Log searching method, device and equipment and readable storage medium

Abstract

The invention discloses a log searching method, device and equipment and a readable storage medium, and belongs to the field of data security. The embodiment is applied to a management system, a target field and a target keyword sent by a user side are received, and a target keyword trap door and a target field identification hash value are respectively obtained based on a secret key of the management system, the target keyword and the target field and are sent to a cloud server; the cloud server determines a target encrypted log entry pointer corresponding to the target keyword trap door and the target field identifier hash value according to a log index in the cloud server and obtains a corresponding target encrypted log entry, and the log index comprises a corresponding relationship among an initial field identifier hash value, the initial field trap door and the encrypted log entry pointer; and receiving the target encrypted log entry and decrypting to obtain a target plaintext, and finally sending the target plaintext to the user side. The application scene of the log searching method can be expanded, data safety in the searching process is guaranteed, and the data query requirement in the actual scene is met.

Description

Technical Field

[0001] The present application belongs to the field of data security, and in particular, relates to a method, apparatus, device, computer-readable storage medium, and computer program product for searching logs. Background Art

[0002] In the era of big data, cloud storage services have become the best choice for processing massive amounts of data due to their convenient, fast, and on-demand network access methods, allowing users to access resources anytime and anywhere, thereby greatly saving local storage resources and local data management and system maintenance costs. In order to protect the confidentiality of data, users usually encrypt the data before uploading it to the cloud server, and search for the corresponding encrypted data from the cloud server when using it.

[0003] In order to further improve the confidentiality of data, the existing technology creates a keyword trapdoor and stores it together with the encrypted log in the cloud server, and users can search the log in the cloud server according to the trapdoor. However, because the expression form of keywords for data query operations is limited, only a single data tag can be queried during the search, so the existing method of searching encrypted logs has limited application scenarios and cannot meet the data query needs in actual scenarios. Summary of the invention

[0004] In a first aspect, an embodiment of the present application provides a method for searching logs, the method being applied to a management system, the method comprising:

[0005] Receiving search information sent by a user terminal, the search information includes a target field, and the target field includes a target keyword;

[0006] Get the target keyword trapdoor based on the target keyword and the secret key of the management system;

[0007] Obtain a target field identifier hash value according to the target field identifier of the target field and the secret key of the management system;

[0008] Sending a target keyword trapdoor and a target field identifier hash value to a cloud server, so that the cloud server determines a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, and obtains a target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer;

[0009] Receive the target encrypted log entry sent by the cloud server, and decrypt the target encrypted log entry to obtain the target plaintext;

[0010] Send the target plaintext to the client.

[0011] In an achievable implementation, before receiving the search information sent by the user terminal, the method further includes:

[0012] Receive a query request sent by a user terminal;

[0013] In response to the query request, the encrypted random value is sent to the user terminal, so that the user terminal decrypts the encrypted random value and signs it to obtain a signature value;

[0014] Receive the signature value sent by the user;

[0015] Verify the signature value, and if the signature value is verified, receive the search information sent by the user.

[0016] In an achievable implementation, before decrypting the target encrypted log entry to obtain the target plaintext, the method further includes:

[0017] Calculate the checksum of the encrypted log entry to obtain the search checksum;

[0018] Verify that the search checksum is consistent with the initial checksum of the encrypted log entry;

[0019] When the search check value is consistent with the initial check value, the target encrypted log entry is decrypted to obtain the target plaintext.

[0020] In an achievable implementation, before receiving the search information sent by the user terminal, the method further includes:

[0021] Get log entries, fields, and keywords within fields;

[0022] Create field tags corresponding to the fields;

[0023] Get the initial field identifier hash value based on the field identifier and the secret key of the management system;

[0024] Get the initial keyword trapdoor based on the keyword and the secret key of the management system;

[0025] Obtain an initial field trapdoor according to the initial field identifier hash value and the initial keyword trapdoor;

[0026] Encrypting the plaintext log entry corresponding to the field and the keyword to obtain an encrypted log entry, and creating an encrypted log entry pointer of the encrypted log entry;

[0027] Building a log index based on the correspondence between the initial field identifier hash value, the initial field trapdoor, and the encrypted log entry pointer;

[0028] Send log index and encrypted log entries to the cloud server.

[0029] In a second aspect, an embodiment of the present application provides a method for searching logs, the method being applied to a cloud server, the method comprising:

[0030] Receive the target keyword trapdoor and target field identifier hash value sent by the management system;

[0031] Determine a target encrypted log entry pointer corresponding to a target keyword trapdoor and a target field identifier hash value according to a log index in the cloud server, wherein the log index in the cloud server includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer;

[0032] Get the target encrypted log entry corresponding to the target encrypted log entry pointer;

[0033] Sends targeted encrypted log entries to the management system.

[0034] In one practicable implementation, determining a target encrypted log entry pointer corresponding to a target keyword trapdoor and a target field identifier hash value according to a log index in a cloud server includes:

[0035] Determine a first log index according to the log index of the target field identifier hash value in the cloud server;

[0036] Obtain a first search trapdoor according to the target keyword trapdoor and the target field identifier hash value;

[0037] A first target encrypted log entry pointer is determined from the encrypted log entry pointers of the first log index according to the first search trapdoor.

[0038] In one practicable implementation, determining a target encrypted log entry pointer corresponding to a target keyword trapdoor and a target field identifier hash value according to a log index established in a cloud server includes:

[0039] Obtain a second search trapdoor according to the target keyword trapdoor and the target field identifier hash value;

[0040] Obtain a Bloom index based on the target field identifier hash value and the second search trapdoor;

[0041] Determine whether the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value;

[0042] When the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value, determining the log index associated with the bit value corresponding to the Bloom index in the Bloom filter array as the second log index, and the Bloom filter array includes a correspondence between the log index and the bit value;

[0043] A second target encrypted log entry pointer is determined from the encrypted log entry pointers of the second log index according to the second search trapdoor.

[0044] In an achievable implementation, before receiving the target keyword trapdoor and the target field identifier hash value sent by the management system, the method further includes:

[0045] Receive log indexes and encrypted log entries sent by the management system.

[0046] In an achievable implementation, after receiving the log index and the encrypted log entry sent by the management system, the method further includes:

[0047] Create a Bloom filter array, the Bloom filter array includes multiple bit values;

[0048] Based on the initial field identifier hash value and the initial field trapdoor in the log index, the initial Bloom index is obtained through the Bloom filter hash function, and the initial Bloom index is mapped to the Bloom filter array to obtain the correspondence between the log index and the bit value. The bit value corresponding to the initial Bloom index in the Bloom filter array is a preset value.

[0049] In a third aspect, an embodiment of the present application provides a device for searching logs, which is applied to a management system, and includes:

[0050] A receiving module, used for receiving search information sent by a user terminal, the search information including a target field, and the target field including a target keyword;

[0051] A determination module, used to obtain a target keyword trapdoor according to the target keyword and a secret key of the management system;

[0052] The determination module is further used to obtain a target field identifier hash value according to a target field identifier of the target field and a secret key of the management system;

[0053] A sending module, used to send a target keyword trapdoor and a target field identifier hash value to a cloud server, so that the cloud server determines a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, and obtains a target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer;

[0054] The receiving module is further used to receive the target encrypted log entry sent by the cloud server, and decrypt the target encrypted log entry to obtain the target plaintext;

[0055] The sending module is also used to send the target plaintext to the user end.

[0056] In a fourth aspect, an embodiment of the present application provides a device for searching logs, which is applied to a cloud server and includes:

[0057] A receiving module, used for receiving a target keyword trapdoor and a target field identifier hash value sent by the management system;

[0058] A determination module, used to determine a target encrypted log entry pointer corresponding to a target keyword trapdoor and a target field identifier hash value according to a log index in the cloud server, wherein the log index in the cloud server includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer;

[0059] An acquisition module, used to acquire a target encrypted log entry corresponding to a target encrypted log entry pointer;

[0060] The sending module is used to send the target encrypted log entries to the management system.

[0061] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement a method for searching logs as in any one of the implementations of the first aspect.

[0062] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, a method for searching logs as in any one of the embodiments of the first aspect is implemented.

[0063] In a seventh aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes a method for searching logs as described in any one of the implementations of the first aspect.

[0064] The embodiment of the present application provides a method, device, equipment, computer-readable storage medium and computer program product for searching logs. The method is applied to a management system. First, by receiving search information including a target field and a target keyword sent by a user end, a target keyword trapdoor is obtained according to the target keyword and the secret key of the management system, and a target field identifier hash value is obtained according to the target field identifier of the target field and the secret key of the management system; by using fields and keywords for searching encrypted logs, the application scenarios of data queries can be expanded to meet the diverse query needs of users. Afterwards, the target keyword trapdoor and the target field identifier hash value are sent to a cloud server, so that the cloud server determines the target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server, and obtains the target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes the corresponding relationship between the initial field identifier hash value, the initial field trapdoor and the encrypted log entry pointer; by matching the trapdoor in the log index to determine the target encrypted log, an efficient search operation can be performed on the encrypted data without decrypting the entire data set, thereby ensuring data security while improving the search speed. Finally, the target encrypted log entries sent by the cloud server are received, the target encrypted log entries are decrypted to obtain the target plaintext, and the target plaintext is sent to the user end; by decrypting the encrypted entries corresponding to the search fields and keywords, the corresponding log plaintext is obtained and sent to the user end, the plaintext of the encrypted log can be searched based on the search fields and keywords, which expands the application scenarios of the method of searching encrypted logs, ensures the security of data during the search process, and meets the data query needs in actual scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0066] Figure 1 This is a signaling interaction diagram of a method for searching logs provided by an embodiment of the present application;

[0067] Figure 2 is a signaling interaction diagram of a method for searching logs provided by another embodiment of the present application;

[0068] Figure 3 This is a flow chart of building a log index provided by an embodiment of the present application;

[0069] Figure 4 It is a flowchart of determining a target encrypted log entry pointer provided by an embodiment of the present application;

[0070] Figure 5 is a flowchart of determining a target encrypted log entry pointer provided by another embodiment of the present application;

[0071] Figure 6 It is a structural block diagram of a device for searching logs provided by an embodiment of the present application;

[0072] Figure 7 is a structural block diagram of a device for searching logs provided by another embodiment of the present application;

[0073] Figure 8 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0074] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0075] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0076] In the era of big data, cloud storage services have become the best choice for processing massive amounts of data due to their convenient, fast, and on-demand network access methods, allowing users to access resources anytime and anywhere, thereby greatly saving local storage resources and local data management and system maintenance costs. In order to protect the confidentiality of data, users usually encrypt the data before uploading it to the cloud server, and search for the corresponding encrypted data from the cloud server when using it.

[0077] In order to further improve the confidentiality of data, the existing technology creates a keyword trapdoor and stores it together with the encrypted log in the cloud server, and users can search the log in the cloud server according to the trapdoor. However, because the expression form of keywords for data query operations is limited, only a single data tag can be queried during the search, so the existing method of searching encrypted logs has limited application scenarios and cannot meet the data query needs in actual scenarios.

[0078] To help understand, first introduce the terms involved in this application. Trapdoor refers to a special structure or key used to search encrypted data. In the embodiment of the present application, the trapdoor is mainly used to help the data owner or authorized user efficiently locate specific information in the encrypted log. Specifically, when the data owner wants to query the audit log, a keyword trapdoor is created using the same algorithm as the encrypted audit log. This trapdoor is generated by the master key, ensuring that no one except the data owner can create a trapdoor for search.

[0079] A log entry refers to a specific log record. A log entry can be composed of multiple fields. Fields refer to different types of data items contained in a log entry. Fields can include multiple keywords with specific meanings. For example, a log entry may include: timestamp: 2024-10-22 14:12:00; user ID: user123; operation type: login; error message: authentication failed; IP address: 192.168.1.1. Among them, timestamp, user ID, operation type, error message and IP address are different fields. "Authentication failed" is a keyword that can be extracted from the "error message" field.

[0080] An encrypted log entry is a log entry that has been processed using an encryption algorithm. Before encryption, the log entry exists in plain text as data that can be directly read and understood, and is then converted into an encrypted log entry using an encryption algorithm.

[0081] In order to solve the problems in the prior art, the embodiments of the present application provide a method, apparatus, device, computer-readable storage medium and computer program product for searching logs. The method for searching logs provided by the embodiments of the present application is first introduced below.

[0082] This embodiment completes the log search through three-end interaction, which includes the user end, the management system and the cloud server. The user end initiates data access and audit log query requests through the management system and receives the query results. The management system is responsible for recording the user's operations on data or system applications, generating user operation logs, and also records and generates system error logs and application logs, etc. and encrypts them, sends the encrypted logs and log indexes to the cloud server for storage, and is responsible for authenticating the user and processing user requests. The cloud server stores the encrypted log data and log index, performs searches according to the traps provided by the management system, and returns matching encrypted log entries.

[0083] To help understand, the basic parameters and functions involved in this application are explained. p and q are two large prime numbers, G1 and G2 are two groups of order q, P0 is a generator on G1, e:G1×G1→G2 is a bilinear pairing, H1:{0,1} * →G1 and H2:G2→{0,1} n are two one-way hash functions, s∈Z q is the master key owned only by the management system, and the system parameters P = (p, q, G1, G2, e, P0, P1) are public to all entities, where P1 = sP0. The manager randomly selects g∈Z q , generate a secret key pk = sH1(g)∈G1, pk is used to encrypt operation logs and data, etc. For the user, select his unique username m as the public key P pubm , generate its private key P prim =sH1(m).

[0084] Figure 1 A signaling interaction diagram of a log search method provided by an embodiment of the present application is shown.

[0085] like Figure 1 As shown, the method may include the following steps:

[0086] S110: The management system receives search information sent by the user terminal, where the search information includes a target field, and the target field includes a target keyword.

[0087] In the embodiment of the present application, the log may include an audit log, which is used to record security-related activities occurring in the system or application. The audit log may include not only data operation logs but also system logs, user behavior logs, security logs, etc.

[0088] Audit log entry L t Have n fields, create a field identifier uid for each field j Indicates the position of a field. Each field includes multiple keywords wj The management system receives the search information sent by the user end, and the search information refers to the key information corresponding to the target plaintext that the user wants to query in the audit log. The search information may include at least one target field, and the target field includes at least one target keyword w i , the target field has a corresponding field identifier uid i .

[0089] S120: The management system obtains a target keyword trapdoor according to the target keyword and a secret key of the management system.

[0090] HMAC (Hash-based Message Authentication Code) is a mechanism that generates a message authentication code by combining a hash function and a secret key. The management system generates a message authentication code based on the target keyword w i and the secret key pk of the management system, and generate the target keyword trapdoor T through the HMAC function i , T i =Hmac(pk,w i ).

[0091] S130: The management system obtains a target field identifier hash value according to the target field identifier of the target field and a secret key of the management system.

[0092] The management system identifies the uid according to the target field of the target field i and the secret key pk of the management system, and calculate the hash value through the hash function to obtain the target field identifier hash value H uidi =Hmac(pk,uid i ).

[0093] S140: The management system sends the target keyword trapdoor and the target field identifier hash value to the cloud server.

[0094] The management system sends a target keyword trapdoor and a target field identifier hash value to a cloud server so that the cloud server can determine a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, and obtain a target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer.

[0095] Identify the uid according to the target field required for the search i and target keyword w i , get the query array [(H uidi ,T i )], the management system sends a query array [(H uidi ,Ti )], that is, the management system sends the target keyword trap door T to the cloud server i and the target field identifier hash value H uidi , the cloud server includes multiple log indexes (H uid ,X uid,w ,P ELt ), each log index (H uid ,X uid,w ,P ELt ) includes a set of initial field identifier hash values ​​H uidj , initial field trapdoor X uidj,wj and encrypted log entry pointer P ELt The corresponding relationship between the encrypted log entry pointer P ELt Points to encrypted log entries E stored on the cloud server Lt The cloud server uses the log index (H uid ,X uid,w ,P ELt ) can determine the target keyword trap door T i and the target field identifier hash value H uidi The corresponding target encrypted log entry pointer P ELt , and through the target encrypted log entry pointer P ELt Get the corresponding target encrypted log entry E Lti .

[0096] S180: The management system receives the target encrypted log entry sent by the cloud server, and decrypts the target encrypted log entry to obtain the target plaintext.

[0097] The management system receives the target encrypted log entries sent by the cloud server By decrypting the encrypted log entries, the target plaintext corresponding to the target field and target keyword can be obtained.

[0098] S190: The management system sends the target plain text to the user terminal.

[0099] The management system sends the decrypted data to the user to obtain the target plaintext, which is the plaintext that the user wants to query through the target field and target keyword in the log.

[0100] The embodiment of the present application provides a method, device, equipment, computer-readable storage medium and computer program product for searching logs. The method is applied to a management system. First, by receiving search information including a target field and a target keyword sent by a user end, a target keyword trapdoor is obtained according to the target keyword and the secret key of the management system, and a target field identifier hash value is obtained according to the target field identifier of the target field and the secret key of the management system; by using fields and keywords for searching encrypted logs, the application scenarios of data queries can be expanded to meet the diverse query needs of users. Afterwards, the target keyword trapdoor and the target field identifier hash value are sent to a cloud server, so that the cloud server determines the target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server, and obtains the target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes the corresponding relationship between the initial field identifier hash value, the initial field trapdoor and the encrypted log entry pointer; by matching the trapdoor in the log index to determine the target encrypted log, an efficient search operation can be performed on the encrypted data without decrypting the entire data set, thereby ensuring data security while improving the search speed. Finally, the target encrypted log entries sent by the cloud server are received, the target encrypted log entries are decrypted to obtain the target plaintext, and the target plaintext is sent to the user end; by decrypting the encrypted entries corresponding to the search fields and keywords, the corresponding log plaintext is obtained and sent to the user end, the plaintext of the encrypted log can be searched based on the search fields and keywords, which expands the application scenarios of the method of searching encrypted logs, ensures the security of data during the search process, and meets the data query needs in actual scenarios.

[0101] In such Figure 1 Based on the embodiment shown, Figure 2 A signaling interaction diagram of a log search method provided in another embodiment of the present application is shown.

[0102] In one embodiment, Figure 2 As shown, before S110: the management system receives the search information sent by the user terminal, the method further includes:

[0103] S111: The management system receives a query request sent by the user terminal.

[0104] The management system receives an encrypted log query request initiated by a user at the user end.

[0105] S112: The management system responds to the query request and sends the encrypted random value to the user terminal, so that the user terminal decrypts the encrypted random value and signs it to obtain a signature value.

[0106] The management system responds to the query request and selects a random value c∈Zq, where Zq is a set of q elements. The management system encrypts E(c) using its private key. The client receives E(c), decrypts it, and signs the random value c using its private key Pprim to obtain the signature value. And the signature value E c Send to the management system.

[0107] S113: The management system receives the signature value sent by the user terminal.

[0108] The management system receives the signature value E sent by the user c .

[0109] S114: The management system verifies the signature value, and receives the search information sent by the user terminal if the signature value verification passes.

[0110] The management system uses the user's user identification public key P pubm Verify the signature value E c , determine whether it is the same as the random value c. If they are the same, the identity authentication is passed. When the signature value is verified, the search information sent by the user end is received.

[0111] This embodiment can effectively verify the identity of the user terminal and prevent unauthorized access by sending an encrypted random value to the user terminal and requiring it to return a signature value, thereby ensuring that only legitimate users can submit search information, thereby improving the security of searching encrypted logs.

[0112] In one embodiment, before the management system decrypts the target encrypted log entry to obtain the target plaintext in step S180, the method further includes:

[0113] The management system calculates the checksum of the encrypted log entry to obtain a search checksum; verifies whether the search checksum is consistent with the initial checksum of the encrypted log entry; and when the search checksum is consistent with the initial checksum, decrypts the target encrypted log entry to obtain the target plaintext.

[0114] The management system receives the target encrypted log entry E Lti =(U,V), the management system calculates the target encrypted log entry E Lti A search check value of the check value is obtained by connecting the target encrypted log entry E to the management system. Lti The initial checksum calculated before sending to the cloud server is compared to verify whether the search checksum is consistent with the initial checksum of the encrypted log entry. If the search checksum is consistent with the initial checksum, the target encrypted log entry is decrypted to obtain the target plaintext. t =Hmac(pk,∑uid i +∑wj +E Lt ), initial check value h t According to the management system's secret key pk and field identifier uid i 、Keywords w j and encrypted log entry E Lt Calculated.

[0115] This embodiment can ensure that the encrypted log entry has not been modified since its creation by comparing the check values, which not only prevents unauthorized data modification, but also increases the difficulty for attackers to successfully tamper with the log entry, thereby improving data integrity and security.

[0116] Figure 3 FIG. 1 is a flow chart showing a process of building a log index provided by an embodiment of the present application. Figure 3 As shown, in one embodiment, before step S110: the management system receives the search information sent by the user terminal, the method further includes:

[0117] S1101: The management system obtains log entries, fields, and keywords in the fields.

[0118] Get the log entry L in the log t , fields, and keywords in fields w j . Exemplarily, the log may be an audit log.

[0119] S1102: The management system creates a field identifier corresponding to the field.

[0120] Create a field identifier uid for each field j Each field has a unique field identifier uid j Correspondingly, each field identifies the uid j Indicates a field position.

[0121] S1103: The management system obtains an initial field identifier hash value according to the field identifier and the secret key of the management system.

[0122] Identify uid by field j The initial field identifier hash value H is calculated by the hash function and the secret key pk of the management system uidj =Hmac(pk,uid j ).

[0123] S1104: The management system obtains an initial keyword trapdoor according to the keyword and the secret key of the management system.

[0124] According to the keyword w j and the secret key pk of the management system, and calculate the initial keyword trapdoor T through the hash function wj =Hmac(pk,wj ).

[0125] S1105: The management system obtains an initial field trapdoor according to the initial field identifier hash value and the initial keyword trapdoor.

[0126] Identify the hash value H according to the initial field uidj =Hmac(pk,uid j ) and the initial keyword trapdoor T wj =Hmac(pk,w j ), the initial field trap door X is obtained by hash function calculation uidi,wj =Hmac(T wj ,H u i ). For all log entries L in the log t Perform the above operation on all fields of uid ,X uid,w ).

[0127] S1106: The management system encrypts the plaintext log entry corresponding to the field and the keyword to obtain an encrypted log entry, and creates an encrypted log entry pointer of the encrypted log entry.

[0128] Identify each field with uid j and keyword w j The corresponding plaintext log entry L t After encryption, we get the encrypted log entry where r∈Z q is randomly selected. At the same time, for each encrypted log entry E Lt Create encrypted log entry pointer P ELt , each encrypted log entry E Lt There is a unique encrypted log entry pointer P ELt correspond.

[0129] S1107: The management system constructs a log index based on the correspondence between the initial field identifier hash value, the initial field trapdoor, and the encrypted log entry pointer.

[0130] Based on the initial field identification hash value H uidj , initial field trapdoor X uid,w and encrypted log entry pointer P ELt The corresponding relationship constructs the log index (H uid ,X uid,w ,P ELt ).

[0131] S1108: The management system sends the log index and encrypted log entries to the cloud server.

[0132] The management system sends (Huid ,X uid,w ,P ELt ) and encrypted log entry E Lt .

[0133] This embodiment obtains log entries, fields and keywords, creates field identifiers, and uses the secret key of the management system to generate initial field identifier hash values ​​and initial keyword trapdoors, and then generates initial field trapdoors, then encrypts the log entries and creates encrypted log entry pointers, builds log indexes based on initial field identifier hash values, initial field trapdoors and encrypted log entry pointers, and finally sends the log indexes and encrypted log entries to the cloud server. This ensures the confidentiality and integrity of log data, supports efficient search functions, and optimizes resource utilization.

[0134] In one embodiment, Figure 1 As shown, the method may include the following steps:

[0135] S140: The cloud server receives the target keyword trapdoor and the target field identifier hash value sent by the management system.

[0136] The cloud server receives the query array sent by the management system [(H uidi ,T i )], that is, the target keyword trap door T i and the target field identifier hash value H uidi .

[0137] S150: The cloud server determines a target encrypted log entry pointer corresponding to a target keyword trapdoor and a target field identifier hash value according to a log index in the cloud server, wherein the log index in the cloud server includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer.

[0138] The cloud server includes multiple log indexes (H uid ,X uid,w ,P ELt ), each log index (H uid ,X uid,w ,P ELt ) includes a set of initial field identifier hash values ​​H uidj , initial field trapdoor X uidj,wj and encrypted log entry pointer P ELt The corresponding relationship between the encrypted log entry pointer P ELt Points to encrypted log entries E stored on the cloud server Lt The cloud server uses the log index (H uid ,X uid,w ,P ELt ) can determine the target keyword trap door Ti and the target field identifier hash value H uidi The corresponding target encrypted log entry pointer P ELt .

[0139] S160: The cloud server obtains the target encrypted log entry corresponding to the target encrypted log entry pointer.

[0140] The cloud server encrypts the log entry pointer P through the target ELt , the corresponding target encrypted log entry E can be obtained from the stored encrypted log entry summary Lti .

[0141] S170: The cloud server sends the target encrypted log entry to the management system.

[0142] The cloud server sends the target encrypted log entry E corresponding to the target field and target keyword to the management system. Lti。

[0143] This embodiment uses trapdoor technology and log indexing to quickly locate and retrieve target log entries without decrypting them, significantly improving search efficiency. At the same time, log entries are always stored in encrypted form in the cloud server, ensuring the confidentiality and privacy of data and preventing unauthorized access and leakage.

[0144] In one embodiment, Figure 4 FIG. 1 is a flow chart of determining a target encrypted log entry pointer provided by an embodiment of the present application. Figure 4 As shown, step S150: the cloud server determines the target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server, including:

[0145] S1511: Determine a first log index according to the log index of the target field identifier hash value in the cloud server.

[0146] Each log index (H uid ,X uid,w ,P ELt ) includes the initial field identifier hash value H uidj , initial field trapdoor X uidj,wj and encrypted log entry pointer P ELt , according to the target field identification hash value H uidi , filter out all log indexes including the target field identifier hash value H uidi The log index may also be called a first log index. The first log index may include at least one log index.

[0147] S1512: Obtain a first search trapdoor according to the target keyword trapdoor and the target field identifier hash value.

[0148] According to the target keyword trap door T i and the target field identifier hash value H uidi The first search trapdoor X is obtained by calculating the trapdoor through the hash function i =Hmac(T i ,H uidi ).

[0149] S1513: Determine a first target encrypted log entry pointer in the encrypted log entry pointer of the first log index according to the first search trapdoor.

[0150] According to the first search trap door X i =Hmac(T i ,H uidi ), filter out the first search trap door X in the first log index i =Hmac(T i ,H uidi ), and uses the encrypted log entry pointer contained in the index as the first target encrypted log entry pointer, that is, the target encrypted log entry pointer P ELt .

[0151] This embodiment uses multi-level indexing and trapdoor technology to quickly locate target log entries in large-scale log data, significantly improving search efficiency. At the same time, the entire search process is performed on encrypted data, ensuring the confidentiality of the log entries and preventing data from being leaked during the search process.

[0152] In one embodiment, Figure 5 FIG. 2 shows a flow chart of determining a target encrypted log entry pointer provided by another embodiment of the present application. Figure 5 As shown, step S150: the cloud server determines the target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server, including:

[0153] S1521: The cloud server obtains a second search trapdoor according to the target keyword trapdoor and the target field identifier hash value.

[0154] According to the target keyword trap door T i and the target field identifier hash value H uidi The second search trapdoor X is obtained by calculating the trapdoor through the hash function i =Hmac(T i ,H uidi ).

[0155] S1522: The cloud server obtains a Bloom index based on the target field identifier hash value and the second search trapdoor.

[0156] The cloud server identifies the hash value H according to the target field uidi and the second search trapdoor X i =Hmac(T i ,H uidi ) The Bloom index l = BKDR (H uidi ||X i ).

[0157] S1523: The cloud server determines whether the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value.

[0158] In the established Bloom filter array BL i Determine the Bloom index l = BKDR (H uidi ||X i ) is 1.

[0159] S1524: When the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value, the cloud server determines that the log index associated with the bit value corresponding to the Bloom index in the Bloom filter array is the second log index, and the Bloom filter array includes a correspondence between the log index and the bit value.

[0160] The Bloom filter array is a multi-bit binary array that can be used through multiple hash functions to identify the hash value H based on the initial field in the log index. uidj and the initial field trapdoor X uidj,wj Multiple hash values ​​corresponding to each log index are calculated, and these hash values ​​are used to set the bit values ​​of the Bloom filter array. The log index is represented in the set by the bit value of the Bloom filter array, so the Bloom filter array can include the correspondence between the log index and the bit value.

[0161] Exemplarily, the hash value H is identified according to the target field uidi and the second search trapdoor X i =Hmac(T i ,H uidi ) The Bloom index l = BKDR (H uidi ||X i ) corresponds to the hash value h1(X i ,H uidi )=3,h2(X i ,H uidi )=7, in the Bloom filter array BL i Determine whether the bit values ​​of BL[3] and BL[7] are both 1. When BL[3]=1 and BL[7]=1, it indicates that the initial field identifier hash value H of the log index uidj and the initial field trapdoor Xuidj,wj The target keyword trap T i and the target field identifier hash value H uidi The same, that is, the encrypted log entry pointer P of the log index EL The corresponding encrypted log entry E Lt It may contain target fields and target keywords.

[0162] In the established Bloom filter array BL i Determine the Bloom index l = BKDR (H uidi ||X i ) corresponding to the bit value of 1, the Bloom filter array BL is determined according to the corresponding relationship between the log index and the bit value. i Bloom index l = BKDR(H uidi ||X i )The log index associated with the bit value corresponding to ) is the second log index.

[0163] S1525: The cloud server determines a second target encrypted log entry pointer in the encrypted log entry pointer of the second log index according to the second search trapdoor.

[0164] Since the hash function may produce collisions, the Bloom filter may have false positives. In this case, a secondary screening is required to filter out the second search trap door X in the second log index. i =Hmac(T i ,H uidi ), that is, determine X in the second log index i =X uidj,wj The log index of the target encrypted log entry is obtained, and the encrypted log entry pointer contained in the index is used as the second target encrypted log entry pointer, that is, the target encrypted log entry pointer P ELt .

[0165] This embodiment can quickly exclude a large number of unmatched records through preliminary screening of the Bloom filter. The use of the Bloom filter significantly reduces unnecessary log entry checks and improves search efficiency. At the same time, the combination of the second search trapdoor and the Bloom index ensures the accuracy of the search results, avoids mismatches and missed matches, and improves the accuracy of the search.

[0166] In one embodiment, before step S140: the cloud server receives the target keyword trapdoor and the target field identifier hash value sent by the management system, the method further includes: the cloud server receives the log index and the encrypted log entry sent by the management system.

[0167] The cloud server receives the log index sent by the management system (H uid ,X uid,w ,PELt ) and encrypted log entry E Lt .

[0168] In one embodiment, after the cloud server receives the log index and the encrypted log entry sent by the management system, the method further includes:

[0169] The cloud server creates a Bloom filter array, which includes a plurality of bit values.

[0170] Based on the initial field identifier hash value and the initial field trapdoor in the log index, the cloud server obtains the initial Bloom index through the Bloom filter hash function, and maps the initial Bloom index to the Bloom filter array to obtain the correspondence between the log index and the bit value. The bit value corresponding to the initial Bloom index in the Bloom filter array is a preset value.

[0171] Bloom filter is a space-efficient probabilistic data structure used to test whether an element is in a set. It maps keywords to a fixed-length binary array through multiple hash functions and determines whether the element exists by the values ​​of these array positions.

[0172] The cloud server receives the log index (H uid ,X uid,w ,P ELt ) creates a binary array BL of length k i And initialized to 0, for each (H uidi ,X uidi,w ), using the BKDR string hash function to calculate the Bloom index l = BKDR (H uidi ||X uidi,wj ), BL i The value of [l] is set to 1. When all combinations are calculated, the log index (H uid ,X uid,w ,P ELt )’s Bloom filter index BL i .

[0173] Exemplarily, the Bloom filter array is initialized: BL = [0,0,0,0,0,0,0,0,0,0], and the initial Bloom index is calculated: l1 = BKDR (H uid1 ||X uid1,w1 )=3,l2=BKDR(H uid1 ||X uid1,w2 )=7,l3=BKDR(H uid2 ||X uid2,w1 )=6,l4=BKDR(H uid2 ||X uid2,w2)=2. According to the value of l as the sequential position in the Bloom filter array BL, the bit values ​​are set in this way: BL[3]=1, BL[7]=1, BL[6]=1, BL[2]=1, and BL=[0,1,1,0,0,1,1,0,0,0]. By the above method, (H uidi ,X uidi,w ) and the Bloom filter array BL i The corresponding relationship is that the log index (H uid ,X uid,w ,P ELt ) and the Bloom filter array BL i The corresponding relationship.

[0174] This embodiment creates a Bloom filter to quickly determine whether a target field and a target keyword may exist in a set, which significantly reduces unnecessary log entry checks and improves search efficiency. At the same time, the storage space occupied by the Bloom filter is much smaller than that of a traditional index structure, reducing the consumption of storage resources.

[0175] Based on the same concept, the embodiment of the present application provides a device for searching logs. Figure 6 The device for searching logs provided in an embodiment of the present application is described in detail.

[0176] Figure 6 This is a structural block diagram of a device for searching logs provided in one embodiment of the present application.

[0177] like Figure 6 As shown, the application of the search log to the management system may include:

[0178] The receiving module 610 is used to receive search information sent by the user terminal, where the search information includes a target field, and the target field includes a target keyword.

[0179] The determination module 620 is used to obtain a target keyword trapdoor according to the target keyword and a secret key of the management system.

[0180] The determination module 620 is further configured to obtain a target field identifier hash value according to the target field identifier of the target field and a secret key of the management system.

[0181] The sending module 630 is used to send the target keyword trapdoor and the target field identifier hash value to the cloud server, so that the cloud server can determine the target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server, and obtain the target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes the correspondence between the initial field identifier hash value, the initial field trapdoor and the encrypted log entry pointer.

[0182] The receiving module 610 is further used to receive the target encrypted log entry sent by the cloud server, and decrypt the target encrypted log entry to obtain the target plaintext.

[0183] The sending module 630 is further configured to send the target plaintext to the user end.

[0184] In one embodiment, before receiving the search information sent by the user terminal, the receiving module 610 is also used to receive the query request sent by the user terminal; the sending module 630 is also used to respond to the query request and send an encrypted random value to the user terminal, so that the user terminal decrypts the encrypted random value and signs it to obtain a signature value; the receiving module 610 is also used to receive the signature value sent by the user terminal; the receiving module 610 is also used to verify the signature value, and when the signature value verification is passed, receive the search information sent by the user terminal.

[0185] In one embodiment, before decrypting the target encrypted log entry to obtain the target plaintext, the determination module 620 is also used to calculate the check value of the encrypted log entry to obtain a search check value, verify whether the search check value is consistent with the initial check value of the encrypted log entry, and when the search check value is consistent with the initial check value, decrypt the target encrypted log entry to obtain the target plaintext.

[0186] In one embodiment, before receiving the search information sent by the user terminal, the receiving module 610 is also used to obtain log entries, fields and keywords in the fields, and create field identifiers corresponding to the fields; the determining module 620 is also used to obtain an initial field identifier hash value based on the field identifier and the secret key of the management system, obtain an initial keyword trapdoor based on the keyword and the secret key of the management system, obtain an initial field trapdoor based on the initial field identifier hash value and the initial keyword trapdoor, encrypt the plaintext log entries corresponding to the fields and keywords to obtain encrypted log entries, and create an encrypted log entry pointer of the encrypted log entry, and construct a log index based on the correspondence between the initial field identifier hash value, the initial field trapdoor and the encrypted log entry pointer; the sending module 630 is also used to send the log index and the encrypted log entry to the cloud server.

[0187] Figure 6 Each module in the device shown has the function of realizing Figures 1 to 5 The functions of each step in the process can achieve the corresponding technical effects, which will not be described in detail here for the sake of brevity.

[0188] Based on the same concept, the embodiment of the present application provides a device for searching logs. Figure 7 The device for searching logs provided in an embodiment of the present application is described in detail.

[0189] Figure 7 It is a structural block diagram of a device for searching logs according to an embodiment of the present application.

[0190] like Figure 7 As shown, the search log is applied to a cloud server, and the device may include:

[0191] The receiving module 710 is used to receive the target keyword trapdoor and the target field identifier hash value sent by the management system.

[0192] The determination module 720 is used to determine the target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server, wherein the log index in the cloud server includes the correspondence between the initial field identifier hash value, the initial field trapdoor and the encrypted log entry pointer.

[0193] The acquisition module 730 is used to acquire the target encrypted log entry corresponding to the target encrypted log entry pointer.

[0194] The sending module 740 is used to send the target encrypted log entry to the management system.

[0195] In one embodiment, the determination module 720 is specifically used to determine the first log index according to the log index of the target field identifier hash value in the cloud server; obtain the first search trap according to the target keyword trap and the target field identifier hash value; and determine the first target encrypted log entry pointer in the encrypted log entry pointer of the first log index according to the first search trap.

[0196] In one embodiment, the determination module 720 is specifically used to obtain a second search trap based on the target keyword trap and the target field identifier hash value; obtain a Bloom index based on the target field identifier hash value and the second search trap; determine whether the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value; when the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value, determine that the log index associated with the bit value corresponding to the Bloom index in the Bloom filter array is the second log index, and the Bloom filter array includes a correspondence between the log index and the bit value; determine the second target encrypted log entry pointer in the encrypted log entry pointer of the second log index according to the second search trap.

[0197] In one embodiment, before receiving the target keyword trapdoor and the target field identifier hash value sent by the management system, the receiving module 710 is further configured to receive the log index and the encrypted log entry sent by the management system.

[0198] In one embodiment, after receiving the log index and encrypted log entry sent by the management system, the receiving module 710 is also used to create a Bloom filter array, which includes multiple bit values; based on the initial field identifier hash value and the initial field trapdoor in the log index, the initial Bloom index is obtained through the Bloom filter hash function, and the initial Bloom index is mapped to the Bloom filter array to obtain the correspondence between the log index and the bit value, and the bit value corresponding to the initial Bloom index in the Bloom filter array is a preset value.

[0199] Figure 7 Each module in the device shown has the function of realizing Figures 1 to 5 The functions of each step in the process can achieve the corresponding technical effects, which will not be described in detail here for the sake of brevity.

[0200] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in one embodiment of the present application is shown.

[0201] The electronic device may include a processor 810 and a memory 820 storing computer program instructions.

[0202] Specifically, the processor 810 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0203] The memory 820 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 820 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 820 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 820 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 820 is a non-volatile solid-state memory.

[0204] The memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to the first aspect of the present disclosure.

[0205] The processor 810 implements any one of the log searching methods in the above embodiments by reading and executing computer program instructions stored in the memory 820 .

[0206] In one example, the electronic device may further include a communication interface 830 and a bus 840. Figure 8 As shown, the processor 810, the memory 820, and the communication interface 830 are connected via a bus 840 and communicate with each other.

[0207] The communication interface 830 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0208] Bus 840 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 840 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0209] The electronic device can execute the method for searching logs in the embodiment of the present application, thereby realizing the combination Figures 1 to 5 Describes the method for searching logs.

[0210] In addition, in combination with the method for searching logs in the above embodiments, the present application embodiment can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the methods for searching logs in the above embodiments is implemented.

[0211] An embodiment of the present application also provides a computer program product, including a computer program, which implements any one of the log search methods in the above embodiments when the computer program is processed and executed.

[0212] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0213] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0214] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0215] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0216] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for searching logs, characterized in that: Applied to a management system, the method comprises: Receiving search information sent by a user terminal, the search information including a target field, and the target field including a target keyword; Obtaining a target keyword trapdoor according to the target keyword and a secret key of the management system; Obtaining a target field identifier hash value according to the target field identifier of the target field and a secret key of the management system; Sending the target keyword trapdoor and the target field identifier hash value to a cloud server, so that the cloud server determines a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, and obtains a target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer; Receiving the target encrypted log entry sent by the cloud server, and decrypting the target encrypted log entry to obtain target plaintext; The target plaintext is sent to the client.

2. The method according to claim 1, characterized in that Before receiving the search information sent by the user terminal, the method further includes: Receiving a query request sent by the user terminal; In response to the query request, an encrypted random value is sent to the user terminal, so that the user terminal decrypts and signs the encrypted random value to obtain a signature value; Receiving the signature value sent by the user terminal; The signature value is verified, and if the signature value is verified successfully, the search information sent by the user terminal is received.

3. The method according to claim 1, characterized in that Before decrypting the target encrypted log entry to obtain the target plaintext, the method further includes: Calculating a check value of the encrypted log entry to obtain a search check value; Verifying whether the search check value is consistent with an initial check value of the encrypted log entry; In a case where the search check value is consistent with the initial check value, the target encrypted log entry is decrypted to obtain a target plaintext.

4. The method according to claim 1, characterized in that: Before receiving the search information sent by the user terminal, the method further includes: Get log entries, fields, and keywords in said fields; Creating a field tag corresponding to the field; Obtaining an initial field identifier hash value according to the field identifier and a secret key of the management system; Obtaining an initial keyword trapdoor according to the keyword and a secret key of the management system; Obtaining an initial field trapdoor according to the initial field identifier hash value and the initial keyword trapdoor; Encrypting the plaintext log entry corresponding to the field and the keyword to obtain an encrypted log entry, and creating an encrypted log entry pointer of the encrypted log entry; Building a log index based on the correspondence between the initial field identifier hash value, the initial field trapdoor and the encrypted log entry pointer; The log index and the encrypted log entry are sent to the cloud server.

5. A method for searching logs, characterized in that: Applied to a cloud server, the method comprises: Receive the target keyword trapdoor and target field identifier hash value sent by the management system; Determining a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, wherein the log index in the cloud server includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer; Obtaining a target encrypted log entry corresponding to the target encrypted log entry pointer; The target encrypted log entry is sent to the management system.

6. The method according to claim 5, characterized in that The step of determining a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index in the cloud server includes: Determine a first log index according to the log index of the target field identifier hash value in the cloud server; Obtain a first search trapdoor according to the target keyword trapdoor and the target field identifier hash value; A first target encrypted log entry pointer is determined in the encrypted log entry pointers of the first log index according to the first search trapdoor.

7. The method according to claim 6, characterized in that The step of determining a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to the log index established in the cloud server includes: Obtain a second search trapdoor according to the target keyword trapdoor and the target field identifier hash value; Obtaining a Bloom index according to the target field identifier hash value and the second search trapdoor; Determining whether the bit value corresponding to the Bloom index is a preset value in the established Bloom filter array; In the case where the bit value corresponding to the Bloom index in the established Bloom filter array is a preset value, determining that the log index associated with the bit value corresponding to the Bloom index in the Bloom filter array is a second log index, and the Bloom filter array includes a correspondence between log indexes and bit values; A second target encrypted log entry pointer is determined in the encrypted log entry pointers of the second log index according to the second search trapdoor.

8. The method according to claim 5, characterized in that Before receiving the target keyword trapdoor and the target field identifier hash value sent by the management system, the method further includes: The log index and the encrypted log entry sent by the management system are received.

9. The method according to claim 8, characterized in that After receiving the log index and the encrypted log entry sent by the management system, the method further includes: Creating a Bloom filter array, the Bloom filter array comprising a plurality of bit values; Based on the initial field identifier hash value and the initial field trapdoor in the log index, an initial Bloom index is obtained through a Bloom filter hash function, and the initial Bloom index is mapped to the Bloom filter array to obtain a correspondence between the log index and the bit value, and the bit value corresponding to the initial Bloom index in the Bloom filter array is a preset value.

10. A device for searching logs, characterized in that: The device is applied to a management system, and the device comprises: A receiving module, configured to receive search information sent by a user terminal, wherein the search information includes a target field, and the target field includes a target keyword; A determination module, configured to obtain a target keyword trapdoor according to the target keyword and a secret key of the management system; The determination module is further used to obtain a target field identifier hash value according to the target field identifier of the target field and a secret key of the management system; A sending module, used to send the target keyword trapdoor and the target field identifier hash value to a cloud server, so that the cloud server determines a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, and obtains a target encrypted log entry corresponding to the target encrypted log entry pointer, wherein the log index includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer; The receiving module is further used to receive the target encrypted log entry sent by the cloud server, and decrypt the target encrypted log entry to obtain the target plaintext; The sending module is also used to send the target plaintext to the user terminal.

11. A device for searching logs, characterized in that: The device is applied to a cloud server, and the device includes: A receiving module, used for receiving a target keyword trapdoor and a target field identifier hash value sent by the management system; A determination module, configured to determine a target encrypted log entry pointer corresponding to the target keyword trapdoor and the target field identifier hash value according to a log index in the cloud server, wherein the log index in the cloud server includes a correspondence between an initial field identifier hash value, an initial field trapdoor, and an encrypted log entry pointer; An acquisition module, used to acquire a target encrypted log entry corresponding to the target encrypted log entry pointer; A sending module is used to send the target encrypted log entry to the management system.

12. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for searching logs according to any one of claims 1 to 9 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method for searching logs according to any one of claims 1 to 9 is implemented.

14. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the log searching method as described in any one of claims 1 to 9.

Images