Third-party trusted platform log security verification method and system and storage medium

Abstract

The invention provides a third-party credible platform log security verification method and system and a storage medium, and the method comprises the steps: firstly collecting an audit log of a credible platform, extracting log feature information, carrying out serial comparison based on a preset initial threshold group, and generating a standardized log with a label; secondly, executing a storage load balancing and self-adaptive fragmentation strategy in combination with the real-time operation state parameter and the dynamic threshold group, and generating a distributed encrypted log block; for the log needing to be backed up, according to the level label and the operation environment information, intelligent disaster recovery backup is triggered based on the synchronous threshold group; and finally, when a query request is responded, multi-level access control is completed based on the user role information and the authentication threshold group, a security query key is generated, and a plaintext auditing log is obtained through an encrypted communication channel, so that the tamper-proof capability of log data, the privacy protection effect and the system resource utilization efficiency are improved.

Description

Technical Field

[0001] This invention relates to the field of trusted platform log verification, and more specifically, to a third-party trusted platform log security verification method, system, and storage medium. Background Technology

[0002] With the widespread application of cloud computing and distributed systems, how to achieve integrity assurance, privacy protection and efficient verification throughout the entire lifecycle of logs in the field of third-party trusted platform log (LP-log) security management has always been a technical challenge.

[0003] First, existing log storage solutions have deficiencies in integrity assurance. Audit logs are typically recorded by software on cloud platforms, lacking reliable anti-tampering mechanisms, allowing malicious administrators to easily delete or destroy log data. Furthermore, traditional linear storage structures or centralized databases are vulnerable to single points of failure, leading to breaks in the audit chain. Second, privacy protection mechanisms are extremely inadequate, lacking fine-grained access control policies and failing to provide differentiated permission management based on different roles such as cloud service providers and tenants. Additionally, plaintext is commonly used during log transmission and storage, especially in the virtual machine-to-host transmission stage, allowing cloud service providers to directly read user privacy information. Moreover, traditional auditing processes often expose sensitive information related to system configuration and network topology. Third, verification efficiency and scalability are low. Verification methods based on traditional Merkle hash trees require traversing the entire tree structure; as the log volume increases, verification time rises exponentially, failing to meet real-time auditing requirements. Simultaneously, the storage capacity limitations of a single node create performance bottlenecks when processing massive distributed logs. Finally, existing technologies lack adaptive optimization capabilities, unable to dynamically adjust security policies and resource allocation based on operational status. Therefore, there is an urgent need for a log verification technology that can achieve end-to-end security control, support privacy protection, and has efficient verification capabilities. Summary of the Invention

[0004] In view of the above problems, the purpose of this invention is to provide a method, system, and storage medium for secure verification of logs on a third-party trusted platform. By constructing a dynamic, threshold-based control mechanism covering the entire log lifecycle—from collection and storage to backup and query—it achieves closed-loop security management of the log lifecycle, effectively solving the challenge of balancing integrity assurance and privacy protection. Specifically, firstly, by employing a series of comparisons between multi-dimensional feature parameters and an initial threshold set, accurate log classification and differentiated routing are achieved, improving adaptability and processing efficiency for heterogeneous logs. Secondly, by combining operational status monitoring with a storage load balancing strategy based on dynamic threshold sets, adaptive sharding encryption and distributed storage optimization are achieved, eliminating single-point-of-failure risks and storage performance bottlenecks. Thirdly, through an intelligent synchronization mechanism based on level tags and operational environment information, disaster recovery backup strategies and system status are dynamically matched, ensuring high availability and rapid recovery capabilities for critical data. Finally, through multi-level authentication and dynamic key generation strategies, fine-grained access control and query privacy protection are achieved, preventing unauthorized access and sensitive information leakage. Furthermore, through periodic performance monitoring and adaptive adjustment of threshold parameters, closed-loop optimization and continuous evolution are achieved, thereby addressing ever-changing workloads and security threats.

[0005] The first aspect of this invention provides a method for secure verification of logs from a third-party trusted platform, the method comprising: Collect audit logs from trusted platforms and extract log characteristics; Based on the log feature information, a tagged log is obtained by comparison processing based on a preset initial threshold group; Obtain the running status information, combine it with the tagged log data, and execute the storage load and sharding strategy based on the preset dynamic threshold group to obtain the encrypted log blocks of distributed storage; If the tagged log data is a log to be backed up, the backup status information is obtained by comparing the level tags and the operating environment information based on the synchronization threshold group. Based on the backup status information, the encrypted log blocks are stored in the disaster recovery backup area; In response to a user query command, a query key is obtained based on the user role information and a preset authentication threshold group. Based on the query key and a preset encrypted communication process, a plaintext audit log is obtained.

[0006] In this scheme, the step of obtaining tagged logs by comparing them based on the log feature information and a preset initial threshold group specifically includes: The load level label is obtained by comparing the log size with a preset size threshold. The frequency level label is obtained by comparing the generated frequency with the preset frequency threshold. Privacy level labels are obtained by comparing the sensitivity labels with preset sensitivity thresholds. The processing channel identifier is obtained by combining and mapping the load level label, frequency level label, and privacy level label.

[0007] In this scheme, the step of executing storage load and sharding strategies based on a preset dynamic threshold group to obtain encrypted log blocks for distributed storage specifically includes: Based on the comparison between the current storage node load and the storage load threshold, a log sharding command is triggered; Based on the comparison between the size of a single log fragment and the fragment size threshold, a second fragmentation process is performed to obtain plaintext log blocks; Based on the privacy level labels in the tagged logs, the corresponding hash chain key is selected for encryption to obtain encrypted log blocks; Update the storage index and hash chain key based on the sharding results.

[0008] In this solution, the step of obtaining backup status information based on the comparison of synchronization threshold groups according to the level label and operating environment information specifically includes: Based on the comparison result between the level label and the real-time synchronization threshold, a real-time synchronization command is triggered; Based on the comparison between log update frequency and periodic synchronization threshold, a batch synchronization task is triggered; Based on the comparison between the current network latency and the network latency threshold, perform backup link switching. Based on the node health status monitoring results, a system recovery readiness report is generated.

[0009] In this scheme, responding to a user query command and obtaining a query key based on user role information and a preset authentication threshold group specifically includes: Based on the comparison between user permission levels and role permission thresholds, perform basic access control; Based on the comparison results between the query time range and the time window threshold, perform secondary time authentication; Based on the successful multi-level authentication, a temporary query token and decryption key are generated.

[0010] This plan also includes: Based on a preset time period, the log verification success rate and response time metrics are collected; the log verification success rate and response time metrics are then input into a pre-trained performance analysis model. Based on the performance deviation analysis results, the parameter configurations of the initial threshold group, dynamic threshold group, and authentication threshold group are dynamically adjusted. Based on the threshold group update results, a configuration report is generated and distributed to each threshold comparison module.

[0011] A second aspect of the present invention provides a third-party trusted platform log security verification system, including a third-party trusted platform log security verification method program, wherein the third-party trusted platform log security verification method program, when executed by the processor, performs the following steps: Collect audit logs from trusted platforms and extract log characteristics; Based on the log feature information, a tagged log is obtained by comparison processing based on a preset initial threshold group; Obtain the running status information, combine it with the tagged log data, and execute the storage load and sharding strategy based on the preset dynamic threshold group to obtain the encrypted log blocks of distributed storage; If the tagged log data is a log to be backed up, the backup status information is obtained by comparing the level tags and the operating environment information based on the synchronization threshold group. Based on the backup status information, the encrypted log blocks are stored in the disaster recovery backup area; In response to a user query command, a query key is obtained based on the user role information and a preset authentication threshold group. Based on the query key and a preset encrypted communication process, a plaintext audit log is obtained.

[0012] In this scheme, the step of obtaining tagged logs by comparing them based on the log feature information and a preset initial threshold group specifically includes: The load level label is obtained by comparing the log size with a preset size threshold. The frequency level label is obtained by comparing the generated frequency with the preset frequency threshold. Privacy level labels are obtained by comparing the sensitivity labels with preset sensitivity thresholds. The processing channel identifier is obtained by combining and mapping the load level label, frequency level label, and privacy level label.

[0013] In this scheme, the step of executing storage load and sharding strategies based on a preset dynamic threshold group to obtain encrypted log blocks for distributed storage specifically includes: Based on the comparison between the current storage node load and the storage load threshold, a log sharding command is triggered; Based on the comparison between the size of a single log fragment and the fragment size threshold, a second fragmentation process is performed to obtain plaintext log blocks; Based on the privacy level labels in the tagged logs, the corresponding hash chain key is selected for encryption to obtain encrypted log blocks; Update the storage index and hash chain key based on the sharding results.

[0014] A third aspect of the present invention provides a computer-readable storage medium comprising a third-party trusted platform log security verification method program, wherein when the third-party trusted platform log security verification method program is executed by a processor, it implements the steps of the third-party trusted platform log security verification method as described in any of the preceding claims.

[0015] This invention provides a method, system, and storage medium for secure verification of logs from a third-party trusted platform. First, audit logs from the trusted platform are collected and log feature information is extracted. Based on a preset initial threshold group, a series of comparisons are performed to generate standardized logs with tags. Second, storage load balancing and adaptive sharding strategies are executed by combining real-time operating status parameters and dynamic threshold groups to generate distributed encrypted log blocks. For logs requiring backup, intelligent disaster recovery backup is triggered based on level tags and operating environment information, using a synchronization threshold group. Finally, when responding to query requests, multi-level access control is completed based on user role information and authentication threshold groups to generate a secure query key. Plaintext audit logs are then obtained through an encrypted communication channel, thereby improving the log data's tamper-proof capability, privacy protection, and system resource utilization efficiency. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope.

[0017] Figure 1 The flowchart of a third-party trusted platform log security verification method according to the present invention is shown; Figure 2 A flowchart illustrating the generation of tagged logs according to an embodiment of the present invention is shown; Figure 3 The following is a flowchart illustrating the execution of a storage load and sharding strategy according to an embodiment of the present invention; Figure 4 A block diagram of a third-party trusted platform log security verification system according to the present invention is shown. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Unless otherwise defined, all terms (including technical and scientific terms) used in embodiments of this invention shall have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in a common dictionary shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and not as being interpreted in an idealized or highly formalized sense, unless expressly defined in this embodiment of the invention.

[0020] The terms "first," "second," and similar words used in the embodiments of this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "an," "a," or "the" do not indicate a quantity limitation, but rather indicate the presence of at least one. Similarly, terms such as "including" or "comprising" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The steps preceding or following the steps in the method of the embodiments of this invention are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0021] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0022] Figure 1 The flowchart of a third-party trusted platform log security verification method according to the present invention is shown.

[0023] like Figure 1 As shown, the first aspect of this invention discloses a method for secure verification of logs from a third-party trusted platform, the method comprising: S102, Collect audit logs from the trusted platform and extract log features; S104, Based on the log feature information, a tagged log is obtained by comparison processing based on a preset initial threshold group; S106, Obtain the running status information, combine it with the tagged log data, and execute the storage load and sharding strategy based on the preset dynamic threshold group to obtain the encrypted log block of distributed storage; S108, if the tagged log data is a log to be backed up, then the backup status information is obtained by comparison processing based on the synchronization threshold group according to the level tag and the operating environment information. S110, Based on the backup status information, store the encrypted log block in the disaster recovery backup area; S112, in response to the user query command, obtain the query key based on the user role information and a preset authentication threshold group; S114. Based on the query key and a preset encrypted communication process, a plaintext audit log is obtained.

[0024] It should be noted that the log feature information includes log size, generation frequency, sensitivity tag, and timestamp; the initial threshold group includes size threshold, frequency threshold, and sensitivity threshold; the dynamic threshold group includes storage load threshold and shard size threshold; the operating status information includes storage node load, network bandwidth, and available storage space; the synchronization threshold group includes real-time synchronization threshold, periodic synchronization threshold, and network latency threshold; the user role information includes user identity and permission level; and the operating environment information includes network latency and node health status.

[0025] In this embodiment, audit logs are first collected through a trusted monitoring interface deployed on a cloud platform host or virtual machine, and feature information such as log size, generation frequency, sensitivity tags, and timestamps is extracted. Next, this feature information is compared in a series with a preset initial threshold group. Load level is determined based on size threshold, active status based on frequency threshold, and privacy level based on sensitivity threshold, thereby generating standardized logs with classification tags and allocating them to corresponding processing channels. Subsequently, real-time operating status parameters such as storage node load, network bandwidth, and available storage space are acquired, and storage load and sharding strategies are executed based on dynamic threshold groups and the tagged logs. When the node load exceeds the storage load threshold, a sharding instruction is triggered, and data block distribution is optimized based on the shard size threshold. Finally, encrypted log blocks for distributed storage are generated using a role-key mechanism. For logs requiring backup, their level tags are compared with a synchronization threshold group of operating environment information (including network latency and node health status). If the level tag reaches the real-time synchronization threshold, off-site disaster recovery backup is immediately initiated; if the network latency exceeds the threshold, the transmission link is automatically switched, thereby ensuring the integrity and availability of the backup data. When a user initiates a query request, multi-level verification is performed based on user role information and authentication threshold groups, including at least permission level comparison and time window verification. Upon successful verification, a temporary query token and decryption key are generated. Finally, the key is used to obtain plaintext audit logs through a secure communication channel. This embodiment achieves closed-loop security management of logs from generation, storage, backup to query through end-to-end threshold-based dynamic control, improving the log system's anti-tampering capabilities, privacy protection, and resource scheduling efficiency.

[0026] Figure 2 The diagram illustrates a flowchart of a tagged log generation process provided by an embodiment of the present invention.

[0027] According to embodiments of the present invention, such as Figure 2 As shown, the step of obtaining tagged logs by comparing the log feature information based on a preset initial threshold group specifically includes: S202, compare the log size with the preset size threshold to obtain the load level label; S204, compare the generated frequency with the preset frequency threshold to obtain the frequency level label; S206, compare the sensitivity label with the preset sensitivity threshold to obtain the privacy level label; S208, based on the combined mapping of the load level label, frequency level label and privacy level label, a processing channel identifier is obtained.

[0028] It should be noted that, firstly, the size of the collected logs is compared with a preset size threshold; if it exceeds the threshold, it is marked as "high load." Then, the log generation frequency is detected and compared with a frequency threshold; logs that consistently exceed the limit are marked as "high frequency." Simultaneously, sensitivity tags are automatically generated based on log content characteristics (such as operation type and data category) and matched with sensitivity thresholds to classify them into "public," "internal," or "confidential" privacy levels. Finally, based on the combined mapping results of the load level, frequency level, and privacy level, the logs are routed to different processing channels; for example, high-load and confidential logs enter the enhanced encryption and priority distributed storage channel, while low-sensitivity logs are assigned to the standard processing channel. This embodiment achieves refined classification and differentiated processing of logs through a multi-dimensional threshold comparison and combined decision-making mechanism, providing accurate strategic basis for subsequent encryption, storage, and verification stages, and improving the processing efficiency of massive heterogeneous logs.

[0029] Figure 3 The following is a flowchart illustrating the execution of a storage load and sharding strategy provided by an embodiment of the present invention.

[0030] According to embodiments of the present invention, such as Figure 3 As shown, the process of executing storage load and sharding strategies based on a preset dynamic threshold group to obtain encrypted log blocks for distributed storage specifically includes: S302, based on the comparison between the current storage node load and the storage load threshold, trigger the log sharding instruction; S304. Based on the comparison between the size of a single log fragment and the fragment size threshold, perform secondary fragmentation to obtain plaintext log blocks. S306, Based on the privacy level label in the tagged log, select the corresponding hash chain key for encryption processing to obtain an encrypted log block; S308, update the storage index and hash chain key based on the sharding processing results.

[0031] It should be noted that in this embodiment, by continuously monitoring the load rate of each storage node, when the load of any node exceeds the storage load threshold, a log sharding instruction is automatically triggered, and the logs to be stored are initially sharded according to time windows or service types. Subsequently, the size of each shard data block is checked; if it exceeds the shard size threshold, secondary sharding is performed to generate plaintext log blocks that conform to storage specifications. Then, based on the privacy level label in the tagged logs, the corresponding encryption key is obtained from the hash chain key management module, and a layered encryption mechanism is used to encrypt the log blocks. After encryption, the distributed storage index and hash chain key are updated to ensure that the location information and integrity verification evidence of each log block are accurately recorded. This embodiment, through the synergistic effect of dynamic sharding and layered encryption, ensures the confidentiality and traceability of data in a distributed environment, thereby improving security.

[0032] According to an embodiment of the present invention, the step of obtaining backup status information based on a comparison of synchronization threshold groups according to level labels and operating environment information specifically includes: Based on the comparison result between the level label and the real-time synchronization threshold, a real-time synchronization command is triggered; Based on the comparison between log update frequency and periodic synchronization threshold, a batch synchronization task is triggered; Based on the comparison between the current network latency and the network latency threshold, perform backup link switching. Based on the node health status monitoring results, a system recovery readiness report is generated.

[0033] It should be noted that in this embodiment, the level label of the log to be backed up is first compared with the real-time synchronization threshold. If the level reaches "Confidential" or "Critical," a real-time synchronization command is immediately generated to synchronize the data to the off-site disaster recovery center. For logs that do not meet the real-time standard, their update frequency and cumulative amount are detected. When they exceed the periodic synchronization threshold, a batch synchronization task is triggered. During the synchronization process, network latency data is continuously monitored. If the latency exceeds the network latency threshold, the system automatically switches to the backup transmission link. Simultaneously, based on the node health status monitoring results, a system recovery readiness report is generated periodically to ensure that backup data can be quickly activated in the event of a master node failure. This embodiment achieves dynamic matching between backup strategies, log importance, and system status through a multi-threshold triggered intelligent synchronization mechanism, avoiding unnecessary resource consumption and ensuring high availability and disaster recovery capabilities for critical data.

[0034] According to an embodiment of the present invention, the step of responding to a user query command and obtaining a query key based on user role information and a preset authentication threshold group specifically includes: Based on the comparison between user permission levels and role permission thresholds, perform basic access control; Based on the comparison results between the query time range and the time window threshold, perform secondary time authentication; Based on the successful multi-level authentication, a temporary query token and decryption key are generated.

[0035] It should be noted that in this embodiment, when a user query command is received, the user's identity information and permission level are first extracted. This is compared with a preset role permission threshold to achieve initial access verification. If the permission level is lower than the threshold, the query process is immediately terminated and a permission denial message is returned. After passing the initial access verification, the time range parameter in the query request is checked and compared with a preset time window threshold. If the query time span exceeds a reasonable range, a secondary review mechanism is triggered or the query range is directly restricted to achieve secondary time authentication. After passing the above multi-level authentication verification, a time-sensitive temporary query token is generated based on the communication session context. Simultaneously, a hierarchical decryption key is obtained from the key management module according to the key permissions corresponding to the user's role, and the token and key are bound to form a complete query key combination. This embodiment, through a hierarchical authentication mechanism and dynamic key generation strategy, prevents unauthorized access and sensitive data leakage, improving the security and user experience of the log query system.

[0036] According to an embodiment of the present invention, it further includes: Based on a preset time period, the log verification success rate and response time metrics are collected; the log verification success rate and response time metrics are then input into a pre-trained performance analysis model. Based on the performance deviation analysis results, the parameter configurations of the initial threshold group, dynamic threshold group, and authentication threshold group are dynamically adjusted. Based on the threshold group update results, a configuration report is generated and distributed to each threshold comparison module.

[0037] It should be noted that in this embodiment, key performance indicators such as log verification success rate and response time are automatically collected according to a preset time period, and these indicators are input into a pre-trained performance analysis model for in-depth analysis. The performance analysis model identifies abnormal patterns such as verification bottlenecks, storage latency, or query timeouts by comparing historical data with the current system state, and generates parameter adjustment strategies for initial threshold groups, dynamic threshold groups, and authentication threshold groups. Based on the strategies, the configuration of each threshold parameter is dynamically adjusted; for example, the frequency threshold for high-frequency logs may be appropriately relaxed to reduce system load, or the permission threshold for sensitive logs may be tightened to enhance security. Finally, a detailed configuration update report is generated and distributed to each threshold comparison module, completing the closed-loop optimization of system parameters. This embodiment, through continuous monitoring and adaptive adjustment mechanisms, enables the system to continuously optimize performance and security strategies according to actual operating conditions, improving its adaptability and stability in the face of changing workloads and security threats.

[0038] It is worth mentioning that it also includes: Obtain the health status score of the primary storage node; If the health status score is lower than the fault detection threshold, the node fault warning level is obtained; Based on the node fault warning level, a graded switching command is triggered according to the switching priority. During the switchover process, query requests are redirected to the backup node based on a traffic redirection mechanism.

[0039] The graded switching instructions include hot switching, warm switching, and cold switching.

[0040] It should be noted that in this embodiment, the health monitoring module continuously acquires the operating status data of the primary storage node, including indicators such as CPU load, memory utilization, and network connectivity, and calculates a comprehensive health status score. When this score falls below a preset fault detection threshold, different levels of node fault warnings are generated based on the degree of score decline, such as mild, moderate, and severe warnings. According to the warning level and preset switching priority rules, a tiered switching command is automatically triggered; a warm switch is performed for mild warnings to maintain service continuity, while a hot switch is immediately initiated for severe warnings to ensure zero data loss. During the switching process, a traffic redirection mechanism transparently redirects user query requests to the backup node in real time, while maintaining consistency verification of data synchronization status. This embodiment achieves high availability and rapid fault recovery for storage services through intelligent fault detection and tiered switching strategies.

[0041] It is worth mentioning that it also includes: Obtain log data from multiple trusted platform nodes; Based on the platform's tracking identifiers, log correlation analysis is performed to obtain the cross-node operation chain; Based on the log block sequence in the cross-node operation link, integrity verification is performed using a preset hash tree structure to obtain a link integrity proof. Based on the node trust information involved in the verification process, a two-way verification process is performed based on the platform integrity metric to obtain a node trust status report; Based on the link integrity proof and node trusted status report, a global audit trajectory map is generated.

[0042] It should be noted that in this embodiment, audit log data is collected from multiple trusted platform nodes deployed in a distributed manner. Then, using platform tracking identifiers, associated logs from different nodes are matched and reassembled to construct a complete cross-node operation chain. For the log block sequence in the operation chain, integrity verification is performed based on an improved Merkle hash tree structure, generating a chain integrity proof by calculating the hash reference relationship between adjacent log blocks. Simultaneously, the platform integrity measurement function provided by trusted hardware is used to perform bidirectional trusted verification on each participating node, obtaining node trusted status reports. Finally, the chain integrity proof and node trusted status reports are integrated to generate a global audit trajectory diagram showing the complete operation trajectory. This embodiment, through distributed log association and bidirectional verification mechanisms, ensures the integrity and trustworthiness of the operation chain in a distributed environment, providing comprehensive and accurate traceability evidence for security auditing.

[0043] Figure 4 A block diagram of a third-party trusted platform log security verification system according to the present invention is shown.

[0044] like Figure 4 As shown, the second aspect of the present invention discloses a third-party trusted platform log security verification system 4, including a memory 41 and a processor 42. The memory includes a third-party trusted platform log security verification method program, which, when executed by the processor, performs the following steps: Collect audit logs from trusted platforms and extract log characteristics; Based on the log feature information, a tagged log is obtained by comparison processing based on a preset initial threshold group; Obtain the running status information, combine it with the tagged log data, and execute the storage load and sharding strategy based on the preset dynamic threshold group to obtain the encrypted log blocks of distributed storage; If the tagged log data is a log to be backed up, the backup status information is obtained by comparing the level tags and the operating environment information based on the synchronization threshold group. Based on the backup status information, the encrypted log blocks are stored in the disaster recovery backup area; In response to a user query command, a query key is obtained based on the user role information and a preset authentication threshold group. Based on the query key and a preset encrypted communication process, a plaintext audit log is obtained.

[0045] It should be noted that the log feature information includes log size, generation frequency, sensitivity tag, and timestamp; the initial threshold group includes size threshold, frequency threshold, and sensitivity threshold; the dynamic threshold group includes storage load threshold and shard size threshold; the operating status information includes storage node load, network bandwidth, and available storage space; the synchronization threshold group includes real-time synchronization threshold, periodic synchronization threshold, and network latency threshold; the user role information includes user identity and permission level; and the operating environment information includes network latency and node health status.

[0046] In this embodiment, audit logs are first collected through a trusted monitoring interface deployed on a cloud platform host or virtual machine, and feature information such as log size, generation frequency, sensitivity tags, and timestamps is extracted. Next, this feature information is compared in a series with a preset initial threshold group. Load level is determined based on size threshold, active status based on frequency threshold, and privacy level based on sensitivity threshold, thereby generating standardized logs with classification tags and allocating them to corresponding processing channels. Subsequently, real-time operating status parameters such as storage node load, network bandwidth, and available storage space are acquired, and storage load and sharding strategies are executed based on dynamic threshold groups and the tagged logs. When the node load exceeds the storage load threshold, a sharding instruction is triggered, and data block distribution is optimized based on the shard size threshold. Finally, encrypted log blocks for distributed storage are generated using a role-key mechanism. For logs requiring backup, their level tags are compared with a synchronization threshold group of operating environment information (including network latency and node health status). If the level tag reaches the real-time synchronization threshold, off-site disaster recovery backup is immediately initiated; if the network latency exceeds the threshold, the transmission link is automatically switched, thereby ensuring the integrity and availability of the backup data. When a user initiates a query request, multi-level verification is performed based on user role information and authentication threshold groups, including at least permission level comparison and time window verification. Upon successful verification, a temporary query token and decryption key are generated. Finally, the key is used to obtain plaintext audit logs through a secure communication channel. This embodiment achieves closed-loop security management of logs from generation, storage, backup to query through end-to-end threshold-based dynamic control, improving the log system's anti-tampering capabilities, privacy protection, and resource scheduling efficiency.

[0047] According to an embodiment of the present invention, the step of obtaining tagged logs by comparing the log feature information based on a preset initial threshold group specifically includes: The load level label is obtained by comparing the log size with a preset size threshold. The frequency level label is obtained by comparing the generated frequency with the preset frequency threshold. Privacy level labels are obtained by comparing the sensitivity labels with preset sensitivity thresholds. The processing channel identifier is obtained by combining and mapping the load level label, frequency level label, and privacy level label.

[0048] It should be noted that, firstly, the size of the collected logs is compared with a preset size threshold; if it exceeds the threshold, it is marked as "high load." Then, the log generation frequency is detected and compared with a frequency threshold; logs that consistently exceed the limit are marked as "high frequency." Simultaneously, sensitivity tags are automatically generated based on log content characteristics (such as operation type and data category) and matched with sensitivity thresholds to classify them into "public," "internal," or "confidential" privacy levels. Finally, based on the combined mapping results of the load level, frequency level, and privacy level, the logs are routed to different processing channels; for example, high-load and confidential logs enter the enhanced encryption and priority distributed storage channel, while low-sensitivity logs are assigned to the standard processing channel. This embodiment achieves refined classification and differentiated processing of logs through a multi-dimensional threshold comparison and combined decision-making mechanism, providing accurate strategic basis for subsequent encryption, storage, and verification stages, and improving the processing efficiency of massive heterogeneous logs.

[0049] According to an embodiment of the present invention, the step of executing a storage load and sharding strategy based on a preset dynamic threshold group to obtain encrypted log blocks for distributed storage specifically includes: Based on the comparison between the current storage node load and the storage load threshold, a log sharding command is triggered; Based on the comparison between the size of a single log fragment and the fragment size threshold, a second fragmentation process is performed to obtain plaintext log blocks; Based on the privacy level labels in the tagged logs, the corresponding hash chain key is selected for encryption to obtain encrypted log blocks; Update the storage index and hash chain key based on the sharding results.

[0050] It should be noted that in this embodiment, by continuously monitoring the load rate of each storage node, when the load of any node exceeds the storage load threshold, a log sharding instruction is automatically triggered, and the logs to be stored are initially sharded according to time windows or service types. Subsequently, the size of each shard data block is checked; if it exceeds the shard size threshold, secondary sharding is performed to generate plaintext log blocks that conform to storage specifications. Then, based on the privacy level label in the tagged logs, the corresponding encryption key is obtained from the hash chain key management module, and a layered encryption mechanism is used to encrypt the log blocks. After encryption, the distributed storage index and hash chain key are updated to ensure that the location information and integrity verification evidence of each log block are accurately recorded. This embodiment, through the synergistic effect of dynamic sharding and layered encryption, ensures the confidentiality and traceability of data in a distributed environment, thereby improving security.

[0051] According to an embodiment of the present invention, the step of obtaining backup status information based on a comparison of synchronization threshold groups according to level labels and operating environment information specifically includes: Based on the comparison result between the level label and the real-time synchronization threshold, a real-time synchronization command is triggered; Based on the comparison between log update frequency and periodic synchronization threshold, a batch synchronization task is triggered; Based on the comparison between the current network latency and the network latency threshold, perform backup link switching. Based on the node health status monitoring results, a system recovery readiness report is generated.

[0052] It should be noted that in this embodiment, the level label of the log to be backed up is first compared with the real-time synchronization threshold. If the level reaches "Confidential" or "Critical," a real-time synchronization command is immediately generated to synchronize the data to the off-site disaster recovery center. For logs that do not meet the real-time standard, their update frequency and cumulative amount are detected. When they exceed the periodic synchronization threshold, a batch synchronization task is triggered. During the synchronization process, network latency data is continuously monitored. If the latency exceeds the network latency threshold, the system automatically switches to the backup transmission link. Simultaneously, based on the node health status monitoring results, a system recovery readiness report is generated periodically to ensure that backup data can be quickly activated in the event of a master node failure. This embodiment achieves dynamic matching between backup strategies, log importance, and system status through a multi-threshold triggered intelligent synchronization mechanism, avoiding unnecessary resource consumption and ensuring high availability and disaster recovery capabilities for critical data.

[0053] According to an embodiment of the present invention, the step of responding to a user query command and obtaining a query key based on user role information and a preset authentication threshold group specifically includes: Based on the comparison between user permission levels and role permission thresholds, perform basic access control; Based on the comparison results between the query time range and the time window threshold, perform secondary time authentication; Based on the successful multi-level authentication, a temporary query token and decryption key are generated.

[0054] It should be noted that in this embodiment, when a user query command is received, the user's identity information and permission level are first extracted. This is compared with a preset role permission threshold to achieve initial access verification. If the permission level is lower than the threshold, the query process is immediately terminated and a permission denial message is returned. After passing the initial access verification, the time range parameter in the query request is checked and compared with a preset time window threshold. If the query time span exceeds a reasonable range, a secondary review mechanism is triggered or the query range is directly restricted to achieve secondary time authentication. After passing the above multi-level authentication verification, a time-sensitive temporary query token is generated based on the communication session context. Simultaneously, a hierarchical decryption key is obtained from the key management module according to the key permissions corresponding to the user's role, and the token and key are bound to form a complete query key combination. This embodiment, through a hierarchical authentication mechanism and dynamic key generation strategy, prevents unauthorized access and sensitive data leakage, improving the security and user experience of the log query system.

[0055] According to an embodiment of the present invention, it further includes: Based on a preset time period, the log verification success rate and response time metrics are collected; the log verification success rate and response time metrics are then input into a pre-trained performance analysis model. Based on the performance deviation analysis results, the parameter configurations of the initial threshold group, dynamic threshold group, and authentication threshold group are dynamically adjusted. Based on the threshold group update results, a configuration report is generated and distributed to each threshold comparison module.

[0056] It should be noted that in this embodiment, key performance indicators such as log verification success rate and response time are automatically collected according to a preset time period, and these indicators are input into a pre-trained performance analysis model for in-depth analysis. The performance analysis model identifies abnormal patterns such as verification bottlenecks, storage latency, or query timeouts by comparing historical data with the current system state, and generates parameter adjustment strategies for initial threshold groups, dynamic threshold groups, and authentication threshold groups. Based on the strategies, the configuration of each threshold parameter is dynamically adjusted; for example, the frequency threshold for high-frequency logs may be appropriately relaxed to reduce system load, or the permission threshold for sensitive logs may be tightened to enhance security. Finally, a detailed configuration update report is generated and distributed to each threshold comparison module, completing the closed-loop optimization of system parameters. This embodiment, through continuous monitoring and adaptive adjustment mechanisms, enables the system to continuously optimize performance and security strategies according to actual operating conditions, improving its adaptability and stability in the face of changing workloads and security threats.

[0057] It is worth mentioning that it also includes: Obtain the health status score of the primary storage node; If the health status score is lower than the fault detection threshold, the node fault warning level is obtained; Based on the node fault warning level, a graded switching command is triggered according to the switching priority. During the switchover process, query requests are redirected to the backup node based on a traffic redirection mechanism.

[0058] The graded switching instructions include hot switching, warm switching, and cold switching.

[0059] It should be noted that in this embodiment, the health monitoring module continuously acquires the operating status data of the primary storage node, including indicators such as CPU load, memory utilization, and network connectivity, and calculates a comprehensive health status score. When this score falls below a preset fault detection threshold, different levels of node fault warnings are generated based on the degree of score decline, such as mild, moderate, and severe warnings. According to the warning level and preset switching priority rules, a tiered switching command is automatically triggered; a warm switch is performed for mild warnings to maintain service continuity, while a hot switch is immediately initiated for severe warnings to ensure zero data loss. During the switching process, a traffic redirection mechanism transparently redirects user query requests to the backup node in real time, while maintaining consistency verification of data synchronization status. This embodiment achieves high availability and rapid fault recovery for storage services through intelligent fault detection and tiered switching strategies.

[0060] It is worth mentioning that it also includes: Obtain log data from multiple trusted platform nodes; Based on the platform's tracking identifiers, log correlation analysis is performed to obtain the cross-node operation chain; Based on the log block sequence in the cross-node operation link, integrity verification is performed using a preset hash tree structure to obtain a link integrity proof. Based on the node trust information involved in the verification process, a two-way verification process is performed based on the platform integrity metric to obtain a node trust status report; Based on the link integrity proof and node trusted status report, a global audit trajectory map is generated.

[0061] It should be noted that in this embodiment, audit log data is collected from multiple trusted platform nodes deployed in a distributed manner. Then, using platform tracking identifiers, associated logs from different nodes are matched and reassembled to construct a complete cross-node operation chain. For the log block sequence in the operation chain, integrity verification is performed based on an improved Merkle hash tree structure, generating a chain integrity proof by calculating the hash reference relationship between adjacent log blocks. Simultaneously, the platform integrity measurement function provided by trusted hardware is used to perform bidirectional trusted verification on each participating node, obtaining node trusted status reports. Finally, the chain integrity proof and node trusted status reports are integrated to generate a global audit trajectory diagram showing the complete operation trajectory. This embodiment, through distributed log association and bidirectional verification mechanisms, ensures the integrity and trustworthiness of the operation chain in a distributed environment, providing comprehensive and accurate traceability evidence for security auditing.

[0062] A third aspect of the present invention provides a computer-readable storage medium comprising a third-party trusted platform log security verification method program, wherein when the third-party trusted platform log security verification method program is executed by a processor, it implements the steps of the third-party trusted platform log security verification method as described in any of the preceding claims.

[0063] In summary, this invention provides a method, system, and storage medium for secure verification of logs from a trusted third-party platform. First, it collects audit logs from the trusted platform and extracts log feature information. Based on a preset initial threshold group, it performs a series of comparisons to generate standardized logs with tags. Second, it combines real-time operating status parameters with a dynamic threshold group to execute storage load balancing and adaptive sharding strategies, generating distributed encrypted log blocks. For logs requiring backup, it triggers intelligent disaster recovery backup based on level tags and operating environment information, using a synchronization threshold group. Finally, when responding to query requests, it completes multi-level access control based on user role information and an authentication threshold group, generates a secure query key, and obtains plaintext audit logs through an encrypted communication channel. This improves the log data's tamper-proof capability, privacy protection, and system resource utilization efficiency.

[0064] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0065] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A third-party trusted platform log security verification method, characterized in that, The method includes: Collect audit logs from trusted platforms and extract log characteristics; Based on the log feature information, a tagged log is obtained by comparison processing based on a preset initial threshold group; Obtain the running status information, combine it with the tagged log data, and execute the storage load and sharding strategy based on the preset dynamic threshold group to obtain the encrypted log blocks of distributed storage; If the tagged log data is a log to be backed up, the backup status information is obtained by comparing the level tags and the operating environment information based on the synchronization threshold group. Based on the backup status information, the encrypted log blocks are stored in the disaster recovery backup area; In response to a user query command, a query key is obtained based on the user role information and a preset authentication threshold group. Based on the query key and a preset encrypted communication process, a plaintext audit log is obtained.

2. The third-party trusted platform log security verification method of claim 1, wherein, The step of obtaining tagged logs based on the log feature information and a preset initial threshold group comparison process specifically includes: The load level label is obtained by comparing the log size with a preset size threshold. The frequency level label is obtained by comparing the generated frequency with the preset frequency threshold. Privacy level labels are obtained by comparing the sensitivity labels with preset sensitivity thresholds. The processing channel identifier is obtained by combining and mapping the load level label, frequency level label, and privacy level label.

3. The third-party trusted platform log security verification method of claim 1, wherein, The process of executing storage load and sharding strategies based on a preset dynamic threshold group to obtain encrypted log blocks for distributed storage specifically includes: Based on the comparison between the current storage node load and the storage load threshold, a log sharding command is triggered; Based on the comparison between the size of a single log fragment and the fragment size threshold, a second fragmentation process is performed to obtain plaintext log blocks; Based on the privacy level labels in the tagged logs, the corresponding hash chain key is selected for encryption to obtain encrypted log blocks; Update the storage index and hash chain key based on the sharding results.

4. The third-party trusted platform log security verification method of claim 1, wherein, The process of obtaining backup status information based on level labels and operating environment information, using a comparison of synchronization threshold groups, specifically includes: Based on the comparison result between the level label and the real-time synchronization threshold, a real-time synchronization command is triggered; Based on the comparison between log update frequency and periodic synchronization threshold, a batch synchronization task is triggered; Based on the comparison between the current network latency and the network latency threshold, perform backup link switching. Based on the node health status monitoring results, a system recovery readiness report is generated.

5. The third-party trusted platform log security verification method of claim 1, wherein, The process of responding to a user query command and obtaining a query key based on the user role information and a preset authentication threshold group specifically includes: Based on the comparison between user permission levels and role permission thresholds, perform basic access control; Based on the comparison results between the query time range and the time window threshold, perform secondary time authentication; Based on the successful multi-level authentication, a temporary query token and decryption key are generated.

6. The third-party trusted platform log security verification method of claim 1, wherein, Also includes: Based on a preset time period, the collected logs verify the success rate and response time metrics. Input the log verification success rate and response time metrics into the pre-trained performance analysis model; Based on the performance deviation analysis results, the parameter configurations of the initial threshold group, dynamic threshold group, and authentication threshold group are dynamically adjusted. Based on the threshold group update results, a configuration report is generated and distributed to each threshold comparison module.

7. A third-party trusted platform log security verification system, characterized in that, The system includes a memory and a processor. The memory includes a third-party trusted platform log security verification method program. When the processor executes the third-party trusted platform log security verification method program, it performs the following steps: Collect audit logs from trusted platforms and extract log characteristics; Based on the log feature information, a tagged log is obtained by comparison processing based on a preset initial threshold group; Obtain the running status information, combine it with the tagged log data, and execute the storage load and sharding strategy based on the preset dynamic threshold group to obtain the encrypted log blocks of distributed storage; If the tagged log data is a log to be backed up, the backup status information is obtained by comparing the level tags and the operating environment information based on the synchronization threshold group. Based on the backup status information, the encrypted log blocks are stored in the disaster recovery backup area; In response to a user query command, a query key is obtained based on the user role information and a preset authentication threshold group. Based on the query key and a preset encrypted communication process, a plaintext audit log is obtained.

8. The third-party trusted platform log security verification system according to claim 7, characterized in that, The step of obtaining tagged logs based on the log feature information and a preset initial threshold group comparison process specifically includes: The load level label is obtained by comparing the log size with a preset size threshold. The frequency level label is obtained by comparing the generated frequency with the preset frequency threshold. Privacy level labels are obtained by comparing the sensitivity labels with preset sensitivity thresholds. The processing channel identifier is obtained by combining and mapping the load level label, frequency level label, and privacy level label.

9. A third-party trusted platform log security verification system according to claim 7, characterized in that, The process of executing storage load and sharding strategies based on a preset dynamic threshold group to obtain encrypted log blocks for distributed storage specifically includes: Based on the comparison between the current storage node load and the storage load threshold, a log sharding command is triggered; Based on the comparison between the size of a single log fragment and the fragment size threshold, a second fragmentation process is performed to obtain plaintext log blocks; Based on the privacy level labels in the tagged logs, the corresponding hash chain key is selected for encryption to obtain encrypted log blocks; Update the storage index and hash chain key based on the sharding results.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer-readable storage medium includes a third-party trusted platform log security verification method program, which, when executed by a processor, implements the steps of the third-party trusted platform log security verification method as described in any one of claims 1 to 6.

Images