Log management method and device

Abstract

The invention provides a log management method and device, and can be applied to the technical field of block chains. The log management method comprises the steps that according to a user role of a transaction user, a log type which can be accessed by the transaction user is inquired; querying an access strategy and a key parameter of the type of log on a chain according to the type of the log which can be accessed by the transaction user; generating a first key according to the key parameter of the type log; acquiring a first random number generated by an application server of the transaction user; generating a first calculation factor and a second calculation factor according to the first random number and the key parameter; and sending the first calculation factor and the second calculation factor to the application server. The invention provides a log management method and device, and can solve the problem that an existing log management method does not distinguish all transaction users of a block chain and does not perform desensitization processing on sensitive data.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and specifically to a log management method and device. Background Art

[0002] The log management process of blockchain generally records node operation logs, important transaction logs (time, transaction content, transaction IP, operation type), error conditions, etc., and then manages the logs in a unified manner to the log center for backup through offline or online archiving. All transaction users can obtain complete transaction logs through the console or through the interface call provided by the blockchain itself.

[0003] With the gradual promotion of blockchain digital scenario construction, more and more scenarios need to be audited for security. However, the existing log management does not distinguish all transaction users of the blockchain, does not desensitize sensitive data, and especially does not perform necessary encryption processing on personal information data. As a result, its logs do not meet the industry's data classification and processing rules and personal information protection regulations. Summary of the invention

[0004] In view of the problems in the prior art, the embodiments of the present application provide a log management method and device, which can at least partially solve the problems in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a log management method, including:

[0006] Based on the user role of the transaction user, query the log types that the transaction user can access;

[0007] Based on the log type that the transaction user can access, query the access policy and key parameters of this type of log on the chain;

[0008] Generate a first key according to the key parameters of the log of this type;

[0009] Obtaining a first random number generated by an application server of the transaction user;

[0010] Generate a first calculation factor and a second calculation factor according to the first random number and the key parameter;

[0011] The first calculation factor and the second calculation factor are sent to the application server, and the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, and use the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key.

[0012] In some embodiments, generating the first key according to the key parameter of the log of the type includes:

[0013] A first key is generated according to a random number of a party requesting log access, a random number of a party encrypting the log, a first public parameter, and a second public parameter.

[0014] In some embodiments, generating a first calculation factor and a second calculation factor according to the first random number and the key parameter includes:

[0015] Generate a first calculation factor according to the random number of the log encryption party, the first public parameter, and the second public parameter;

[0016] A second calculation factor is generated according to the first random number, the random number of the party requesting log access, the random number of the party encrypting the log, and the second public parameter.

[0017] In some embodiments, after obtaining the log management key, the method further includes:

[0018] The log management key is signed using the private key of the transaction user to obtain an encryption key;

[0019] The encryption key is sent to the blockchain network for on-chain endorsement.

[0020] In a second aspect, an embodiment of the present application provides a log management method, including:

[0021] Execute transactions and generate transaction logs according to transaction users’ transaction requests;

[0022] Obtaining the access policy, encryption policy, and key parameters corresponding to the log type of the transaction log;

[0023] Generate a first key according to the key parameters;

[0024] According to the encryption strategy, encrypting the target field in the transaction log using the first key to generate an encrypted log;

[0025] The first key, the encrypted log and the attribute information corresponding to the access policy are sent to a log management server, and the log management server is used to encrypt the attribute information using the first key, generate attribute ciphertext, and add the attribute ciphertext as an attribute of the encrypted log.

[0026] In some embodiments, the method further comprises:

[0027] The log type of the transaction log is sent to a log management server, and the log management server is used to save the encrypted log as a log file that complies with a naming specification according to the log type.

[0028] In a third aspect, an embodiment of the present application provides a log management method, including:

[0029] Obtain the encrypted logs of the target type from the log management server;

[0030] Generate a second random number and send it to the blockchain network, where the blockchain network is used to generate a first calculation factor and a third calculation factor according to the second random number and a key parameter of the log file of the target type;

[0031] Generate a third key according to the first calculation factor, the third calculation factor and the second random number;

[0032] Decrypting the locally stored log management key using the third key to obtain the access policy, the first calculation factor, and the second calculation factor;

[0033] Generate a first key according to the first calculation factor, the second calculation factor, and a first random number stored locally;

[0034] If the first key and the third key are consistent, decrypting the attribute ciphertext of the encrypted log using the third key to obtain the attribute information in the access policy of the encrypted log;

[0035] If the attribute information matches the access policy, the log content of the encrypted log is decrypted using the third key to obtain a plaintext log.

[0036] In a fourth aspect, an embodiment of the present application provides a log management device, including:

[0037] A first query module, used to query the log types accessible to the transaction user according to the user role of the transaction user;

[0038] The second query module is used to query the access policy and key parameters of the log type accessible to the transaction user on the chain;

[0039] A first generating module, used for generating a first key according to a key parameter of the log of this type;

[0040] A first acquisition module, used to acquire a first random number generated by an application server of the transaction user;

[0041] A second generating module, used to generate a first calculation factor and a second calculation factor according to the first random number and the key parameter;

[0042] The first sending module is used to send the first calculation factor and the second calculation factor to the application server, and the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, and use the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key.

[0043] In some embodiments, the first generating module is specifically used for:

[0044] A first key is generated according to a random number of a party requesting log access, a random number of a party encrypting the log, a first public parameter, and a second public parameter.

[0045] In some embodiments, the second generating module is specifically used for:

[0046] Generate a first calculation factor according to the random number of the log encryption party, the first public parameter, and the second public parameter;

[0047] A second calculation factor is generated according to the first random number, the random number of the party requesting log access, the random number of the party encrypting the log, and the second public parameter.

[0048] In some embodiments, the apparatus further comprises:

[0049] A signature module, used to sign the log management key using the private key of the transaction user to obtain an encryption key;

[0050] The first sending module is also used to send the encryption key to the blockchain network for on-chain endorsement.

[0051] In a fifth aspect, an embodiment of the present application provides a log management device, including:

[0052] An execution module, used to execute transactions and generate transaction logs according to transaction requests of transaction users;

[0053] A second acquisition module is used to obtain the access policy, encryption policy and key parameters corresponding to the log type of the transaction log;

[0054] A third generating module, used to generate a first key according to the key parameters;

[0055] an encryption module, configured to encrypt the target field in the transaction log using the first key according to the encryption strategy to generate an encrypted log;

[0056] The second sending module is used to send the first key, the encrypted log and the attribute information corresponding to the access policy to the log management server. The log management server is used to encrypt the attribute information using the first key, generate attribute ciphertext, and add the attribute ciphertext as the attribute of the encrypted log.

[0057] In some embodiments, the second sending module is further used for:

[0058] The log type of the transaction log is sent to a log management server, and the log management server is used to save the encrypted log as a log file that complies with a naming specification according to the log type.

[0059] In a sixth aspect, an embodiment of the present application provides a log management device, including:

[0060] A third acquisition module is used to obtain encrypted logs of a target type from a log management server;

[0061] a fourth generation module, configured to generate a second random number and send the second random number to the blockchain network, wherein the blockchain network is configured to generate a first calculation factor and a third calculation factor according to the second random number and a key parameter of a log file of the target type;

[0062] a fifth generating module, configured to generate a third key according to the first calculation factor, the third calculation factor and the second random number;

[0063] A first decryption module, used to decrypt the locally stored log management key using the third key to obtain the access policy, the first calculation factor and the second calculation factor;

[0064] A sixth generation module, used to generate a first key according to the first calculation factor, the second calculation factor and a first random number stored locally;

[0065] a second decryption module, configured to decrypt the attribute ciphertext of the encrypted log using the third key if the first key and the third key are consistent, so as to obtain the attribute information in the access policy of the encrypted log;

[0066] The third decryption module is used to decrypt the log content of the encrypted log using the third key to obtain a plain text log if the attribute information matches the access policy.

[0067] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the log management method described in any of the above embodiments are implemented.

[0068] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the log management method described in any of the above embodiments are implemented.

[0069] The log management method and device provided in the embodiments of the present application query the type of log accessible to the transaction user according to the user role of the transaction user; query the access policy and key parameters of the log of this type on the chain according to the type of log accessible to the transaction user; generate a first key according to the key parameters of the log of this type; obtain a first random number generated by the application server of the transaction user; generate a first calculation factor and a second calculation factor according to the first random number and the key parameters; send the first calculation factor and the second calculation factor to the application server, the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, use the second key to encrypt the access policy, the first calculation factor and the second calculation factor of the log accessible to the transaction user to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key. In this way, according to the requirements of the KP-ABE attribute encryption algorithm, the logs are first classified, the log attributes and access policies are specified, and then the access policies are written into the keys held by the transaction users. Multiple parameters are required to generate symmetric keys (first key and second key). The keys are kept by both the encryption and decryption parties (nodes of the blockchain network and off-chain transaction users) to support subsequent log management processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0071] Figure 1 It is a structural diagram of a log management system provided in one embodiment of the present application.

[0072] Figure 2 It is a flowchart of a log management method provided in an embodiment of the present application.

[0073] Figure 3 It is a schematic diagram of the Diffie-Hellman algorithm provided in an embodiment of the present application.

[0074] Figure 4 It is a partial flow chart of the log management method provided in one embodiment of the present application.

[0075] Figure 5 It is a flowchart of a log management method provided in an embodiment of the present application.

[0076] Figure 6 It is a flowchart of a log management method provided in an embodiment of the present application.

[0077] Figure 7 It is a flowchart of a log management method provided in an embodiment of the present application.

[0078] Figure 8 This is a schematic diagram of the permission levels of various types of logs provided in an embodiment of the present application.

[0079] Fig. 9 It is a flowchart of a log management method provided in an embodiment of the present application.

[0080] Fig.10 It is a flowchart of a log management method provided in an embodiment of the present application.

[0081] Fig.11 It is a structural diagram of a log management device provided in one embodiment of the present application.

[0082] Fig.12 It is a structural diagram of a log management device provided in one embodiment of the present application.

[0083] Fig.13 It is a structural diagram of a log management device provided in one embodiment of the present application.

[0084] Fig.14 It is a schematic diagram of the physical structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Here, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but are not intended to limit the present application. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily arranged with each other.

[0086] The terms “first”, “second”, etc. used in this document do not specifically refer to an order or sequence, nor are they used to limit this application. They are only used to distinguish elements or operations described with the same technical terms.

[0087] The words “include,” “including,” “have,” “contain,” etc. used in this document are open-ended terms, meaning including but not limited to.

[0088] As used herein, "and / or" includes any and all permutations of the items described.

[0089] The execution subject of the log management method provided in the embodiment of the present application includes but is not limited to a computer.

[0090] In order to better understand the present application, the research background of the present application is first introduced in detail below.

[0091] KP-ABE: (Key-Policy ABE, KP-ABE) embeds the policy into the user key and the attribute into the ciphertext. The key corresponds to an access structure and the ciphertext corresponds to an attribute set. Decryption is possible only if the attributes in the attribute set satisfy the access policy. This design is closer to a static scenario. At this time, the ciphertext is encrypted with its related attributes and stored on the server. When the user is allowed to get certain messages, a specific access policy is assigned to the user. Its application scenarios are more inclined to paid video websites, log encryption management, etc. If a user wants to decrypt multiple files, he must have multiple keys that can satisfy the match, otherwise he cannot decrypt multiple files.

[0092] Diffie-Hellman algorithm: It is a public key algorithm. The communicating parties calculate the shared key by exchanging some data without transmitting the key.

[0093] This application introduces the KP-ABE attribute encryption algorithm and the Diffie-Hellman algorithm to provide solutions for access control of blockchain logs and security of access content. The detailed technical solution is as follows:

[0094] Please refer to Figure 1 As shown, the blockchain log management system can include the following four parts: application server 1, key production server 2, log management server 3 and blockchain network 4. The application server 1 includes a transaction system that calls a smart contract to access the blockchain network 4 and an authorization system of a blockchain node attribution institution that accesses the log management server 3; the key production server 2 is a key production service cluster for each application system to access the blockchain network 4 and the log management server 3; the log management server 3 is a log management center cluster responsible for managing the blockchain system operation log, important transaction log, transaction error log, etc.

[0095] Figure 2 is a flow chart of a log management method provided by an embodiment of the present application, such as Figure 2 As shown, the log management method provided in the embodiment of the present application can be applied to the key production server 2, and the method includes:

[0096] S101. Query the log types accessible to the transaction user according to the user role of the transaction user;

[0097] Before step S101, the institution applying to join the blockchain network 4 can send the application to the blockchain network 4; the institutional users of each node in the blockchain network 4 vote to agree or disagree with the application to join, and confirm the application of the applicant institution to join; according to the application content of the applicant institution, the transaction user of the institution is assigned, and the identity authentication certificate and the corresponding public-private key pair of the transaction user are issued through the blockchain's own CA node or the key production server 2 integrated with the CA certificate issuance SDK.

[0098] In step S101, the log types accessible to the user are determined according to the transaction user role of the applicant institution.

[0099] S102. According to the log type accessible to the transaction user, query the access policy and key parameters of the log type on the chain;

[0100] In step S102, the access policy of the log type on the chain is queried according to the log type. If there is a new log type, the system administrator needs to pre-formulate the access policy, call the system smart contract, and endorse and store the policy on the chain.

[0101] For example, the logs of blockchain are divided into system operation logs, important transaction logs and error logs. The access rights of important transaction logs are high-level rights, the access rights of system operation logs are medium-level rights, and the access rights of error logs are low-level rights. The attributes of the three types of logs include attributes A, B, C, and D. The way to formulate access policies can be shown in Table 1 below:

[0102] Table 1: Log access policy

[0103] Log Type Log permission level Related properties Attribute Threshold Important transaction log high A, B, C, D (AΛB)Λ(CVD) System operation log middle A.B AΛB Error log Low C.D CVD

[0104] Among them: AΛB means that the properties of A and B are satisfied;

[0105] CVD means that C or D attribute is satisfied;

[0106] (AΛB)Λ(CVD) means that both A and B attributes are satisfied, and either C or D attribute is satisfied.

[0107] Similarly, the key parameters used for encryption and decryption of the content of the log type on the query chain are calculated based on the log type. If a new log type is added, the key parameters must be randomly generated in advance.

[0108] S103, generating a first key according to the key parameters of the log of this type;

[0109] S104, obtaining a first random number generated by an application server of the transaction user;

[0110] S105. Generate a first calculation factor and a second calculation factor according to the first random number and the key parameter;

[0111] S106. Send the first calculation factor and the second calculation factor to the application server, the application server being used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, and use the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key.

[0112] In steps S103 to S106, the key production server 2 generates a first key according to the key parameters of the log of this type, and generates a first calculation factor and a second calculation factor according to the first random number generated by the application server of the transaction user and the key parameters, so that the application server generates a second key consistent with the first key on the chain according to the first calculation factor, the second calculation factor and the first random number, and uses the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor, and obtains a log management key that can be used for log access rights and log content decryption.

[0113] The log management method provided in the embodiment of the present application, according to the requirements of the KP-ABE attribute encryption algorithm, first classifies the logs, specifies the log attributes and access policies, and then writes the access policies into the keys held by the transaction users. Multiple parameters are required to generate symmetric keys (first keys and second keys). The keys are kept by both the encryption and decryption parties (nodes of the blockchain network and off-chain transaction users) to support subsequent log management processes.

[0114] In some embodiments, generating the first key according to the key parameters of the type of log includes: generating the first key according to a random number of a party requesting log access, a random number of a party encrypting the log, a first public parameter, and a second public parameter.

[0115] Specifically, for each log, if the log has multiple access parties, each access party will randomly generate a random number A, and then the encryption party will generate a random number B. The random numbers are all different. The purpose is to enable both parties to calculate a common key through random numbers, public parameter prime numbers m and integer g.

[0116] According to the principle of Diffie-Hellman algorithm (see Figure 3The first key K is generated using the random number A of the party requesting log access, the random number B of the party encrypting the log, the public parameter prime number m and the integer g, that is:

[0117] K=g AB modm.

[0118] like Figure 4 As shown, in some embodiments, generating a first calculation factor and a second calculation factor according to the first random number and the key parameter includes:

[0119] S1051. Generate a first calculation factor according to the random number of the log encryption party, the first public parameter, and the second public parameter;

[0120] S1052: Generate a second calculation factor according to the first random number, the random number of the party requesting log access, the random number of the party encrypting the log, and the second public parameter.

[0121] Specifically, to strengthen the security of random numbers, the random number A of the party requesting log access is regenerated by the application server, that is, A1, and the number of digits of A1 can be required to be one less than A; if the random number A1 is inconsistent with the pre-made random number A, it is necessary to recalculate the second calculation factor Y1 of the original key (that is, the first key K) that the application server can obtain, and the first calculation factor Y is calculated based on the pre-made random number on the chain. The calculation formula is:

[0122] Y=g B modm;

[0123] Y1=g (A-A1)B .

[0124] Correspondingly, the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, specifically including: the application server 1 obtains the first calculation factor Y and the second calculation factor Y1 of the first key K, and locally saves the previously generated first random number A1, and can calculate and obtain the key K that is consistent with the chain, and the calculation formula is:

[0125] K=Y A1 *Y1=g A1B *g (A-A1)B modm=g (A1+A-A1)B modm=g AB modm

[0126] The key is used to encrypt the first calculation factor Y, the second calculation factor Y1, and the attribute policy of log access to form a new key K1 (ie, a log management key).

[0127] In some embodiments, after obtaining the log management key, the method further includes: using the private key of the transaction user to sign the log management key to obtain an encryption key; and sending the encryption key to the blockchain network for on-chain endorsement.

[0128] Specifically, the log management key K1 is signed with the private key of the blockchain transaction user's identity authentication CA and then stored on the chain for endorsement.

[0129] Figure 5 is a flow chart of a log management method provided by an embodiment of the present application, such as Figure 5 As shown, the log management method provided in the embodiment of the present application can be applied to 4 nodes of the blockchain network, and the method includes:

[0130] S201. Execute a transaction and generate a transaction log according to a transaction request of a transaction user;

[0131] In step S201, the application server 1 can use the identity authentication certificate issued by the transaction user and the CA to initiate a call to the on-chain smart contract and request the execution of the transaction; after the node of the blockchain network 4 receives the application for calling the smart contract, it performs the endorsement and block placement operations to complete the transaction process; during the transaction, relevant transaction logs will be generated, including detailed operation logs of important transactions, system logs of blockchain node operation, and error logs when transactions fail.

[0132] S202, obtaining an access policy, an encryption policy, and a key parameter corresponding to the log type of the transaction log;

[0133] In step S202, according to the log type, the system smart contract is queried to obtain the pre-established log access policy and key parameters on the chain. The key parameters may include random number A, random number B, public parameter prime number m and integer g.

[0134] S203, generating a first key according to the key parameters;

[0135] S204: Encrypt the target field in the transaction log using the first key according to the encryption strategy to generate an encrypted log;

[0136] S205. Send the first key, the encrypted log, and the attribute information corresponding to the access policy to a log management server. The log management server is used to encrypt the attribute information using the first key, generate an attribute ciphertext, and add the attribute ciphertext as an attribute of the encrypted log.

[0137] In step S203 to step S205, a first key is generated according to the key parameters, and according to the encryption strategy corresponding to the log type, the first key is used to encrypt the content of the fields that need to be encrypted in the transaction log, such as the ID number, identity authentication password, name, address and other fields in the personal information field; the first key, the encrypted log message, the log type, the attributes corresponding to the log strategy, etc. are transmitted to the log management server 3; the log management server 3 uses the first key to encrypt the attributes corresponding to the log strategy into a ciphertext M, modify the attributes of the log file, and add the M attribute.

[0138] The log management method provided in the embodiment of the present application, log encryption depends on the log type, the attributes of the log access policy, the first key, etc. Different log types require hierarchical and classified encryption of different fields, which solves the problem that the existing log management method does not distinguish all transaction users of the blockchain and does not perform desensitization processing on sensitive data.

[0139] In some embodiments, the method further includes: sending the log type of the transaction log to a log management server, the log management server being used to save the encrypted log as a log file that complies with the naming specification according to the log type. Specifically, each type of log can be generated according to the log naming specification, for example, the detailed operation log of an important transaction is named app_xxxxxxxx.log, the system operation log is named sys_xxxxxxxx.log, and the error log is named error_xxxxxxxx.log.

[0140] Figure 6 is a flow chart of a log management method provided by an embodiment of the present application, such as Figure 6 As shown, the log management method provided in the embodiment of the present application can be applied to the application server 1, and the method includes:

[0141] S301, obtaining an encrypted log of a target type from a log management server;

[0142] In step S301, the application server 1 of an organization initiates a request for log acquisition, transmits the request parameters of the interface call, and signs with the private key of the CA certificate for identity authentication; after receiving the request, the blockchain network 4 verifies the identity of the user who initiated the transaction of the organization, and after the identity is passed, requests the log management server 3 to obtain the log; the log management server 3 can push the required log to the file server specified by the application server 1 according to the request.

[0143] S302, generating a second random number and sending it to the blockchain network, wherein the blockchain network is used to generate a first calculation factor and a third calculation factor according to the second random number and a key parameter of the log file of the target type;

[0144] In step S302, the application server 1 generates a second random number A2 for calculating the third key; the blockchain network 4 queries the key parameters of this type of log, and calculates the first calculation factor Y and the third calculation factor Y2 based on the second random number and the key parameters.

[0145] For example, the key parameters include: random number A, random number B, public parameter prime number m and integer g, then:

[0146] Y=g B modm;

[0147] Y2=g (A-A2)B .

[0148] S303, generating a third key according to the first calculation factor, the third calculation factor and the second random number;

[0149] In step S303, the application server 1 calculates the third key according to Y and Y2, for example, the third key = Y A2 ×Y2.

[0150] S304: Decrypt the locally stored log management key using the third key to obtain the access policy, the first calculation factor, and the second calculation factor;

[0151] In step S304, the log management key K1 stored in the application server 1 is decrypted to obtain the access policy and the first calculation factor Y and the second calculation factor Y1 encrypted in K1.

[0152] S305: Generate a first key according to the first calculation factor, the second calculation factor, and a first random number stored locally;

[0153] In step S305, the first key K is calculated according to the first calculation factor Y, the second calculation factor Y1 and the first random number A1 stored locally, for example, K=Y A1 ×Y1.

[0154] S306: If the first key and the third key are consistent, decrypt the attribute ciphertext of the encrypted log using the third key to obtain attribute information of the encrypted log;

[0155] S307: If the attribute information matches the access policy, decrypt the log content of the encrypted log using the third key to obtain a plaintext log.

[0156] In step S306 to step S307, it is verified whether the third key is consistent with the first key; if they are consistent, the ciphertext of the log attribute is decrypted using the third key to obtain the attribute value corresponding to the ciphertext and match it with the attribute policy in K1.

[0157] For example, the plaintext attributes of the log attributes after decryption are: A, B, C.

[0158] The log attribute strategy is: (AΛB)Λ(CVD).

[0159] This indicates that the attribute matches the attribute policy, so the attribute policy has permission to access the log.

[0160] Use the key K to decrypt the log content and parse it to obtain the full log plaintext.

[0161] The log management method provided in the embodiment of the present application generates a third key by interacting with the blockchain network to obtain multiple parameters, and uses the third key to decrypt the attribute ciphertext of the encrypted log to obtain the attribute information in the access policy of the encrypted log. If the attribute information matches the access policy, the log content of the encrypted log is decrypted using the third key to obtain a plaintext log, thereby realizing the management of the log access process. In addition, the consistency of the third key and the first key is also verified, so that the integrity of the KP-ABE attribute encryption policy can be verified to avoid the risk of the key held by the user being lost and stolen by others.

[0162] According to the requirements of the KP-ABE attribute encryption algorithm, the logs are first classified, the log attributes and access policies are specified, and then the access policies are written into the keys held by the transaction users. Multiple parameters are required to generate symmetric keys (the first key and the second key). The keys are kept by both the encryption and decryption parties (the nodes of the blockchain network and the off-chain transaction users) to support the subsequent log management process.

[0163] In order to better understand the present application, the log management method provided by the present application is described in detail below through a specific embodiment.

[0164] The embodiment of the present application introduces the KP-ABE attribute encryption algorithm and the Diffie-Hellman algorithm to provide a solution for the access rights control and access content security of blockchain logs.

[0165] Please refer to Figure 7 As shown, the keys produced include two categories: one is the identity certificate of the transaction user issued by the blockchain CA, and the other is the key for log access permission and log content decryption issued based on the identity certificate and log attributes.

[0166] The principle of key production is to classify the logs according to the requirements of the KP-ABE attribute encryption algorithm, specify the log attributes and access policies, and then write the access policies into the keys held by the user. The keys in this embodiment are calculated and generated using the Diffie-Hellman algorithm, which requires multiple calculation factors to generate symmetric keys. The keys are kept by both the encryption and decryption parties (nodes of the blockchain network and off-chain transaction users). The detailed key production process is as follows:

[0167] Step 1: An organization applies to join the blockchain network and sends the application call to the blockchain network 4;

[0168] Step 2: The institutional users of each node in the blockchain network 4 vote to approve or disapprove the application to join, and confirm the application of a certain institution to join;

[0169] Step 3: According to the application content of an institution, the transaction user of the institution is assigned, and the identity authentication certificate and the corresponding public and private key pair of the transaction user are issued through the blockchain's own CA node or the key production server 2 integrated with the CA certificate issuance SDK;

[0170] Step 4: According to the transaction user role of the institution, determine the log type that the user can access, and then query the access policy of the log type on the chain according to the log type. If there is a new log type, the system administrator needs to pre-formulate the access policy, call the system smart contract, and endorse and store the policy on the chain.

[0171] like Figure 8 As shown, for example, the logs of the blockchain are divided into system operation logs, important transaction logs and error logs. The access rights of important transaction logs are high-level rights, the access rights of system operation logs are intermediate rights, and the access rights of error logs are low-level rights. The attributes of the three types of logs include attributes A, B, C, and D. The way to formulate access policies is shown in Table 1.

[0172] Step 5: According to the log access policy established on the chain, and the key parameters used for encryption and decryption of the log type content (random number A of the party requesting log access, random number B of the party encrypting the log, public parameter prime number m and integer g), if a new log type is added, the key parameters must be randomly generated in advance. According to the principle of the Diffie-Hellman algorithm (see Figure 3 The Diffie-Hellman algorithm schematic diagram shown in the figure), the random number A of the party requesting log access, the random number B of the party encrypting the log, the public parameter prime number m and the integer g can be used to generate the first key K, that is:

[0173] K=g AB modm.

[0174] Step 6: To enhance the security of random numbers, the random number A of the party requesting log access is regenerated by the application server, that is, A1, and the number of digits of A1 is required to be one less than A.

[0175] Step 7: If the random number A1 is inconsistent with the pre-made random number A, it is necessary to recalculate the calculation factor Y1 of the original key that the application server can obtain. Y is calculated based on the pre-made random number on the chain. The calculation formula is:

[0176] Y=g B modm;

[0177] Y1=g (A-A1)B .

[0178] Step 8: Application server 1 obtains the calculation factors Y and Y1 of key K, and locally saves the previously generated random number A1. It can calculate and obtain the key K that is consistent with the key on the chain. The calculation formula is:

[0179] K=Y A1 *Y1=g A1B *g (A-A1)B modm=g (A1+A-A1)B modm=g AB modm.

[0180] The key is used to encrypt the calculation factors Y and Y1, as well as the attribute policy of log access, to form a new key K1.

[0181] Step 9: Sign the key K1 with the private key of the blockchain transaction user’s identity authentication CA and store it on the chain for endorsement.

[0182] Figure 7 The process is to obtain the steps for making a single key. If you need to access multiple types of files, you need to make multiple keys.

[0183] Log encryption generation depends on the log type, the attributes of the log access policy, the key K, etc. Different log types require different fields to be encrypted in different levels and categories, as shown in Table 2:

[0184] Table 2: Hierarchical classification encryption table

[0185]

[0186]

[0187] Please refer to Fig. 9 , the detailed log encryption process is:

[0188] Step 1: Application server 1 uses the identity authentication certificate issued by the transaction user and CA to initiate a call to the on-chain smart contract and request to execute the transaction;

[0189] Step 2: After receiving the application for calling the smart contract, the node of blockchain network 4 performs the endorsement and block placement operations to complete the transaction process;

[0190] Step 3: During the transaction process, relevant transaction logs will be generated, including detailed operation logs of important transactions, system logs of blockchain node operation, and error logs when transaction errors occur. Each type of log is generated according to the log naming specification. For example, the detailed operation log of important transactions is named app_xxxxxxxx.log, the system operation log is named sys_xxxxxxxx.log, and the error log is named error_xxxxxxxx.log;

[0191] Step 4: According to the log type, query the system smart contract to obtain the pre-established log strategy on the chain, as well as the calculation factors of the key K, random number A, random number B, public parameter prime number m and integer g;

[0192] Step 5: Calculate the key K = g AB modm, encrypts the content of fields that need to be encrypted according to the log type and classification rules, such as the ID card number, identity authentication password, name, address and other fields in the personal information field;

[0193] Step 6: Transmit the key K, the encrypted log message transmission, the log type, the attributes corresponding to the log policy, etc. to the log management server 3;

[0194] Step 7: The log management server 3 uses the key K to encrypt the attributes corresponding to the log policy into a ciphertext M, saves the log message as a log that complies with the naming specification according to the log type, and modifies the attributes of the log file to add the M attribute.

[0195] All logs generated by the blockchain network 4 are archived to the log management server 3. If transaction users of the blockchain node-owned institution need to access the logs, they need to first authenticate the blockchain node and then perform log acquisition and log content decryption operations. Fig.10 , the detailed log access process is:

[0196] Step 1: Application server 1 of an organization initiates a request for log acquisition, transmits the request parameters of the interface call, and signs with the private key of the CA certificate for identity authentication;

[0197] Step 2: After receiving the request, the blockchain network 4 verifies the identity of the user who initiated the transaction. After the identity is verified, it requests the log management server 3 to obtain the log;

[0198] Step 3: The log management server 3 pushes the required logs to the file server specified by the application server 1 according to the request;

[0199] Step 4: Application server 1 generates a random number A2 for calculating the key K;

[0200] Step 5: The blockchain network 4 queries the calculation factors random number A, random number B, public parameter prime number m and integer g required for the key K of this type of log, and calculates Y and Y2.

[0201] Y=g B modm;

[0202] Y2=g (A-A2)B .

[0203] Step 6: Application server 1 calculates K based on Y and Y2, K = Y A2 *Y2.

[0204] Step 7: Decrypt the initial key K1 stored in the application server 1, obtain the attribute policy and calculation factors Y, A1, Y1 encrypted in K1, and calculate the key = Y A1 *Y1;

[0205] Verify that the key is consistent with the key generated in step 6;

[0206] Step 8: If they are consistent, use key K to decrypt the ciphertext of the log attribute, obtain the attribute value corresponding to the ciphertext, and match it with the attribute policy in K1 to see if they are completely matched.

[0207] For example, the plaintext attributes of the log attributes after decryption are: A, B, C;

[0208] The log attribute strategy is: (AΛB)Λ(CVD);

[0209] This indicates that the attribute matches the attribute policy, so the attribute policy has permission to access the log.

[0210] Step 9: Use the key K to decrypt the log content and parse it to obtain the full log plaintext.

[0211] The embodiment of the present application is based on the KP-ABE attribute encryption algorithm and the Diffie-Hellman algorithm to solve the permission control of log content of blockchain nodes according to the transaction user role, and can at least achieve the following technical effects: based on the KP-ABE attribute encryption algorithm, the access policy of the log can be flexibly adjusted according to the log attributes of the blockchain, and the corresponding keys can be allocated; the encryption key of the log content is shared based on the Diffie-Hellman algorithm, which can enhance the confidentiality and security of the log and meet the regulatory requirements of data classification and grading; the key issued based on the Diffie-Hellman algorithm can verify the integrity of the KP-ABE attribute encryption policy, avoiding the risk of the user's key being lost and stolen by others.

[0212] Fig.11 is a structural diagram of a log management device provided by an embodiment of the present application, such as Fig.11 As shown, the log management device provided in the embodiment of the present application includes:

[0213] A first query module 41 is used to query the log types accessible to the transaction user according to the user role of the transaction user;

[0214] The second query module 42 is used to query the access policy and key parameters of the log type accessible to the transaction user on the chain;

[0215] A first generating module 43, configured to generate a first key according to a key parameter of the log of this type;

[0216] A first acquisition module 44, used to acquire a first random number generated by an application server of the transaction user;

[0217] A second generating module 45, configured to generate a first calculation factor and a second calculation factor according to the first random number and the key parameter;

[0218] The first sending module 46 is used to send the first calculation factor and the second calculation factor to the application server, and the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, and use the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key.

[0219] The log management device provided in the embodiment of the present application, according to the requirements of the KP-ABE attribute encryption algorithm, first classifies the logs, specifies the log attributes and access policies, and then writes the access policies into the keys held by the transaction users. Multiple parameters are required to generate symmetric keys (first keys and second keys). The keys are kept by both the encryption and decryption parties (nodes of the blockchain network and off-chain transaction users) to support subsequent log management processes.

[0220] In some embodiments, the first generating module is specifically used for:

[0221] A first key is generated according to a random number of a party requesting log access, a random number of a party encrypting the log, a first public parameter, and a second public parameter.

[0222] In some embodiments, the second generating module is specifically used for:

[0223] Generate a first calculation factor according to the random number of the log encryption party, the first public parameter, and the second public parameter;

[0224] A second calculation factor is generated according to the first random number, the random number of the party requesting log access, the random number of the party encrypting the log, and the second public parameter.

[0225] In some embodiments, the apparatus further comprises:

[0226] A signature module, used to sign the log management key using the private key of the transaction user to obtain an encryption key;

[0227] The first sending module is also used to send the encryption key to the blockchain network for on-chain endorsement.

[0228] Fig.12 is a structural diagram of a log management device provided by an embodiment of the present application, such as Fig.12 As shown, the log management device provided in the embodiment of the present application includes:

[0229] An execution module 51, used to execute transactions and generate transaction logs according to transaction requests of transaction users;

[0230] A second acquisition module 52 is used to acquire the access policy, encryption policy and key parameters corresponding to the log type of the transaction log;

[0231] A third generating module 53, used to generate a first key according to the key parameters;

[0232] An encryption module 54, configured to encrypt the target field in the transaction log using the first key according to the encryption strategy to generate an encrypted log;

[0233] The second sending module 55 is used to send the first key, the encrypted log and the attribute information corresponding to the access policy to the log management server. The log management server is used to encrypt the attribute information using the first key, generate attribute ciphertext, and add the attribute ciphertext as the attribute of the encrypted log.

[0234] In some embodiments, the second sending module is further used for:

[0235] The log type of the transaction log is sent to a log management server, and the log management server is used to save the encrypted log as a log file that complies with a naming specification according to the log type.

[0236] The log management device provided in the embodiment of the present application, log encryption depends on the log type, the attributes of the log access policy, the first key, etc. Different log types require hierarchical and classified encryption of different fields, which solves the problem that the existing log management method does not distinguish all transaction users of the blockchain and does not perform desensitization processing on sensitive data.

[0237] Fig.13 is a structural diagram of a log management device provided by an embodiment of the present application, such as Fig.13 As shown, the log management device provided in the embodiment of the present application includes:

[0238] A third acquisition module 61 is used to obtain encrypted logs of a target type from a log management server;

[0239] A fourth generating module 62, configured to generate a second random number and send the second random number to the blockchain network, wherein the blockchain network is configured to generate a first calculation factor and a third calculation factor according to the second random number and a key parameter of the log file of the target type;

[0240] A fifth generating module 63, configured to generate a third key according to the first calculation factor, the third calculation factor and the second random number;

[0241] A first decryption module 64 is used to decrypt the locally stored log management key using the third key to obtain the access policy, the first calculation factor and the second calculation factor;

[0242] A sixth generating module 65, configured to generate a first key according to the first calculation factor, the second calculation factor and a first random number stored locally;

[0243] A second decryption module 66 is configured to decrypt the attribute ciphertext of the encrypted log using the third key to obtain attribute information of the encrypted log if the first key and the third key are consistent;

[0244] The third decryption module 67 is used to decrypt the log content of the encrypted log using the third key to obtain a plain text log if the attribute information matches the access policy.

[0245] The log management device provided in the embodiment of the present application generates a third key by interacting with the blockchain network to obtain multiple parameters, and uses the third key to decrypt the attribute ciphertext of the encrypted log to obtain the attribute information of the encrypted log. If the attribute information matches the access policy, the log content of the encrypted log is decrypted using the third key to obtain a plaintext log, thereby realizing the management of the log access process. In addition, the consistency of the third key and the first key is also verified, so that the integrity of the KP-ABE attribute encryption policy can be verified to avoid the risk of the key held by the user being lost and stolen by others.

[0246] The embodiment of the device provided in the embodiment of the present application can be specifically used to execute the processing flow of the above-mentioned method embodiment. Its functions are not repeated here, and reference can be made to the detailed description of the above-mentioned method embodiment.

[0247] It should be noted that the log management method and device provided in the embodiments of the present application can be used in the financial field, and can also be used in any technical field other than the financial field. The embodiments of the present application do not limit the application field of the log management method and device.

[0248] Fig.14 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application is shown in FIG. Fig.14 As shown, the electronic device may include: a processor (processor) 701, a communication interface (Communications Interface) 702, a memory (memory) 703 and a communication bus 704, wherein the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704. The processor 701 can call the logic instructions in the memory 703 to execute the method described in any of the above embodiments.

[0249] In addition, the logic instructions in the above-mentioned memory 703 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0250] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments.

[0251] This embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program enables the computer to execute the methods provided by the above-mentioned method embodiments.

[0252] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0253] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0254] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0255] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0256] In the description of this specification, the description with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0257] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A log management method, characterized in that: include: Based on the user role of the transaction user, query the log types that the transaction user can access; Based on the log type that the transaction user can access, query the access policy and key parameters of this type of log on the chain; Generate a first key according to the key parameters of the log of this type; Obtaining a first random number generated by an application server of the transaction user; Generate a first calculation factor and a second calculation factor according to the first random number and the key parameter; The first calculation factor and the second calculation factor are sent to the application server, and the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, and use the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key.

2. The method according to claim 1, characterized in that The generating a first key according to the key parameter of the log of the type includes: A first key is generated according to a random number of a party requesting log access, a random number of a party encrypting the log, a first public parameter, and a second public parameter.

3. The method according to claim 2, characterized in that The step of generating a first calculation factor and a second calculation factor according to the first random number and the key parameter includes: Generate a first calculation factor according to the random number of the log encryption party, the first public parameter, and the second public parameter; A second calculation factor is generated according to the first random number, the random number of the party requesting log access, the random number of the party encrypting the log, and the second public parameter.

4. The method according to any one of claims 1 to 3, characterized in that: After obtaining the log management key, the method further includes: The log management key is signed using the private key of the transaction user to obtain an encryption key; The encryption key is sent to the blockchain network for on-chain endorsement.

5. A log management method, characterized in that: include: Execute transactions and generate transaction logs according to transaction users’ transaction requests; Obtaining the access policy, encryption policy, and key parameters corresponding to the log type of the transaction log; Generate a first key according to the key parameters; According to the encryption strategy, encrypting the target field in the transaction log using the first key to generate an encrypted log; The first key, the encrypted log and the attribute information corresponding to the access policy are sent to a log management server, and the log management server is used to encrypt the attribute information using the first key, generate attribute ciphertext, and add the attribute ciphertext as an attribute of the encrypted log.

6. The method according to claim 5, characterized in that The method further comprises: The log type of the transaction log is sent to a log management server, and the log management server is used to save the encrypted log as a log file that complies with a naming specification according to the log type.

7. A log management method, characterized in that: include: Obtain the encrypted logs of the target type from the log management server; Generate a second random number and send it to the blockchain network, where the blockchain network is used to generate a first calculation factor and a third calculation factor according to the second random number and a key parameter of the log file of the target type; Generate a third key according to the first calculation factor, the third calculation factor and the second random number; Decrypting the locally stored log management key using the third key to obtain the access policy, the first calculation factor, and the second calculation factor; Generate a first key according to the first calculation factor, the second calculation factor, and a first random number stored locally; If the first key and the third key are consistent, decrypting the attribute ciphertext of the encrypted log using the third key to obtain the attribute information in the access policy of the encrypted log; If the attribute information matches the access policy, the log content of the encrypted log is decrypted using the third key to obtain a plaintext log.

8. A key generation device, characterized in that: include: A first query module, used to query the log types accessible to the transaction user according to the user role of the transaction user; The second query module is used to query the access policy and key parameters of the log type accessible to the transaction user on the chain; A first generating module, used for generating a first key according to a key parameter of the log of this type; A first acquisition module, used to acquire a first random number generated by an application server of the transaction user; A second generating module, used to generate a first calculation factor and a second calculation factor according to the first random number and the key parameter; The first sending module is used to send the first calculation factor and the second calculation factor to the application server, and the application server is used to generate a second key according to the first calculation factor, the second calculation factor and the first random number, and use the second key to encrypt the access policy of the log accessible to the transaction user, the first calculation factor and the second calculation factor to obtain a log management key, and use the log management key to perform log management, wherein the second key is consistent with the first key.

9. A log management device, characterized in that: include: An execution module, used to execute transactions and generate transaction logs according to transaction requests of transaction users; A second acquisition module is used to obtain the access policy, encryption policy and key parameters corresponding to the log type of the transaction log; A third generating module, used to generate a first key according to the key parameters; an encryption module, configured to encrypt the target field in the transaction log using the first key according to the encryption strategy to generate an encrypted log; The second sending module is used to send the first key, the encrypted log and the attribute information corresponding to the access policy to the log management server. The log management server is used to encrypt the attribute information using the first key, generate attribute ciphertext, and add the attribute ciphertext as the attribute of the encrypted log.

10. A log management device, characterized in that: include: A third acquisition module is used to obtain encrypted logs of a target type from a log management server; a fourth generation module, configured to generate a second random number and send the second random number to the blockchain network, wherein the blockchain network is configured to generate a first calculation factor and a third calculation factor according to the second random number and a key parameter of a log file of the target type; a fifth generating module, configured to generate a third key according to the first calculation factor, the third calculation factor and the second random number; A first decryption module, used to decrypt the locally stored log management key using the third key to obtain the access policy, the first calculation factor and the second calculation factor; a sixth generating module, configured to generate a first key according to the first calculation factor, the second calculation factor, and a first random number stored locally; a second decryption module, configured to decrypt the attribute ciphertext of the encrypted log using the third key if the first key and the third key are consistent, so as to obtain the attribute information in the access policy of the encrypted log; The third decryption module is used to decrypt the log content of the encrypted log using the third key to obtain a plain text log if the attribute information matches the access policy.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4, 5 to 6 or 7 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4, 5 to 6 or 7 are implemented.

Images