Log file generation method, device and electronic equipment

Abstract

The application discloses a log file generation method and device and electronic equipment, and relates to the field of financial technology.The method comprises the following steps: acquiring a log message of a target interface and an encryption configuration of the target interface; detecting a global switch state of a global encryption switch and an interface switch state of an interface encryption switch based on the encryption configuration of the target interface; if at least one of the global encryption switch or the interface encryption switch is in an open state, then performing encryption processing on the log message based on the encryption configuration of the target interface to generate a target log file.The technical scheme of the embodiment of the application realizes an encryption processing mode of configuration driving instead of hard coding, does not need to repeatedly develop encryption logic for log messages with different structures, greatly reduces the development workload and the modification cost, avoids omissions or misjudgments caused by manual identification, and significantly reduces the maintenance cost.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a method, apparatus and electronic device for generating log files. Background Technology

[0002] Currently, sensitive information in applications is often recorded in plaintext in log files, posing a risk of leakage.

[0003] In existing technologies, the structures of log messages from different application interfaces vary greatly, requiring separate development of encryption logic for each application interface.

[0004] Existing technologies suffer from problems such as the need to repeatedly write encryption code, a large workload, high modification costs, easy omissions or misjudgments in manual identification of sensitive fields, scattered encryption logic, difficulty in unified management, and maintenance difficulties. Summary of the Invention

[0005] This invention provides a log file generation method, apparatus, and electronic device, which realizes an encryption processing method that replaces hard coding with configuration driver. It eliminates the need to repeatedly develop encryption logic for log messages with different structures, greatly reducing development workload and modification costs, avoiding omissions or misjudgments caused by manual identification, and significantly reducing maintenance costs.

[0006] According to one aspect of the present invention, a log file generation method is provided, the method comprising: Obtain the log messages of the target interface and the encryption configuration of the target interface; Based on the encryption configuration of the target interface, detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch; If at least one of the global encryption switch or the interface encryption switch is in the on state, the log message is encrypted based on the encryption configuration of the target interface to generate the target log file.

[0007] According to another aspect of the present invention, a log file generation apparatus is provided, the apparatus comprising: The target log message acquisition module is used to acquire the log messages of the target interface and the encryption configuration of the target interface; A dual-layer encryption switch detection module is used to detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface. The target log file generation module is used to encrypt the log message based on the encryption configuration of the target interface and generate a target log file if at least one of the global encryption switch or the interface encryption switch is in the on state.

[0008] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the log file generation method according to any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the log file generation method according to any embodiment of the present invention.

[0010] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the log file generation method described in any embodiment of the present invention.

[0011] The technical solution of this invention, by configuring independent encryption configurations for each target interface and combining a two-layer switching mechanism of global encryption switch and interface encryption switch, realizes a configuration-driven encryption processing method that replaces hard coding. This eliminates the need to repeatedly develop encryption logic for log messages with different structures, significantly reducing development workload and modification costs. At the same time, the encryption configuration automatically determines sensitive fields, avoiding omissions or misjudgments caused by manual identification. Furthermore, the two-layer switching mechanism takes into account both the need for unified global management and flexible interface-level control, with encryption rules centrally managed in the configuration, significantly reducing maintenance costs.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of a log file generation method provided in Embodiment 1 of the present invention; Figure 2This is a flowchart of a log file generation method provided in Embodiment 2 of the present invention; Figure 3 This is a flowchart of a log file generation method provided in Embodiment 2 of the present invention; Figure 4 This is a schematic diagram of a log file generation device according to Embodiment 3 of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device that implements the log file generation method of this invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0017] Example 1 Figure 1 This is a flowchart illustrating a log file generation method according to Embodiment 1 of the present invention. This embodiment of the invention is applicable to situations where log files are generated from interface-based log messages. The method can be executed by a log file generation device, which can be implemented in hardware and / or software. This log file generation device can be configured in an electronic device that carries the log file generation function, such as a client or server.

[0018] See Figure 1 The log file generation methods shown include: S101. Obtain the log messages and encryption configuration of the target interface.

[0019] The target interface is used to facilitate data interaction between the caller and the callee. The callee is the application that implements the functionalities of the business system.

[0020] Log messages are data packets transmitted between the caller and the callee through the target interface. For example, log messages may include request messages and response messages. A request message is a structured data packet sent by the caller to the callee through the target interface. The request message represents a data interaction request. For example, a request message may include a request method, request header information, and request body data. A response message is a structured data packet returned by the callee to the caller through the target interface after receiving and processing the request message. The response message provides feedback on the processing result of the request message. For example, a response message may include status information, response header information, and response body data.

[0021] The encryption configuration of the target interface is a pre-defined set of encryption rule parameters for the target interface. This encryption configuration controls the encryption processing behavior of the target interface during data interaction.

[0022] Specifically, obtain the log messages of the target interface and the pre-determined encryption configuration of the target interface.

[0023] S102. Based on the encryption configuration of the target interface, detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch.

[0024] The encryption configuration of the target interface includes the global switch status of the global encryption switch and the interface switch status of the interface encryption switch.

[0025] The global encryption switch is the master control switch that determines whether encryption processing is enabled for all application interfaces of the entire business system. The global switch state characterizes the status of the global encryption switch. For example, the global switch state includes an on state and a off state. When the global encryption switch is on, it can be understood that encryption processing is performed on all application interfaces of the business system. When the global encryption switch is off, it can be understood that encryption processing is not performed on all application interfaces of the business system.

[0026] The interface encryption switch controls whether encryption processing is enabled on the target interface. The interface encryption switch is set independently for each individual interface. The interface switch state characterizes the state of the interface encryption switch. For example, the interface switch state includes an on state and a off state. When the interface encryption switch is on, it can be understood that encryption processing is performed on the log messages of the target interface. When the interface encryption switch is off, it can be understood that encryption processing is not performed on the log messages of the target interface. The interface switch state only affects the corresponding target interface and does not affect other interfaces.

[0027] In comparison, global encryption switches and interface encryption switches are encryption switches with different control granularities. Interface encryption switches have a finer control granularity than global encryption switches. You can understand it this way: a global encryption switch is a system-level encryption switch, applicable to all application interfaces of the business system; an interface encryption switch is an interface-level encryption switch, applicable to the target interface.

[0028] Specifically, the encryption configuration of the target interface is queried, and the global switch status of the global encryption switch and the interface switch status of the interface encryption switch are detected.

[0029] S103. If at least one of the global encryption switch or the interface encryption switch is in the on state, the log message is encrypted based on the encryption configuration of the target interface to generate the target log file.

[0030] The target log file is a data file formed by persistently storing one or more log messages generated by the target interface during data interaction. The target log file is a collection of log messages. It is used to support log querying, auditing, and analysis. When at least one of the global encryption switch or the interface encryption switch is enabled, the target log file is a data file formed by persistently storing encrypted log messages. The target log file is a collection of encrypted log messages.

[0031] Specifically, if at least one of the global encryption switch or the interface encryption switch is turned on, the entire log message is encrypted based on the encryption configuration of the target interface to generate the target log file.

[0032] In an optional embodiment of the present invention, after detecting the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface, the method further includes: if both the global encryption switch and the interface encryption switch are in the off state, then the target plaintext log file is directly generated based on the log message.

[0033] The target plaintext log file is a data file formed by persistently storing unencrypted log messages generated during data interaction with the target interface. The target plaintext log file is a collection of original log messages. The log messages (or sensitive fields within the log messages) stored in the target plaintext log file exist in plaintext form.

[0034] Specifically, if both the global encryption switch and the interface encryption switch are in the off state, the original text of the log message will be directly persisted and stored to generate a plaintext target log file.

[0035] This solution increases the selectivity of log message encryption and improves the flexibility of log file display by directly generating plaintext log files when both the global encryption switch and the interface encryption switch are turned off.

[0036] The technical solution of this invention, by configuring independent encryption configurations for each target interface and combining a two-layer switching mechanism of global encryption switch and interface encryption switch, realizes a configuration-driven encryption processing method that replaces hard coding. This eliminates the need to repeatedly develop encryption logic for log messages with different structures, significantly reducing development workload and modification costs. At the same time, the encryption configuration automatically determines sensitive fields, avoiding omissions or misjudgments caused by manual identification. Furthermore, the two-layer switching mechanism takes into account both the need for unified global management and flexible interface-level control, with encryption rules centrally managed in the configuration, significantly reducing maintenance costs.

[0037] In an optional embodiment of the present invention, the method further includes: periodically detecting the global switch status of the global encryption switch and the interface switch status of the interface encryption switch, and obtaining the log message of the target interface and the target log file; comparing the log message with the target log file to determine the actual encryption processing status of the target interface; performing a consistency check between the encryption processing status of the target interface and the global switch status and the interface switch status; if the actual encryption processing status is inconsistent with the global switch status and the interface switch status, performing secondary encryption processing on the log message and updating the target log file.

[0038] The actual encryption processing status refers to the actual processing status of the log messages of the target interface. For example, the actual encryption processing status includes either encrypted processing or unencrypted processing. The actual encryption processing status may differ from the global switch status and the interface switch status. This can be understood as follows: based on the global switch status and the interface switch status, it is determined that log messages need encryption processing, but the actual encryption status is unencrypted; or, based on the global switch status and the interface switch status, it is determined that log messages do not need encryption processing, but the actual encryption status is encrypted.

[0039] Specifically, the system periodically checks the global encryption switch status and the interface encryption switch status, and obtains the target interface's log messages and corresponding target log files. The log messages are compared with the target log files to determine the actual encryption processing status of the target interface. A consistency check is performed between the target interface's encryption processing status and the encryption processing requirements corresponding to the global and interface switch statuses. If the actual encryption processing status is inconsistent with the encryption processing requirements of the global and interface switch statuses, the log messages are subjected to secondary encryption based on the target interface's encryption configuration. The secondary encrypted log messages are then persistently stored, and the target log file is updated.

[0040] This solution introduces failure detection for the global switch status of the global encryption switch and the interface switch status of the interface encryption switch, which improves the consistency between the encryption processing status of the target interface and the global switch status and interface switch status, thereby improving the fault tolerance of log message encryption.

[0041] In an optional embodiment of the present invention, if at least one of the global encryption switch or the interface encryption switch is in the on state, after encrypting the log message based on the encryption configuration of the target interface to generate the target log file, the method further includes: obtaining the query field of the target interface; detecting the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface; if at least one of the global encryption switch or the interface encryption switch is in the on state, encrypting the query field based on the encryption configuration of the target interface to obtain the ciphertext field; and using the ciphertext field to query the target log file of the target interface.

[0042] The query fields are the query conditions entered by the querying party when performing a query operation on the target interface. Query fields are used to characterize the querying party's query requirements. Query fields are used to generate the actual query conditions for the target log file.

[0043] The ciphertext field is the encrypted data of the query field. It is used to match and compare the ciphertext field with the encrypted target log file in encrypted query scenarios. In fact, each query field represents the actual query conditions for the encrypted target log file.

[0044] Specifically, the system retrieves the query fields of the target interface input by the querying party through the front-end page. It then queries the encryption configuration of the target interface, checking the global encryption switch status and the interface encryption switch status. If at least one of the global encryption switch or the interface encryption switch is enabled, it queries the encryption type corresponding to the query field in the target interface's encryption configuration to determine the encryption method for the query field. The system then uses this encryption method to encrypt the query field, obtaining the ciphertext field. Finally, it uses the ciphertext field to query the target interface's log file.

[0045] This solution improves the traceability of log message encryption processing and enables effective querying of encrypted target log files by encrypting the query fields based on the global encryption switch and the on / off state of the interface encryption switch of the target interface during the log query and retrieval phase, and then querying based on the encrypted fields.

[0046] Example 2 Figure 2This is a flowchart of a log file generation method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment of the present invention specifies "encrypting log messages based on the encryption configuration of the target interface to generate a target log file" as "parsening the encryption configuration, identifying the target sensitive fields in the log message and the target encryption method corresponding to the target sensitive fields; encrypting the target sensitive fields using the target encryption method to generate target ciphertext; replacing the target sensitive fields in the log message with the target ciphertext to generate a target ciphertext log file," thus improving the targeting and encryption efficiency of log message encryption, thereby improving the efficiency of log file generation. It should be noted that parts not detailed in this embodiment of the present invention can be referred to in the descriptions of other embodiments.

[0047] See Figure 2 The log file generation methods shown include: S201. Obtain the log messages and encryption configuration of the target interface.

[0048] S202. Based on the encryption configuration of the target interface, detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch.

[0049] S203. If at least one of the global encryption switch or the interface encryption switch is in the on state, the encryption configuration is parsed to identify the target sensitive field in the log message and the target encryption method corresponding to the target sensitive field.

[0050] Target sensitive fields are data fields identified as needing protection in encryption during data interaction with the target interface. They can be understood as the raw data fields in log messages that require encryption. These target sensitive fields contain sensitive information. Optionally, target sensitive fields can be directly determined by the encryption field identifier in the encryption configuration. In this case, the encryption field identifier is used to identify the sensitive fields that the target interface needs to encrypt.

[0051] The target encryption method refers to the encryption processing method for the target sensitive field. For example, the target encryption method can be a combination rule of encryption algorithm, encryption key, and encryption logic used when performing encryption processing on the target sensitive field. For example, the target encryption method can be determined according to the encryption type in the encryption configuration. The encryption type is used to record the encryption algorithm or encryption logic, etc., for the encryption processing.

[0052] Specifically, the encryption field identifiers in the encryption configuration are parsed to identify the target sensitive fields in the log messages. The encryption type of the target sensitive fields in the encryption configuration is parsed to identify the target encryption method corresponding to the target sensitive fields.

[0053] In an optional embodiment of the present invention, parsing the encryption configuration to identify target sensitive fields and the target encryption methods corresponding to the target sensitive fields includes: parsing the encryption configuration to identify candidate sensitive fields from log messages; detecting the field switch status of the field encryption switch of the candidate sensitive fields based on the encryption configuration of the target interface; filtering target sensitive fields whose field encryption switches are in the on state from the candidate sensitive fields, and determining the target encryption method of the target sensitive fields.

[0054] Candidate sensitive fields are data fields that, based on encryption configuration, are initially identified as potentially requiring encryption during data interaction with the target interface. Candidate sensitive fields are used to filter target sensitive fields. In comparison, candidate sensitive fields are data fields that may require encryption; target sensitive fields are data fields that actually require encryption. Optionally, candidate sensitive fields can be determined by encryption field identifiers in the encryption configuration. In this case, the encryption field identifier is used to identify data fields that the target interface may require encryption, i.e., candidate sensitive fields.

[0055] The field encryption switch controls whether encryption processing is enabled for candidate sensitive fields. It is set independently for each individual data field. Comparatively, the field encryption switch offers finer-grained control than the interface encryption switch. In short, the field encryption switch is a field-level encryption switch applicable to a single candidate sensitive field.

[0056] The field switch state is used to characterize the state of the field encryption switch. For example, the field switch state includes an on state and a off state. When the field encryption switch is on, it can be understood that encryption processing is performed on the candidate encryption field. When the field encryption switch is off, it can be understood that no encryption processing is performed on the candidate encryption field. The field switch state only affects the corresponding data field and does not affect other fields.

[0057] Specifically, the encryption field identifiers in the encryption configuration are parsed to identify candidate sensitive fields from log messages. The encryption configuration of the target interface is queried to check the field encryption switch status of the candidate sensitive fields. If the field encryption switch of a candidate sensitive field is on, then the candidate sensitive field is identified as the target sensitive field. The encryption type of the target sensitive field in the encryption configuration is then parsed to identify the corresponding target encryption method.

[0058] This solution parses the encryption configuration, identifies candidate sensitive fields from log messages, detects the field encryption switch status of candidate sensitive fields based on the encryption configuration of the target interface, filters target sensitive fields whose field encryption switches are on from the candidate sensitive fields, and determines the target encryption method for the target sensitive fields. By introducing the identification of the field encryption switch status of candidate sensitive fields and filtering target sensitive fields from the candidate sensitive fields, this solution further improves the flexibility and accuracy of log message encryption.

[0059] In an optional embodiment of the present invention, parsing the encryption configuration to identify target sensitive fields in the log message and the target encryption method corresponding to the target sensitive fields includes: parsing the encryption configuration to identify target sensitive fields in the log message; and querying the sensitive field encryption dictionary in the encryption configuration according to the field type of the target sensitive field to determine the target encryption method corresponding to the target sensitive field.

[0060] The field type serves as a category identifier for the target sensitive field. Optionally, the field type can be determined by classifying the target sensitive field according to its data format, business attributes, or sensitivity level. The encryption configuration also includes a sensitive field encryption dictionary. This dictionary records the mapping between field types and encryption methods. A sensitive field encryption dictionary can correspond to a single target interface. Different target interfaces can have different sensitive field encryption dictionaries.

[0061] Specifically, the encryption field identifiers in the encryption configuration are parsed to identify the target sensitive fields in the log messages. Based on the field type of the target sensitive field, the sensitive field encryption dictionary in the encryption configuration is queried to determine the encryption method corresponding to the field type in the sensitive field encryption dictionary, thus obtaining the target encryption method corresponding to the target sensitive field.

[0062] This solution parses the encryption configuration, identifies target sensitive fields in log messages, and queries the sensitive field encryption dictionary in the encryption configuration based on the field type of the target sensitive field to determine the target encryption method corresponding to the target sensitive field. By introducing a sensitive field encryption dictionary and determining the encryption method based on the field type of the target sensitive field, the detection efficiency of the target encryption method is improved, thereby improving the efficiency of log file generation.

[0063] In an optional embodiment of the present invention, the method further includes: periodically detecting the validity period of the encryption key and salt value contained in the target encryption method; if the validity period of the encryption key or salt value expires, updating the encryption key and salt value.

[0064] The encryption key is a core parameter used when encrypting sensitive fields in a log message. It controls the encryption algorithm's operation. The encryption key determines the mapping between plaintext and ciphertext. It is essential for the correct execution of encryption and decryption. For example, an encryption key includes a key value, key length, and validity period. The key value is the actual binary data of the encryption key. The key length is the number of bits in the encryption key. The key length determines the security strength of the encryption key. The validity period is the time range during which the encryption key is valid.

[0065] A salt is auxiliary data randomly generated before encryption of a target sensitive field. It is concatenated or mixed with the original field value of the target sensitive field. The salt ensures that the same original field value produces different ciphertext results in different encryption scenarios. The salt prevents the original data from being deduced through ciphertext comparison. For example, a salt includes salt content, salt length, generation method, usage method, and validity period. The salt content is auxiliary data. The salt length is the number of bits in the salt value. The generation method is the rule for generating the salt. For example, generation methods include random generation, timestamp-based generation, or field value derivation. The usage method is how the salt is combined with plaintext. For example, usage methods include concatenation, prefixing, or mixed operations. The validity period is the time range within which the salt is available.

[0066] When the validity period of an encryption key or salt value expires, it can be understood that the encryption key or salt value has exceeded its usable time range and needs to be updated.

[0067] Specifically, the validity period of the encryption key and salt value included in the target encryption method is periodically checked. If the encryption key or salt value has expired, it is updated. If the encryption key or salt value is still valid, it is not updated.

[0068] This scheme introduces validity period detection for the encryption key and salt value included in the target encryption method. When the validity period of the encryption key or salt value expires, the encryption key and salt value are updated, which can prevent the leakage of encryption key and salt value and improve the security of log message encryption.

[0069] S204. Using the target encryption method, the target sensitive fields are encrypted to generate the target ciphertext.

[0070] The target ciphertext is the result of encrypting the target sensitive fields. In comparison, the target sensitive fields can be read directly, but the target ciphertext cannot be read directly.

[0071] Specifically, the target sensitive fields are encrypted using the encryption algorithm and encryption key contained in the target encryption method to generate the target ciphertext.

[0072] Optionally, the salt value included in the target encryption method is concatenated with the target sensitive field. The concatenation result of the salt value and the target sensitive field is encrypted using the encryption algorithm and encryption key included in the target encryption method to generate the target ciphertext.

[0073] S205. Use the target ciphertext to replace the target sensitive fields in the log message and generate the target ciphertext log file.

[0074] The target ciphertext log file is a data file formed by persistently storing log messages after replacing the target sensitive fields with the target ciphertext. The target ciphertext log file is a collection of encrypted log messages. It is used to achieve persistent data storage without exposing the original sensitive information of the target sensitive fields.

[0075] Specifically, the target sensitive fields in the log message are replaced with the target ciphertext, and the replaced log message is persistently stored to generate a target ciphertext log file in ciphertext form.

[0076] The technical solution of this invention determines the sensitive fields and corresponding encryption methods in the log message based on the encryption configuration, and encrypts the sensitive fields using the encryption methods to generate target ciphertext, thereby improving the targeting and encryption efficiency of the log message encryption. By using the target ciphertext to replace the target sensitive fields in the log message to generate a target ciphertext log file, the efficiency of log file generation can be improved.

[0077] Based on the above embodiments, Figure 3 This is a preferred embodiment of a log file generation method. See also... Figure 3 The log file generation methods shown include: S301, Read log messages.

[0078] S302, Load encryption configuration.

[0079] The encryption configuration for each interface is pre-configured by the configuration management module. This interface encryption configuration automatically identifies sensitive fields in request or response messages and dynamically encrypts them. For example, Table 1 shows the encryption configuration table. The encryption configuration includes interface identifier, interface name, interface address, interface parameters, grayscale environment, encryption field identifier, and encryption type. The encryption method is determined by the encryption type, which includes the encryption key. S303. Check if the encryption switch is turned on; if not, proceed to S304; if yes, proceed to S305.

[0080] Encryption switches can be dynamically controlled via environment variables or encryption configuration. For example, encryption switches include a global encryption switch and an interface encryption switch, facilitating debugging and troubleshooting. Optionally, the encryption switch may also include an environment switch, which detects whether the target interface is in a grayscale environment. If the target interface is in a grayscale or non-grayscale environment, the environment encryption switch for that environment is detected. If the environment encryption switch is enabled, the log messages of the target interface are encrypted. The environment encryption switch offers finer-grained control than the interface encryption switch.

[0081] Specifically, the state of the encryption switch on the interface determines whether encryption is enabled. If the encryption switch is off, plaintext log files are output directly; if the encryption switch is on, the encryption process begins.

[0082] S304. Generate plaintext log files.

[0083] Specifically, the encryption process is skipped, and plaintext log files are output directly.

[0084] S305. Traverse log messages and identify sensitive fields.

[0085] Specifically, it iterates through request and response messages and matches sensitive fields in the encryption configuration that require encryption.

[0086] S306, Invoke the encryption algorithm.

[0087] It can adapt to multiple encryption algorithms. For example, the encryption algorithm, encryption key, and salt value can be configured for each encryption type. The encryption key and salt value have an expiration date and can be updated periodically.

[0088] Optionally, based on the encryption type corresponding to the sensitive field, an encryption algorithm is invoked, and ciphertext is generated by combining the encryption key and salt value.

[0089] S307, Replace sensitive fields with ciphertext.

[0090] S308. Generate encrypted log file.

[0091] Specifically, the processed log messages are written to the log file.

[0092] Optionally, the encrypted log files can support specific retrieval logic to balance security and availability.

[0093] Currently, sensitive information in applications is often recorded in plaintext in log files, posing a risk of leakage. Existing technologies suffer from significant differences in the structure and sensitive fields of log messages between different application interfaces, requiring the development of separate encryption logic for each interface. These existing technologies suffer from the problems of repetitive encryption code writing, high workload, high modification costs, easy omissions or misjudgments in manual identification of sensitive fields, fragmented encryption logic, difficulty in unified management, and maintenance difficulties.

[0094] This solution provides a configuration-driven method for encrypting sensitive log information. By configuring sensitive fields and encryption rules in interface messages via scripts, it achieves dynamic encryption, multi-algorithm adaptation, and ciphertext retrieval of log messages. This method replaces hard coding with configuration, eliminating the need to repeatedly develop encryption logic for different interfaces, significantly improving modification efficiency and reducing development costs. Simultaneously, automated field matching and encryption processing eliminate the risks of omissions and misjudgments caused by manual field-by-field judgment. Furthermore, it supports independent configuration of encryption strategies for different interfaces and adaptation to multiple encryption algorithms, possessing excellent flexibility and scalability. In addition, the encryption switch and ciphertext retrieval functions cater to both security control and debugging needs, making it user-friendly for operations and maintenance. The overall encryption processing logic is embedded in the log output layer, executing before log writing, with zero intrusion into business code.

[0095] Example 3 Figure 4 This is a schematic diagram of a log file generation device provided in Embodiment 3 of the present invention. This embodiment of the present invention is applicable to situations where log files are generated from interface-based log messages. The device can execute a log file generation method and can be implemented in hardware and / or software. The device can be configured in an electronic device that carries the log file generation function, such as a client or server.

[0096] See Figure 4 The log file generation device shown includes: a target log message acquisition module 401, a dual-layer encryption switch detection module 402, and a target log file generation module 403. The target log message acquisition module 401 is used to acquire the log messages and encryption configuration of the target interface; the dual-layer encryption switch detection module 402 is used to detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface; the target log file generation module 403 is used to encrypt the log messages and generate a target log file based on the encryption configuration of the target interface if at least one of the global encryption switch or the interface encryption switch is in an on state.

[0097] The technical solution of this invention, by configuring independent encryption configurations for each target interface and combining a two-layer switching mechanism of global encryption switch and interface encryption switch, realizes a configuration-driven encryption processing method that replaces hard coding. This eliminates the need to repeatedly develop encryption logic for log messages with different structures, significantly reducing development workload and modification costs. At the same time, the encryption configuration automatically determines sensitive fields, avoiding omissions or misjudgments caused by manual identification. Furthermore, the two-layer switching mechanism takes into account both the need for unified global management and flexible interface-level control, with encryption rules centrally managed in the configuration, significantly reducing maintenance costs.

[0098] In an optional embodiment of the present invention, the target log file generation module 403 includes: a target sensitive field identification unit, used to parse the encryption configuration and identify the target sensitive field in the log message and the target encryption method corresponding to the target sensitive field if at least one of the global encryption switch or the interface encryption switch is in the on state; a target ciphertext generation unit, used to encrypt the target sensitive field using the target encryption method to generate target ciphertext; and a target ciphertext log file generation unit, used to replace the target sensitive field in the log message with the target ciphertext to generate a target ciphertext log file.

[0099] In an optional embodiment of the present invention, the target sensitive field identification unit includes: a candidate sensitive field identification subunit, used to parse the encryption configuration and identify candidate sensitive fields from log messages; a field switch status detection subunit, used to detect the field switch status of the field encryption switch of the candidate sensitive field based on the encryption configuration of the target interface; and a target sensitive field filtering subunit, used to filter target sensitive fields whose field encryption switches are in the on state from the candidate sensitive fields and determine the target encryption method of the target sensitive field.

[0100] In an optional embodiment of the present invention, the target sensitive field identification unit includes: a target sensitive field identification subunit, used to parse the encryption configuration and identify the target sensitive fields in the log message; and a target encryption method determination subunit, used to query the sensitive field encryption dictionary in the encryption configuration according to the field type of the target sensitive field and determine the target encryption method corresponding to the target sensitive field; wherein, the sensitive field encryption dictionary is used to record the mapping relationship between field type and encryption method.

[0101] In an optional embodiment of the present invention, the target log file generation module 403 includes: an expiration detection unit, used to periodically detect the expiration of the encryption key and salt value contained in the target encryption method; and an encryption key update unit, used to update the encryption key and salt value if the expiration of the encryption key or salt value has expired.

[0102] In an optional embodiment of the present invention, the apparatus includes: a query field acquisition module, configured to, if at least one of the global encryption switch or the interface encryption switch is in an on state, encrypt log messages based on the encryption configuration of the target interface to generate a target log file, and then acquire a query field of the target interface; an encryption status detection module, configured to, based on the encryption configuration of the target interface, detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch; a ciphertext field generation module, configured to, if at least one of the global encryption switch or the interface encryption switch is in an on state, encrypt the query field based on the encryption configuration of the target interface to obtain a ciphertext field; and a target log file query module, configured to, using the ciphertext field, query the target log file of the target interface.

[0103] In an optional embodiment of the present invention, the device includes: a switch state detection module, configured to, if at least one of the global encryption switch or the interface encryption switch is in an on state, encrypt log packets based on the encryption configuration of the target interface to generate a target log file, periodically detect the global switch state of the global encryption switch and the interface switch state of the interface encryption switch, and obtain the log packets and the target log file of the target interface; an actual encryption processing state determination module, configured to compare the log packets with the target log file to determine the actual encryption processing state of the target interface; a consistency verification module, configured to perform consistency verification between the encryption processing state of the target interface and the global switch state and the interface switch state; and a secondary encryption processing module, configured to, if the actual encryption processing state is inconsistent with the global switch state and the interface switch state, perform secondary encryption processing on the log packets and update the target log file.

[0104] In an optional embodiment of the present invention, the apparatus includes: a target plaintext log file generation module, configured to, after detecting the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface, directly generate a target plaintext log file according to the log message if both the global encryption switch and the interface encryption switch are in the off state.

[0105] The log file generation apparatus provided in this embodiment of the invention can execute the log file generation method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0106] In the technical solutions of this invention, the information collected is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0107] Example 4 According to embodiments of the present invention, the present invention also provides an electronic device, a readable storage medium, and a computer program product.

[0108] Figure 5 A schematic diagram of an electronic device 500 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0109] like Figure 5 As shown, the electronic device 500 includes at least one processor 501 and a memory, such as a read-only memory 502 or a random access memory 503, communicatively connected to the at least one processor 501. The memory stores computer programs executable by the at least one processor. The processor 501 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 502 or loaded from storage unit 508 into the random access memory 503. The random access memory 503 can also store various programs and data required for the operation of the electronic device 500. The processor 501, read-only memory 502, and random access memory 503 are interconnected via a bus 504. An input / output interface 505 is also connected to the bus 504.

[0110] Multiple components in electronic device 500 are connected to input / output interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0111] Processor 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 501 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 501 performs the various methods and processes described above, such as the log file generation method.

[0112] In some embodiments, the log file generation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 500 via read-only memory 502 and / or communication unit 509. When the computer program is loaded into random access memory 503 and executed by processor 501, one or more steps of the log file generation method described above may be performed. Alternatively, in other embodiments, processor 501 may be configured to execute the log file generation method by any other suitable means (e.g., by means of firmware).

[0113] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), complex programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0115] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0116] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0117] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0118] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system. This addresses the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0119] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0120] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for generating log files, characterized in that, The method includes: Obtain the log messages of the target interface and the encryption configuration of the target interface; Based on the encryption configuration of the target interface, detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch; If at least one of the global encryption switch or the interface encryption switch is in the on state, the log message is encrypted based on the encryption configuration of the target interface to generate the target log file.

2. The method according to claim 1, characterized in that, The encryption configuration based on the target interface encrypts the log messages to generate a target log file, including: The encryption configuration is parsed to identify the target sensitive fields in the log message and the target encryption method corresponding to the target sensitive fields; The target sensitive field is encrypted using the aforementioned target encryption method to generate target ciphertext; The target ciphertext is used to replace the target sensitive field in the log message to generate a target ciphertext log file.

3. The method according to claim 2, characterized in that, The step of parsing the encryption configuration to identify the target sensitive field and the target encryption method corresponding to the target sensitive field includes: The encryption configuration is parsed to identify candidate sensitive fields from the log messages; Based on the encryption configuration of the target interface, detect the field switch status of the field encryption switch of the candidate sensitive field; Filter the target sensitive fields from the candidate sensitive fields whose field encryption switch is on, and determine the target encryption method for the target sensitive fields.

4. The method according to claim 2, characterized in that, The step of parsing the encryption configuration to identify the target sensitive fields in the log message and the target encryption method corresponding to the target sensitive fields includes: The encryption configuration is parsed to identify the target sensitive fields in the log message; Based on the field type of the target sensitive field, the sensitive field encryption dictionary in the encryption configuration is queried to determine the target encryption method corresponding to the target sensitive field; wherein, the sensitive field encryption dictionary is used to record the mapping relationship between the field type and the encryption method.

5. The method according to claim 2, characterized in that, Also includes: Periodically check the validity period of the encryption key and salt value contained in the target encryption method; If the encryption key or the salt value expires, the encryption key and the salt value shall be updated.

6. The method according to claim 1, characterized in that, If at least one of the global encryption switch or the interface encryption switch is in the on state, and the log message is encrypted based on the encryption configuration of the target interface to generate the target log file, the method further includes: Obtain the query fields of the target interface; Based on the encryption configuration of the target interface, detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch; If at least one of the global encryption switch or the interface encryption switch is in the on state, the query field is encrypted based on the encryption configuration of the target interface to obtain the ciphertext field; Use the encrypted field to query the target log file of the target interface.

7. The method according to claim 1, characterized in that, If at least one of the global encryption switch or the interface encryption switch is in the on state, and the log message is encrypted based on the encryption configuration of the target interface to generate the target log file, the method further includes: The global switch status of the global encryption switch and the interface switch status of the interface encryption switch are periodically detected, and the log messages and target log files of the target interface are obtained. The log message is compared with the target log file to determine the actual encryption processing status of the target interface; Perform a consistency check between the encryption processing state of the target interface and the global switch state and the interface switch state; If the actual encryption processing state is inconsistent with the global switch state and the interface switch state, the log message will be encrypted a second time, and the target log file will be updated.

8. The method according to claim 1, characterized in that, After detecting the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface, the method further includes: If both the global encryption switch and the interface encryption switch are in the off state, the target plaintext log file is directly generated based on the log message.

9. A log file generation device, characterized in that, The device includes: The target log message acquisition module is used to acquire the log messages of the target interface and the encryption configuration of the target interface; A dual-layer encryption switch detection module is used to detect the global switch status of the global encryption switch and the interface switch status of the interface encryption switch based on the encryption configuration of the target interface. The target log file generation module is used to encrypt the log message based on the encryption configuration of the target interface and generate a target log file if at least one of the global encryption switch or the interface encryption switch is in the on state.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the log file generation method according to any one of claims 1-8.

Images