Lightweight data transaction monitoring method, apparatus, device, and storage medium

Abstract

The application provides a lightweight data transaction monitoring method, device, equipment and storage medium, wherein the method comprises: determining a to-be-audited object; obtaining a stored evidence audit log of the to-be-audited object, and matching an original audit log of the to-be-audited object based on the stored evidence audit log, wherein the stored evidence audit log is obtained by inserting tamper-proof content into the original audit log based on a tamper-proof content use strategy, and the tamper-proof content use strategy and the tamper-proof content are determined by an audit system; and performing data transaction monitoring on the to-be-audited object based on the original audit log. The method, device, equipment and storage medium provided by the application can avoid the situation of forging the content of the to-be-audited object, thereby ensuring the credibility of data transaction monitoring. Moreover, only the stored evidence audit log needs to be stored in the audit system, so that the lightweight data transaction monitoring is realized, and the information leakage of the original audit log is avoided.

Description

Technical Field

[0001] This invention relates to the field of data transaction monitoring technology, and in particular to a lightweight data transaction monitoring method, apparatus, device, and storage medium. Background Technology

[0002] Monitoring solutions for data transaction processes mainly fall into three categories:

[0003] The first category is the traditional auditing approach. Traditional auditing relies on internal audit logs from data transaction-related systems for monitoring; these logs are typically used for internal oversight. However, for coordinated audits across multiple trading centers or for law enforcement and compliance audit departments, these internal audit logs stored in data transaction-related systems are susceptible to falsification and have poor reliability.

[0004] The second approach involves entrusting audit logs to a third-party evidence storage agency for audit documentation, thereby preventing the logs from being forged. While the audit documentation produced by this approach is credible to the auditing department, it still struggles to prevent collusion in tampering or forgery, and because the audit logs are stored in a third-party evidence storage agency, there is a risk of audit log leakage.

[0005] The third category is audit evidence storage based on blockchain. While blockchain can ensure that audit logs are immutable, forgeable, or revocable, thus overcoming the untrustworthiness problem of audit logs in the first category, the distributed nature of blockchain means that everyone on the chain has a complete copy of the audit log, making it public and transparent. This third category cannot meet the confidentiality requirements of audit logs and carries a greater risk of audit log leakage than the second category.

[0006] Therefore, how to ensure the reliability of data transaction monitoring while meeting the confidentiality requirements of audit logs remains an urgent problem to be solved. Summary of the Invention

[0007] This invention provides a lightweight data transaction monitoring method, apparatus, device, and storage medium to address the shortcomings of existing technologies that make it difficult to simultaneously address information leakage in data transaction detection and audit logs.

[0008] This invention provides a lightweight data transaction monitoring method for use in an auditing system. The data transaction monitoring method includes:

[0009] Identify the entities to be audited;

[0010] Obtain the pre-stored evidence audit log of the audited object, and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0011] Based on the original audit logs, data transaction monitoring is performed on the audited object.

[0012] According to a lightweight data transaction monitoring method provided by the present invention, the step of matching the original audit log of the audited object based on the evidence audit log includes:

[0013] Obtain the candidate audit logs of the object to be audited;

[0014] Based on the anti-tampering content usage strategy, the anti-tampering content is inserted into the candidate audit log, and the candidate audit log after inserting the anti-tampering content is transformed to obtain the log to be matched;

[0015] If the log to be matched is consistent with the evidence audit log, the candidate audit log is determined as the original audit log.

[0016] According to a lightweight data transaction monitoring method provided by the present invention, the method further includes, before obtaining the pre-stored evidence audit log of the object to be audited:

[0017] Based on the information of the object to be audited, determine the anti-tampering content usage strategy and the anti-tampering content;

[0018] The anti-tampering content usage strategy and the anti-tampering content are sent to the data transaction-related system where the audited object is located, so that the data transaction-related system inserts the anti-tampering content into the original audit log of the audited object based on the anti-tampering content usage strategy, and generates a storage audit log based on the authentication verification code obtained by transforming the original audit log after inserting the anti-tampering content;

[0019] Receive the evidence audit logs sent by the data transaction-related system.

[0020] According to a lightweight data transaction monitoring method provided by the present invention, the step of determining the information of the object to be audited includes:

[0021] Generate audit instructions;

[0022] The audit instruction is sent to the data transaction-related system where the audited object is located, and the audit instruction response is received from the data transaction-related system.

[0023] The information of the audited object is determined from the audit instruction response.

[0024] According to a lightweight data transaction monitoring method provided by the present invention, the audit instruction response is generated by the data transaction related system based on at least one of the system identifier of the audit system, network communication address, timestamp information, information of the audited object, and a summary of the audit instruction.

[0025] According to a lightweight data transaction monitoring method provided by the present invention, the step of determining the anti-tampering content usage strategy based on the information of the audited object includes:

[0026] Based on the type of the original audit log of the object to be audited, determine the strategy for using the anti-tampering content;

[0027] or,

[0028] Based on the type of the original audit log of the audited object, and at least one of the following: protocol version number, monitoring item category, information format, data packet length, custom fields, data transaction related system identifier, data transaction related system network address, data transaction related system hardware address, data transaction related system business internal index number, original audit log size, and original audit log content description, the anti-tampering content usage strategy is determined.

[0029] According to a lightweight data transaction monitoring method provided by the present invention, the audit system includes a centralized audit system and a local audit system;

[0030] When the data transaction monitoring method is applied to the centralized audit system, determining the anti-tampering content usage strategy and anti-tampering content based on the information of the audited object includes:

[0031] Based on the information of the object to be audited, a strategy set and a content set are generated;

[0032] The policy set and the content set are sent to the local audit system so that the local audit system can determine at least one anti-tampering content usage policy from the policy set and at least one anti-tampering content from the content set.

[0033] According to a lightweight data transaction monitoring method provided by the present invention, the audit system includes a centralized audit system and a local audit system;

[0034] When the data transaction monitoring method is applied to the local audit system, determining the anti-tampering content usage strategy and anti-tampering content based on the information of the audited object includes:

[0035] Receive the set of strategies and the set of content determined by the centralized audit system based on the information of the audited object;

[0036] Based on the original audit logs, at least one anti-tampering content usage policy is determined from the policy set, and at least one anti-tampering content is determined from the content set.

[0037] According to a lightweight data transaction monitoring method provided by the present invention, the audit system includes a centralized audit system and a local audit system;

[0038] When the data transaction monitoring method is applied to the centralized audit system, receiving the evidence storage audit log sent by the data transaction-related system includes:

[0039] It directly receives the evidence audit logs sent by the data transaction-related system and directly returns an evidence audit log reporting response to the data transaction-related system.

[0040] Alternatively, it can receive the evidence audit log sent by the data transaction-related system and forwarded by the local audit system, and return an evidence audit log reporting response to the local audit system.

[0041] According to a lightweight data transaction monitoring method provided by the present invention, the audit system includes a centralized audit system and a local audit system;

[0042] When the data transaction monitoring method is applied to the local audit system, receiving the evidence audit log sent by the data transaction-related system includes:

[0043] Receive the original audit log and the evidence audit log sent by the data transaction related system, use the original audit log as the candidate audit log of the object to be audited, and return the original audit log reporting response and the evidence audit log reporting response to the data transaction related system;

[0044] The evidence audit log is sent to the centralized audit system, and the evidence audit log reporting response is received from the centralized audit system.

[0045] The lightweight data transaction monitoring method provided by the present invention further includes:

[0046] Receive monitoring user settings;

[0047] In response to the monitoring user settings, determine at least one of the following: candidate anti-tampering content usage strategy, candidate anti-tampering content, and anti-tampering content generation strategy corresponding to the monitoring user settings;

[0048] The anti-tampering content usage strategy is at least one of the candidate anti-tampering content usage strategies;

[0049] And / or,

[0050] The anti-tampering content is at least one of the candidate anti-tampering contents, or the anti-tampering content is determined based on the anti-tampering content generation strategy;

[0051] The forms of monitoring user settings include at least one of the following: rule-based, configuration file, button, circle, checkmark, mark, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, and virtual reality.

[0052] According to a lightweight data transaction monitoring method provided by the present invention, the original audit log is determined based on data transaction user settings and / or monitoring user settings;

[0053] The forms of data transaction user settings and / or monitoring user settings include at least one of the following: rules-based, configuration files, buttons, circle, checkmark, marker, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, and virtual reality.

[0054] The present invention also provides a lightweight data transaction monitoring device for use in an auditing system, the data transaction monitoring device comprising:

[0055] The object determination unit is used to determine the object to be audited;

[0056] The log matching unit is used to obtain the pre-stored evidence audit log of the audited object and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0057] The transaction monitoring unit is used to monitor data transactions of the audited object based on the original audit logs.

[0058] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the lightweight data transaction monitoring method described above.

[0059] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the lightweight data transaction monitoring method as described above.

[0060] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the lightweight data transaction monitoring method as described above.

[0061] The lightweight data transaction monitoring method, apparatus, device, and storage medium provided by this invention involve both an audit system and a data transaction-related system. The data transaction-related system, based on the anti-tampering content usage strategy and anti-tampering content determined by the audit system, transforms the original audit logs into evidence-based audit logs, which are then submitted to the audit system for evidence storage. Therefore, assuming the audit system is trustworthy, it is theoretically impossible to generate audit object content with the same semantics and type by forging the original audit logs, effectively preventing intentional forgery of audit object content. Furthermore, since the audit system only needs to store the evidence-based audit logs, without storing the original audit logs, lightweight data transaction monitoring is achieved, and information leakage of the original audit logs is avoided. During specific audits, the evidence-based audit logs are matched against the original audit logs, ensuring the trustworthiness of the original audit logs, thereby ensuring the trustworthiness of the data transaction monitoring. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0063] Figure 1 This is a flowchart illustrating the lightweight data transaction monitoring method provided by the present invention;

[0064] Figure 2 This is a flowchart illustrating the method for generating evidence audit logs provided by the present invention;

[0065] Figure 3 This is a flowchart illustrating the lightweight data transaction evidence preservation method provided by the present invention.

[0066] Figure 4 This is one of the interactive diagrams of the data transaction-related system and the auditing system provided by the present invention;

[0067] Figure 5 This is the second interactive diagram of the data transaction-related system and the auditing system provided by the present invention;

[0068] Figure 6 This is a schematic diagram of the lightweight data transaction monitoring device provided by the present invention;

[0069] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0071] Traditional data transaction monitoring methods rely on audit logs from internal information systems within the data transaction-related systems. These audit logs are used for internal oversight. However, for law enforcement agencies, these logs are stored within the monitored data transaction systems, making them susceptible to falsification. Therefore, using audit logs as evidence for oversight is not entirely reliable for law enforcement agencies.

[0072] To prevent audit logs from being forged, they can be sent to an external third-party evidence storage agency for storage. While this method of audit evidence storage is credible to law enforcement and regulatory authorities, it still cannot solve the problem of collusion in tampering or forgery.

[0073] To address the aforementioned issues, this invention proposes a lightweight data transaction monitoring method. In this method, both the auditing system and the data transaction-related systems collaborate to achieve credible evidence-based supervision without disclosing the content of the audited object. It is understood that the auditing system here can be a law enforcement and regulatory center.

[0074] The regulated data transaction systems transform the original audit logs according to the anti-tampering content and usage policies provided by the audit system. This transformation yields an authentication verification code that combines the original audit logs with the anti-tampering content. Based on this verification code, a notarized audit log is generated and submitted to the audit system for notarization. The submission of the notarized audit log can be encrypted to ensure secure transmission during the notarization process.

[0075] Accordingly, the audit system only stores this evidence-preserving audit log. Since the evidence-preserving audit log does not include the original audit log content of the audited entity and is constrained by the audit system, it ensures that the original audit log is not leaked or forged. This solves the problem of audit logs or audited entity content being tampered with or forged after an evidence-preserving event occurs, reduces the overhead of transmitting the original log content, and improves the credibility of the evidence and the efficiency of evidence retrieval. This method can be used not only for law enforcement supervision but also for internal corporate self-monitoring and third-party evaluation scenarios.

[0076] Figure 1 This is a flowchart illustrating the lightweight data transaction monitoring method provided by the present invention, as follows: Figure 1 As shown, this method is applied to an auditing system, and the method includes:

[0077] Step 110: Identify the object to be audited.

[0078] Here, the object to be audited is the object that needs to be monitored for data transactions. The object to be audited can be one or more data transaction-related systems, or a data transaction function or a data transaction executed by one or more data transaction-related systems. This embodiment of the invention does not make specific limitations in this regard.

[0079] The audit target can be determined based on the retrospective investigation behavior initiated by the audit system in response to abnormal events, or based on the self-inspection audit behavior of the audit system set up locally in the data transaction-related system, or based on the joint audit behavior of multiple audit systems set up locally in multiple data transaction-related systems. This embodiment of the invention does not specifically limit this.

[0080] Here, data transaction-related systems can refer to various systems involved in data transactions, including systems of data service providers, data traders, data processors, data sellers, and data buyers. This embodiment of the invention does not specifically limit the data types, data sizes, data content, or other data attributes involved in each data transaction-related system.

[0081] Step 120: Obtain the pre-stored evidence audit log of the audited object, and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, which modifies the original audit log by inserting anti-tampering content into the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0082] Specifically, after identifying the object to be audited, the pre-stored evidence audit logs of the object to be audited can be obtained from the audit system.

[0083] It is understandable that the audit logs mentioned here are specifically for storage within the audit system. Prior to this, the data transaction-related system of the audited entity, as the evidence sender (i.e., the party requiring audit log storage), can determine the original audit logs of the audited entity and receive the anti-tampering content usage policy and anti-tampering content sent by the audit system. Then, based on the anti-tampering content usage policy, it inserts the anti-tampering content into the original audit logs. The original audit logs with the inserted anti-tampering content are then transformed, and the resulting authentication verification code is used to generate the evidence-storing audit logs, which are then sent to the audit system for storage. In this process, the audit system is the information storage party, the party responsible for implementing information storage.

[0084] The original audit log refers to the original information of the audited object that needs to be documented. Original information varies across multiple stages, including before, during, and after data transactions. For example, there might be original information 1 during the data collection stage, original information 2 during the data processing stage, and new original information 3 during the data cataloging stage. In short, the same information may manifest as different original information at different stages. The concept of original information is relative to the stages and phases of the data transaction.

[0085] The anti-tampering content usage strategy can be based on the type of the original audit log of the audited object, generating different types of content according to certain rules. The anti-tampering content usage strategy can be a set, and the elements of the set of anti-tampering content usage strategies include, but are not limited to: a set of insertions or replacements at the beginning, end, or any byte within the size range of the original audit log. This embodiment of the invention does not impose specific constraints on this.

[0086] The tamper-proof content can be generated according to certain rules based on the type of the original audit log of the audited object. The tamper-proof content can be a collection, and its elements include, but are not limited to: strings, binary codes, numbers, text, nodes from graph databases, columns from relational database tables, images, audio, and video. For example, if the original audit log is a TXT text document, the generated tamper-proof content can be a collection of strings, numbers, and text of unlimited length; if the original audit log is a relational database table, the generated tamper-proof content can be a collection of strings, numbers, and text of unlimited length corresponding to columns in the relational database table. The generation strategy for the tamper-proof content includes, but is not limited to, random values ​​and modulo operations. This embodiment of the invention does not impose specific constraints on the tamper-proof content, the generation strategy of the tamper-proof content, the original audit log content, or the size of the audit log content generated by fusing the tamper-proof content with the original audit log.

[0087] The generation of anti-tampering content and anti-tampering content usage policies can be configured. Configuration methods can be based on one or more of the following: rules, configuration files, buttons, selection, checkmarks, markers, key presses, scroll wheels, menus, voice, video, eye contact, gestures, text, bioelectrical signals, and virtual environments. Specifically, similar to tossing a mute switch on a mobile phone or moving a voice recorder left and right, it can also be reflected as input without a physical switch, such as screen gestures (left to right, right to left, top to bottom, bottom to top, etc.), pop-up interface filling (e.g., form entry), file import (e.g., XML format), voice input, configuration file input, pop-up / menu selection, and displaying a virtual keyboard on the screen.

[0088] The anti-tampering content and anti-tampering usage strategies are stored in the audit system for tracing and evidence collection after an infringement incident occurs.

[0089] The original audit logs with inserted tamper-proof content are transformed, specifically requiring a one-way irreversible transformation, including but not limited to hashing and SM4-GCM. This patent does not impose specific constraints on the authentication verification code generation method. For example, the authentication verification code can be generated using the SM4-GCM mode. SM4-GCM is a combination of the national block cipher algorithm standard SM4 and the Galois / Counter Mode (GCM). It includes the SM4-CTR (SM4 based Counter) mode and the Galois Hash (GHASH) mode, simultaneously possessing confidentiality, integrity, and data source authentication characteristics. The SM4-CTR mode ensures confidentiality and data source authentication characteristics through key encryption, while GHASH ensures message integrity.

[0090] It is understandable that, compared to directly transforming the original audit log, this embodiment of the invention transforms the original audit log with anti-tampering content inserted. The application of anti-tampering content and anti-tampering content usage strategies makes it theoretically impossible to forge original audit logs with the same semantics and type, which can effectively avoid the occurrence of intentional forgery of the content of the audited object.

[0091] Therefore, for the audit system, after obtaining the pre-stored evidence audit logs of the audited object, it can match the corresponding original audit logs based on these evidence audit logs. It is understood that the audit system not only stores the evidence audit logs but also the tamper-proof content and usage strategies required to generate them. Thus, when the audit system obtains its own stored original audit logs or those provided by data transaction-related systems, it can verify whether the original audit logs can be transformed into evidence audit logs based on the tamper-proof content and usage strategies. This determines whether the original audit logs have been tampered with, thereby obtaining a reliable and tamper-proof original audit log that matches the evidence audit logs.

[0092] Step 130: Based on the original audit logs, perform data transaction monitoring on the audited object.

[0093] Specifically, once reliable and tamper-proof original audit logs are obtained, data transaction monitoring of the audit target can be carried out based on the original audit logs.

[0094] For example, in response to retrospective investigations triggered by abnormal events, the audit center can receive abnormal alarm information in advance and determine the audit target based on the abnormal alarm information. After obtaining the original audit log of the audit target, it can compare and analyze the content in the original audit log based on the specific content in the abnormal alarm information to obtain the analysis results and then determine the authenticity of the alarm behavior.

[0095] For example, in response to self-inspection audit activities, the audit center can randomly select a batch of audit logs of the audited entities, and then find a batch of original audit logs. By using big data analysis or correlation analysis on all the original audit logs, clues to abnormal behavior can be obtained.

[0096] For example, in the case of joint auditing, each auditing system can take the transaction-related behaviors corresponding to the same ownership certificate as the audit objects, thereby obtaining the original audit logs of each transaction-related behavior under the same ownership certificate, and performing correlation analysis on all the original audit logs to obtain clues of abnormal behavior.

[0097] The data transaction monitoring method provided in this invention involves both an auditing system and a data transaction-related system. The data transaction-related system, based on the anti-tampering content usage strategy and anti-tampering content determined by the auditing system, transforms the original audit logs into evidence-based audit logs, which are then submitted to the auditing system for evidence storage. Therefore, assuming the auditing system is trustworthy, it is theoretically impossible to generate auditable object content with the same semantics and type by forging the original audit logs, effectively preventing intentional forgery of auditable object content. Furthermore, since the auditing system only needs to store evidence-based audit logs and not the original audit logs, data transaction monitoring is lightweighted, and information leakage of the original audit logs is avoided. During specific audits, the evidence-based audit logs are matched against the original audit logs, ensuring the trustworthiness of the original audit logs and thus guaranteeing the trustworthiness of data transaction monitoring.

[0098] The data transaction monitoring method provided in this invention can be applied to common standard transmission protocols, including but not limited to: TCP, UDP, HTTP / HTTPS protocols, and custom security protocols; the application scope covers every stage of the data transaction and circulation process, including but not limited to: monitoring scenarios such as data collection, data access, data sharing, data deletion, and data usage.

[0099] Based on the above embodiments, step 120, which involves matching the original audit log of the audited object with the evidence-preserving audit log, includes:

[0100] Obtain the candidate audit logs of the object to be audited;

[0101] Based on the anti-tampering content usage strategy, the anti-tampering content is inserted into the candidate audit log, and the candidate audit log after inserting the anti-tampering content is transformed to obtain the log to be matched;

[0102] If the log to be matched is consistent with the evidence audit log, the candidate audit log is determined as the original audit log.

[0103] Specifically, in the process of matching the original audit logs, candidate audit logs for the object to be audited can first be obtained. These candidate audit logs can be audit logs reported by the data transaction-related system where the object to be audited resides, or audit logs of the object to be audited that are pre-stored by the audit system. Considering that the audit logs obtained at this stage may not be feasible, they are referred to here as candidate audit logs.

[0104] After obtaining the candidate audit logs, they need to be verified for trustworthiness. Specifically, this verification involves inserting tamper-proof content into the candidate audit logs based on the anti-tampering content usage strategy, and then transforming the candidate audit logs after inserting the tamper-proof content to obtain the logs to be matched. It's understandable that the method of obtaining the logs to be matched here is consistent with the previous method of obtaining evidence-based audit logs from the original audit logs in data transaction-related systems. The purpose of obtaining the logs to be matched is to determine whether the evidence-based audit logs can be obtained from the candidate audit logs, and then to determine whether the candidate audit logs are consistent with the original audit logs required to generate the evidence-based audit logs.

[0105] After obtaining the log to be matched, it can be compared with the evidence audit log. If the log to be matched matches the evidence audit log, it means that the candidate audit log is an authentic and trustworthy original audit log, and the trust verification passes. If the log to be matched differs from the evidence audit log, it means that the candidate audit log has been maliciously tampered with, the trust verification fails, the acquisition of the original audit log matching the evidence audit log fails, and subsequent data transaction monitoring is no longer performed.

[0106] Based on any of the above embodiments Figure 2 This is a flowchart illustrating the method for generating evidence audit logs provided by the present invention, as shown below. Figure 2 As shown, prior to step 120, the method further includes:

[0107] Step 210: Based on the information of the object to be audited, determine the anti-tampering content usage strategy and the anti-tampering content.

[0108] Here, the information of the audited object may include at least one of the following: audited object identifier, the identifier of the data verification system to which the audited object is located, the name of the audited object, the main domain name of the data verification system to which the audited object is located, the subdomain name of the data verification system to which the audited object is located, the type of the audited object, the business license information of the company to which the audited object belongs, the name of the operator of the audited object, and the online filing time of the audited object.

[0109] Once the auditing system obtains information about the object to be audited, it can determine the strategy for using anti-tampering content and the content to be protected against tampering.

[0110] Step 220: Send the anti-tampering content usage policy and the anti-tampering content to the data transaction related system where the audited object is located, so that the data transaction related system inserts the anti-tampering content into the original audit log of the audited object based on the anti-tampering content usage policy, and generates a storage audit log based on the authentication verification code obtained by transforming the original audit log after inserting the anti-tampering content.

[0111] Specifically, once the auditing system determines the anti-tampering content usage strategy and the anti-tampering content, it can send both to the data transaction-related system where the audited entity is located.

[0112] After receiving the aforementioned anti-tampering content usage strategy and anti-tampering content, the data transaction-related system where the audited object is located can generate the authentication verification code required for storing the original audit log based on this anti-tampering content usage strategy and anti-tampering content.

[0113] During this process, data transaction-related systems need to insert tamper-proof content into the original audit log based on the tamper-proof content usage policy, thereby obtaining the original audit log after the insertion of the tamper-proof content. It can be understood that the original audit log after the insertion of the tamper-proof content is the audit log in the original audit log after the tamper-proof content has been inserted at the location indicated by the tamper-proof content usage policy.

[0114] After receiving the original audit logs with tamper-proof content inserted, the data transaction system can transform these logs and use the transformed result as an authentication verification code. Subsequently, the data transaction system can generate a certificate of authenticity audit log carrying this verification code and submit it to the audit system for certificate of authenticity.

[0115] Here, evidence audit logs can be generated based on the authentication verification code, or based on the authentication verification code and at least one of the following: the name of the system that generated the authentication verification code, the generation time, and the generation location.

[0116] Alternatively, evidence audit logs can be generated based on the identifiers and authentication verification codes of data transaction-related systems;

[0117] Alternatively, an evidence-based audit log can be generated based on at least one of the following: the identifier and authentication verification code of the data transaction-related system; the operation subject of the original audit log; the operation behavior of the original audit log; the protocol version number; the command category; the monitoring item category; the information format; the data packet length; the custom fields; the audit system identifier; the network address of the data transaction-related system; the hardware address of the data transaction-related system; the business internal index number of the audit system; the business internal index number of the data transaction-related system; the type of the original audit log; the name of the original audit log; the size of the original audit log; the description of the content of the original audit log; the search terms of the content of the original audit log; the ownership identifier of the original audit log; the transaction type; the exchange identifier; the transaction time; the buyer; the seller; the service provider; the exchange identifier; the classification number of the original audit log; the ownership subject of the original audit log; the creation time of the original audit log; the creation location of the original audit log; the operation time of the original audit log; the operation location of the original audit log; the operation result of the original audit log; the encrypted fields; and the integrity measure and signature of the evidence-based audit log to be generated.

[0118] It should be noted that different data transaction-related systems may differentiate themselves by the name of the original audit log, the size of the original audit log, the description of the content of the original audit log, the search terms for the content of the original audit log, the ownership identifier of the original audit log, the transaction type, the exchange identifier, the transaction time, the buyer, the seller, the service provider, the exchange identifier, and the classification number of the original audit log, thereby indicating different versions of information content.

[0119] The entities that operate the original audit logs include, but are not limited to, natural persons, institutions, organizations, equipment, or programs that operate the original audit logs. This embodiment of the invention does not impose specific constraints on these entities.

[0120] The operations performed on the original audit logs include, but are not limited to: data collection, data organization, data cleaning, data analysis, data processing, data ownership confirmation, data certification, data catalog publication, data trading, data transfer, data usage, sending files, viewing files, approving files, downloading files, deleting files, and handling abnormal information. This embodiment of the invention does not impose specific constraints.

[0121] The internal business index number of the audit system here refers to the internal business index number of the local audit system, which is a unique identifier used to index the internal business of the local audit system. Its functions include, but are not limited to: using it to efficiently retrieve the internal business index numbers of data transaction-related systems when the centralized audit system is tracing and collecting evidence. The internal business index number of the local audit system and the internal business index number of the data transaction-related system are in one-to-one correspondence. This embodiment of the invention does not impose specific constraints on its functions.

[0122] The description of the original audit log content refers to a brief description of the original audit log content;

[0123] Search terms for original audit log content refer to keywords used to query the original audit log content;

[0124] The classification number of the original audit log refers to the classification of the content of the original audit log;

[0125] The ownership of the original audit log refers to the natural person, institution, organization, equipment or program to which the original audit log belongs, and this patent does not impose specific constraints on it;

[0126] The creation time of the original audit log refers to the moment when the original audit log was created. The format is not limited, for example, "yyyy-MM-dd HH:mm:ss".

[0127] The creation location of the original audit log refers to the location where the original audit log was created. The format is not limited, such as latitude and longitude representation.

[0128] The operation time of the original audit log refers to the moment when the original audit log was operated on. The format is not limited, such as "yyyy-MM-dd HH:mm:ss".

[0129] The operation location of the original audit log refers to the location where the original audit log was operated on, and the format is not limited, such as latitude and longitude representation.

[0130] The operation result of the original audit log refers to the monitored object after the original audit log has been operated on;

[0131] The encrypted field is a field in the audit instruction sent by the receiving audit system. It is sent directly from the data transaction-related system to the local audit system without any operation by the data transaction-related system. It is used for anti-replay attacks, etc.

[0132] The integrity measure of the pending audit log and the integrity measure in the signature refer to the values ​​obtained by the data transaction-related system after transforming the content of the pending audit log to ensure the integrity of the pending audit log content. The signature is the signature of the pending audit log content by the data transaction-related system to ensure non-repudiation.

[0133] Step 230: Receive the evidence audit log sent by the data transaction related system.

[0134] Specifically, the data transaction-related system will report the generated evidence storage audit logs to the audit system. In turn, the audit system can receive and store the evidence storage audit logs for subsequent auditing.

[0135] The method provided in this invention involves an audit system generating tamper-proof content and a usage strategy for that content. A data transaction-related system then inserts the tamper-proof content into the original audit log according to the usage strategy. The original audit log after inserting the tamper-proof content is then transformed to obtain an authentication verification code. This verification code possesses the characteristics of confidentiality, integrity, and data source authentication. Since the tamper-proof content and usage strategy are generated by the audit system and cannot be altered by the data transaction-related system, it is theoretically impossible to generate auditable object content with the same semantics and type by forging the original audit log, provided the audit system is trustworthy. This effectively prevents the intentional forgery of auditable object content.

[0136] The audit system stores evidence-based audit logs generated based on authentication verification codes (containing only authentication verification codes and related management information), without storing the original audit log content. This eliminates the risk of data leakage caused by the outflow of the audited object's content. Moreover, this is a lightweight evidence storage solution that significantly reduces data transmission bandwidth and the audit system's storage overhead.

[0137] Based on any of the above embodiments, the step of determining the information of the audited object in step 210 includes:

[0138] Generate audit instructions;

[0139] The audit instruction is sent to the data transaction-related system where the audited object is located, and the audit instruction response is received from the data transaction-related system.

[0140] The information of the audited object is determined from the audit instruction response.

[0141] Specifically, audit instructions can be generated based on the object to be audited. Audit instructions may include, but are not limited to, at least one of the following: object identifier, audit system identifier, network communication address of the audit system, and timestamp information.

[0142] After generating an audit instruction, the audit system can send it to the data transaction-related system where the audited entity resides. Upon receiving the audit instruction, the data transaction-related system can respond by generating an audit instruction response.

[0143] The audit instruction response here can reflect that an authentication relationship has been established between the data transaction-related system of the audited object and the audit system; the audit instruction response includes, but is not limited to, at least one of the following information: audited object identifier, audit system identifier, network communication address of the audit system, timestamp information, audited object name, main domain name of the data transaction-related system, subdomain name of the data transaction-related system, audited object type, business license information of the company to which the data transaction-related system belongs, name of the operator of the data transaction-related system, network registration time of the data transaction-related system, and audit instruction summary.

[0144] The data transaction-related system where the audited object is located can return the audit instruction response to the audit system; accordingly, the audit system can receive the audit instruction response and then obtain the information of the audited object from the audit instruction response.

[0145] Based on any of the above embodiments, the audit instruction response is generated by the data transaction related system based on at least one of the system identifier of the audit system, network communication address, timestamp information, information of the audited object, and a summary of the audit instruction.

[0146] Among them, the system identifier, network communication address, timestamp information, and summary of audit instructions of the audit system can be determined based on the audit instructions, and the information of the audited object can be determined based on the content of the audited object stored in the data transaction related system itself.

[0147] Based on any of the above embodiments, step 210 includes:

[0148] Based on the type of the original audit log of the object to be audited, determine the strategy for using the anti-tampering content;

[0149] or,

[0150] Based on the type of the original audit log of the audited object, and at least one of the following: protocol version number, monitoring item category, information format, data packet length, custom fields, data transaction related system identifier, data transaction related system network address, data transaction related system hardware address, data transaction related system business internal index number, original audit log size, and original audit log content description, the anti-tampering content usage strategy is determined.

[0151] Specifically, the information of the audited object includes the type of the original audit log.

[0152] After obtaining information about the audited object, the audit system can determine the anti-tampering content usage strategy based on the type of the original audit log carried in the audited object's information, or generate a corresponding anti-tampering content usage strategy for the original audit log based on the type of the original audit log carried in the audited object's information, and at least one of the following: protocol version number, monitoring item category, information format, data packet length, custom fields, data transaction related system identifier, network address of the data transaction related system, hardware address of the data transaction related system, business internal index number of the data transaction related system, size of the original audit log, and description of the content of the original audit log. Here, the anti-tampering content usage strategy can be pre-set. For example, it can be determined based on the type of the original audit log to place the anti-tampering content at the beginning, end, or any preset byte within the size range of the original audit log. This embodiment of the invention does not specifically limit this.

[0153] The type of the original audit log is not limited; it can be any existing audit log format or an emerging log format.

[0154] The protocol version number indicates the version of the communication protocol;

[0155] The monitoring item category is used to indicate the specific types of information reported by the data transaction-related system, including but not limited to: data collection, data organization, data cleaning, data analysis, data processing, data ownership confirmation, data certification, data catalog publication, data transaction, data transfer, and data use;

[0156] The information format is used to represent the format of information exchanged between the data transaction-related system and the audit system, and between the audit systems, including but not limited to: audit instructions, audit instruction responses, responses to the reporting of evidence audit logs, responses to the reporting of original audit logs, abnormal operation messages, or other information formats;

[0157] The data packet length refers to the length of the entire data packet;

[0158] Identifiers for data transaction-related systems, including but not limited to: numbers and strings, used to distinguish different data transaction-related systems;

[0159] The network address, or IP address, of a data transaction-related system is used to record the network address information for business interactions between different data transaction-related systems.

[0160] The hardware address, or MAC address, of a data transaction-related system is used to record the hardware address of the data transaction-related system's devices for business interaction between different data transaction-related systems.

[0161] The business internal index number of the data transaction-related system is a unique identifier for the business within the index of the data transaction-related system. Its functions include, but are not limited to, efficiently retrieving the auditable object when tracing evidence in the local audit system or the centralized audit system. The embodiments of the present invention do not impose specific constraints on its functions. It can be understood that when the business internal index numbers of the data transaction-related system and the audit system correspond one-to-one, the auditable object can be retrieved efficiently through the business internal index number.

[0162] The size of the raw audit log is used to represent the size of the raw audit log content, and the representation method includes, but is not limited to, bytes and bits.

[0163] The description of the original audit log content is a brief description of the original audit log content.

[0164] Based on any of the above embodiments, the audit system includes a centralized audit system and a local audit system.

[0165] The relationship between the centralized audit system, the local audit system, and the data transaction-related systems can be either one-to-one or many-to-many. Specifically, the local audit system can be deployed in multiple layers, and multiple systems can be deployed within the same layer. The local audit system can be deployed at the same unit as the data transaction-related systems to store and manage various operations of the data transaction-related systems and record the data flow status. Similarly, the centralized audit system can be deployed in multiple layers, and multiple systems can be deployed within the same layer. The centralized audit system is used to store and manage key evidence information fields reported by local audit systems or data transaction-related systems at all levels.

[0166] Furthermore, this deployment architecture is variable; it can be a multi-level deployment with multiple deployments at each level, or a single-level deployment. This embodiment of the invention does not impose specific constraints on the deployment architecture, and different deployment architectures are all within the protection scope of this embodiment of the invention.

[0167] Under the above architecture, this method can be applied to a centralized auditing system. Accordingly, step 210 includes:

[0168] Based on the information of the object to be audited, a strategy set and a content set are generated;

[0169] The policy set and the content set are sent to the local audit system so that the local audit system can determine at least one anti-tampering content usage policy from the policy set and at least one anti-tampering content from the content set.

[0170] Here, the determination of anti-tampering content usage strategies and the specific anti-tampering content can be accomplished through collaboration between the centralized audit system and the local audit system. In practice, the centralized audit system can generate a set of strategies and a set of content based on the information of the object to be audited.

[0171] Here, the strategy set and content set are used to constrain the scope of the finally determined anti-tampering content using strategies and the scope of the anti-tampering content. That is, the finally determined anti-tampering content using strategies is one or more of the strategy set, and the finally determined anti-tampering content is one or more of the content set.

[0172] Once the centralized audit system has determined the strategy set and content set, it can send them to the local audit system.

[0173] After receiving the policy set and content set, the local audit system determines the anti-tampering content application policy for the audited object from the policy set and the anti-tampering content for the audited object from the content set. It is understood that the selection of anti-tampering content application policies and anti-tampering content from the policy set and content set can be based on the original audit logs. Furthermore, the selected anti-tampering content application policies and anti-tampering content can be one or more.

[0174] Based on any of the above embodiments, under the above architecture, the method can also be applied to a local auditing system. Accordingly, step 210 includes:

[0175] Receive the set of strategies and the set of content determined by the centralized audit system based on the information of the audited object;

[0176] Based on the original audit logs, at least one anti-tampering content usage policy is determined from the policy set, and at least one anti-tampering content is determined from the content set.

[0177] Specifically, for a local audit system, the local audit system can receive a set of strategies and a set of content determined by the centralized audit system based on information about the audited object.

[0178] After receiving the policy set and content set, the local audit system can select the anti-tampering content to be applied to the audited object from the policy set based on the original audit logs, and determine the anti-tampering content to be applied to the audited object from the content set. Here, the selected anti-tampering content policy and anti-tampering content can both be one or more.

[0179] Based on any of the above embodiments, under the above architecture, this method can be applied to a centralized auditing system. Accordingly, step 230, receiving the evidence storage audit log sent by the data transaction related system, includes:

[0180] It directly receives the evidence audit logs sent by the data transaction-related system and directly returns an evidence audit log reporting response to the data transaction-related system.

[0181] Alternatively, it can receive the evidence audit log sent by the data transaction-related system and forwarded by the local audit system, and return an evidence audit log reporting response to the local audit system.

[0182] Specifically, the data transaction-related systems can communicate directly with the centralized audit system. That is, the data transaction-related systems can directly send the evidence storage audit logs to the centralized audit system. Correspondingly, after receiving the evidence storage audit logs, the centralized audit system can also directly return an evidence storage audit log reporting response to the data transaction-related systems. Once the data transaction-related systems receive the evidence storage audit log reporting response, they can determine that the centralized audit system has received the evidence storage audit logs, and the evidence storage of the audit logs is complete.

[0183] Alternatively, data transaction-related systems can also relay data through a local audit system to achieve communication with the centralized audit system. That is, the data transaction-related systems can send the evidence storage audit logs to the local audit system, and then the local audit system can send the received evidence storage audit logs to the centralized audit system. Correspondingly, after receiving the evidence storage audit logs, the centralized audit system can also return an evidence storage audit log reporting response to the local audit system. After receiving the evidence storage audit log reporting response, the local audit system can determine that the centralized audit system has received the evidence storage audit logs, and the evidence storage of the audit logs is completed.

[0184] Here, the evidence audit log reporting response generated and returned by the centralized audit system can be determined based on the centralized audit system identifier; alternatively, it can be based on the centralized audit system identifier, along with the protocol version number, command type, monitoring item type, information format, data packet length, custom fields, evidence audit log reporting response identifier, evidence audit log reporting response time, data transaction related system identifier, data transaction related system network address, data transaction related system hardware address, law enforcement monitoring system business internal index number, data transaction related system business internal index number, original audit log name, original audit log size, original audit log content description, and original audit log... The content search terms, original audit log ownership identifier, transaction type, exchange identifier, transaction time, buyer, seller, service provider, exchange identifier, original audit log classification number, original audit log type, original audit log ownership subject, original audit log creation time, original audit log creation location, original audit log operation subject, original audit log operation behavior, original audit log operation time, original audit log operation location, original audit log operation result, authentication verification code, encrypted field, evidence audit log integrity measure and signature, and evidence audit log reporting response integrity measure and signature to be generated are determined.

[0185] Among them, the evidence audit log reporting response identifier refers to the feedback that the centralized audit system has received and reported the evidence audit log. In the centralized audit system, the evidence audit log reporting response identifier is unique and is used to distinguish the reported evidence audit log. It is directly returned by the centralized audit system to the data transaction related system.

[0186] The response time for the evidence audit log submission is the moment when the centralized audit system responds to the receipt of the evidence audit log; the format is not limited.

[0187] The integrity measure of the pending evidence audit log reporting response and the integrity measure in the signature refer to the values ​​obtained by the centralized audit system after transforming the pending evidence audit log reporting response to ensure the integrity of the pending evidence audit log reporting response. The signature is the signature of the pending evidence audit log reporting response by the centralized audit system to ensure non-repudiation.

[0188] Based on any of the above embodiments, under the above architecture, this method can be applied to a local auditing system. Accordingly, step 230, receiving the evidence audit log sent by the data transaction-related system, includes:

[0189] Receive the original audit log and the evidence audit log sent by the data transaction related system, use the original audit log as the candidate audit log of the object to be audited, and return the original audit log reporting response and the evidence audit log reporting response to the data transaction related system;

[0190] The evidence audit log is sent to the centralized audit system, and the evidence audit log reporting response is received from the centralized audit system.

[0191] Specifically, after generating the evidence-based audit logs, the data transaction-related system can send both the evidence-based audit logs and the original audit logs to the local audit system. That is, the local audit system can store not only the evidence-based audit logs but also the original audit logs to support subsequent data transaction monitoring. Correspondingly, after receiving the evidence-based audit logs and the original audit logs, the local audit system can return a report response for the evidence-based audit logs and a report response for the original audit logs to the data transaction-related system. Upon receiving these responses, the data transaction-related system can confirm that the local audit system has received the evidence-based audit logs and the original audit logs, and the evidence storage of the audit logs in the local audit system is complete.

[0192] In addition, after receiving the evidence storage audit logs, the local audit system can send them to the centralized audit system. Upon receiving the audit logs, the centralized audit system can send a response back to the local audit system confirming that the audit log storage at the centralized audit system is complete.

[0193] Here, the evidence audit log reporting response generated and returned by the local audit system can be determined based on the local audit system identifier; or, it can be based on the local audit system identifier, along with the protocol version number, command type, monitoring item type, information format, data packet length, custom fields, evidence audit log reporting response identifier, evidence audit log reporting response time, data transaction related system identifier, data transaction related system network address, data transaction related system hardware address, local monitoring system business internal index number, data transaction related system business internal index number, original audit log type, original audit log name, original audit log size, and original audit log content. The description, search terms for the original audit log content, ownership identifier of the original audit log, transaction type, exchange identifier, transaction time, buyer, seller, service provider, exchange identifier, classification number of the original audit log, ownership subject of the original audit log, creation time of the original audit log, creation location of the original audit log, operating subject of the original audit log, operating behavior of the original audit log, operating time of the original audit log, operating location of the original audit log, operating result of the original audit log, authentication verification code, encrypted field, measure of integrity of the evidence audit log and signature, and measure of integrity of the report response to the evidence audit log to be generated and signature are determined.

[0194] Based on any of the above embodiments, the method further includes:

[0195] Receive monitoring user settings;

[0196] In response to the monitoring user settings, determine at least one of the following: candidate anti-tampering content usage strategy, candidate anti-tampering content, and anti-tampering content generation strategy corresponding to the monitoring user settings;

[0197] The anti-tampering content usage strategy is at least one of the candidate anti-tampering content usage strategies;

[0198] And / or,

[0199] The anti-tampering content is at least one of the candidate anti-tampering contents, or the anti-tampering content is determined based on the anti-tampering content generation strategy;

[0200] The forms of monitoring user settings include at least one of the following: rule-based, configuration file, button, circle, checkmark, mark, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, and virtual reality.

[0201] Specifically, within the audit system, the use of anti-tampering content policies and / or the determination of anti-tampering content can be user-triggered. Within the audit system, specifically, users at the centralized audit system can input and / or import monitoring user settings into the audit system via terminal operations.

[0202] After receiving the monitoring user settings, the auditing system can respond when triggered by the monitoring user settings. The specific response method is to determine at least one of the following: candidate anti-tampering content usage strategy, candidate anti-tampering content, and anti-tampering content generation strategy corresponding to the monitoring user settings.

[0203] Here, the candidate anti-tampering content usage policy refers to the optional anti-tampering content usage policy set by the user through monitoring. The candidate anti-tampering content usage policy can include anti-tampering content usage policies corresponding to various types of raw audit logs, and can also include anti-tampering content usage policies corresponding to at least one of the following: various types of raw audit logs, protocol version number, monitoring item category, information format, data packet length, custom fields, data transaction related system identifier, network address of data transaction related system, hardware address of data transaction related system, business internal index number of data transaction related system, size of raw audit log, and description of raw audit log content.

[0204] It is understandable that the candidate anti-tampering content usage strategy is the range of anti-tampering content usage strategies defined by the user. When determining the anti-tampering content usage strategy, it can be selected from the candidate anti-tampering content usage strategies or generated.

[0205] Candidate content refers to the optional anti-tampering content set by the user. Candidate content can include one or more alternative anti-tampering options. That is, when determining anti-tampering content, it can be selected from the candidate content.

[0206] The anti-tampering content generation strategy involves monitoring the rules set by the user for generating anti-tampering content. In other words, when determining anti-tampering content, the strategy can be used to generate anti-tampering content.

[0207] Triggering methods for monitoring users in the audit system include, but are not limited to, one or more of the following: rule-based, configuration file-based, button-based, circle-based, checkmark-based, marker-based, key-based, scroll wheel-based, menu-based, voice-based, video-based, eye-tracking, gesture-based, text-based, bioelectrical signals, and virtual environment-based. Specifically, actions similar to tossing a mute switch up and down on a mobile phone or sliding a voice recorder left and right can also be considered as input without a physical switch, such as screen gestures (left to right, right to left, top to bottom, bottom to top, etc.), pop-up interface filling (e.g., form entry), file import (e.g., XML format), voice input, configuration file input, pop-up / menu selection, and on-screen virtual keyboard input.

[0208] Based on any of the above embodiments, the original audit log is determined based on data transaction user settings and / or monitoring user settings;

[0209] The forms of data transaction user settings and / or monitoring user settings include at least one of the following: rules-based, configuration files, buttons, circle, checkmark, marker, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, and virtual reality.

[0210] Specifically, the determination of the original audit log can be user-triggered. Users on the data transaction-related system can enter data transaction user settings into the data transaction-related system through terminal operations, and / or users on the audit system can enter monitoring user settings into the audit system through terminal operations, which are then forwarded by the audit system to the data transaction-related system.

[0211] After receiving data transaction user settings and / or monitoring user settings, the data transaction-related system can respond when triggered by the data transaction user settings and / or monitoring user settings. Specifically, the response method is to determine the original audit log corresponding to the data transaction user settings and / or monitoring user settings, and execute subsequent steps to achieve evidence storage of the original audit log.

[0212] Triggering methods for data transaction user settings and / or monitoring user settings stored in data transaction-related systems include, but are not limited to, one or more of the following: rules, configuration files, buttons, circle, checkmark, marker, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, virtual environment, etc. Specifically, similar to tossing the mute switch up and down on a mobile phone or tossing the recorder left and right, it can also reflect input without a physical switch, such as screen gestures (left to right, right to left, top to bottom, bottom to top, etc.), pop-up interface filling (e.g., form entry), file (e.g., XML format) import, voice input, configuration file input, pop-up / menu selection, virtual keyboard input displayed on the screen, etc. This embodiment of the invention does not specifically limit these methods.

[0213] The determination of the original audit log can also be made by the user settings on the audit system side. The user settings on the audit system side are similar to those on the data transaction related system. The setting result is generated from the audit system to the data transaction related system. The transmission protocol, data format and data content are not specifically limited in this embodiment of the invention.

[0214] The original audit log includes, but is not limited to, at least one of the following: data transaction related system identifier, operation subject of the original audit log, operation behavior of the original audit log, protocol version number, command category, monitoring item category, information format, data packet length, custom fields, compliance audit system identifier, network address of the data transaction related system, hardware address of the data transaction related system, business internal index number of the audit system, business internal index number of the data transaction related system, type of original audit log, name of the original audit log, size of the original audit log, description of the content of the original audit log, content of the original audit log, search terms of the content of the original audit log, ownership identifier of the original audit log, transaction type, transaction identifier, transaction time, buyer, seller, service provider, exchange identifier, classification number of the original audit log, ownership subject of the original audit log, creation time of the original audit log, creation location of the original audit log, operation time of the original audit log, operation location of the original audit log, operation result of the original audit log, encrypted fields, and a measure of the integrity of the original audit log to be generated, and a signature.

[0215] Based on any of the above embodiments Figure 3 This is a flowchart illustrating the lightweight data transaction evidence preservation method provided by the present invention, as follows: Figure 3 As shown, the data transaction evidence storage method occurs before data transaction monitoring. That is, the data transaction evidence storage method is to store the evidence storage audit logs in the centralized audit system and the local audit system so that the original audit logs can be verified based on the evidence storage audit logs during data transaction monitoring.

[0216] The method includes the following steps:

[0217] S1. Centralized audit system B sends audit instructions to data transaction-related system A:

[0218] Specifically, after identifying the object to be audited, the centralized audit system B can generate an audit instruction based on the object and send the audit instruction to the data transaction-related system A where the object to be audited is located.

[0219] S2. Data transaction-related system A returns an audit instruction response to centralized audit system B:

[0220] Upon receiving an audit instruction, data transaction system A generates an audit instruction response. This response signifies the establishment of an authentication relationship between data transaction system A and centralized audit system B. Subsequently, data transaction system A sends the audit instruction response to centralized audit system B.

[0221] S3, Generation Strategy Set and Content Set:

[0222] After receiving an audit instruction response, centralized audit system B can generate a policy set and a content set based on the information of the audited object carried within it. Here, the policy set is the set of policies to be applied to candidate anti-tampering content, and the content set is the set of candidate anti-tampering content.

[0223] S4. The centralized audit system B sends the strategy set and content set to the local audit system C.

[0224] S5. Determine the original audit log:

[0225] Data transaction-related system A can generate raw audit logs for the objects to be audited.

[0226] S6. Local auditing system C sends the anti-tampering content usage policy and anti-tampering content to data transaction related system A:

[0227] Upon receiving the strategy set and content set, the local audit system C can select at least one anti-tampering content to use the strategy and at least one anti-tampering content, respectively, and send the selected at least one anti-tampering content to the data transaction related system A.

[0228] S7. Generate the original audit log after inserting tamper-proof content:

[0229] After receiving at least one anti-tampering content usage policy and at least one anti-tampering content, data transaction related system A can insert the anti-tampering content into the original audit log based on the anti-tampering content usage policy, thus obtaining the original audit log after inserting the anti-tampering content.

[0230] S8. Generate evidence audit log:

[0231] After obtaining the original audit log with the tamper-proof content inserted, data transaction system A transforms the original audit log with the tamper-proof content inserted to obtain the authentication verification code, and generates a storage audit log carrying the authentication verification code.

[0232] S9. Data transaction related system A sends the original audit log and the evidence audit log to the local audit system C.

[0233] S10. The local audit system C returns the original audit log reporting response and the evidence audit log reporting response to the data transaction related system A.

[0234] S11. Local audit system C reports the evidence audit log to centralized audit system B.

[0235] S11' Data transaction related system A reports the evidence storage audit log to the centralized audit system B.

[0236] S12. The centralized audit system B returns a response to the evidence audit log report to the local audit system B.

[0237] S12', The centralized audit system B returns a report response for the evidence storage audit log to the data transaction related system A.

[0238] Steps S11 and S12 can be executed, or steps S11' and S12' can be executed.

[0239] Based on any of the above embodiments Figure 4 This is one of the interactive diagrams of the data transaction-related system and the auditing system provided by the present invention, such as... Figure 4 As shown, data transaction-related system A can include various types of data transaction-related systems, such as data service-related systems A1 and A1', data ownership confirmation systems A2 and A2', data catalog publishing systems A3 and A3', data transaction systems A4 and A4', etc. In addition, there can be other data transaction-related systems such as data delivery systems A5 and A5', data transfer systems A6 and A6'.

[0240] Furthermore, data service-related systems A1 and A1' are mainly service systems that precede data ownership confirmation or data transactions, such as data collection systems, data organization systems, data cleaning systems, data analysis systems, and data processing systems.

[0241] The data ownership confirmation systems A2 and A2' are primarily used to determine the ownership of data.

[0242] The data catalog publishing systems A3 and A3' are mainly used for listing data products on data exchanges.

[0243] The data trading systems A4 and A4' are mainly used to complete the entire transaction process. They can consist of multiple systems that cover functions such as pricing, negotiation, contract signing, and data delivery.

[0244] Data delivery systems A5 and A5' are primarily used to ensure the correct delivery of data to the buyer after a contract has been signed.

[0245] Data transfer systems A6 and A6' are primarily used for security control and management of the data transfer process.

[0246] Data transaction-related system A can communicate with local audit system C, and centralized audit system B can communicate with each other and with local audit system C. Data transaction-related system A can also communicate directly with centralized audit system B.

[0247] Figure 5 This is the second interactive diagram of the data transaction-related system and the auditing system provided by this invention, as shown below. Figure 5 As shown, the relationship between data transaction-related systems and local audit systems can be one-to-one, one-to-many, many-to-one, or many-to-many. That is, a data transaction-related system can interact with only one local audit system, a data transaction-related system can interact with multiple local audit systems, multiple data transaction-related systems can interact with one local audit system, and multiple data transaction-related systems can interact with multiple local audit systems.

[0248] The relationship between data transaction-related systems and centralized audit systems can be one-to-one, one-to-many, many-to-one, or many-to-many. That is, a data transaction-related system can interact with only one centralized audit system, a data transaction-related system can interact with multiple centralized audit systems, multiple data transaction-related systems can interact with one centralized audit system, or multiple data transaction-related systems can interact with multiple centralized audit systems.

[0249] The relationship between a local audit system and a centralized audit system can be one-to-one, one-to-many, many-to-one, or many-to-many. That is, a local audit system can interact with only one centralized audit system, or a local audit system can interact with multiple centralized audit systems. Multiple data transaction-related systems can also interact with one centralized audit system, or multiple data transaction-related systems can also interact with multiple centralized audit systems.

[0250] The interaction methods and content between two similar entity systems (local audit system, centralized audit system, data transaction related system) can be the same as or different from any other two entity systems (local audit system, centralized audit system, data transaction related system).

[0251] This multi-layered, flexible deployment architecture allows the interaction between data transaction-related systems and local audit systems, data transaction-related systems and centralized audit systems, and local audit systems and centralized audit systems to increase or decrease with the scale of deployment. Based on the evidence-based audit logs, infringement can be traced and tracked across the entire domain.

[0252] By designing a scalable, multi-level evidence storage architecture, the load on the centralized audit system service is significantly reduced. Functions such as data organization, management, retrieval, and download are offloaded to the local audit system service, improving the high concurrency and high availability of the centralized audit system. At the business level, through the regulatory services of the centralized audit system, infringement can be traced and tracked across the entire domain based on the evidence storage audit logs.

[0253] Based on any of the above embodiments Figure 6 This is a schematic diagram of the lightweight data transaction monitoring device provided by the present invention, as shown below. Figure 6 As shown, the device includes:

[0254] The object determination unit 610 is used to determine the object to be audited;

[0255] The log matching unit 620 is used to obtain the pre-stored evidence audit log of the audited object and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0256] The transaction monitoring unit 630 is used to monitor data transactions of the audited object based on the original audit log.

[0257] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a lightweight data transaction monitoring method, which includes:

[0258] Identify the entities to be audited;

[0259] Obtain the pre-stored evidence audit log of the audited object, and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0260] Based on the original audit logs, data transaction monitoring is performed on the audited object.

[0261] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0262] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is able to execute the lightweight data transaction monitoring method provided by the above methods, the method comprising:

[0263] Identify the entities to be audited;

[0264] Obtain the pre-stored evidence audit log of the audited object, and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0265] Based on the original audit logs, data transaction monitoring is performed on the audited object.

[0266] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the lightweight data transaction monitoring method provided by the methods described above, the method comprising:

[0267] Identify the entities to be audited;

[0268] Obtain the pre-stored evidence audit log of the audited object, and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system.

[0269] Based on the original audit logs, data transaction monitoring is performed on the audited object.

[0270] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0271] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0272] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lightweight data transaction monitoring method, characterized in that, The data transaction monitoring method, applied to an auditing system, includes: Identify the entities to be audited; Obtain the pre-stored evidence audit log of the audited object, and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system. Based on the original audit logs, data transaction monitoring is performed on the audited object; The process of obtaining the pre-stored evidence audit logs of the object to be audited also includes, prior to: Based on the information of the object to be audited, determine the anti-tampering content usage strategy and the anti-tampering content; The anti-tampering content usage strategy and the anti-tampering content are sent to the data transaction-related system where the audited object is located, so that the data transaction-related system inserts the anti-tampering content into the original audit log of the audited object based on the anti-tampering content usage strategy, and generates a storage audit log based on the authentication verification code obtained by transforming the original audit log after inserting the anti-tampering content; The system receives the evidence storage audit log sent by the data transaction-related system; wherein the audit system only stores the evidence storage audit log and does not store the original audit log. The process of matching the original audit log of the audited object based on the evidence-preserving audit log includes: Obtain the candidate audit logs of the object to be audited; Based on the anti-tampering content usage strategy, the anti-tampering content is inserted into the candidate audit log, and the candidate audit log after inserting the anti-tampering content is transformed to obtain the log to be matched; If the log to be matched is consistent with the evidence audit log, the candidate audit log is determined as the original audit log; The audit system includes a centralized audit system and a local audit system; When the data transaction monitoring method is applied to the local audit system, determining the anti-tampering content usage strategy and anti-tampering content based on the information of the audited object includes: Receive the set of strategies and the set of content determined by the centralized audit system based on the information of the audited object; Based on the original audit logs, at least one anti-tampering content usage policy is determined from the policy set, and at least one anti-tampering content is determined from the content set; When the data transaction monitoring method is applied to the local audit system, receiving the evidence audit log sent by the data transaction-related system includes: Receive the original audit log and the evidence audit log sent by the data transaction related system, use the original audit log as the candidate audit log of the object to be audited, and return the original audit log reporting response and the evidence audit log reporting response to the data transaction related system; The evidence audit log is sent to the centralized audit system, and the evidence audit log reporting response is received from the centralized audit system.

2. The lightweight data transaction monitoring method according to claim 1, characterized in that, The steps for determining the information of the object to be audited include: Generate audit instructions; The audit instruction is sent to the data transaction-related system where the audited object is located, and the audit instruction response is received from the data transaction-related system. The information of the audited object is determined from the audit instruction response.

3. The lightweight data transaction monitoring method according to claim 2, characterized in that, The audit instruction response is generated by the data transaction-related system based on at least one of the following: the system identifier of the audit system, network communication address, timestamp information, information of the audited object, and a summary of the audit instruction.

4. The lightweight data transaction monitoring method according to claim 1, characterized in that, The process of determining the anti-tampering content usage strategy based on the information of the audited object includes: Based on the type of the original audit log of the object to be audited, determine the strategy for using the anti-tampering content; or, Based on the type of the original audit log of the audited object, and at least one of the following: protocol version number, monitoring item category, information format, data packet length, custom fields, data transaction related system identifier, data transaction related system network address, data transaction related system hardware address, data transaction related system business internal index number, original audit log size, and original audit log content description, the anti-tampering content usage strategy is determined.

5. The lightweight data transaction monitoring method according to claim 1, characterized in that, The audit system includes a centralized audit system and a local audit system; When the data transaction monitoring method is applied to the centralized audit system, determining the anti-tampering content usage strategy and anti-tampering content based on the information of the audited object includes: Based on the information of the object to be audited, a strategy set and a content set are generated; The policy set and the content set are sent to the local audit system so that the local audit system can determine at least one anti-tampering content usage policy from the policy set and at least one anti-tampering content from the content set.

6. The lightweight data transaction monitoring method according to claim 1, characterized in that, The audit system includes a centralized audit system and a local audit system; When the data transaction monitoring method is applied to the centralized audit system, receiving the evidence storage audit log sent by the data transaction-related system includes: It directly receives the evidence audit logs sent by the data transaction-related system and directly returns an evidence audit log reporting response to the data transaction-related system. Alternatively, it can receive the evidence audit log sent by the data transaction-related system and forwarded by the local audit system, and return an evidence audit log reporting response to the local audit system.

7. The lightweight data transaction monitoring method according to any one of claims 1 to 6, characterized in that, Also includes: Receive monitoring user settings; In response to the monitoring user settings, determine at least one of the following: candidate anti-tampering content usage strategy, candidate anti-tampering content, and anti-tampering content generation strategy corresponding to the monitoring user settings; The anti-tampering content usage strategy is at least one of the candidate anti-tampering content usage strategies; And / or, The anti-tampering content is at least one of the candidate anti-tampering contents, or the anti-tampering content is determined based on the anti-tampering content generation strategy; The forms of monitoring user settings include at least one of the following: rule-based, configuration file, button, circle, checkmark, mark, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, and virtual reality.

8. The lightweight data transaction monitoring method according to any one of claims 1 to 6, characterized in that, The original audit logs are determined based on data transaction user settings and / or monitoring user settings; The forms of data transaction user settings and / or monitoring user settings include at least one of the following: rule-based, configuration file, button, circle, checkmark, mark, key, scroll wheel, menu, voice, video, eye contact, gesture, text, bioelectrical signals, and virtual reality.

9. A lightweight data transaction monitoring device, characterized in that, The data transaction monitoring device, used in an auditing system, includes: The object determination unit is used to determine the object to be audited; The log matching unit is used to obtain the pre-stored evidence audit log of the audited object and match the original audit log of the audited object based on the evidence audit log. The evidence audit log is obtained by the data transaction related system where the audited object is located, after inserting anti-tampering content into the original audit log based on the anti-tampering content usage strategy. The anti-tampering content usage strategy and the anti-tampering content are determined by the audit system. The transaction monitoring unit is used to monitor data transactions of the audited object based on the original audit logs. The process of obtaining the pre-stored evidence audit logs of the object to be audited also includes, prior to: Based on the information of the object to be audited, determine the anti-tampering content usage strategy and the anti-tampering content; The anti-tampering content usage strategy and the anti-tampering content are sent to the data transaction-related system where the audited object is located, so that the data transaction-related system inserts the anti-tampering content into the original audit log of the audited object based on the anti-tampering content usage strategy, and generates a storage audit log based on the authentication verification code obtained by transforming the original audit log after inserting the anti-tampering content; The system receives the evidence storage audit log sent by the data transaction-related system; wherein the audit system only stores the evidence storage audit log and does not store the original audit log. The process of matching the original audit log of the audited object based on the evidence-preserving audit log includes: Obtain the candidate audit logs of the object to be audited; Based on the anti-tampering content usage strategy, the anti-tampering content is inserted into the candidate audit log, and the candidate audit log after inserting the anti-tampering content is transformed to obtain the log to be matched; If the log to be matched is consistent with the evidence audit log, the candidate audit log is determined as the original audit log; The audit system includes a centralized audit system and a local audit system; When the data transaction monitoring device is applied to the local auditing system, determining the anti-tampering content usage strategy and anti-tampering content based on the information of the audited object includes: Receive the set of strategies and the set of content determined by the centralized audit system based on the information of the audited object; Based on the original audit logs, at least one anti-tampering content usage policy is determined from the policy set, and at least one anti-tampering content is determined from the content set; When the data transaction monitoring device is applied to the local audit system, receiving the evidence audit log sent by the data transaction related system includes: Receive the original audit log and the evidence audit log sent by the data transaction related system, use the original audit log as the candidate audit log of the object to be audited, and return the original audit log reporting response and the evidence audit log reporting response to the data transaction related system; The evidence audit log is sent to the centralized audit system, and the evidence audit log reporting response is received from the centralized audit system.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the lightweight data transaction monitoring method as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the lightweight data transaction monitoring method as described in any one of claims 1 to 8.

Images