System, method and computer device for data audit queries
By employing a three-host architecture and multi-process deployment of the DPDK framework, the problem of slow data auditing and querying speed in high-security cross-network switching scenarios of bidirectional optical gateways was solved, enabling fast data storage and retrieval and improving user experience.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2023-12-27
- Publication Date
- 2026-08-04
AI Technical Summary
In existing technologies, bidirectional optical shutters have relatively low data auditing and query speeds in high-security cross-network switching scenarios.
It adopts a three-host architecture consisting of a sending host, a data audit host, and a receiving host, combined with the multi-process deployment of the DPDK framework. The data processing engine parses and stores private protocol messages, and the audit query engine enables fast querying.
It improves data storage security and query speed, enhancing the user experience.
Smart Images
Figure CN117793220B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and more specifically to a system, method, and computer device for data auditing and querying. Background Technology
[0002] A bidirectional optical gateway (hereinafter referred to as the gateway) is deployed between networks of different security levels, enabling cross-network and cross-domain data transmission through physical logical isolation cards. The hardware architecture of a bidirectional optical gateway typically adopts a 2+1 architecture, consisting of a transmitting host, a receiving host, and a bidirectional isolation component. The bidirectional isolation component comprises two isolation cards connected by optical fibers. The transmitting and receiving hosts run network proxy programs and security engines, forming the software architecture. This hardware and software architecture together create a secure host, which ultimately provides cross-network and cross-domain data transmission services.
[0003] The bidirectional optical gateway's transmitting and receiving hosts employ proxy technology to receive and transmit network data from both ends of the device. This offloads data below the network layer, extracts application protocols and data using application protocol filtering, performs security checks on the data, and encapsulates secure data using a proprietary protocol. Through an isolation component between the two hosts, cross-network and cross-domain data transmission is achieved. Both the transmitting and receiving hosts of the bidirectional optical gateway can provide security auditing functions, typically using databases or files to store administrator operation logs and logs related to network connections, authentication, data transmission, and security checks. These logs can be queried through management systems such as web applications. The database or files are usually stored on the device's hard drive. However, in high-security cross-network exchange scenarios, it is necessary to audit not only log information but also the transmitted raw data; therefore, existing technologies suffer from slow query speeds. Summary of the Invention
[0004] The purpose of this application is to provide a system, method, and computer device for data auditing and querying, in order to solve the problem of low query speed in existing data auditing and querying devices.
[0005] To achieve the above objectives, the first aspect of this application provides a system for data auditing and querying, comprising:
[0006] The sending host is configured to encapsulate the received message to obtain a private protocol message.
[0007] The data audit host communicates with the sending host, including:
[0008] The data processing engine is configured to parse and process the private protocol message received from the sending host to obtain the target information, and then store the target information.
[0009] The audit query engine is configured to query the stored target information based on the query command when a query command is received.
[0010] In this embodiment of the application, the sending host includes: a security engine configured to perform security checks on the message to obtain the target data; and a proxy engine configured to add a data storage identifier field in the private protocol and encapsulate the target data using the private protocol to obtain a private protocol message.
[0011] In this embodiment, the data processing engine includes: a private protocol processing module configured to parse the private protocol to extract target information from the private protocol message, wherein the target information includes target data, network connection information and first log information; send the target data and network connection information to a first lockless circular queue, and send the first log information to a second lockless circular queue.
[0012] In this embodiment of the application, the data processing engine further includes: a data storage module, configured to read target data and network connection information from a first locked circular queue, and store the target data in a target file according to the network connection information; when the network connection is closed or data storage ends, construct a data log based on the target file information, network connection information and private protocol information to obtain second log information; and send the second log information to a third unlockless circular queue.
[0013] In this embodiment of the application, the data processing engine further includes a log storage module, configured to read the first log information and the second log information from the second lock ring queue and the third lock ring queue respectively, and store the first log information and the second log information in the database.
[0014] In this embodiment of the application, the system further includes: a receiving host, configured to receive private protocol messages sent by the data audit host, process the private protocol messages and send them to the target device.
[0015] In this embodiment of the application, the query commands include: query log command, query network connection and associated file command, and query connection and associated file data content command.
[0016] A second aspect of this application provides a method for data audit query, applied to a data audit host, the method comprising:
[0017] Receive private protocol messages sent by the sending host, where the private protocol messages are obtained by the sending host after receiving the messages;
[0018] The private protocol messages are parsed and processed to obtain the target information, and the target information is then stored.
[0019] Upon receiving a query command, the system queries the stored target information according to the query command.
[0020] A third aspect of this application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method for data auditing and querying.
[0021] A fourth aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to execute the method for data auditing queries described above.
[0022] The above technical solution provides a system for data auditing and querying, including a sending host configured to encapsulate a received message to obtain a private protocol message; a data auditing host communicating with the sending host, including a data processing engine configured to parse the private protocol message received from the sending host to obtain target information and store the target information; and an auditing query engine configured to query the stored target information according to a query command received. This application stores data on the auditing host, improving data storage security. Simultaneously, the use of a data processing engine and an auditing query engine enables fast data storage and querying, improving the user experience.
[0023] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description
[0024] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:
[0025] Figure 1 The diagram illustrates the architecture of a system for data auditing queries according to an embodiment of this application.
[0026] Figure 2 This illustration schematically shows an architecture diagram of a system for data auditing queries according to another embodiment of this application;
[0027] Figure 3 The flowchart illustrating a method for data audit query according to an embodiment of this application is shown schematically.
[0028] Explanation of reference numerals in the attached figures
[0029] 100 Sending Host 200 Data Audit Host
[0030] 300 Receiver Host 110 Sender Host Proxy Engine
[0031] 120 Sender Host Security Engine 130 Sender Host Operating System
[0032] 210 Data Processing Engine 220 Audit Query Engine
[0033] 211 Private Protocol Processing Module 212 Data Storage Module
[0034] 213 Log storage module; 310 Receiver host proxy engine
[0035] 320 Receiver Host Security Engine 330 Receiver Host Operating System Detailed Implementation
[0036] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.
[0037] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.
[0038] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.
[0039] Figure 1 This diagram schematically illustrates the architecture of a system for data auditing queries according to an embodiment of this application. Figure 1As shown in the embodiment of this application, a system for data auditing and querying is provided, which may include:
[0040] The sending host 100 is configured to encapsulate the received message to obtain a private protocol message.
[0041] Data audit host 200 communicates with sending host 100, including:
[0042] The data processing engine 210 is configured to parse and process the private protocol message received from the sending host 100 to obtain target information and store the target information.
[0043] The audit query engine 220 is configured to query the stored target information based on the query command when a query command is received.
[0044] The system for data auditing and querying in this embodiment adopts a three-host architecture (sending host, security audit host, and receiving host) plus a four-way isolation card architecture. The security audit host is configured with: ≥32GB of memory, 8TB total hard drive capacity (8TB SSD), ≥2 hard drives, RAID support, two integrated two-way isolation cards, and a domestically produced 8-core CPU. Compared to existing data review devices, this embodiment uses a large-capacity hard drive to improve data storage capacity. The security audit host 200 communicates with both the sending host 100 and the receiving host via the two-way isolation cards. The security audit host 200 uses the DPDK framework to handle protocol parsing and forwarding, while simultaneously extracting and storing data. The security audit host 200 mainly includes a data processing engine 210 and an audit query engine 220 to provide key data auditing functions. The sending host 100 and the receiving host are connected to different networks, which can provide network security, data security, application proxy and other related functions. When the operating system records logs, it sends the data to the data audit host 200 through the original interface and notifies the security audit host 200 to store the original data by adding a data storage identification field to the private protocol.
[0045] Specifically, when the sending host 100 receives a message, it first performs a security check on the received message, then encapsulates the message after the security check to obtain a private protocol message, and sends it to the data audit host 200. After receiving the private protocol message from the sending host 100, the data audit host 200 parses and processes it using the data processing engine 210 before sending it to the receiving host. Since the data processing engine 210 adopts a multi-process deployment using the DPDK framework and integrates private protocol processing, data storage, and log storage modules, it can execute different module business functions according to parameters when its processes are running. In this embodiment, after the data audit host 200 receives the private protocol message from the sending host 100, the data processing engine 210 activates the private protocol processing process to parse and process the private protocol message to obtain the target information, and then activates the data storage process and the log storage process to store the target information. Using the data processing engine 210 enables fast data storage, and storing the data on the data audit host 200 improves data storage security.
[0046] When data needs to be queried, the Web management system sends a query command to the data audit host 200. Upon receiving the query command, the audit query engine 220 in the data audit host 200 first parses the parameters in the query command, then queries the stored target information according to the query command, and sends the query results to the Web management system via WebSocket. Through the audit query engine 220, fast data retrieval can be achieved, thereby improving the user experience.
[0047] The above technical solution provides a system for data auditing and querying, including a sending host configured to encapsulate a received message to obtain a private protocol message; a data auditing host communicating with the sending host, including a data processing engine configured to parse the private protocol message received from the sending host to obtain target information and store the target information; and an auditing query engine configured to query the stored target information according to a query command received. This application stores data on the auditing host, improving data storage security. Simultaneously, the use of a data processing engine and an auditing query engine enables fast data storage and querying, improving the user experience.
[0048] Figure 2 An architectural diagram of a system for data auditing queries according to another embodiment of this application is illustrated schematically. Figure 2As shown in this embodiment, the sending host 100 includes: a security engine 110, configured to perform security checks on packets to obtain target data; and a proxy engine 120, configured to add a data storage identifier field to a private protocol and encapsulate the target data using the private protocol to obtain a private protocol packet.
[0049] Specifically, the sending host 100 is equipped with a security engine 110, a proxy engine 120, and an operating system 130. The security engine 110 performs security checks on the packets. The proxy engine 120 then encapsulates the security-checked data (the target data) using a private protocol to obtain a private protocol packet, which is then sent to the data audit host via a two-way isolation card. The proxy engine 120 also adds a data storage identifier field to the private protocol to notify the data audit host 200 to store the target data. Log information generated by the operating system 130 during the security check and packet encapsulation process is also synchronously sent to the data audit host 200.
[0050] like Figure 2 As shown in this embodiment, the data processing engine 210 includes: a private protocol processing module 211, configured to parse the private protocol to extract target information from the private protocol message, wherein the target information includes target data, network connection information and first log information; send the target data and network connection information to a first lockless circular queue, and send the first log information to a second lockless circular queue.
[0051] Specifically, the data processing engine 210 adopts a multi-process deployment based on the DPDK framework to realize the reception and transmission of private protocol messages. It also integrates a private protocol processing module 211, a data storage module 212, and a log storage module 213. When the data processing engine process runs, it executes the business functions of different modules according to parameters. For example, it can run the functions of receiving, processing, and sending private protocol messages according to parameters, with the process name being "Private Protocol Processing Process." It can also run the data storage module function according to parameters, with the process name being "Data Storage Process," and it can also run the log storage module function according to parameters, with the process name being "Log Storage Process." Therefore, when the data audit host receives a private protocol message, the private protocol processing process of the data processing engine 210 starts running. The private protocol processing module 211 parses the private protocol to extract target data, network connection information, and first log information, which is the business log information generated by the operating system 130 of the sending host 100. The private protocol processing process also establishes a first lock-free circular queue and a second lock-free circular queue for communication with the data storage process and the log storage process, respectively. Then, the target data and network connection information are sent to the data storage process through the first lock-free circular queue; the first log information is sent to the log storage process through the second lock-free circular queue.
[0052] like Figure 2 As shown in this embodiment, the data processing engine 210 further includes a data storage module 212, configured to read target data and network connection information from a first locked circular queue, and store the target data in a target file according to the network connection information. The file used to store the data is associated with the database through the network connection information. When the network connection is closed or data storage ends, a data log is constructed based on the target file information, network connection information, and private protocol information to obtain second log information; the second log information is then sent to a third unlockless circular queue.
[0053] Specifically, when the data storage processing process of the data processing engine 210 starts running, the data storage module 212 performs the data storage function. The data storage module 212 reads the target data and network connection information from the first locked circular queue, and then stores the target data into the target file according to the network connection information. When the network connection is closed or data storage ends, a data log is constructed based on the target file information, network connection information, and private protocol information to obtain log information, namely the second log information, and then the second log information is sent to the third unlockless circular queue.
[0054] like Figure 2As shown in the embodiment of this application, the data processing engine 210 further includes a log storage module 213, which is configured to read the first log information and the second log information from the second lock ring queue and the third lock ring queue respectively, and store the first log information and the second log information in the database.
[0055] Specifically, when the log storage processing process of the data processing engine 210 starts running, the log storage module 213 performs the log storage function. The log storage module 213 reads the first log information and the second log information from the second lock ring queue and the third lock ring queue, respectively, and then stores the first log information and the second log information into the database.
[0056] like Figure 2 As shown in the embodiment of this application, the system further includes: a receiving host 300, configured to receive private protocol messages sent by the data audit host 200, process the private protocol messages and send them to the target device.
[0057] Specifically, the system for data auditing and querying in this embodiment further includes a receiving host 300, which has the same structure as the sending host 100. The receiving host 300 is equipped with a security engine 310, a proxy engine 320, and an operating system 330. After receiving a private protocol message, the data auditing host 200 parses the protocol through the private protocol processing process of the data processing engine 210, extracts information such as target data and network connections, and then sends it to the data storage process through a lockless circular queue. Finally, the private protocol message is sent to the receiving host 300 through a bidirectional isolation card. Upon receiving the private protocol message, the receiving host processes it through modules such as the security engine 310 and the proxy engine module 320 before sending it to the target. The processing procedure is the same as that of the sending host 100.
[0058] In this embodiment of the application, the query commands include: query log command, query network connection and associated file command, and query connection and associated file data content command.
[0059] Specifically, the query commands sent by the Web management system to the data audit host 200 can be mainly divided into three categories: query log commands, query network connections and associated files commands, and query connection and associated file data content commands. When the audit query engine 220 in the data audit host 200 receives the query command, it first parses the parameters in the query command, then queries the stored target information according to the query command, and sends the query results to the Web management system via WebSocket.
[0060] In one example, when the query command is to query logs, the audit query engine 220 parses the parameters in the query command, which are the time periods of the logs to be queried. Then, it queries the database for relevant log data and sends the relevant data to the web management system via WebSocket.
[0061] In another example, when the query command is to query network connection and associated file information, the audit query engine 220 parses the parameters, which can be the network name to be queried, etc., and then queries the database for network connection and associated file information, and feeds the information back to the web management system via WebSocket, while sending the file data to the web management system.
[0062] In another example, when the query command is to query the connection and associated file data content, the audit query engine 220 parses the parameters, then queries the database for information such as network connections and associated files, uses multi-pattern matching and regular expression fusion technology to search for keywords in the files, and feeds the results back to the web management system via WebSocket.
[0063] Figure 3 A flowchart illustrating a method for data audit query according to an embodiment of this application is shown schematically. Figure 3 As shown in the embodiment of this application, a method for data audit query is provided, applied to a data audit host. The method may include the following steps:
[0064] Step S301: Receive the private protocol message sent by the sending host, wherein the private protocol message is obtained by the sending host encapsulating the message after receiving it.
[0065] Step S302: Parse and process the private protocol message to obtain the target information, and store the target information.
[0066] Step S303: Upon receiving a query command, query the stored target information according to the query command.
[0067] Specifically, when the sending host receives a message, it first performs a security check on the received message, then encapsulates the message to obtain a private protocol message, and sends it to the data audit host. After receiving the private protocol message from the sending host, the data audit host uses its data processing engine to parse and process it before sending it to the receiving host. Since the data processing engine adopts a multi-process deployment using the DPDK framework and integrates private protocol processing, data storage, and log storage modules, it can execute the business functions of different modules according to parameters when its processes are running. In this embodiment, after the data audit host receives the private protocol message from the sending host, the data processing engine enables private protocol processing to parse and process the message to obtain the target information, and then enables the data storage process and the log storage process to store the target information. Using a data processing engine enables rapid data storage, and storing the data on the data audit host improves data storage security.
[0068] When data queries are needed, the web management system sends a query command to the data audit host. Upon receiving the query command, the audit query engine on the data audit host first parses the parameters in the query command, then queries the stored target information according to the query command, and sends the query results to the web management system via WebSocket. Through the audit query engine 220, fast data retrieval can be achieved, thereby improving the user experience.
[0069] This application provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method for data auditing and querying.
[0070] Specifically, in this embodiment of the application, the processor can be configured to: receive a private protocol message sent by a sending host, wherein the private protocol message is obtained by the sending host encapsulating the message after receiving it; parse the private protocol message to obtain target information and store the target information; and, upon receiving a query command, query the stored target information according to the query command.
[0071] The above technical solution provides a system for data auditing and querying, including a sending host configured to encapsulate a received message to obtain a private protocol message; a data auditing host communicating with the sending host, including a data processing engine configured to parse the private protocol message received from the sending host to obtain target information and store the target information; and an auditing query engine configured to query the stored target information according to a query command received. This application stores data on the auditing host, improving data storage security. Simultaneously, the use of a data processing engine and an auditing query engine enables fast data storage and querying, improving the user experience.
[0072] This application also provides a machine-readable storage medium storing instructions that cause a machine to execute the above-described method for data auditing and querying.
[0073] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0074] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0075] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0077] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0078] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0079] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0080] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0081] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A system for data auditing and querying, characterized in that, include: The sending host is configured to encapsulate the received message to obtain a private protocol message. The data audit host communicates with the sending host, including: The data processing engine is configured to, upon receiving a private protocol message sent by the sending host, parse and process the private protocol message to obtain target information, and store the target information; The audit query engine is configured to, upon receiving a query command, query the stored target information according to the query command. The data processing engine in the data audit host includes: A private protocol processing module is configured to parse a private protocol to extract the target information from the private protocol message, wherein the target information includes target data, network connection information, and first log information; The target data and the network connection information are sent to a first lock-free circular queue, and the first log information is sent to a second lock-free circular queue. Then, the target data and network connection information are sent to the data storage process through the first lock-free circular queue, and the first log information is sent to the log storage process through the second lock-free circular queue.
2. The system according to claim 1, characterized in that, The sending host includes: A security engine is configured to perform security checks on the message to obtain the target data; The proxy engine is configured to add a data storage identifier field to the private protocol and encapsulate the target data using the private protocol to obtain the private protocol message.
3. The system according to claim 1, characterized in that, The data processing engine also includes: The data storage module is configured to read the target data and the network connection information from the first lockless circular queue, and store the target data into a target file according to the network connection information; When the network connection is closed or data storage is terminated, a data log is constructed based on the target file information, the network connection information, and the private protocol information to obtain the second log information; The second log information is sent to the third lock-free circular queue.
4. The system according to claim 3, characterized in that, The data processing engine also includes: The log storage module is configured to read the first log information and the second log information from the second lockless circular queue and the third lockless circular queue, respectively, and store the first log information and the second log information into the database.
5. The system according to claim 1, characterized in that, The system also includes: The receiving host is configured to receive the private protocol message sent by the data audit host, process the private protocol message, and then send it to the target device.
6. The system according to claim 1, characterized in that, The query commands include: Commands for querying logs, querying network connections and associated files, and querying the data content of connections and associated files.
7. A method for data audit query, applied to a data audit host, characterized in that, The method includes: Receive a private protocol message sent by the sending host, wherein the private protocol message is obtained by the sending host encapsulating the message after receiving it; The private protocol message is parsed to obtain target information, and the target data and network connection information in the target information are sent to the first lockless ring queue, and the first log information in the target information is sent to the second lockless ring queue. Then, the target data and network connection information are sent to the data storage process through the first lockless ring queue, and the first log information is sent to the log storage process through the second lockless ring queue. Upon receiving a query command, the stored target information is queried according to the query command.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method for data auditing query as described in claim 7.
9. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the method for data auditing queries as described in claim 7.