WO2021085701A1 - Device for processing security event using blockchain and smart contract, and method therefor - Google Patents

Abstract

A security event processing device according to the present invention comprises: a security event collection unit for storing security event log information, a transaction hash value, and a merged hash value in a recovery blockchain and a security event database, and storing the transaction hash value and the merged hash value in a smart contract, whenever a security event occurs; and a security event inquiry unit for comparing whether the transaction hash value and the merged hash value, which are last recorded in the security event database, are the same as the transaction hash value and the merged hash value, which are last recorded in the smart contract, and verifying whether the security event log information has been falsified.

Description

Device for handling security events using blockchain and smart contract, and method for the same

The present invention relates to a security event processing technology, and more particularly, to an apparatus for processing a security event using a block chain and a smart contract, and a method therefor.

Recently, as security incidents such as personal information leakage occur frequently, the importance of security events is increasing. For example, in the case of a device for a company such as a shopping mall, a game, or an Internet service to record and handle customer information, the integrity of the security event log generated by the device must be guaranteed. This is a situation in which security events occurring in the personal information processing system must be stored in a system that cannot be modified or deleted in order to meet compliance such as information protection management system (ISMS). When a client terminal accesses the device and performs actions such as copying or modifying personal information, it must be able to keep the information on the access behavior of the client terminal intact, and securely log security events in a way that has been completely verified for integrity. Information should be stored and managed. These security obligations are defined in the personal information processing system, personal information safety security measures, Article 2, 10, and personal information security measures standards Article 8 (storage and inspection of access records), and keep access records for at least 1 year in accordance with Articles 1 and 3 . It is based on the obligation to keep the access records of the management personal information handlers from forgery, theft, and loss, and the stipulation of integrity under Article 30 of the Enforcement Decree of the Personal Information Protection Act (Measures to Ensure Safety of Personal Information).

In general, when a server or database of a company is damaged by hacking, it is difficult to trust that the existing data has not been hacked, and thus the integrity of the existing data cannot be verified. This does not mean that there is no integrity verification method, but in reality, the system for integrity verification is not in operation. In other words, in order to verify integrity, it is necessary to have a remote system that cannot be modified or deleted, or employ appropriate operating personnel, so resources increase, and if data is stored in a remote system that cannot be modified or deleted, the cost burden is high. to be.

[Prior technical literature]

[Patent Literature]

Korean Patent Publication No. 2017-0137388 published on December 13, 2017 (Name: Integrity guarantee method using blockchain technology)

An object of the present invention is to provide an apparatus and a method for dynamically verifying the integrity of such a security event and automatically recovering the integrity when a problem occurs.

The apparatus for processing a security event according to a preferred embodiment of the present invention for achieving the above-described object, whenever a security event occurs, the security event log information, the transaction hash value, and the merged hash value with the recovery block chain. A security event collection unit that is stored in a security event database and stores the transaction hash value and the merged hash value in a smart contract, the transaction hash value and the merge hash value last recorded in the security event database, and the last in the smart contract. And a security event inquiry unit that compares whether or not the recorded transaction hash value and the merged hash value are the same, and verifies whether the security event log information is altered or not.

When the security event occurs, the security event collection unit collects the security event log information and records it in the recovery block chain, and when a transaction hash value corresponding to the security event log information is returned from the recovery block chain, the The merged hash value is calculated using the security event log information and the transaction hash value as factors, and the transaction hash value and the merged hash value corresponding to the security event log information are indexed in the recovery block chain. .

As a result of the comparison, if the transaction hash value and the merge hash value last recorded in the security event database and the transaction hash value and the merge hash value last recorded in the smart contract are not the same, the security event stored in the security event database It is characterized in that it is determined that log information has been altered.

The device detects the time point at which the security event log information is altered, extracts the security event log information from the recovery blockchain using the transaction hash value and the merged hash value at the detected tampering time point, and then extracts the security event log information. It characterized in that it further comprises a data restoration unit for restoring the security event database with log information.

The data restoration unit is characterized in that the transaction hash value and the merge hash value recorded in the smart contract are compared with the transaction hash value and the merge hash value recorded in the security event database to detect the altered time point.

When the security event collection unit stores the transaction hash value and the merge hash value in a smart contract, the same transaction hash value and the merge hash value are also stored in the verification block chain, and the security event inquiry unit When a preset storage period for the transaction hash value and the merge hash value is exceeded, the transaction hash value and the merge hash value last recorded in the security event database, and the transaction hash value last recorded in the verification block chain, and merge. It is characterized in that it compares whether or not the hash values are the same to verify whether the security event log information is tampered with.

The method for processing a security event according to a preferred embodiment of the present invention for achieving the above object is a block chain for recovering the security event log information, the transaction hash value, and the merged hash value for the security event by the security event collection unit. And storing in a security event database, storing the transaction hash value and the merged hash value in a smart contract by a security event collection unit, and merging the transaction hash value last recorded in the security event database by a security event inquiry unit And verifying whether or not the security event log information is altered by comparing whether the hash value and the transaction hash value and the merge hash value last recorded in the smart contract are the same.

The storing of the security event database in the security event database includes the steps of collecting the security event log information when the security event occurs, and recording the security event log information in the recovery block chain, and the security event collection unit from the recovery block chain. When the transaction hash value corresponding to the security event log information is returned, calculating the merged hash value using the security event log information and the transaction hash value as a factor, and the security event collection unit in the recovery block chain. And indexing the transaction hash value and the merge hash value corresponding to the security event log information.

The step of verifying whether the security event log information is tampered with may include, as a result of the comparison, a transaction hash value and a merge hash value last recorded in the security event database, and a transaction hash value and a merge hash value last recorded in the smart contract. If not the same, it is characterized in that it is determined that the security event log information stored in the security event database has been altered.

When it is determined that the security event log information has been altered, the data restoration unit detects a time point at which the security event log information is altered, and the data restoration unit uses a transaction hash value and a merge hash value at the detected modulation time point. And extracting the security event log information from the recovery block chain, and restoring the security event database with the extracted security event log information.

The step of detecting the time point at which the security event log information is altered may include comparing the transaction hash value and the merge hash value recorded in the smart contract with the transaction hash value and the merge hash value recorded in the security event database by the data restoration unit. It is characterized by detecting the modulated time point.

The storing of the transaction hash value and the merge hash value in the smart contract includes storing the transaction hash value and the merge hash value equal to the transaction hash value and the merge hash value in a verification block chain; and , After the step of storing the transaction hash value and the merged hash value in the verification block chain, when a preset storage period for the transaction hash value and the merged hash value of the smart contract passes, the security event inquiry unit Verify whether the security event log information is tampered with by comparing whether the transaction hash value and merge hash value last recorded in the security event database and the transaction hash value and merge hash value last recorded in the verification blockchain are the same. It further includes the step of.

In order to achieve the above object, there is provided a computer-readable recording medium in which a program for executing the method for processing a security event according to the present invention described above in a computer is recorded.

As the era of hyper-connected networks in which the Internet is connected to all things beyond the information age, hacking attacks are gradually increasing, and compliance is gradually strengthening accordingly. Securing the integrity of various types of security events is a very important task, and in particular, in the case of securing the integrity of security events occurring in the personal information processing system, it is a situation that is required to satisfy compliance. A method of storing security events recorded in the existing local system to a remote system that cannot be modified/deleted is widely used, but the cost burden is high. However, the present invention satisfies compliance and operates at the same time by providing a method to quickly recover by dynamically detecting and recovering when an integrity problem occurs while at the same time verifying the integrity of security events by utilizing the irreversible characteristics of the blockchain and the database. There is an effect that can also reduce the cost aspect of.

1 is a diagram illustrating a system for processing a security event according to an embodiment of the present invention.

2 is a diagram for explaining the configuration of a security event management apparatus of a system for processing a security event according to an embodiment of the present invention.

3 is a diagram for explaining the configuration of a block chain network according to an embodiment of the present invention.

4 is a flowchart illustrating a method of processing a security event when an initial security event occurs according to an embodiment of the present invention.

5 is a flowchart illustrating a method of processing a security event according to an embodiment of the present invention.

6 is a flowchart illustrating a restoration procedure while processing a security event according to an embodiment of the present invention.

7 is a diagram for explaining a restoration procedure while processing a security event according to an embodiment of the present invention.

The apparatus for processing a security event according to a preferred embodiment of the present invention for achieving the above-described object, whenever a security event occurs, the security event log information, the transaction hash value, and the merged hash value with the recovery block chain. A security event collection unit that is stored in a security event database and stores the transaction hash value and the merged hash value in a smart contract, the transaction hash value and the merge hash value last recorded in the security event database, and the last in the smart contract. And a security event inquiry unit that compares whether or not the recorded transaction hash value and the merged hash value are the same, and verifies whether the security event log information is altered or not.

When the security event occurs, the security event collection unit collects the security event log information and records it in the recovery block chain, and when a transaction hash value corresponding to the security event log information is returned from the recovery block chain, the The merged hash value is calculated using the security event log information and the transaction hash value as factors, and the transaction hash value and the merged hash value corresponding to the security event log information are indexed in the recovery block chain. .

As a result of the comparison, if the transaction hash value and the merge hash value last recorded in the security event database and the transaction hash value and the merge hash value last recorded in the smart contract are not the same, the security event stored in the security event database It is characterized in that it is determined that log information has been altered.

The device detects the time point at which the security event log information is altered, extracts the security event log information from the recovery blockchain using the transaction hash value and the merged hash value at the detected tampering time point, and then extracts the security event log information. It characterized in that it further comprises a data restoration unit for restoring the security event database with log information.

The data restoration unit is characterized in that the transaction hash value and the merge hash value recorded in the smart contract are compared with the transaction hash value and the merge hash value recorded in the security event database to detect the altered time point.

When the security event collection unit stores the transaction hash value and the merge hash value in a smart contract, the same transaction hash value and the merge hash value are also stored in the verification block chain, and the security event inquiry unit When a preset storage period for the transaction hash value and the merge hash value is exceeded, the transaction hash value and the merge hash value last recorded in the security event database, and the transaction hash value last recorded in the verification block chain, and merge. It is characterized in that it compares whether or not the hash values are the same to verify whether the security event log information is tampered with.

The method for processing a security event according to a preferred embodiment of the present invention for achieving the above object is a block chain for recovering the security event log information, the transaction hash value, and the merged hash value for the security event by the security event collection unit. And storing in a security event database, storing the transaction hash value and the merged hash value in a smart contract by a security event collection unit, and merging the transaction hash value last recorded in the security event database by a security event inquiry unit And verifying whether or not the security event log information is altered by comparing whether the hash value and the transaction hash value and the merge hash value last recorded in the smart contract are the same.

The storing of the security event database in the security event database includes the steps of collecting the security event log information when the security event occurs, and recording the security event log information in the recovery block chain, and the security event collection unit from the recovery block chain. When the transaction hash value corresponding to the security event log information is returned, calculating the merged hash value using the security event log information and the transaction hash value as a factor, and the security event collection unit in the recovery block chain. And indexing the transaction hash value and the merge hash value corresponding to the security event log information.

The step of verifying whether the security event log information is tampered with may include, as a result of the comparison, a transaction hash value and a merge hash value last recorded in the security event database, and a transaction hash value and a merge hash value last recorded in the smart contract. If not the same, it is characterized in that it is determined that the security event log information stored in the security event database has been altered.

When it is determined that the security event log information has been altered, the data restoration unit detects a time point at which the security event log information is altered, and the data restoration unit uses a transaction hash value and a merge hash value at the detected modulation time point. And extracting the security event log information from the recovery block chain, and restoring the security event database with the extracted security event log information.

The step of detecting the time point at which the security event log information is altered may include comparing the transaction hash value and the merge hash value recorded in the smart contract with the transaction hash value and the merge hash value recorded in the security event database by the data restoration unit. It is characterized by detecting the modulated time point.

The storing of the transaction hash value and the merge hash value in the smart contract includes storing the transaction hash value and the merge hash value equal to the transaction hash value and the merge hash value in a verification block chain; and , After the step of storing the transaction hash value and the merged hash value in the verification block chain, when a preset storage period for the transaction hash value and the merged hash value of the smart contract passes, the security event inquiry unit Verify whether the security event log information is tampered with by comparing whether the transaction hash value and merge hash value last recorded in the security event database and the transaction hash value and merge hash value last recorded in the verification blockchain are the same. It further includes the step of.

In order to achieve the above object, there is provided a computer-readable recording medium in which a program for executing the method for processing a security event according to the present invention described above in a computer is recorded.

Prior to the detailed description of the present invention, terms or words used in the present specification and claims to be described below should not be construed as being limited to their usual or dictionary meanings, and the inventors will use their own invention in the best way. In order to explain, based on the principle that it can be appropriately defined as a concept of a term, it should be interpreted as a meaning and concept consistent with the technical idea of the present invention. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention, and do not represent all the technical ideas of the present invention, and thus various equivalents that can replace them at the time of application It should be understood that there may be water and variations.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this case, it should be noted that the same components in the accompanying drawings are indicated by the same reference numerals as possible. In addition, detailed descriptions of known functions and configurations that may obscure the subject matter of the present invention will be omitted. For the same reason, some components in the accompanying drawings are exaggerated, omitted, or schematically illustrated, and the size of each component does not entirely reflect the actual size.

In order to clarify the features and advantages of the means for solving the problems of the present invention, the present invention will be described in more detail with reference to specific embodiments of the present invention shown in the accompanying drawings.

However, in the following description and the accompanying drawings, detailed descriptions of known functions or configurations that may obscure the subject matter of the present invention will be omitted. In addition, it should be noted that the same components are denoted by the same reference numerals as much as possible throughout the drawings.

The terms or words used in the following description and drawings should not be interpreted as being limited to their usual or dictionary meanings, and the inventor may appropriately define the concept of terms for describing his or her invention in the best way. It should be interpreted as a meaning and concept consistent with the technical idea of the present invention based on the principle that there is. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention, and do not represent all the technical ideas of the present invention. It should be understood that there may be equivalents and variations.

In addition, terms including ordinal numbers such as first and second are used to describe various elements, and are used only for the purpose of distinguishing one element from other elements, and to limit the elements. Not used. For example, without departing from the scope of the present invention, the second element may be referred to as the first element, and similarly, the first element may be referred to as the second element.

In addition, when a component is referred to as being "connected" or "connected" to another component, it means that it is logically or physically connected, or can be connected. In other words, it should be understood that a component may be directly connected or connected to another component, but another component may exist in the middle, or may be indirectly connected or connected.

In addition, terms used in the present specification are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In addition, terms such as "comprises" or "have" described herein are intended to designate the existence of features, numbers, steps, actions, components, parts, or a combination thereof described in the specification. It is to be understood that the above other features or the possibility of the presence or addition of numbers, steps, actions, components, parts, or combinations thereof are not preliminarily excluded.

In addition, terms such as "... unit", "... group", and "module" described in the specification mean a unit that processes at least one function or operation, which can be implemented by hardware or software or a combination of hardware and software. have.

In addition, "a or an", "one", "the" and similar words are indicated otherwise in this specification in the context of describing the present invention (especially in the context of the following claims). It may be used in a sense encompassing both the singular and the plural, unless otherwise clearly contradicted by context.

In addition, embodiments within the scope of the present invention include computer-readable media having or carrying computer-executable instructions or data structures stored on the computer-readable media. Such computer-readable media may be any available media accessible by a general purpose or special purpose computer system. By way of example, such computer readable media may be in the form of RAM, ROM, EPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage, or computer executable instructions, computer readable instructions, or data structures. Physical storage media such as, but not limited to, any other media that can be used to store or transmit any program code means, and can be accessed by a general purpose or special purpose computer system.

In the description and claims that follow, a “network” is defined as one or more data links that enable the transfer of electronic data between computer systems and/or modules. When information is transmitted or provided to a computer system through a network or other (wired, wireless, or a combination of wired or wireless) communication connection, this connection can be understood as a computer-readable medium. Computer-readable instructions include, for example, instructions and data that cause a general purpose computer system or a special purpose computer system to perform a specific function or group of functions. Computer-executable instructions may be, for example, assembly language, or even binary, intermediate format instructions such as source code.

In addition, the present invention relates to a personal computer, a laptop computer, a handheld device, a multiprocessor system, a microprocessor-based or programmable consumer electronics, a network PC, a minicomputer, a mainframe computer, a mobile phone, a PDA, a pager. In a network computing environment having various types of computer system configurations including (pager) and the like, it can be applied to provide advertisements to the computer systems. The invention may also be practiced in a distributed system environment where both local and remote computer systems linked through a network with a wired data link, a wireless data link, or a combination of wired and wireless data links perform tasks. In a distributed system environment, program modules may be located in local and remote memory storage devices.

First, a system for processing a security event according to an embodiment of the present invention will be described. 1 is a diagram illustrating a system for processing a security event according to an embodiment of the present invention. 2 is a diagram for explaining the configuration of a security event management apparatus of a system for processing a security event according to an embodiment of the present invention. 3 is a diagram for explaining the configuration of a block chain network according to an embodiment of the present invention.

The system for processing security events according to an embodiment of the present invention (hereinafter, abbreviated as'security system', 10) uses a block chain and a smart contract to ensure integrity for security events. As a method of verifying and restoring, the integrity is verified using a block chain and database that have irreversible characteristics, and if an integrity problem occurs, it dynamically detects and recovers quickly. To this end, as shown in FIG. 1, the security system 10 includes a security information processing server 100, a security event management device 200, a blockchain network 300, a security event database 400, and a manager device 500. ). In particular, the blockchain network 300 includes a recovery block chain 310, a smart contract 320, and a verification block chain 330.

The security information processing server 100 is for providing a predetermined service to a user of the client terminal 1, that is, a customer, when the client terminal 1 is connected. Representatively, the security information processing server 100 may be an example of a server providing an Internet shopping mall, a game, an Internet service, and the like. In particular, when the client terminal 1 is connected, the security information processing server 100 may record and manage information of a user of the client terminal 1, that is, a customer. In an embodiment of the present invention, information that must be secured among information managed by the security information processing server 100, for example, customer information, will be referred to as security information.

The security event management apparatus 200 is for managing the access behavior of the client terminal 1 to the security information processing server 100, that is, a security event. The security event management device 200 may be provided as a separate device from the security information processing server 100. In this case, the security event management device 200 is interposed between the security information processing server 100 and the client terminal 1 to manage a security event in which the client terminal 1 accesses the security information processing server 100. I can. However, the present invention is not limited thereto, and the security event management apparatus 200 may be implemented as a kind of program installed and operated in the security information processing server 100.

Referring to FIG. 2, the security event management apparatus 200 includes a security event collection unit 210, a security event inquiry unit 220, and a data restoration unit 230.

The security event collection unit 210 collects security event log information when the client terminal 1 attempts to access the security information processing server 100, that is, when a security event occurs. Such security event log information may be composed of various information such as access time of the client terminal 1, identification information of the client terminal 1, access information, and behavior.

The security event collection unit 210 generates a transaction including security event log information and transmits it to the recovery block chain 310. Then, the security event log information is recorded in the recovery block chain 310 by any one node. And when the security event log information is recorded, the security event collection unit 210 receives the transaction hash value used to verify the transaction including the security event log information on the recovery block chain 310. I can. Then, the security event collection unit 210 may calculate a merge hash value by taking the security event log information and the transaction hash value as a factor. Then, the security event collection unit 210 indexes the transaction hash value and the merge hash value corresponding to the security event log information in the recovery block chain 310.

In addition, the security event collection unit 210 stores security event log information, transaction hash value, and merge hash value, which are the same information as the information stored in the recovery block chain 310, in the security event database 400. In addition, for integrity verification, the security event collection unit 210 indexes the transaction hash value and the merge hash value in the smart contract 320 and the verification block chain 330. That is, the security event collection unit 210 stores the transaction hash value and the merge hash value in the smart contract 320 and the verification block chain 330 according to the time sequence.

When a security event occurs, the security event inquiry unit 220 checks the security event database 400 to determine whether it is the first security event or a subsequent security event rather than the first. In addition, the security event inquiry unit 220 may check whether the security event log information has been altered based on the transaction hash value and the merge hash value.

When the security event log information of the security event database 400 is altered, the data restoration unit 230 accesses the recovery block chain 310 and uses the security event database 400 as the security event information of the recovery block chain 310. ) To recover.

The operation of the security event management apparatus 200 including the security event collection unit 210, the security event inquiry unit 220, and the data restoration unit 230 will be described in more detail below.

3, the block chain network 300 includes a recovery block chain 310, a smart contract 320, and a verification block chain 330. The recovery block chain 310, the smart contract 320, and the verification block chain 330 may be mounted on the same or different block chain networks.

The recovery block chain 310 stores security event log information whenever a security event occurs, and stores a transaction hash value and a merge hash value as an index of the security event log information.

The smart contract 320 stores a transaction hash value and a merge hash value corresponding to the security event log information according to the time sequence in which the security event occurs for integrity verification. The smart contract 320 maintains the stored transaction hash value and the merge hash value only for a preset storage period.

Like the smart contract 320, the verification block chain 330 stores a transaction hash value and a merge hash value corresponding to the security event log information according to the time sequence in which security events occur for integrity verification. Unlike the smart contract 320, the verification block chain 330 permanently preserves the stored transaction hash value and the merge hash value.

Meanwhile, the security event database 400 stores security event log information whenever a security event occurs, and stores a transaction hash value and a merge hash value as an index of the security event log information.

The manager device 500 is a device used by the administrator of the security system 10 including the security information processing server 100, the security event management device 200, the blockchain network 300, and the security event database 400. . The manager may inquire necessary information through the manager device 500. In addition, when data tampering is found, the security event management device 200 notifies the manager device 500 that the tampering has occurred, and the manager device 500 generates a warning so that the manager can recognize it.

Next, a method of processing a security event upon occurrence of an initial security event according to an embodiment of the present invention will be described. 4 is a flowchart illustrating a method of processing a security event when an initial security event occurs according to an embodiment of the present invention. In particular, the embodiment of FIG. 4 assumes that a security event occurs for the first time.

4, when the client terminal 1 attempts to access the security information processing server 100, a security event occurs. In this case, the security event inquiry unit 220 may recognize that it is the first security event occurring in step S110. In the case of the first occurrence of a security event, since there is no content stored in the security event database 400, the security event database 400 may be searched to recognize that it is the first security event.

As such, when the first security event occurs, the security event collection unit 210 includes information on the connection of the client terminal 1 in step S120, for example, access time, terminal identification information, access information, behavior information, etc. Collects security event log information.

The security event collection unit 210 records the security event log information, which is the original data previously collected in step S130, in the recovery block chain 310.

Then, the security event collection unit 210 receives the transaction hash value returned from the recovery block chain 310 in step S140 and calculates a merge hash value using the security event log information and the transaction hash value as a factor. do.

Subsequently, the security event collection unit 210 indexes the original data, the security event log information, the transaction hash value, and the merge hash value, in the recovery block chain 310 in step S150.

Then, the security event collection unit 210 stores the same information, that is, the security event log information, the transaction hash value, and the merge hash value in the security event database 400 in step S160.

In addition, the security event collection unit 210 indexes the transaction hash value and the merge hash value in the smart contract 320 and the verification block chain 330 in step S170.

Next, a method of processing a security event according to an embodiment of the present invention will be described. 5 is a flowchart illustrating a method of processing a security event according to an embodiment of the present invention.

Referring to FIG. 5, it is assumed that the client terminal 1 attempts to access the security information processing server 100 and a security event occurs. In this case, the security event inquiry unit 220 may recognize that it is not the first security event that has occurred in step S210. Since there is a content stored in the security event database 400, it can be recognized that it is not the first security event that occurred by inquiring the security event database 400.

The security event inquiry unit 220, recognizing that it is not the first security event, is a transaction hash value and a merge hash value of the last row of the security event database 400, that is, in the security event database 400 in step S220. After reading the last recorded transaction hash value and the merge hash value, compare whether the read transaction hash value and the merge hash value are the same as the last recorded transaction hash value and the merge hash value in the smart contract 320 do.

If the result of the comparison in step S220 is the same, the security event inquiry unit 220 determines that there is no tampering such as accessing the security event database 400 to modify or delete data, and proceed to step S230. On the other hand, if it is not the same as a result of the comparison in step S220, it is determined that there is modulation, and the process proceeds to step S280.

In step S230, the security event collection unit 210 records the security event log information in the recovery block chain 310. Then, the security event collection unit 210 receives the transaction hash value returned from the recovery block chain 310 in step S240 and calculates a merge hash value using the security event log information and the transaction hash value as a factor. do. In addition, the security event collection unit 210 indexes the security event log information, the transaction hash value, and the merged hash value, which are original data, in the recovery block chain 310 in step S250. Then, the security event collection unit 210 stores the same information, that is, the security event log information, the transaction hash value, and the merge hash value in the security event database 400 in step S260. Subsequently, the security event collection unit 210 indexes the transaction hash value and the merge hash value in the smart contract 320 and the verification block chain 330 in step S270.

Meanwhile, if it is determined that there is modulation, a restoration procedure is performed in step S280. The restoration procedure is a procedure for restoring data in the security event database by extracting the security event log information, which is the original data, from the recovery block chain 310. Then, the restoration procedure of step S280 described above during processing of a security event according to an embodiment of the present invention will be described in more detail. 6 is a flowchart illustrating a restoration procedure while processing a security event according to an embodiment of the present invention. In addition, FIG. 7 is a diagram for explaining a restoration procedure while processing a security event according to an embodiment of the present invention.

Referring to FIG. 6, the data restoration unit 230 detects a modulation time point in step S310. For example, the data restoration unit 230 modulates the transaction hash value and the merge hash value recorded in the smart contract 320 and the transaction hash value and the merge hash value recorded in the security event database 400 using a binary search algorithm. The viewpoint can be detected. The smart contract 320 has a preset storage period. That is, the smart contract 320 stores the transaction hash value and the merge hash value only during a preset storage period. Accordingly, the search speed for detecting the tampering point is improved by comparing the transaction hash value and the merge hash value recorded in the smart contract 320 with the transaction hash value and the merge hash value recorded in the security event database 400. If the storage period of the smart contract 320 is exceeded, the transaction hash value and the merge hash value recorded in the verification block chain 230 and the transaction hash value and the merge hash value recorded in the security event database 400 are compared. Thus, the modulated time point can be detected.

For example, as shown in FIG. 7, a modulated time point may be detected using a hash tree. When a hash tree is generated and compared using the transaction hash value and the merged hash value for each time of the smart contract 320 and the security event database 400, a modified time point can be detected. For example, if the transaction hash value and the merged hash value indicated by Td in the hash tree of FIG. 7 are modulated, the transaction hash value and the merged hash value indicated by Td are the hash existing in the generation path of the hash tree that is the basis. Value, i.e. T-hash(01), Hash(0-0), D-hash(30day), D-hash(30), Hash(0-14), ..., M- indicated by dotted box hash(1Month) will be different, and the rest of the hash will be the same.

When the tampering time point is detected, the data restoration unit 230 extracts the original data security event log information from the recovery block chain 310 using the transaction hash value and the merged hash value of the tampering time point detected in step S320, The security event database 400 is restored with the extracted security event log information.

As described above, according to an embodiment of the present invention, the recovery block chain 310 stores original data (security event log information), and even if the original data (security event log information) of the security event database 400 is damaged It is possible to safely restore the original data. In the conventional technology, only integrity was verified by using a block chain. However, the present invention can not only verify the integrity, but can also restore the original data. In addition, in the present invention, by combining the smart contract 320 and the recovery block chain 310, it is possible to find and restore only the location where integrity is damaged in a minimum time. On the other hand, due to the vast amount of data in the recovery block chain 310, the processing speed may be reduced during inquiry. However, the present invention can solve the problem of processing speed during inquiry by using the smart contract 320 or the verification block chain 330. That is, since the verification block chain 330 has only a transaction hash and a merge hash, the search speed is improved. In particular, it is possible to further improve the search speed by using the smart contract 320 having a constant storage period.

The merge hash value is an argument, and has the security event log information and transaction hash value, which are the original data. Although it is not possible to directly check whether the original data is damaged by simply using the transaction hash value, the present invention employs a merged hash value, so that it is possible to quickly check whether the original data is damaged only by comparing the hash values. That is, in order to check whether the original data is damaged with only the transaction hash, the original data must be retrieved through the transaction hash in the recovery block chain 310 and then compared. On the other hand, in the present invention, it is possible to quickly check whether the original data is damaged by comparing only the hash value with a merge hash value obtained by simply merging the transaction hash value and the shown event log information (original data).

Meanwhile, the method for processing a security event according to an embodiment of the present invention described above may be implemented in the form of a program that can be read through various computer means and recorded in a computer-readable recording medium. Here, the recording medium may include a program command, a data file, a data structure, or the like alone or in combination. The program instructions recorded on the recording medium may be specially designed and constructed for the present invention, or may be known and usable to those skilled in computer software. For example, the recording medium includes magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic-optical media such as floptical disks ( magneto-optical media), and a hardware device specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions may include not only machine language wires such as those made by a compiler, but also high-level language wires that can be executed by a computer using an interpreter or the like. Such a hardware device may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

As explained above, the specification includes details of a number of specific implementations, but these should not be understood as limiting to the scope of any invention or claimable, but rather may be peculiar to a particular embodiment of a particular invention. It should be understood as a description of the features that are present. Certain features described herein in the context of separate embodiments may be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination. Furthermore, although features operate in a particular combination and may be initially described as so claimed, one or more features from a claimed combination may in some cases be excluded from the combination, and the claimed combination may be a sub-combination. Or sub-combination variations.

The embodiments of the present invention present the best mode of the present invention, and provide examples to illustrate the present invention and to enable those skilled in the art to make and use the present invention. The written specification is not intended to limit the present invention to the specific terms presented. Therefore, although the present invention has been described in detail with reference to the above-described examples, those skilled in the art can make modifications, changes, and modifications to these examples without departing from the scope of the present invention. Therefore, the scope of the present invention should not be determined by the described embodiments, but should be determined by the claims.

[Explanation of code]

1: client terminal

10: security system

100: security information processing server

200: security event management device

210: security event collection unit

220: Security event inquiry unit

300: Blockchain network

310: Blockchain for recovery

320: smart contract

330: Blockchain for verification

400: security event database

500: manager device

Claims (13)

1. In the device for processing a security event,

   Whenever a security event occurs, the security event log information, the transaction hash value, and the merged hash value are stored in the recovery block chain and the security event database, and the transaction hash value and the merged hash value are stored in a smart contract. part; And

   To verify whether the security event log information is tampered with by comparing whether the transaction hash value and the merge hash value last recorded in the security event database and the transaction hash value and the merge hash value last recorded in the smart contract are the same. It characterized in that it comprises a; security event inquiry unit

   A device for handling security events.
2. The method of claim 1,

   The security event collection unit

   When the security event occurs, the security event log information is collected and recorded in the recovery block chain,

   When the transaction hash value corresponding to the security event log information is returned from the recovery blockchain,

   Calculating the merged hash value using the security event log information and the transaction hash value as factors,

   Indexing the transaction hash value and the merge hash value corresponding to the security event log information in the recovery block chain.

   A device for handling security events.
3. The method of claim 1,

   As a result of the comparison, if the transaction hash value and the merge hash value last recorded in the security event database and the transaction hash value and the merge hash value last recorded in the smart contract are not the same, the security event stored in the security event database It is characterized in that it is determined that the log information has been altered.

   A device for handling security events.
4. The method of claim 3,

   The security event log information is detected when the security event log information is tampered with, and the security event log information is extracted from the recovery block chain using the transaction hash value and the merged hash value at the detected modulation time, and then the extracted security event log information is used. And a data restoration unit for restoring the security event database.

   A device for handling security events.
5. The method of claim 4,

   The data restoration unit

   Comparing the transaction hash value and the merge hash value recorded in the smart contract with the transaction hash value and the merge hash value recorded in the security event database to detect the altered time point.

   A device for handling security events.
6. The method of claim 1,

   The security event collection unit

   When storing the transaction hash value and the merge hash value in a smart contract, the same transaction hash value and the merge hash value are also stored in the verification blockchain,

   The security event inquiry unit

   When a preset storage period for the transaction hash value and the merge hash value of the smart contract is exceeded, the transaction hash value and the merge hash value last recorded in the security event database and the last recorded in the verification blockchain. Comparing whether the transaction hash value and the merged hash value are the same to verify whether the security event log information is tampered with.

   A device for handling security events.
7. In a method for handling a security event,

   Storing, by the security event collection unit, security event log information, transaction hash value, and merge hash value for the security event in the recovery block chain and the security event database;

   Storing the transaction hash value and the merge hash value in a smart contract by a security event collection unit;

   Modulation of the security event log information by comparing whether the security event inquiry unit is the same as the transaction hash value and the merge hash value last recorded in the security event database with the transaction hash value and the merge hash value last recorded in the smart contract. The step of verifying whether or not; characterized in that it further comprises

   Methods for handling security events.
8. The method of claim 7,

   The step of storing in the security event database

   Collecting the security event log information when the security event occurs by the security event collection unit and recording it in a recovery block chain;

   When the security event collection unit returns a transaction hash value corresponding to the security event log information from the recovery block chain, calculating the merge hash value using the security event log information and the transaction hash value as factors; And

   And indexing the transaction hash value and the merge hash value corresponding to the security event log information in the recovery block chain by the security event collection unit.

   Methods for handling security events.
9. The method of claim 7,

   The step of verifying whether the security event log information is tampered with

   As a result of the comparison, if the transaction hash value and the merge hash value last recorded in the security event database and the transaction hash value and the merge hash value last recorded in the smart contract are not the same, the security event stored in the security event database It is characterized in that it is determined that the log information has been altered.

   Methods for handling security events.
10. The method of claim 9,

    Detecting, by a data restoration unit, a time point at which the security event log information is altered;

    Extracting the security event log information from the recovery block chain using the transaction hash value and the merge hash value of the detected modulation time by the data restoration unit; And

    And restoring the security event database with the extracted security event log information.

    Methods for handling security events.
11. The method of claim 10,

    The step of detecting the time point at which the security event log information has been tampered with

    Characterized in that the data restoration unit compares the transaction hash value and the merge hash value recorded in the smart contract with the transaction hash value and the merge hash value recorded in the security event database to detect the altered time point.

    Methods for handling security events.
12. The method of claim 7,

    Storing the transaction hash value and the merge hash value in a smart contract

    And storing the transaction hash value and the merge hash value equal to the transaction hash value and the merge hash value in a verification block chain; and

    After the step of storing the transaction hash value and the merge hash value in a verification block chain,

    When a preset storage period for the transaction hash value and the merge hash value of the smart contract is exceeded,

    The security event log compares whether the transaction hash value and the merge hash value last recorded in the security event database and the transaction hash value and the merge hash value last recorded in the verification blockchain are the same. The step of verifying whether the information is tampered with; characterized in that it further comprises

    Methods for handling security events.
13. A computer-readable recording medium on which a program for executing a method for processing a security event according to any one of claims 7 to 12 is recorded on a computer.

Images