Log data management system, method and equipment and storage medium

Abstract

The invention discloses a log data management system, method and device and a storage medium, and the system comprises a log collection module which obtains log information and transaction chain information at different moments in real time, stores the log information and the transaction chain information to a log database, and constructs a log transaction chain according to the transaction chain information; an integrity verification module extracts to-be-verified log information in a preset time period from the log database, and separately performs integrity verification on the to-be-verified log information and the log transaction chain; wherein when integrity verification fails, the log monitoring module sends early warning prompt information to a log administrator according to verification failure information; or when the integrity verification is successful, the audit module archives the to-be-verified log information to the file server and deletes the to-be-verified log information in the log database. According to the method, a systematic data protection mechanism is formed by combining the electronic signature, the Hash algorithm and the transaction chain technology, and the authenticity and reliability of the log data are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a log data management system, method, device and storage medium. Background Art

[0002] Logs are important tools for recording system events, user activities, and error messages in the system, and they play a vital role in the operation and maintenance of the system. An effective logging mechanism can record in detail the time, type, and result of an event. For some important data (accounting, transaction details, etc.), there is a high risk of operational errors and internal misconduct in the system. In addition, data audit requirements must also be met. Therefore, for the system users, developers, and business operators to track important information changes and system operations made to the system, it is necessary to continuously record them in chronological order and save them as log data to ensure the long-term integrity and non-loss of the logs.

[0003] At present, the existing technology mainly uses hash algorithms to encrypt log data in the anti-tampering mechanism of log data, which can ensure the integrity and non-dependency of log data. However, there is no way to solve the problem of logs being inserted or deleted midway. There are deficiencies in the security, real-time, compliance and traceability of log data, which may cause audit records to be easily tampered or lost, and cannot provide real-time operation tracking, and it is difficult to meet corporate audit needs and compliance requirements. Therefore, how to ensure the authenticity and reliability of log data has become a problem that needs to be solved urgently.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a log data management system, method, device and storage medium, aiming to solve the problem of how to ensure the authenticity and reliability of log data.

[0006] To achieve the above object, the present invention provides a log data management system, which includes a log collection module, an integrity verification module, and a log monitoring module or an audit module;

[0007] The log collection module is used to obtain log information and transaction chain information at different times in real time, store the log information and transaction chain information in a log database, and construct a log transaction chain according to the transaction chain information;

[0008] The integrity verification module is used to extract the log information to be verified within a preset period of time from the log database, and perform integrity verification on the log information to be verified and the log transaction chain respectively;

[0009] The log monitoring module is used to send early warning information to the log administrator according to the verification failure information when the integrity verification fails;

[0010] The audit module is used to archive the log information to be verified to the file server and delete the log information to be verified in the log database when the integrity verification is successful.

[0011] Optionally, the log collection module is further used to collect the current log data when monitoring the user operating system, and determine the current transaction node sequence number, the encrypted string and the signature string corresponding to the encrypted string corresponding to the current log data;

[0012] The log collection module is further used to determine the current transaction string according to the current log data, the encrypted string and the signature string;

[0013] The log collection module is also used to use the current log data, the encrypted string and the signature string as current log information, the current transaction node serial number, the current transaction string, the previous transaction node serial number and the previous transaction string as current transaction chain information, and store the current log information and the current transaction chain information in a log database.

[0014] Optionally, the log collection module is further used to encrypt the current log data using a hash algorithm to obtain an encrypted string;

[0015] The log collection module is further used to sign and encrypt the encrypted string using a private key to obtain a signature string;

[0016] The log collection module is further used to perform hash algorithm encryption on the current log data, the encrypted string and the signature string to obtain a current transaction string.

[0017] Optionally, the integrity verification module is further used to extract log information to be verified within a preset period of time from the log database;

[0018] The integrity verification module is further used to determine the signature string to be verified according to the log information to be verified, and perform signature authentication on the signature string to be verified through a public key;

[0019] The integrity verification module is further used to determine the log data to be verified and the encrypted string to be verified according to the log information to be verified when the signature authentication is successful;

[0020] The integrity verification module is further used to perform hash algorithm encryption on the log data to be verified, obtain an encrypted string to be processed, and compare the encrypted string to be processed with the encrypted string to be verified;

[0021] The integrity verification module is also used to determine that the log information integrity verification is successful if the comparison is consistent.

[0022] Optionally, the integrity verification module is further used to extract the transaction chain information to be verified within the preset time period from the log database, and determine the transaction node sequence number according to the transaction chain information to be verified;

[0023] The integrity check module is further used to determine whether the log transaction chain is broken according to the transaction node sequence number;

[0024] The integrity verification module is also used to determine that the log transaction chain integrity verification is successful if there is no broken chain.

[0025] Optionally, the audit module is further used to break the log transaction chain based on the transaction node sequence number after the log information to be verified is archived to the file server.

[0026] In addition, to achieve the above purpose, the present invention also proposes a log data management method, the log data management method comprising the following steps:

[0027] Acquire log information and transaction chain information at different times in real time, store the log information and transaction chain information in a log database, and construct a log transaction chain according to the transaction chain information;

[0028] Extracting the log information to be verified within a preset period of time from the log database, and performing integrity verification on the log information to be verified and the log transaction chain respectively;

[0029] Wherein, when the integrity verification fails, an early warning message is sent to the log administrator according to the verification failure information; or

[0030] When the integrity verification succeeds, the log information to be verified is archived to the file server, and the log information to be verified is deleted from the log database.

[0031] In addition, to achieve the above objectives, the present invention also proposes a log data management device, which includes: a memory, a processor, and a log data management program stored on the memory and executable on the processor, wherein the log data management program is configured to implement the steps of the log data management system described above.

[0032] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which a log data management program is stored, and when the log data management program is executed by a processor, the steps of the log data management system as described above are implemented.

[0033] The log data management system of the present invention includes a log collection module, an integrity verification module, and a log monitoring module or an audit module. First, the log collection module obtains log information and transaction chain information at different times in real time, stores the log information and transaction chain information in a log database, and constructs a log transaction chain according to the transaction chain information. Then, the integrity verification module extracts the log information to be verified within a preset period from the log database, and performs integrity verification on the log information to be verified and the log transaction chain respectively. After that, when the integrity verification fails, the log monitoring module sends an early warning prompt information to the log administrator according to the verification failure information; when the integrity verification succeeds, the audit module archives the log information to be verified to a file server, and deletes the log information to be verified in the log database. The present invention forms a set of systematic data protection mechanisms by combining electronic signatures, hash algorithms and transaction chain technologies, thereby ensuring the authenticity and reliability of log data. The present invention uses a combination of three technical means: hash encryption, electronic signature and transaction chain. A unique hash value is generated through a strong hash algorithm and an electronic signature is performed to ensure the source and authenticity of the data. The transaction chain technology is used to link each log record to provide a traceable timestamp function. This not only ensures the integrity and non-tamperability of log data during storage and transmission, but also when problems are found in the data, the system can detect in real time through a monitoring module and automatically issue an alarm, thereby improving the overall system's anti-attack capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a structural diagram of a log data management device in a hardware operating environment involved in an embodiment of the present invention;

[0035] Figure 2 This is a structural block diagram of the first embodiment of the log data management system of the present invention;

[0036] Figure 3 This is a schematic diagram of the integrity check process of the first embodiment of the log data management system of the present invention;

[0037] Figure 4 Schematic diagram of the flow of the first embodiment of the log data management method of the present invention.

[0038] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0039] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0040] Reference Figure 1 , Figure 1 The diagram is a structural diagram of a log data management device in a hardware operating environment according to an embodiment of the present invention.

[0041] like Figure 1 As shown, the Bluetooth Low Energy (BLE)-based TCP communication device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input module such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage system independent of the aforementioned processor 1001.

[0042] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the log data management device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0043] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a log data management program.

[0044] exist Figure 1 In the log data management device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the log data management device of the present invention can be set in the log data management device, and the log data management device calls the log data management program stored in the memory 1005 through the processor 1001, and executes the log data management system provided by the embodiment of the present invention.

[0045] The embodiment of the present invention provides a log data management system, referring to Figure 2 , Figure 2 This is a structural block diagram of the first embodiment of the log data management system of the present invention.

[0046] In this embodiment, the log data management system includes a log collection module 2001 , an integrity verification module 2002 , and a log monitoring module 2003 or an audit module 2004 .

[0047] The log collection module 2001 is used to obtain log information and transaction chain information at different times in real time, store the log information and transaction chain information in a log database, and construct a log transaction chain according to the transaction chain information.

[0048] It should be noted that the system needs to record all changes to the evidence data and can track all operation logs. To this end, the log information will be collected through the log collection module, where the log information also includes the evidence log, and the evidence log must record at least the following information: user identification, event type, date, time, processing result (success / failure), event trigger, affected data, system components, and resource identification information.

[0049] In the specific implementation, log information can be stored and recorded using auditTrailData.

[0050] In this embodiment, when the log collection module monitors the user operating system, it collects the current log data and determines the current transaction node serial number, encryption string and signature string corresponding to the current log data; determines the current transaction string based on the current log data, encryption string and signature string; uses the current log data, encryption string and signature string as the current log information, uses the current transaction node serial number, current transaction string, previous transaction node serial number and previous transaction string as the current transaction chain information, and stores the current log information and the current transaction chain information in the log database.

[0051] Furthermore, the log collection module encrypts the current log data using a hash algorithm to obtain an encrypted string; signs and encrypts the encrypted string using a private key to obtain a signature string; and encrypts the current log data, the encrypted string, and the signature string using a hash algorithm to obtain a current transaction string (i.e., a hash value of a fixed length).

[0052] It should be understood that electronic signatures use a private key to sign an encrypted string, which can prove the identity of the signer and ensure that the client's request is legitimate. This helps prevent forgery and impersonation. The sender cannot deny that they have sent data with a specific signature. This is very important for legal and compliance requirements because once the signature is generated, the sender will not be able to deny their actions.

[0053] The hash algorithm alone can only verify the integrity of the data, but cannot confirm the source and sender of the data. By combining with electronic signatures, data integrity, identity authentication and non-repudiation can be ensured at the same time. If only hash values ​​are used, attackers can tamper with data without being detected and recalculate hash values. Electronic signatures add another layer of security, making such tampering more difficult, because attackers must have the signer's private key to forge a legitimate signature. The combined use of hash encryption and electronic signatures can provide a higher level of information security, ensuring the integrity of data during transmission and storage and the credibility of the source.

[0054] It should also be noted that the log data at the current moment is encrypted using a hash algorithm to obtain a hash value (ie, an encrypted string) of a fixed length.

[0055] It should be understood that the hash value is fast in calculation and is suitable for fast integrity verification. When the log data is tampered with, the hash value will change, so the integrity of the data can be verified by comparing the hash value.

[0056] If log data is inserted or deleted midway, it cannot be detected. System logs are delivered through transactions, and the continuity of data needs to be technically guaranteed so that anomalies can be detected. Therefore, a third method of ensuring log integrity is used here, which is to use log transaction chains.

[0057] By connecting logs into chains, it is technically guaranteed that each log follows the previous one. In addition, if the log is to be tampered, inserted, or deleted, the subsequent log information will be appended and all hash values ​​starting from the change point must be updated, but it is actually impossible to tamper with the transaction and the continuity of the transaction. In actual applications, the serial number generated by the instance starts from 1 and gradually increases to generate the transaction chain.

[0058] Assume that according to the time information of the user's operating system, unencrypted log data A, unencrypted log data B, unencrypted log data C, etc. can be collected in sequence. Among them, unencrypted log data A, unencrypted log data A is subjected to a hash algorithm to obtain an encrypted string A+, A+ is encrypted by signature to obtain a signature string A++, and then A, A+, and A++ are encrypted by a hash algorithm to obtain a transaction string A*. If the transaction chain is empty, the transaction node sequence number is 1, and A, A+, and A++ are used as log information, and A* and 1 are used as transaction chain information, and the log information (A, A+, A++) and transaction chain information (A* and 1) are stored in the log database, and the transaction chain information (A* and 1) is stored in the node with the transaction node sequence number 1 in the log transaction chain.

[0059] Unencrypted log data B, unencrypted log data B is subjected to a hash algorithm to obtain an encrypted string B+, B+ is encrypted by a signature to obtain a signature string B++, and then B, B+, and B++ are encrypted by a hash algorithm to obtain a transaction string B*, and the transaction node sequence number is 2; B, B+, and B++ are used as log information, B*, 2, A*, and 1 are used as transaction chain information, the previous transaction node sequence number is 1 and the previous transaction string is A*, and the log information (B, B+, B++) and transaction chain information (B*, 2, A*, and 1) are stored in the log database, and the transaction chain information (B*, 2, A*, and 1) is stored in the node with transaction node sequence number 2 in the log transaction chain.

[0060] Unencrypted log data C, unencrypted log data C is subjected to hash algorithm to obtain encrypted string C+, C+ is subjected to signature encryption to obtain signature string C++; C, C+, C++ are encrypted by hash algorithm to obtain transaction string C*, and the transaction node serial number is 3; C, C+, C++ are used as log information, B* and A* are encrypted by hash algorithm to obtain the encrypted string of B* and A* (i.e., the encrypted hash value of B* and A*), the previous transaction node serial number is 2 and the previous transaction string is the encrypted string of B* and A*, the encrypted string of C*, 3, B* and A* and 2 are used as transaction chain information, and the log information (C, C+, C++) and transaction chain information (C*, 3, the encrypted string of B* and A* and 2) are stored in the log database, and the transaction chain information (C*, 3, the encrypted string of B* and A* and 2) is stored in the node with transaction node serial number 3 in the log transaction chain, etc.

[0061] The integrity verification module 2002 is used to extract the log information to be verified within a preset period of time from the log database, and perform integrity verification on the log information to be verified and the log transaction chain respectively.

[0062] It should be noted that the preset time period can be a user-defined time period.

[0063] refer to Figure 3 , Figure 3The integrity check flow diagram of the first embodiment of the log data management system of the present invention is as follows: the integrity check module extracts the log information to be verified within a preset period of time from the log database; determines the signature string to be verified based on the log information to be verified, and performs signature authentication on the signature string to be verified through the public key; when the signature authentication is successful, determines the log data to be verified and the encrypted string to be verified based on the log information to be verified; encrypts the log data to be verified by a hash algorithm to obtain the encrypted string to be processed, and compares the encrypted string to be processed with the encrypted string to be verified; if the comparison is consistent, it is determined that the integrity verification of the log information is successful. Extract the transaction chain information to be verified within a preset period of time from the log database, and determine the transaction node serial number based on the transaction chain information to be verified; determine whether the log transaction chain is broken based on the transaction node serial number; if there is no broken chain, it is determined that the integrity verification of the log transaction chain is successful.

[0064] In the specific implementation, the public key saved on the server side is used to verify the signature string to be verified. If the signature verification fails, the module will record the error message "Log electronic signature failed". After the log monitoring module detects the keyword "Log electronic signature failed", it will automatically send an email notification to the relevant person in charge to ensure timely response and processing, and terminate subsequent inspections; if the electronic signature verification is successful, the next step of log content tampering inspection (i.e. verification of the encrypted string to be verified) will be carried out.

[0065] It should be noted that since the encrypted strings to be verified corresponding to the log data to be verified are pre-stored in the log database, it is necessary to encrypt the log data to be verified using a hash algorithm to obtain the encrypted string to be processed, and compare the encrypted string to be processed with the encrypted string to be verified. If the hash values ​​are inconsistent, it is marked as "the log has been tampered with". After the log monitoring module detects the keyword "the log has been tampered with", it records the information and automatically sends an email notification to the relevant person in charge; if the hash values ​​are consistent, the log transaction chain verification continues.

[0066] The transaction chain information to be verified within a preset period of time can be extracted from the log database, and the transaction node serial number can be determined based on the transaction chain information to be verified, and the transaction node serial numbers of the previous node and the next node in the transaction chain can be checked; if there is no broken chain, it is determined that the log transaction chain integrity verification is successful; if the serial number is not continuous, it means that the log sequence has changed, and it is marked as "the transaction chain is detected to be tampered with". After the log monitoring module detects the keyword "the transaction chain is detected to be tampered with", it records the information and automatically sends an email notification to the relevant person in charge.

[0067] The log monitoring module 2003 is used to send early warning information to the log administrator according to the verification failure information when the integrity verification fails;

[0068] The audit module 2004 is used to archive the log information to be verified to the file server and delete the log information to be verified from the log database when the integrity verification is successful.

[0069] It should also be noted that the verification failure information can be understood as the information that the integrity verification module has failed to verify, the early warning prompt information can be understood as the identification given by the integrity verification module, and the keywords of the log monitoring module can be set in advance. The keywords can be set to "log electronic signature failure", "detection that the transaction chain has been tampered with", etc.

[0070] The log monitoring module improves timeliness and automation, reduces the need for manual intervention, enhances system stability, and can customize monitoring rules according to specific needs. The module uses keyword monitoring technology, event-driven architecture, email notification system and log analysis tools to achieve efficient anomaly monitoring and processing.

[0071] In the specific implementation, after the audit module archives the to-be-verified log information to the file server, the auditor can view the verified log file and perform a disconnection process on the log transaction chain based on the transaction node sequence number (for example, if the transaction node sequence number is 1-11 in total, and the transaction node sequence number corresponding to the to-be-verified log information is 1-11, then after the to-be-verified log information is deleted, the nodes 1-11 in the log transaction chain are deleted, and the transaction node sequence number corresponding to the subsequent new log information collected restarts to 1), that is, after the to-be-verified log information is archived to the file server, after the to-be-verified log information is deleted from the log database, the transaction node in the transaction chain corresponding to the to-be-verified log information in its log transaction chain is also deleted accordingly. Regularly archiving and cleaning up log data in the database can reduce the burden on the database and improve overall system performance and processing efficiency.

[0072] The log data management system of this embodiment includes a log collection module, an integrity verification module, and a log monitoring module or an audit module. First, the log collection module obtains log information and transaction chain information at different times in real time, stores the log information and transaction chain information in a log database, and constructs a log transaction chain according to the transaction chain information. Then, the integrity verification module extracts the log information to be verified within a preset period from the log database, and performs integrity verification on the log information to be verified and the log transaction chain respectively. After that, when the integrity verification fails, the log monitoring module sends an early warning prompt message to the log administrator according to the verification failure information; when the integrity verification succeeds, the audit module archives the log information to be verified to a file server, and deletes the log information to be verified from the log database. The present invention forms a systematic data protection mechanism by combining electronic signatures, hash algorithms and transaction chain technologies to ensure the authenticity and reliability of log data. This embodiment uses a combination of three technical means: hash encryption, electronic signature, and transaction chain. A unique hash value is generated through a strong hash algorithm and an electronic signature is performed to ensure the source and authenticity of the data. The transaction chain technology is used to link each log record to provide a traceable timestamp function. This not only ensures the integrity and non-tamperability of log data during storage and transmission, but also when problems are found in the data, the system can detect them in real time through the monitoring module and automatically issue an alarm, thereby improving the overall system's ability to resist attacks.

[0073] Reference Figure 4 , Figure 4 Schematic diagram of the flow of the first embodiment of the log data management method of the present invention.

[0074] like Figure 4 As shown, the log data management method proposed in the embodiment of the present invention includes the following steps:

[0075] Step S10: acquiring log information and transaction chain information at different times in real time, storing the log information and the transaction chain information in a log database, and constructing a log transaction chain according to the transaction chain information;

[0076] Step S20: extracting the log information to be verified within a preset period from the log database, and performing integrity verification on the log information to be verified and the log transaction chain respectively;

[0077] Wherein, the log data management method further includes:

[0078] Step S30: When the integrity verification fails, sending a warning message to the log administrator according to the verification failure information; or

[0079] Step S40: When the integrity verification succeeds, the log information to be verified is archived to the file server, and the log information to be verified is deleted from the log database.

[0080] Other embodiments or specific implementations of the log data management method of the present invention can refer to the above-mentioned system embodiments and will not be described in detail here.

[0081] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0082] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0083] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0084] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A log data management system, characterized in that: The log data management system includes a log collection module, an integrity verification module, and a log monitoring module or an audit module; The log collection module is used to obtain log information and transaction chain information at different times in real time, store the log information and transaction chain information in a log database, and construct a log transaction chain according to the transaction chain information; The integrity verification module is used to extract the log information to be verified within a preset period of time from the log database, and perform integrity verification on the log information to be verified and the log transaction chain respectively; The log monitoring module is used to send early warning information to the log administrator according to the verification failure information when the integrity verification fails; The audit module is used to archive the log information to be verified to the file server and delete the log information to be verified in the log database when the integrity verification is successful.

2. The system according to claim 1, characterized in that The log collection module is further used to collect the current log data when monitoring the user operating system, and determine the current transaction node sequence number, the encrypted string and the signature string corresponding to the encrypted string corresponding to the current log data; The log collection module is further used to determine the current transaction string according to the current log data, the encrypted string and the signature string; The log collection module is also used to use the current log data, the encrypted string and the signature string as current log information, the current transaction node serial number, the current transaction string, the previous transaction node serial number and the previous transaction string as current transaction chain information, and store the current log information and the current transaction chain information in a log database.

3. The system according to claim 2, characterized in that The log collection module is further used to encrypt the current log data using a hash algorithm to obtain an encrypted string; The log collection module is further used to sign and encrypt the encrypted string using a private key to obtain a signature string; The log collection module is further used to perform hash algorithm encryption on the current log data, the encrypted string and the signature string to obtain a current transaction string.

4. The system according to any one of claims 1 to 3, characterized in that: The integrity verification module is further used to extract log information to be verified within a preset period of time from the log database; The integrity verification module is further used to determine the signature string to be verified according to the log information to be verified, and perform signature authentication on the signature string to be verified through a public key; The integrity verification module is further used to determine the log data to be verified and the encrypted string to be verified according to the log information to be verified when the signature authentication is successful; The integrity verification module is further used to perform hash algorithm encryption on the log data to be verified, obtain an encrypted string to be processed, and compare the encrypted string to be processed with the encrypted string to be verified; The integrity verification module is also used to determine that the log information integrity verification is successful if the comparison is consistent.

5. The system according to claim 4, characterized in that The integrity verification module is further used to extract the transaction chain information to be verified within the preset time period from the log database, and determine the transaction node sequence number according to the transaction chain information to be verified; The integrity check module is further used to determine whether the log transaction chain is broken according to the transaction node sequence number; The integrity verification module is also used to determine that the log transaction chain integrity verification is successful if there is no broken chain.

6. The system according to claim 5, characterized in that The audit module is further used to break the log transaction chain based on the transaction node sequence number after the log information to be verified is archived to the file server.

7. A log data management method, characterized in that: The log data management method comprises the following steps: Acquire log information and transaction chain information at different times in real time, store the log information and transaction chain information in a log database, and construct a log transaction chain according to the transaction chain information; Extracting the log information to be verified within a preset period of time from the log database, and performing integrity verification on the log information to be verified and the log transaction chain respectively; Wherein, when the integrity verification fails, an early warning message is sent to the log administrator according to the verification failure information; or When the integrity verification succeeds, the log information to be verified is archived to the file server, and the log information to be verified is deleted from the log database.

8. A log data management device, characterized in that: The device comprises: a memory, a processor, and a log data management program stored in the memory and executable on the processor, wherein the log data management program is configured to implement the steps of the log data management system according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium stores a log data management program, and when the log data management program is executed by the processor, the steps of the log data management system according to any one of claims 1 to 6 are implemented.

Images