KR20220115323A - Apparatus for monitoring log by using block chain - Google Patents

Abstract

An apparatus for monitoring a log by using a block chain may include: a monitoring item setting unit setting a log to be monitored among logs of an apparatus; a block generation unit generating blocks in which information on the log to be monitored is recorded and storing the blocks in each of a plurality of nodes through settlement for the plurality of nodes and blocks to connect the blocks to a pre-generated block chain; and a monitoring performance unit monitoring whether the log to be monitored is forged by comparing information on the log to be monitored recorded in the node.

Description

A device that monitors logs using blockchain {APPARATUS FOR MONITORING LOG BY USING BLOCK CHAIN}

The present invention relates to a device for monitoring logs using a block chain.

A hacker who wants to hack into a specific system illegally accesses the system, obtains the authority of the administrator or superuser of the system, deletes log information related to his/her illegal access/hacking, and then deletes the security data of the system. get them

At this time, since the hacker deletes all his/her hacking logs, the security officer of the corresponding system may not even be able to understand the hacking attempt situation.

On the other hand, the quantum cryptography communication service is a service that provides a quantum key that is never hacked to an application service to be used as a key for an encryption communication service.

If the system (or service platform) managing the quantum key is hacked while the customer receives the unhacked quantum key from the quantum key distribution device, all security may be destroyed.

Korean Patent Publication No. 2009-0044202 (published on May 7, 2009)

The present invention is to solve the problems of the prior art described above, by setting a monitoring target log among the logs of the log monitoring device, and storing the information on the monitoring target log in a block chain, to determine whether information on the monitoring target log is forged or falsified. want to monitor

However, the technical problems to be achieved by the present embodiment are not limited to the technical problems described above, and other technical problems may exist.

As a technical means for achieving the above technical problem, an apparatus for monitoring a log using a block chain according to the first aspect of the present invention includes: a monitoring item setting unit for setting a monitoring target log for monitoring among logs of the device; Creating and storing a block in which information about the monitoring target log is recorded, and storing the block in each of the plurality of nodes through agreement on the block with a plurality of nodes to connect the block to a pre-created block chain block generation unit; and a monitoring performing unit configured to compare the monitoring target log recorded in the block stored in the device with information on the monitoring target log recorded in the block stored in the plurality of nodes to monitor whether the monitoring target log is forged or falsified. .

The above-described problem solving means are merely exemplary, and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description.

According to any one of the above-described problem solving means of the present invention, the present invention sets a monitoring target log among the logs of the log monitoring device, and stores the information on the monitoring target log in the block chain, thereby forgery or forgery of information on the monitoring target log By implementing a system that can monitor whether or not there is, it is possible to continuously detect hacking of the log monitoring device.

Through this, the present invention can improve the security of the log monitoring device, thereby improving the stability of the service.

1 is a block diagram of a log monitoring apparatus according to an embodiment of the present invention.
2A to 2B are diagrams illustrating a block structure and a block chain connection structure according to an embodiment of the present invention.
3 is an operation flowchart illustrating a method of providing a quantum key management service according to an embodiment of the present invention.
4 is a flowchart illustrating a method of monitoring a log using a block chain according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. However, the present invention may be embodied in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is "connected" with another part, this includes not only the case of being "directly connected" but also the case of being "electrically connected" with another element interposed therebetween. . Also, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated.

In this specification, a "part" includes a unit realized by hardware, a unit realized by software, and a unit realized using both. In addition, one unit may be implemented using two or more hardware, and two or more units may be implemented by one hardware.

Some of the operations or functions described as being performed by the terminal or device in this specification may be instead performed by a server connected to the terminal or device. Similarly, some of the operations or functions described as being performed by the server may also be performed in a terminal or device connected to the corresponding server.

Hereinafter, detailed contents for carrying out the present invention will be described with reference to the accompanying configuration diagram or process flow diagram.

1 is a block diagram of a log monitoring apparatus 10 according to an embodiment of the present invention.

Referring to FIG. 1 , the log monitoring apparatus 10 may include a monitoring item setting unit 100 , a block generating unit 110 , a monitoring performing unit 120 , and an authenticating unit 130 . However, the log monitoring device 10 shown in FIG. 1 is only one implementation example of the present invention, and various modifications are possible based on the components shown in FIG. 1 .

The monitoring item setting unit 100 may set a monitoring target log for monitoring among the logs of the log monitoring device 10 .

For example, the monitoring item setting unit 100 may set a command log (eg, a directory or a user execution command, etc.) of the log monitoring device 10 as a monitoring target log. Here, the command log may include commands that can check all commands executed by the user, such as history commands in CENTOS.

For example, the monitoring item setting unit 100 records the access log (login/logout/superuser mode change) of the log monitoring device 10, the authentication log (the log that authenticates the user requesting the quantum key), and the service provision log. It can be set as a monitoring target log.

The monitoring item setting unit 100 includes a monitoring target system log to be monitored by the log monitoring device 10, a monitoring target service log (eg, a service log such as a quantum key service provision history, quantum key provision request approval history, etc.), log Normal and abnormal ranges of , additional information to determine whether the log is hacked, etc. can be set as the monitoring target log.

For example, when setting a command history log, the monitoring item setting unit 100 may set a command format that can be regarded as hacking among command history. For example, in XML format, when the command is SUDO and the executor is ABCD, the contents of judgment as hacking can be set according to each metadata field. In this case, the log may store log types (eg, authentication log, login/logout log, command execution log, service provision log, etc.), log time, log generation system, log impact, log details, and the like.

The block generating unit 110 may check the information on the monitoring target log in real time and record it in the block.

The block generating unit 110 may generate a block in which information on a monitoring target log is recorded. Here, the information on the monitoring target log may include at least one of the monitoring target system log, the monitoring target service log, the log location, the normal range of the log, the abnormal range of the log, and additional information for determining whether the log is hacked. have.

Referring to FIG. 2A , the block generation unit 110 sets version information, previous block hash information, time information, etc. in the header area of the block, and then records information on the monitoring target log in the body area of the block. have.

The block generation unit 110 stores blocks in each of the plurality of nodes through agreement on a plurality of nodes and blocks (blocks in which information about the log to be monitored) having a connection relationship with the block chain is recorded blocks can be connected to At this time, if the validity of the corresponding block is verified for each node, the block is connected to the pre-generated block chain. Through the block connected to the block chain, the monitoring target log recorded in the block is shared with each node of the block chain.

Figure 2b shows the connection structure of the blockchain. Referring to FIG. 2B , the header of each block includes the block hash value of the adjacent block to be connected, and is connected to the adjacent block through its own block hash value. The bodies of all blocks share a transaction, and adjacent blocks are connected.

When the block is connected to the pre-created block chain, the monitoring unit (not shown) monitors whether there is an additionally set monitoring target log, records information about the additionally set monitoring target log in the new block, and then creates a new block It can be stored in each node by connecting to the blockchain.

The authentication unit 130 may perform authentication with respect to a log-in process for accessing the log monitoring device 10 or accessing the monitoring target system monitored by the log monitoring device 10 .

The account management unit (not shown) may manage an account for access to the log monitoring device 10 or access to a monitoring target system monitored by the log monitoring device 10 .

The monitoring performing unit 120 compares information about the monitoring target log recorded in the block stored in the log monitoring device 10 with the monitoring target log recorded in the block stored in each node to monitor whether the monitoring target log is forged or falsified. have.

Monitoring target logs stored in the block chain are hacked in a specific node and even if the monitoring target log is deleted, it is possible to check the monitoring target logs that are not deleted in other nodes. can be monitored for hacking.

The authenticator 130 may receive a quantum key request from the first terminal to generate a quantum key, transfer the generated quantum key to the first terminal, and deliver the quantum key to a second terminal for communicating with the first terminal have.

The block generator 110 may generate a block for the service history according to the quantum key generation, and transmit the block for the service history to a plurality of nodes to perform an agreement on the block for the service history with the plurality of nodes. .

The generator 110 may generate a block for the service history according to the quantum key generation, and transmit the block for the service history to a plurality of nodes to perform agreement on the block for the service history with the plurality of nodes.

3 is an operation flowchart illustrating a method of providing a quantum key management service.

3, when the log monitoring device 10 receives the quantum key request from the first terminal 20 in step S301, the service history log for the quantum key request of the first terminal 20 is recorded in a block, A block can be created and the block can be transmitted to multiple nodes. At this time, a plurality of nodes can verify the validity of the received block and connect the block to the pre-generated block chain.

In step S303, the log monitoring apparatus 10 may generate a quantum key according to the quantum key request of the first terminal 20 .

In step S305, the log monitoring device 10 may transmit the quantum key and the ID of the quantum key to the first terminal 20 .

In step S307, the first terminal 20 may transmit the ID of the quantum key to the second terminal 30 to communicate.

In step S309, when the log monitoring device 10 receives the quantum key request including the ID of the quantum key from the second terminal 30, the service history log for the quantum key request of the second terminal 30 is stored in the block. A block can be created by writing, and the block can be transmitted to multiple nodes. At this time, a plurality of nodes can verify the validity of the received block and connect the block to the pre-generated block chain.

In step S311, the log monitoring apparatus 10 may deliver the quantum key corresponding to the ID of the quantum key to the second terminal 30.

In step S313, the first terminal 20 and the second terminal 30 may start a quantum encryption communication session using a quantum key.

Returning to FIG. 1 again, the monitoring performing unit 120 detects forgery in at least one of a monitoring target log recorded in a block stored in the log monitoring device 10 and a monitoring target log recorded in a block stored in a plurality of nodes. In this case, a hacking alert may be issued.

For example, the monitoring performing unit 120 may search the monitoring target log recorded in the block chain for each monitoring target system, and inspect whether there is an abnormality in the monitoring target log that can determine hacking. At this time, if hacking is determined, the monitoring performing unit 120 may issue a hacking alert.

If there is no abnormal log to be determined as hacking, the monitoring execution unit 120 compares the monitoring target log recorded in the block of the block chain and the monitoring target log recorded in the block of the monitoring target system to check whether forgery or not. have.

When forgery occurs through forgery inspection, the monitoring performing unit 120 may determine that it is hacking and issue a hacking alert of the monitoring target system.

If there is no forgery, the monitoring performing unit 120 may continue the monitoring process.

For example, when the quantum key service is provided by the first log monitoring device, the second log monitoring device, and the third log monitoring device, each of the first log monitoring device, the second log monitoring device, and the third log monitoring device is a quantum key. Key service provision logs and system logs can be stored in each block.

In the first log monitoring device, the second log monitoring device, and the third log monitoring device, each block can be connected to the block chain through agreement with a plurality of nodes of the block chain.

At this time, if hacking occurs in the first log monitoring device and the hacker has all the rights of the first log monitoring device, the logs stored in the first log monitoring device and the block chain contents of the first log monitoring device are deleted, etc. can do the actions of

In this case, the second log monitoring device and the third log monitoring device include logs recorded in blocks of the first log monitoring device, second log monitoring device, and third log monitoring device, and logs recorded in blocks stored in a plurality of nodes. By comparing the logs, it is possible to determine whether a hacker has forged or forged logs.

Meanwhile, for those skilled in the art, the monitoring item setting unit 100 , the block generating unit 110 , the monitoring performing unit 120 , and the authenticating unit 130 may be implemented separately, or one or more of them may be integrated. will fully understand

4 is a flowchart illustrating a method of monitoring a log using a block chain according to an embodiment of the present invention.

Referring to FIG. 4 , in step S401 , the log monitoring device 10 may set a monitoring target log for monitoring among the logs of the log monitoring device 10 .

In step S403, the log monitoring apparatus 10 may generate a block in which information on a monitoring target log is recorded.

In step S405, the log monitoring device 10 may connect the block to the pre-created block chain by storing the block in each of the plurality of nodes through agreement on the block with the plurality of nodes.

In step S407, the log monitoring device 10 may monitor whether the monitoring target log is forged or falsified by comparing information on the monitoring target log recorded in the block stored in the node.

In the above description, steps S401 to S407 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the present invention. In addition, some steps may be omitted if necessary, and the order between the steps may be changed.

An embodiment of the present invention may also be implemented in the form of a recording medium including instructions executable by a computer, such as a program module executed by a computer. Computer-readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer-readable media may include all computer storage media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.

The above description of the present invention is for illustration, and those of ordinary skill in the art to which the present invention pertains can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and likewise components described as distributed may also be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. .

10: log monitoring device
100: monitoring item setting unit
110: block generation unit
120: monitoring execution unit
130: authentication unit

Claims (5)

In a device for monitoring logs using a block chain,
a monitoring item setting unit for setting a monitoring target log for monitoring among the logs of the device;
Creating and storing a block in which information about the monitoring target log is recorded, and storing the block in each of the plurality of nodes through agreement on the block with a plurality of nodes to connect the block to a pre-created block chain block generation unit; and
A monitoring performing unit that compares the monitoring target log recorded in the block stored in the device with information on the monitoring target log recorded in the block stored in the plurality of nodes to monitor whether the monitoring target log is forged or falsified
A device comprising a.
The method of claim 1,
The information on the monitoring target log includes at least one of a monitoring target system log, a monitoring target service log, a location of the log, a normal range of the log, an abnormal range of the log, and additional information for determining whether the log is hacked A device comprising:
The method of claim 1,
An authenticator for receiving a quantum key request from a first terminal to generate a quantum key, transferring the generated quantum key to the first terminal, and transferring the quantum key to a second terminal for communicating with the first terminal
The device further comprising a.
4. The method of claim 3,
The block generator generates a block for the service history according to the generation of the quantum key, transmits the block for the service history to the plurality of nodes, and performs an agreement on the block for the service history with the plurality of nodes What to do, the device.
The method of claim 1,
The monitoring performing unit will issue a hacking alert when forgery is found in at least one of a monitoring target log recorded in a block stored in the device and a monitoring target log recorded in a block stored in the plurality of nodes.

Images