Cloud log processing method and device, electronic equipment and computer storage medium

Abstract

The embodiment of the invention provides a cloud log processing method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of cloud computing, the cloud log processing method comprises the following steps: when log data is obtained, generating an encrypted log entry based on the log data, and storing the encrypted log entry into a log database; obtaining at least one historical encrypted log entry to be processed from a log database; generating at least one log chain based on each historical encrypted log entry; classifying the log chains to obtain at least one log chain set; accumulator entries are generated based on the log chain sets; an attestation of a past log is generated based on the accumulator entry, and the attestation of the past log is published to a common platform. According to the embodiment of the invention, the integrity, confidentiality and traceability of the log data and the non-tampering property of the log are ensured.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a cloud log processing method, a cloud log processing device, an electronic device and a computer-readable storage medium. Background Art

[0002] With the development of network technology, more and more users use cloud storage to save their data. However, malicious users may damage cloud accounts and servers in order to steal sensitive data. In cloud environments, data is usually stored in multiple geographical locations and virtual infrastructures, making it difficult for traditional log management tools to adapt.

[0003] In cloud environments, cloud service providers (CSPs) are usually responsible for recording user activity logs. However, since the logs are in the cloud, it is difficult for users to directly control them. They cannot verify whether the logs recorded by the CSP are authentic, nor can they prevent the log data from being tampered with. This poses a huge challenge to data forensics in cloud environments. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a cloud log processing method, a cloud log processing device, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In order to solve the above problems, an embodiment of the present invention discloses a method for processing cloud logs, which includes:

[0006] When the log data is acquired, an encrypted log entry is generated based on the log data, and the encrypted log entry is stored in a log database;

[0007] Obtain at least one historical encrypted log entry to be processed from a log database;

[0008] generating at least one log chain based on each of the historical encrypted log entries;

[0009] Classifying each of the log chains to obtain at least one log chain set;

[0010] generating an accumulator entry based on each of the log chain sets;

[0011] A proof of a past log is generated based on the accumulator entry, and the proof of the past log is published to a public platform.

[0012] In one or more embodiments, further comprising:

[0013] In response to a verification instruction for the log data, verify the log data and audit the verification;

[0014] When the validation is complete, an audit report is generated.

[0015] In one or more embodiments, generating an encrypted log entry based on the log data includes:

[0016] Parsing the log data to obtain key information in the log data;

[0017] Storing the key information in a cache;

[0018] Target information in the key information is extracted from the cache, and the target information is encrypted using a public key to obtain an encrypted log entry.

[0019] In one or more embodiments, generating at least one log chain based on each of the historical encrypted log entries includes:

[0020] Calculating a hash value of each of the historical encrypted log entries;

[0021] The hash values ​​of any two adjacent historical encrypted log entries are combined into a log chain to obtain at least one log chain.

[0022] In one or more embodiments, classifying each of the log chains to obtain at least one log chain set includes:

[0023] Each of the log chains is classified according to the time interval to obtain a set of log chains corresponding to multiple time intervals.

[0024] In one or more embodiments, generating accumulator entries based on each of the log chain sets includes:

[0025] Using a fingerprint algorithm to generate a fingerprint corresponding to each log chain set;

[0026] Calculate the hash value of each fingerprint;

[0027] Store each hash value into a Bloom filter to generate an accumulator entry.

[0028] In one or more embodiments, generating a proof of a past log based on the accumulator entry includes:

[0029] Obtain the timestamp corresponding to each log chain set and the digital signature of the cloud service provider of the log data;

[0030] A proof of a past log is generated using the accumulator entries, each of the timestamps, and the digital signature.

[0031] In one or more embodiments, the verifying the log data includes:

[0032] Obtain at least one private key shard from a cloud service provider;

[0033] Reconstructing each of the private key fragments using a secret sharing algorithm to obtain a private key;

[0034] Decrypting the historical encrypted log entries using the private key to obtain target information;

[0035] Detecting whether the target information is the same as the target information recorded by the cloud service provider;

[0036] If they are the same, the log data has not been tampered with; if they are not the same, the log data has been tampered with.

[0037] In one or more embodiments, the verifying the log data further includes:

[0038] Obtaining a certificate of the past log from the public platform;

[0039] The log data is verified using the certification of the past log.

[0040] Accordingly, an embodiment of the present invention discloses a cloud log processing device, the device comprising:

[0041] A first generating module, configured to generate an encrypted log entry based on the log data when the log data is acquired;

[0042] A storage module, used for storing the encrypted log entry in a log database;

[0043] An acquisition module, used for acquiring at least one historical encrypted log entry to be processed from a log database;

[0044] A second generating module, configured to generate at least one log chain based on each of the historical encrypted log entries;

[0045] A classification module, used for classifying each of the log chains to obtain at least one log chain set;

[0046] A third generating module, configured to generate accumulator entries based on each of the log chain sets;

[0047] a fourth generating module for generating a proof of a past log based on the accumulator entry;

[0048] A publishing module is used to publish the proof of the past log to a public platform.

[0049] In one or more embodiments, further comprising:

[0050] A verification module, configured to verify the log data in response to a verification instruction for the log data;

[0051] The audit module is used to audit the verification and generate an audit report when the verification is completed.

[0052] In one or more embodiments, the first generating module is specifically used to:

[0053] Parsing the log data to obtain key information in the log data;

[0054] Storing the key information in a cache;

[0055] Target information in the key information is extracted from the cache, and the target information is encrypted using a public key to obtain an encrypted log entry.

[0056] In one or more embodiments, the second generating module is specifically used to:

[0057] Calculating a hash value of each of the historical encrypted log entries;

[0058] The hash values ​​of any two adjacent historical encrypted log entries are combined into a log chain to obtain at least one log chain.

[0059] In one or more embodiments, the classification module is specifically used to:

[0060] Each of the log chains is classified according to the time interval to obtain a set of log chains corresponding to multiple time intervals.

[0061] In one or more embodiments, the third generation module is specifically used to:

[0062] Using a fingerprint algorithm to generate a fingerprint corresponding to each log chain set;

[0063] Calculate the hash value of each fingerprint;

[0064] Store each hash value into a Bloom filter to generate an accumulator entry.

[0065] In one or more embodiments, the fourth generation module is specifically used to:

[0066] Obtain the timestamp corresponding to each log chain set and the digital signature of the cloud service provider of the log data;

[0067] A proof of a past log is generated using the accumulator entries, each of the timestamps, and the digital signature.

[0068] In one or more embodiments, the verification module is specifically used to:

[0069] Obtain at least one private key shard from a cloud service provider;

[0070] Reconstructing each of the private key fragments using a secret sharing algorithm to obtain a private key;

[0071] Decrypting the historical encrypted log entries using the private key to obtain target information;

[0072] Detecting whether the target information is the same as the target information recorded by the cloud service provider;

[0073] If they are the same, the log data has not been tampered with; if they are not the same, the log data has been tampered with.

[0074] In one or more embodiments, the verification module is further configured to:

[0075] Obtaining a certificate of the past log from the public platform;

[0076] The log data is verified using the certification of the past log.

[0077] Correspondingly, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the various steps of the above-mentioned cloud log processing method embodiment when executed by the processor.

[0078] Accordingly, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each step of the above-mentioned cloud log processing method embodiment is implemented.

[0079] The embodiments of the present invention include the following advantages:

[0080] When log data is obtained, an encrypted log entry is generated based on the log data, and the encrypted log entry is stored in the log database; at least one historical encrypted log entry to be processed is obtained from the log database; at least one log chain is generated based on each of the historical encrypted log entries; each of the log chains is classified to obtain at least one log chain set; an accumulator entry is generated based on each of the log chain sets; a proof of past logs is generated based on the accumulator entry, and the proof of past logs is published to a public platform. In this way, log data can be collected and parsed from a cloud service provider, encrypted using a public key and combined with a log chain, and stored in the cloud. Compared with traditional methods, this method provides strong security and transparency that traditional methods lack through a multi-level security mechanism, ensuring the integrity, confidentiality and traceability of log data.

[0081] Furthermore, by efficiently generating accumulator entries through technologies such as fingerprint algorithms and Bloom filters, a large amount of log data can be quickly verified, providing real-time and efficiency that traditional solutions lack, and ensuring the immutability of logs. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 It is a flowchart of the steps of Embodiment 1 of a method for processing a cloud log of the present invention;

[0083] Figure 2 It is a schematic diagram of the topological structure of the present invention;

[0084] Figure 3 This is a flow chart of steps of a second embodiment of a method for processing a cloud log of the present invention;

[0085] Figure 4 It is a structural block diagram of an embodiment of a cloud log processing device of the present invention. DETAILED DESCRIPTION

[0086] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0087] One of the core concepts of the embodiments of the present invention is to allow the collection and analysis of log data from cloud service providers, and to encrypt it using a public key and combine it with the log chain and store it in the cloud. Compared with traditional methods, this method provides strong security and transparency that traditional methods lack through a multi-level security mechanism, ensuring the integrity, confidentiality and traceability of log data.

[0088] Furthermore, by efficiently generating accumulator entries through technologies such as fingerprint algorithms and Bloom filters, a large amount of log data can be quickly verified, providing real-time and efficiency that traditional solutions lack, and ensuring the immutability of logs.

[0089] Reference Figure 1 , showing a flow chart of the steps of a first embodiment of a method for processing cloud logs of the present invention, which can be applied to a user's terminal device, referring to Figure 2 , shows a schematic diagram of the topological structure of an embodiment of the present invention, wherein the terminal device can be connected to at least one cloud service provider (CSP) to interact with data, and the terminal device can also be connected to a public platform to interact with data. The method may specifically include the following steps:

[0090] Step 101: when log data is acquired, an encrypted log entry is generated based on the log data, and the encrypted log entry is stored in a log database.

[0091] In actual applications, users may visit multiple cloud service providers, and multiple cloud service providers will generate corresponding log data, so the terminal device can obtain log data from multiple cloud service providers. Of course, if the user has only visited one cloud service provider, then it is sufficient to obtain log data from this one cloud service provider.

[0092] It should be noted that when a user has visited multiple cloud service providers, the user can also obtain log data from a specified cloud service provider. In actual applications, the number of cloud service providers and whether a specified cloud service provider is needed can be adjusted according to actual needs, and the embodiments of the present invention do not limit this.

[0093] In an embodiment of the present invention, generating an encrypted log entry based on the log data includes:

[0094] Parsing the log data to obtain target information in the log data;

[0095] Storing the target information in a cache;

[0096] The target information in the cache is encrypted using a public key to obtain an encrypted log entry.

[0097] Specifically, after obtaining the log data, the log data can be parsed to obtain the target information in the log data, wherein the target information may include a timestamp, an IP address, etc. Of course, in addition to the above information, the target information may also include other information. In practical applications, the specific content of the target information may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0098] Then, the target information can be stored in a preset cache, and the target information in the cache can be encrypted using the user's public key to obtain an encrypted log entry (ELE), so that the confidentiality of the data can be ensured.

[0099] It should be noted that in addition to encrypting the target information, the complete log data can also be encrypted. Encrypting the target information takes less time, and encrypting the complete log data is more complete. In actual applications, the encrypted data content can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0100] After the encrypted log entry is generated, it can be stored in a preset log database. The log database can be deployed in the cloud or locally. In actual applications, the deployment method of the log database can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0101] Step 102: Obtain at least one historical encrypted log entry to be processed from a log database.

[0102] After the encrypted log entry is stored in the log database, at least one encrypted log entry to be processed (referred to as a “historical encrypted log entry” for ease of description) can be obtained from the log database. That is, the encrypted log entry to be processed may include the encrypted log entry generated in step 101 .

[0103] For example, before executing step 101, the log database stores encrypted log entry 1 and encrypted log entry 2 to be processed. Step 101 generates encrypted log entry 3. After storing encrypted log entry 3 in the log database, encrypted log entry 1, encrypted log entry 2, and encrypted log entry 3 can be obtained from the log database.

[0104] It should be noted that if no log data is obtained, or no new log data is obtained, step 101 may not be performed, and step 102 may be directly performed.

[0105] Step 103: Generate at least one log chain based on each of the historical encrypted log entries.

[0106] After obtaining each historical encrypted log entry, multiple log chains (LCs) can be generated using each historical encrypted log entry, where a log chain is a small piece of information that coexists with the corresponding log data, used to maintain the order and integrity of the log data and prevent any tampering of the log data, including but not limited to addition, modification, deletion, and reordering. When the log data needs to be verified, the encrypted log entry can be obtained from the log chain, and its hash value can be calculated after decryption to verify its integrity.

[0107] In the embodiment of the present invention, generating at least one log chain based on each of the historical encrypted log entries includes:

[0108] Calculating a hash value of each of the historical encrypted log entries;

[0109] The hash values ​​of any two adjacent historical encrypted log entries are combined into a log chain to obtain at least one log chain.

[0110] Specifically, for any historical encrypted log entry, its hash value can be calculated to obtain the hash value of each historical encrypted log entry, and then the hash values ​​of any two adjacent historical encrypted log entries can be combined to generate a log chain, thereby obtaining the hash values ​​of all historical encrypted log entries. For example, for historical encrypted log entry 4, its hash value can be combined with the hash value of historical encrypted log entry 3 to generate a log chain, and for historical encrypted log entry 5, its hash value can be combined with the hash value of historical encrypted log entry 4 to generate a log chain.

[0111] It should be noted that the order of historical encrypted log entries can be arranged based on the generation time of the log data, or based on other methods. In actual applications, the arrangement of historical encrypted log entries can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0112] Step 104: classify each of the log chains to obtain at least one log chain set.

[0113] After obtaining a plurality of log chains, each log chain may be classified to obtain a plurality of log chain sets, wherein each log chain set includes at least one log chain.

[0114] In the embodiment of the present invention, the classifying of the log chains to obtain at least one log chain set includes:

[0115] Each of the log chains is classified according to the time interval to obtain a set of log chains corresponding to multiple time intervals.

[0116] Specifically, when classifying each log chain, you can classify it according to the time interval, that is, any log chain can be classified into the corresponding log chain set according to the time interval to which the timestamp corresponding to the log chain belongs. For example, the log chain with a timestamp of 12:00 to 12:59 is classified into log chain set 1, and the log chain with a timestamp of 13:00 to 13:59 is classified into log chain set 2.

[0117] It should be noted that, in addition to classification based on time intervals, other classification methods may also be used. In practical applications, the specific classification method may be set according to actual needs, and the embodiments of the present invention do not limit this.

[0118] Step 105: Generate accumulator entries based on each of the log chain sets.

[0119] After obtaining each log chain set, the accumulator entry (AE) can be generated according to each log chain set, that is, all log data corresponds to an accumulator entry. Among them, the accumulator entry is a key part of the past log proof generation process, which is used to store and verify the fingerprint information of all log data within a certain period of time, and to ensure the integrity and immutability of the log data.

[0120] In the embodiment of the present invention, the generating of accumulator entries based on each of the log chain sets includes:

[0121] Using a fingerprint algorithm to generate a fingerprint corresponding to each log chain set;

[0122] Calculate the hash value of each fingerprint;

[0123] Store each hash value into a Bloom filter to generate an accumulator entry.

[0124] Specifically, for any log chain set, the Rabin fingerprint algorithm can be used to calculate the unique fingerprint (FP) of the log chain set. Specifically, the following formula can be used:

[0125] FP=Finger Print(LC1||CL2||...||LC L )

[0126] Among them, LC1~LC L For each log chain in the log chain collection.

[0127] Then, a hash function is used to calculate the hash value of each fingerprint, and the hash value of each fingerprint is stored in a Bloom filter. The Bloom filter uses the hash value of each fingerprint to generate a corresponding accumulator entry.

[0128] The hash value of each fingerprint can be stored in the Bloom filter in the following way:

[0129] v1=hash1(FP), v2=hash2(FP),...,v n =hash n (FP)

[0130] In the Bloom filter, V1~V n1, the rest are 0, V1~V n Together they form AE.

[0131] It should be noted that, in addition to Rabin, other fingerprint algorithms may also be used. In practical applications, the specific fingerprint algorithm may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0132] Step 106: Generate a proof of the past log based on the accumulator entry, and publish the proof of the past log to a public platform.

[0133] After the accumulator entry is generated, the proof of past log (PPL) of the log data can be generated using the accumulator entry, and the proof of past log is published to the public platform for verifiers to download and verify. The proof of past log is used to provide integrity proof for past log data, so that the verifier can verify its authenticity after the log is generated.

[0134] In an embodiment of the present invention, the generating of the proof of the past log based on the accumulator entry includes:

[0135] Obtain the timestamp corresponding to each log chain set and the digital signature of the cloud service provider of the log data;

[0136] A proof of a past log is generated using the accumulator entries, each of the timestamps, and the digital signature.

[0137] Specifically, when generating proof of past logs, we can first obtain the timestamps corresponding to each log chain set and the digital signature of the cloud service provider that generated the log data. Then, we use the accumulator entry, timestamp, and digital signature to generate proof of past logs. Specifically, we can use the following formula:

[0138] PPL= <AE,TE,Sig CSP (AE, TE)>

[0139] Among them, AE is the accumulator entry, TE is the timestamp, Sig CSP Sign data for cloud service providers.

[0140] In an embodiment of the present invention, when log data is obtained, an encrypted log entry is generated based on the log data, and the encrypted log entry is stored in a log database; at least one historical encrypted log entry to be processed is obtained from the log database; at least one log chain is generated based on each of the historical encrypted log entries; each of the log chains is classified to obtain at least one log chain set; an accumulator entry is generated based on each of the log chain sets; a proof of past logs is generated based on the accumulator entry, and the proof of past logs is published to a public platform. In this way, log data can be collected and parsed from a cloud service provider, encrypted using a public key and combined with a log chain, and stored in the cloud. Compared with traditional methods, this method provides strong security and transparency that traditional methods lack through a multi-level security mechanism, ensuring the integrity, confidentiality and traceability of log data.

[0141] Furthermore, by efficiently generating accumulator entries through technologies such as fingerprint algorithms and Bloom filters, a large amount of log data can be quickly verified, providing real-time and efficiency that traditional solutions lack, and ensuring the immutability of logs.

[0142] Reference Figure 3 , shows a flow chart of the steps of a second embodiment of a method for processing cloud logs of the present invention, which may specifically include the following steps:

[0143] Step 301: When log data is obtained, an encrypted log entry is generated based on the log data, and the encrypted log entry is stored in a log database.

[0144] In actual applications, users may visit multiple cloud service providers, and multiple cloud service providers will generate corresponding log data, so the terminal device can obtain log data from multiple cloud service providers. Of course, if the user has only visited one cloud service provider, then it is sufficient to obtain log data from this one cloud service provider.

[0145] It should be noted that when a user has visited multiple cloud service providers, the user can also obtain log data from a specified cloud service provider. In actual applications, the number of cloud service providers and whether a specified cloud service provider is needed can be adjusted according to actual needs, and the embodiments of the present invention do not limit this.

[0146] In an embodiment of the present invention, generating an encrypted log entry based on the log data includes:

[0147] Parsing the log data to obtain target information in the log data;

[0148] Storing the target information in a cache;

[0149] The target information in the cache is encrypted using a public key to obtain an encrypted log entry.

[0150] Specifically, after obtaining the log data, the log data can be parsed to obtain the target information in the log data, wherein the target information may include a timestamp, an IP address, etc. Of course, in addition to the above information, the target information may also include other information. In practical applications, the specific content of the target information may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0151] Then, the target information can be stored in a preset cache, and the target information in the cache can be encrypted using the user's public key to obtain an encrypted log entry (ELE), so that the confidentiality of the data can be ensured.

[0152] It should be noted that in addition to encrypting the target information, the complete log data can also be encrypted. Encrypting the target information takes less time, and encrypting the complete log data is more complete. In actual applications, the encrypted data content can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0153] After the encrypted log entry is generated, it can be stored in a preset log database. The log database can be deployed in the cloud or locally. In actual applications, the deployment method of the log database can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0154] Step 302: Obtain at least one historical encrypted log entry to be processed from a log database.

[0155] After the encrypted log entry is stored in the log database, at least one encrypted log entry to be processed (referred to as a “historical encrypted log entry” for ease of description) can be obtained from the log database. That is, the encrypted log entry to be processed may include the encrypted log entry generated in step 301 .

[0156] It should be noted that if no log data is obtained, or no new log data is obtained, step 301 may not be performed, and step 302 may be directly performed.

[0157] Step 303: Generate at least one log chain based on each of the historical encrypted log entries.

[0158] After obtaining each historical encrypted log entry, multiple log chains (LCs) can be generated using each historical encrypted log entry, where a log chain is a small piece of information that coexists with the corresponding log data, used to maintain the order and integrity of the log data and prevent any tampering of the log data, including but not limited to addition, modification, deletion, and reordering. When the log data needs to be verified, the encrypted log entry can be obtained from the log chain, and its hash value can be calculated after decryption to verify its integrity.

[0159] In the embodiment of the present invention, generating at least one log chain based on each of the historical encrypted log entries includes:

[0160] Calculating a hash value of each of the historical encrypted log entries;

[0161] The hash values ​​of any two adjacent historical encrypted log entries are combined into a log chain to obtain at least one log chain.

[0162] Specifically, for any historical encrypted log entry, its hash value can be calculated to obtain the hash value of each historical encrypted log entry, and then the hash values ​​of any two adjacent historical encrypted log entries are combined to generate a log chain to obtain the hash values ​​of all historical encrypted log entries.

[0163] It should be noted that the order of historical encrypted log entries can be arranged based on the generation time of the log data, or based on other methods. In actual applications, the arrangement of historical encrypted log entries can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0164] Step 304: classify each of the log chains to obtain at least one log chain set.

[0165] After obtaining a plurality of log chains, each log chain may be classified to obtain a plurality of log chain sets, wherein each log chain set includes at least one log chain.

[0166] In the embodiment of the present invention, the classifying of the log chains to obtain at least one log chain set includes:

[0167] Each of the log chains is classified according to the time interval to obtain a set of log chains corresponding to multiple time intervals.

[0168] Specifically, when classifying each log chain, the classification can be performed according to the time interval. That is, the log chain can be classified into the corresponding log chain set according to which time interval the timestamp corresponding to any log chain belongs.

[0169] It should be noted that, in addition to classification based on time intervals, other classification methods may also be used. In practical applications, the specific classification method may be set according to actual needs, and the embodiments of the present invention do not limit this.

[0170] Step 305: Generate accumulator entries based on each of the log chain sets.

[0171] After obtaining each log chain set, the accumulator entry (AE) can be generated according to each log chain set, that is, all log data corresponds to an accumulator entry. Among them, the accumulator entry is a key part of the past log proof generation process, which is used to store and verify the fingerprint information of all log data within a certain period of time, and to ensure the integrity and immutability of the log data.

[0172] In the embodiment of the present invention, the generating of accumulator entries based on each of the log chain sets includes:

[0173] Using a fingerprint algorithm to generate a fingerprint corresponding to each log chain set;

[0174] Calculate the hash value of each fingerprint;

[0175] Store each hash value into a Bloom filter to generate an accumulator entry.

[0176] Specifically, for any log chain set, the Rabin fingerprint algorithm can be used to calculate the unique fingerprint (FP) of the log chain set. Specifically, the following formula can be used:

[0177] FP=Finger Print(LC1||LC2||...||LC L )

[0178] Among them, LC1~LC L For each log chain in the log chain collection.

[0179] Then, a hash function is used to calculate the hash value of each fingerprint, and the hash value of each fingerprint is stored in a Bloom filter. The Bloom filter uses the hash value of each fingerprint to generate a corresponding accumulator entry.

[0180] The hash value of each fingerprint can be stored in the Bloom filter in the following way:

[0181] v1=hash1(FP), v2=hash2(FP),...,v n =hash n (FP)

[0182] In the Bloom filter, V1~V n1, the rest are 0, V1~V n Together they form AE.

[0183] It should be noted that, in addition to Rabin, other fingerprint algorithms may also be used. In practical applications, the specific fingerprint algorithm may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0184] Step 306: Generate a proof of the past log based on the accumulator entry, and publish the proof of the past log to a public platform.

[0185] After the accumulator entry is generated, the proof of past log (PPL) of the log data can be generated using the accumulator entry, and the proof of past log is published to the public platform for verifiers to download and verify. The proof of past log is used to provide integrity proof for past log data, so that the verifier can verify its authenticity after the log is generated.

[0186] In an embodiment of the present invention, the generating of the proof of the past log based on the accumulator entry includes:

[0187] Obtain the timestamp corresponding to each log chain set and the digital signature of the cloud service provider of the log data;

[0188] A proof of a past log is generated using the accumulator entries, each of the timestamps, and the digital signature.

[0189] Specifically, when generating proof of past logs, we can first obtain the timestamps corresponding to each log chain set and the digital signature of the cloud service provider that generated the log data. Then, we use the accumulator entry, timestamp, and digital signature to generate proof of past logs. Specifically, we can use the following formula:

[0190] PPL= <AE,TE,Sig CSP (AE, TE)>

[0191] Among them, AE is the accumulator entry, TE is the timestamp, Sig CSP Sign data for cloud service providers.

[0192] Step 307: In response to the verification instruction for the log data, verify the log data and audit the verification.

[0193] In actual applications, users can initiate verification instructions for log data in terminal devices. In response to the instructions, the terminal device can verify the log data to determine whether the log data generated by the cloud service provider (that is, the log data in the cloud) has been tampered with. At the same time, during the verification process, the entire verification process can be audited. The audit items include but are not limited to the collection, encryption, and storage steps of log data, as well as capturing delays and abnormal behaviors in log data processing.

[0194] It should be noted that, in addition to the above-mentioned items, the audit items may also include other items. In practical applications, the specific audit items may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0195] Among them, verification can be performed using the user's private key or using proof of past logs.

[0196] In the embodiment of the present invention, the verifying the log data includes:

[0197] Obtain at least one private key shard from a cloud service provider;

[0198] Reconstructing each of the private key fragments using a secret sharing algorithm to obtain a private key;

[0199] Decrypting the historical encrypted log entries using the private key to obtain target information;

[0200] Detecting whether the target information is the same as the target information recorded by the cloud service provider;

[0201] If they are the same, the log data has not been tampered with; if they are not the same, the log data has been tampered with.

[0202] Specifically, after obtaining the verification instruction, at least one private key shard can be obtained from at least two cloud service providers. After obtaining all private key shards, a secret sharing algorithm can be used to reconstruct all private keys to obtain a private key for decryption. Then, the private key is used to decrypt the historical encrypted log entries to obtain the target information. Then, the target information is checked to see if it is the same as the target information on the cloud recorded by the cloud service provider. If they are the same, it means that the log data on the cloud has not been tampered with. If they are not the same, it means that the log data on the cloud has been tampered with.

[0203] It should be noted that before verification, a secret sharing algorithm can be used to split the user's private key into multiple shards, and then each shard is dispersedly stored in at least two cloud service providers to ensure the security of the private key.

[0204] Furthermore, the embodiment of the present invention can use asymmetric keys for encryption and decryption, that is, when generating encrypted log entries, the user's public key can be used for encryption, and when decrypting, the user's private key can be used for decryption. Of course, symmetric keys can also be used for encryption and decryption. In practical applications, the type of key can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0205] In the embodiment of the present invention, the verifying the log data further includes:

[0206] Obtaining a certificate of the past log from the public platform;

[0207] The log data is verified using the certification of the past log.

[0208] Specifically, in addition to using private keys to verify log data, you can also obtain proof of past logs from a public platform and use the proof of past logs to verify whether the log data in the cloud has been tampered with.

[0209] Since the proof of past logs is published on a public platform, any authorized party can use the published proof of past logs to verify the integrity of the log data and ensure that the log has not been tampered with.

[0210] Step 308, when the verification is complete, an audit report is generated.

[0211] When verification is complete, an audit report can be generated for subsequent review and examination.

[0212] In the embodiment of the present invention, log data is collected and parsed from cloud service providers, encrypted using public keys and combined with log chains, and stored in the cloud. Compared with traditional methods, this method provides strong security and transparency that traditional methods lack through a multi-level security mechanism, ensuring the integrity, confidentiality and traceability of log data.

[0213] Furthermore, by efficiently generating accumulator entries through technologies such as fingerprint algorithms and Bloom filters, a large amount of log data can be quickly verified, providing real-time and efficiency that traditional solutions lack, and ensuring the immutability of logs.

[0214] Furthermore, users are allowed to check the authenticity of logs by decrypting and checking encrypted log entries stored by CSP. Any authorized party can also use PPL to verify the integrity of logs to ensure that logs have not been tampered with. In this way, through the combination of user private key decryption and PPL with AE, log data can be verified quickly and efficiently, providing transparency and accuracy that traditional methods lack, ensuring the integrity and reliability of log data.

[0215] Furthermore, CSP and users can jointly generate a public-private key pair for log data encryption, and the private key is distributed among multiple CSPs through a secret sharing algorithm so that the key can be rebuilt when needed. In this way, the private key is stored in multiple CSPs through a secret sharing algorithm, and the key can only be rebuilt under certain conditions, providing high security and fault tolerance that traditional methods lack, ensuring the security and recoverability of the key.

[0216] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0217] Reference Figure 4 , shows a structural block diagram of an embodiment of a cloud log processing device of the present invention, which may specifically include the following modules:

[0218] A first generating module 401 is used to generate an encrypted log entry based on the log data when the log data is acquired;

[0219] A storage module 402, used to store the encrypted log entry in a log database;

[0220] The acquisition module 403 is used to acquire at least one historical encrypted log entry to be processed from the log database;

[0221] A second generating module 404, configured to generate at least one log chain based on each of the historical encrypted log entries;

[0222] A classification module 405 is used to classify each of the log chains to obtain at least one log chain set;

[0223] A third generating module 406, configured to generate accumulator entries based on each of the log chain sets;

[0224] A fourth generating module 407, for generating a proof of a past log based on the accumulator entry;

[0225] The publishing module 408 is used to publish the proof of the past log to a public platform.

[0226] In an embodiment of the present invention, it also includes:

[0227] A verification module, configured to verify the log data in response to a verification instruction for the log data;

[0228] The audit module is used to audit the verification and generate an audit report when the verification is completed.

[0229] In the embodiment of the present invention, the first generating module is specifically used to:

[0230] Parsing the log data to obtain key information in the log data;

[0231] Storing the key information in a cache;

[0232] Target information in the key information is extracted from the cache, and the target information is encrypted using a public key to obtain an encrypted log entry.

[0233] In the embodiment of the present invention, the second generating module is specifically used to:

[0234] Calculating a hash value of each of the historical encrypted log entries;

[0235] The hash values ​​of any two adjacent historical encrypted log entries are combined into a log chain to obtain at least one log chain.

[0236] In the embodiment of the present invention, the classification module is specifically used for:

[0237] Each of the log chains is classified according to the time interval to obtain a set of log chains corresponding to multiple time intervals.

[0238] In the embodiment of the present invention, the third generating module is specifically used for:

[0239] Using a fingerprint algorithm to generate a fingerprint corresponding to each log chain set;

[0240] Calculate the hash value of each fingerprint;

[0241] Store each hash value into a Bloom filter to generate an accumulator entry.

[0242] In the embodiment of the present invention, the fourth generating module is specifically used for:

[0243] Obtain the timestamp corresponding to each log chain set and the digital signature of the cloud service provider of the log data;

[0244] A proof of a past log is generated using the accumulator entries, each of the timestamps, and the digital signature.

[0245] In the embodiment of the present invention, the verification module is specifically used to:

[0246] Obtain at least one private key shard from a cloud service provider;

[0247] Reconstructing each of the private key fragments using a secret sharing algorithm to obtain a private key;

[0248] Decrypting the historical encrypted log entries using the private key to obtain target information;

[0249] Detecting whether the target information is the same as the target information recorded by the cloud service provider;

[0250] If they are the same, the log data has not been tampered with; if they are not the same, the log data has been tampered with.

[0251] In the embodiment of the present invention, the verification module is further used for:

[0252] Obtaining a certificate of the past log from the public platform;

[0253] The log data is verified using the certification of the past log.

[0254] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0255] An embodiment of the present invention further provides an electronic device, including:

[0256] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, each process of the above-mentioned cloud log processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0257] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned cloud log processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0258] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0259] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0260] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0261] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0262] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0263] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0264] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0265] A cloud log processing method and a cloud log processing device provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for processing cloud logs, characterized in that: The method comprises: When the log data is acquired, an encrypted log entry is generated based on the log data, and the encrypted log entry is stored in a log database; Obtain at least one historical encrypted log entry to be processed from a log database; generating at least one log chain based on each of the historical encrypted log entries; Classifying each of the log chains to obtain at least one log chain set; generating an accumulator entry based on each of the log chain sets; A proof of a past log is generated based on the accumulator entry, and the proof of the past log is published to a public platform.

2. The cloud log processing method according to claim 1, characterized in that: Also includes: In response to a verification instruction for the log data, verify the log data and audit the verification; When the validation is complete, an audit report is generated.

3. The cloud log processing method according to claim 1, characterized in that: The generating an encrypted log entry based on the log data comprises: Parsing the log data to obtain key information in the log data; Storing the key information in a cache; The target information in the key information is extracted from the cache, and the target information is encrypted using a public key to obtain an encrypted log entry.

4. The cloud log processing method according to claim 1, characterized in that: The generating at least one log chain based on each of the historical encrypted log entries comprises: Calculating a hash value of each of the historical encrypted log entries; The hash values ​​of any two adjacent historical encrypted log entries are combined into a log chain to obtain at least one log chain.

5. The cloud log processing method according to claim 1, characterized in that: The classifying each of the log chains to obtain at least one log chain set includes: Each of the log chains is classified according to the time interval to obtain a set of log chains corresponding to multiple time intervals.

6. The cloud log processing method according to claim 1, characterized in that: The generating an accumulator entry based on each of the log chain sets comprises: Using a fingerprint algorithm to generate a fingerprint corresponding to each log chain set; Calculate the hash value of each fingerprint; Store each hash value into a Bloom filter to generate an accumulator entry.

7. The cloud log processing method according to claim 1 is characterized in that: The generating a proof of past log based on the accumulator entry comprises: Obtain the timestamp corresponding to each log chain set and the digital signature of the cloud service provider of the log data; A proof of a past log is generated using the accumulator entries, each of the timestamps, and the digital signature.

8. The cloud log processing method according to claim 2, characterized in that: The verifying the log data includes: Obtain at least one private key shard from a cloud service provider; Reconstructing each of the private key fragments using a secret sharing algorithm to obtain a private key; Decrypting the historical encrypted log entries using the private key to obtain target information; Detecting whether the target information is the same as the target information recorded by the cloud service provider; If they are the same, the log data has not been tampered with; if they are not the same, the log data has been tampered with.

9. The cloud log processing method according to claim 2, characterized in that: The verifying the log data further includes: Obtaining a certificate of the past log from the public platform; The log data is verified using the certification of the past log.

10. A cloud log processing device, characterized in that: The device comprises: A first generating module, configured to generate an encrypted log entry based on the log data when the log data is acquired; A storage module, used for storing the encrypted log entry in a log database; An acquisition module, used for acquiring at least one historical encrypted log entry to be processed from a log database; A second generating module, configured to generate at least one log chain based on each of the historical encrypted log entries; A classification module, used for classifying each of the log chains to obtain at least one log chain set; A third generating module, configured to generate accumulator entries based on each of the log chain sets; a fourth generating module for generating a proof of a past log based on the accumulator entry; A publishing module is used to publish the proof of the past log to a public platform.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the cloud log processing method as claimed in any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the cloud log processing method according to any one of claims 1 to 9 are implemented.

Images