JP2002297540A - Log collection system, server for use in log collection system and medium recorded with server control program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to determine correctness of a log. SOLUTION: A log collection server 10 and client 11 are arranged to be interconnected by a network. A client 10 generates a hash digest from the log information. The log information is encrypted with a session key. The hash digest and session key are encrypted by a public key. Encryption log information, an encryption hash digest and encryption session key are transmitted to the server 10. The server 10 decodes the encryption hash digest and encryption session key by using a secret key. The encryption log information is decoded by using the obtained session key. The hash digest is generated from the log information obtained by decoding in the server 10 and compared with the hash digest obtained by decoding. The log information is stored in the server 10 when two digests are matched.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a log collection system, a server used in the log collection system, and a medium recording a program for controlling the server.

[0002]

BACKGROUND OF THE INVENTION WWW servers and mail servers are becoming increasingly important for companies as information infrastructures of companies. However, illegal access to WWW servers and mail servers has been increasing year by year, causing damage and loss to companies. In such a situation, the existence of information that can be used as proof of unauthorized access has been strongly required in reporting damages.

[0003]

DISCLOSURE OF THE INVENTION An object of the present invention is to provide a log collection system capable of collecting logs with evidence.

A log collection system according to the present invention is configured such that a log collection server and at least one or more clients in which log information is stored are interconnected by a network.

[0005] The client includes first client authentication information generation means for generating first client authentication information from the log information, first encryption means for encrypting the log information with a first key, and The first client authentication information generated by the first client authentication information generating means and the first client authentication information used for encrypting the log information.
A second encryption means for encrypting the key with the second key, the encrypted log information generated by the first encryption means, and the encryption generated by the second encryption means. First client authentication information and encrypted first
And a first transmitting unit for transmitting the key to the log collection server.

The log collection server obtains the encrypted first client authentication information and the encrypted first key by using first and second decryption means for decrypting the encrypted first client authentication information and the encrypted first key using a third key. Second decryption means for decrypting the encrypted log information using the obtained first key, and a second client for generating second client authentication information from the log information obtained by the second decryption means Authentication information generating means for determining whether or not the second client authentication information generated by the second client authentication information generating means matches the first client authentication information obtained by the first decryption means; The client authentication means and the client authentication means determine that the first client authentication information and the second client authentication information match. If the, and a log information storage means for storing log information obtained by the second decoding means.

Here, a client is a WWW server or S
Including MTP (simple mail transfer protocol) server. This means a client in the log collection system, which is a client in the log collection system, but may be a server in another system at the same time.

[0008] A firewall may be set between the log collection server and the client to protect a corporate LAN or the like from irregular entry.

According to the present invention, both the log collection server and the client connected to the network have means for generating client authentication information created from log information. Client authentication information is created in the client from the log information stored in the client. The log information is sent to the log collection server in an encrypted state. The encrypted log information is decrypted in the log collection server, and client authentication information is generated in the log collection server from the log information obtained by the decryption. If the algorithm of the client authentication information generation means is the same, the two client authentication information will match. The log information obtained by decryption is stored and saved in the log collection server on condition that the two client authentication information matches.

As described above, according to the present invention, whether the encrypted log information transmitted from the client to the log collection server is valid based on the client authentication information,
That is, it is possible to determine that the data is transmitted from a client constituting the log collection system.
Logs obtained by decryption can be provided with evidential ability.

Since log information is encrypted and transmitted from the client to the log collection server, even if the log information is stolen during transmission, there is little possibility that the log information will be falsified.
Further, since the log created in the client is not stored in the client but is stored in the log collection server, the possibility that the log is falsified is reduced as compared with a system in which the log is stored for each client. be able to.

In one embodiment, the client includes:
There is further provided second transmission means for transmitting the first client authentication information generated by the first client authentication information generation means to the log collection server. The log collection server further includes a storage unit that stores the first client authentication information transmitted by the second transmission unit as third client authentication information. The client authentication unit determines whether the first client authentication information, the second client authentication information, and the third client authentication information match.
Since the log information is stored in the log collection server only when the three client authentication information matches, the log information transmitted from the client constituting the log collection system and
Log information transmitted from a client that does not constitute the log collection system can be determined with higher accuracy.

In another embodiment, the storage means of the log collection server stores the first client authentication information in response to the transmission of the first client authentication information from the client. And time information indicating the time when the third client authentication information was stored. The log collection server transmits to the client third encryption means for encrypting the time information using a fourth key, and encrypted time information encrypted by the third encryption means. A third transmitting means is provided. The second of the above clients
Means for encrypting, in addition to the first client authentication information generated by the first client authentication information generating means and the first key used for encrypting the log information, the log collection server Is encrypted with the second key. The first transmitting means of the client comprises: encrypted log information generated by the first encrypting means; encrypted first client authentication information generated by the second encrypting means; The key and the encrypted encryption time information are transmitted to the log collection server.

[0014] The first decryption means of the log collection server converts the encrypted first client authentication information, the encrypted first key and the encrypted encryption time information using a third key. Decrypt. The log collection server further includes third decryption means for decrypting the encryption time information obtained by the first decryption means using the fourth key. The log information storage means of the log collection server stores the log information together with the time information obtained by the third decryption means.

By attaching the time information to the log information, it is possible to prove the time when the log information was created in the client and the log information was transmitted from the client to the log collection server. It is preferable that the client adds (links) time information (encrypted time information) to the log information (encrypted log information). The accompanying time information includes that using the electronic signature technology. The possibility of falsification of the time information using the log collection server can be reduced, and it can be used to prove that the time information attached to the log information is objective and accurate.

Preferably, the log collection server acquires time information from a network time server connected to the network. Obtaining the time information from a network environment different from the network environment including the log collection server and the client can ensure the objectivity of the time information attached to the log information.

The network time server is a GPS (G
It has a receiver for receiving a time signal transmitted from a global positioning system. A time signal from the satellite is acquired by the network time server, and time (time) information based on the time signal is used in the log collection server. In addition, on the Internet, "NTP (Network Time Pr
otocol) ", and this NTP may be used. The standard radio wave used to widely inform the inside and outside of the country of the standard of time and frequency and the Japan Standard Time based on Coordinated Universal Time may be used.

The present invention also provides a log collection server used in a log collection system, a control method thereof, a control program for the log collection server, and a program recording medium.

[0019]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows an example of the configuration of a log collection system for providing evidence to a log notified from a client.

The log collection system includes a log collection server 10, a plurality of clients 11, and a network time server.
12 are mutually connected by a network. Log collection server 10 and client 11
This is a computer system including a PU, a memory, a hard disk, an input device, an output device, and the like. network·
The time server 12 is a computer system including a CPU, a memory, a hard disk, and the like. Here, the client means a client in a relationship with the log collection server 10. That is, the client in this log collection system includes a computer system having a server function such as a WWW server and a mail server. In the log collection system, a WWW server, a mail server, and the like are also positioned as clients connected to the log collection server 10 via a network.

The network time server 12 is a satellite
It has a receiver for receiving a GPS (Global Positioning System) time synchronization signal transmitted from 13. An accurate time is obtained from a time signal source independent of the network constituted by the client 11 and the server 10. The log collection server 10 can obtain an accurate time via the network time server 12.

The log collection server 10 collects logs created in the client 11 and stores the collected logs as described later. In addition, it has a function of checking the authenticity of the log sent from the client 11 together with the authentication of the client 11.

A strong access control mechanism exists between the log collection server 10 and the client 11. Access using a protocol other than the one related to log collection is not possible.

The log collection server 10 includes a public key / private key generation program, a time stamp key generation program, an encryption program, a decryption program, and a communication program. Details of the processing of these programs will be described later.

The client 11 includes a session key generation program, an encryption program, a decryption program, and a communication program. Details of the processing of these programs will also be described later.

FIG. 2 shows a table stored in the storage device of the log collection server 10. Log collection server 10
In addition to the above-mentioned various programs, a table described below is also stored in the storage device.

FIG. 2A is a table in which an identification name (client name) for identifying each client 11 is used as a key, and a pair of a public key and a secret key corresponding to each client 11 is stored. The clients 11 constituting the log collection system are known in the log collection server 10, and a pair of a public key and a secret key corresponding to each of the clients 11 is prepared in advance. The public key / private key pair is generated by the above-described public key / private key generation program. By the public key / private key generation program,
A different public key / private key pair is generated for each client 11. Of course, the public / private key pair generated by a device other than the log collection server
May be stored in the storage device.

FIG. 2B shows a table for managing the correspondence between the time stamp and the hash digest.
As described later, in the log collection server 10, the client
1 for each of the hash digests sent from 11
A time stamp corresponding to one-to-one is issued, and the correspondence between the transmitted hash digest and the time stamp is managed. For example, hash digest (A, 1)
Indicates that the hash digest is the first hash digest transmitted from the client A. The time stamp corresponding to the hash digest (A, 1) is time stamp 1.

FIGS. 3 and 4 show the processing flow of the log collection server 10 and the client 11. Multiple clients
11 performs basically the same operation, and here, the operation of one client (client A) is shown. A block S1 surrounded by a broken line indicates a processing flow of the log collection server 10, and a block C1 surrounded by a broken line indicates a processing flow of the client A. FIG. 5 shows an outline of the encryption processing performed in the client A, and FIG. 6 shows an outline of the decryption processing and the collation processing performed in the log collection server 10, respectively.

In the client A, the log generated by the operating system (OS) is read (process 100). FIG. 7 is an example of a log generated in the client A.

The underlined "kona" in line (1) is the name of client A. The log shown in FIG. 7 shows the contents of the processing performed by the client “kona” and the processing performed by the client “kona” using another computer.

The underlined “in.telnetd” is the name of the process running on the client A. “7834” is the process ID. The underlined “shuttle” is the name of the computer that accessed the client A. Row (1)
Indicates that at 15:57:41 on November 6, a computer named “shuttle” accessed a client A named “kona” by telnet. The lines (1), (2) and (3) indicate that the computer "shuttle" has three processes (windows) in which the client "kona" processes by telnet. Line (4) is on client A:
This indicates that the processing for the mail server has been started.

The log described above is temporarily stored in the buffer area of the memory of the client A. In the log collection system, a log is stored in a log collection server connected to the client A via a network as described later.
Done at 10.

In the process 101, the log read in the process 100 is converted by using a hash function to generate a hash digest (A) (see FIG. 5A). There are known hash functions such as "MD5" and "SHA". For example, when the hash function “MD5” is used, 12
An 8-bit hash digest is generated. For example, the hash function "MD5" uses the string "The meeting last
week was swell. "is converted to" 050f3
905211cddf36107ffc361c23e3d ".

In the process 102, the hash digest (A), the client name, and the client's public key are transmitted to the log collection server 10 as connection request data to the log collection server 10. The client name is stored in the storage device of the client A in advance. The public key is a public key of a pair of a public key and a private key generated in advance by the log collection server 10 as described above. The public key and the secret key generated by the log collection server 10 are stored in the storage device of the client A.

In the process 200, the log collection server 10 receives the connection request data (hash digest (A), client name and public key) transmitted from the client A. The log collection server 10 accesses the table shown in FIG. It is checked whether the client name described in the received request connection data is registered in the table, and if it is registered in the table, whether the same public key as the transmitted public key is registered in the table Is checked. If it is correct, the process proceeds to processing 201, and if it is not correct, it is regarded as an unauthorized access, and the process ends.

In the process 201, first, the log collection server 10 generates a random number. The log collection server 10 encrypts the random number with the client A's public key stored in the table (FIG. 2A).

[0038] The encrypted random number is called a challenge code. The challenge code is for confirming whether or not the client A to which the server has transmitted the connection request is a client permitted to access.

The client A, having received the challenge code, decrypts the challenge code by using a secret key by a decryption program (process 103). The challenge code is returned to the original random number.

In the process 104, the character string (random number generated by the log collection server 10) obtained by the decryption is applied to a hash function to generate a hash digest (this is called a response code). The generated response code is further encrypted with a public key using an encryption program. The encrypted response code (encrypted response code) is transmitted to the log collection server 10.

In step 202, the encrypted response code transmitted from the client A is received. The encrypted response code is decrypted with the secret key (stored in the above-described table (stored in FIG. 2A)) of the client A. The response code is obtained. The generated hash random number is applied to a hash function to generate a hash digest.The generated hash digest is compared with the response code.
Is determined. Proceed to process 203. Otherwise, it is regarded as an unauthorized access and the processing is interrupted.

In step 203, the log collection server 10 creates a time stamp using the time information obtained from the network time server 12. The information included in the time stamp is information on year, month, day, hour, minute, and second.

In step 204, the log collection server 10 encrypts the time stamp using a common key cryptosystem using an encryption program. An encrypted time stamp is generated. The time stamp key used for encrypting the time stamp is generated by a time stamp key generation program. The same key may be used as the time stamp key each time, or the time stamp key may be generated each time an encrypted time stamp is generated.

In processing 205, the log collection server 10 checks the time stamp and the hash digest (B) before encryption.
Are stored in a table as shown in FIG. 2 (B). The hash digest (B) is the same as the hash digest (A) of the log transmitted from the client A at the time of the connection request. In the log collection server 10, the hash digest (A) is stored as a hash digest (B).

In the process 206, the log collection server 10
The encrypted time stamp is transmitted to the client A using the encryption program.

In the process 105, the client A receives the encrypted time stamp transmitted from the log collection server 10. In the client A, a session key generation program is executed, and a random number (session key) is generated.

In the process 106, the client A executes the encryption program. The log is encrypted with the session key (encrypted log generation (FIG. 5 (2)). Processing 10
Proceed to 7.

In process 107, client A
A hash digest (A), the session key,
A header including the encrypted time stamp is created.
A control code is inserted between the hash digest (A) and the session key, and between the session key and the encrypted time stamp.

In step 108, the header is encrypted with the public key (FIG. 5 (3)).

In the process 109, the client A integrates the encrypted header and the log (encrypted log) encrypted with the session key. A control code is inserted between the encrypted header and the encrypted log.

In the process 110, the client A transmits the integrated data (encrypted header and encrypted log) to the log collection server 10 (FIG. 5 (4)).

In process 207, the log collection server 10 receives the integrated data transmitted from the client A. The log collection server 10 recognizes a boundary (boundary) between the encrypted header and the encrypted log in the integrated data based on the control code. The integrated data is separated (decomposed) into an encryption header and an encryption log (FIG. 6).
(1)).

In the process 208, the log authentication server 10
The encrypted header is decrypted with a secret key using a decryption program. A header including the hash digest (A), the session key, and the encrypted time stamp is generated (FIG. 6 (2)). Based on the control code, it is separated into a hash digest (A), a session key, and an encrypted time stamp.

In step 209, the log collection server 10 decrypts the encrypted time stamp with the time stamp key using a decryption program. A time stamp is obtained (FIG. 6 (3)).

In the process 210, the log collection server 10
Decrypts the encrypted log with the session key using a decryption program. A log is obtained (FIG. 6 (4)).

In the process 211, the log collection server 10 applies a hash function to the log obtained by decryption to create a hash digest (C) (FIG. 6 (5)).

In the process 212, the log collection server 10
The hash digest (B) is obtained by accessing the table shown in FIG. 2B and using the time stamp obtained by decryption as a key.

In the process 213, the log collection server 10 writes the hash digest (A) included in the header obtained by decryption, the hash digest (B) stored in the table, and the log obtained by decryption. Hash digest obtained by applying a hash function
Compare and confirm with (C). If there is a mismatch, the process is stopped.

In step 214, the log collection server 10 saves the header and the log.

As described above, in the log collection system, in general, the log written and saved in the file in each of the clients 11 is not the client 11 but the log.
Stored in the log collection server 10. Client 11
Since the log before being sent to the log collection server 10 is written into the buffer area of the memory of the client 11, the client 11 is illegally accessed and evidence of the access (this evidence is also generally recorded in the log) Written)
Can be prevented from being intentionally erased.

Since the log sent from the client 11 is sent to the log collection server 10 via the network in an encrypted state, the risk of the contents of the log being falsified on the transmission path is avoided. can do.

Further, the validity of the log transmitted from the client 11 to the log collection server 10 can be almost accurately determined by the hash digests (A), (B) and (C). Even if a log is transmitted from a computer for which use of the log collection system is not permitted, it can be determined with high accuracy that such a log is not valid.

Further, the log transmitted from the client 11 to the log collection server 10 is accompanied by a time stamp as header information, and the time stamp is based on the time information using the network time server 12. It can be used for certifying the time when the log is stored in the log collection server 10, and the like.

The program described above can be recorded on a portable recording medium such as a CD-ROM or a fixed recording medium. By installing the program from the medium on which the program is recorded, the computer system can be operated as the log collection server 10.

[Brief description of the drawings]

FIG. 1 shows the overall configuration of a log collection system.

FIG. 2 (A) shows an example of a table storing a correspondence between a client and a public key and a secret key, and FIG. 2 (B) shows an example of a table storing a correspondence between a time stamp and a hash digest, respectively. .

FIG. 3 is a flowchart illustrating a flow of data communication between a log collection server and a client.

FIG. 4 is a flowchart showing a flow of data communication between a log collection server and a client.

FIG. 5 shows an outline of an encryption process in a client.

FIG. 6 shows an outline of decryption processing and collation processing in the log collection server.

FIG. 7 shows an example of a log.

[Explanation of symbols]

 10 Log collection server 11 Client 12 Network time server 13 Satellite

Continued on the front page (51) Int.Cl. ⁷ Identification code FI Theme coat II (Reference) H04L 9/32 H04L 9/00 601E 673C F-term (Reference) 5B017 AA07 BA07 CA16 5B042 GA12 GA18 MA08 MC35 MC40 5B085 AC14 AE23 AE29 BG07 5J104 AA01 AA07 AA16 EA04 EA19 KA01 KA05 NA02 NA05 PA07

Claims (10)

[Claims] 1. A log collection system comprising a log collection server and a client in which at least one or more log information is stored are connected to each other by a network, wherein the client is configured to execute a log processing based on the log information. 1
First client authentication information generating means for generating client authentication information, first encryption means for encrypting the log information with a first key, and first client authentication information generating means for generating the first client authentication information. Encryption means for encrypting the client authentication information and the first key used for encrypting the log information with a second key, and a cipher generated by the first encryption means. Log information, encrypted first client authentication information generated by the second encryption means, and encrypted first client authentication information.
And a first transmitting means for transmitting the encrypted first client authentication information and the encrypted first key to the log collection server by using a third key. First decryption means for decrypting the encrypted log information using the first key obtained by the first decryption means, and second decryption means for decrypting the encrypted log information by using the first key obtained by the first decryption means. Second client authentication information generating means for generating second client authentication information from the log information, the second client authentication information generated by the second client authentication information generating means, and the first decryption means. Client authentication means for determining whether the obtained first client authentication information matches, and the first client authentication information and the second client authentication information by the client authentication means. If it is determined that the client authentication information matches, the second log information storage means for storing log information obtained by the decoding means, a log collection system. 2. The client according to claim 2, wherein said client transmits first client authentication information generated by said first client authentication information generating means to said log collection server.
Wherein the log collection server further comprises storage means for storing the first client authentication information transmitted by the second transmission means as third client authentication information, wherein the client authentication means 2. The log collection system according to claim 1, wherein the system determines whether the first client authentication information, the second client authentication information, and the third client authentication information match. 3. The storage means of the log collection server stores the first client authentication information as third client authentication information in response to the transmission of the first client authentication information from the client. , Which stores time information indicating the time at which the third client authentication information is stored, wherein the log collection server encrypts the time information using a fourth key, and A third transmitting unit for transmitting the encryption time information encrypted by the third encrypting unit to the client, wherein the second encrypting unit of the client includes the first client authentication information generating unit Client authentication information generated by the above, the first key used for encrypting the log information, and the first client authentication information transmitted from the log collection server. Encrypting the encryption time information with a second key, wherein the first transmitting means of the client transmits the encrypted log information generated by the first encrypting means to the second encryption key; Transmitting the encrypted first client authentication information, the encrypted first key, and the encrypted encryption time information generated by the means to the log collection server; Means for decrypting the encrypted first client authentication information, the encrypted first key and the encrypted encryption time information using a third key, and the log collection server Further, there is provided third decryption means for decrypting the encryption time information obtained by the first decryption means using the fourth key, and the log information storage means of the log collection server stores the log information. In the third Is accompanied by time information obtained by the decoding means is configured to store the log authentication system according to claim 2. 4. A network time server is connected to the network, and the log collection server further includes time information acquiring means for acquiring time information from the network time server. 3. The log collection system according to 3. 5. The log collection system according to claim 1, wherein the first client authentication information and the second client authentication information are obtained by performing an operation using a hash function on log information. 6. The client includes first key generating means for generating a first key used for encrypting log information, wherein the first key generating means encrypts the log information every time the client encrypts the log information. The log collection system according to claim 1, wherein the first key is generated at the same time. 7. The log collection server used in a log collection system in which a log collection server and at least one client in which log information is stored are interconnected by a network. A first decryption unit for decrypting the encrypted first client authentication information and the encrypted first key transmitted from the first decryption unit using a second key, and a first decryption unit obtained by the first decryption unit. Second decryption means for decrypting the encrypted log information transmitted from the client using a key, and second decryption means for generating second client authentication information from the log information obtained by the second decryption means. Client authentication information generation means, the second client authentication information generated by the second client authentication information generation means, and the first recovery Client authentication means for judging whether the first client authentication information obtained by the first means matches the first client authentication information, and that the first client authentication information and the second client authentication information match by the client authentication means. A log information storage unit that stores the log information obtained by the second decryption unit when is determined. 8. A method for controlling a log collection server used in a log collection system in which a log collection server and at least one client in which log information is stored are interconnected by a network. , The encrypted first sent from the client
Client authentication information and encrypted first key
Decrypting the encrypted log information transmitted from the client using the obtained first key, generating second client authentication information from the obtained log information, The generated second client authentication information;
It is determined whether or not the obtained first client authentication information matches. If it is determined that the first client authentication information matches the second client authentication information, it is obtained by decryption. A method for controlling a log collection server that stores log information. 9. A control program for a log collection server used in a log collection system in which a log collection server and at least one or more clients in which log information is stored are interconnected by a network. Decrypting the encrypted first client authentication information and the encrypted first key transmitted from the client using a second key, and transmitting the decrypted first client authentication information and the encrypted first key from the client using the obtained first key. Decrypts the encrypted log information to be generated, generates second client authentication information from the obtained log information, and the generated second client authentication information matches the obtained first client authentication information. It is determined whether or not the first client authentication information and the second client authentication information match. A program for controlling the log collection server so as to store the obtained log information. 10. A recording medium on which the program according to claim 9 is recorded.