TWI484331B - Base on cross-layer log data trace system and method - Google Patents

Description

Data trajectory tracking system and method based on cross-layer log recording

The invention relates to a technology for data track tracing, in particular to a data track tracking system and method based on cross-layer log recording.

In the rapid development of technology and the Internet, various services and materials are increasing, resulting in a huge amount of data (Big Data), in order to quickly process huge amounts of data, cloud computing has risen. Cloud computing is one of the hottest Internet trends. It has become a hot research topic in recent years. The idea is to access and configure cloud hardware and software resources according to users' needs.

Cloud computing expands the resource management of infrastructure and software through virtualization technology, which is more flexible than traditional system construction. Therefore, the importance of cloud computing data security is increasing. When users use the network to intercept, process and store the cloud, how to ensure data security, improve service efficiency and meet available requirements has become a major problem for cloud service providers.

In the cloud environment, the access of data is always the dilemma faced by cloud services. Because in the business environment, the information represents business opportunities and money; especially after the passage of the amendments, the personal identification data and the sensitive data transmission and access. Data transfer in the cloud environment, even if there is related encryption, virtual private Information security measures such as human networks (VPNs), but there are still possible breakthroughs.

Therefore, how to solve the above problems and deficiencies in the above-mentioned applications, that is, the inventors of the present invention and those involved in the industry are eager to study the direction of improvement.

Therefore, in view of the above-mentioned deficiencies, the inventors of the present invention have collected relevant materials, and have evaluated and considered such patents through continuous evaluation and modification through multi-party evaluation and consideration, and through years of experience in the industry.

The main purpose of the present invention is to provide a data trajectory tracking system based on cross-layer log recording, which uses a log collecting system, a special data gateway and a log reading software, and combines existing general network equipment, programs, and operating systems. Log collection function.

Another object of the present invention is to provide a data track tracking method based on cross-layer log recording, which can clearly prove the relevant track of the file data being accessed, and further grasp the case where the data is accessed.

In order to achieve the above object, the present invention is achieved by the following technical means. The present invention provides a data track tracking method based on cross-layer log recording, which includes the following steps: a user operates a client at a remote end. The network program enters a cloud system via the network; the cloud system allows the network program to execute at least one application to read a file, and the cloud system generates a file fingerprint code for the file; when the network program executes the application in the cloud system Will produce a file The data access log of the fingerprint code; and when the network program ends in the cloud system service, the application generates a program log, and a log reader collects the data access log, the program log data and the associated data, and is analyzed. After sorting time, get the data usage track of the client.

Furthermore, in another embodiment, the present invention is achieved by the following technical means, wherein the present invention is based on a data trajectory tracking system for cross-layer logging, comprising: at least one data gateway, which records in a cloud computing environment. The act of accessing the file or the data by the at least one application generates a data access log to record the access action, and the application must access the data or file of the at least one database through the data gateway in the cloud computing environment; a log device, which is connected to the data gateway by the network and receives the data access log, and the log device is also connected to at least one server in the cloud computing environment to receive all the log data on the server and store the log data of a specific period. The content, using all the log data stored in the log device, for analysis, comparison, confirmation of the behavior of the file or data transmission and the content of the transmission.

Through different logging standards, the present invention can break through a single level, such as an application or an operating system, and acquire more data, and more effectively provide a track of data access for related tracking. In turn, it is more effective to understand the path of data transmission and the related operation or operation of the system or user involved in the crime for criminal tracing or forensic evidence.

The above described objects, features, and advantages of the invention will be apparent from the description and appended claims

11‧‧‧Logging equipment

12‧‧‧Information gateway

13‧‧‧Application

14‧‧‧Operating system

15‧‧‧Server

16‧‧‧Network equipment

17‧‧‧Database

S11~S14‧‧‧ method flow steps

The first figure shows a schematic diagram of a data trajectory tracking system based on cross-layer log recording according to an embodiment of the invention.

The second figure shows a flow chart of the steps of the data track tracking method based on cross-layer log recording according to an embodiment of the present invention.

The invention will now be further described with reference to the drawings and specific embodiments of the invention.

Please refer to the first figure for a data trajectory tracking system based on cross-layer log recording according to an embodiment of the present invention. In this embodiment, the track of at least one file or data executed by the program may be tracked in the cloud computing environment, including: the data gateway 12 records the action of the file or the data accessed by the application 13 in the cloud computing environment, and generates a data access log. In order to record the access action, the application 13 must access the data or file of the database 17 through the data gateway 12 in the cloud computing environment; and the log device 11 connects to the data gateway 12 by the network and receives the data access. The log device 11 is also connected to the server 15 in the cloud computing environment to receive all the log data on the server 15 and store the log data content of a specific period, and use all the log data stored in the log device 11 for analysis. , compare, confirm the behavior of the file or data transmission and the content of the transmission.

In addition, the network device 16 can return the network log to the log device 11 via the network, so that the log device 11 stores the log data of each layer of the network protocol. network Device 16 can also be considered a type of server.

The application program 13 is a log reading software executed on the operating system 14 of the server 15. When the operating system 14 starts executing an application software, it continuously reads the system log in the operating system 14 and the service log of the server. The application 13 is a function attached to an application software, and when the application software starts executing, the program log of the application software is continuously read.

After the above-mentioned log reading software is executed, the platform as a service (PaaS) in the cloud computing records the relevant connection request information to the system log, and the infrastructure as a service in the cloud computing (Infrastructure as a Service, IaaS) Records related connection request information to the web log.

In this embodiment, when the application software executes the file, the file stored in the database 17 is read through the data gateway 12, and an file fingerprint is generated (the file fingerprint is the identification code of the file), and the file is any When a user operates, an associated data is generated and stored in the data access log. The associated data includes at least the file fingerprint, the name of the program, the time of occurrence, and the file path or folder through which the file passes.

According to the above, the present invention uses the log collecting system, cooperates with the special data gateway 12 and the log reading software, and combines the existing general network device 16 and the server 15 to perform the log collecting function.

In another embodiment, the present invention is applied to a cross-layer log collection mechanism of a distributed multi-transport protocol, and can be used to store post-mortem data based on log data in conjunction with the use of data eigenvalues in the collected related logs. Take and transmit Data trajectory tracking mechanism.

According to the above, the cross-layer log collection mechanism of the distributed multi-transport protocol is used for various data access behaviors in combination with different recording standards such as SNMP, Windows Event and Syslog, and different device and system log recording sources, such as Add, change, delete, and modify, and use the one-way hash algorithm to calculate the feature values of files or data, and record them. On the one hand, in the log system, there is no doubt about the actual content of the real data. On the other hand, it benefits from the use of the one-way hash algorithm calculation. The data feature value generated is unique, so it can be proved and transmitted afterwards. Whether the content of the data is consistent with the sample. In this way, the data transmission pipeline and related systems or users use the data. Protection schemes that are different from traditional data leakage are based on prior definitions. The invention can more clearly prove the relevant trajectory of the data being accessed, and further grasp the case where the data is accessed.

Please refer to the second figure for a flow chart of the steps of the data track tracing method based on cross-layer log recording according to an embodiment of the present invention. Step S11: Entering the cloud system; the user operates a network program at a remote end to enter the cloud system via the network. In another embodiment, the client is a network device and has a web log.

Step S12: executing the application to read the file and generating the file fingerprint code; the cloud system allows the network program to execute at least one application to read a file, and the cloud system generates an file fingerprint code for the file. The file fingerprint code is generated by an algorithm to generate a digital code of the identifiable file according to the file content.

Step S13: generating a data access log; when the network program executes the application in the cloud system, a data access log containing the file fingerprint code is generated.

Step S14: collecting and analyzing all the log data; when the network program ends in the service of the cloud system, the application generates a program log, and a log reading program collects the data access log, the program log data, the system log, and the network. After the log and related data are analyzed and sorted, the data usage track of the client is obtained. The log reading program is installed in the operating system on each server of the cloud system, and can read the system log of the operating system. The related data includes at least the file fingerprint code, the name of the program, the time of occurrence, and the file path or folder through which the file passes.

The invention combines the one-way hash algorithm to generate data feature values of the current file or data content when various file data access behaviors occur, such as adding, changing, deleting and modifying, for post-tracking and auditing. The need for evidence is as if a fingerprint-like trace is produced when the file is executed, leaving evidence of execution.

The invention utilizes a log collecting system, cooperates with special network devices and programs, and combines existing general network devices, programs and operating systems to track data tracks. The features are as follows:

1. Application software deployed in the cloud computing environment, adding related functions or using its original logging function, during the relevant operation, recording the requester's application identification data, such as user account, request time, request item and Return items, etc.

2. In the Platform as a Service (PaaS) layer, record related connection request information (network layer, transport layer, talk layer, presentation layer, application layer) data, supplemented by infrastructure as a service (IaaS) layer record Related MAC, IP address, etc. (physical layer, data link layer, network layer) data.

3. The pipeline for the external transmission of data in the system has a specific data gateway, which needs to be tracked through specific equipment to track the behavior and content of the data transmitted.

4. In the log system, combined with the above information, provide relevant comparison functions to identify potential violations of the specification.

In summary, the present invention can break through a single level, such as an application or an operating system, to acquire more data and more effectively provide a track of data access for related tracking. In turn, it is more effective to understand the path of data transmission and the related operation or operation of the system or user involved in the crime for criminal tracing or forensic evidence.

Through the above detailed description, it can fully demonstrate that the object and effect of the present invention are both progressive in implementation, highly industrially usable, and are new inventions not previously seen on the market, and fully comply with the invention patent requirements. , 提出 apply in accordance with the law. The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of the invention. All changes and modifications made in accordance with the scope of the invention shall fall within the scope covered by the patent of the invention. I would like to ask your review committee to give a clear explanation and pray for it.

11‧‧‧Logging equipment

12‧‧‧Information gateway

13‧‧‧Application

14‧‧‧Operating system

15‧‧‧Server

16‧‧‧Network equipment

17‧‧‧Database

Claims (15)

A data trajectory tracking system based on cross-layer logging, which is a track for tracking at least one file or data executed by a program in a cloud computing environment, comprising: at least one data gateway, which records files or data in the cloud computing environment. An action accessed by at least one application generates a data access log to record the access action, and the application must access the data or file of the at least one database through the data gateway in the cloud computing environment; And a log device connected to the data gateway by the network and receiving the data access log, the log device is also connected to at least one server in the cloud computing environment to receive all the log data on the server, and Store the log data content of a specific period, use all the log data stored in the log device, analyze and compare, confirm the behavior of the file or data transmission and the content of the transmission. The data trajectory tracking system based on cross-layer logging according to claim 1, wherein the server is a network device that returns at least one network log to the log device via the network. The data trajectory tracking system based on cross-layer logging according to claim 1, wherein the application is a log reading software executed on a server operating system, when the operating system starts executing the application software. , that is, the system log in the operating system and the service log of the server are continuously read. For example, the cross-layer log record-based data trajectory tracking system described in claim 3, wherein after the log reading software is executed, the platform as a service (PlaS) is recorded in the cloud computing. Line request information to the system Log. The data trajectory tracking system based on the cross-layer log record described in claim 3, wherein after the log reading software is executed, the infrastructure as a service (IaaS) of the cloud computing is recorded. Wire the request information to the service log. The data trajectory tracking system based on cross-layer logging according to claim 1, wherein the application is a function attached to an application software, and the application software starts executing, that is, the program for continuously reading the application software. Log. The data track tracking system based on the cross-layer log record described in claim 6 , wherein when the application software executes the file, an file fingerprint is generated, and when the file is operated by any user, a file is generated. The associated data is stored in the data access log, and the associated data includes at least the fingerprint of the file, the name of the program, the time of occurrence, and the file path or folder through which the file passes. A data trajectory tracking method based on cross-layer logging includes the steps of: a user operating a network program at a remote end to access a cloud system via a network; the cloud system allows the network program to execute At least one application reads a file, the cloud system generates a file fingerprint code for the file; generates a data access log containing the file fingerprint code; and when the network program ends the service in the cloud system, The application generates a program log, and a log reading program collects the data access log, the program log data and associated data, and after analyzing and sorting time, obtaining the client's capital. Material usage track. The data trajectory tracking method based on cross-layer logging according to claim 8, wherein the log reading program is installed in an operating system on each server of the cloud system. The data track tracking method based on the cross-layer log record described in claim 9 of the patent application, further comprising the log reading program reading the system log of each operating system. The data track tracking method based on cross-layer log record according to claim 8 or 9, wherein the log reading program is a program installed on an operating system, when an application software is started by the client. , that is, keep track of the use of the network program and the files being executed. The data track tracking method based on cross-layer log record according to claim 8 is wherein the client is a network device. The method for tracking data traces based on cross-layer log records according to claim 12, further comprising the log reader collecting network logs of the network device. The data track tracking method based on cross-layer log record according to claim 8 , wherein the file fingerprint code is generated by an algorithm according to the file content to identify a digital code of the file. The data track tracking method based on cross-layer log record according to claim 8 , wherein the related data includes at least the file fingerprint code, the name of the program, the time of occurrence, and the file path or folder through which the file passes.