KR102771347B1 - Integrated log data security management system based on blockchain - Google Patents

Abstract

The present invention relates to a blockchain-based access record and event log security management system, and more specifically, to a multi-purpose IT system that records and manages the access record and event log record of an administrator who accesses a database, thereby preventing information leak accidents caused by weak security and information hacking, as well as improving inefficient system management due to post-accident falsification of access records or event log records. The present invention relates to a blockchain-based access record and event log security management system.

Description

Integrated log data security management system based on blockchain

The present invention relates to a blockchain-based integrated log data security management system, and more specifically, to a blockchain-based integrated log data security management system that prevents falsification of integrated log data, including access records and event log records of authenticated users who have accessed the database of a system server, and resolves various problems resulting from inefficient security management, including information leak accidents and information hacking caused by vulnerable security, when storing integrated log data.

In the late 1990s, with the spread and popularization of the Internet, various information services were implemented in the form of flexible and highly accessible web applications, and accordingly, the IT infrastructure system changed from a client/server structure to a web-based structure.

The web-based structure is basically composed of WEB-WAS-database management system (DBMS), and can be configured more complexly.

After the enforcement of the Personal Information Protection Act, records of access to personal information processing systems must be managed, including ID, IP, and work performance (search, modification, deletion, printing, etc.).

The system must be implemented to take technical and administrative measures to store and manage access records for at least six months.

If an authorized internal worker's account is compromised through hacking or if an unused work account is compromised, a lot of personal information can be accessed and leaked.

If accurate access logs are not created, compliance response becomes difficult, and it is impossible to control employees from indiscriminately accessing and acquiring personal information.

Korean Patent Publication No. 10-2001-0104421 discloses a log integration processing device including a multi-server system including a plurality of web servers connected to a data communication network, wherein the log generation means is provided to each of the plurality of web servers and, when a visitor requests transmission of specific data, generates log data configured to include information about the IP of the visitor who requested transmission, the time at which the visitor's data transmission request was processed, the storage location of the requested transmission target data, the processing result for the transmission request, and the size of the transmitted data, a log transmission means is provided to each of the plurality of web servers and transmits the log data generated by each of the log generation means in real time, a log collection processing means collects a plurality of log data transmitted in real time from the log transmission means provided to each of the plurality of web servers, a log record processing means sequentially records and processes the plurality of log data collected by the log collection processing means in a recording device, and a log recording device in which the plurality of log data collected by the log collection means is recorded.

Korean Patent Publication No. 10-2002-0012855 discloses an integrated log analysis and management system that, in an enterprise environment where host systems such as routers, firewall systems, and computer systems are connected to each other through a predetermined communication network, collects and transmits system events occurring in the host systems and log files generated by an operating system running on each host system, stores the transmitted information in a database in a predetermined format, and searches and queries the information stored in the database to analyze and manage the system events and log files of each host system, thereby extracting only the logs related to security from among the firewall, system, DB, and other application system logs, constructing an abbreviated DB (Log Format), and connecting and managing them as a single log chain by user and IP, thereby enabling monitoring of user violations against the system.

Meanwhile, system log data is a massive amount of data that records all events that occur while the system is running and is permanently recorded as long as the system is running, and event logs are similar data that are records generated based on the actions of system users and are also massive amounts of data.

Previously, these massive amounts of data were simply recorded and managed as text files or relational databases.

However, although the ability to record immediately without a separate procedure was an advantage of text files, it was also a disadvantage. Since it was vulnerable to falsification and was raw data, its usability was extremely low. In addition, relational databases were also struggling to accommodate all the log data that was recorded in large quantities, so an approach was used to reduce the size of the recorded data by selecting the data.

This previous method led to imperfect log management, such as low usability or missing records due to data selection, which affected stable system operation. Ultimately, in order to ensure stable system operation, a new technical approach was required that could record all log data while providing both security and usability.

Republic of Korea Patent Publication No. 10-2001-0104421 Republic of Korea Patent Publication No. 10-2002-0012855 Republic of Korea Patent Publication No. 10-1330222

The purpose of the present invention, which was devised to solve the above-mentioned problems, is to provide a blockchain-based integrated log data security management system that prevents falsification of integrated log data, including access records and event log records of authenticated users who accessed the database of a system server, and solves various problems resulting from inefficient security management, from information leak accidents and information hacking caused by weak security.

The above-mentioned object is achieved by the following configuration provided in the present invention.

The integrated log data security management system based on blockchain according to the present invention is:

The connecting terminal and;

A system server including a user authentication unit that authenticates and connects an authenticated user connected through the user terminal; and a DB work unit that performs work of an authenticated user connected to a DB by authenticating through the user authentication unit;

A blockchain network unit that distributes and stores integrated log data of authenticated users who have accessed the above system server in a blockchain ledger; and

It is characterized by comprising a midware solution unit including a log data collection unit that generates and collects integrated log data for each worker in the form of a data set, including a connection log and a work content log, for each authenticated user who has accessed the system server through an authentication connection process using the above-mentioned user authentication unit; and a node distribution unit that distributes and stores the collected integrated log data in a blockchain ledger of the blockchain network unit.

Preferably, the midware solution unit includes a hash function value extraction unit that extracts a hash function value by applying a hash algorithm to the integrated log data collected through the log data collection unit.

The above node distribution unit is configured to distribute and store the hash function value extracted through the hash function value extraction unit in the blockchain ledger of the blockchain network section.

More preferably, it is configured to further include an AI-based smart contract section that verifies integrated log data by referencing big data, and detects actions that deviate from predefined criteria as deviant actors and detects actions that violate complex rules as abnormal signs actors.

As described above, in the present invention, by organically combining the midware solution part and the blockchain network part, the integrated log data of an authenticated user is collected and distributed and stored in nodes of the blockchain network part, thereby simultaneously satisfying the recording, security, and usability of the integrated log data.

That is, since the blockchain network part guarantees the immutability and integrity of data since data recorded once is permanently recorded and cannot be changed, and integrated log data is converted into a hash value and recorded in the blockchain network part, enabling smooth operation of the network part.

Therefore, if falsification or modification of integrated log data occurs on individual hardware, the fact of falsification can be immediately detected as it is inconsistent with the records in the blockchain, thereby resolving various problems from information leaks and information hacking caused by previously weak security to inefficient security management.

In addition, the blockchain network part can record integrated log data in the blockchain ledger by adding a smart contract part, and this function ensures wide stability and usability of the data.

Figure 1 is an implementation status diagram of a blockchain-based integrated log data security management system according to one embodiment of the present invention.
FIG. 2 is a block diagram showing the overall configuration of a blockchain-based integrated log data security management system according to one embodiment of the present invention.
FIG. 3 is a flowchart showing the process of collecting and storing integrated log data through a blockchain-based integrated log data security management system according to one embodiment of the present invention.

It should be understood that the embodiments of the present invention encompass various modifications, equivalents, and/or alternatives. In connection with the description of the drawings, similar reference numerals may be used for similar components.

In this document, the expressions "have", "can have", "include", or "may include" indicate the presence of a feature (e.g., a numerical value, function, operation, or component such as a part), but do not exclude the presence of additional features.

In this document, the expressions "A or B", "at least one of A or/and B", or "one or more of A or/and B" may include all possible combinations of the items listed together.

For example, “A or B,” “at least one of A and B,” or “at least one of A or B” can all refer to (1) including at least one A, (2) including at least one B, or (3) including both at least one A and at least one B.

The expressions “first,” “second,” “first,” or “second” used in this document can describe various components, regardless of order and/or importance, and are only used to distinguish one component from other components and do not limit the components.

For example, without departing from the scope of the rights set forth in this document, the first component could be renamed the second component, and similarly, the second component could also be renamed the first component.

The expression "configured to" as used herein can be used interchangeably with, for example, "suitable for", "having the capacity to", "designed to", "adapted to", "made to", or "capable of". The term "configured to" does not necessarily mean "specifically designed to".

In this document, terms such as “command,” “instruction,” “control information,” “message,” “information,” “data,” “packet,” “data packet,” “intent,” and/or “signal” transmitted and received between the first electronic device(s) and the second electronic device(s) may include or refer to human-perceivable ideas or specific electrical representations (e.g., digital codes/analog physical quantities) regardless of their expression.

It will be apparent to those skilled in the art that the exemplary expressions listed above can be interpreted in various ways depending on the context in which they are used.

In this document, “is greater than B” does not simply mean “is greater than B,” but also includes “is equal to or greater than B.”

The terms used in this document are only used to describe specific embodiments and may not be intended to limit the scope of other embodiments. Singular expressions may include plural expressions unless the context clearly indicates otherwise.

Terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by a person of ordinary skill in the art described in this document. Terms used in this document that are defined in general dictionaries may be interpreted as having the same or similar meaning in the context of the relevant technology, and shall not be interpreted in an ideal or overly formal sense unless explicitly defined in this document.

Hereinafter, a blockchain-based integrated log data management system proposed as a preferred embodiment of the present invention will be described in detail with reference to the attached drawings.

FIG. 1 is an implementation status diagram of a blockchain-based integrated log data security management system according to one embodiment of the present invention, FIG. 2 is a block diagram showing the entire configuration of a blockchain-based integrated log data security management system according to one embodiment of the present invention, and FIG. 3 is a flowchart showing a process of collecting and storing integrated log data through a blockchain-based integrated log data security management system according to one embodiment of the present invention.

An integrated management system (1) having a blockchain-based access record and event log management function according to the present invention includes a user terminal (40), a system server (10), a blockchain network unit (30), and a midware solution unit (20).

The above-mentioned access terminal (40) is composed of a PC, tablet, smartphone, etc. that can connect to the system server (10) through a network.

In addition, the system server (10) includes a user authentication unit (11) that authenticates an authenticated user connected through a user terminal (40) and a database (DB) work unit (12) that performs work of an authenticated user by authenticating through the user authentication unit (11).

The above network may include at least one of a telecommunications network, a computer network, the Internet, or a telephone network.

The wireless communication protocol for accessing the above network may use, for example, at least one of LTE (Long-Term Evolution), LTE-A (LTE Advanced), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), UMTS (Universal Mobile Telecommunications System), WiBro (Wireless Broadband), GSM (Global System for Mobile communications), or 5G standard communication protocols.

Accordingly, the above authenticated user connects to the system server (10) through the network via the user terminal (40), completes the authentication process via the user authentication unit (11), and then accesses the DB work unit (12) of the system server (10) according to the granted authority to perform various tasks such as inquiry tasks.

The above system server (10) can store various data related to the identity authentication of an authenticated user in the DB work unit (12), such as identity verification data, qualification certificate, qualification authentication data, user authentication information, verification information, etc.

In addition, since various data related to the above-mentioned identity authentication are sensitive information of the customer, in order to improve the security of the use of the above-mentioned information, they are distributed and stored in the blockchain ledger (31) of the blockchain network unit (30), so that the history of transmission, modification, deletion, addition, etc. of various data recorded in the DB work unit (12) is managed more safely in the blockchain network unit (30).

The initial registration process of an authenticated user through the above user authentication unit (11) is that when the above user authentication unit (11) transmits identity verification data to the connected user terminal (40), the authenticated user performs identity verification based on the identity verification data through the user terminal.

Thereafter, the above-mentioned user authentication unit (11) issues a connection certificate to an authenticated user whose identity has been verified through the above-mentioned user terminal (40) and provides it to the user terminal (40), and the above-mentioned mid-ware solution unit (20) encrypts information related to a qualification certificate for the connection certificate issued by the above-mentioned user certificate and then stores it in a distributed manner in the blockchain ledger (31) of the blockchain network unit (30).

Here, the above-mentioned access authentication unit (11) can generate authentication data based on the authentication certificate.

For example, credential authentication data may include identity verification data submitted by a user by signing a credential certificate with the user's private key in response to user information requested by a verification agency for service use.

For example, user authentication information may include an authentication token generated by entering a QR code into the user authentication section of the system server.

When the above authenticated user enters an institution that requires identity verification through a user terminal (40), the authenticated user authentication information can be generated by authenticating (tagging) a QR code on another user terminal linked to the user authentication unit (11).

And, in the process of authenticating a user through the user authentication unit (11), when the authenticated user provides the issued connection certificate to the user authentication unit (11) through the user terminal (40), the midware solution unit (20) extracts information related to the qualification certificate for the connection certificate from the blockchain ledger (31) of the blockchain network unit (30).

Thereafter, the above-mentioned user authentication unit (11) decrypts information related to a qualification certificate extracted from the blockchain ledger (31) of the above-mentioned blockchain network unit (30) and authenticates the authenticated user through a process of verifying the qualification certificate using the decrypted information related to a qualification certificate.

Meanwhile, the above-described mid-ware solution unit (20) includes a log data collection unit (21) that combines the access log, the database access log, and the work content log for each worker who accessed the system server (10) using an authenticated user as a key and performed work, and generates and collects integrated log data for each worker in the form of a data set by transaction unit; and a node distribution unit (22) that encrypts the integrated log data collected through the log data collection unit (21) and stores it in a distributed manner in the blockchain ledger (31) of the blockchain network unit (30).

In order to ensure the integrity of the integrated log data through the above blockchain network unit (30), it is desirable to provide each integrated log data source to the blockchain network unit (30).

However, if the entire integrated log data is distributed and stored in the blockchain network unit (30) without any special processing, the load on the blockchain network unit (30) may increase, which may cause problems in making it difficult to operate the network properly.

Considering this, in this embodiment, a hash algorithm is applied to convert the integrated log data collected from the log data collection unit (21) into a lightweight hash function value through the hash algorithm, and this is transmitted to the blockchain network unit (30) and distributedly stored in the nodes.

To this end, in this embodiment, the midware solution unit (20) includes a hash function value extraction unit (23) that extracts a hash function value by applying a hash algorithm to the integrated log data collected through the log data collection unit (21), and the node distribution unit (22) distributes and stores the hash function value extracted through the hash function value extraction unit (23) in the blockchain ledger (31) of the blockchain network unit (30).

In this way, by extracting hash function values from integrated log data using hash function values and distributing and storing them in the blockchain ledger (31) of the blockchain network unit (30), the load on the blockchain network unit (30) is minimized, enabling smooth operation of the network.

In particular, in this embodiment, a smart contract unit (50) is added that analyzes integrated log data distributed and stored in the blockchain network unit (30) in real time and notifies the system manager of a risk pattern analysis and comparison alarm, and transmits a hash function value of the optimal integrated log data to the blockchain network unit (30) through the node distribution unit (22), and the smart contract unit (50) verifies the integrated log data transmitted to the blockchain network unit (30) and records and manages it in the blockchain ledger (31).

Preferably, the integrated log data is sent to the blockchain ledger (31) of the blockchain network unit (30) through the node distribution unit (22) in a lightweight form as a hash function value by the hash function value extraction unit (23).

Accordingly, the smart contract unit (50) performs a risk detection function by comparing and verifying the integrated log data that has been lightened into a hash function value by the hash function value extraction unit (23) without analyzing the original integrated log data collected through the log data collection unit (21) of the midware solution unit (20).

At this time, the smart contract unit (50) compares and verifies the integrated log data that is lightened by the hash function value by referring to the big data of the AI unit (51), and if the integrated log data of each authenticated user is found to have an action that is outside the predefined criteria, it is defined as an aberrant actor, and for a composite rule violation, it is defined as an abnormal sign actor and is detected, and this is notified to the system administrator.

The above smart contract unit (50) detects risk patterns through pattern analysis and automatically sends an alarm to the system manager if only the integrity of the integrated log data is verified, since the integrated log data itself is data that can be utilized for big data, and the integrated log data is updated as big data after verification through the smart contract unit (50) and utilized as big data for the analysis of the integrated log data.

Although the present invention has been described above with specific preferred embodiments, the present invention is not limited in technical idea to the above-described embodiments or the contents described in the drawings, and anyone with ordinary skill in the art can make various modifications without departing from the gist of the present invention claimed in the scope of the claims, and such changes are within the scope of the claims of the present invention.

1. Integrated log data security management system
10. System Server 11. Access Authentication Unit
12. DB Work Unit
20. Midware Solution Department 21. Log Data Collection Unit
22. Node distribution unit 23. Hash function value extraction unit
30. Blockchain Network Department 31. Blockchain Ledger
40. Access terminal
50. Smart Contract Unit 51. AI Unit

Claims (3)

The connecting terminal and;
A system server including a user authentication unit that authenticates and connects an authenticated user connected through the user terminal; and a DB work unit that performs work of an authenticated user connected to a DB by authenticating through the user authentication unit;
A blockchain network unit that distributes and stores integrated log data of authenticated users who have accessed the above system server in a blockchain ledger; and
A midware solution unit including a log data collection unit that generates and collects integrated log data for each worker in the form of a data set by transaction unit for each authenticated user who accessed the system server through an authentication connection process using the above-mentioned user authentication unit; and a node distribution unit that distributes and stores the collected integrated log data in the blockchain ledger of the blockchain network unit.
The initial registration process of an authenticated user through the above user authentication unit includes a step in which the user authentication unit issues a connection certificate for an authenticated user whose identity has been verified through identity verification data and provides the certificate to the user terminal, and the midware solution unit encrypts information related to the qualification certificate for the connection certificate issued by the user authentication unit and then distributes and stores it in the blockchain ledger of the blockchain network unit.
The authentication connection process of an authenticated user through the above-mentioned user authentication unit includes a step in which the user terminal provides the connection certificate to the user authentication unit, the midware solution unit extracts and decrypts information related to the qualification certificate for the connection certificate from the blockchain ledger of the blockchain network unit, and authenticates the authenticated user by verifying the qualification certificate through the decrypted qualification certificate-related information. A blockchain-based integrated log data security management system. In the first paragraph, the midware solution unit includes a hash function value extraction unit that extracts a hash function value by applying a hash algorithm to the integrated log data collected through the log data collection unit.
A blockchain-based integrated log data security management system, characterized in that the above node distribution unit is configured to distribute and store the hash function value extracted through the hash function value extraction unit in the blockchain ledger of the blockchain network section. In the second paragraph, a blockchain-based integrated log data security management system characterized in that it further includes an AI-based smart contract section that verifies integrated log data by referencing big data, and defines an act that deviates from a predefined standard as a deviant act, and detects an act that violates a complex rule as an abnormal sign act.