KR101435592B1 - A log verification device for the contents distribution log of authoring content provided as an online service - Google Patents

Abstract

The present invention relates to a log verifying apparatus for verifying a content distribution log of an authoring content provided as an online service, and is provided in a user log of authoring content consumed in a user terminal and in an online service provider or an online service provider database The contents of the copyrighted content provided as an online service that can clearly verify the distribution of the copyrighted content by comparing the generated log and the generated distribution log to the log storage server, And a log verifying apparatus for verifying the distribution log.
A log verifying apparatus for verifying a content distribution log of an authoring content provided by an online service of the present invention includes a user log analyzing unit for analyzing a user log of content downloaded or uploaded from a user terminal, A distribution log analyzer for analyzing the distribution log generated by the log agent that records the log; and a backup log generator for generating a backup log by backing up the distribution log generated by the log agent and analyzing the stored backup log And an analysis log comparing unit for comparing two or more of the analyzed user log, the distribution log, and the backup log analyzed.

Description

[0001] The present invention relates to a log verifying apparatus for verifying a content distribution log of an authoring content provided as an online service,

The present invention relates to a log verifying apparatus for verifying a content distribution log of an authoring content provided as an online service, and is provided in a user log of authoring content consumed in a user terminal and in an online service provider or an online service provider database The contents of the copyrighted content provided as an online service that can clearly verify the distribution of the copyrighted content by comparing the generated log and the generated distribution log to the log storage server, And a log verifying apparatus for verifying the distribution log.

Generally, an online service provider (OST) such as a digital cable and an IPTV provider charges a copyrighted content and provides it to a user, and the user receives a paid content at a fair cost. In the 'method for digital rights management' of Korean Patent Laid-Open Publication No. 2008-64164 (2008.07.08) which is a prior art for providing such paid contents, a license related to the protected contents is evaluated, and a requested access A method for granting authority to a user is disclosed. However, in the related art, the access right to the digital contents is limited to restrict access, but the problem of illegally using the digital contents to which the use right is granted can not be solved. Accordingly, There is a problem.

On the other hand, the online service provider receives the fee for authoring content from users while paying the authoring content to the user while providing the authoring content to the user, and the authoring cost of the authoring content paid by the users is obtained from the author of the authoring content and the online service provider Are distributed at a predetermined ratio to generate profits.

However, recent online service providers are providing a large number of paid authoring contents to users, while interrupting some of the revenue generated by providing authoring content by omitting, deleting or modifying the provision record of the authoring content, There is a problem that the user can not receive the profit.

In addition, while the online service provider encrypts and stores the generated log while providing the authored content to the users, it takes a lot of time to analyze the encrypted log to check the legitimate distribution record of the authoring content, There is a problem that technology is not easy.

Accordingly, it is difficult for an online service provider to check the author's content provided for a fee by the missing, deleted, or modified log record of the authored content, There is a problem that the revenue to be paid to the author of the authoring content is lost due to the inability to accurately grasp the profit.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the problems of the prior art as described above, and it is an object of the present invention to provide a tool for verifying the reliability of an online service provider illegally distributing content.

It is another object of the present invention to perform tracking and verification of illegal circulation activities by causing a content distribution record to be recorded in a user terminal that downloads or uploads contents.

It is another object of the present invention to perform tracking and verification of an illegal circulation activity by recording a content circulation record in a log black box, a log agent.

It is another object of the present invention to perform tracking and verification of an illegal circulation activity by backing up a log record stored in a log agent to a log storage server.

In addition, according to the present invention, by comparing two or more of a user log recorded in a user terminal and a backup log recorded in a log storage server and a log record recorded in a log agent, it is possible to track and verify illegal circulation of an online service provider There is another purpose to carry out.

In addition, the present invention provides an online service provider that installs a log agent on one or more online service provider servers for providing authoring content, analyzes real-time SQL packets transmitted and received between one or more online service provider databases, In real time, thereby eradicating illegal circulation of the contents.

In addition, the present invention provides a real-time analysis of SQL packets transmitted and received with an online service provider server for providing authoring content by installing a log agent in one or more online service provider databases for storing authoring content and distribution information, There is another purpose of eradicating the illegal circulation of the authoring contents by logging the contents in which the authoring contents are served in real time.

In addition, the present invention records the distribution contents of the authoring content provided by the online service provider as a fee to the user in a normalized and formatted log, thereby making it possible to store the distribution logs of the plurality of online service providers in the user log and the backup log There is another purpose for performing online service provider tracking and verification of illegal content distribution activities.

In addition, the present invention provides a method and system for preventing an online service provider from tampering with or modifying a distribution log record by monitoring an access to a distribution log generated while an online service provider provides the user with a fee and logging a monitoring event for the same There is another purpose.

According to another aspect of the present invention, there is provided a log verifying apparatus comprising: a user log analyzing unit for analyzing a user log of content downloaded or uploaded from a user terminal; and a log analyzing unit A backup log analyzing unit for analyzing the log and a backup log analyzing unit for analyzing the stored backup log by generating a backup log by backing up the distribution log generated by the log storage server in the log agent, And an analysis log comparison unit for comparing two or more of the distribution log or the backup log with each other, and a log verification apparatus for verifying a content distribution log of the copyrighted content provided as an online service.

Accordingly, the content distribution log agent and the operation method for protecting the authoring content provided by the online service of the present invention provide a tool for performing the reliability verification of the content distribution behavior of the online service provider, There is an effect that can verify the behavior.

In addition, the present invention records and provides a user log of the authoring content used by the user terminal to the user terminal, thereby enabling the online service provider to perform tracking and verification of the illegal authoring content circulation behavior.

In addition, the present invention records and provides a log log of a work content used by an online service provider in a log black box, which is a log black box, to provide an online service provider's another traceable and authentic content distribution activity It is effective.

In addition, the present invention can perform tracking and verification of an illegal content distribution activity of an online service provider by comparing the user log, the distribution log, and the backup log recorded in the user terminal, the log agent, and the log storage server There is another effect.

In addition, the present invention provides another advantage that the online service provider can track and verify illegal content distribution activities by backing up and providing the log records stored in the log agent to the log storage server.

In addition, the present invention provides an online service provider that installs a log agent on one or more online service provider servers for providing authoring content, analyzes real-time SQL packets transmitted and received between one or more online service provider databases, Is logarithmically recorded in real time, thereby eradicating the illegal circulation of the copyrighted content.

In addition, the present invention provides an online service provider in which one or more online service provider servers for providing authoring content by installing a log agent in one or more online service provider databases for storing authoring content and distribution information, and real- And analyzing contents of the contents to be served in real time, thereby eradicating illegal circulation of the contents.

In addition, according to the present invention, the distribution contents of the authoring contents to be provided as a fee to the user are recorded as normalized and formatted logs, so that the distribution logs of a plurality of online service providers are easily compared with any one or more of the user logs and the backup logs, There is another effect of enabling service providers to track and verify illegal content distribution activities.

In addition, the present invention monitors the access of a log, which is a distribution record generated while an online service provider provides a fee to the user, and logs a monitoring event for the online service provider, thereby preventing the online service provider from tampering with / There is another effect that can.

Brief Description of the Drawings Fig. 1 is a general block diagram showing a content distribution and log generation flow according to the present invention;
FIG. 2 is a block diagram illustrating a log verification server according to the present invention. FIG.
3 is a configuration diagram of a log system for generating a distribution log according to the first embodiment of the present invention;
4 is a configuration diagram of a log system for generating a distribution log according to a second embodiment of the present invention;
5 is a configuration diagram of a log agent according to the present invention.
6 is a flowchart illustrating a method of generating a distribution log according to the first embodiment of the present invention.
FIG. 7 is a flowchart illustrating a method of generating a distribution log according to a second embodiment of the present invention.

The terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms and the inventor may appropriately define the concept of the term in order to best describe its invention It should be construed as meaning and concept consistent with the technical idea of the present invention.

Therefore, the embodiments described in this specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is an overall block diagram illustrating a content distribution and log generation flow according to the present invention; FIG. 1, when one or more online service provider servers 200 (hereinafter referred to as 'OSP servers') are requested to upload or download authoring contents from the user terminal 100, a plurality of OSP servers 200 connected to the OSP server 200 Uploads or downloads authoring content to an online service provider database (not shown) (hereinafter, referred to as an 'OSP database') of the online service provider database, and stores a circulation record thereon.

At this time, the user terminal 100 stores the user log, which is the contents of the work of the authoring content requested by the user for uploading or downloading, to the user terminal 100. The OSP server 200 receives a log agent 300, which is a distribution record for the authoring content provided to each of the user terminals 100.

Also, the log storage server 500 performs a function of backing up the distribution log recorded in the log agent 300, and stores the backup log backed up with the distribution log.

The authentication server 600 is made up of a public key infrastructure (PKI). By providing the public key and the private key pair to the log agent 300 and the log storage server 500, Encrypted with the public key of the log agent 300, and the backup log of the log storage server 500 is encrypted with the public key of the log storage server 500.

Each of the public key and the private key issued by the authentication server 600 is transmitted between the authentication server 600 and the log agent 300 or the log storage server 500 in the form of SSL (Secure Sockets Layer) or TLS (Transport Layer Security) It is preferable to issue it using any one of the communication protocols.

The log verification server 700 receives user logs from the user terminal 100, a distribution log from the log agent 300 or a backup log from the log storage server 500, and compares the received logs with each other Report the statistical comparison results.

At this time, the distribution log of the log agent 300 is encrypted with the public key of the log agent 300. Since the backup log of the log storage server 500 is encrypted with the public key of the log storage server 500, 700 receives respective private keys through the log agent 300 and the log storage server 500 and decrypts the transmitted distribution log or backup log. In order to guarantee the integrity of the private key issued for the log agent 300 and the log storage server 500, the log verification server 700 directly stores the private key of the log agent 300 and the log And receives the private key of the server 500 and proceeds to decrypt the distribution log or the backup log.

Meanwhile, the user log recorded in the user terminal 100 is encrypted and stored by at least one of a hash algorithm and a block encryption algorithm. However, in the case of an encryption algorithm that can be decrypted by the log verification server 700, Algorithm may be used.

The log verification server 700 can periodically receive and compare the user log of each user terminal 100 and the log of the log agent 300 and the backup log of the log storage server 500, It is preferable to perform the method on-line, but each of the methods may be received using a storage medium that can guarantee the integrity of the log.

The distribution log for the authoring content circulated in the OSP server 200 is preferably created in the log agent 300 installed in the OSP server 200. However, depending on the size of the OSP server 200, The log agent 300 may be installed in an online service provider database (hereinafter, referred to as 'OSP database') to store a distribution log for each OSP database (not shown) 3 and 4 in detail.

2 is a block diagram illustrating a log verification server according to the present invention. 2, the log verification server 700 includes a user log analyzer 710 for analyzing a user log generated in the user terminal 100, a log analyzer 710 for analyzing the log log generated in the log agent 300, And a backup log analysis unit 730 for analyzing the backup logs backed up to the log storage server 500. The backup log analysis unit 730 analyzes the backup logs stored in the distribution log analysis unit 720 and the log storage server 500,

In addition, an analysis log comparison unit 740 for comparing the log data analyzed by the user log analysis unit 710, the distribution log analysis unit 720, and the backup log analysis unit 730 with each other is provided, And a log statistics unit 750 for generating the analysis log results compared by the log comparator 740 as a report.

The user log analyzer 710 receives a user log of the user terminal 100 and analyzes logs of the user log 100. A user log, which is a usage history of the authoring content used in a plurality of user terminals 100, It is preferable that the user log analyzer 710 includes means for decrypting the user log according to the encryption type of the corresponding user terminal 100 because the user log is encrypted using an algorithm provided by one or more of the block encryption algorithms Do.

The user log analyzer 710 may further include means for decrypting the user log encrypted with the encryption algorithm other than the hash algorithm or the block encryption algorithm.

The distribution log analyzer 720 receives and analyzes the distribution log of the authoring content circulated in the OPS server or the OSP database of the log agent 300. The log agent 300 analyzes the distribution log of the authoring content distributed to the log agent 300 The distribution log analyzer 720 receives the private key of the log agent 300 from the authentication server or the log agent 300, decrypts the received distribution log, and decrypts the decrypted distribution log .

The backup log analyzer 730 encrypts the distribution log of the log agent 300 with the public key of the log storage server 500 and stores it in the log The backup log analyzer 730 receives the private key of the log storage server 500 from the authentication server or the log storage server 500, decrypts the received backup log, and analyzes the decrypted backup log.

The analysis log comparator 740 receives the logs analyzed by the user log analyzer 710, the distribution log analyzer 720 and the backup log analyzer 730 and compares the logs with each other, , The distribution log, or the backup log may be judged as falsification or modulation. In addition, various data on the distribution of the authoring contents can be generated.

The distribution history of the authoring content, the number of circulation of the authoring content, the list of the purchaser, the date of purchase, and the purchase amount. If at least one of the user log and the distribution log and the backup log are different from each other, it is determined that falsification, alteration, or omission of the log occurs in at least one of the user terminal 100 or the log agent 300, The alarm unit 740 may generate an alarm or an event according to the applied security policy.

The log statistics unit 750 may receive the comparison result from the analysis log comparison unit 740 and may generate a report on distribution of the content. The content distribution report is generated using a list, a diagram, a graph, an image or text, and can be created for each authoring content, and can be created according to the user terminal 100, the OSP server, the OSP database, have.

Also, the content distribution report includes information such as the number of circulation of the authoring content, the purchaser list, the date and time of purchase, the purchase amount, and the author. Therefore, it is possible to output all the information about distribution of the contents of the author to the statistical report.

3 is a configuration diagram of a log system for generating a distribution log according to the first embodiment of the present invention. 3, when at least one OSP server 200 receives a request for authoring content from the user terminal 100, the at least one OSP server 200 may access a plurality of OSP databases 410, 420, 430, and 440 connected to the OSP server 200 It records the history of the requested content and the details of the provided content.

At this time, the OSP server 200 providing the authoring contents provided for a fee has to record the distribution information of the authoring contents provided according to the user's request in the plurality of OSP databases 410, 420, 430, and 440, The distribution information recorded in the OSP databases 410, 420, 430, and 440 is omitted, deleted, or modified so that the content distribution information is up-converted / modulated to provide paid content to be paid, There is a problem that can not be paid to.

Accordingly, by installing the log agent 300 in the OSP server 200, the log agent 300 monitors the network packets transmitted and received by the OSP server 200 from the plurality of OSP databases 410, 420, 430, and 440 can do.

The log agent 300 filters the SQL packets in the monitored packet, extracts the packet including the SQL query from the filtered SQL packets, and generates and stores the SQL query and the object of transmission and reception of the SQL packet as the SQL query log.

Meanwhile, since the generated SQL query log is transformed into a normalized form, it can be easily used in analyzing the log to track the content distribution. Also, the generated SQL query log can be encrypted and stored, and any encryption method known in the art can be used.

In addition, the log agent 300 writes and stores the SQL query log in a log file, performs access monitoring on the stored log file to prevent log file tampering from the online service provider, The monitoring is performed by analyzing an event accessed from the OSP server 200 that can access the log agent 300 storing the log file or analyzing an event for directly accessing the log file stored in the log agent 300 .

4 is a block diagram of a log system for generating a distribution log according to a second embodiment of the present invention. 4, the log agents 300-1, 300-2, 300-3, and 300-4 for monitoring the packets according to the content distribution and generating and storing SQL query logs are stored in a plurality of OSP databases The log agents 300-1, 300-2, 300-3, and 300-4 installed in the plurality of OSP databases 410, 420, 430, and 440 are installed in the respective OSs 410, 420, Each of the databases 410, 420, 430, and 440 generates an SQL query log using packets transmitted and received by the OSP server 200.

Also, the log agents 300-1, 300-2, 300-3, and 300-4 write and store the SQL query log in a log file, perform access monitoring on the stored log file, In order to prevent the log files from being tampered with or tampered with, the access monitoring of the log files is performed by the OSP server 200 that can access the log agents 300-1, 300-2, 300-3, and 300-4 storing the log files Analyzing an accessing event, or analyzing an event for directly accessing a log file stored in the log agents 300-1, 300-2, 300-3, and 300-4.

5 is a configuration diagram of a log agent according to the present invention. 5, the log agent 300 installed in one or more OSP servers 200 or one or more OSP databases 410, 420, 430, 440 includes a packet collection module 310, an SQL query packet filter module 320, a packet analysis module 330, a log normalization module 340, a log encryption management module 350, a log storage management module 360, a log access monitoring module 390, and a log access monitoring filter module 395 .

The packet collection module 310 monitors packets transmitted and received from the network interface cards (NIC) of the OSP server 200 or the OSP databases 410, 420, 430, and 440. It is preferable to use a method of controlling by the control of the network interface card, but any of known packet monitoring techniques may be used.

The packets monitored by the packet collection module 310 may be packets using TCP, and may be transmitted to the OSP server 200 or the OSP database 410, 420, 430, It is preferable to monitor packets transmitted to and received from a port used by at least one of MSSQL and ORACLE.

The SQL query packet filter module 320 filters the SQL packet among the monitored packets and transmits the filtered SQL packet to the packet analysis module 330.

The SQL query packet filter module 320 filters SQL packets when the packet collection module 310 monitors all the packets, but performs separate filtering when monitoring only the SQL packets in the packet collection module 310 And transmits the monitored SQL packet to the packet analysis module 330.

The packet analysis module 330 analyzes the SQL packet transmitted from the SQL query packet filter module 320, extracts the SQL query, and transmits the extracted SQL query to the log normalization module 340.

The SQL packet includes an SQL query, and the packet analysis module 330 further extracts a target of transmitting and receiving SQL packets such as TIMESTAMP, a source IP, a source port, a destination IP, and a destination port in an SQL packet. That is, the SQL query includes SQL statements such as SELECT, UPDATE, DELETE, INSERT, SET, COMMIT, ROLLBACK, CREATE, DROP and ALTER used in the database. The packet analysis module 330 analyzes and transmits SQL packets Extracts the SQL query in the SQL packet, and transmits the SQL query to the log normalization module 340 for generation of the SQL query log using the extracted SQL packet transmission target and SQL query.

The log normalization module 340 normalizes the received SQL query and the target of transmission / reception of the SQL packet to generate a formatted SQL query log.

Conventionally, since a plurality of online service providers use different log generation methods, the generated log is not formatted, and therefore it takes a long time to analyze the log or the log analysis itself is not easy.

Accordingly, the log normalization module 340 can normalize the SQL query to generate a formatted SQL query log, so that the log analysis can be performed more easily when the log is analyzed later.

In addition, the log normalization module 340 receives the monitoring event transmitted from the log access monitoring filter module 395, normalizes the received monitoring event, and converts the monitored event into a formal log file access change history.

The monitoring event includes log access information related to access monitoring for accessing a log file in which the SQL query log is recorded. The log access log information is accessed from the OSP server 200 or the log storage management module 360 accessing the log file. Information is generated.

Meanwhile, the log normalization module 340 transmits the generated SQL query log or log file access change history to the log encryption management module 350.

The log encryption management module 340 encrypts the normalized SQL query log in SQL syntax units. It is preferable to use a fast encryption method in order to solve the problem of encrypting a large-capacity SQL query log in real time, although any of the known encryption methods can be used as the encryption method.

In addition, the log-encrypting management module 340 normalizes and encrypts the formatted log-file access change history.

The log encryption management module 340 transmits the encrypted SQL query log or log file access history to the log storage management module 360.

The log storage management module 360 receives the SQL query log from the log encryption management module 350. Records and stores the received SQL query log in the SQL query log file 370. When the log file access change history is received, the log file access change history received in the log file access change log file 380 is recorded and stored do.

The log storage management module 360 generates and manages one or more of the SQL query log file 370 or the log file access change log file 380. The log storage management module 360 generates the SQL query log file 370 and the log file 370 according to a predetermined rule, It is desirable to generate an access change history file 380. [

The log storage management module 360 performs access monitoring of the SQL query log file 370. When access to the SQL query log file 370 is detected, the log storage management module 360 generates log access information about the access, To the access monitoring module 390.

The log access monitoring module 390 receives the log access information, which is all the access records for accessing the SQL query log file 370, to ensure the integrity of the SQL query log recorded in the SQL query log file 370, To the monitoring filter module 395.

Log access information transmitted to the log access monitoring module 390 may be received from the log storage management module 360 and may be received from the OSP server 200. [

The log access monitoring filter module 395 receives the log access information transmitted from the log access monitoring module 390 and analyzes and filters the log access information that abnormally or normally accesses the SQL query log file 370, And generates a monitoring event corresponding to log access information.

If a monitoring event to access the SQL query log file 370 is generated, the log access monitoring filter module 295 transmits the monitoring event to the log normalization module 340 so that a log file access change history is generated do.

6 is a flowchart illustrating a method of generating a distribution log according to the first embodiment of the present invention. As shown in FIG. 6, the packet collection module of the log agent installed in one or more OSP servers or one or more OSP databases monitors packets transmitted and received through one or more OSP servers or network interface cards of one or more OSP databases (S410) .

The SQL query packet filter module filters the SQL packet among the monitored packets and transmits the filtered SQL packet to the packet analysis module (S420). At this time, if the monitored packet is not an SQL packet, the corresponding packet is discarded (S425), and the monitored packet is captured and filtered (S410).

In this case, the filtering of the SQL packet in the monitored packet is preferably performed by the SQL query packet filter module. However, in the case where the packet collection module performs the filtering of the SQL packet, the SQL query packet filter module Can send the filtered SQL packet to the packet analysis module.

Meanwhile, the monitored packet is a TCP packet, and it is preferable to monitor packets transmitted and received through ports used in databases such as MYSQL, MSSQL, and ORACLE among TCP packets.

The packet analysis module analyzes the received SQL packet and extracts at least one of the SQL query or the object of transmission / reception of the SQL packet (S430). At this time, if at least one of the SQL query or the object of transmission / reception of the SQL packet is not extracted in the analyzed SQL packet, the corresponding SQL packet is discarded (S425), and the SQL packet transmitted thereafter is analyzed.

In this case, the SQL query includes SQL statements such as SELECT, UPDATE, DELETE, INSERT, SET, COMMIT, ROLLBACK, CREATE, DROP and ALTER in the SQL packet, and the object to be transmitted and received in the SQL packet includes TIMESTAMP, , A destination IP, and a destination port.

The packet analysis module transmits at least one of the extracted SQL query or the object of the SQL packet transmission / reception to the log normalization module, and the log normalization module normalizes the received SQL query or the object to be transmitted / (S450).

The normalized and standardized SQL query log is preferably generated in a predefined pattern so that log analysis can be done quickly and easily when analyzing the SQL query log file to confirm the authenticity of author content distribution.

Thereafter, the log normalization module transmits the generated SQL query log to the log encryption management module 350, and the log encryption management module encrypts the received SQL query log in units of syntax (S460).

At this time, the encryption method for encrypting the generated SQL query log may be any of the known encryption methods, but a fast encryption method is used in order to solve the problem of encrypting the large-capacity SQL query log in real time desirable.

The log encryption management module transmits the encrypted SQL query log to the log storage management module, and the log storage management module records and stores the received SQL query log in the SQL query log file (S470).

At this time, if there is no SQL query log file to record the received SQL query log, the log storage management module may generate the corresponding SQL query log file, and preferably generate at least one SQL query log file.

Therefore, it is preferable to repeat steps S410 to S470 to generate an SQL packet that is continuously monitored and filtered by the SQL query log.

FIG. 7 is a flowchart illustrating a method of generating a distribution log according to a second embodiment of the present invention. As shown in FIG. 7, the procedure up to step S470 is the same as that shown in FIG. 6, and the procedure after step S470 can be described as follows.

In step S470, when the log storage management module records and stores the SQL query log in the SQL query log file (S480), the log access monitoring module analyzes the received log access information, Access to the query log file is monitored (S481).

The log access information is generated in response to an event that accesses the SQL query log file from the log storage management module that manages the SQL query log file, and corresponds to the event that accesses the SQL query log file from the OSP server or OSP database where the log agent is installed. .

In this case, the log access monitoring module transmits the received log access information to the log access monitoring filter module, analyzes the log access information for accessing the SQL query log file, and when it attempts to access the SQL query log file, To the log normalization module (S483).

Then, the log normalization module normalizes the received monitoring event and converts it into a regular log file access change log (S450). When the log log access log is transferred to the log encryption management module, The log file access change history is encrypted (S460).

It is preferable to use the same encryption method as that used for encrypting the SQL query log, but it is also possible to use another encryption method.

Thereafter, the log encryption management module transmits the encrypted log file access change history to the log storage management module, and the log storage management module records and stores the received log file access change log in the log file access change log file (S470) .

On the other hand, it is preferable to repeat steps S480 through S470 for access monitoring of the SQL query log file.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, Various changes and modifications will be possible.

100: user terminal 200: online service provider server
300, 300-1, 300-2, 300-3, and 300-4: log agent
310: Packet collection module 320: SQL query packet filter module
330: Packet analysis module 340: Log normalization module
350: log encryption management module 360: log storage management module
370: SQL query log file 380: Log file access change history file
390: Log access monitoring module 395: Log access monitoring filter module
410: content information database 420: filtering information database
430: Purchasing information database 440: Other information database
500: log storage server 600: authentication server
700: log verification server 710: user log analysis unit
720: Distribution log analysis unit 730: Backup log analysis unit
740: Analysis log comparison unit 750: Log statistics unit

Claims (17)

A log verifying apparatus comprising:
A user log analyzer for analyzing a user log of content downloaded or uploaded from a user terminal;
A distribution log analyzer for analyzing a distribution log generated by a log agent that records a log of the content distributed through the OSP server;
A backup log analyzer for backing up the distribution log generated by the log storage server by the log storage server to generate a backup log and analyzing the stored backup log; And
An analysis log comparing unit for comparing two or more of the user log, the distribution log, and the backup log analyzed,
And a verification unit for verifying the content distribution log of the content to be provided as an online service.
The method according to claim 1,
And a log statistics unit for statistically comparing the verification result of the log compared by the analysis log comparison unit. The log verification apparatus for verifying a content distribution log of a copyrighted content provided as an online service.
3. The method of claim 2,
Wherein the log statistics unit generates a statistical report using at least one of a list, a chart, a graph, an image, and text. The log verifying apparatus for verifying a content distribution log of a copyrighted content provided as an online service.
The method according to claim 1,
Wherein the user log analyzing unit analyzes the user log encrypted by at least one of a hash algorithm and a block encryption algorithm, and verifies the content distribution log of the authoring content provided as an online service.
The method according to claim 1,
Wherein the distribution log analyzing unit decrypts the distribution log encrypted using the public key of the log agent issued by the authentication server with the private key of the log agent and analyzes the decrypted distribution log. The log verifying apparatus comprising:
The method according to claim 1,
Wherein the backup log analyzing unit decrypts the backup log encrypted using the public key of the log storage server issued by the authentication server with the private key of the log storage server and analyzes the backup log. A log verifier for verifying the distribution log.
The method according to claim 1,
The distribution log
The SQL packet processing unit in the log agent monitors the packets transmitted and received in real time through the network card of the terminal equipped with the log agent to filter the SQL packets among the packets and transmits the SQL query or the SQL packet in the filtered SQL packet A first step of extracting one or more pieces;
The log management unit in the log agent generates an SQL query log corresponding to at least one of the SQL query or the SQL packet transmission / reception subject extracted, normalizes the generated SQL query log, and encrypts the normalized SQL query log A second step; And
A third step of performing at least one of writing the SQL query log in which the log storage unit in the log agent is encrypted in a log file or access management of the log file
Wherein the online content is generated by using the online service.
8. The method of claim 7,
The first step
A first step in which the packet collection module in the SQL packet processing unit monitors a packet;
A second step of filtering the SQL packet among the monitored packets of the SQL query packet filter module in the SQL packet processing unit; And
A third step of extracting and analyzing one or more of the SQL query or SQL packet transmission / reception target among the SQL packets filtered by the packet analysis module in the SQL packet processing unit
Wherein the content distribution log of the content to be provided as an online service is verified.
8. The method of claim 7,
The second step
A first step of normalizing at least one of the SQL query or the object of transmission / reception of an SQL packet generated by the log normalization module in the log management unit to generate the SQL query log formatted; And
A second step of encrypting the SQL query log generated by the log encryption management module in the log management unit by syntax unit
Wherein the content distribution log of the content to be provided as an online service is verified.
8. The method of claim 7,
After the third step,
A log access monitoring module in the log monitoring unit monitors access of the SQL query log to generate log access information, and the log access monitoring filter module in the log monitoring unit detects the access of the SQL query log from the log access information A fourth step of generating a surveillance event corresponding to the log access information;
A log normalization module in the log management unit receives the monitoring event, normalizes the monitoring event, converts the monitoring event into a formal log file access change log, and a log encryption management module in the log management unit encrypts the log file access log Step 5; And
A sixth step in which the log storage management module in the log storage unit stores the encrypted log file access change history
Wherein the content distribution log of the content to be provided as an online service is verified.
11. The method of claim 10,
Wherein the method for detecting access is to receive the log access information from at least one of a log storage management module in the log management unit or a terminal equipped with the log agent, Log verification device for verification.
8. The method of claim 7,
Wherein the SQL query includes at least one SQL statement of SELECT, UPDATE, DELETE, INSERT, SET, COMMIT, ROLLBACK, CREATE, DROP or ALTER. A log verification device.
8. The method of claim 7,
Wherein the terminal equipped with the log agent is any one of an online service provider server for providing authoring content or an online service provider database for storing authoring content and installed in any one of the online service provider server and the online service provider database Wherein the log agent performs at least one of retrieving, requesting, storing, or providing the authoring content transmitted and received in either the online service provider server or the online service provider database, Wherein the SQL query log is generated by extracting at least one of the plurality of content items and the plurality of content items.
8. The method of claim 7,
Wherein the packet is a TCP packet. 29. A log verifying apparatus for verifying a content distribution log of a copyrighted content provided as an online service.
15. The method of claim 14,
Wherein the TCP packet is transmitted / received to a port used by one or more of MYSQL, MSSQL, or ORACLE.
9. The method of claim 8,
Wherein the packet analysis module analyzes at least one of a TIMESTAMP, a source IP, a source PORT, a destination IP, or a destination PORT in the SQL packet to extract the target of the SQL packet transmission / reception. A log verifier for verifying the distribution log.
8. The method of claim 7,
Wherein the log storage management module in the log storage unit receives the encrypted log file access change log and stores the log file access log change history received in the log file access log change log file, And a log storage management module, wherein the log storage management module generates a content distribution log of the authoring content provided as an online service.

Images