Log management system and log management method

Abstract

To rapidly determine the presence or absence of interpolation of log data and identify illegal log when an information security event occurs.SOLUTION: Facilities 25 (25a, 25b, ...) of a log management system 10A connected with a network 20 and generating and storing log data 26 comprises: receiving means 13 which receives the log data 26 as a log assemblage which is classified into a plurality of categories; calculation means 14 which calculates an authentication code from the corresponding log data 26 of the log assemblage based on a priority level of the category or a selection procedure; storage means 15 which stores the authentication code; and comparison means 17 which compares the authentication code stored when the log data 26 was generated with the authentication code calculated thereafter.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a log management technique in a computer network. [Background technology]

[0002] Connecting equipment to a computer network makes the sharing and transmission of information and data extremely efficient. However, when an incident occurs that threatens information security, it is important to determine the cause and identify the extent of the damage. Furthermore, it is necessary to prevent the damage from spreading and to recover quickly. To achieve this, it is effective to investigate log data that records network usage (forensic investigation). However, before conducting an investigation, it is necessary to confirm that the log data itself has not been tampered with and is intact.

[0003] As an example of a conventional technique for detecting whether log data has been tampered with, there is a method of storing multiple split data obtained by dividing the time series of generated log data and hash values ​​calculated from each of the split data. After detecting a security event, the hash value of the split data is recalculated and compared with the previously calculated and stored hash value. If the comparison results of the two hash values ​​do not match, it is determined that the corresponding split data contains a tampered unauthorized log. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 5045489 Summary of the Invention [Problem to be solved by the invention]

[0005] In the above technology, the log data accumulated from time to time is divided into a certain amount of data, and a huge amount of divided data and its hash value are stored. There was a problem that it takes a long time to recalculate the hash values ​​of the huge amount of stored divided data and compare them with the previously calculated hash values. Therefore, when a security incident occurs, it is difficult to quickly provide a healthy log for investigation.

[0006] An embodiment of the present invention has been made in consideration of the above circumstances, and aims to provide a log management technology that can quickly provide a healthy log for investigation when an information security incident occurs. [Means for solving the problem]

[0007] In a log management system according to an embodiment, a log collection is formed in a facility connected to a network for generating and storing log data, the log data being classified into a plurality of categories. The system includes a control means for requesting the facility to transfer the corresponding log collection in accordance with a priority order or a selection procedure of the category, a receiving means for receiving the log data transferred from the facility, a calculation means for calculating an authentication code from the received log data, a storage means for storing the authentication code, and a comparison means for comparing the authentication code stored at the time of the generation of the log data with the authentication code calculated thereafter. The authentication code is converted into binary data, concatenated in a preset order, and then converted into a one-way function. The system is characterized in that it is provided with a code combination means for determining an authentication code, or a search means for dividing the log aggregate into two and performing the comparison of the calculated authentication code from only one of the two divided bodies, and if the comparison results in a mismatch, dividing the divided body into two again and repeatedly performing the comparison of the calculated authentication code from only one of the two divided bodies, or a pre-inspection means for inspecting the number of binary values ​​after binary conversion of the received log data or the calculated authentication code to confirm whether the log data has been tampered with or not. Effect of the Invention

[0008] An embodiment of the present invention provides a log management technique that quickly determines whether log data has been tampered with and identifies unauthorized logs when an information security incident occurs. [Brief description of the drawings]

[0009] [Figure 1] 1 is a block diagram of a log management system according to a first embodiment of the present invention. [Diagram 2] FIG. 11 is a block diagram of a log management system showing a modified example of the first embodiment. [Diagram 3] FIG. 11 is a block diagram of a log management system according to a second embodiment. [Figure 4] FIG. 11 is a block diagram of a log management system according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] (First embodiment) Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings. FIG. 1 is a block diagram of a log management system 10A (10) according to a first embodiment of the present invention. FIG. 2 is a block diagram of a log management system 10B (10) showing a modified example of the first embodiment. The log management system 10A manages log data 26 of equipment 25 (25a, 25b, ...) that is connected to a network 20 and generates and stores log data 26. The log management system 10A (10) can be connected to the network 20 as needed, such as during inspection and maintenance, or can be connected at all times.

[0011] The log management system 10A further includes a control means 11 for requesting the equipment 25 (25a, 25b...) to transfer the corresponding log collection in accordance with the priority order or selection procedure of this category, a receiving means 13 for receiving the log data 26 transferred from the equipment 25 (25a, 25b...), a calculation means 14 for calculating an authentication code from the received log data 26, a storage means 15 for storing the authentication code, and a comparison means 17 for comparing the authentication code stored when the log data 26 was generated with the authentication code calculated thereafter. The equipment 25 (25a, 25b...) transfers the log data 26 at a fixed period or upon request of the control means 11.

[0012] The equipment 25 (25a, 25b, ...) is equipment, devices, computers, etc. connected to a local area network, an intranet, or a computer network in various facilities such as various factories, plants, production lines, social infrastructure facilities, and public facilities. It is also a maintenance device connected to the equipment or network. The log management system 10A may be directly connected to the maintenance device, or may also serve as the maintenance device. The log data 26 is information that is recorded by combining the contents and information about events such as the start, stop, operation during operation, operation, setting change, operation content, and communication with the outside of the equipment 25 with time, equipment identification information, etc.

[0013] The log data 26 may be transferred from the equipment 25 to the receiving means 13 at regular intervals, instead of being controlled by the control means 11. When controlled by the control means 11, the control means 11 is composed of a computer, calculator, PC, an electronic circuit or arithmetic device equipped with an FPGA or CPU, a controller, or the like, and a general-purpose or dedicated device may be applied. The control means 11 is connected to a network, and transmits a command to the equipment 25 to transfer the log data 26 of a log aggregate classified according to a category and having a high priority to the receiving means 13. The control means 11 may also transmit a transfer command for the corresponding log aggregate to the equipment 25 in accordance with a procedure for selecting a category by an operator's terminal operation.

[0014] 1, the control means 11 may be installed in each of the facilities 25 (25a, 25b, ...) in the network 20, or one unit may be installed for a predetermined number of facilities 25. Software having the functions of the control means 11 may also be installed in the facilities. Furthermore, the log data 26 can be made unnecessary by transferring it from the relevant facilities 25 to the receiving means 13 at regular intervals, rather than being controlled by the control means 11.

[0015] Examples of classification by category include security classification or zone, function or role, model, system, installation location, manufacturer or year of manufacture, type, format, and amount of stored information. When categories are defined by security classification, classes are set according to the importance of the security of the equipment, and equipment 25 is classified into 10 classes, for example. Log data 26 belonging to the same class is considered to be one log collection.

[0016] In this case, the number and types of log data 26 constituting one log collection are not limited, and the data do not need to be stored in association with one facility 25, and may be distributed throughout the facilities 25 (25a, 25b, ...) connected to the network 20. As another example, in the case of security zones, classes are set according to the importance of security for the zone, and the zones are classified into, for example, five levels. The facilities 25 are classified by zone, and log data 26 belonging to the same class is considered to be one log collection. In this case, a storage device (not shown) that collects and stores log data 26 of facilities 25 in the same zone can also be installed within the zone. The storage device can be composed of a NAS, a computer, and its storage device.

[0017] The one-way transfer means 12 transfers the log data 26 in only one direction from the equipment 25 (25a, 25b, ...) connected to the network 20 to the receiving means 13. The one-way transfer means 12 is configured, for example, with a light-emitting element such as an LED or LD as a transmitter and a light-receiving element such as a PD as a receiver. The one-way transfer means 12 transfers the log data 26 in only one direction from the equipment 25 to the receiving means 13 according to a priority order or selection procedure. The one-way transfer means 12 can completely prevent the leakage of the log data 26 and the authentication code from the receiving means 13 to the network 20. In addition, as shown in FIG. 2, when the one-way transfer means 12 (12a, 12b, 12) are installed in each of the independent networks 20 (20a, 20b, 20c), the control means 11 may be configured to be connected to some of the networks 20b and 20c.

[0018] The receiving means 13 is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, an arithmetic unit, a controller, etc., and may be a general-purpose or dedicated device. The receiving means 13 receives the log data 26 from the equipment 25 (25a, 25b, ...) by a main memory such as a register, a cache memory, or a RAM, and temporarily stores the log data 26 even if the generation timing or arrival time of the log data 26 is different.

[0019] The calculation means 14 has a calculation function and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, a calculation device, a controller, etc., and a general-purpose or dedicated device can be applied. The calculation means 14 calculates and obtains an authentication code from the log data 26, and transmits the authentication code to the storage means 15 or the matching means 17.

[0020] The authentication code can be calculated using a one-way function, a message authentication code calculated using an authenticated block cipher algorithm, or a digital signature. Specifically, for example, MD2, MD4, MD5, SHA-1, SHA-2, SHA-3, RIPEMD-128, and RIPEMD-160 can be used as one-way functions, CBC-MAC, CMAC, CCM, and GCM / GMAC can be used as authenticated block cipher algorithms, and RSA and DSA can be used as digital signatures.

[0021] The storage means 15 is composed of a computer, calculator, PC, electronic circuit with FPGA or CPU, arithmetic device, controller, etc., and general-purpose or dedicated devices can be applied. In addition to storage such as magnetic disks and SSDs, external storage devices such as USB memory, memory cards, CDs, DVDs, and Blue-rays can also be applied as the storage device. The storage means 15 stores the log data 26 transmitted from the receiving means 13 and the authentication code transmitted from the arithmetic means 14. Then, it transmits the stored log data 26 and authentication code to the verification means 17.

[0022] The pre-inspection means 16 has a calculation function and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, a calculation device, a controller, or the like, and may be a general-purpose or dedicated device. The pre-inspection means 16 receives the log data 26 transmitted from the receiving means 13 and the authentication code transmitted from the calculation means 14, and checks the parity to confirm that the log data 26 may have been tampered with. In checking the number of binary values ​​after binary conversion, the number of 1s or the number of 0s in the binary value of the log data 26 or the authentication code is calculated and stored in the pre-inspection means 16 or the storage means 15. When detecting tampering of the corresponding log data 26, the number of 1s in the corresponding log data 26 or its authentication code is found and compared with the number of 1s in the corresponding log data 26 stored in the pre-inspection means 16 or the storage means 15. This makes it possible to detect tampering of the corresponding log data 26 caused by a difference in the number of 1s. The pre-inspection means 16 can be omitted and can be provided as necessary.

[0023] The verification means 17 has a calculation function and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, a calculation device, a controller, etc., and a general-purpose or dedicated device can be applied. The verification means 17 verifies the authentication code transferred from the pre-inspection means 16 with the authentication code stored in the storage means 15. If the verification matches, it means that the log data 26 on which the authentication code is based has not been tampered with, and if they do not match, it means that an authentication error has occurred and the log data 26 has been tampered with.

[0024] (Operation of the first embodiment) When a security incident occurs, it is necessary to investigate the details, scope of impact, the date and time of occurrence and termination, the cause and countermeasures, the intrusion route and method, etc. For this reason, it is common to investigate and analyze various log data 26 of the equipment 25, but if the log data 26 itself has been tampered with, the investigation cannot be carried out correctly. Therefore, the log data 26 of the equipment 25 is provided for investigation after verifying that it has not been tampered with.

[0025] The equipment 25 connected via the network 20 transmits log data 26 to the receiving means 13 at predetermined time intervals. The log data 26 is transmitted at event unit times such as process processing such as control, calculation, and storage in the equipment 25, from starting up to stopping the equipment 25, and from logging in to logging out of the equipment 25.

[0026] Furthermore, when a predetermined amount of log data 26 is generated, when specific log data 26 is generated, when an event occurs, etc., the log data 26 can be transmitted from the equipment 25. Furthermore, instead of being controlled by the control means 11, the log data 26 can be transferred from the equipment 25 to the receiving means 13 at fixed intervals. The log data 26 of the equipment 25 is then transmitted to the receiving means 13 through the one-way transfer means 12. The one-way transfer means 12 makes it possible to receive the log data 26 from each equipment 25, but the log data 26 and authentication code stored in the receiving means 13 or storage means 15 do not flow out in the direction of the equipment 25.

[0027] The log data 26 of the equipment 25 is subjected to an authentication code calculation by the calculation means 14. In the calculation, a log set of the same security class (hereinafter, U r 25 facilities belonging to m Log data (hereinafter, L m ) are converted to binary, concatenated in a specified order, and then the authentication code (hereafter, C m (abbreviated as ).

[0028] In particular, C obtained from one-way functions m can be fixed to 512 bits or less, and L m The capacity can be reduced compared to C m is facility 25 m The information is stored in the storage means 15 together with the equipment name, model, serial number, etc. m is also stored in the storage means 15.

[0029] U in all classes r C m is calculated and stored in the storage means 15. Also, L m is also stored in the storage means 15. m If the amount of data or capacity is large, m Set the number of combinations of n, and generate n authentication codes (C m n (abbreviated as U r The authentication code of C m n n can be made to consist of L after bonding. m The number and capacity of the L m and C m or C m n is converted to binary, the number of 1's is found and stored in the storage means 15. Note that the pre-inspection means 16 is optional and can be provided as necessary.

[0030] The control means 11 is classified according to the priority of the security classification. r Specify U rThe currently stored log data from the equipment 25 belonging to m In addition, when the cause can be estimated, such as when the security incident is highly likely to be an unauthorized login to the facility 25, the U of the rank related to the login is acquired. r Priority will be given to acquiring 25 facilities.

[0031] In this way, by forming a log aggregate based on security classification and security incidents and setting priorities for the log aggregate, it is possible to quickly determine whether important log data 26 has been tampered with and to quickly identify unauthorized log data. m Convert these into binary values, concatenate them in the specified order, and convert them into the current authentication code (hereafter, C' m ), or the current n authentication codes (hereafter, C' m n It is known that one-way functions can be calculated in a very short time.

[0032] U r L' m When checking for tampering with L', first, the pre-inspection means 16 m or C' m or C' m n is converted to binary and the number of 1s is found. m or C m or C m n If the number of 1s in L' is different, it is determined that there has been tampering. m By analyzing the log data, it is possible to identify unauthorized logs. In this way, by converting the log data 26 or the authentication code into binary data and counting the number of 1's, it is possible to easily confirm that there has been tampering. Note that even if the number of 1's is the same, there is still a possibility of tampering. For this reason, the pre-inspection means 16 can be omitted, and can be provided as necessary.

[0033] Next, the collation means 17 checks C' output from the pre-inspection means 16. m or C'm n and C stored in the storage means 15 m or C m n C' m =C m When it is L' m There is no tampering with L' m An investigation into the security incident regarding C' m ≠C m When it is L' m There was a tampering with L' m By analyzing the log data 26, it is possible to identify unauthorized logs. In this way, the log data 26 is classified according to the category of the equipment 25, and a log collection is created for each category. By setting priorities and obtaining and comparing authentication codes for the log collection, it is possible to quickly identify whether important log data 26 has been tampered with and to quickly identify unauthorized log data. m or C' m n By storing this in the storage means 15, it is possible to maintain that the current state log data 26 is sound.

[0034] (Effects of the first embodiment) In this way, in the first embodiment, the log data 26 is classified according to a predetermined category to create a log collection for each category, and an authentication code for the log collection is obtained by setting a priority order, thereby making it possible to check that the log data has not been tampered with. This makes it possible to quickly obtain the log data required for the investigation. In addition, by storing the most recent authentication code in the storage means, it is possible to maintain the soundness of the current state of the log data.

[0035] Furthermore, by forming a log collection of the facility 25 based on the security classification and security incident, and by setting priorities and obtaining authentication codes for the log collection, it is possible to check that the log data 26 that is important from a security standpoint has not been tampered with. This makes it possible to quickly provide the log data required for an investigation.

[0036] Furthermore, while log data 26 can be received from each facility 25, the log data 26 and authentication code stored in the receiving means 13 and storage means 15 can be prevented from leaking out onto the network 20. This ensures that the log data 26 and authentication code to be collated are sound, and therefore log data 26 of important facilities 25 can be quickly provided for investigation.

[0037] Furthermore, the log data 26 or authentication code from each facility 25 is converted to binary data and the number of 1's is counted to quickly check for tampering. This makes it possible to detect tampering of the log data 26 even before the authentication code is verified, so that the log data 26 of important facilities 25 can be quickly provided for investigation. This pre-inspection means 16 is optional and can be provided as necessary.

[0038] Second embodiment Next, a second embodiment of the present invention will be described with reference to Fig. 3. Fig. 3 is a block diagram of a log management system 10C(10) according to the second embodiment. In Fig. 3, parts having the same configuration or function as Fig. 1 are indicated by the same reference numerals, and duplicated explanations will be omitted.

[0039] The log management system 10C of the second embodiment includes, in addition to a receiving means 13, a calculation means 14, a storage means 15, and a comparison means 17, a compression means 18 that compresses the volume of log data 26 transferred from equipment 25 (25a, 25b, ...) connected to the network 20 and transfers it to the receiving means 13, an addition means 19 that adds unique identification information of the equipment 25 (25a, 25b, ...) to the received log data 26 and then causes the calculation means 14 to calculate an authentication code, and a code combination means 21 that combines the log data 26 with the corresponding authentication code and stores it in the storage means 15.

[0040] The compression means 18 has a calculation function and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, a calculation device, a controller, etc., and a general-purpose or dedicated device can be applied. The compression means 18 can be installed in each of the equipment 25 (25a, 25b, etc.) connected to the network 20, or one unit can be installed for a predetermined number of equipment 25. Software having the function of the compression means 18 can also be installed in the equipment. The compression means 18 reversibly compresses the volume of the log data 26 of the equipment 25 and transmits it to the receiving means 13. Run-length coding, Huffman coding, Lempel-Ziv compression, etc. can be applied as a data compression method.

[0041] The adding means 19 has a storage device and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, an arithmetic device, a controller, etc., and a general-purpose or dedicated device can be applied. In addition to storage such as a magnetic disk or SSD, the storage device can also be an external storage device such as a USB memory, a memory card, a CD, a DVD, or a Blue-ray. The adding means 19 stores individual identification information of the equipment 25 (25a, 25b, ...), and when the calculation means 14 calculates an authentication code from the log data 26, the individual identification information of the relevant equipment 25 is added to the calculation. The individual identification information is digital information that can identify the equipment, such as the model / model number, specifications, type, purpose, manufacturer, production date, repair history, and serial number of the equipment.

[0042] The code combining means 21 has a calculation function and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, a calculation device, a controller, etc., and a general-purpose or dedicated device can be applied. The code combining means 21 calculates the authentication code calculated by the calculation means 14, and transmits it to the storage means 15 or the matching means 17. In the calculation, an arbitrary number of authentication codes are converted into binary and concatenated, and an authentication code is obtained by the same calculation as the calculation means 14.

[0043] (Operation of the second embodiment) As in the first embodiment, when verifying that the log data 26 of the equipment 25 has not been tampered with, there may be a large number of pieces of log data 26 of the equipment 25 to be investigated and verified. In such a case, the log data 26 in units of events is compressed by the compression means 18 and transmitted from the equipment 25 connected via the network 20. Alternatively, the log data 26 is compressed by the compression means 18 from the equipment 25 and transmitted at regular intervals.

[0044] The compressed log data 26 in the facility 25 is decompressed by the compression means 18 of the log management system 10C and then transmitted to the receiving means 13. Instead of transmitting the compressed data, the facility 25 can calculate an authentication code for the log data 26 from a one-way function and transmit it to the calculation means 14. By compressing the log data 26 and transmitting it over the network 20, rapid transmission can be achieved.

[0045] The log data 26 of the equipment 25 is subjected to a calculation by the calculation means 14 to calculate an authentication code. r L m Obtain individual information about each of Q L m The individual information is converted into binary data, and then concatenated to generate Q authentication codes (hereafter, PC m Next, the code combining means 21 obtains Q PC m After converting them into binary and concatenating them in a preset order, an authentication code is obtained from a one-way function and U r Certification code (hereinafter referred to as TC m TC m is stored in the storage means 15. This makes it possible to reduce the number of authentication codes even when the number of log data 26 constituting the log collection is large.

[0046] High Priority U r L' compressed and transmitted by the compression means 18 from the facility 25 belonging to m is decompressed by the compression means 18 and then transmitted to the receiving means 13. Then, U r L' m Obtain individual information for each of Q L' mThe individual information is converted into binary data, concatenated, and the current Q authentication codes (hereafter referred to as PC') are generated from the one-way function. m Furthermore, the code combining means 21 obtains Q PC's. m After converting the data into binary data and concatenating them in a preset order, the authentication code (hereinafter referred to as TC') is generated using a one-way function. m (abbreviated as ).

[0047] The collation means 17 checks whether the TC' output from the code combination means 21 is m and TC stored in the storage means 15 m Compare with TC' m =TC m When it is L' m There is no tampering with L' m An investigation into the security incident involving TC m and T.C.' m Since the authentication code including the individual information of the equipment 25 matches, it is possible to confirm that there is no error in the log data 26 of the important equipment 25 by including the individual information of the equipment 25 in the authentication code. m ≠TC m When it is L' m There was a tampering with U r By analyzing this, unauthorized logs can be identified.

[0048] (Effects of the second embodiment) In this way, in the second embodiment, the log data 26 of each facility 25 is compressed, transmitted over the network 20, and then decompressed after reception, thereby enabling rapid transmission of the log data 26. This allows the log data 26 of important facilities 25 to be quickly provided for investigation.

[0049] Furthermore, the authentication codes obtained for each log collection into which the log data 26 is classified can be combined to obtain an authentication code, and the authentication codes can be collated by setting priorities. This makes it possible to reduce the number of authentication codes even when the amount of log data 26 is large, so that the log data 26 of important equipment 25 can be quickly provided for investigation.

[0050] Furthermore, by adding individual information about the facility 25 to a log collection classified according to the category of the facility 25, and by setting priorities and obtaining an authentication code for the log collection, it is possible to check that the log data 26 has not been tampered with. This allows the facility 25 to be correctly authenticated, so that the log data 26 of important facility 25 can be quickly provided for investigation.

[0051] Third embodiment Next, a third embodiment of the present invention will be described with reference to Fig. 4. Fig. 4 is a block diagram of a log management system 10D(10) according to the third embodiment. In Fig. 4, parts having the same configuration or function as Fig. 1 are indicated by the same reference numerals, and duplicated explanations will be omitted.

[0052] The log management system 10C of the second embodiment includes, in addition to the receiving means 13, calculation means 14, storage means 15, and matching means 17 common to the first embodiment, a search means 27 which performs matching of an authentication code calculated from only one of the two divided bodies into which a log collection is divided, and if the matching result is a mismatch, further divides the divided body into two and repeatedly performs matching of an authentication code calculated from only one of the two divided bodies.

[0053] The search means 27 has a calculation function and is composed of a computer, a calculator, a PC, an electronic circuit equipped with an FPGA or a CPU, a calculation device, a controller, etc., and a general-purpose or dedicated device can be applied. The search means 27 calculates the authentication code of only one of the log collections divided into two and transmits it to the matching means 17. In this case, if the matching does not match, the log collection is further divided into two, and if the matching matches, the other log collection is obtained from the equipment, divided into two, and transmitted to the matching means 17. The search means 27 repeats the series of operations of obtaining, dividing, and matching the log collection.

[0054] (Operation of the third embodiment) As in the first and second embodiments, when verifying that the log data 26 of the facility 25 has not been tampered with, the volume of the log data 26 of the facility 25 to be inspected and verified may be very large.

[0055] Log data 26 from equipment 25 connected via network 20 is transmitted to receiving means 13. Receiving means 13 waits for log data 26 with different generation timings or transmission times, and receives log data 26. Then, log data 26 is considered as one log collection and is repeatedly divided into two.

[0056] And 2 p U r is formulated. r is one L m It may be divided into multiple or more L m It may also be composed of U r Data capacity and L m There is no restriction on the number of configurations. r If we set r = 1, 2, 3, ... z and specify the priority order in descending order, log aggregate 0: (U1~Uz), log aggregate 1: (U1~U z / 2 )(U z / 2+1 ~U z ), Log aggregate 2: (U1~U z / 4 )(U z / 4+1 ~U z / 2 )(U z / 2+1 ~U 3z / 4 )(U 3z / 4+1 ~U z )..., the log aggregates can be set in the order of priority "descending order". r belongs to m From C m Find z U z From C m are stored in the storage means 15, respectively.

[0057] (U1~U z / 2 ) belonging to L' m is transmitted to the receiving means 13, and L m ' to C m ' is required.

[0058] The collation means 17 compares the C output from the calculation means 14 m ' and stored in the storage means 15. mC' m =C m When it is L' m There is no tampering with L' m An investigation into the security incident will be launched.

[0059] (U z / 2+1 ~U z ) belonging to L' m is transmitted to the receiving means 13, and is calculated by the calculation means 14. z / 2+1 ~U 3z / 4 ) belonging to L m ' to C m In the collation means 17, C' m ≠C m When it is L' m Therefore, the data stored in the receiving means 13 (U z / 2+1 ~U 3z / 8 ) belonging to L m ' to C m C' is calculated again and collated by the collation means 17. m ≠C m When it is L' m There is tampering with the text.

[0060] On the other hand, if the tampering is in one place (U 3z / 4 ~U z ) has not been tampered with, so L' m An investigation into the security incident will be started. If tampering has occurred in multiple places, an authentication code will be obtained and compared. By repeatedly dividing and comparing the log data in this way, it is possible to quickly detect tampering with the log data of high-priority equipment and identify unauthorized logs, starting with the highest priority.

[0061] (Effects of the third embodiment) In the third embodiment, a log collection is divided into two, the log collection with the higher priority is transmitted and the authentication code is compared, and the mismatched log collection is further divided into two and the authentication code of the log collection with the higher priority is compared, and this process is repeated, so that it is possible to check for tampering and identify unauthorized log data starting from the log collection with the higher priority. In this way, by repeatedly dividing the log data of high-priority equipment and comparing its authentication code, it is possible to quickly provide log data 26 of important equipment 25 for investigation.

[0062] According to at least one of the log management systems of the above-described embodiments, a code is generated for each log aggregate divided from the time series of the logs classified by category, thereby obtaining important information. Logs can be provided quickly for investigation.

[0063] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, modifications, and combinations can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents described in the claims, as well as in the scope and spirit of the invention. [Explanation of symbols]

[0064] 10 (10A, 10B, 10C, 10D)...log management system, 11...control means, 12...one-way transfer means, 13...receiving means, 14...calculating means, 15...storing means, 16...pre-inspection means, 17...collating means, 18...compressing means, 19...adding means, 20 (20a, 20b, 20c)...network, 21...code combining means, 25 (25 m )...Facilities, 26...Log data, 27...Search methods.

Claims

1. In a facility connected to a network for generating and storing log data, a log collection is formed in which the log data is classified into a plurality of categories, control means for requesting the facility to transmit the corresponding log aggregates in accordance with a priority or selection procedure of the categories; A receiving means for receiving the log data transferred from the facility; A calculation means for calculating an authentication code from the received log data; a storage means for storing the authentication code; a verification means for verifying the authentication code stored at the time of generating the log data and the authentication code calculated thereafter, The equipment log management system includes a code combining means for converting the authentication codes of the log collection into binary codes, combining the codes in a preset order, and then determining the authentication code from a one-way function.

2. In a facility connected to a network for generating and storing log data, a log collection is formed in which the log data is classified into a plurality of categories, control means for requesting the facility to transmit the corresponding log aggregates in accordance with a priority or selection procedure of the categories; A receiving means for receiving the log data transferred from the facility; A calculation means for calculating an authentication code from the received log data; a storage means for storing the authentication code; a verification means for verifying the authentication code stored at the time of generating the log data and the authentication code calculated thereafter, An equipment log management system comprising a search means for performing the comparison of the calculated authentication code from only one of the two divided bodies obtained by dividing the log collection into two, and if the comparison results in a mismatch, dividing the collection into two further bodies and repeatedly performing the comparison of the calculated authentication code from only one of the two bodies.

3. In a facility connected to a network for generating and storing log data, a log collection is formed in which the log data is classified into a plurality of categories, control means for requesting the facility to transmit the corresponding log aggregates in accordance with a priority or selection procedure of the categories; A receiving means for receiving the log data transferred from the facility; A calculation means for calculating an authentication code from the received log data; a storage means for storing the authentication code; a verification means for verifying the authentication code stored at the time of generating the log data and the authentication code calculated thereafter, A management system for equipment logs, comprising a pre-inspection means for inspecting the received log data or the binary number obtained after binary conversion of the calculated authentication code, and confirming whether or not the log data has been tampered with.

4. In the facility log management system according to any one of claims 1 to 3, The category is defined by a security classification, and the management system for equipment logs comprises a log collection of multiple pieces of log data generated and stored in the equipment belonging to the same security classification.

5. In the facility log management system according to any one of claims 1 to 4, A management system for facility logs, comprising: a one-way transfer means for transferring the log data in only one direction from the facility connected to the network to the receiving means.

6. In the facility log management system according to any one of claims 1 to 5, A management system for equipment logs comprising: a compression means for compressing the volume of the log data transferred from the equipment connected to the network and transferring the compressed log data to the receiving means. 。

7. In the facility log management system according to any one of claims 1 to 6, An equipment log management system comprising an addition means for adding unique identification information of the equipment to the received log data and then calculating the authentication code.

8. In a facility connected to a network for generating and storing log data, a log collection is formed in which the log data is classified into a plurality of categories, requesting the facility to transmit the corresponding log aggregates according to a priority or selection procedure for the categories; receiving the log data transferred from the equipment; calculating an authentication code from the received log data; storing the authentication code; a step of comparing the authentication code stored at the time of generating the log data with the authentication code calculated thereafter, The method for managing equipment logs further comprises converting the authentication code of the log collection into binary form, concatenating the converted code in a preset order, and then deriving the authentication code from a one-way function.

9. In a facility connected to a network for generating and storing log data, a log collection is formed in which the log data is classified into a plurality of categories, requesting the facility to transmit the corresponding log aggregates according to a priority or selection procedure for the categories; receiving the log data transferred from the equipment; calculating an authentication code from the received log data; storing the authentication code; a step of comparing the authentication code stored at the time of generating the log data with the authentication code calculated thereafter, A method for managing equipment logs, comprising: a search means for performing the comparison of the calculated authentication code from only one of the two divided bodies into which the log collection is divided; and if the comparison results in a mismatch, the divided body is further divided into two and the comparison of the calculated authentication code is repeatedly performed from only one of the two divided bodies.

10. In a facility connected to a network for generating and storing log data, a log collection is formed in which the log data is classified into a plurality of categories, requesting the facility to transmit the corresponding log aggregates according to a priority or selection procedure for the categories; receiving the log data transferred from the equipment; calculating an authentication code from the received log data; storing the authentication code; a step of comparing the authentication code stored at the time of generating the log data with the authentication code calculated thereafter, A log management method in which a pre-inspection means inspects the received log data or the number of binary values ​​obtained by binary conversion of the calculated authentication code, thereby confirming whether or not the log data has been tampered with.

Images