Docs

Torch Log Service

Data storage

Data tamper-proof

TLS uses the Append Only mode to store data, and the underlying data is verified using CRC to prevent data errors or tampering.

This topic introduces the principles of data tamper-proofing in TLS.

Principle introduction

Writing data to the TLS system follows a standardized process to ensure the security and reliability of data transmission and storage. The specific steps are as follows:

1. Data collection and reporting

By calling the TLS SDK or deploying Logcollector, users collect target data and push it to the TLS API cluster.

2. Data validations and authentications

After the TLS API cluster receives data, it will perform double security verification:

First, perform signature verification to verify the legitimacy and integrity of the data source and prevent the data from being tampered with or forged.

Then complete permission authentication and confirm that the user initiating the request has data write permissions for the corresponding Topic.

After dual verification is completed, the API cluster will forward data to the TLS backend business cluster.

3. Append Only data write in

After the TLS backend business cluster receives the data, it uses the Append Only (only append) mode to write the data into the pooled storage cluster of the Volcano Engine backend. This mode only supports appending new content to the end of the data file and prohibits modification of already stored data, ensuring data cannot be tampered with at the mechanism level.

4. Write in feedback

After data is successfully written to the backend pooled storage cluster, the backend business cluster generates a response and returns the result to the TLS API cluster. Finally, the API cluster provides this result to the user who initiated the request, completing the entire data write process.

Core features

To ensure data integrity and tamper resistance, the data writing and storage process possesses the following key features:

Features	Notice
Independent data file isolation	Topic Independent storage of data files, mutual non-interference of data, and risk avoidance of tampering caused by file association at the storage structure level.
Original data cannot be tampered with	Topic: The raw data of a topic becomes immutable once written. This state will persist until the end of the data lifecycle (TTL). Once expired, the data will be deleted in its entirety, with no intermediate modification steps throughout the process.
Force Append Only storage mode	Volcengine backend pooled storage strictly adopts the Append Only (append-only) mode. This mode only supports adding new content to the end of the data file and strictly prohibits any modification of already stored data, with the writing mechanism itself eliminating the possibility of tampering.
Multiple verification and redundancy protection	Multiple verification and redundancy protection of the data within pooled storage. Achieve redundant storage through erasure coding technology to ensure data availability in scenarios such as hardware failure. The CRC verification mechanism enables real-time verification of data integrity, making it impossible to bypass the system and directly tamper with the underlying data.
Optional encrypted storage	Supports enabling the data encryption feature for Topic. After data encryption is enabled, data will be stored in encrypted form in the backend pooled storage, further enhancing data storage security and reducing the risk of unauthorized access and tampering. For more details, please refer toData encryption.

Last updated: 2025.12.01 10:33:25