Compiling method for log encryption and log encryption method

Abstract

The present disclosure provides a compiling method for log encryption and a log encryption method, wherein the compiling method for log encryption comprises: parsing a log statement in a source code file, determining a constant part in the log statement; encrypting the constant part to generate an encrypted constant data block; embedding the encrypted constant data block into an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt a variable part in the log statement to generate an encrypted variable data block during running, and generate encrypted log data according to the encrypted constant data block and the encrypted variable data block. The method only encrypts the constant part of the log statement in the compiling stage, and only encrypts the dynamic variable in real time in the program running stage, thereby reducing the risk of leakage of log information, reducing the calculation and memory overhead caused by log encryption, and balancing log security and program running performance.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, specifically to a compilation method for log encryption, a compilation apparatus for log encryption, a log encryption method, a log encryption apparatus, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] Log technology is an important tool for software system debugging, troubleshooting, and operational status monitoring. During program execution, logs record key business processes, variable states, and exception information, facilitating system fault location by development and maintenance personnel. However, logs often contain sensitive information, such as user identity information, business data, and system configurations. Storing and transmitting this information in plaintext poses serious security risks.

[0003] To address log security issues, existing technologies generally employ encryption of log content. Common log encryption schemes include application-layer encryption, log library encryption, and system call interception encryption. These schemes require encrypting the entire log content each time it is output, including format strings, constant text, delimiters, and all other elements. In scenarios with frequent log output (such as high concurrency, real-time systems, and applications in debug mode), this repeated encryption incurs significant CPU (Central Processing Unit) overhead. Summary of the Invention

[0004] This disclosure provides a compilation method for log encryption, a compilation apparatus for log encryption, a log encryption method, a log encryption apparatus, an electronic device, a computer-readable storage medium, and a computer program product.

[0005] In a first aspect, embodiments of this disclosure propose a compilation method for log encryption, comprising: parsing log statements in a source code file to determine constant portions in the log statements; encrypting the constant portions to generate encrypted constant data blocks; and embedding the encrypted constant data blocks into an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt variable portions in the log statements to generate encrypted variable data blocks during runtime, and to generate encrypted log data based on the encrypted constant data blocks and the encrypted variable data blocks.

[0006] Secondly, embodiments of this disclosure provide a log encryption method, comprising: during the execution of an executable program, in response to the execution of a log statement, encrypting the variable portion of the log statement to generate an encrypted variable data block, wherein the executable program pre-sets an encrypted constant data block corresponding to the constant portion of the log statement; and generating encrypted log data based on the encrypted constant data block and the encrypted variable data block.

[0007] Thirdly, embodiments of this disclosure propose a compilation apparatus for log encryption, comprising: a code parsing module configured to parse log statements in a source code file and determine constant portions in the log statements; a constant encryption module configured to encrypt the constant portions to generate encrypted constant data blocks; and a program generation module configured to embed the encrypted constant data blocks into an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt the variable portions in the log statements to generate encrypted variable data blocks during runtime, and to generate encrypted log data based on the encrypted constant data blocks and the encrypted variable data blocks.

[0008] Fourthly, embodiments of this disclosure provide a log encryption device, comprising: a variable encryption module configured to, during the execution of an executable program, encrypt the variable portion of a log statement to generate an encrypted variable data block in response to the execution of the log statement, wherein the executable program pre-sets encrypted constant data blocks corresponding to the constant portion of the log statement; and an encrypted log generation module configured to generate encrypted log data based on the encrypted constant data blocks and the encrypted variable data blocks.

[0009] Fifthly, embodiments of this disclosure provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute a compilation method for log encryption as described in any implementation of the first aspect or a log encryption method as described in any implementation of the second aspect.

[0010] In a sixth aspect, embodiments of this disclosure provide a non-transitory computer-readable storage medium storing computer instructions that, when executed by a processor, enable the implementation of a compilation method for log encryption as described in any implementation of the first aspect or a log encryption method as described in any implementation of the second aspect.

[0011] In a seventh aspect, embodiments of this disclosure provide a computer program product including a computer program, which, when executed by a processor, can implement the compilation method for log encryption described in any implementation of the first aspect or the log encryption method described in any implementation of the second aspect.

[0012] According to the technical solution provided in the embodiments of this disclosure, log statements in source code files can be parsed to determine the constant parts in the log statements; then, the constant parts are encrypted to generate encrypted constant data blocks; subsequently, the encrypted constant data blocks are embedded in an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt the variable parts in the log statements to generate encrypted variable data blocks during operation, and generate encrypted log data based on the encrypted constant data blocks and the encrypted variable data blocks.

[0013] By pre-encrypting the constant portions of log statements and embedding them into the executable program during the compilation phase, the executable program no longer stores plaintext log constants, avoiding the direct acquisition of log templates through reverse engineering of the binary program. During program execution, only dynamic variables are encrypted in real time, eliminating the need to assemble complete plaintext log strings in memory, thus preventing plaintext log leaks caused by memory dumps. The constant ciphertext can be directly reused, saving runtime encryption operations on fixed text and reducing computational and memory overhead from log output. The final output is encrypted log data composed of ordered blocks of encrypted constant data and encrypted variable data. Log transmission and storage are both performed in ciphertext form, effectively reducing the risk of log information leakage and balancing log security with program performance.

[0014] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0015] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 A flowchart illustrating a compilation method for log encryption provided in this embodiment of the disclosure; Figure 2 A flowchart of another compilation method for log encryption provided in an embodiment of this disclosure; Figure 3 A flowchart of a log encryption method provided in this disclosure embodiment; Figure 4 A flowchart of another log encryption method provided in this disclosure embodiment; Figure 5 A structural block diagram of a compilation apparatus for log encryption provided in an embodiment of this disclosure; Figure 6 A structural block diagram of a log encryption device provided in an embodiment of this disclosure; Figure 7This is a schematic diagram of the structure of an electronic device suitable for executing a compilation method or a log encryption method for log encryption, provided as an embodiment of this disclosure. Detailed Implementation

[0016] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding; these should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0017] This disclosure relates to the field of computer technology, specifically to a compilation method for log encryption, a compilation device for log encryption, a log encryption method, a log encryption device, an electronic device, a computer-readable storage medium, and a computer program product. It is applicable to various software scenarios that require log output but do not want the log plaintext (fixed log text, business dynamic data) to be directly exposed in the program binary file, log data stream, and program memory.

[0018] Applications log key data such as system running status, user actions, and error messages, providing crucial information for troubleshooting, performance optimization, and security auditing. Most existing program logging implementations directly write plaintext logging statements in the source code, outputting the raw plaintext log after the program runs.

[0019] Existing plaintext logging solutions have significant drawbacks: First, the log format string and fixed prompt text are directly compiled and stored in the program's binary file. Attackers can directly read the fixed text content in the log by reverse engineering the program, which can easily leak business prompts and business logic information. Second, the logs output by the program are in plaintext. Once the log transmission and storage process is captured, the dynamic business data contained in the logs will be directly exposed, posing a risk of data leakage.

[0020] To mitigate the risk of information leakage from plaintext logs, some existing solutions employ runtime encryption of the entire log string. This involves the program first concatenating the plaintext log data, then encrypting the entire log before outputting it. However, this approach has significant drawbacks: the program still needs to concatenate and generate the complete plaintext log string in memory during runtime. The plaintext log temporarily resides in the process's memory, making it vulnerable to memory dumping tools, thus maintaining the risk of plaintext leakage. Furthermore, runtime string concatenation and encryption incur substantial computational overhead, making it unsuitable for performance-sensitive programs.

[0021] In other words, existing log encryption schemes mainly suffer from high runtime overhead, or they only perform simple transformations on fixed template text in the logs without protecting dynamic variables generated at runtime, leaving dynamic data exposed in plaintext.

[0022] The following description of several optional embodiments illustrates the technical solutions of this disclosure and the technical effects produced by these solutions. It should be noted that the following embodiments can be referenced, learned from, or combined with each other. Identical terms, similar features, and similar implementation steps in different embodiments will not be repeated.

[0023] Please refer to Figure 1 , Figure 1 A flowchart of a compilation method for log encryption provided in this disclosure embodiment, wherein process 100 includes the following steps: Step 101: Parse the log statements in the source code file and determine the constant parts of the log statements.

[0024] The compilation method used for log encryption runs on the development side (development machine / build server), and the execution entity is the compiler program / build toolchain. For example, in the scenario of a web server application developed based on the C language, this compilation stage is executed on the developer's computer. In this embodiment, the source code file to be processed is first read. The compiler first performs lexical analysis and syntax parsing on the source code, constructing an abstract syntax tree corresponding to the source code. Here, the source code file is a text file written in a programming language, containing software business code and log statements. It cannot be directly run by the computer and needs to be compiled and linked by the compiler. The abstract syntax tree (AST) is a tree-shaped intermediate representation obtained by the compiler after parsing the source code, used to represent the syntactic logic structure of the source code.

[0025] Then, the compiler's internal static analysis module traverses each syntax node of the abstract syntax tree, searching for nodes representing function call types. These function call type nodes are specifically designed to represent the syntactic behavior of calling a function in the source code. Next, the name of the function called by the identified node (i.e., the name of the function called by the node of the function call type) is compared and matched with the preset logging function name to locate the target syntax tree node corresponding to the logging function call. Finally, the call information of the logging statement is extracted from this target syntax tree node, obtaining the format string and the passed parameter information.

[0026] Next, the static analysis module scans the acquired format string, using a pattern matching algorithm to identify placeholders (such as %s, %d, %f, etc.) within the format string. These placeholders mark the positions where dynamic data will be filled in later. The scanning process traverses the format string sequentially from beginning to end. Whenever a placeholder is identified, the text before the placeholder is extracted as a constant segment. After identifying the placeholders, the scanning continues, repeating the above extraction and identification operation until the entire format string has been traversed.

[0027] After the format string is split by placeholders, it will result in multiple segments of constant text, which are the constant parts of the log statements.

[0028] As an example, a log statement is "User %s logged in at %s.\n". Based on the two placeholders %s and %s in the statement, we get three constant parts: "User", "logged in at", and ".\n".

[0029] Step 102: Encrypt the constant part to generate an encrypted constant data block.

[0030] During the compilation of the source code file, all constant portions of the identified log statements are retrieved, and a preset encryption key is invoked to perform encryption operations on each constant portion sequentially, thereby obtaining the corresponding encrypted constant data block. The encryption method can employ either a symmetric or asymmetric encryption algorithm, the specific choice depending on the trade-off between security and performance. After encryption, each constant string becomes a ciphertext data block. The compiler generates metadata for each ciphertext data block, including information such as data length and encryption algorithm identifier.

[0031] Step 103: Embed the encrypted constant data block into the executable program.

[0032] After constant encryption is completed, the encrypted constant data block is embedded in the executable program. The executable program is obtained by compiling the source code file. During the execution process, the executable program is used to encrypt the variable part of the log statement to generate encrypted variable data blocks, and generate encrypted log data based on the encrypted constant data blocks and encrypted variable data blocks.

[0033] After constant encryption is completed, code transformation is performed, generating metadata based on log statements, encrypted constant data blocks, and variable portions. The metadata includes an array pointer to the encrypted constant data blocks and bit codes representing the order of constants and variables. The generated metadata is added to the global metadata table, and the template identifier corresponding to this metadata entry is determined. During the code transformation process, the original log function calls are replaced with generic encrypted log function calls, using the template identifier and dynamic variables as input parameters to the encrypted log function, thus obtaining the rewritten log code.

[0034] Next, the rewritten log code, along with the remaining business logic code from the source code file excluding the log statements, is fed into the compilation process to generate target code. Backend processing is performed on the target code to obtain machine code. During the linking phase, the encrypted constant data block is deployed as literal data to the read-only data segment of the executable program to be generated; simultaneously, the global metadata table and preset keys are deployed to the static data segment of the executable program. Symbol resolution, address relocation, and linking with the program's dependent library files are then completed, ultimately generating the executable program, with the encrypted constant data block embedded within it.

[0035] For example, the original log statement is "User %s logged in at %s.\n", and its three constant text segments are encrypted with keys to obtain three encrypted constant data blocks. After the link is completed, these three encrypted constant data blocks are stored in the read-only data segment of the executable program, and the program binary file no longer saves the original plaintext constant text of the log.

[0036] During the execution of the executable program, the variable part is encrypted to generate encrypted variable data blocks, and encrypted log data is generated based on the encrypted constant data blocks and encrypted variable data blocks. The data form of the encrypted log data here can be a data flow. A data flow refers to the complete flow path and transformation sequence of data from input, through a series of processing nodes, transformation, transmission, until output.

[0037] According to the compilation method for log encryption provided in this disclosure, the log statements in the source code file are first parsed to determine the constant parts of the log statements. Then, the constant parts are encrypted to generate encrypted constant data blocks. Afterwards, the encrypted constant data blocks are embedded into an executable program. The executable program is obtained by compiling the source code file. During runtime, the executable program encrypts the variable parts of the log statements to generate encrypted variable data blocks, and generates encrypted log data based on the encrypted constant data blocks and encrypted variable data blocks. Thus, the constant parts of the log statements are pre-encrypted and embedded into the executable program during the compilation stage. The executable program no longer stores the plaintext log constants, avoiding the direct acquisition of the log template through reverse engineering of the binary program. During program execution, only dynamic variables are encrypted in real time, eliminating the need to assemble complete plaintext log strings in memory, thus preventing plaintext log leakage caused by memory dumping. The encrypted constants can be directly reused, saving runtime encryption operations on fixed text and reducing the computational and memory overhead of log output. The final output is an encrypted log data stream consisting of encrypted constant data blocks and encrypted variable data blocks in an ordered manner. The log transmission and storage processes are all in ciphertext form, which effectively reduces the risk of log information leakage and balances log security with program performance.

[0038] Please refer to Figure 2 , Figure 2 A flowchart of another compilation method for log encryption provided in an embodiment of this disclosure, wherein process 200 includes the following steps: Step 201: Extract the format string carried by the log function called by the target node.

[0039] In this embodiment, the compiler performs syntax parsing on the source code file, generates an abstract syntax tree, traverses the abstract syntax tree to identify the target node of the log function call type, which corresponds to the log function call statement in the source code. The compiler reads the child node information of the target node, identifies each input parameter of the log function, and extracts the format string used as the first input parameter.

[0040] For example, the logging statement in the source code is `log_info("User %s logged in at %s.\n", username, time_str)`, which forms a target node of function call type in the abstract syntax tree. This target node records the called function name as `log_info` and contains multiple child nodes, corresponding to the various input parameters of the function. The compiler traverses this target node, extracts the string literal stored in the first parameter child node, and obtains the format string "User %slogged in at %s.\n", completing the data extraction in this step and providing input for subsequent identification of constant and variable parts.

[0041] In some optional implementations of the embodiments of this disclosure, the compilation method for log encryption described above further includes: determining a first node of function call type from the abstract syntax tree corresponding to the source code file; matching the called function name corresponding to the first node with a preset log function name, and determining a target node based on the matching result; extracting log call information corresponding to the target node, wherein the log statement includes log call information.

[0042] In this implementation, the compiler performs lexical and syntactic analysis on the source code file to construct an abstract syntax tree (AST) corresponding to the source code. It then traverses the AST to find and determine the node containing the function call type, denoted as the first node. Next, it reads the name of the called function stored in this first node and compares it with the pre-configured log function name.

[0043] If the function name matches, the first node is determined to be the target node; otherwise, the abstract syntax tree is traversed again to process the next function call type node. After determining the target node, the syntax information carried by the target node is read, and the log call information is extracted, including the called function identifier and each input parameter node. The log statement is included in the log call information.

[0044] This implementation identifies log calls by traversing the abstract syntax tree and matching function names. This allows for precise location of log statements in the source code, avoiding misidentification of other functions. Complete extraction of log call information provides reliable input for subsequent constant and variable decomposition and encryption processing, ensuring the stable execution of the subsequent log encryption process.

[0045] Step 202: Parse the format string, determine the constant text in the format string, and obtain the constant part.

[0046] The format string extracted from the target node is obtained, and a pattern matching algorithm is used to scan the format string character by character from beginning to end to identify format placeholders. For each placeholder detected, the text before the placeholder is truncated as a constant text segment; the scanning continues, and the identification and truncation operations are repeated until the entire format string has been traversed. The remaining text at the end is also treated as a constant text segment, which is the constant part.

[0047] This step, by extracting the format string of the log function and parsing the placeholders, can accurately separate the constant text in the log statement and complete the division of the constant part. This provides an accurate data foundation for subsequent compilation-time encryption of constants and runtime encryption of variables, ensuring the correct execution of the log encryption logic.

[0048] Step 203: Determine the placeholders in the format string and use the input parameters corresponding to the placeholders as the variable part.

[0049] While identifying placeholders, the system sequentially matches the input parameters in the log function call according to the order in which the placeholders appear. Each input parameter is then considered a variable. This completes the parsing process, yielding all constant and variable parts for subsequent construction of the alternation sequence.

[0050] Step 204: Generate an alternating sequence of constant and variable parts according to the original order of the format strings in the log statement.

[0051] Based on the constant text parsed from the preceding steps and the input parameters corresponding to the placeholders, the constant part and the variable part are alternately arranged to generate an alternating sequence, strictly following the original order of each fragment in the log statement format string.

[0052] For example, the parsed fragments from the format string "User %s logged in at %s.\n" are in the following order: constant text "User", input parameter username, constant text "logged in at ", input parameter time_str, constant text ".\n". Organizing these fragments according to this original order generates an alternating sequence: [constant part - User, variable part - username, constant part - logged in at, variable part - time_str, constant part - .\n]. This alternating sequence faithfully reproduces the arrangement order of the log fragments, providing a basis for generating bit encoding and subsequent code conversion.

[0053] Step 205: Encrypt each constant part in the alternating sequence using a preset key to obtain the corresponding encrypted constant data block.

[0054] Traverse the alternating sequence, filter out all constant parts within the sequence, call the preset key, and independently perform encryption operations on each constant part, generating an encrypted constant data block for each constant part.

[0055] For example, the alternating sequence contains three constant parts: "User ", " logged in at ", and ".\n". Each of the three constant text parts is encrypted separately using a preset key. The first encrypted constant text part is encrypted to obtain the first encrypted constant data block, the second encrypted constant text part is encrypted to obtain the second encrypted constant data block, and the third encrypted constant text part is encrypted to obtain the third encrypted constant data block. The encrypted constant data blocks retain their original order and are used for subsequent generation of metadata and embedding of the executable program; the original plaintext constants are not directly written into the program.

[0056] This step identifies format string placeholders, treats the input parameters as variable parts, generates an alternating sequence of constants and variables in their original order, and encrypts each constant part using a preset key to obtain encrypted constant data blocks. This pre-encryption of constants avoids plaintext storage and distinguishes between constants and variables.

[0057] Step 206: Perform code transformation based on log statements, encrypted constant data blocks, and variable portions in alternating sequences to generate log code.

[0058] Code transformation is performed based on log statements, encrypted constant data blocks, and variable portions of the alternation sequence. First, bit encoding is generated based on the alternation sequence, and metadata is constructed using array pointers to the encrypted constant data blocks. This metadata is added to the global metadata table, and the corresponding template identifier is obtained. Then, the original log function call is rewritten, replacing it with a generic encrypted log function. The template identifier and variable portions of the alternation sequence are used as input parameters to the generic encrypted log function. The rewritten code is then obtained.

[0059] Step 207: Compile the log code and the rest of the code to generate the target code.

[0060] The rewritten logging code replaces the original logging statements in the source code. The compiler reads the source code file and merges the rewritten logging code with all other code in the source code file except for the logging statements. This remaining code includes business logic, variable definitions, function implementations, conditional branches, loop logic, and other program code that does not involve logging rewriting; these are left unmodified. The compiler performs compilation processing on the merged complete code, sequentially completing lexical analysis, syntax analysis, and intermediate code generation. After backend processing, the target code is output. The target code contains both the original business logic and the rewritten logging logic, fully preserving the original business functionality of the source code, modifying only the logging-related parts.

[0061] Step 208: Perform linking on the target code to obtain the executable program.

[0062] The compiled target code is obtained, and linking is performed on it. During the linking phase, symbol resolution and address relocation are completed. Encrypted constant data blocks are deployed to the read-only data segment of the executable program, and the global metadata table and preset keys are deployed to the static data segment of the executable program. The relocated target code and the library files that the program depends on are integrated, segment information is merged, and finally, the executable program is generated. This executable program fully retains the original business logic and includes built-in encrypted constant data blocks, a global metadata table, and keys; it no longer stores the original plaintext constants of the logs.

[0063] The log segments are constructed in an alternating sequence according to their original order, ensuring that the order remains unchanged. During the compilation phase, the constant parts are pre-encrypted, and the log code is rewritten and compiled and linked with the rest of the code to generate an executable program. The program no longer stores plaintext log constants. Log preprocessing is implemented at the compilation stage, laying the foundation for encrypted log output at runtime.

[0064] According to the compilation method for log encryption provided in the embodiments of this disclosure, by parsing log statements during the compilation stage, distinguishing between constant and variable parts, constructing an alternating sequence in the original order, encrypting the constant part in advance, and obtaining an executable program through code rewriting, compilation and linking, the program no longer stores plaintext log constants, thereby resisting binary reverse engineering to obtain log templates.

[0065] In some optional implementations of the embodiments of this disclosure, step 206 above may be performed as follows: generating metadata based on the bit encoding generated by the alternating sequence and the pointer corresponding to the array composed of encrypted constant data blocks, wherein the bit encoding is used to characterize the arrangement order of the constant part and the variable part in the log statement; adding the metadata to a preset global metadata table and determining the identification information of the metadata in the global metadata table; replacing the original log function in the log statement with a preset encrypted log function, and using the identification information and the variable part in the alternating sequence as the input parameters of the encrypted log function to obtain the log code.

[0066] In this implementation, a bit code is generated based on the already generated alternating sequence of constants and variables. A memory pointer is obtained to the array consisting of all encrypted constant data blocks of the alternating sequence. The bit code is combined with this array pointer to construct the metadata corresponding to this log entry.

[0067] In this system, the bit code is a binary number where each bit takes the value 1 or 0. 1 indicates a constant value, and 0 indicates a dynamic variable value. The length of the bit code equals the number of constant values ​​plus the number of dynamic variables. Using this encoding structure, the output order can be determined by scanning the bit code sequentially from the most significant bit to the least significant bit. The memory pointer points to the address of the beginning of the array. During program execution, this pointer allows direct location of the array and reading of each encrypted constant data block.

[0068] The constructed metadata is added to the pre-created global metadata table, which is used to centrally store the metadata corresponding to all log statements. The data table assigns a unique identifier to the newly added metadata, namely the template ID (identity).

[0069] Then, the code is rewritten, replacing the original log function call nodes in the syntax tree with preset generic encrypted log function call nodes. The input parameters of the functions are set to the template ID and all variable parts in the alternation sequence, while the rest of the syntax structure remains unchanged. After the rewrite, the log code is obtained. For example, the original code printf("Client %s", ip) is converted to encrypted_log(0, ip), where 0 is the index of the log statement in the global metadata table.

[0070] In addition, the encrypted constant data block obtained during compilation will be embedded as literal data into the read-only data segment (.rodata) of the executable program to be generated, so that the encrypted constant data block can be directly read at runtime and cannot be modified at runtime.

[0071] During the code conversion process, the compiler needs to handle details such as variable type conversion, memory management, and error handling to ensure that the generated code is semantically equivalent to the original log statements.

[0072] This implementation records the order of data segments using bit encoding, constructs metadata by combining it with pointers to an array of encrypted constants, stores it in a global metadata table, and assigns a unique identifier. It rewrites log function calls, eliminating the plaintext of the original format string, and instead uses the identifier to reference the metadata, effectively hiding the log template and providing support for generating encrypted log data at runtime.

[0073] In some optional implementations of the embodiments of this disclosure, the compilation method for log encryption described above further includes: performing backend processing on the target code to generate machine code; and step 208 described above can be executed as follows: linking and integrating the machine code, encrypted constant data block, global metadata table, and library files that the executable program to be generated depends on to generate an executable program.

[0074] In this implementation, the compiled target code undergoes compiler backend processing, including instruction selection and register allocation, converting the target code into corresponding machine code. The linker then obtains this machine code, the encrypted constant data block, the populated global metadata table, and the library files that the executable program depends on. The linker performs symbol resolution and address relocation, deploys the encrypted constant data block to the executable program's .rodata read-only data segment, deploys the global metadata table to the data segment, and then links and integrates the machine code, data segment information, and library files to finally generate the executable program.

[0075] This implementation converts the target code into machine code through backend processing. During the linking phase, it integrates the machine code, encrypted constant data blocks, global metadata table, and dependency library files to complete data segment deployment and address relocation, generate an executable program, solidify the ciphertext and metadata, eliminate plaintext logs, and ensure the normal operation of subsequent encrypted logs.

[0076] In some optional implementations of the embodiments of this disclosure, the above-described linking and integrating of machine code, encrypted constant data blocks, global metadata table, and library files depended by the executable program to generate an executable program can be performed as follows: deploying the encrypted constant data blocks to the read-only data segment of the executable program to be generated; deploying the global metadata table to the static read-write data segment of the executable program to be generated, and embedding a key into the static read-write data segment; performing symbol resolution and address relocation on the machine code; and linking and integrating the relocated machine code, library files, and information of each data segment to generate an executable program.

[0077] In this implementation, during the linking phase, a data deployment operation is first performed. The encrypted constant data blocks, which were encrypted during the compilation phase, are deployed to the read-only data segment `.rodata` of the executable program to be generated. Data within this segment can only be read during program execution, not modified, to prevent tampering with the encrypted constant data blocks at runtime. Next, the global metadata table, populated with metadata corresponding to each log entry, is deployed to the static read-write data segment of the executable program. Simultaneously, the key used for encrypting dynamic variables at runtime is embedded in this static read-write data segment, allowing the program to read this key to perform encryption operations during execution.

[0078] Subsequently, symbol resolution and address relocation are performed on the machine code output by the compiler backend. This involves resolving the symbols referenced in the machine code, correcting the memory access addresses corresponding to the code and data, and completing address mapping to ensure the code can correctly access the global metadata table, keys, and encrypted constant data blocks within the read-only data segment. After relocation, the relocated machine code, the library files the program depends on, the read-only data segment, and the segment information of the static read-write data segment are linked together to complete segment merging and space layout, ultimately outputting a complete executable program.

[0079] This implementation deploys encrypted constant data blocks, a global metadata table, and keys separately during the linking phase. A read-only segment protects the ciphertext constants, while a read-write segment allows runtime access to the metadata and keys. Linking is completed after symbol resolution and address relocation, generating an executable program, eliminating plaintext logs, and supporting runtime log encryption.

[0080] Please refer to Figure 3 , Figure 3A flowchart of a log encryption method provided in this disclosure embodiment, wherein process 300 includes the following steps: Step 301: During the execution of the executable program, in response to the execution of the log statement, the variable part in the log statement is encrypted to generate an encrypted variable data block.

[0081] The log encryption method runs on the target device (i.e., the user-side device) or web server, which is the hardware environment where the application is ultimately deployed and run. In this embodiment of the disclosure, during the execution of the executable program, when the program execution flow reaches the location of the rewritten encrypted log function call, that is, in response to the execution of the log statement, the encrypted log function is triggered to execute. The function receives the passed template identifier and dynamic variables. The template identifier is used as an index to look up the pre-set global metadata table inside the executable program, reads the corresponding metadata, and obtains the array pointer and bit encoding of the encrypted constant data block from the metadata.

[0082] Then, each bit of the parsed bit encoding is scanned sequentially, and the current segment is distinguished as either a constant part or a variable part based on the bit value. If the corresponding bit represents a constant part, the pre-encrypted encrypted constant data block in the read-only data segment is read directly through the array pointer; if the corresponding bit represents a variable part, the actual value of the variable at runtime is retrieved, and the key embedded in the static data segment of the program is used to perform encryption operation on the dynamic variable value to generate an encrypted variable data block.

[0083] The executable program pre-configures encrypted constant data blocks corresponding to the constant portions of the log statements. The executable program is the compiled program file, and the constant portion refers to the fixed text content in the log format string. During the compilation stage, encryption is performed using a key to generate encrypted constant data blocks, and this encrypted data is directly written into the static data segment inside the executable program.

[0084] Step 302: Generate encrypted log data based on the encrypted constant data block and the encrypted variable data block.

[0085] In this step, each data block is organized according to the format of "4-byte length field + ciphertext data". Following the order recorded by the bit encoding, the encrypted constant data block and the encrypted variable data block are sequentially concatenated and output to form complete encrypted log data. The encrypted log data can be in the form of a data stream. A data stream refers to the complete flow path and transformation sequence of data from input, through a series of processing nodes, transformations, and transmissions, until the output. This encrypted log data can be output to a serial port, a local log file, or sent over a network. The original plaintext content of the log is not present in the data. Each data block uses the format of "4-byte length field + ciphertext data". The 4-byte length field stores the byte length of the ciphertext data. The parser first reads the 4 bytes to obtain the ciphertext length, and then reads the corresponding bytes of ciphertext data based on that length.

[0086] According to the log encryption method provided in this disclosure, during the execution of the executable program, in response to the execution of a log statement, the variable portion of the log statement is encrypted to generate an encrypted variable data block. The executable program pre-sets encrypted constant data blocks corresponding to the constant portion of the log statement. Then, encrypted log data is generated based on the encrypted constant data blocks and the encrypted variable data blocks. Thus, the variable portion of the log is encrypted in real-time during program execution, and combined with the encrypted constant data blocks pre-set during the compilation stage, encrypted log data is assembled. This eliminates the need to concatenate the complete log string in plaintext, avoids exposing the complete plaintext log in memory, reduces the risk of plaintext log leakage, simplifies security processing logic, and ensures the security of log data transmission and storage.

[0087] Please refer to Figure 4 , Figure 4 A flowchart of another log encryption method provided in this disclosure embodiment, wherein process 400 includes the following steps: Step 401: During the execution of the executable program, in response to the execution of a log statement, determine the metadata corresponding to the identifier information of the log statement from the global metadata table, and obtain the pointer and bit encoding corresponding to the array of encrypted constant data blocks from the metadata.

[0088] In this embodiment of the disclosure, during the execution of the executable program, when the program execution flow reaches the location of the rewritten encrypted log function call, the log statement is executed. Using the identification information (template ID) passed in as the function input parameter as an index, the global metadata table deployed in the static read / write data segment is accessed to find the metadata that matches the template identifier. From the found metadata, the pointers corresponding to the arrays composed of encrypted constant data blocks, as well as the bit codes representing the arrangement order of constants and variables, are read for subsequent log data assembly and encryption.

[0089] In this context, bit encoding is used to represent the arrangement order of constant and variable parts in the log statement. A bit encoding is a binary number where each bit is either 1 or 0. 1 indicates a constant part, and 0 indicates a dynamic variable part. The length of the bit encoding equals the number of constants plus the number of dynamic variables. Using this encoding structure, the output order can be determined by scanning the bit encoding sequentially from the most significant bit to the least significant bit. The memory pointer points to the address of the beginning of the array. During program execution, this pointer allows direct location of the array and reading of each encrypted constant data block.

[0090] As an example, when the program runs to the encrypted log function with the template ID "ID-05", it retrieves the global metadata table with ID-05, reads the pointer to the encrypted constant array and the 5-bit code stored in the metadata, and can locate the three encrypted constant data blocks in the .rodata read-only data segment by using the pointer, and identify the type of each fragment according to the bit code.

[0091] Step 402: Determine the variable portion in the alternating sequence based on the bit encoding, and encrypt the determined variable portion using a preset key to obtain an encrypted variable data block.

[0092] In this embodiment of the disclosure, the bit encoding in the metadata is read, and the bit encoding is scanned bit by bit. Based on the value of each bit, it is determined whether the current segment belongs to the constant part or the variable part. When the segment belonging to the variable part is identified, the real-time running value corresponding to the variable part is extracted from the input parameters of the encrypted log function. The key embedded in the static read and write data segment is read, and the key is used to perform encryption operation on the real-time value of the variable to generate an encrypted variable data block.

[0093] The alternation sequence is a sequence containing constant and variable parts generated based on the original order of the format strings in the log statement. Specifically, it strictly follows the original order of the segments in the log statement's format strings, alternating between constant and variable parts to generate the alternation sequence, based on the constant text and the input parameters corresponding to the placeholders in the log statement.

[0094] For example, starting from the most significant bit, each bit of the bit encoding is scanned sequentially: if the bit is 1 (indicating a constant part), the pre-encrypted constant ciphertext data block is directly output (format: [4-byte length][ciphertext data]); if the bit is 0 (indicating a dynamic variable part), the corresponding variable value is obtained from the variable parameter list, encrypted using the embedded public key or symmetric key, and then the encrypted data block is output (format: [4-byte length][ciphertext data]).

[0095] This step involves retrieving metadata based on the template ID during program runtime, obtaining an array pointer and bit encoding, identifying the variable portion using the bit encoding, and encrypting the real-time value of the variable using the key to obtain an encrypted variable data block. This eliminates the need to carry the original log format string, achieving runtime encryption of dynamic variables and providing the data foundation for generating encrypted log data.

[0096] Step 403: Combine the encrypted constant data block and the encrypted variable data block according to the arrangement order represented by the bit encoding to obtain the encrypted log data.

[0097] In this embodiment, each bit of the bit encoding is traversed sequentially according to its original arrangement order as a constant and a variable. If the corresponding bit is a constant, the corresponding encrypted constant data block is read through the array pointer; if the corresponding bit is a variable, the already generated encrypted variable data block is used. Each data block is concatenated sequentially according to the format [4-byte length field][ciphertext data] to obtain a complete encrypted log data stream. It should be noted that the output order of all data blocks strictly follows the arrangement order of the constant and dynamic parts in the original log statement, thereby ensuring that the original log content can be correctly restored after decryption.

[0098] According to the log encryption method provided in this disclosure, the log format string is parsed during the compilation stage to distinguish between constant text and variable parts corresponding to placeholders. An alternating sequence is constructed to encrypt the constant parts in advance and complete the code conversion. The original format string is no longer stored in plaintext in the program during compilation. During program execution, metadata and bit encoding are read based on the identification information, and only the actual values ​​of variables obtained at runtime are encrypted. The constant ciphertext is pre-completed during the compilation stage, thus reducing the amount of encryption computation at runtime. At the same time, the log template is not stored in plaintext in the executable program, reducing the risk of reverse analysis revealing the log format, thus balancing log security and program performance.

[0099] In some optional implementations of the embodiments of this disclosure, the above-mentioned log encryption method further includes: sequentially reading each encrypted data block in the encrypted log data, decrypting the read encrypted data block according to the log encryption method to obtain the corresponding decrypted data block; concatenating each decrypted data block according to the arrangement order of each encrypted data block in the encrypted log data to generate the original log text, wherein the original log text is the log output content formed after the actual values ​​of the variable parts of the log statement are filled in.

[0100] In this implementation, the log parsing system acquires encrypted log data. This data stream consists of multiple data blocks sequentially, each using a format of "4-byte length field + ciphertext data". The parsing process iteratively performs data block reading operations: first, it reads the 4-byte length field from the data stream and parses it to obtain the length value of the current ciphertext data; then, based on this length value, it reads the corresponding byte length of the ciphertext data block from the data stream.

[0101] The encryption method used during the compilation phase is identified. If symmetric encryption is used, the corresponding symmetric key is used; if asymmetric encryption is used, the private key paired with the public key used during the compilation phase is used to perform decryption operations on the read ciphertext data block to obtain the decrypted plaintext data block. The read and decryption steps are repeated until the entire encrypted log data is processed.

[0102] The original order of each data block within the encrypted log data stream is strictly maintained. The plaintext obtained from each decrypted block is sequentially appended to the output buffer for concatenation, resulting in the original log text. This original log text is the complete log output content formed after the variable parts of the original log statements are filled with their actual values.

[0103] Since the constant parts at compile time and the dynamic parts at runtime are encrypted using the same / related keys, the parsing system does not need to distinguish their origins and can simply decrypt them in sequence.

[0104] This implementation method reads the encrypted log data stream block by block according to the format, selects the corresponding key to decrypt the data block according to the encryption method, and concatenates the plaintext in the original order to restore the original log text after filling in the actual values ​​of the variables, thus achieving reliable restoration and parsing of encrypted logs.

[0105] To enhance understanding, the compilation method and log encryption method for log encryption in this disclosure embodiment will be illustrated below with a specific application scenario.

[0106] The application scenario is as follows: This embodiment applies to a web server application developed in C language. This server needs to record access logs for all HTTP (Hypertext Transfer Protocol) requests, including client IP (Internet Protocol) address, request time, request method, request path, HTTP status code, and other information. Since the access logs may contain sensitive information (such as client IP, user authentication information, etc.), the logs need to be encrypted and stored, but this should not significantly impact the server's request processing performance.

[0107] The specific implementation environment is as follows: Compiler: GCC, which extends the encrypted log function of this invention; OpenSSL library provides encryption algorithm support; Encryption parameters: RSA-2048 asymmetric encryption algorithm is used, the public key is used for encryption at compile time and runtime, and the private key is exclusively held by the log parsing system; The log output format adopts the length prefix method, and the length field is a 4-byte unsigned integer.

[0108] The specific implementation process is as follows: 1. Extend the GCC compiler: First, modify the GCC compiler source code to add logging statement recognition and static analysis functionality to the C frontend. Specific modifications include: a) Adding recognition logic for logging functions such as `printf`, `fprintf`, and `syslog`, triggering subsequent processing when these function calls are encountered. b) Adding a special processing branch for logging statements during the compiler's Intermediate Representation (IR) construction phase to extract the format string parameters and variable argument lists of logging functions. c) Adding a processing step during compilation to convert the identified logging statements, replacing the original logging calls with encrypted logging calls.

[0109] 2. Implement the compiler's static analysis module: Implement a format string splitting algorithm. The core idea of ​​this algorithm is to decompose the format string into an alternating sequence of constant and dynamic parts according to the position of the placeholders. The specific implementation steps are as follows: First, the system scans from the beginning of the format string, searching for the first placeholder (such as "%s", "%d", "%f" in C). If a placeholder is found, the text from the beginning to the placeholder is treated as a constant part, and its content and position within the format string are recorded. Then, the type of the placeholder is parsed (e.g., %s for string, %d for integer), and treated as a dynamic part, recording its type and corresponding parameter index.

[0110] Next, continue scanning from the position after the placeholder, repeating the above process until the entire format string has been scanned. If there are no placeholders in the remaining text, then the remaining text is treated as a constant.

[0111] Through the above process, a sequence consisting of alternating constant and dynamic parts can be obtained. The compiler stores this alternating sequence as an internal data structure, recording the type (constant or dynamic), position, content (for constant parts) or parameter index (for dynamic parts) of each part, providing necessary information for subsequent compile-time encryption and code transformation.

[0112] 3. Encrypting constants at compile time: The specific implementation of encrypting constant strings using an RSA public key is as follows: First, load the pre-generated RSA public key, which will exist in pair with the private key used for decryption. Then, for each constant part identified in step 2, perform the encryption operation sequentially. The encryption process includes: obtaining the content and length of the constant string, calling the RSA public key encryption algorithm, and converting the plaintext into ciphertext.

[0113] After encryption, the compiler embeds the ciphertext data as a constant array into the read-only data segment (.rodata segment) of the target program. This embedded ciphertext data can be directly read and output during program runtime without re-encryption calculation.

[0114] The compiler generates metadata for each ciphertext block, including data length and encryption information, so that it can be used for correct output at runtime and subsequent decryption.

[0115] 4. The compiler performs code transformation: Original code example: printf("Client %s requested %s %s, status %d\n", client_ip, method, path, status); Static analysis splitting results at compile time: The constants include: C1="Client", C2="requested", C3="", C4=", status", C5="\n"; The dynamic part includes: D1=client_ip, D2=method, D3=path, D4=status; The output order is: C1→D1→C2→D2→C3→D3→C4→D4→C5; The bit encoding is: CDCDCDCDC=0b101010101 (1 represents a constant, 0 represents a variable).

[0116] The compiler maintains a global metadata table. Whenever a new log statement is processed, the corresponding metadata is generated and stored in the global metadata table, and a consecutive index is assigned to the stored metadata as a template ID.

[0117] 5. Compile and run: The web server program was compiled using the extended GCC compiler. After compilation, the resulting executable file included encrypted logging functionality.

[0118] 6. Runtime log output: When the web server is running, it outputs an encrypted log data stream (in hexadecimal representation) for each HTTP request it processes.

[0119] 7. Runtime log output: The log parsing system reads the encrypted log file, decrypts it using a private key, and restores the original log text after filling in the actual values ​​of the variables.

[0120] The above method can achieve the following technical effects: 1. By dividing log encryption into two phases—compile-time and runtime—constant portions (format strings, constant text, etc.) in the log are pre-encrypted at compile time, while only dynamic variable values ​​are encrypted at runtime. Since constant portions often constitute a large proportion of log content (especially for structured logs and logs containing fixed prompts), this phased encryption method can shift most of the encryption computation to compile time, thereby significantly reducing the encryption workload at runtime. 2. Although a phased encryption strategy is employed, the security of the logs is not compromised. Both the compile-time encrypted constant portion and the runtime encrypted dynamic portion are protected using the same encryption algorithm and key. For attackers, without the corresponding private key or decryption key, it is impossible to distinguish between compile-time encrypted data and runtime encrypted data, nor can they decrypt any part of the content. Therefore, the above method completely maintains the confidentiality of the logs while reducing runtime overhead.

[0121] 3. Through compiler extensions and code transformation technologies, a transparent log encryption mechanism is implemented for developers. Developers do not need to modify existing log code or learn new log APIs (Application Programming Interfaces). They only need to specify the corresponding compilation options during compilation, and the compiler will automatically complete the identification, static analysis, constant encryption, and code transformation of log statements. This zero-intrusive design greatly reduces integration costs. Furthermore, when the encryption strategy needs to be adjusted (such as changing the encryption algorithm or adjusting the key length), developers do not need to modify the source code; they only need to reconfigure the compiler parameters or key file and recompile the program.

[0122] Further reference Figure 5 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a compilation apparatus for log encryption, which is similar to... Figure 1 The example shown corresponds to the compilation method embodiment for log encryption.

[0123] like Figure 5As shown, the compilation apparatus 500 for log encryption in this embodiment of the present disclosure may include: a code parsing module 501, a constant encryption module 502, and a program generation module 503. The code parsing module 501 is configured to parse log statements in a source code file to determine the constant portions of the log statements; the constant encryption module 502 is configured to encrypt the constant portions to generate encrypted constant data blocks; the program generation module 503 is configured to embed the encrypted constant data blocks into an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt the variable portions of the log statements to generate encrypted variable data blocks during runtime, and to generate encrypted log data based on the encrypted constant data blocks and the encrypted variable data blocks.

[0124] In some optional implementations of the embodiments of this disclosure, the specific processing of the code parsing module 501, the constant encryption module 502, and the program generation module 503, and the resulting technical effects, can be referred to respectively. Figure 1 The relevant descriptions of steps 101-103 in the corresponding embodiments will not be repeated here.

[0125] In some optional implementations of the embodiments of this disclosure, the compilation apparatus 500 for log encryption further includes: a node determination module, configured to determine a first node of function call type from the abstract syntax tree corresponding to the source code file; match the called function name corresponding to the first node with a preset log function name, and determine a target node based on the matching result; extract log call information corresponding to the target node, wherein the log statement includes log call information.

[0126] In some optional implementations of the embodiments of this disclosure, the code parsing module is further configured to: extract the format string carried by the log function called by the target node; parse the format string to determine the constant text in the format string; wherein the constant part includes constant text.

[0127] In some optional implementations of the embodiments of this disclosure, the compilation device 500 for log encryption further includes: a variable determination module configured to determine placeholders in a format string and use the input parameters corresponding to the placeholders as variable parts; a sequence generation module configured to generate an alternating sequence of constant parts and variable parts according to the original arrangement order of each format string in the log statement; and a constant encryption module including: an encryption submodule configured to encrypt each constant part in the alternating sequence using a preset key to obtain a corresponding encrypted constant data block.

[0128] In some optional implementations of the embodiments of this disclosure, the program generation module includes: a code conversion submodule, configured to perform code conversion based on log statements, encrypted constant data blocks, and variable portions in alternating sequences to generate log code; a compilation submodule, configured to perform compilation processing on the log code and the remaining code to generate target code, wherein the remaining code is the code in the source code file excluding the log statements; and a linking submodule, configured to perform linking processing on the target code to obtain an executable program.

[0129] In some optional implementations of the embodiments of this disclosure, the code conversion submodule is further configured to: generate metadata based on the bit encoding generated by the alternating sequence and the pointer corresponding to the array composed of encrypted constant data blocks, wherein the bit encoding is used to characterize the arrangement order of the constant part and the variable part in the log statement; add the metadata to a preset global metadata table and determine the identification information of the metadata in the global metadata table; replace the original log function in the log statement with a preset encrypted log function, and use the identification information and the variable part in the alternating sequence as the input parameters of the encrypted log function to obtain the log code.

[0130] In some optional implementations of the embodiments of this disclosure, the compilation apparatus 500 for log encryption further includes: a backend processing module configured to perform backend processing on the target code to generate machine code; and a linking submodule including: a linking unit configured to link and integrate the machine code, encrypted constant data blocks, global metadata table, and library files depended by the executable program to be generated, to generate an executable program.

[0131] In some optional implementations of the embodiments of this disclosure, the linking unit is further configured to: deploy the encrypted constant data block to the read-only data segment of the executable program to be generated; deploy the global metadata table to the static read-write data segment of the executable program to be generated, and embed the key into the static read-write data segment; perform symbol resolution and address relocation on the machine code; and link and integrate the relocated machine code, library files, and information of each data segment to generate the executable program.

[0132] This embodiment exists as a device 500 embodiment corresponding to the above method embodiment. The key steps or equivalent technical means that can be implemented by each component in the compilation device 500 embodiment for log encryption provided in this embodiment, as well as the technical effects brought about by this device embodiment, can be referred to the relevant descriptions in the above method embodiments, and will not be repeated here.

[0133] Further reference Figure 6 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a log encryption device, which is similar to... Figure 3The illustrated log encryption method corresponds to the example provided.

[0134] like Figure 6 As shown, the log encryption device 600 of this embodiment may include a variable encryption module 601 and an encrypted log generation module 602. The variable encryption module 601 is configured to, during the execution of an executable program, encrypt the variable portion of a log statement to generate an encrypted variable data block in response to the execution of that log statement. The executable program pre-sets encrypted constant data blocks corresponding to the constant portions of the log statements. The encrypted log generation module 602 is configured to generate encrypted log data based on the encrypted constant data blocks and the encrypted variable data blocks.

[0135] In some optional implementations of the embodiments of this disclosure, the specific processing of the variable encryption module 601 and the encrypted log generation module 602 and the resulting technical effects can be referred to respectively. Figure 3 The relevant descriptions of steps 301-302 in the corresponding embodiments will not be repeated here.

[0136] In some optional implementations of the embodiments of this disclosure, the variable encryption module is further configured to: determine the metadata corresponding to the identifier information of the log statement from the global metadata table, and obtain the pointer and bit code corresponding to the array of encrypted constant data blocks from the metadata, wherein the bit code is used to characterize the arrangement order of the constant part and the variable part in the log statement; determine the variable part in the alternation sequence according to the bit code, and encrypt the determined variable part using a preset key to obtain the encrypted variable data block, wherein the alternation sequence is a sequence containing the constant part and the variable part generated according to the original arrangement order of each format string in the log statement.

[0137] In some optional implementations of the embodiments of this disclosure, the encrypted log generation module is further configured to: concatenate and combine the encrypted constant data block and the encrypted variable data block according to the arrangement order represented by the bit encoding to obtain encrypted log data.

[0138] In some optional implementations of the embodiments of this disclosure, the log encryption device 600 further includes: a decryption module, configured to sequentially read each encrypted data block in the encrypted log data, decrypt the read encrypted data block according to the log encryption method to obtain the corresponding decrypted data block; and concatenate each decrypted data block according to the arrangement order of each encrypted data block in the encrypted log data to generate the original log text, wherein the original log text is the log output content formed after the actual values ​​of the variable parts of the log statement are filled in.

[0139] This embodiment exists as a device 600 embodiment corresponding to the above method embodiment. The key steps or equivalent technical means that can be implemented by each component in the log encryption device 600 embodiment provided in this embodiment, as well as the technical effects brought about by this device embodiment, can be referred to the relevant descriptions in the above method embodiments, and will not be repeated here.

[0140] According to embodiments of the present disclosure, the present disclosure also provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute a compilation method for log encryption as described in any implementation of the first aspect or a log encryption method as described in any implementation of the second aspect.

[0141] According to embodiments of this disclosure, this disclosure also provides a non-transitory computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, can implement the compilation method or log encryption method for log encryption described in any of the above embodiments.

[0142] For example, a compilation method for log encryption or a computer instruction corresponding to a log encryption method in this disclosure embodiment can be stored on a storage medium such as an optical disc, hard disk, or USB flash drive. When the computer instruction corresponding to the compilation method for log encryption or the log encryption method in the storage medium is read or executed by a computer, the compilation method for log encryption or the log encryption method as described in any of the above embodiments can be implemented.

[0143] According to embodiments of this disclosure, this disclosure also provides a computer program product including a computer program that, when executed by a processor, can implement the compilation method or log encryption method for log encryption described in any of the above embodiments.

[0144] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device 700 proposed in embodiments of the present disclosure includes a processor 701 and a memory 702 storing an executable computer program. When the processor 701 executes the executable computer program stored in the memory 702, it implements the compilation method or log encryption method for log encryption provided in embodiments of the present disclosure.

[0145] In some optional implementations of the embodiments of this disclosure, the electronic device 700 may further include a communication interface 703 and a bus 704 for connecting the processor 701, the memory 702 and the communication interface 703.

[0146] In some optional implementations of the embodiments of this disclosure, bus 704 is used to connect communication interface 703, processor 701 and memory 702 to realize mutual communication between these devices.

[0147] In some optional implementations of the embodiments of this disclosure, the processor 701 may be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), Controller, Microcontroller, and Microprocessor. It is understood that, for different devices, the electronic device used to implement the function of the processor 701 may also be other, and the embodiments of this disclosure do not specifically limit it.

[0148] The aforementioned memory 702 is used to store executable computer programs and data. The executable computer program includes computer operation instructions. Memory 702 may include high-speed RAM and may also include non-volatile memory, such as at least two disk drives. In practical applications, the aforementioned memory 702 can be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or a combination of the above types of memory, and provides executable computer programs and data to the processor.

[0149] Furthermore, the functional modules in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional module.

[0150] If the integrated units described above are implemented as software functional modules and not sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure embodiment, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the method of this disclosure embodiment. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] According to the technical solution of this disclosure, by pre-encrypting the constant portion of the log statements and embedding it into the executable program during the compilation stage, the executable program no longer stores the plaintext of the log constants, thus avoiding the direct acquisition of the log template through reverse engineering of the binary program. During program execution, only dynamic variables are encrypted in real time, eliminating the need to assemble complete plaintext log strings in memory, preventing plaintext log leakage caused by memory dumping. The constant ciphertext can be directly reused, saving runtime encryption operations on fixed text and reducing computational and memory overhead from log output. The final output is encrypted log data composed of encrypted constant data blocks and encrypted variable data blocks in an ordered manner. Log transmission and storage are both conducted in ciphertext form, effectively reducing the risk of log information leakage and balancing log security with program performance.

[0152] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0153] It should also be understood that expressions such as "comprising," "including," "having," "containing," and / or "comprising" are open-ended rather than closed-ended expressions in this disclosure, indicating the presence of the stated features, elements, and / or components, but not excluding the presence of one or more other features, elements, components, and / or combinations thereof. Furthermore, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features, not just individual elements in the list. Additionally, when describing embodiments of this disclosure, the word "may" is used to mean "one or more embodiments of this disclosure." And the term "exemplary" is intended to refer to an example or illustration.

[0154] Unless otherwise specified, all terms used herein (including engineering and technical terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. It should also be understood that, unless expressly stated in this disclosure, terms as defined in common dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or overly formalized meaning.

[0155] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A compilation method for log encryption, characterized in that, The method includes: Parse the log statements in the source code file to determine the constant parts of the log statements; The constant portion is encrypted to generate an encrypted constant data block; The encrypted constant data block is embedded in an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt the variable part in the log statement to generate an encrypted variable data block during the running process, and generate encrypted log data based on the encrypted constant data block and the encrypted variable data block.

2. The method according to claim 1, characterized in that, The method further includes: Determine the first node of the function call type from the abstract syntax tree corresponding to the source code file; The name of the called function corresponding to the first node is matched with the preset log function name, and the target node is determined based on the matching result; Extract the log call information corresponding to the target node, wherein the log statement includes the log call information.

3. The method according to claim 2, characterized in that, The step of parsing the log statements in the source code file and determining the constant portion of the log statements includes: Extract the format string carried by the log function called by the target node; The format string is parsed to determine the constant text in the format string, wherein the constant part includes the constant text.

4. The method according to claim 3, characterized in that, The method further includes: Determine the placeholders in the format string, and use the input parameters corresponding to the placeholders as the variable part; Generate an alternating sequence of the constant portion and the variable portion according to the original order of the format strings in the log statement; and The step of encrypting the constant portion to generate an encrypted constant data block includes: Each constant portion in the alternating sequence is encrypted using a preset key to obtain the corresponding encrypted constant data block.

5. The method according to claim 4, characterized in that, The step of embedding the encrypted constant data block into the executable program includes: Log code is generated by performing code conversion based on the log statements, the encrypted constant data blocks, and the variable portions in the alternation sequence. The log code and the remaining code are compiled to generate target code, wherein the remaining code is the code in the source code file excluding the log statement; The target code is linked to obtain the executable program.

6. The method according to claim 5, characterized in that, The step of generating log code based on the log statements, the encrypted constant data blocks, and the variable portions of the alternating sequence includes: Metadata is generated based on the bit encoding generated by the alternating sequence and the pointers corresponding to the array composed of the encrypted constant data blocks, wherein the bit encoding is used to characterize the arrangement order of the constant part and the variable part in the log statement; The metadata is added to a preset global metadata table, and the identification information of the metadata in the global metadata table is determined; The original log function in the log statement is replaced with a preset encrypted log function, and the identification information and the variable part in the alternation sequence are used as the input parameters of the encrypted log function to obtain the log code.

7. The method according to claim 6, characterized in that, The method further includes: The target code is processed by backend to generate machine code; and The step of performing linking processing on the target code to obtain the executable program includes: The machine code, the encrypted constant data block, the global metadata table, and the library files that the executable program depends on are linked and integrated to generate the executable program.

8. The method according to claim 7, characterized in that, The step of linking and integrating the machine code, the encrypted constant data block, the global metadata table, and the library files that the executable program depends on to generate the executable program includes: Deploy the encrypted constant data block to the read-only data segment of the executable program to be generated; The global metadata table is deployed to the static read / write data segment of the executable program to be generated, and the key is embedded into the static read / write data segment; Perform symbol resolution and address relocation on the machine code; The relocated machine code, the library files, and the information of each data segment are linked and integrated to generate the executable program.

9. A log encryption method, characterized in that, The method includes: During the execution of the executable program, in response to the execution of a log statement, the variable portion of the log statement is encrypted to generate an encrypted variable data block. The executable program pre-sets an encrypted constant data block corresponding to the constant portion of the log statement. Encrypted log data is generated based on the encrypted constant data block and the encrypted variable data block.

10. The method according to claim 9, characterized in that, The step of encrypting the variable portion of the log statement to generate encrypted variable data blocks includes: Determine the metadata corresponding to the identifier information of the log statement from the global metadata table, and obtain the pointer and bit code corresponding to the array of the encrypted constant data block from the metadata, wherein the bit code is used to characterize the arrangement order of the constant part and the variable part in the log statement; The variable portion in the alternation sequence is determined according to the bit encoding, and the determined variable portion is encrypted using a preset key to obtain the encrypted variable data block. The alternation sequence is a sequence containing the constant portion and the variable portion generated according to the original arrangement order of each format string in the log statement.

11. The method according to claim 10, characterized in that, The step of generating encrypted log data based on the encrypted constant data block and the encrypted variable data block includes: The encrypted constant data block and the encrypted variable data block are concatenated and combined according to the arrangement order represented by the bit encoding to obtain the encrypted log data.

12. The method according to any one of claims 9-11, characterized in that, The method further includes: Read each encrypted data block in the encrypted log data sequentially, and decrypt the read encrypted data block according to the log encryption method to obtain the corresponding decrypted data block; The decrypted data blocks are concatenated according to the order in which the encrypted data blocks are arranged in the encrypted log data to generate the original log text. The original log text is the log output content formed by filling the actual values ​​of the variable parts of the log statements.

13. A compilation apparatus for log encryption, characterized in that, The device includes: The code parsing module is configured to parse log statements in source code files and determine the constant parts of the log statements; A constant encryption module is configured to encrypt the constant portion to generate an encrypted constant data block. The program generation module is configured to embed the encrypted constant data block into an executable program, wherein the executable program is obtained by compiling the source code file, and the executable program is used to encrypt the variable part in the log statement to generate an encrypted variable data block during the running process, and generate encrypted log data based on the encrypted constant data block and the encrypted variable data block.

14. A log encryption device, characterized in that, The device includes: The variable encryption module is configured to, during the execution of an executable program, in response to the execution of a log statement, encrypt the variable portion of the log statement to generate an encrypted variable data block, wherein the executable program pre-sets an encrypted constant data block corresponding to the constant portion of the log statement; The encrypted log generation module is configured to generate encrypted log data based on the encrypted constant data block and the encrypted variable data block.

15. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the compilation method for log encryption according to any one of claims 1-8 or the log encryption method according to any one of claims 9-12.

16. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the processor to execute the compilation method for log encryption according to any one of claims 1-8 or the log encryption method according to any one of claims 9-12.

17. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the compilation method for log encryption according to any one of claims 1-8 or the log encryption method according to any one of claims 9-12.

Images