A method for securely retrieving an attack alarm information log from a terminal, comprising: sending, by a client tool, account and login information to a server, in response to receiving the account and login information, determining, by the server, whether the account has authority to receive the attack alarm information log, and if it is determined that the account has authority, sending first data to be authenticated to a client tool, in response to receiving the first data to be authenticated, retrieving, by the client tool, an operator certificate from a U-KEY, whereby the U-key is a removable device that is inserted in the client tool, and the U-KEY includes an operator private key which can be directly used by the client tool, using the operator private key to encrypt the first data to be authenticated, generating the first authentication data, and sending the operator certificate and the first authentication data to the server, in response to receiving the operator certificate and the first authentication data, authenticating, by the server, the first authentication data, in response to authenticating the first authentication data, sending, by the terminal, second data to be authenticated to the client tool, in response to receiving the second data to be authenticated, sending, by the client tool, the second data to be authenticated to the server, in response to receiving the second data to be authenticated, authenticating, by the server, the second data to be authenticated, and if the second data to be authenticated are authenticated, using a first private key to encrypt the second data to be authenticated, generating second authentication data, and sending the second authentication data to the terminal via the client tool, in response to receiving the second authentication data, using, by the terminal, a first public key to authenticate the second authentication data, if the second authentication data are authenticated, sending, by the client tool, instructions to the terminal, in response to receiving the instructions, using, by the terminal a second public key to encrypt the attack alarm information log and sending the attack alarm information log to the client tool, in response to receiving the attack alarm information log, using, by the client tool, a second private key to decrypt the attack alarm information log and retrieving clear information of the attack alarm information log. sending, by a client tool, account and login information to a server, in response to receiving the account and login information, determining, by the server, whether the account has authority to receive the attack alarm information log, and if it is determined that the account has authority, sending first data to be authenticated to a client tool, in response to receiving the first data to be authenticated, retrieving, by the client tool, an operator certificate from a U-KEY, whereby the U-key is a removable device that is inserted in the client tool, and the U-KEY includes an operator private key which can be directly used by the client tool, using the operator private key to encrypt the first data to be authenticated, generating the first authentication data, and sending the operator certificate and the first authentication data to the server, in response to receiving the operator certificate and the first authentication data, authenticating, by the server, the first authentication data, in response to authenticating the first authentication data, sending, by the terminal, second data to be authenticated to the client tool, in response to receiving the second data to be authenticated, sending, by the client tool, the second data to be authenticated to the server, in response to receiving the second data to be authenticated, authenticating, by the server, the second data to be authenticated, and if the second data to be authenticated are authenticated, using a first private key to encrypt the second data to be authenticated, generating second authentication data, and sending the second authentication data to the terminal via the client tool, in response to receiving the second authentication data, using, by the terminal, a first public key to authenticate the second authentication data, if the second authentication data are authenticated, sending, by the client tool, instructions to the terminal, in response to receiving the instructions, using, by the terminal a second public key to encrypt the attack alarm information log and sending the attack alarm information log to the client tool, in response to receiving the attack alarm information log, using, by the client tool, a second private key to decrypt the attack alarm information log and retrieving clear information of the attack alarm information log.