Database log auditing method based on block chain combined with IPFS

Abstract

The invention discloses a database log auditing method based on a block chain in combination with an IPFS. Traditional database log auditing depends on a centralized database, and potential safety hazards exist. According to the method, the hash value of the log data is recorded on the block chain by using the decentralization and tamper-resistant characteristics of the block chain, so that the integrity and traceability of the data are ensured. The content addressing and duplicate elimination technology of the IPFS is used for storing the log data, so that the storage burden of the block chain is effectively reduced. In addition, a secret sharing mechanism is introduced to protect key information, and a secret key is managed. By analyzing the performance of the technical scheme in the aspects of authority access control, storage cost, auditing efficiency and the like and evaluating the safety and performance of the technical scheme, the feasibility and superiority of the method in practical application are verified, and a reliable solution is provided for enterprise-level safety auditing.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain, and in particular to a database log auditing method based on blockchain combined with IPFS. Background Art

[0002] In the era of digital economy, more and more companies choose to use digital technology for digital transformation to improve their core competitiveness. However, with the advancement of digital transformation, although the sharing and exchange of large amounts of data and information has improved the efficiency of information communication, it has also brought new information security risks. According to the "2022 Data Leakage Situation Analysis Report" released by the Shanjie Information Security and Strategic Research Center, the main reasons for the leakage and tampering of sensitive data include not only external attacks, but also chaotic permission management, such as unauthorized access, database configuration errors, malicious behavior of insiders, and system vulnerabilities. These problems usually come from within the enterprise, especially those developers, testers, operators, and managers who have access to business systems and databases. For example, users with root permissions can bypass the security mechanism of the business system and directly access and modify all data in the database. This abuse of permissions may render all risk control measures ineffective. There have been companies that have caused important customer data to be leaked due to malicious operations by internal employees, causing serious financial losses and reputation damage to the company. These incidents show that internal security risks are a serious challenge facing enterprises. Once security issues such as information theft and data tampering occur, the balance between "pursuing efficiency" and "pursuing security" will be broken. Traditional security measures often appear powerless in these situations. To meet this challenge, database log auditing becomes crucial because it can provide support for subsequent security measures by auditing users' data access and modification operations.

[0003] In this case, the database log audit system came into being. The existing system records various operation logs in the system, monitors and analyzes user behavior to discover potential security risks and abnormal activities. When an adversary with root access to the database manipulates the database to perform risky operations, the audit system administrator can track and analyze the security incident through detailed log records, determine the root cause of the problem, prevent similar incidents from happening again, and improve the overall security defense capabilities.

[0004] However, despite the huge advantages brought by the log audit system, it also faces some risks and challenges. A key requirement of auditing is to provide data integrity throughout the system life cycle to ensure the accuracy of the audit. Traditional log audit systems usually rely on traditional databases as the medium for record keeping. This client-server model regards the database as the only trust point for audit logs. This design makes the database a single point of failure risk source, and the audit log is vulnerable to damage in multiple aspects.

[0005] For example, in Figure 1 In the simplified model, the traditional database log audit system usually involves three parties: operation and maintenance personnel, system database, and auditors. Specifically, when the operation and maintenance personnel perform daily operations, the system database will record these operation logs, and the auditors are responsible for auditing these logs. However, if the operation and maintenance personnel collude with the auditors, the auditors may ignore, tamper with, or delete the audit logs, resulting in the system administrator being unable to restore the true operation records, allowing the operation and maintenance personnel to successfully evade the audit system. This shows that the traditional database log audit system has huge challenges in terms of security and auditability, and a more secure and tamper-proof audit log framework is urgently needed to meet these challenges. Blockchain technology, especially the decentralized and tamper-proof characteristics, provides a new idea for solving the security and integrity problems in traditional audit systems.

[0006] Although traditional blockchain applications can improve the security of log auditing, there are challenges in terms of storage costs, computing overhead and user experience. IPFS technology, as a distributed storage solution, can effectively reduce storage costs, but how to combine it with blockchain to optimize the efficiency and security of the log auditing system is still an unresolved problem.

[0007] In this context, blockchain technology provides a new solution. Blockchain technology, with its characteristics of decentralization, immutability and traceability, has been applied to many fields such as the Internet of Things, finance, and logistics. In the field of information security, researchers have applied blockchain technology to log auditing to solve the security problems in traditional auditing systems. The blockchain-based log auditing system ensures the integrity and immutability of the data by recording log data on the blockchain. This approach not only improves the security and reliability of log auditing, but also provides a more effective solution for dealing with potential audit risks. Further research and practice have shown that blockchain technology can automate the audit process through smart contracts, reduce human intervention, and thus improve the efficiency and accuracy of auditing. Summary of the invention

[0008] In view of the deficiencies in the prior art, the present invention provides a database log auditing method based on blockchain combined with IPFS.

[0009] The technical solution adopted by the present invention is:

[0010] Step 1: Take the security parameters as input to obtain the public parameters and the master private key of the audit service platform;

[0011] Taking public parameters, the master private key of the audit service platform and audit project information as input, a unique identifier for the audit project is generated;

[0012] generating a key for encrypting log data using the unique identifier and the public parameters;

[0013] Step 2: pre-processing the log data to filter out log entries that may be at risk, and encrypting the log entries using the key;

[0014] Step 3: Use the IPFS module to distribute the log data, store the encrypted logs in blocks, and generate a root hash value to ensure the integrity and immutability of the data;

[0015] Step 4: After successfully storing the log in the IPFS module, the blockchain module is used to further ensure the traceability and immutability of the log;

[0016] Step 5: Auditors conduct a safe and effective audit of the logs generated by the operation and maintenance personnel operating the database through the interaction of the audit service platform, IPFS module and blockchain network.

[0017] Beneficial effects of the invention: The invention provides an efficient, secure and scalable log audit solution, which effectively addresses many problems in traditional systems, including data tampering, excessive storage costs and insufficient system performance; by storing log data hashes on the blockchain and distributing log files in IPFS, data immutability, efficient storage and cost optimization are achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a traditional database log audit system;

[0019] Figure 2 A flowchart of a database log audit method based on blockchain and IPFS provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, which does not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Before proposing the method involved in the embodiment of the present application, the database log audit architecture on which the method of the embodiment of the present application relies is first introduced:

[0022] The database log audit architecture in the embodiment of the present application includes six main entities: operation and maintenance personnel, database, auditors, IPFS, blockchain network, and audit service platform, among which the operation and maintenance personnel and database together constitute the audit project, and the auditors, IPFS, blockchain network and audit service platform constitute the audit system BCISLAS.

[0023] Operation and maintenance personnel: They are the highest-authority users of the database in the audit project and can directly access and operate the system database. Their operation logs are the focus of the audit because these logs involve key operations and sensitive data of the system. Auditing the operation logs of operation and maintenance personnel can ensure the legality and standardization of system operations and prevent abuse of authority and potential security threats.

[0024] Database: stores all operation log data of operation and maintenance personnel, including user activities and system events. This data needs to be processed, stored and verified to ensure integrity and non-tamperability.

[0025] Auditors: Professionals responsible for performing audit tasks. They access, analyze, and verify log data in audit projects through the audit service platform. However, auditors may collude with operation and maintenance personnel to help them pass the audit tasks.

[0026] IPFS: Used for distributed storage of log data generated by audit projects. It uses the distributed storage characteristics of network nodes to store log data on multiple nodes to ensure high availability and reliability of data. Storing large-capacity log data on IPFS can reduce the storage burden of the blockchain network while ensuring the integrity and security of the data.

[0027] Blockchain: The core component of the system, used to store the hash values ​​of processed log data. The decentralized and tamper-proof characteristics of blockchain ensure the credibility and security of data. Whenever the log data processed by the audit service platform is uploaded to IPFS, the corresponding hash value will be recorded on the blockchain. These hash values ​​can be used to verify the integrity of log data and prevent data from being tampered with or lost.

[0028] Audit service platform: It is the interface for auditors to interact with the system. The platform provides a complete set of tools and functions to support the collection, processing, encryption, storage and verification of log data. The platform also provides early warning functions to help auditors quickly discover and respond to potential security risks.

[0029] In the embodiments of this application, it is assumed that the audit service platform, IPFS, blockchain, and database are all semi-honest, that is, these systems and platforms behave as "honest and curious" in the data processing process, strictly follow the protocol, but may analyze the protocol and data content to obtain additional information. However, they will not actively perform malicious operations or tamper with data. In contrast, operation and maintenance personnel and auditors are "malicious but rational".

[0030] It is believed that operation and maintenance personnel will bypass the security mechanism of the business system and directly access and modify all data in the database only when they can obtain additional economic benefits. This behavior may lead to security issues such as sensitive data leakage and data tampering, causing serious damage to internal systems. For example, operation and maintenance personnel may threaten the integrity and security of the system by bypassing security mechanisms to access sensitive data or modify key records.

[0031] Auditors may turn a blind eye to risk information in audit logs for personal gain (for example, colluding with operation and maintenance personnel), or may even modify or forge audit logs.

[0032] Assume that there is a competitive relationship between each auditor, that is, once an auditor is found to be doing evil by other auditors, the evil doer will be punished, and other auditors will be rewarded. This mechanism reduces the possibility of auditors colluding to do evil. This assumption is reasonable. For example, in game theory, participants will choose the best strategy in a competitive environment to maximize their own interests; in the field of information security, many technology companies and open source projects encourage security researchers to report vulnerabilities through Bug Bounty Program. These programs ensure the security of the system by rewarding researchers who discover vulnerabilities and imposing severe penalties on malicious exploitation of vulnerabilities.

[0033] Based on the database log audit architecture and assumptions described above, such as Figure 2 As shown, a database log audit method based on blockchain combined with IPFS provided in an embodiment of the present application includes the following steps:

[0034] Step 1, initialization is the core startup part of the BCISLAS system, ensuring that the system has all necessary parameters and configurations before starting operation.

[0035] 1. Audit service platform with security parameters As input, the probabilistic polynomial time algorithm Setup is used to generate the public parameter pp and the master private key m of the audit service platform. sk ,Right now in Specified as a unary string, that is, to encode a value as an integer The safety parameter represents the ideal trade-off between safety and performance and provides input That is one bit string whose bits are all 1, because the running time is bounded polynomially in the length of the input, not in the actual value of the input. sk It is the core security element of the system and is kept by the audit service platform. It is used to generate unique identifiers and ensure the confidentiality of data.

[0036] 2. The audit service platform constructs a unique identifier generation algorithm IdGen, using public parameters pp, the identity information of the audit project or auditor m i and the master private key m of the audit service platform sk As input, output a unique identifier ID i ,As shown in formula (1), this identifier is used to distinguish different audit projects or auditors, ensuring that log data or auditors will not be confused. That is, this unique identifier is not only the core of subsequent encrypted logs and indexes, but also serves as key information for identifying and locating log entries during the audit process.

[0037] ID i ←IdGen(pp,m i ,m sk )(1)

[0038] Where i represents the type of input certification material, such as P and i represent the audit project and auditor respectively.

[0039] 3. In order to ensure the security of log data, the audit service platform uses pp and ID P Generates encryption keys for audit log items The AES algorithm is an efficient and widely used symmetric encryption algorithm that provides strong data protection.

[0040] Step 2: Process the real-time operation log data stream sent by the audit project, apply risk rules to filter the logs, and encrypt the filtered logs.

[0041] 1. The audit service platform sets the risk rule R, risk threshold τ and filtering threshold θ. The risk rule R is composed of a set of predefined rules used to determine whether a log entry has risks. Each risk rule consists of a set of keywords. in, denoted as a keyword, s is the number of risk rule keywords. The risk threshold τ represents the minimum similarity value for a log entry to be considered a risk, while the filtering threshold θ represents the number of log entries that need to be processed.

[0042] These risk rules are mapped into vector representations through the pre-trained word embedding model Word2Vec. The vector representation is Average the keyword vectors in each risk rule to get the vector representation of the risk rule Used to capture the overall semantics of the rule.

[0043] 2. When the operation and maintenance personnel operate the database, the audit service platform will collect operation logs L = {l1,l2,…,l n}, for log entry l i , extract its keywords Where k is the number of keywords, and is mapped to a vector representation through a word embedding model. The keyword vectors in each log are averaged to obtain the vector representation of each log, as shown below:

[0044]

[0045] 3. The audit service platform can effectively identify potential risk logs by using the word embedding model to calculate the similarity between the collected log entries and risk rules. This embodiment uses cosine similarity to calculate the log entry l i Vector Risk Rule Vector The semantic similarity between them is:

[0046]

[0047] Among them, · represents the dot product of the vectors, and ‖·‖ represents the norm of the vectors.

[0048] For each log entry l i Calculate its difference with all risk rules r i The semantic similarity of and select the largest semantic similarity:

[0049]

[0050] If Semsim max (l i )>τ, then l i Add temporary filter log collection middle:

[0051]

[0052] 4. When the log entries in the buffer exceed the filtering threshold θ, that is The audit service platform will Perform encryption processing to obtain filtered encrypted risk logs

[0053]

[0054] Encrypted risk log Will be sent to the IPFS module for processing.

[0055] Furthermore, in order to distinguish different log data, this embodiment uses L and L i and Where i represents the number of the logs to be processed in sequence.

[0056] Step 3: Use IPFS to distribute the log data, store the encrypted logs in blocks, and generate a root hash value to ensure the integrity and immutability of the data.

[0057] 1. Divide the encrypted log into multiple data blocks of a certain size, and calculate the hash value of each data block to build the Merkle-DAG structure until the root hash value, i.e., the content addressable identifier, is obtained. This process ensures that log data can be quickly located and retrieved in distributed storage. In this way, files can be managed effectively, and only one file reference needs to be added without taking up additional storage space.

[0058] 2. Store the Merkle-DAG structure in the IPFS network and return the root hash value The audit service platform is used by the subsequent blockchain module to verify the integrity of the data. In this way, the log data is stored safely and efficiently on the chain, providing a basic data structure for subsequent log query and verification.

[0059] Step 4: Blockchain technology ensures the immutability and transparency of data through its distributed ledger and consensus mechanism. Blockchain technology is used to store the hash value of log data to achieve integrity verification and audit tracking of log data.

[0060] 1. In order to distinguish different encrypted logs, the embodiment of the present application uses ID P and log timestamp Combined into query hash This key acts as an index for the log hash in the blockchain, ensuring that each log hash can be accurately retrieved by its unique key. and Stored in the blockchain, the blockchain records according to the consensus mechanism.

[0061] 2. The PBFT consensus algorithm is used in the blockchain network for transaction verification and block generation. This consensus algorithm is an algorithm that reaches consensus when a few nodes act maliciously, and has high throughput and low confirmation time.

[0062] Step 5: Auditors conduct a safe and effective audit of the logs generated by the operation and maintenance personnel operating the database through the interaction of the audit service platform, IPFS module and blockchain network.

[0063] 1. Auditors send auditor information to the audit service platform A Register and get the auditor's unique identifier ID A ←IdGen(pp,m A ,m sk ) and assign audit tasks based on unique identifiers.

[0064] 2. The audit service platform uses secret sharing technology to share the key of the audit project Distribute to multiple auditors, each auditor gets a part of the key. This can improve the security of the system and avoid single point failure.

[0065] 3. After the auditor observes the risk abnormality alarm in the audit project on the audit service platform, he / she can query the hash Call the smart contract to obtain the log hash value of the corresponding risk alert from the blockchain

[0066] 4. Auditors obtain encrypted logs from IPFS through log hash values Then, apply for decryption service from the audit service platform.

[0067] 5. The audit service platform will send a request for key service to other auditors. If other auditors also observe the corresponding risk alert, they will send the corresponding key share, otherwise it will be rejected.

[0068] 6. When the audit service platform collects enough key shares, it will restore the key Used to decrypt encrypted logs and obtain decrypted logs And decrypt the log Sent to auditors with key shares for audit.

[0069] 7. Each auditor conducts an audit based on risk rule R and generates an audit report which is fed back to the audit service platform.

[0070] In summary, the technical solution provided by the embodiment of the present invention has the following advantages:

[0071] 1) By using the AES algorithm for symmetric encryption, strong data protection is provided during the transmission and storage of log data. The encrypted log data is distributedly stored in the IPFS module and its hash value is recorded on the blockchain, which ensures the confidentiality and integrity of the data during storage and retrieval. Even in the case of malicious attacks or data tampering, the system can effectively protect the security of log data.

[0072] 2) Taking advantage of the immutability and transparency of blockchain technology, the hash value of log data is recorded on the blockchain through the PBFT consensus algorithm. This not only prevents tampering of log data, but also ensures the integrity of audit records. The distributed ledger mechanism of blockchain ensures that all participants have a consistent understanding of the immutability of log data, which improves the credibility and transparency of the system.

[0073] 3) The IPFS module achieves efficient distributed storage by storing encrypted log data in blocks and generating root hash values ​​for content addressing. This method effectively reduces the demand for storage space and optimizes data retrieval speed. At the same time, the decentralized storage structure of IPFS enhances the robustness and fault tolerance of the system.

[0074] 4) Flexible risk rules and thresholds are set in log processing. The similarity between log entries and risk rules is calculated through word embedding models, which can intelligently identify potential risk logs. Log entries are stored in a buffer and encrypted according to similarity and thresholds. This mechanism improves the accuracy of risk detection and reduces the burden of the system processing unnecessary logs.

[0075] 5) Audit verification uses secret sharing technology to distribute keys to ensure the security and multiple verification of the audit process. This method avoids single point failure and improves the security of the system. Auditors use key shares to decrypt and audit logs to ensure the accuracy and fairness of the audit results. At the same time, the smart contract mechanism ensures the validity and consistency of the log hash values ​​obtained during the audit process.

[0076] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or in any form that the information constitutes prior art known to those skilled in the art.

Claims

1. A database log audit method based on blockchain combined with IPFS, the method comprising the following steps: Step 1: Take the security parameters as input to obtain the public parameters and the master private key of the audit service platform; Taking public parameters, the master private key of the audit service platform and audit project information as input, a unique identifier for the audit project is generated; generating a key for encrypting log data using the unique identifier and the public parameters; Step 2: pre-processing the log data to filter out log entries that may be at risk, and encrypting the log entries using the key; Step 3: Use the IPFS module to distribute the log data, store the encrypted logs in blocks, and generate a root hash value to ensure the integrity and immutability of the data; Step 4: After successfully storing the log in the IPFS module, the blockchain module is used to further ensure the traceability and immutability of the log; Step 5: Auditors conduct a safe and effective audit of the logs generated by the operation and maintenance personnel operating the database through the interaction of the audit service platform, IPFS module and blockchain network.

2. According to a database log audit method based on blockchain combined with IPFS according to claim 1, it is characterized in that: In step 1, a probabilistic polynomial time algorithm is used to generate public parameters and the master private key of the audit service platform.

3. According to a database log audit method based on blockchain combined with IPFS according to claim 1 or 2, it is characterized in that: In step 1, the key is generated using a symmetric encryption algorithm.

4. According to a database log audit method based on blockchain combined with IPFS according to claim 1, it is characterized in that: Step 2 is specifically: Set risk rules, risk thresholds, and filtering thresholds on the audit service platform. By collecting the operation logs of the operation and maintenance personnel on the database in real time, extract the keywords of each log, and calculate the similarity between the log and the rules based on the matching degree between the keywords and the risk rules; If the similarity exceeds the risk threshold, the log entry is temporarily stored in the filtered log collection; Once the number of log entries in the filtered log set reaches the filtering threshold, these log entries are encrypted using the key generated in step 1.

5. According to a database log audit method based on blockchain combined with IPFS according to claim 4, it is characterized in that: The risk rules are mapped into vector representations through the pre-trained word embedding model Word2Vec.

6. According to a database log audit method based on blockchain combined with IPFS according to claim 1, it is characterized in that: In step 3, the encrypted log set is divided into blocks according to size in the IPFS module, and a hash value is generated for each data block, thereby constructing a Merkle-DAG structure.

7. According to a database log audit method based on blockchain combined with IPFS according to claim 1, it is characterized in that: Step 4 is as follows: The unique key of each log is used as the log hash index, and the smart contract is called to store the log hash index and the corresponding encrypted log root hash in the blockchain; in this process, the blockchain network verifies the validity of the transaction through the PBFT consensus algorithm and generates blocks containing these log hash values, thereby ensuring that the log's on-chain records cannot be tampered with.

8. According to claim 7, a database log audit method based on blockchain combined with IPFS is characterized in that: The unique key is a hash value formed by combining the unique identifier generated in step 1 and the timestamp.

9. According to a database log audit method based on blockchain combined with IPFS according to claim 1, it is characterized in that: When an audit needs to be conducted, the auditor registers with the audit service platform, obtains a unique identifier, and is assigned an audit task based on the unique identifier; The audit service platform distributes the key of the audit project to multiple auditors, ensuring that the original key can only be restored when enough key shares are collected; The auditor who is assigned a key share calls the smart contract through the blockchain to obtain the encrypted log root hash based on the log hash index, thereby obtaining the corresponding encrypted log on the IPFS module; After recovering the key and decrypting the log, the auditor audits the log in combination with the risk rules, finally generates an audit report, and feeds the results back to the audit service platform.

10. According to claim 9, a database log audit method based on blockchain combined with IPFS is characterized in that: Before sufficient key shares are collected, it also includes: After the auditor observes the risk abnormality alarm in the audit project on the audit service platform, he / she can obtain the log hash value of the corresponding risk alarm from the blockchain by querying the hash and calling the smart contract; After the auditor obtains the encrypted log from the IPFS module through the log hash value, he / she applies for decryption service from the audit service platform; The audit service platform sends a request for key service to other auditors. If other auditors also observe the corresponding risk abnormality alarm, they will send the corresponding key share, otherwise they will refuse.

Images