Method and apparatus for processing log, device, and product

Abstract

The present disclosure relates to a method and apparatus for processing a log, a device, and a product. The method comprises: receiving an encrypted log from a client, wherein an encryption process of the encrypted log is associated with a first key bound to a first moment. The method further comprises: in response to receiving an access request for the encrypted log at a second moment, determining a time difference between the first moment and the second moment, wherein the second moment is later than the first moment. In addition, the method further comprises: in response to the time difference being less than a predetermined time window length, using a second key to decrypt the encrypted log, wherein the second key is the same as or corresponds to the first key.

Description

Methods, apparatus, devices, and products for processing logs Technical Field

[0001] This disclosure relates to the field of data security, and more specifically to methods, apparatus, devices and products for processing logs. Background Technology

[0002] With the rapid development of the mobile internet, mobile applications have become an indispensable part of users' daily lives. For example, video applications have not only profoundly changed the way people entertain themselves, but have also become an important platform for various activities such as information dissemination, social interaction, and creative expression. More and more users are sharing their life experiences and showcasing their personal talents through video applications, enriching the content of their digital lives.

[0003] Mobile applications generate a large amount of log data during operation, including but not limited to system information, operation records, application performance data, network communication data, and error and exception data. If this data is not collected securely and used properly, it may lead to data leakage or misuse, thereby posing a threat to data security. Summary of the Invention

[0004] In a first aspect of the embodiments of this disclosure, a method for processing logs is provided. The method includes receiving an encrypted log from a client, the encryption process of which is associated with a first key bound to a first time point. The method further includes determining a time difference between the first and second time points, the second time point being later than the first time point, in response to receiving an access request for the encrypted log at a second time point. Furthermore, the method includes decrypting the encrypted log using a second key, the second key being the same as or corresponding to the first key, in response to the time difference being less than a predetermined time window length.

[0005] In a second aspect of embodiments of this disclosure, another method for processing logs is provided. The method includes generating logs. The method further includes obtaining a first key, the first key being bound to a first moment. The method further includes generating encrypted logs based on the logs using the first key. Furthermore, the method includes sending the encrypted logs to a server, wherein a second key used by the server to decrypt the encrypted logs expires at a second moment, the time difference between the first and second moments is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

[0006] In a third aspect of embodiments of this disclosure, an apparatus for processing logs is provided. The apparatus includes an encrypted log receiving module configured to receive encrypted logs from a client, the encryption process of which is associated with a first key bound to a first time point. The apparatus also includes a time difference determination module configured to determine a time difference between the first and second time points in response to receiving an access request for the encrypted logs at a second time point, wherein the second time point is later than the first time point. Furthermore, the apparatus includes a log decryption module configured to decrypt the encrypted logs using a second key, which is the same as or corresponds to the first key, in response to a time difference less than a predetermined time window length.

[0007] In a fourth aspect of the embodiments of this disclosure, another apparatus for processing logs is provided. The apparatus includes a log generation module configured to generate logs. The apparatus also includes a key acquisition module configured to acquire a first key, the first key being bound to a first time point. The apparatus further includes a log encryption module configured to generate encrypted logs based on the logs and using the first key. Furthermore, the apparatus includes a log sending module configured to send the encrypted logs to a server, wherein a second key used by the server to decrypt the encrypted logs expires at a second time point, the time difference between the first and second times points is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

[0008] In a fifth aspect of embodiments of this disclosure, a server-side electronic device is provided. The electronic device includes one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement a method for processing logs. The method includes receiving encrypted logs from a client, the encryption process of which is associated with a first key bound to a first time point. The method further includes determining a time difference between the first and second time points, the second time point being later than the first time point, in response to receiving an access request for the encrypted logs at a second time point. Furthermore, the method includes decrypting the encrypted logs using a second key, the second key being the same as or corresponding to the first key, in response to the time difference being less than a predetermined time window length.

[0009] In a sixth aspect of embodiments of this disclosure, a client electronic device is provided. The electronic device includes one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement a method for processing logs. The method includes generating logs. The method further includes obtaining a first key, the first key being bound to a first moment. The method further includes generating encrypted logs based on the logs using the first key. Furthermore, the method includes sending the encrypted logs to a server, wherein a second key used by the server to decrypt the encrypted logs expires at a second moment, the time difference between the first moment and the second moment is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

[0010] In a seventh aspect of embodiments of this disclosure, a computer program product is provided. The computer program product is tangibly stored on a non-transitory computer-readable medium and includes machine-executable instructions that, when executed, cause a machine to implement a method for processing logs. The method includes receiving encrypted logs from a client, the encryption process of which is associated with a first key bound to a first time point. The method further includes determining a time difference between the first and second time points, the second time point being later than the first time point, in response to receiving an access request for the encrypted logs at a second time point. Furthermore, the method includes decrypting the encrypted logs using a second key, the second key being the same as or corresponding to the first key, in response to the time difference being less than a predetermined time window length.

[0011] In an eighth aspect of embodiments of this disclosure, a computer program product is provided. The computer program product is tangibly stored on a non-transitory computer-readable medium and includes machine-executable instructions that, when executed, cause a machine to implement a method for processing logs. The method includes generating logs. The method also includes obtaining a first key, which is bound to a first moment. The method further includes generating encrypted logs based on the logs and using the first key. Furthermore, the method includes sending the encrypted logs to a server, wherein a second key used by the server to decrypt the encrypted logs expires at a second moment, the time difference between the first and second moments is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

[0012] The summary section is provided to present the chosen concepts in a simplified form, which will be further described in the detailed description below. The summary section is not intended to identify key or principal features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter. Attached Figure Description

[0013] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0014] Figure 1 illustrates a schematic diagram of an example environment in which various embodiments of the present disclosure may be implemented;

[0015] Figure 2 shows a flowchart of a method for processing logs according to some embodiments of the present disclosure;

[0016] Figure 3 shows a flowchart of another method for processing logs according to some embodiments of the present disclosure;

[0017] Figure 4 illustrates a schematic diagram of an example of a process for sending encrypted logs from a client to a server according to some embodiments of the present disclosure;

[0018] Figure 5 illustrates a schematic diagram of an example of a process for periodically checking timestamps associated with logs at the server side according to some embodiments of the present disclosure;

[0019] Figure 6 illustrates a schematic diagram of an example of a process for processing log access requests at the server side according to some embodiments of the present disclosure;

[0020] Figure 7 shows a block diagram of an apparatus for processing logs according to some embodiments of the present disclosure;

[0021] Figure 8 shows a block diagram of another apparatus for processing logs according to some embodiments of the present disclosure;

[0022] Figure 9 shows a block diagram of a device capable of implementing several embodiments of the present disclosure. Detailed Implementation

[0023] It is understood that all user-related data involved in this technical solution should be obtained and used only after authorization from the user. This means that if it is necessary to use a user's personal information in this technical solution, the user's explicit consent and authorization are required before obtaining this data; otherwise, no related data collection and use will be carried out. It should also be understood that when implementing this technical solution, relevant laws and regulations should be strictly followed in the process of data collection, use, and storage, and necessary technical measures should be taken to protect user data security and ensure the secure use of data.

[0024] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0025] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects unless explicitly stated. Other explicit and implicit definitions may also be included below.

[0026] Mobile applications generate a large amount of log data during operation, including but not limited to system information, operation records, application performance data, network communication data, and error and exception data. To analyze the application's operational status and operation records, application logs are typically stored on a server for access by data analysis systems. Logs are usually generated by the client and collected on the server through log broker tools (e.g., Fluentd, Logstash), application programming interfaces (APIs), or message queues (e.g., Kafka, RabbitMQ). On the server side, logs can be stored using file storage, databases, and cloud object storage.

[0027] In some related technologies, logs are anonymized and stored long-term on the server. However, even anonymized logs may still contain user-related data. This data, stored long-term without anonymization, is at risk of being leaked should a security vulnerability or attack occur. Furthermore, as the number and types of stored logs increase over time, this data may become a target for attackers. For example, attackers might analyze large amounts of processed logs to predict the original logs, thus threatening data security.

[0028] Therefore, embodiments of this disclosure propose a scheme for processing logs. In this scheme, after generating a log, a client (or application) can obtain a first key, which is a time-bound key and is bound to a first moment. The client can then encrypt the log to generate an encrypted log. During the log encryption process, the client can use the first key to encrypt the log directly or indirectly. The client can then send the encrypted log to a server. After receiving the encrypted log, if the server receives an access request for the encrypted log at a second moment, it can determine the time difference between the first moment bound to the first key and the second moment. If this time difference is less than a predetermined time window length, the server can use a second key to decrypt the encrypted log, wherein the second key can be the first key sent from the client to the server, or a key corresponding to the first key stored on the server.

[0029] In this way, after the log is encrypted, it can only be successfully decrypted if accessed within a predetermined time window; otherwise, decryption will fail. This ensures timely analysis of application performance and operation records while simultaneously invalidating logs that may contain sensitive data in the shortest possible time, thereby improving data security.

[0030] Figure 1 illustrates a schematic diagram of an example environment 100 in which various embodiments of the present disclosure may be implemented. As shown in Figure 1, environment 100 includes a client 102 and a server 104. The client 102 can be any device capable of running an application. For example, the client 102 can be a mobile phone, tablet computer, smart wearable device, personal computer, desktop computer, laptop computer, or Internet of Things device, etc. The server 104 can be any device with computing or processing capabilities. For example, the server 104 can be a local server, cloud server, virtual server, personal computer, desktop computer, or laptop computer, etc.

[0031] In environment 100, application 106 runs on client 102. Application 106 can be any application that generates logs during its runtime. For example, application 106 could be a video application, a lifestyle service application, a social application, or a music application. Logs are automatically generated record files during application runtime, typically including application status, operations, error messages, performance metrics, user behavior, and system events. Logs help development engineers, maintenance engineers, and data analysis engineers understand the application's working status, troubleshoot problems, and make appropriate decisions.

[0032] In environment 100, application 106 can generate log 108 during runtime. Log 108 can include multiple log entries of the same or different types. For example, log 108 can include information logs recording normal operation events in the application, error logs recording errors encountered by the application during runtime (e.g., crashes, exceptions), and performance logs recording application performance, etc.

[0033] After log 108 is generated, client 102 can encrypt log 108 to improve its security. In environment 100, client 102 can obtain key 110. In some embodiments, key 110 may be generated at server 104. Client 102 can obtain key 110 from server 104. In some embodiments, key 110 may be generated at client 102 in response to the generation of log 108. In some embodiments, key 110 may be pre-stored at client 102. In some embodiments, key 110 may be a public key for asymmetric encryption. In some embodiments, key 110 may be a key for symmetric encryption.

[0034] In environment 100, key 110 is a time-bound key. A time-bound key means that the key is associated with a specific moment or timestamp, the timestamp associated with the key can be determined when the key is accessed, and the timestamp cannot be modified after the key is bound to the timestamp. In environment 100, key 110 is bound to moment 120. In some embodiments, when key 110 is received by client 102 from server 104, moment 120 can be the time when server 104 sends key 110 to client 102. In some embodiments, moment 120 can be the time between the time log 108 is generated and the time when server 104 sends key 110 to client 102. In some embodiments, moment 120 can be the time log 108 is generated. In some embodiments, moment 120 can be the time key 110 is generated.

[0035] In environment 100, after obtaining key 110, client 102 can encrypt log 108 to generate encrypted log 112. During this encryption process, client 102 can use key 110 to directly or indirectly encrypt log 108. In some embodiments, client 102 can directly use key 110 to encrypt the data in log 108 to generate encrypted log 112. In some embodiments, client 102 can generate a temporary session key for log 108 and use this session key to encrypt the data in log 108. Then, client 102 can use key 110 to encrypt the session key. This process can be referred to as indirectly using key 110 to encrypt log 108.

[0036] In environment 100, client 102 can send encrypted log 112 to server 104. After receiving encrypted log 112, server 104 can store encrypted log 112. At time 122, server 104 can receive access request 114 for encrypted log 112 (e.g., from a data analysis system). Since encrypted log 112 is encrypted using key 110, and key 110 is bound to time 120, server 104 can determine the time difference 124 between time 120 bound to key 110 and time 122 when access request 114 is received.

[0037] In environment 100, the predetermined time window 126 has a fixed window length. Server 104 can compare the time difference 124 with the predetermined time window 126. If the time difference 124 satisfies (e.g., is less than or equal to) the predetermined time window 126, server 104 can use key 116 to decrypt encrypted log 112 to obtain log 118 (i.e., log 108). In embodiments where key 110 is a public key for asymmetric encryption, key 116 may be a private key corresponding to key 110 stored on server 104. In embodiments where key 110 is a key for symmetric encryption, key 116 may be the same key as key 110 stored on server 104, or a key corresponding to key 110 used to decrypt encrypted log 112. However, in environment 100, key 116 may be invalidated or destroyed after the predetermined time window 126 begins at time 120, preventing server 104 from obtaining a valid key to decrypt encrypted log 112 when it receives an access request after time 128. Thus, when the time difference 124 does not meet (e.g., is greater than) the predetermined time window 126, the server 104 can reject the access request 114 (e.g., because a valid key 116 cannot be obtained) to prevent logs stored beyond the predetermined time window 126 from being accessed.

[0038] In this way, after log 108 is encrypted, encrypted log 112 can only be successfully decrypted if accessed within a predetermined time window 126; otherwise, decryption will fail. This ensures timely analysis of application performance and operation records while simultaneously invalidating logs that may contain sensitive data in the shortest possible time, thereby enhancing data security.

[0039] Figure 2 illustrates a flowchart of a method 200 for processing logs according to some embodiments of the present disclosure. Method 200 can be executed by a server, for example, by server 104 in Figure 1. As shown in Figure 2, at block 202, the server can receive encrypted logs from a client, the encryption process of which is associated with a first key bound to a first moment. For example, in environment 100 as shown in Figure 1, client 102 can send encrypted log 112 to server 104. After receiving encrypted log 112, server 104 can store it. Key 110 is used during the encryption of encrypted log 112 to directly or indirectly encrypt log 108. Furthermore, key 110 is bound to moment 120. Moment 120 can be, for example, the time when server 104 sends key 110 to client 102, the time between the time log 108 is generated and the time server 104 sends key 110 to client 102, the time log 108 is generated, or the time key 110 is generated, etc.

[0040] In box 204, in response to receiving an access request for the encrypted log at a second time, the server can determine the time difference between the first and second times, where the second time is later than the first time. For example, in environment 100 as shown in Figure 1, at time 122, server 104 can receive access request 114 for encrypted log 112. Then, server 104 can determine the time difference 124 between the time 120 bound to key 110 and the time 122 when access request 114 is received.

[0041] In box 206, in response to a time difference less than a predetermined time window length, the server can use a second key to decrypt the encrypted log, the second key being the same as or corresponding to the first key. For example, in environment 100 as shown in Figure 1, the predetermined time window 126 has a fixed window length. The server 104 can compare the time difference 124 with the predetermined time window 126. If the time difference 124 is less than the predetermined time window 126, the server 104 can use key 116 to decrypt the encrypted log 112 to obtain log 118 (i.e., log 108). Key 116 can be a private key corresponding to key 110 stored on the server 104, a key identical to key 110 stored on the server 104, or a key corresponding to key 110 used to decrypt the encrypted log 112.

[0042] Figure 3 illustrates a flowchart of another method 300 for processing logs according to some embodiments of the present disclosure. Method 200 can be performed by a client, for example, method 200 can be performed by client 102 in Figure 1. As shown in Figure 3, at block 302, the client can generate logs. For example, in environment 100 shown in Figure 1, client 102 can generate log 108 for application 106.

[0043] In box 304, the client can obtain a first key, which is bound to a first time point. For example, in environment 100 as shown in Figure 1, client 102 can obtain key 110. Key 110 is a time-bound key, and key 110 can be bound to time point 120.

[0044] In box 306, the client can generate an encrypted log based on the log using a first key. For example, in environment 100 as shown in FIG1, client 102 can encrypt log 108 to generate encrypted log 112. During this encryption process, client 102 can use key 110 to encrypt log 108 directly or indirectly. In some embodiments, client 102 can directly use key 110 to encrypt the data of log 108 to generate encrypted log 112. In some embodiments, client 102 can generate a temporary session key for log 108 and use this session key to encrypt the data of log 108. Then, client 102 can use key 110 to encrypt the session key.

[0045] In box 308, the client can send an encrypted log to the server, where a second key used by the server to decrypt the encrypted log expires at a second time point. The time difference between the first and second times is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key. For example, in environment 100 as shown in Figure 1, client 102 can send encrypted log 112 to server 104. Key 116 is the key used to decrypt encrypted log 112. For example, key 116 can be a private key corresponding to key 110 stored on server 104, a key identical to key 110 stored on server 104, or a key corresponding to key 110 used to decrypt encrypted log 112. Key 116 expires at time 128, after a predetermined time window 126 has passed from time 120, preventing server 104 from using key 116 to decrypt encrypted log 112.

[0046] In this way, after the log is encrypted, it can only be successfully decrypted if accessed within a predetermined time window; otherwise, decryption will fail. This ensures timely analysis of application performance and operation records while simultaneously invalidating logs that may contain sensitive data in the shortest possible time, thereby improving data security.

[0047] Figure 4 illustrates a schematic diagram of an example 400 of a process for sending encrypted logs from a client to a server according to some embodiments of the present disclosure. In example 400, the client includes an application 402 and an encryption module 404, and the server includes a key management system 408, a log storage and retrieval system 410, and an audit trail system 412. Furthermore, example 400 also includes an encrypted communication module 406 that implements encrypted communication between the client and the server. Application 402 can generate logs during operation; for example, application 402 can be application 106 in Figure 1.

[0048] Encryption module 404 can be configured to perform initial encryption and add timestamps to the logs at the client end. In some embodiments, encryption module 404 can use the AES-256 algorithm to encrypt the log content and the SHA-256 algorithm to generate a unique identifier for the log. In some embodiments, encryption module 404 can use the Network Time Protocol (NTP) to ensure the accuracy of the timestamps. NTP is a protocol for synchronizing time in computer networks, and encryption module 404 can connect to a reliable time source server over the network to keep the client's time accurate. Furthermore, encryption module 404 can generate a temporary session key using secure random numbers and encrypt the temporary session key using an asymmetric encryption algorithm.

[0049] The server-side key management system 408 can be configured to manage and distribute encryption keys. The key management system 408 can use a Hardware Security Module (HSM) to store the master key. An HSM is a physical device specifically designed to protect and manage sensitive information such as encryption keys. HSMs possess tamper-proof mechanisms, strict access controls, and dedicated encryption hardware to perform encryption operations. Storing the master key in an HSM prevents its leakage due to software vulnerabilities, malicious attacks, or improper operation. Because HSMs are designed with strict protection measures for key storage and usage—for example, they can restrict access to the master key to only authorized entities through specific interfaces and verification processes—the security of the entire encryption system is enhanced.

[0050] Furthermore, the key management system 408 can utilize a Time-Based One-Time Key Generation (TOTP) algorithm to generate keys. TOTP is a dynamic password generation algorithm that generates temporary passwords valid only for a short period based on the current time and a pre-shared key. The key management system 408 can then use the Shamir secret sharing algorithm to divide the key into multiple fragments, storing these fragments in different locations. In addition, the key management system 408 can use a key rotation mechanism to periodically change the encryption key. The key management system 408 can also use two-factor authentication to strengthen access control of the key, denying unauthorized access. By comprehensively using multiple technologies, the key management system 408 can improve key security and protect data security at multiple stages, including key storage, generation, fragmentation, and access control.

[0051] The log storage and retrieval system 410 can be configured to store encrypted logs and provide log retrieval services. The log storage and retrieval system 410 can employ a distributed file system to store large amounts of log data. Furthermore, the log storage and retrieval system 410 can index log identifiers and timestamps to improve the efficiency of log retrieval.

[0052] The audit trail system 412 can be configured to log all operations performed on the logs to ensure system auditability. The audit trail system 412 can record log operations in detail based on the OWASP standard. Furthermore, the audit trail system 412 can employ an asynchronous log writing mechanism to reduce the impact on the main system performance. The audit trail system 412 can also use log compression and archiving functions to optimize storage space usage. In addition, the audit trail system 412 can provide role-based access control for audit logs. Different personnel have different access permissions to audit logs. The system can verify the identity and role of the account accessing the audit logs, and then determine whether to allow access based on predefined rules, preventing unauthorized access and ensuring log security.

[0053] As shown in Figure 4, application 402 can generate logs during operation. Encryption module 404 can capture the logs that need to be recorded and generate a unique identifier for the logs based on them. In addition, encryption module 404 can also generate a current timestamp (e.g., this timestamp can correspond to the first moment described above). Then, encryption module 404 can generate a temporary session key (e.g., by generating a secure random number) and use the session key to perform preliminary encryption on the logs to generate encrypted logs.

[0054] After generating the encrypted log, the encryption module 404 can send a key retrieval request to the server to request a time-bound public key, which may include the generated timestamp. Upon receiving the key retrieval request, the server can generate a public and private key for asymmetric encryption and bind them to the timestamp in the key retrieval request. The time-bound public key can be sent from the server to the client via the encrypted communication module 406, and the private key can be stored on the server.

[0055] After the client obtains the time-bound public key, the encryption module 404 can use this public key to encrypt the previously generated session key used for encrypting logs, generating an encrypted session key. The client can then send the encrypted log content, log identifier, timestamp, and encrypted session key to the server. Upon receiving the encrypted log, the server can store it in the log storage and retrieval system 410 and record this storage operation in the audit trail system 412.

[0056] Figure 5 illustrates a schematic diagram of an example 500 of a process for periodically checking timestamps associated with logs at a server according to some embodiments of the present disclosure. In example 500, the server includes a key management system 508 (e.g., key management system 408 in Figure 4), a log storage and retrieval system 510 (e.g., log storage and retrieval system 410 in Figure 4), a time window controller 512, an automatic failure executor 514, and an audit trail system 516 (e.g., audit trail system 412 in Figure 4).

[0057] The time window controller 512 can be configured to control the accessible time window of logs according to pre-set rules. In some embodiments, the time window controller 512 can adjust the accessible time window based on the log type. For example, user operation logs may include user operation records, click records, page access records, etc. Although anonymized, these logs may still contain user-related data, so the time window length can be set to a smaller value (e.g., 30 days or less). As another example, system operation logs may include service status, error reports, performance metrics, etc. System operation logs are used to troubleshoot system problems or evaluate system performance, so the time window for system operation logs can be larger than that for user operation logs (e.g., 3 months or more). Furthermore, the time window for system operation logs can be adjusted based on the complexity of the system. In this way, the length of the time window can be dynamically determined, improving system flexibility and meeting different log analysis needs.

[0058] The automatic failure executor 514 can be configured to invalidate the log and the corresponding key (e.g., the private key stored on the server) after the time window expires. The automatic failure executor 514 can utilize a scheduled task system and asynchronous processing mechanisms to improve system performance. Furthermore, the automatic failure executor 514 can utilize a secure erasure algorithm to ensure the key is completely deleted. In addition, the automatic failure executor 514 can utilize transaction mechanisms to ensure the atomicity of the failure operation, and a failure confirmation mechanism to prevent failure failure due to system malfunctions.

[0059] As shown in Figure 5, the server-side time window controller 512 can periodically check the timestamps associated with logs stored in the log storage and retrieval system 510, or check the timestamps bound to the private key of the session key used to decrypt the logs. If the accessible time window for the log has ended or the time difference between the current moment and the timestamp bound to the private key is greater than the length of the accessible time window, the automatic invalidation executor 514 can destroy the private key stored in the key management system 508 to ensure that the session key used to decrypt the encrypted logs cannot be decrypted, thereby ensuring that the encrypted logs cannot be decrypted. Since the private key is destroyed, the automatic invalidation executor 514 can mark the corresponding log as invalid. After the automatic invalidation executor 514 invalidates the private key and the log, the audit trail system 516 can record this invalidation operation.

[0060] In some embodiments, the server can periodically check the time difference between the log's expiration time and the current time. If the time difference exceeds a predetermined threshold, the server can delete the expired log from the log storage and retrieval system 510. This approach further enhances log security and saves storage space.

[0061] Figure 6 illustrates a schematic diagram of an example 600 of a process for processing log access requests at a server according to some embodiments of the present disclosure. As shown in Figure 6, in example 600, the server includes a key management system 608 (e.g., the key management system 508 in Figure 5), a log storage and retrieval system 610 (e.g., the log storage and retrieval system 510 in Figure 5), a time window controller 612 (e.g., the time window controller 512 in Figure 5), an audit trail system 616 (e.g., the audit trail system 516 in Figure 5), and a permissions management module 618.

[0062] The access control module 618 can be configured to manage and control access rights to various parts of the system. For example, the access control module 618 can be a permission system based on the RBAC model. The access control module 618 can use OAuth 2.0 and OpenID Connect to implement authentication and authorization. Furthermore, the access control module 618 can ensure that users can only access necessary resources based on the principle of least privilege. The access control module 618 can also employ a dynamic permission allocation mechanism to support the granting and revocation of temporary permissions. In addition, the access control module 618 can also have permission change auditing functionality.

[0063] As shown in Figure 6, after authorization verification, the authorization management module 618 can request access to the encrypted logs in the log storage and retrieval system 610. The time window controller 612 can check the timestamp associated with the logs stored in the log storage and retrieval system 610, or check the timestamp bound to the private key of the session key used to decrypt the logs.

[0064] If the time of the log access request is within the log's valid time window, or if the time difference between the log access request time and the timestamp bound to the private key is less than the length of the accessible time window, the log storage and retrieval system 610 can obtain the private key for the session key used to decrypt the log from the key management system 608. The log storage and retrieval system 610 can then use the obtained private key to decrypt the log's session key, and use the decrypted session key to decrypt the encrypted log. The decrypted log can be sent to the access control module 618. The access control module 618 can provide the decrypted log to authorized users for viewing and analysis. The authorized user's access to the log can be recorded in the audit trail system 616.

[0065] If the request to access the log exceeds the log's valid time window, or if the time difference between the request and the timestamp bound to the private key is greater than the length of the accessible time window, it indicates that the log and the corresponding private key have expired. In this case, the request to access the log can be denied, and the rights management module 618 can notify authorized personnel that access to the log is unavailable. Furthermore, this denied log access attempt can be recorded in the audit trail system 616.

[0066] The solutions provided by the embodiments of this disclosure can significantly shorten the storage time of sensitive data and effectively reduce the risk of data leakage. By improving the automation level of log management, potential risks caused by human operation can be reduced, enhancing system security and reliability, and resisting potential attacks and data abuse. Furthermore, this solution can improve the flexibility of the log invalidation mechanism to meet the analysis needs of different types of logs. While protecting data security, this solution also ensures that application developers and data analysis engineers can perform necessary performance analysis and problem diagnosis. In addition, by recording various operations on the logs, system auditability can be achieved, enabling system administrators or automated management systems to promptly identify potential problems in the system based on audit logs, further improving system reliability and security.

[0067] Figure 7 shows a block diagram of an apparatus 700 for processing logs according to some embodiments of the present disclosure. As shown in Figure 7, the apparatus 700 includes an encrypted log receiving module 702 configured to receive encrypted logs from a client, the encryption process of which is associated with a first key bound to a first time point. The apparatus 700 also includes a time difference determination module 704 configured to determine a time difference between the first and second time points in response to receiving an access request for the encrypted logs at a second time point, wherein the second time point is later than the first time point. Furthermore, the apparatus 700 includes a log decryption module 706 configured to decrypt the encrypted logs using a second key, which is the same as or corresponds to the first key, in response to a time difference less than a predetermined time window length.

[0068] In some embodiments, the first key is a public key for asymmetric encryption, and the second key is a private key corresponding to the public key.

[0069] In some embodiments, the apparatus 700 further includes: a time binding module configured to bind a first key and a second key to a first time moment in response to receiving a key acquisition request from a client; a first key sending module configured to send the first key to the client; and a second key storage module configured to store the second key.

[0070] In some embodiments, the first key is used at the client to encrypt the third key, the third key is generated at the client, and the third key is used to encrypt the logs at the client to generate encrypted logs.

[0071] In some embodiments, the apparatus 700 further includes: a third key receiving module configured to receive an encrypted third key from a client, wherein using the second key to decrypt the encrypted log includes: a third key decryption module configured to use the second key to decrypt the encrypted third key; and an encrypted log decryption module configured to use the third key to decrypt the encrypted log.

[0072] In some embodiments, where the time difference is a first time difference, the apparatus 700 further includes: a second time difference determining module configured to determine a second time difference between a first time moment and a third time moment; and a second time difference using module configured to invalidate the encrypted log at the third time moment by destroying a second key in response to the second time difference being not less than a predetermined time window length.

[0073] In some embodiments, the apparatus 700 further includes: a third time difference determination module configured to determine a third time difference between a third time moment and a fourth time moment; and a third time difference usage module configured to delete encrypted logs in response to the third time difference being greater than a predetermined threshold.

[0074] In some embodiments, the apparatus 700 further includes: a log type determination module configured to determine the log type of the encrypted log; and a time window determination module configured to determine the corresponding predetermined time window length based on the log type.

[0075] In some embodiments, the apparatus 700 further includes: a storage operation recording module configured to record a storage operation in response to storing the encrypted log on a server; an access request recording module configured to record an access request in response to the encrypted log being decrypted; an invalidation operation recording module configured to record an invalidation operation in response to the encrypted log being invalidated; and an access attempt recording module configured to record an access attempt in response to receiving an access request for the invalidated encrypted log.

[0076] Figure 8 shows a block diagram of an apparatus 800 for processing logs according to some embodiments of the present disclosure. As shown in Figure 8, the apparatus 800 includes a log generation module 802 configured to generate logs. The apparatus 800 also includes a key acquisition module 804 configured to acquire a first key, which is bound to a first moment. The apparatus 800 also includes a log encryption module 806 configured to generate encrypted logs based on the logs and using the first key. Furthermore, the apparatus 800 includes a log sending module 808 configured to send encrypted logs to a server, wherein a second key used by the server to decrypt the encrypted logs expires at a second moment, the time difference between the first moment and the second moment is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

[0077] In some embodiments, the first key is a public key and the second key is a private key corresponding to the public key.

[0078] In some embodiments, the key acquisition module 804 includes: a request sending module configured to send a key acquisition request to the server; and a first key receiving module configured to receive a first key from the server.

[0079] In some embodiments, the log encryption module 806 includes: a third key generation module configured to generate a third key; a third key usage module configured to generate encrypted logs by encrypting logs using the third key; and a third key encryption module configured to generate an encrypted third key by encrypting the third key using a first key, wherein a second key is used to decrypt the encrypted third key, wherein the device 800 further includes: a third key sending module configured to send the encrypted third key to a server.

[0080] It is understood that by utilizing the devices 700 and 800 of this disclosure, at least one of the many advantages achievable by the methods or processes described above can be realized. For example, after a log is encrypted, it can only be successfully decrypted if accessed within a predetermined time window; otherwise, the log cannot be decrypted. This ensures timely analysis of application performance and operation records while simultaneously invalidating logs that may contain sensitive data in the shortest possible time, thereby enhancing data security.

[0081] Figure 9 shows a block diagram of a device 900 capable of implementing various embodiments of the present disclosure. Device 900 may be, for example, a client 102 or a server 104 as shown in Figure 1. As shown in Figure 9, device 900 includes a central processing unit (CPU) and / or a graphics processing unit (GPU) 901, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 902 or loaded from storage unit 908 into random access memory (RAM) 903. Various programs and data required for the operation of device 900 may also be stored in RAM 903. The CPU / GPU 901, ROM 902, and RAM 903 are interconnected via bus 904. Input / output (I / O) interface 905 is also connected to bus 904. Although not shown in Figure 9, device 900 may also include a coprocessor.

[0082] Multiple components in device 900 are connected to I / O interface 905, including: input unit 906, such as keyboard, mouse, etc.; output unit 907, such as various types of monitors, speakers, etc.; storage unit 908, such as disk, optical disk, etc.; and communication unit 909, such as network card, modem, wireless transceiver, etc. Communication unit 909 allows device 900 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0083] The various methods or processes described above can be executed by CPU / GPU 901. For example, in some embodiments, the methods can be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 908. In some embodiments, part or all of the computer program can be loaded and / or installed on device 900 via ROM 902 and / or communication unit 909. When the computer program is loaded into RAM 903 and executed by CPU / GPU 901, one or more steps or actions in the methods or processes described above can be performed.

[0084] In some embodiments, the methods and processes described above can be implemented as a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of this disclosure.

[0085] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0086] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, a local area network (LAN), a wide area network (WAN), and / or a wireless network, to an external computer or external storage device. The network may include copper cables, fiber optic cables, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0087] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​and conventional procedural programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0088] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0089] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0091] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical applications, or technical improvements to the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for processing logs, comprising: Receive encrypted logs from the client, wherein the encryption process of the encrypted logs is associated with a first key bound to the first moment; In response to receiving an access request for the encrypted log at a second time, determine the time difference between the first and second time points, wherein the second time point is later than the first time point; and In response to the time difference being less than a predetermined time window length, a second key is used to decrypt the encrypted log, the second key being the same as or corresponding to the first key.

2. The method according to claim 1, wherein the first key is a public key for asymmetric encryption, and the second key is a private key corresponding to the public key.

3. The method according to claim 2, further comprising: In response to receiving a key acquisition request from the client, the first key and the second key are bound to the first moment; Send the first key to the client; as well as Store the second key.

4. The method of claim 3, wherein the first key is used at the client to encrypt the third key, the third key is generated at the client, and the third key is used to encrypt the log at the client to generate the encrypted log.

5. The method according to claim 4, further comprising: Receive the encrypted third key from the client. The use of the second key to decrypt the encrypted log includes: Use the second key to decrypt the encrypted third key; and Use the third key to decrypt the encrypted log.

6. The method according to claim 1, wherein the time difference is a first time difference, and the method further comprises: Determine the second time difference between the first time point and the third time point; as well as In response to the second time difference being not less than the predetermined time window length, the encrypted log is invalidated by destroying the second key at the third moment.

7. The method according to claim 6, further comprising: Determine the third time difference between the third time point and the fourth time point; as well as In response to the third time difference being greater than a predetermined threshold, the encrypted log is deleted.

8. The method according to claim 1, further comprising: Determine the log type of the encrypted log; as well as The corresponding predetermined time window length is determined based on the log type.

9. The method according to claim 1, further comprising: In response to storing the encrypted log on the server, the storage operation is recorded; In response to the decryption of the encrypted log, the access request is recorded; In response to the encryption log becoming invalid, record the invalidation operation; as well as In response to receiving an access request for an expired encrypted log, log the access attempt.

10. A method for log protection, comprising: Generate logs; Obtain the first key, which is bound to the first moment; Based on the log, the first key is used to generate an encrypted log; as well as The encrypted log is sent to the server, wherein the second key used by the server to decrypt the encrypted log becomes invalid at a second time, the time difference between the first time and the second time is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

11. The method of claim 10, wherein the first key is a public key and the second key is a private key corresponding to the public key.

12. The method of claim 11, wherein obtaining the first key comprises: Send a key acquisition request to the server; as well as Receive the first key from the server.

13. The method of claim 12, wherein generating the encrypted log using the first key based on the log comprises: Generate a third key; The encrypted log is generated by encrypting the log using the third key; as well as The encrypted third key is generated by encrypting the third key using the first key, wherein the second key is used to decrypt the encrypted third key. The method further includes: Send the encrypted third key to the server.

14. An apparatus for processing logs, comprising: An encrypted log receiving module is configured to receive encrypted logs from a client, wherein the encryption process of the encrypted logs is associated with a first key bound to a first moment; A time difference determination module is configured to, in response to receiving an access request for the encrypted log at a second time moment, determine the time difference between the first time moment and the second time moment, wherein the second time moment is later than the first time moment; and The log decryption module is configured to decrypt the encrypted log using a second key in response to the time difference being less than a predetermined time window length, wherein the second key is the same as or corresponds to the first key.

15. An apparatus for processing logs, comprising: The log generation module is configured to generate logs. The key acquisition module is configured to acquire a first key, which is bound to a first moment. The log encryption module is configured to generate encrypted logs based on the logs using the first key; as well as The log sending module is configured to send the encrypted log to the server, wherein the second key used by the server to decrypt the encrypted log expires at a second time, the time difference between the first time and the second time is greater than a predetermined time window length, and the second key is the same as or corresponds to the first key.

16. An electronic device comprising: processor; as well as A memory coupled to the processor, the memory having instructions stored therein, which, when executed by the processor, cause the electronic device to perform the method according to any one of claims 1 to 13.

17. A computer program product tangibly stored on a non-transitory computer-readable medium and comprising machine-executable instructions that, when executed, cause a machine to perform the method according to any one of claims 1 to 13.

Images