Audit tracking system and method based on encryption key
By using an audit trail system based on encryption keys, a unique audit identifier is generated and associated with the encryption key, which solves the problem of insufficient tracking in the encryption process of traditional data auditing. This achieves data security and efficient auditing throughout the entire lifecycle and is suitable for high-confidentiality scenarios.
Patent Information
- Application Number
- CN202510917106.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-03
- Publication Date
- 2025-11-04
AI Technical Summary
Existing data auditing methods lack the ability to trace the encryption process, making it impossible to effectively monitor and record the generation and use of encryption keys, which increases data security risks. At the same time, it is difficult to achieve comprehensive auditing while protecting data privacy, especially in high-confidentiality scenarios where effective data auditing is not possible.
An audit trail system based on encryption keys is adopted, including an encryption module, a key management module, an access control module, and an audit analysis module. It generates a unique audit identifier and associates it with the encryption key, which runs through the data storage, transmission, and access links, records operation information, and performs visual analysis to achieve auditing of encrypted data.
It achieves full lifecycle data security protection, precise and efficient auditing and tracking, and avoids the risk of privacy leakage caused by data decryption. It is suitable for scenarios with high privacy requirements, such as healthcare and finance.
Smart Images
Figure CN120893059A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security technology, specifically to an audit trail system and method based on encryption keys. Background Technology
[0002] As a core asset of enterprises and organizations, the security and auditability of data are of paramount importance. With the rapid development of information technology, the volume of data is exploding and frequently flows and interacts between different systems, platforms, and users. However, current data security and auditing systems face numerous challenges and struggle to meet the ever-increasing security demands.
[0003] Traditional data auditing methods have limitations. Firstly, they lack tracking of the encryption process. Most existing methods focus on recording data access and operation logs, such as user queries, insertions, and deletions in the database. However, their ability to track information related to the encryption phase is weak. During data encryption, traditional auditing methods often fail to effectively monitor and record details such as the generation and use of encryption keys and the specifics of encryption operations. This creates security risks during the encryption phase, making it difficult to trace the source and process of encryption operations. Secondly, relying on data decryption for auditing typically requires decrypting the data before auditing. This decryption-dependent approach has significant drawbacks. Firstly, it increases the risk of data leakage, as data may be illegally obtained or tampered with during decryption. Secondly, in scenarios with extremely high data confidentiality requirements, such as sensitive customer information in financial institutions or confidential government documents, easy decryption is not permitted, making effective auditing impossible.
[0004] Security risks exist during data flow. Various security threats, such as cyberattacks, malware intrusions, and data tampering, exist during data storage, transmission, and processing. Existing data security mechanisms often have vulnerabilities in addressing these complex security risks and cannot fully guarantee data security and integrity. Furthermore, due to the numerous stages in data flow, it is difficult to effectively audit and trace the entire data lifecycle. Once a security issue occurs, it is difficult to accurately pinpoint the root cause and the scope of its impact.
[0005] There is a conflict between data privacy protection and auditing. Data auditing requires acquiring data for analysis and judgment to ensure compliant use and security. However, this conflicts with data privacy requirements. For example, if the auditing process for user personal data is not strictly controlled, it could lead to the leakage of user privacy information.
[0006] Achieving comprehensive data auditing while protecting data privacy, and balancing the relationship between data privacy protection and auditing, is a technical problem that needs to be solved. Summary of the Invention
[0007] The technical objective of this invention is to address the above-mentioned shortcomings by providing an audit trail system and method based on encryption keys, thereby solving the technical problem of achieving comprehensive auditing of data while protecting data privacy, and balancing the relationship between data privacy protection and auditing.
[0008] In a first aspect, the present invention provides an audit tracing system based on encryption keys, comprising an encryption module, a key management module, an access control module, an audit log recording module, and an audit analysis module;
[0009] The encryption module is used to generate encryption keys and audit identifiers, check and verify user-input data, encrypt the data that has passed the check and verification based on the encryption key to obtain encrypted data, send the encrypted data, encryption key, audit identifier and data identifier of the encrypted data to the key management module for storage, and receive confirmation information returned by the key management module.
[0010] The key management module is used to store and manage encrypted data, encryption keys, and audit identifiers, and to provide query services for encryption keys and audit identifiers.
[0011] The access control module is used to receive data access requests submitted by users, authenticate users based on user identity information in the data access request, query user access permissions, obtain encryption keys and audit identifiers related to the encrypted data specified in the data access request from the key management module for users with access permissions, decrypt the encrypted data specified in the data access request based on the encryption keys, support users to operate on the decrypted data according to their access permissions, record the user's operation process on the data and form operation information, send the user identity information, operation information and audit identifier as audit log information to the audit log recording module for storage, and receive confirmation information returned by the audit log recording module.
[0012] The audit analysis module is used to send query requests to the audit log recording module based on the query conditions input by the user, analyze and process the search results returned by the audit log recording module, and display the analysis results in a visual manner.
[0013] Preferably, the encryption module is used to perform the following operations:
[0014] It can receive various types of data input from users, including text files, database records, and image files;
[0015] The system checks and validates user-input data, including data format checks and data integrity checks. If the data does not meet the requirements, it returns an error message to the user.
[0016] An encryption key is generated according to a preset encryption algorithm, and a unique audit identifier is generated according to the audit identifier generation rules. The audit identifier is a string generated based on the encryptor's identity information, encryption timestamp, unique identifier of encryption device, and random number.
[0017] The verified data is encrypted using the encryption key to obtain encrypted data.
[0018] Send the encrypted data, encryption key, and audit identifier to the key management module;
[0019] Receive confirmation information returned by the key management module.
[0020] Preferably, the access control module is used to perform the following operations:
[0021] Receive data access requests submitted by users. The data access requests specify the data identifier of the data to be accessed. The data identifier includes the file name and the database table name.
[0022] Based on the user's identity information in the data access request, the user is authenticated. The authentication methods include username and password verification and biometric identification. If the authentication fails, an access denial message is returned to the user.
[0023] After authentication, based on the user's identity information in the data access request, the permission management database is called to query the permission information and determine whether the user has access rights to the data specified in the data access request. If the user does not have access rights, access denial information is returned to the user.
[0024] For users with access rights, the encryption key and audit identifier associated with the encrypted data specified in the data access request are obtained from the key management module.
[0025] The encrypted data specified in the data access request is decrypted based on the encryption key, and users can perform operations on the decrypted data according to their access permissions, including querying, modifying and deleting. The operation process of the user on the data is recorded and operation information is formed, including operation type, operation time and operation result.
[0026] The user's identity information, operation information, and audit identifier are sent to the audit log recording module. Correspondingly, the audit log recording module stores the user's identity information, operation information, and audit identifier in the audit log database according to a predetermined format and returns confirmation information to the access control module.
[0027] Preferably, the audit analysis module is used to perform the following operations:
[0028] Provide a user interface to receive user-input query conditions, including audit identifier, time range, and user identity;
[0029] The system sends a query request to the audit log recording module based on the query conditions entered by the user; correspondingly, the audit log recording module retrieves relevant audit log information from the audit log database based on the query request and returns the retrieval results to the audit analysis module.
[0030] The retrieved audit log information is analyzed and processed to obtain analysis results. During the analysis and processing, the audit log information is mined and the existing security problems and abnormal behaviors are found based on the preset data analysis methods. The data analysis methods include anomaly detection algorithms and trend analysis algorithms.
[0031] The analysis results are presented in a visual manner, including generating bar charts to show the number of operations by different users and line charts to show the changing trend of data access frequency.
[0032] Secondly, the present invention provides an audit tracing method based on an encryption key, which implements audit tracing based on an audit tracing system based on an encryption key as described in any of the first aspects, comprising the following steps:
[0033] Data encryption: The user input data is checked and verified. The data that passes the check and verification is encrypted based on the encryption key to obtain encrypted data. The encrypted data, encryption key, audit identifier and data identifier of the encrypted data are sent to the key management module for storage. The encryption key and audit identifier are generated by the encryption module.
[0034] Key Management: The key management module stores and manages encrypted data, encryption keys, and audit identifiers, and provides query services for encryption keys and audit identifiers.
[0035] Access Control: The access control module receives data access requests submitted by users, authenticates users based on the user identity information in the data access request, and queries the user's access permissions. For users with access permissions, it obtains the encryption key and audit identifier related to the encrypted data specified in the data access request from the key management module, decrypts the encrypted data specified in the data access request based on the encryption key, supports users to operate on the decrypted data according to their access permissions, records the user's operation process and forms operation information, and sends the user identity information, operation information and audit identifier as audit log information to the audit log recording module for storage.
[0036] Audit Analysis: The audit analysis module accepts user-input query conditions, sends query requests to the audit log recording module based on the user-input query conditions, analyzes and processes the search results returned by the audit log recording module, and displays the analysis results in a visual manner.
[0037] As a preferred method, data encryption includes the following operations:
[0038] It can receive various types of data input from users, including text files, database records, and image files;
[0039] The system checks and validates user-input data, including data format checks and data integrity checks. If the data does not meet the requirements, it returns an error message to the user.
[0040] An encryption key is generated according to a preset encryption algorithm, and a unique audit identifier is generated according to the audit identifier generation rules. The audit identifier is a string generated based on the encryptor's identity information, encryption timestamp, unique identifier of encryption device, and random number.
[0041] The verified data is encrypted using the encryption key to obtain encrypted data.
[0042] Send the encrypted data, encryption key, and audit identifier to the key management module;
[0043] Receive confirmation information returned by the key management module.
[0044] Preferably, access control includes the following operations:
[0045] Receive data access requests submitted by users. The data access requests specify the data identifier of the data to be accessed. The data identifier includes the file name and the database table name.
[0046] Based on the user's identity information in the data access request, the user is authenticated. The authentication methods include username and password verification and biometric identification. If the authentication fails, an access denial message is returned to the user.
[0047] After authentication, based on the user's identity information in the data access request, the permission management database is called to query the permission information and determine whether the user has access rights to the data specified in the data access request. If the user does not have access rights, access denial information is returned to the user.
[0048] For users with access rights, the encryption key and audit identifier associated with the encrypted data specified in the data access request are obtained from the key management module.
[0049] The encrypted data specified in the data access request is decrypted based on the encryption key, and users can perform operations on the decrypted data according to their access permissions, including querying, modifying and deleting. The operation process of the user on the data is recorded and operation information is formed, including operation type, operation time and operation result.
[0050] The user's identity information, operation information, and audit identifier are sent to the audit log recording module. Correspondingly, the audit log recording module stores the user's identity information, operation information, and audit identifier in the audit log database according to a predetermined format and returns confirmation information to the access control module.
[0051] As a preferred approach, audit analysis includes the following operations:
[0052] The audit analysis module provides a user interface to receive user-input query conditions, including audit identifier, time range, and user identity.
[0053] The system sends a query request to the audit log recording module based on the query conditions entered by the user; correspondingly, the audit log recording module retrieves relevant audit log information from the audit log database based on the query request and returns the retrieval results to the audit analysis module.
[0054] The retrieved audit log information is analyzed and processed to obtain analysis results. During the analysis and processing, the audit log information is mined and the existing security problems and abnormal behaviors are found based on the preset data analysis methods. The data analysis methods include anomaly detection algorithms and trend analysis algorithms.
[0055] The analysis results are presented in a visual manner, including generating bar charts to show the number of operations by different users and line charts to show the changing trend of data access frequency.
[0056] The audit trail system and method based on encryption keys of the present invention have the following advantages:
[0057] 1. Full lifecycle security protection: A unique audit identifier is generated and associated with a key during encryption, which is maintained throughout the data storage, transmission, and access stages to prevent data from being illegally obtained and maliciously manipulated at each stage, thus providing comprehensive data security.
[0058] 2. Precise and efficient audit tracking: Based on the association between keys and audit identifiers, auditors can trace the source of data encryption and the details of each operation, quickly locate security issues and violations, and improve audit efficiency and accuracy by combining algorithms and visualization analysis;
[0059] 3. Balancing privacy and auditing needs: Auditing can be conducted without decrypting data, avoiding the privacy leakage risks associated with traditional auditing decryption. Effective auditing is achieved while protecting data privacy, making it suitable for scenarios with high privacy requirements, such as healthcare and finance. Attached Figure Description
[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0061] The invention will be further described below with reference to the accompanying drawings.
[0062] Figure 1 This is a block diagram of an audit trail system based on encryption keys, as described in Example 1.
[0063] Figure 2 This is a flowchart of the encryption module in an audit trail system based on encryption keys, as shown in Example 1.
[0064] Figure 3 This is a flowchart of the audit log recording module in an audit trail system based on encryption keys, as shown in Example 1.
[0065] Figure 4 This is a flowchart of the audit analysis module in an audit trail system based on encryption keys, as shown in Example 1. Detailed Implementation
[0066] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.
[0067] This invention provides an audit trail system and method based on encryption keys to solve the technical problem of achieving comprehensive auditing of data while protecting data privacy, and balancing the relationship between data privacy protection and auditing.
[0068] Example 1:
[0069] The present invention provides an audit trail system based on encryption keys, comprising an encryption module, a key management module, an access control module, an audit log recording module, and an audit analysis module.
[0070] The encryption module is used to generate encryption keys and audit identifiers, check and verify user-input data, encrypt the data that has passed the check and verification based on the encryption key to obtain encrypted data, send the encrypted data, encryption key, audit identifier and data identifier of the encrypted data to the key management module for storage, and receive confirmation information returned by the key management module.
[0071] As a specific implementation of the encryption module, this module is used to perform the following operations:
[0072] (1) Receive various types of data input by the user, including text files, database records and image files, etc.;
[0073] (2) Check and verify the data input by the user, including data format check and data integrity check. If the data does not meet the requirements, return an error message to the user.
[0074] (3) Generate an encryption key according to a preset encryption algorithm (such as AES-256) and generate a unique audit identifier according to the audit identifier generation rules. The audit identifier is a string generated based on the encryptor's identity information (obtained from the user identity authentication system), the encryption timestamp (obtained using the system clock to obtain the precise time), the unique identifier of the encryption device (obtained by reading the device hardware information), and a random number (generated using a random number generator).
[0075] (4) Encrypt the verified data using the encryption key to obtain encrypted data;
[0076] (5) Send the encrypted data, encryption key, and audit identifier to the key management module;
[0077] (6) Receive confirmation information returned by the key management module.
[0078] In this embodiment, the encryption module employs advanced encryption algorithms (such as AES and RSA) to encrypt the input data, ensuring data confidentiality during storage and transmission. This module features a unique audit identifier generation function, capable of generating a unique audit identifier based on preset complex rules. This audit identifier includes the encryptor's identity information (such as employee ID, department name, etc.), encryption time (accurate to milliseconds), encryption device information (such as device MAC address, IP address, etc.), and a randomly generated unique code. The generated audit identifier is tightly associated with the encryption key, and this association information is transmitted to the key management module for storage.
[0079] The key management module is used to store and manage encrypted data, encryption keys, and audit identifiers, and provides query services for encryption keys and audit identifiers.
[0080] In this embodiment, the key management module employs highly secure storage technologies (such as encrypted storage and redundant backup) to store encryption keys and their associated audit identifiers. It has management functions for key generation, updating, and destruction to ensure the security and validity of the keys. It provides query interfaces for keys and audit identifiers so that other modules can obtain relevant information when needed.
[0081] The access control module receives data access requests submitted by users, authenticates users based on the user identity information in the data access request, and queries the user's access permissions. For users with access permissions, it obtains the encryption key and audit identifier related to the encrypted data specified in the data access request from the key management module, decrypts the encrypted data specified in the data access request based on the encryption key, supports users to operate on the decrypted data according to their access permissions, records the user's operation process and forms operation information, sends the user identity information, operation information and audit identifier as audit log information to the audit log recording module for storage, and receives the confirmation information returned by the audit log recording module.
[0082] As a specific implementation of the access control module, this module is used to perform the following operations:
[0083] (1) Receive data access requests submitted by users. The data access requests specify the data identifier of the data to be accessed. The data identifier includes the file name and the database table name.
[0084] (2) Based on the user identity information in the data access request, verify the user's identity. The verification methods include username and password verification and biometric identification. If the verification fails, return access denied information to the user.
[0085] (3) After authentication, based on the user identity information in the data access request, call the permission management database to query the permission information and determine whether the user has access rights to the data specified in the data access request. If the user does not have access rights, return access denied information to the user.
[0086] (4) For users with access rights, obtain the encryption key and audit identifier related to the encrypted data specified in the data access request from the key management module;
[0087] (5) Decrypt the encrypted data specified in the data access request based on the encryption key, and support users to perform operations on the decrypted data according to their access permissions, including querying, modifying and deleting, record the user's operation process on the data, and form operation information, including operation type (such as SELECT query, UPDATE modification, etc.), operation time (accurate to milliseconds) and operation result (success or failure).
[0088] (6) Send user identity information, operation information and audit identifier to the audit log recording module. Correspondingly, the audit log recording module stores user identity information, operation information and audit identifier in the audit log database according to a predetermined format and returns confirmation information to the access control module.
[0089] In this embodiment, the access control module integrates multiple authentication methods (such as username and password, fingerprint recognition, multi-factor authentication, etc.) to authenticate users accessing encrypted data. Based on the user's identity and permission information (stored in the permission management database), it determines whether the user has permission to access specific data. When the user is successfully authenticated and has access rights, the encryption key corresponding to the encrypted data and its associated audit identifier are obtained from the key management module.
[0090] The audit log recording module receives user access and operation information (including user identity, access time, operation type, etc.) and audit identifiers from the access control module. It records this information in a specific format (such as JSON, XML, etc.) to the audit log database, ensuring the integrity and readability of the audit logs. Regular backups and archiving of the audit logs prevent data loss and facilitate subsequent querying and analysis.
[0091] The audit analysis module sends query requests to the audit log recording module based on the query conditions entered by the user, analyzes and processes the search results returned by the audit log recording module, and displays the analysis results in a visual manner.
[0092] As a specific implementation of the audit analysis module, this module is used to perform the following operations:
[0093] (1) Provide a user interface to receive query conditions input by the user. The query conditions include audit identifier, time range (e.g., January 1, 2024 to December 31, 2024) and user identity (e.g., specific employee number);
[0094] (2) Send a query request to the audit log recording module based on the query conditions input by the user; correspondingly, the audit log recording module is used to retrieve relevant audit log information from the audit log database based on the query request and return the retrieval results to the audit analysis module;
[0095] (3) Analyze and process the retrieved audit log information to obtain analysis results. During the analysis and processing, the audit log information is mined and the existing security problems and abnormal behaviors are found based on the preset data analysis methods. The data analysis methods include anomaly detection algorithms and trend analysis algorithms.
[0096] (4) Present the analysis results in a visual way, including generating bar charts to show the number of operations by different users and line charts to show the changing trend of data access frequency.
[0097] In this embodiment, the audit analysis module provides a user-friendly interface for auditors to input query criteria (such as audit identifier, time range, user identity, etc.). Based on the query criteria input by the auditors, relevant audit log information is retrieved from the audit log database of the audit log recording module. Advanced data analysis algorithms (such as data mining, machine learning, etc.) are used to analyze the retrieved audit logs to identify potential security issues and abnormal behaviors. The analysis results are presented to auditors in a visual manner (such as charts, reports, etc.) to help them make quick decisions.
[0098] The system in this embodiment generates a unique audit identifier and associates it with the encryption key during data encryption, containing metadata such as the encryptor's identity and the time. The encrypted data is stored and transmitted together with the audit identifier. During data access operations, after verifying identity and permissions, the system obtains the audit identifier based on the encryption key and records visitor information, operation type, etc., to form an audit log. Auditors can use the audit system to track the entire lifecycle information of data from encryption to subsequent access based on the audit identifier. This system improves data security, enhances auditability, enables audit tracking of the entire data lifecycle, and eliminates the need for decryption when auditing encrypted data, avoiding the risk of data leakage. It is suitable for high-confidentiality scenarios.
[0099] Example 2:
[0100] This invention provides an audit tracing method based on encryption keys, which provides audit tracing based on the system disclosed in Embodiment 1, including four steps: data encryption, key management, access control, and audit analysis.
[0101] Step S100 Data Encryption: The user-inputted data is checked and verified. The data that has passed the check and verification is encrypted based on the encryption key to obtain encrypted data. The encrypted data, encryption key, audit identifier, and data identifier of the encrypted data are sent to the key management module for storage. The encryption key and audit identifier are generated by the encryption module.
[0102] As a specific implementation of data encryption, this step includes the following operations:
[0103] (1) Receive various types of data input by the user, including text files, database records and image files;
[0104] (2) Check and verify the data input by the user, including data format check and data integrity check. If the data does not meet the requirements, return an error message to the user.
[0105] (3) Generate an encryption key according to the preset encryption algorithm, and generate a unique audit identifier according to the audit identifier generation rules. The audit identifier is a string generated based on the encryptor's identity information, encryption timestamp, unique identifier of encryption device and random number.
[0106] (4) Encrypt the verified data using the encryption key to obtain encrypted data;
[0107] (5) Send the encrypted data, encryption key, and audit identifier to the key management module;
[0108] (6) Receive confirmation information returned by the key management module.
[0109] In this embodiment, advanced encryption algorithms (such as AES and RSA) are used to encrypt the input data, ensuring its confidentiality during storage and transmission. This module features a unique audit identifier generation function, capable of generating a unique audit identifier based on preset complex rules. This audit identifier includes the encryptor's identity information (such as employee ID, department name, etc.), encryption time (accurate to milliseconds), encryption device information (such as device MAC address, IP address, etc.), and a randomly generated unique code. The generated audit identifier is closely associated with the encryption key, and this association information is passed to the key management module for storage.
[0110] Step S200 Key Management: The key management module stores and manages encrypted data, encryption keys, and audit identifiers, and provides query services for encryption keys and audit identifiers.
[0111] In this embodiment, high-security storage technologies (such as encrypted storage and redundant backup) are used to store encryption keys and their associated audit identifiers during key management. It includes management functions for key generation, updating, and destruction to ensure the security and validity of the keys. A query interface for keys and audit identifiers is provided so that other modules can obtain relevant information when needed.
[0112] Step S300 Access Control: The access control module receives data access requests submitted by users, authenticates users based on user identity information in the data access request, and queries user access permissions. For users with access permissions, the module obtains the encryption key and audit identifier related to the encrypted data specified in the data access request from the key management module. The module decrypts the encrypted data specified in the data access request based on the encryption key, supports users to operate on the decrypted data according to their access permissions, records the user's operation process, forms operation information, and sends the user identity information, operation information, and audit identifier as audit log information to the audit log recording module for storage.
[0113] As a specific implementation of access control, this step includes the following operations:
[0114] (1) Receive data access requests submitted by users. The data access requests specify the data identifier of the data to be accessed. The data identifier includes the file name and the database table name.
[0115] (2) Based on the user identity information in the data access request, verify the user's identity. The verification methods include username and password verification and biometric identification. If the verification fails, return access denied information to the user.
[0116] (3) After authentication, based on the user identity information in the data access request, call the permission management database to query the permission information and determine whether the user has access rights to the data specified in the data access request. If the user does not have access rights, return access denied information to the user.
[0117] (4) For users with access rights, obtain the encryption key and audit identifier related to the encrypted data specified in the data access request from the key management module;
[0118] (5) Decrypt the encrypted data specified in the data access request based on the encryption key, and support users to perform operations on the decrypted data according to their access permissions, including querying, modifying and deleting, record the user's operation process on the data, and form operation information, including operation type, operation time and operation result;
[0119] (6) Send user identity information, operation information and audit identifier to the audit log recording module. Correspondingly, the audit log recording module stores user identity information, operation information and audit identifier in the audit log database according to a predetermined format and returns confirmation information to the access control module.
[0120] In this embodiment, the access control process integrates multiple authentication methods (such as username and password, fingerprint recognition, multi-factor authentication, etc.) to authenticate users accessing encrypted data. Based on the user's identity and permission information (stored in the permission management database), it is determined whether the user has permission to access specific data. When the user is successfully authenticated and has the necessary access permissions, the encryption key corresponding to the encrypted data and its associated audit identifier are obtained from the key management module.
[0121] The audit log recording module receives user access and operation information (including user identity, access time, operation type, etc.) and audit identifiers from the access control module. This information is recorded in the audit log database according to a specific format (such as JSON, XML, etc.) to ensure the integrity and readability of the audit logs. Regular backups and archiving of the audit logs prevent data loss and facilitate subsequent querying and analysis.
[0122] Step S400 Audit Analysis: The audit analysis module accepts the query conditions input by the user, sends a query request to the audit log recording module based on the query conditions input by the user, analyzes and processes the search results returned by the audit log recording module, and displays the analysis results in a visual manner.
[0123] As a specific implementation of audit analysis, this step includes the following operations:
[0124] (1) The audit analysis module provides a user interface to receive user input query conditions, including audit identifier, time range and user identity;
[0125] (2) Send a query request to the audit log recording module based on the query conditions input by the user; correspondingly, the audit log recording module is used to retrieve relevant audit log information from the audit log database based on the query request and return the retrieval results to the audit analysis module;
[0126] (3) Analyze and process the retrieved audit log information to obtain analysis results. During the analysis and processing, the audit log information is mined and the existing security problems and abnormal behaviors are found based on the preset data analysis methods. The data analysis methods include anomaly detection algorithms and trend analysis algorithms.
[0127] (4) Present the analysis results in a visual way, including generating bar charts to show the number of operations by different users and line charts to show the changing trend of data access frequency.
[0128] In this embodiment, the audit analysis module provides a user-friendly interface for auditors to input query criteria (such as audit identifier, time range, user identity, etc.). Based on the query criteria input by the auditors, relevant audit log information is retrieved from the audit log database of the audit log recording module. Advanced data analysis algorithms (such as data mining, machine learning, etc.) are used to analyze the retrieved audit logs to identify potential security issues and abnormal behaviors. The analysis results are presented to auditors in a visual manner (such as charts, reports, etc.) to help them make quick decisions.
[0129] The above provides a detailed description of the audit tracing system and method based on encryption keys provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. An audit trail system based on cryptographic keys, characterized in that, It includes an encryption module, a key management module, an access control module, an audit log recording module, and an audit analysis module; The encryption module is used to generate encryption keys and audit identifiers, check and verify user-input data, encrypt the data that has passed the check and verification based on the encryption key to obtain encrypted data, send the encrypted data, encryption key, audit identifier and data identifier of the encrypted data to the key management module for storage, and receive confirmation information returned by the key management module. The key management module is used to store and manage encrypted data, encryption keys, and audit identifiers, and to provide query services for encryption keys and audit identifiers. The access control module is used to receive data access requests submitted by users, authenticate users based on user identity information in the data access request, query user access permissions, obtain encryption keys and audit identifiers related to the encrypted data specified in the data access request from the key management module for users with access permissions, decrypt the encrypted data specified in the data access request based on the encryption keys, support users to operate on the decrypted data according to their access permissions, record the user's operation process on the data and form operation information, send the user identity information, operation information and audit identifier as audit log information to the audit log recording module for storage, and receive confirmation information returned by the audit log recording module. The audit analysis module is used to send query requests to the audit log recording module based on the query conditions input by the user, analyze and process the search results returned by the audit log recording module, and display the analysis results in a visual manner.
2. The audit trail system based on encryption keys according to claim 1, characterized in that, The encryption module is used to perform the following operations: It can receive various types of data input from users, including text files, database records, and image files; The system checks and validates user-input data, including data format checks and data integrity checks. If the data does not meet the requirements, it returns an error message to the user. An encryption key is generated according to a preset encryption algorithm, and a unique audit identifier is generated according to the audit identifier generation rules. The audit identifier is a string generated based on the encryptor's identity information, encryption timestamp, unique identifier of encryption device, and random number. The verified data is encrypted using the encryption key to obtain encrypted data. Send the encrypted data, encryption key, and audit identifier to the key management module; Receive confirmation information returned by the key management module.
3. The audit trail system based on encryption keys according to claim 1, characterized in that, The access control module is used to perform the following operations: Receive data access requests submitted by users. The data access requests specify the data identifier of the data to be accessed. The data identifier includes the file name and the database table name. Based on the user's identity information in the data access request, the user is authenticated. The authentication methods include username and password verification and biometric identification. If the authentication fails, an access denial message is returned to the user. After authentication, based on the user's identity information in the data access request, the permission management database is called to query the permission information and determine whether the user has access rights to the data specified in the data access request. If the user does not have access rights, access denial information is returned to the user. For users with access rights, the encryption key and audit identifier associated with the encrypted data specified in the data access request are obtained from the key management module. The encrypted data specified in the data access request is decrypted based on the encryption key, and users can perform operations on the decrypted data according to their access permissions, including querying, modifying and deleting. The operation process of the user on the data is recorded and operation information is formed, including operation type, operation time and operation result. The user's identity information, operation information, and audit identifier are sent to the audit log recording module. Correspondingly, the audit log recording module stores the user's identity information, operation information, and audit identifier in the audit log database according to a predetermined format and returns confirmation information to the access control module.
4. The audit trail system based on encryption keys according to claim 1, characterized in that, The audit analysis module is used to perform the following operations: Provide a user interface to receive user-input query conditions, including audit identifier, time range, and user identity; The system sends a query request to the audit log recording module based on the query conditions entered by the user; correspondingly, the audit log recording module retrieves relevant audit log information from the audit log database based on the query request and returns the retrieval results to the audit analysis module. The retrieved audit log information is analyzed and processed to obtain analysis results. During the analysis and processing, the audit log information is mined and the existing security problems and abnormal behaviors are found based on the preset data analysis methods. The data analysis methods include anomaly detection algorithms and trend analysis algorithms. The analysis results are presented in a visual manner, including generating bar charts to show the number of operations by different users and line charts to show the changing trend of data access frequency.
5. An audit trail method based on cryptographic keys, characterized in that, An audit trail based on an audit trail system according to any one of claims 1-4 is implemented, comprising the following steps: Data encryption: The user input data is checked and verified. The data that passes the check and verification is encrypted based on the encryption key to obtain encrypted data. The encrypted data, encryption key, audit identifier and data identifier of the encrypted data are sent to the key management module for storage. The encryption key and audit identifier are generated by the encryption module. Key Management: The key management module stores and manages encrypted data, encryption keys, and audit identifiers, and provides query services for encryption keys and audit identifiers. Access Control: The access control module receives data access requests submitted by users, authenticates users based on the user identity information in the data access request, and queries the user's access permissions. For users with access permissions, it obtains the encryption key and audit identifier related to the encrypted data specified in the data access request from the key management module, decrypts the encrypted data specified in the data access request based on the encryption key, supports users to operate on the decrypted data according to their access permissions, records the user's operation process and forms operation information, and sends the user identity information, operation information and audit identifier as audit log information to the audit log recording module for storage. Audit Analysis: The audit analysis module accepts user-input query conditions, sends query requests to the audit log recording module based on the user-input query conditions, analyzes and processes the search results returned by the audit log recording module, and displays the analysis results in a visual manner.
6. The audit tracing method based on encryption keys according to claim 5, characterized in that, Data encryption includes the following operations: It can receive various types of data input from users, including text files, database records, and image files; The system checks and validates user-input data, including data format checks and data integrity checks. If the data does not meet the requirements, it returns an error message to the user. An encryption key is generated according to a preset encryption algorithm, and a unique audit identifier is generated according to the audit identifier generation rules. The audit identifier is a string generated based on the encryptor's identity information, encryption timestamp, unique identifier of encryption device, and random number. The verified data is encrypted using the encryption key to obtain encrypted data. Send the encrypted data, encryption key, and audit identifier to the key management module; Receive confirmation information returned by the key management module.
7. The audit tracing method based on encryption keys according to claim 5, characterized in that, Access control includes the following operations: Receive data access requests submitted by users. The data access requests specify the data identifier of the data to be accessed. The data identifier includes the file name and the database table name. Based on the user's identity information in the data access request, the user is authenticated. The authentication methods include username and password verification and biometric identification. If the authentication fails, an access denial message is returned to the user. After authentication, based on the user's identity information in the data access request, the permission management database is called to query the permission information and determine whether the user has access rights to the data specified in the data access request. If the user does not have access rights, access denial information is returned to the user. For users with access rights, the encryption key and audit identifier associated with the encrypted data specified in the data access request are obtained from the key management module. The encrypted data specified in the data access request is decrypted based on the encryption key, and users can perform operations on the decrypted data according to their access permissions, including querying, modifying and deleting. The operation process of the user on the data is recorded and operation information is formed, including operation type, operation time and operation result. The user's identity information, operation information, and audit identifier are sent to the audit log recording module. Correspondingly, the audit log recording module stores the user's identity information, operation information, and audit identifier in the audit log database according to a predetermined format and returns confirmation information to the access control module.
8. The audit tracing method based on encryption keys according to claim 5, characterized in that, Audit analysis includes the following operations: The audit analysis module provides a user interface to receive user-input query conditions, including audit identifier, time range, and user identity. The system sends a query request to the audit log recording module based on the query conditions entered by the user; correspondingly, the audit log recording module retrieves relevant audit log information from the audit log database based on the query request and returns the retrieval results to the audit analysis module. The retrieved audit log information is analyzed and processed to obtain analysis results. During the analysis and processing, the audit log information is mined and the existing security problems and abnormal behaviors are found based on the preset data analysis methods. The data analysis methods include anomaly detection algorithms and trend analysis algorithms. The analysis results are presented in a visual manner, including generating bar charts to show the number of operations by different users and line charts to show the changing trend of data access frequency.