verification of the log file to be verified has failed.

22. A log file processing apparatus, comprising: A first storage module and a first processing module; The first storage module is used to obtain and store the hash value sent by the node in the distributed service system. The hash value is the hash value of the log file generated by the node using the log information generated during the splitting period when the node meets the predetermined splitting conditions. The splitting period is the time interval between the two most recent adjacent times when the splitting conditions are met. The first processing module is configured to, in response to the node meeting predetermined computation conditions, provide the node with the hash values ​​of log files generated by each node in the distributed service system during the computation period, so that the node can generate a root hash corresponding to the computation period based on the obtained hash values. The computation period is the time interval between the two most recent consecutive times that the computation conditions are met. The root hash is used by the verification device to perform security verification on the log files generated by each node during the corresponding computation period. The root hash is stored in a second server. The second server is further configured to: for any computation period, in response to any node generating a root hash for the computation period that is different from the same root hash generated by more than half of the other nodes for the computation period, identify the node as a problem node and discard the root hash generated by the node for the computation period.

23. The apparatus according to claim 22, wherein, The first storage module is further configured to assign a unique number to each generated log file, and use the number to identify each log file.

24. A log file processing apparatus, comprising: The second storage module and the second processing module; The second storage module is used to obtain and store the root hash sent by the nodes in the distributed service system. The root hash is the root hash of the calculation period generated by the nodes when the nodes meet the predetermined calculation conditions, based on the hash value of the log files generated by each node in the distributed service system within the obtained calculation period. The calculation period is the time interval between the two most recent two consecutive times when the calculation conditions are met. The log file is the log file generated by each node when the nodes meet the predetermined splitting conditions, using the log information generated within the splitting period. The splitting period is the time interval between the two most recent two consecutive times when the splitting conditions are met. The second processing module is used to obtain an acquisition request sent by the verification device, and return to the verification device the log file to be verified corresponding to the acquisition request and the root hash corresponding to the log file to be verified, so that the verification device can perform security verification on the log file to be verified based on the obtained root hash. The second storage module is further configured to, for any computing period, in response to any node generating a root hash for the computing period that is different from the same root hash generated by more than half of the other nodes for the computing period, identify the node as a problem node and discard the root hash generated by the node for the computing period.

25. A log file processing system, comprising: The apparatus as described in any one of claims 13-19, the apparatus as described in any one of claims 20-21, the apparatus as described in any one of claims 22-23, and the apparatus as described in claim 24.

26. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-12.

27. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-12.

28. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the method of any one of claims 1-12.

Images