Audit log secure storage and transmission method and system

Abstract

The invention discloses a secure storage and transmission method and system for an audit log, and belongs to the technical field of data encryption. The method comprises the following steps: encrypting the audit log generated in an operation process by adopting an encryption algorithm; signing the encrypted audit log to generate a digital signature, and attaching the digital signature to the encrypted audit log; adding a timestamp to the signed encrypted audit log by adopting a timestamp technology; transmitting and storing the obtained encrypted audit log with the timestamp by adopting a secure transmission channel; the auditing log is verified by adopting a public key of an encryption algorithm, and the authenticity and integrity of the auditing log are confirmed by comparing the digital signature with the timestamp. According to the method, through multiple technical means of encryption, signature, timestamp and rule matching and the like, safe storage transmission and effective analysis of the DCS audit logs are achieved, and important guarantee is provided for safe operation and maintenance and decision making of the DCS.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a method and system for secure storage and transmission of audit logs. Background Art

[0002] With the improvement of industrial automation, distributed control systems (DCS) play an increasingly important role in industrial production. Distributed control systems are widely used in industrial production processes, and their security and stability are crucial to production. Audit logs are an important part of DCS system security, which are used to record the operations and events of DCS systems for post-analysis and troubleshooting. However, DCS systems face security threats from both inside and outside, such as malware attacks and unauthorized access, which leads to certain security risks in the storage and transmission of audit logs in DCS systems, such as vulnerability to attacks and data leakage. In order to deal with these threats, a reliable method is needed to record and audit system operations so as to track and analyze security incidents when they occur. Therefore, it is of great practical significance to study a method for securely storing and transmitting audit logs. Summary of the invention

[0003] In view of the problems existing in the prior art, the present invention provides a method and system for secure storage and transmission of audit logs, which realizes secure storage and transmission of audit logs and improves the security of DCS systems.

[0004] The present invention is achieved through the following technical solutions: In a first aspect, the present application provides a method for securely storing and transmitting an audit log, comprising the following steps: The audit log generated during the operation is encrypted using an encryption algorithm to obtain an encrypted audit log; Sign the encrypted audit log to generate a digital signature, and attach the digital signature to the encrypted audit log to obtain the signed encrypted audit log; Use timestamp technology to add timestamp to the signed encrypted audit log to obtain an encrypted audit log with timestamp; Use secure transmission channels to transmit and save encrypted audit logs with timestamps; Use the public key of the encryption algorithm to verify the encrypted audit log with timestamp, and confirm the authenticity and integrity of the audit log by verifying the digital signature and timestamp; Use the rule matching method to analyze the confirmed audit logs and identify the security of the audit logs. The specific steps are as follows: Define the rules; Collect audit logs; Preprocess audit logs; Match the pre-processed audit logs with the defined rules; Generate alerts or reports based on the matching results.

[0005] Preferably, the audit log includes at least one of the following: operation type, operation time, operator identity and operation result.

[0006] Preferably, the encryption algorithm is AES, RSA, ECC, SM2 encryption algorithm or SM4 encryption algorithm.

[0007] Preferably, the method of signing the encrypted audit log to generate a digital signature is as follows: The digital signature algorithm is used to generate public and private keys. The private key is used to generate the signature, while the public key is used to verify the validity of the signature. Use the hash algorithm to calculate the hash value of the encrypted audit log, and use the private key to encrypt the hash value to generate the digital signature of the encrypted audit log; The steps of using the hash algorithm to calculate the hash value of the encrypted audit log are as follows: a. Select a hash algorithm: Select a suitable hash algorithm based on security requirements and performance considerations. b. Obtain encrypted audit logs: Collect the encrypted audit logs that need to be signed from the DCS system.

[0008] c. Preprocessing of encrypted audit logs: Before calculating the hash value, the encrypted audit logs need to be preprocessed.

[0009] d. Calculate the hash value of the encrypted audit log: Use the selected hash algorithm to perform hash calculation on the preprocessed encrypted audit log.

[0010] e. Verify hash value: Recalculate the hash value of the encrypted audit log and compare it with the saved hash value, and verify the hash value of the encrypted audit log based on the comparison result.

[0011] Preferably, the method of adding a timestamp to the signed encrypted audit log using the timestamp technology is as follows: Generate a timestamp request based on the signed encrypted audit log, and send the timestamp request to the timestamp authorization server. The timestamp authorization server uses the private key to encrypt the timestamp request to generate a timestamp signature, and combines the timestamp signature and the timestamp into a timestamp token. The timestamp token is attached to the signed encrypted audit log, and the verifier verifies the timestamp signature through the timestamp token. The specific steps for timestamp signature verification through timestamp token are as follows: a. Get a timestamp token; b. Parse the timestamp token to obtain the timestamp signature and timestamp; c. Recalculate the hash value of the encrypted audit log; d. Compare the calculated hash value with the hash value recorded in the timestamp token, and determine whether the encrypted audit log has been tampered with based on the comparison result; e. Check whether the timestamp is within a reasonable time range and verify the validity of the timestamp; f. Use the public key of the timestamp authorization server to verify the timestamp signature; g. Verify that the signing certificate of the timestamp authorization server and any certificates in the trust chain are valid, and that the signing certificate and any of the certificates have not been revoked.

[0012] Preferably, the method of using a secure transmission channel to transmit and store the encrypted audit log with a timestamp includes: A secure communication channel is established using a secure communication protocol, and encrypted audit logs with timestamps are transmitted through the secure communication channel and stored in the central log server.

[0013] In a second aspect, the present application provides a secure storage and transmission system for audit logs, including: The encryption module is used to encrypt the audit log generated during the operation process using an encryption algorithm to obtain an encrypted audit log; The signature module is used to sign the encrypted audit log to generate a digital signature, and attach the digital signature to the encrypted audit log to obtain the signed encrypted audit log; The timestamp module is used to add a timestamp to the encrypted audit log after signing by using the timestamp technology to obtain an encrypted audit log with a timestamp; A transmission module is used to transmit and save the encrypted audit log with timestamp through a secure transmission channel; The verification module is used to verify the encrypted audit log with a timestamp using the public key of the encryption algorithm, and confirm the authenticity and integrity of the audit log by verifying the digital signature and timestamp; The analysis module is used to analyze the confirmed audit logs using the rule matching method to identify the security of the audit logs. The specific steps are as follows: Define the rules; Collect audit logs; Preprocess audit logs; Match the pre-processed audit logs with the defined rules; Generate alerts or reports based on the matching results.

[0014] In a third aspect, the present application provides a DCS system, in which the secure storage and transmission system for audit logs is integrated.

[0015] In a fourth aspect, the present application provides an electronic device, including: Memory for storing computer programs; A processor is used to implement the steps of the method for securely storing and transmitting an audit log when executing the computer program.

[0016] In a fifth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the method for securely storing and transmitting an audit log are implemented.

[0017] Compared with the prior art, the present invention has the following beneficial technical effects: The invention provides a secure storage and transmission method for audit logs. By adopting an encryption algorithm to encrypt the audit logs, the confidentiality of the audit log content during the transmission and storage process is ensured, and sensitive information is prevented from being stolen or leaked by unauthorized personnel. The generated digital signature can verify the integrity and source authenticity of the audit log. Even if the audit log is tampered with during the transmission process, the receiver can find this by verifying the digital signature, thereby ensuring the reliability of the audit log. The timestamp technology is used to add a timestamp to the audit log, thereby ensuring the authenticity and accuracy of the audit log generation time. The timestamp is provided by a reliable timestamp authorization server and has legal effect, further enhancing the credibility of the audit log. The secure transmission channel and the central log server are used to transmit and store the audit logs, thereby realizing the centralized management and backup of the audit logs. This helps to simplify the audit log management process, improve management efficiency, and reduce the risks caused by the loss or damage of the audit logs. The rule matching method can effectively identify abnormal behaviors or potential security threats by matching the key elements in the audit log with preset rules. This helps system administrators to timely discover and respond to security risks and ensure the stable operation and data security of the DCS system. Through in-depth analysis of audit logs, DCS system administrators can understand the use of DCS systems, potential security vulnerabilities and threats, and formulate more targeted security strategies and reinforcement measures. This helps to improve the overall security level of the DCS system and provide strong support for the long-term safe operation and maintenance of the DCS system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1A flowchart of a method for secure storage and transmission of audit logs provided by the present invention; Figure 2 A structural schematic diagram of a secure storage and transmission system for audit logs provided by the present invention. DETAILED DESCRIPTION

[0020] The present invention will be further described in detail below in conjunction with the accompanying drawings, which are intended to explain the present invention rather than to limit it.

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0023] The DCS system can monitor and control various parameters in the production process in real time, such as temperature, pressure, flow, etc., to ensure that the production process is carried out according to predetermined conditions and standards. Through precise process control, the DCS system can improve product quality and consistency and reduce production costs. The audit log of the DCS system records every operation behavior and event in the DCS system in detail, including user login, data modification, equipment status change, etc. When the DCS system fails or is abnormal, the audit log becomes an important clue to track the root cause of the problem. By viewing the operation records in the audit log, you can quickly locate the time, place and cause of the problem, thereby accelerating the troubleshooting and repair process.

[0024] The DCS system faces security threats from both inside and outside, such as malware attacks, unauthorized access, etc. Audit logs can monitor security events in the system in real time. Once abnormal behavior is found, such as unauthorized access attempts, leakage of sensitive data, etc., an alarm can be immediately issued and relevant operation details can be recorded. This not only helps to timely discover and respond to security threats, but also provides valuable evidence for subsequent security incident analysis and investigation and evidence collection.

[0025] The audit log records the user's operation behavior pattern, including login time, operation content, operation results, etc. By analyzing this information, we can understand the user's needs and habits, and provide a reference for the design and optimization of the DCS system. At the same time, when a security incident or data leakage occurs, the audit log can also be used to trace the user's responsibility and ensure the security and controllability of the DCS system. By analyzing the audit log, we can find performance bottlenecks and resource waste in the DCS system. For example, we can analyze which operations frequently cause the DCS system to be overloaded, and which resources have not been fully utilized for a long time. Based on this information, the DCS system can be optimized for performance and resource allocation to improve the operating efficiency and stability of the DCS system.

[0026] See also Figure 1 Based on the above DCS system audit log, the present application provides a method for secure storage and transmission of audit logs, including the following steps: Step 1: Encrypt the audit log generated during the operation process.

[0027] During the operation of the DCS system, all operations performed by users in the DCS system will be monitored and corresponding audit logs will be generated for recording. The audit logs include information such as operation type, operation time, operator identity, and operation results. The audit logs are then encrypted using an encryption algorithm to ensure the confidentiality of the audit log content during transmission.

[0028] The encryption algorithm may be AES (Advanced Encryption Standard, symmetric encryption algorithm), RSA (Rivest-Shamir-Adleman, asymmetric encryption algorithm), ECC (Elliptic Curve Cryptography, elliptic curve encryption algorithm), SM2 encryption algorithm or SM4 encryption algorithm, SM2 is an encryption algorithm based on the elliptic curve public key cryptography system, SM4 is a block cipher algorithm, SM stands for the first letters of "commercial secret", i.e. commercial password, Security for Commerce.

[0029] AES is one of the most widely used symmetric encryption algorithms. It provides a variety of key lengths (such as 128 bits, 192 bits, and 256 bits) and is highly efficient and secure. AES has a fast encryption speed and is suitable for encrypting large amounts of data, such as audit logs.

[0030] RSA is mainly used for asymmetric encryption, but it is also often used for the exchange of encryption keys. In the encryption scenario of audit logs, RSA can be used to encrypt the AES key, and then the encrypted AES key is transmitted or stored together with the audit log. In this way, even if the AES key is leaked, it cannot be decrypted without the RSA private key, thereby protecting the security of the audit log.

[0031] ECC is a public key cryptography system based on elliptic curve mathematics. Compared with RSA, it can use a shorter key length at the same security level, thereby increasing the speed of encryption and decryption. ECC is also suitable for the exchange of encryption keys and can be used in conjunction with symmetric encryption algorithms such as AES.

[0032] Step 2: Sign the encrypted audit log to generate a digital signature, and attach the digital signature to the encrypted audit log.

[0033] In the DCS system, after the audit log generated by the operation process is encrypted, a digital signature is further generated to verify the integrity and source authenticity of the encrypted audit log. The signing method of the encrypted audit log is as follows: The public key and private key are generated according to the digital signature algorithm. The private key will be used to generate the signature, while the public key is used to verify the validity of the signature.

[0034] The hash value of the encrypted audit log is calculated using a hash algorithm. The hash algorithm converts input data of any length into an output of a fixed length, namely a hash value. This hash value will be used in the subsequent signing process.

[0035] The hash value is encrypted using the private key to generate a digital signature for the encrypted audit log. The digital signature will be attached to the encrypted audit log and stored or transmitted together.

[0036] When the integrity and origin of the audit log need to be verified, the receiver will use the public key to decrypt (verify) the digital signature and recalculate the hash value of the encrypted audit log. If the decrypted hash value matches the recalculated hash value, it means that the audit log has not been tampered with during transmission and indeed came from the sender.

[0037] Step 3: Use timestamp technology to add a timestamp to the signed encrypted audit log.

[0038] In the DCS system, the audit logs generated during the operation are encrypted, digitally signed, and timestamp technology is used to add a timestamp to the encrypted audit logs after signing to ensure that the generation time of the audit logs is not tampered with. This is a process to enhance the security and credibility of the audit logs. The details are as follows: First, select a reliable timestamp authorization server whose timestamp service is legally binding.

[0039] Then, the hash value of the encrypted and signed audit log is used as a timestamp request, which includes necessary information such as the identity information of the requester and the time of the timestamp request. The timestamp request is sent to the timestamp authorization server through a secure transmission channel.

[0040] Secondly, after receiving the timestamp request, the timestamp authorization server will use a compliant time source to obtain the current accurate time. It will use its private key to encrypt the information in the timestamp request (including the hash value of the audit log, request time, etc.), generate a timestamp signature, and then generate a timestamp token.

[0041] The specific process of generating a timestamp token is to combine the timestamp signature, timestamp and other necessary information (such as the identification information of the timestamp authorization server) into a timestamp token.

[0042] When the timestamp of the audit log needs to be verified, the verifier can use the public key of the timestamp authorization server to decrypt and verify the timestamp signature in the timestamp token. At the same time, the hash value of the audit log is recalculated and compared with the hash value recorded in the timestamp token. If the hash values ​​are consistent, the audit log has not been tampered with after signing.

[0043] Step 4: Use a secure transmission channel to transmit and save the encrypted audit log with timestamp obtained in step 3.

[0044] Select a secure communication protocol, establish a secure communication channel on the network based on the selected secure communication protocol, transmit encrypted audit logs with timestamps through the secure communication channel, and save them on the central log server. On the central log server, use non-volatile storage media to store audit logs and perform regular backups to prevent audit logs from being lost or tampered with.

[0045] Step 5: When verifying the audit log, the operator's public key is used to verify the stored audit log, and the authenticity and integrity of the audit log are confirmed by comparing the digital signature and timestamp.

[0046] Step 6: Identify potential security threats and improper operations by analyzing audit logs, and provide decision support for DCS system security. The analysis method of audit logs is as follows: The audit log is analyzed by rule matching method, and the audit log is matched with the rules in the rule base. The audit log data is traversed, the rules in the rule base are applied to each audit log entry, and a match is checked. For each matching audit log entry, the matching result is recorded, including the matched rule, the matching time, the matched audit log content and other information. Based on the results of the rule matching, abnormal behaviors or potential security threats in the audit log are identified. These abnormal behaviors may include unauthorized resource access, leakage of sensitive data, tampering of DCS system configuration, etc. Risk assessment is performed on the identified abnormal behaviors to assess their impact on the DCS system, data and business. This helps to determine the priority of abnormal behaviors and take appropriate countermeasures.

[0047] Use the rule matching method to analyze the audit log and identify the security of the audit log. The specific steps are as follows: a. Define rules: Based on the business scenario, define a set of rules for detecting violations.

[0048] b. Collect audit logs: Collect audit logs from various components of the DCS system.

[0049] c. Preprocess audit logs: Preprocess the collected audit logs. d. Rule matching: Match the preprocessed audit logs with the defined rules.

[0050] e. Generate alarms or reports: Once a matching result error is found, the DCS system will generate a corresponding alarm or report to notify the administrator for further investigation and processing.

[0051] The rule matching method can effectively identify abnormal behaviors or potential security threats by matching the key elements in the audit log with preset rules, providing strong support for the safe operation and maintenance and decision-making of the DCS system.

[0052] The above-mentioned audit log secure storage and transmission method is intended to improve the security and reliability of industrial control systems. This method ensures the integrity, non-repudiation and real-time nature of audit logs through encryption technology, digital signature and timestamp services, thus providing strong support for DCS system security.

[0053] The above-mentioned method for secure storage and transmission of audit logs ensures the confidentiality of audit log data and prevents data leakage and illegal access by encrypting the audit logs. It then adopts distributed storage and trusted verification mechanisms to improve data reliability and security, monitors and alarms abnormal situations during storage and transmission, and can promptly detect and handle potential security threats. Secondly, it regularly backs up and restores stored audit logs to prevent data loss and damage.

[0054] In actual applications, it can be integrated into the existing DCS system or deployed as an independent security module. System administrators can configure the security storage strategy of the audit log according to actual needs, select encryption and signature algorithms, and set the storage and backup strategy of the audit log. See also Figure 2 Based on the above-mentioned secure storage and transmission method of audit logs, the present application also proposes a secure storage and transmission system for audit logs, which may include: The encryption module is used to encrypt the audit log generated during the operation process using an encryption algorithm to obtain an encrypted audit log; The signature module is used to sign the encrypted audit log to generate a digital signature, and attach the digital signature to the encrypted audit log to obtain the signed encrypted audit log; The timestamp module is used to add a timestamp to the encrypted audit log after signing by using the timestamp technology to obtain an encrypted audit log with a timestamp; A transmission module is used to transmit and save the encrypted audit log with timestamp through a secure transmission channel; The verification module is used to verify the encrypted audit log with a timestamp using the public key of the encryption algorithm, and confirm the authenticity and integrity of the audit log by verifying the digital signature and timestamp; The analysis module is used to analyze the confirmed audit logs using the rule matching method to identify the security of the audit logs. The specific steps are as follows: Define the rules; Collect audit logs; Preprocess audit logs; Match the pre-processed audit logs with the defined rules; Generate alerts or reports based on the matching results.

[0055] Based on the above-mentioned secure storage and transmission system for audit logs, the present application also proposes a DCS system, in which the above-mentioned secure storage and transmission system for audit logs is integrated.

[0056] It should be noted that in the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each module is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The module described as a separate component may or may not be physically separated. The component displayed as a module may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0057] In addition, each module in each embodiment of the present invention may be integrated into a processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0058] An electronic device provided in an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of a method for securely storing and transmitting an audit log as described in any of the above embodiments are implemented.

[0059] Another electronic device provided in the embodiment of the present application may also include: an input port connected to the processor, used to transmit multimodal data collected by an external acquisition device to the processor; and a display unit connected to the processor, used to display the processing results of the processor to the outside world; a communication module connected to the processor, used to realize the communication between the electronic device and the outside world. The display unit can be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes but is not limited to mobile high-definition link technology, universal serial bus, high-definition multimedia interface, wireless connection (including wireless fidelity technology, Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s), IEEE 802.11s is a standard formulated by IEEE (Institute of Electrical and Electronics Engineers) for wireless local area networks, specifically used to support the construction and management of wireless networks.

[0060] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the method for securely storing and transmitting audit logs described in any of the above embodiments are implemented.

[0061] The computer-readable storage medium involved in this application includes random access memory, internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs (Compact Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0062] For the description of the relevant parts of the secure storage and transmission system for audit logs, electronic equipment, and computer-readable storage medium provided in the embodiments of the present application, please refer to the detailed description of the corresponding parts in the secure storage and transmission method for audit logs provided in the embodiments of the present application, which will not be repeated here. In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0063] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A method for secure storage and transmission of audit logs, characterized in that: The following steps are involved: The audit log generated during the operation is encrypted using an encryption algorithm to obtain an encrypted audit log; Sign the encrypted audit log to generate a digital signature, and attach the digital signature to the encrypted audit log to obtain the signed encrypted audit log; Use timestamp technology to add timestamp to the signed encrypted audit log to obtain an encrypted audit log with timestamp; Use secure transmission channels to transmit and save encrypted audit logs with timestamps; Use the public key of the encryption algorithm to verify the encrypted audit log with timestamp, and confirm the authenticity and integrity of the audit log by verifying the digital signature and timestamp; Use the rule matching method to analyze the confirmed audit logs and identify the security of the audit logs. The specific steps are as follows: Define the rules; Collect audit logs; Preprocess audit logs; Match the pre-processed audit logs with the defined rules; Generate alerts or reports based on the matching results.

2. According to claim 1, a method for secure storage and transmission of audit logs is characterized in that: The audit log includes at least one of the following: operation type, operation time, operator identity and operation result.

3. According to claim 1, a method for secure storage and transmission of audit logs is characterized in that: The encryption algorithm is AES, RSA, ECC, SM2 encryption algorithm or SM4 encryption algorithm.

4. The method for secure storage and transmission of audit logs according to claim 1, characterized in that: The method for signing the encrypted audit log to generate a digital signature is as follows: The digital signature algorithm is used to generate public and private keys. The private key is used to generate the signature, while the public key is used to verify the validity of the signature. Use the hash algorithm to calculate the hash value of the encrypted audit log, and use the private key to encrypt the hash value to generate the digital signature of the encrypted audit log; The steps of using the hash algorithm to calculate the hash value of the encrypted audit log are as follows: Select a hashing algorithm; Get encrypted audit logs; Preprocessing encrypted audit logs; Calculate the hash value of the encrypted audit log; Verify the hash value, compare the re-calculated hash value of the encrypted audit log with the saved hash value, and verify the hash value of the encrypted audit log based on the comparison result.

5. The method for secure storage and transmission of audit logs according to claim 1, characterized in that: The method of adding a timestamp to the signed encrypted audit log using the timestamp technology is as follows: Generate a timestamp request based on the signed encrypted audit log, and send the timestamp request to the timestamp authorization server. The timestamp authorization server uses the private key to encrypt the timestamp request to generate a timestamp signature, and combines the timestamp signature and the timestamp into a timestamp token. The timestamp token is attached to the signed encrypted audit log, and the verifier verifies the timestamp signature through the timestamp token. The specific steps for timestamp signature verification through timestamp token are as follows: Get a timestamp token; Parse the timestamp token to get the timestamp signature and timestamp; Recalculate the hash value of the encrypted audit log; Compare the calculated hash value with the hash value recorded in the timestamp token, and determine whether the encrypted audit log has been tampered with based on the comparison result; Check whether the timestamp is within a reasonable time range and verify the validity of the timestamp; Verify the timestamp signature using the timestamp authorization server's public key; Verify that the signing certificate of the timestamp authorization server and any certificates in the trust chain are valid, and that the signing certificate and any of the certificates have not been revoked.

6. The method for secure storage and transmission of audit logs according to claim 1, characterized in that: The method of using a secure transmission channel to transmit and save the encrypted audit log with a timestamp includes: A secure communication channel is established using a secure communication protocol, and encrypted audit logs with timestamps are transmitted through the secure communication channel and stored in the central log server.

7. A secure storage and transmission system for audit logs, characterized in that: include: The encryption module is used to encrypt the audit log generated during the operation process using an encryption algorithm to obtain an encrypted audit log; The signature module is used to sign the encrypted audit log to generate a digital signature, and attach the digital signature to the encrypted audit log to obtain the signed encrypted audit log; The timestamp module is used to add a timestamp to the encrypted audit log after signing by using the timestamp technology to obtain an encrypted audit log with a timestamp; A transmission module is used to transmit and save the encrypted audit log with timestamp through a secure transmission channel; The verification module is used to verify the encrypted audit log with a timestamp using the public key of the encryption algorithm, and confirm the authenticity and integrity of the audit log by verifying the digital signature and timestamp; The analysis module is used to analyze the confirmed audit logs using the rule matching method to identify the security of the audit logs. The specific steps are as follows: Define the rules; Collect audit logs; Preprocess audit logs; Match the pre-processed audit logs with the defined rules; Generate alerts or reports based on the matching results.

8. A DCS system, characterized in that: The DCS system is integrated with a secure storage and transmission system for audit logs as described in claim 7.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of a method for securely storing and transmitting an audit log as described in any one of claims 1 to 6 when executing the computer program.

10. A computer-readable storage medium, characterized in that: A computer program is stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of a method for securely storing and transmitting an audit log as described in any one of claims 1 to 6 are implemented.

Images