JP2001306368A - Device and method for storing log data of communication network - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device and a method for storing log data of a communication network capable of preventing modification and deletion of log data by an unauthorized person to connect. SOLUTION: This device is constituted of a control means 11 to generate the log data of the person to connect a computer for server via an information communication network, a data transmitting means 15 to transmit the log data generated from the control means 11 and a storage means 30 to receive the log data through the data transmitting means and to store it in a medium in a form to enable write for only one time in real time.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus and method for storing log data in a communication network, and more particularly, to an apparatus and method for storing log data in a communication network.
BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a log data storage device and method for a communication network, which can prevent log data from being changed or deleted by an external user without a legitimate access right.

[0002]

2. Description of the Related Art In general, in a server or the like which is always connected through an information communication network such as the Internet, an external connecting person connected through the information communication network is connected to important internal data of the server and the server. To prevent access to your computer,
Restrict access rights in the operating system and set up a firewall. At the same time, connection routes and connection times (connection start time, connection end time, total connection time, etc.) for all connected users who have connected to the server through the information communication network, the ID of the connected user (IDentification; ID) and after connection The log data (Log Data) relating to the details of the activity (eg, file deletion, copying, generation, etc.) is stored in an auxiliary storage device such as a hard disk drive.

As described above, when an unauthorized access person such as a hacker disables an access restriction command of an operating system and disables a firewall, and performs an unauthorized access, the connection route and the like are determined by the log data stored in the auxiliary storage device as described above. Can be tracked back to recover a changed or destroyed system in a short time.

[0004]

However, as described above, even when an operating system restricts access rights and provides a firewall, and a log data is stored, an unauthorized connection such as a hacker can prevent the operating system from operating. If the log data stored in the auxiliary storage device is arbitrarily changed or deleted after the access restriction command and the firewall are disabled, it becomes difficult to trace unauthorized users and recover the changed or destroyed system. was there.

[0005]

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned various problems.
Provided is a log data storage device and method for a communication network that can write to log data only once and make it impossible to rewrite or delete log data, thereby preventing log data from being changed or deleted by an unauthorized user. It is in.

[0006]

According to a first aspect of the present invention, there is provided an apparatus for storing log data of a connecting party connected to a network device through a communication network, wherein log data relating to the connecting of the connecting party is generated. Control means, data transmission means for transmitting log data generated by the control means,
A storage device for receiving log data through the data transmission device and storing the log data in a medium that can be written only once is provided.

[0007] The storage means includes a plurality of the media, and further includes a buffer unit and a signal switching unit,
When the storage capacity of any one medium is exceeded, log data may be stored by switching to another medium. The medium of the storage means may be a compact disc recordable (CD-R medium) or a digital versatile disc recordable (DVD-R) medium.

According to a second embodiment of the present invention, there is provided a method for storing log data of a connected user who connects to a network device through a communication network, wherein a log file for recording the log data of the connected user is generated and stored in a storage device. A first step of saving, a second step of setting a log file saved in the current storage device to an old log file (Fo), and recording of log data of the connected party in the log file saved in the storage device A third step of setting a log file stored in the current storage device as a new log file (Fn), and a fourth step of setting an old log file (Fn).
If there is a change between the content written in o) and the content written in the new log file (Fn), the log data of the connected party is recorded in a separate log file (Fm) and can be written only once. A method for storing log data of a communication network, characterized by sequentially performing a fifth step of returning to the second step after storing the log data in a medium.

The log file (Fm) of the fifth step is
It may be stored in a writable medium only once with a predetermined time period as a cycle. The fifth step is to record only the contents that have changed between the contents of the old log file (Fo) and the contents of the new log file (Fn) in the log file (Fm), and to write to the medium that can be written only once. May be saved.
In this case, the log file (Fm) is preferably assigned a predetermined serial number to its file name for identification. According to a method of storing log data of a communication network, log data of a connected user, which increases with time, may be additionally recorded in real time on a writable medium only once. The medium may be a compact disc recordable (CD-R medium), or a digital versatile disc recordable (DVD-R medium).
Medium).

The above summary of the present invention does not list all of the necessary features of the present invention, and a sub-combination of these features may also be an invention.

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment according to the present invention will be described below in detail with reference to the accompanying drawings.

FIG. 1 is a schematic diagram showing a communication server connection system including a log data storage device of a communication network according to an embodiment of the present invention. As can be seen from the figure, the server connection system for communication including this embodiment includes a server computer 10 and a connection computer 20 which can be connected to the server computer 10 through the communication network N. And the server computer 10
And log data storage means 30 connected to the server.

In FIG. 1, according to one embodiment of the present invention,
Log data storage means 30 for server computer 10
Although the case where it is externally attached is illustrated as an example, according to another embodiment of the present invention, it can be built in the server computer 10 as shown in FIG.

The server computer 10 is always connected to the communication network N, and is connected to a connecting person via the communication network N.
It provides Web pages and various contents, sends and receives e-mails and data, and generates log data relating to the connection of a connected person connected through the communication network N, and outputs the log data to the log data storage unit 30.

Such a server computer 10
As shown in FIG. 3, the main processor 11 performs various control operations, and the memory 1 is a temporary storage space for data required when the main processor 11 performs control operations.
2, an auxiliary storage device 13 (for example, a hard disk drive) including an operating system and various applications and storing log data in which log data is recorded, and a communication network connected to the communication network N to transmit and receive data. It comprises a connection section 14 and a log data storage section connection section 15 for transmitting log data to the log data storage section 30 under the control of the main processor 11.
The server computer 10 further includes components such as a display unit and a user operation command input unit in addition to the above-described components. However, since these are well-known and conventional technologies, description thereof will be omitted. To

Here, the server computer 10
The main processor 11, the memory 12, the auxiliary storage device 13, the communication network connection unit 14, and the log data storage unit connection unit 15 can exchange data via a system bus (Data Bus) 16. ing. Further, the log data storage unit connection unit 15 may be any unit that can transmit log data to the log data storage unit 30 under the control of the main processor 11. When the log data storage means 30 is provided outside the server computer 10, the log data storage means connection unit 15 serves as an external data input / output device of a general computer system (for example, Parallel Port or S).
CSI Adapter or Universal Serial Bus Port). When the log data storage means 30 is provided in the server computer 10, the log data storage means connection section 15 serves as an internal data input / output device of a normal computer system (for example, an E-IDE input / output device or a SCSI input / output device). Output device).

The connecting computer 20 is a communication network.
It is generally a Netizen personal computer that can surf the Web through N,
Personal digital assistant (PDA: Personal Digital Assistant)
And communication networks N such as Internet-connected televisions
The present invention can be implemented in any form of communication terminal as long as the communication terminal can be connected to the server computer 10 through the Internet. Computer 20 for the connected person
Can be connected to the communication network N through various devices and methods known at present, such as a modem or a CSU (Channel Service Unit). However, since this is a well-known and conventional technology, a separate description will be omitted.

As described above, the communication network N is sufficient if the server computer 10 and the connecting computer 20 are connected in common and can perform data communication with each other. As an example, the communication network N Could be the Internet.

Further, the log data storage means 30 comprises:
The log data output from the server computer 10 is stored in a medium that can be written only once in real time. An example of the one-time writable medium is a compact disk recordable medium (Comp
act Disk-Recordable Media (CD-R) and digital versatile disk recordable media (Digital Versatile Di
sk Recordable Media; DVD-R). In addition to these, the present invention can be implemented using any type of medium as long as it cannot be rewritten, changed, or deleted once data is stored.

Here, one embodiment of the log data storage means 30 is the same as that shown in FIG. 4, and as shown in FIG. 4, the log data storage means 30 according to one embodiment of the present invention comprises a control unit. 31, a buffer unit 32, a signal switching unit 33, and a plurality of medium drives 34 and 35.

In FIG. 4, when log data is input from the server computer 10, the control unit 31
The signal switching unit 33 and the plurality of media drives 34 and 35 are selectively driven and accessed, and the server computer 10
The log data transmitted from is stored in a writable medium only once in real time.

The buffer unit 32 temporarily stores the log data transmitted from the server computer 10 and sequentially transmits the log data to any one of the plurality of media drives 34 and 35 through the signal switching unit 33. This is to compensate for the difference in data transmission speed between the server computer 10 and the log data storage means 30.

The signal switching section 33 selectively transmits the log data sequentially transmitted from the buffer section 32 to one of the plurality of medium drives 34 and 35 under the control of the control section 31. , The media drives 34, 35
Records the log data transmitted through the signal switching unit 33 on a medium that can be written only once.

Hereinafter, an example of the operation of the present invention configured as described above will be described in detail with reference to FIGS.

First, when the server computer 10 is turned on, the components of the server computer 10 including the main processor 11 are initialized. The initialized main processor 11 searches the auxiliary storage device 13 (S10), and determines whether a log file containing log data exists in the auxiliary storage device 13 (S20).

In step S20, the auxiliary storage device 13
If the log file that has already been generated is not searched, the main processor 11 generates a log file for writing log data to the auxiliary storage device 13 (S30), and measures time (T) (S40). Then, the log file stored in the current auxiliary storage device 13 is set as the old log file (Fo) (S45). As an example, the information on the old log file (Fo) is temporarily stored in the memory 12 or stored in a predetermined directory of the auxiliary storage device 13 (for example, a directory named Temporary).
irectory).

Next, the main processor 11 is connected to a communication network.
Generate log data (for example, a connection route, a connection time, an idea of a connected user, and a breakdown of activities after connection, etc.) of a connected user who connects to the communication network connection unit 14 through N, and generate the generated log data. The data is sequentially written to the log files stored in the auxiliary storage device 13 (S50). Incidentally, an example of the contents of the log data written in the log file of the auxiliary storage device 13 as described above is as follows.

[ Security Violations Nov 2 13:50:23 nemesis su 'su' failed for crowland
on / dev / ttyp6 Nov 2 13:50:35 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, crowland Nov 2 13:50:43 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, adm Nov 2 13:50:46 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, uucp Nov 2 13:50:48 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, root Nov 2 13:56:44 nemesis netacl [25785]: deny host =
blast.psionic.com/206.161.70.238 Unusual System Events Nov 2 13:50:23 nemesis su 'su' failed for crowland
on / dev / ttyp6 Nov 2 13:50:35 nemesis login: LOGIN FAILURE ON / de
v / ttyp5 FROMlocalhost, crowland Nov 2 13:50:43 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, adm Nov 2 13:50:46 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, uucp Nov 2 13:50:48 nemesis login: LOGIN FAILURE ON / d
ev / ttyp5 FROMlocalhost, root Nov 2 13:52:34 nemesis sshd [25715]: log: Connect
ion from206.161.70.238 port 4839 Nov 2 13:52:39 nemesis sshd [25715]: fatal: Conne
ction closed byremote host Nov 2 13:52:40 nemesis sshd [25717]: log: Connect
ion from206.161.70.238 port 4840 Nov 2 13:52:44 nemesis sshd [25717]: log: passwor
d authentication forcrowland accept Nov 2 13:52:48 nemesis sshd [25717]: log: closing c
onnection to206. 161. 70. 238 Nov 2 13:56:44 nemesis netacl [25785]: deny host
= blast.psionic.com/206.161.70.238 ''

Next, the main processor 11 sets the log file currently stored in the auxiliary storage device 13 as a new log file (Fn) (S55). For example, the information on the new log file (Fn) may be temporarily stored in the memory 12 or may be stored in a predetermined directory of the auxiliary storage device 13.

The main processor 11 executes the steps
The contents of the log data of the old log file (Fo) set in S45 and the contents of the log data of the new log file (Fn) set in step S55 are compared with each other to determine whether there is a change in the contents. If there is no change between the old log file (Fo) and the new log file (Fn), the time (T) measured so far is checked (S70). Is compared with a predetermined time (Ts) (for example, about 5 seconds) (S8).
0).

If the time (T) measured so far in step S80 does not exceed the set time (Ts), the main processor 11 proceeds to step S100 described later, while the measured time (T) is not If the set time (Ts) has elapsed, the time measured so far is reset (S90), and it is checked whether or not the administrator intends to turn off the server computer 10 (S100). If the server computer 10 is not selected to be turned off, the step S4 for measuring the time (T)
Return to 0.

If there is a change in the contents between the old log file (Fo) and the new log file (Fn) in step S60, the main processor 11 checks the time (T) measured up to now. (S110), this is compared with the set time (Ts) (S120). Step S
The time (T) measured so far at 120 is the set time (T
If s) has not elapsed, the main processor 11 proceeds to step S100, but on the other hand, measures the measured time (T).
If the set time (Ts) has elapsed, the main processor 11 generates a log file (Fm) to be stored on a writable medium only once through the log data storage unit 30 (S130).

Here, when the contents (log data) of the log file stored in the auxiliary storage device 13 are changed,
A new log file including both the already written log data and the changed log data is newly generated and overwritten on the existing log file.
Log file (F
m) records only changed log data. This is because the data in the auxiliary storage device 13 can be erased and rewritten, that is, rewritable. Therefore, when overwriting an existing file, the capacity of the log file does not increase so much. Since a medium cannot be rewritten, the capacity is unnecessarily increased when a log file including all log data is generated and added and stored. This is to prevent this.

For example, existing log data is data from a predetermined point in time to 13:20:00 on May 9, 2000, and log data newly changed is 13:20 on May 9, 2000. If the data is from 05:05 to 13:20:50 on May 9, 2000, the auxiliary storage device 13 stores the data from the predetermined time on May 9, 2000
All log data up to 20:50 is stored in one log file, but the medium that can be written only once is 13:20:05 on May 9, 2000 at which the new change occurred. From 13:20:50 on May 9, 2000
Only log data up to a second is stored.

As a result, a single log file is stored in the auxiliary storage device 13, but a plurality of log files (Fm) are stored in a medium that can be written only once. A serial number is added to the file name. As an example, the file name of the log file (Fm) stored in the write-once medium is "lo"
g-nov2-13-50-23.txt… log-nov2-13-52-
11.txt… log-nov2-13-53-15.txt… log-no
v2-14-01-55.txt... It is convenient if the serial numbers are sequentially assigned according to the recording time, as the log files (Fm) can be easily identified and the recording time can be immediately identified. .

Next, the main processor 11 transmits the log file (Fm) generated in step S130 to the log data storage unit 30 through the log data storage unit connection unit 15, and transmits the log file (Fm) from the log data storage unit connection unit 15. Log file (Fm) transmitted to log data storage means 30
Are sequentially written to the medium that can be written only once by the log data storage unit (S140).

That is, according to one embodiment of the present invention, log data added each time log data changes is written to a medium that can be written only once with a cycle of a set time (Ts). The reason why the log data is written on the medium that can be written only once at regular intervals is that the main processor 1
This is for reducing the load on 1.

Thereafter, the main processor 11 proceeds to step S90 to reset the time measured up to the present, and then proceeds to step S100 to check whether the administrator intends to turn off the server computer 10. As a result, if the server computer is not selected to be turned off, the process returns to the step S40 for measuring the time (T), whereas if the server computer 10 is selected to be turned off, writing is performed only once. Generate a log file (Fm) to save on a possible medium (S1
50).

Next, the main processor 11 transmits the log file (Fm) generated in step S130 to the log data storage unit 30 through the log data storage unit connection unit 15, and transmits the log file (Fm) from the log data storage unit connection unit 15. Log file (Fm) transmitted to log data storage means 30
Are sequentially written to the medium that can be written only once by the log data storage unit (S160).

Thereafter, the main processor 11 ends the control operation, and the server computer 10 is turned off. Originally, the server computer 10 is generally turned on for 24 hours. However, when the administrator checks the system or turns off the server computer 10 to suspend the operation of the system for a while. Therefore, in such a case, the system is turned off after the log data up to the latest is stored in the write-once medium through the log data storage unit 30 only once.

Next, a process of storing log data in the log data storage means 30 configured as shown in FIG. 4 will be described in accordance with one embodiment of the present invention.

When the log file (Fm) in which the log data is recorded is transmitted from the server computer 10 to the storage unit 30, the control unit 31 generates a control signal and outputs a control signal from among the plurality of medium drives 34 and 35. , One of the medium drives, and controls the signal switching unit 33 so that the log file (Fm) is transmitted to the driven medium drive. The log file (Fm) transmitted from the server computer 10 to the storage unit 30 is stored in the buffer unit 3.
After being temporarily stored in the media drive 2, the data is transmitted to the currently operating media drive among the plurality of media drives 34 and 35 through the signal switching unit 33. The log data transmitted from the buffer unit 32 is stored in a medium that can be written only once by the corresponding medium drive under the control of the control unit 31. At this time, the control unit 31 continuously checks the capacity of the log data transmitted to the medium drive. If the storage capacity of the medium inserted in the medium drive is exceeded, the control unit 31 drives the remaining medium drives and sets the signal switching unit 33. And the log file (Fm) output from the buffer unit 32 is transmitted to the remaining medium drives. Here, although not shown, the control unit 31 displays a message indicating that the storage capacity of the medium has been exceeded through a buzzer or other display means, so that the administrator can replace the medium in the medium drive that has exceeded the storage capacity. To

As described above, according to the present invention, log data of a connected user who connects to the server computer through the communication network is stored in the medium which can be written only once through the log data storing means. Log data is stored on a writable medium only once by the log data storage means even if the computer invades the server computer by disabling the operating system access restriction command and firewall, so that the log data is changed or deleted become unable. by this,
When an unauthorized user enters, the log data is read from the medium of the storage means, whereby the operation of recovering the changed or destroyed system can be easily performed by backtracking the intrusion route.

On the other hand, in the embodiment of the present invention, after log data is once stored in the auxiliary storage device, each time log data is newly generated, the newly generated log data can be written only once. Although only the case of addition to the medium has been described by way of example, this is only one of the various possible embodiments of the present invention, and according to another embodiment of the present invention, It is also possible to save log data in real time on a medium to which log data can be written only once without going through an apparatus. As described above, when the log data is stored in a write-once medium in real time without passing through the auxiliary storage device as in another embodiment of the present invention, a separate log file is not generated. Therefore, only the generated log data is recorded on a writable medium only once in real time.

On the other hand, in the embodiment of the present invention, only the case where connection record storage means for storing connection records such as log data is applied to a server computer has been described. The present invention is not limited to this, and can be applied to storing connection records of all types of network equipment.

[0046]

As described above, according to the present invention, since the log data is stored in a medium that can be written only once,
There are effects such as preventing log data from being changed or deleted by an unauthorized connection person.

[Brief description of the drawings]

FIG. 1 is a schematic diagram illustrating a communication server connection system including a log data storage device of a communication network according to an embodiment of the present invention.

FIG. 2 is a schematic diagram showing a communication server connection system including a log data storage device of a communication network according to another embodiment of the present invention.

FIG. 3 is a schematic block diagram of the server computer shown in FIGS. 1 and 2;

FIG. 4 is a schematic block diagram of a log data storage unit according to an embodiment of the present invention.

FIG. 5 is a flowchart illustrating a method for storing log data in a communication network according to the present invention.

[Explanation of symbols]

 10. . . Server computer 11. . . Main processor 12. . . Memory 13. . . Auxiliary storage device 14. . . Communication network connection unit 15. . . Log data storage means connection unit 20. . . Computer for connecting person 30. . . Log data storage means 31. . . Control unit 32. . . Buffer section 33. . . Signal switching unit 34, 35. . . Media drive

Claims (11)

[Claims] 1. An apparatus for storing log data of a connecting party connected to a network device through a communication network, wherein the controlling means generates log data related to the connection of the connecting party, and transmits the log data generated by the controlling means. A log data storage device for a communication network, comprising: a data transmission means for receiving the log data via the data transmission means; and a storage means for storing the log data in a medium that can be written only once. 2. The storage unit includes a plurality of the media, and further includes a buffer unit and a signal switching unit, and switches to another medium when the storage capacity of any one of the media is exceeded. The log data storage device for a communication network according to claim 1, wherein the log data is stored. 3. The communication network log data storage device according to claim 1, wherein the storage medium is a compact disc recordable (CD-R) medium. 4. The log data storage device according to claim 1, wherein the storage medium is a digital versatile disk recordable (DVD-R) medium. 5. A method of storing log data of a connecting party connecting to a network device through a communication network, wherein a first step of generating a log file for recording the log data of the connecting party and storing the log file in a storage device; A second step of setting the log file stored in the current storage device to an old log file (Fo), and a third step of recording the log data of the connected party in the log file stored in the storage device
And a fourth step of setting the log file saved in the current storage device to the new log file (Fn), and the contents written to the old log file (Fo) and the new log file (Fn) If there is a change between the contents, the log data of the connected party is recorded in a separate log file (Fm), stored in a medium that can be written only once, and then returns to the second step. A log data storing method for a communication network. 6. The log file (F) of the fifth step.
The method according to claim 5, wherein m) is stored in a writable medium only once with a predetermined time period as a cycle. 7. In the fifth step, only the contents that have changed between the contents of the old log file (Fo) and the contents of the new log file (Fn) are recorded in the log file (Fm). 7. The method according to claim 5, wherein the log data is stored in a writable medium. 8. The method according to claim 7, wherein a predetermined serial number is added to a file name of the log file (Fm) for identification. 9. The method of storing log data of a communication network according to claim 5, wherein log data of a connected user, which increases with time, is additionally recorded in a write-once medium in real time. 3. A method for storing log data of a communication network according to item 1. 10. The method according to claim 5, wherein the medium is a compact disk recordable (CD-R) medium. 11. The method according to claim 5, wherein the medium is a digital versatile disc recordable (DVD-R) medium.