CN108171078A - A kind of data security method and device towards third-party cloud platform evaluation system - Google Patents

Abstract

The present application discloses a data preservation method and device for a third-party cloud platform evaluation system. The method encrypts the log data and log certification information provided by the cloud service platform, and stores the log data in the form of a log chain. When a third-party evaluation system uses the collected log data to evaluate a cloud service platform, it first needs to verify the log certification information and log chain sequence verification of the log data to prevent the log data from being illegally tampered with during use, thereby The originality and integrity of the log files are guaranteed to be verified, and the privacy of users is protected by means of encryption.

Description

A data preservation method and device for a third-party cloud platform evaluation system

technical field

The present application relates to the field of cloud services, and more specifically, relates to a data preservation method and device for a third-party cloud platform evaluation system.

Background technique

The rapid development of cloud services provides users with great convenience, but it also brings some security problems. During the use of virtualized terminals, because the account becomes the only control method to control whether resources are allowed to be used, if the security and management measures of the cloud platform are not appropriate, it will cause security risks such as unauthorized use, illegal access, and data leakage. For users, real-time auditing and evaluation of the cloud platform through a third-party evaluation system is an effective way to know the credibility of the cloud service provider's infrastructure and cloud system. However, in the process of collecting log data, there will also be security risks such as illegal interception and tampering. In addition, cloud service providers need to consider the privacy protection of users, and usually cannot directly provide data with user information.

Contents of the invention

In view of this, this application provides a data preservation method and device for a third-party cloud platform evaluation system, which can not only ensure that the third-party evaluation system can verify the originality and integrity of log files, but also provide data from cloud services. From the perspective of merchants, user privacy is protected.

In order to achieve the above purpose, the proposed scheme is as follows:

A data preservation method for a cloud platform third-party evaluation system, the method for a third-party evaluation system, comprising:

Obtain log data of the cloud platform, and analyze the log data to generate multiple first log instances;

Encrypting the multiple first log instances to generate multiple second log instances;

According to the last modification time of the log instance, arrange the plurality of second log instances in sequence to generate a log chain;

Obtaining the log certification information of the second log instance provided by the cloud platform, and generating a log certification information instance;

Retrieving a second log instance of each virtual IP and a log proof instance corresponding to the second log instance;

Encrypting the second log instance and the log proof instance corresponding to the second log instance to generate a third log instance including proof information.

Preferably, said encrypting said multiple first log instances to generate multiple second log instances includes:

The multiple first log instances are encrypted by using the public key of the third-party evaluation system to generate multiple second log instances.

Preferably, the encrypting the second log instance and the log proof instance corresponding to the second log instance to generate a third log instance containing proof information includes:

Encrypting the second log instance and the log proof instance corresponding to the second log instance by using the private key of the cloud platform to generate a third log instance including the proof information.

Preferably, the method further includes: storing the second log instance and the log chain in a log database of a third-party evaluation system.

Preferably, the method further includes: storing the third log instance in the log certification database of the third-party evaluation system.

A data security device for a third-party evaluation system on a cloud platform, the device is oriented to a third-party evaluation system, comprising:

The first data acquisition unit is configured to acquire log data of the cloud platform, and analyze the log data to generate a plurality of first log instances;

a first encryption unit, configured to encrypt the multiple first log instances to generate multiple second log instances;

A log chain generation unit, configured to arrange the plurality of second log instances in order according to the last modification time of the log instance, to generate a log chain;

The second data acquisition unit is configured to acquire log certification information of the second log instance provided by the cloud platform, and generate a log certification information instance;

A retrieval unit, configured to retrieve a second log instance of each virtual IP and a log proof instance corresponding to the second log instance;

The second encryption unit is configured to encrypt the second log instance and the log proof instance corresponding to the second log instance, to generate a third log instance containing proof information.

Preferably, the first encryption unit encrypts the multiple first log instances by using the public key of the third-party evaluation system to generate multiple second log instances.

Preferably, the second encryption unit encrypts the second log instance and the log certification instance corresponding to the second log instance by using the private key of the cloud platform to generate a third log instance containing certification information.

Preferably: the log chain generating unit is further configured to store the second log instance and the log chain in a log database of a third-party evaluation system.

Preferably, the second encryption unit is further configured to store the third log instance in the log certification database of the third-party evaluation system.

It can be seen from the above technical solutions that the present application discloses a data preservation method and device for a third-party cloud platform evaluation system. The method encrypts the log data and log certification information provided by the cloud service platform, and stores the log data in the form of a log chain. When a third-party evaluation system uses the collected log data to evaluate a cloud service platform, it first needs to verify the log certification information and log chain sequence verification of the log data to prevent the log data from being illegally tampered with during use, thereby The originality and integrity of the log files are verified, and the privacy of users is protected by means of encryption.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 shows a schematic flow diagram of a data preservation method for a third-party cloud platform evaluation system disclosed by an embodiment of the present invention;

Figure 2 is the certification information verification process;

Figure 3 is the log chain sequence verification process;

Fig. 4 shows a schematic structural diagram of a third-party-oriented cloud platform evaluation system data protection device disclosed in another embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Referring to FIG. 1 , a schematic flowchart of a data preservation method for a third-party evaluation system on a cloud platform disclosed by an embodiment of the present invention is shown.

In this embodiment, the method includes:

S101: Obtain log data of the cloud platform, and parse the log data to generate multiple first log instances.

First establish communication with the cloud platform to collect different types of log data (including network logs, process logs, and operating system logs), and analyze the log data to generate a first log instance. The following uses network logs to illustrate.

A weblog instance is defined as follows:

LE=<FromIP,ToIP,TL,Port,UserID,Content>

Among them, FromIP is the source IP, ToIP is the destination IP, TL is the UTC time of the network operation, Port is the port number, UserID is the ID of the cloud platform user, and Content is other content recorded in the operation.

S102: Encrypt the multiple first log instances to generate multiple second log instances.

In order to protect data security, the public key PKA of the third-party evaluation system is used to encrypt the data information in the log instance to generate the encrypted second log instance (Encrypted Log Entry, ELE), which is expressed as follows:

ELE＝<EPKA(ToIP,Port,UserID,FromIP,TL,Content)>

S103: According to the last modification time of the log instance, arrange the plurality of second log instances in sequence to generate a log chain.

After the ELE is generated, according to the last modification time of the file (included in the timestamp information of the file), it is arranged into a log chain (Log chain, LC) in sequence, and if there is illegal tampering, the log chain will be rearranged. The log chain is represented as follows:

LC=<ELE,LCprev>

LCprev is the preorder log instance of the current log instance.

Furthermore, the second log instance and log chain are stored in the log database, expressed as DBLE, composed of ELE and LC:

DBLE=<ELE,LC>

S104: Obtain log certification information of the second log instance provided by the cloud platform, and generate a log certification information instance.

Obtain the log certification information provided by the cloud service provider and generate a log certification information instance, including the verification value of the original log file and various timestamp information, expressed as pro:

Pro＝<H(LE),time-stamp 1,time-stamp 2,...>

Send the updated log proof instance to the log proof database for storage.

S105: Retrieve a second log instance of each virtual IP and a log proof instance corresponding to the second log instance.

Retrieve the log database and the log proof database at the preset time, obtain the second log instance of each virtual IP and the log proof information corresponding to the second log instance, expressed as AED:

AED=<ELE,Pro>

S106: Encrypt the second log instance and the log proof instance corresponding to the second log instance, to generate a third log instance including proof information.

The private key of the cloud platform is used to encrypt the second log instance and the log proof instance corresponding to the second log instance, and generate a third log instance containing proof information, which is expressed as follows:

LogPro=<AED,Tp,SigSKC(AED,Tp)>

Tp represents the generation time of the file, and SigSKC(AED,Tp) is a digital signature generated by encrypting (AED,TP) with the private key SKC of the cloud service provider.

When the third-party evaluation system uses the collected log data to evaluate a cloud service platform, the verification of the proof information and the sequence of the log chain are first performed on the log data. Figure 2 is the proof information verification process. First, use the public key of the cloud platform and the private key of the third-party evaluation system to decrypt the third log instance and the log proof instance corresponding to the third log instance. If the decryption is successful, then use the decrypted log The proof instance verifies the third log instance, and if the verification is passed, then the verification of the log chain sequence is performed to verify the integrity of the log file. Figure 3 is the log chain sequence verification process, assuming there is a log chain: (ELE0, LC0) (ELE1, LC1)….

Because LC1 is the sequence of the second log instance, that is (ELE0, LC0), if the log chain has been illegally tampered with, the sequence will change (because it is arranged according to the last modification timestamp), if (ELE0, LC0) is the same as LC1, indicating that it has not been illegally tampered with. This verification method can verify the originality of log files and prevent illegal tampering during use.

Compared with the prior art, the present invention provides log certification information by the cloud service provider, and uses the private key of the cloud service provider to generate a digital signature to protect the privacy of the cloud platform user; log files are stored in the form of log chains, and are prevented from being used through sequence verification Illegally tampered with in the process.

Referring to FIG. 4 , it shows a schematic structural diagram of a third-party-oriented cloud platform evaluation system data protection device disclosed in another embodiment of the present invention.

As can be seen from FIG. 4 , the device includes: a first data collection unit 1 , a first encryption unit 2 , a log chain generation unit 3 , a second data collection unit 4 , a retrieval unit 5 , and a second encryption unit 6 .

The first data acquisition unit 1 is configured to acquire log data of the cloud platform, and analyze the log data to generate multiple first log instances.

For a network instance, the network instance can be expressed as

LE=<FromIP,ToIP,TL,Port,UserID,Content>

Among them, FromIP is the source IP, ToIP is the destination IP, TL is the UTC time of the network operation, Port is the port number, UserID is the ID of the cloud platform user, and Content is other content recorded in the operation.

Furthermore, the first encryption unit 2 uses the public key PKA of the third-party evaluation system to encrypt the data information in the first log instance to generate an encrypted second log instance (EncryptedLog Entry, ELE), which is expressed as follows:

ELE＝<EPKA(ToIP,Port,UserID,FromIP,TL,Content)>

The log chain generation unit 3 is configured to arrange the second log instances in sequence according to the last modification time of the log instances to generate a log chain. Among them, the log chain is expressed as follows:

LC=<ELE,LCprev>

LCprev is the preorder log instance of the current log instance.

Furthermore, the second log instance and log chain are stored in the log database, denoted as DBLE, composed of ELE and LC.

The second data acquisition unit 4 is used to obtain the log certification information of the second log instance provided by the cloud platform, generate a log certification information instance, and store the updated log certification information instance in the log certification database of the third-party evaluation system.

At a fixed time point every day, the retrieval unit 5 retrieves the second log instance of each virtual IP in the log database and the log proof database and the log proof instance corresponding to the second log instance, expressed as AED:

AED=<ELE,Pro>

Wherein, ELE is the second log instance, and Pro is the log certification letter corresponding to the second log instance.

The second encryption unit 6 encrypts the second log instance using the private key of the cloud platform and the log proof instance corresponding to the second log instance, generates a third log instance that includes proof information, and converts the third log instance The logs sent to the third-party evaluation system prove to be stored in the database, and the third log instance is expressed as follows:

LogPro=<AED,Tp,SigSKC(AED,Tp)>

Tp represents the generation time of the file, and SigSKC(AED,Tp) is a digital signature generated by encrypting (AED,TP) with the private key SKC of the cloud service provider.

It should be noted that the system embodiment corresponds to the method embodiment, and its execution process and execution principle are the same, which will not be repeated here.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. A data preservation method for a cloud platform third-party evaluation system, characterized in that it comprises: Obtain log data of the cloud platform, and analyze the log data to generate multiple first log instances; Encrypting the multiple first log instances to generate multiple second log instances; According to the last modification time of the log instance, arrange the plurality of second log instances in sequence to generate a log chain; Obtaining the log certification information of the second log instance provided by the cloud platform, and generating a log certification information instance; Retrieving a second log instance of each virtual IP and a log proof instance corresponding to the second log instance; Encrypting the second log instance and the log proof instance corresponding to the second log instance to generate a third log instance including proof information. 2. The method according to claim 1, wherein said encrypting said multiple first log instances to generate multiple second log instances comprises: The multiple first log instances are encrypted by using the public key of the third-party evaluation system to generate multiple second log instances. 3. The method according to claim 1, wherein the second log instance and the log proof instance corresponding to the second log instance are encrypted to generate a third log instance containing proof information, include: Encrypting the second log instance and the log proof instance corresponding to the second log instance by using the private key of the cloud platform to generate a third log instance including the proof information. 4. The method according to claim 1, further comprising: storing the second log instance and the log chain in a log database of a third-party evaluation system. 5. The method according to claim 1, further comprising: storing the third log instance in a log proof database of the third-party evaluation system. 6. A data security device for a cloud platform third-party evaluation system, said device is oriented to a third-party evaluation system, characterized in that it includes: The first data acquisition unit is configured to acquire log data of the cloud platform, and analyze the log data to generate a plurality of first log instances; a first encryption unit, configured to encrypt the multiple first log instances to generate multiple second log instances; A log chain generation unit, configured to arrange the plurality of second log instances in order according to the last modification time of the log instance, to generate a log chain; The second data acquisition unit is configured to acquire log certification information of the second log instance provided by the cloud platform, and generate a log certification information instance; A retrieval unit, configured to retrieve a second log instance of each virtual IP and a log proof instance corresponding to the second log instance; The second encryption unit is configured to encrypt the second log instance and the log proof instance corresponding to the second log instance, to generate a third log instance containing proof information. 7. The device according to claim 6, wherein the first encryption unit encrypts the multiple first log instances using a public key of a third-party evaluation system to generate multiple second log instances. 8. The device according to claim 6, wherein the second encryption unit encrypts the second log instance and the log proof instance corresponding to the second log instance using a private key of the cloud platform to generate A third log instance containing proof information. 9. The device according to claim 6, wherein the log chain generating unit is further configured to store the second log instance and the log chain in a log database of a third-party evaluation system. 10. The device according to claim 6, wherein the second encryption unit is further configured to store the third log instance in a log certification database of the third-party evaluation system.