JP7765872B2 - Log management device and log management analysis system - Google Patents

Description

The present invention relates to a log management and analysis system for detecting and analyzing cyber attacks, which mainly consists of a log management device mounted on a mobile object and a center device installed outside the mobile object.

In recent years, technologies for driver assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication) and vehicle-to-infrastructure communication, have been attracting attention. As a result, vehicles are increasingly equipped with communication functions, and so-called vehicle connectivity is on the rise. As a result, the possibility of vehicles becoming subject to cyberattacks is increasing. In light of this, various devices have been proposed that analyze security logs detected on in-vehicle networks and respond to cyberattacks.

For example, Patent Document 1 discloses a system consisting of a log management device mounted on a vehicle and a center device installed outside the vehicle.

Japanese Patent Application Laid-Open No. 2022-17889

Here, the present inventors have found the following problem.
Security logs output from security sensors mounted on vehicles, which are moving objects, are temporarily stored in a storage device connected to a log management device installed on the vehicle. However, because the storage device has a limited capacity, if an overflow occurs, the security logs may not be stored in the storage device. Even if an overflow does not occur, if the storage device is shared with other functions, storing the security logs may consume the storage device's capacity.

Furthermore, in the past, when a security log was sent from a log management device to a central device, the log management device would delete the security log from the storage device on the condition that it received a receipt notification from the central device. However, since a receipt notification was generated each time a security log was sent to the central device, communication volume increased. Furthermore, since the security log deletion process occurred sporadically, the load on the log management device increased.

The present disclosure aims to realize a log management device and the like that can appropriately operate the resources of storage devices connected to the log management device.
Another object of the present disclosure is to reduce the amount of communication between the center device and the log management device, and to reduce the amount of security log deletion processing in the log management device.

Note that the above issues are presented as an example of a case where the log management device is installed in a vehicle, but this is described as one example of the issues. Even if the log management device is not installed in a vehicle, issues such as limited storage capacity and reduced communication volume with the center device can arise.

The log management device (100) of the present disclosure is a log management device (100) that transmits a security log generated by a security sensor to a center device (200),
a log receiving unit (101) that receives the security log from the security sensor;
a log storage unit (103) for storing the security log;
a request message generating unit (107) that generates a request message inquiring about the reception status at the center device for all of the security logs stored in the log storage unit;
a transmission timing determination unit (108) that determines a transmission timing that is a timing for transmitting the request message;
a transmitting unit (105) that transmits the security log to the center device and also transmits the request message to the center device at the transmission timing;
It has.

Note that the numbers in parentheses attached to the constituent elements of the invention described in the claims and this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention.

With the above-described configuration, the resources of the storage devices connected to the log management device can be appropriately utilized.
Furthermore, with the above-described configuration, it is possible to reduce the amount of communication with the center device, and it is also possible to reduce the amount of security log deletion processing in the log management device.

FIG. 1 is a diagram illustrating an example of the configuration of a log management analysis system according to the present disclosure. FIG. 1 is a block diagram illustrating a configuration example of a log management device according to an embodiment of the present disclosure. FIG. 10 illustrates an example of a security log according to an embodiment of the present disclosure. FIG. 10 illustrates an example of a request message according to an embodiment of the present disclosure. FIG. 10 illustrates an example of a response message according to an embodiment of the present disclosure. FIG. 1 is a block diagram illustrating a configuration example of a center device according to an embodiment of the present disclosure. A flowchart showing the operation of the log management analysis system according to an embodiment of the present disclosure. FIG. 1 is a block diagram illustrating a form or aspect of a log management device according to an embodiment of the present disclosure.

Embodiments of the present invention will be described below with reference to the drawings.

The present invention refers to the inventions described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks refer to the words described in the claims or in the Summary of the Invention section, and are also not limited to the following embodiments.

Configurations and methods recited in dependent claims are optional configurations and methods in the invention recited in the independent claims. Configurations and methods of embodiments corresponding to configurations and methods recited in dependent claims, as well as configurations and methods recited only in embodiments without being recited in the claims, are optional configurations and methods in the present invention. Configurations and methods recited in embodiments where the recitation of the claims is broader than the recitation of the embodiments are also optional configurations and methods in the present invention, in the sense that they are examples of configurations and methods of the present invention. In either case, by being recited in an independent claim, they become essential configurations and methods of the present invention.

The effects described in the embodiments are those obtained when the configuration of the embodiment is an example of the present invention, and are not necessarily the effects of the present invention.

When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to that embodiment alone, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in multiple embodiments may be collected and combined. The same applies to the examples.

The problem described as the problem to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this fact, together with the configuration and method of the present invention, affirms the inventive step of the invention.

1. Embodiment (1) Overall Configuration of Log Management Analysis System 1 First, the overall configuration of a log management analysis system 1 of this embodiment will be described with reference to FIG.

The log management analysis system 1 consists of a log management device 100 and a center device 200.

The log management device 100 is connected to a center device 200 via a communication network 2. The log management device 100 transmits to the center device 200 a "security log" generated by a security sensor.
where:
The term "security log" does not matter what name it is called, as long as it contains the detection results of the security sensor or an evaluation of the detection results.
The "center device" is not limited to a specific name, and may be any device that manages or analyzes security logs received from a log management device.

In this embodiment, the log management device 100 is "mounted" on a vehicle, which is a "mobile body." However, the log management device 100 may be mounted on a fixed object instead of a mobile body.
where:
"Mobile object" refers to an object that can move at any speed. It also includes cases where the object is stationary. Examples include, but are not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these.
"Mounted" includes not only cases where the device is directly fixed to the mobile body, but also cases where the device is not fixed to the mobile body but moves with the mobile body. For example, cases where the device is carried by a person riding on the mobile body, or cases where the device is mounted on cargo placed on the mobile body, are included.

The communication lines that make up the communication network 2 may be either wireless communication lines or wired communication lines.
Examples of wireless communication lines include communication lines based on mobile communication systems, such as W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, or 5G. In addition, communication lines based on wireless communication methods such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), Bluetooth (registered trademark), UWB (Ultra Wide Band), or DSRC (Dedicated Short Range Communication) can also be used.
Examples of wired communication lines include a LAN (Local Area Network) such as Ethernet (registered trademark), an optical fiber line, or a fixed telephone line.
Alternatively, the communication line may be a combination of a wireless communication line and a wired communication line. For example, the log management device 100 and a base station device in a cellular system may be connected by a wireless communication method, and the base station device and the center device 200 may be connected by a wired communication method such as a trunk line of a telecommunications carrier or the Internet.

In this embodiment, an example is described in which the log management device 100 is mounted on a vehicle, but the log management device 100 does not have to be mounted on a vehicle. Also, an example is described in which the center device 200 is assumed to be a server device and is not mounted on a vehicle, but the center device 200 may be mounted on a vehicle.

(2) Configuration of the Log Management Device 100 The configuration of the log management device 100 of this embodiment will be described with reference to FIG.

The log management device 100 comprises a log receiving unit 101, a buffer 102, a log storage unit 103, a control unit 104, a transmission unit 105, and a receiving unit 106. The control unit 104 also has a request message generating unit 107, a transmission timing determining unit 108, a deletion instruction unit 109, and a priority setting unit 110.

The log management device 100 can be configured with a general-purpose CPU (Central Processing Unit), volatile memory such as RAM, non-volatile memory such as ROM, flash memory, or a hard disk, various interfaces, and an internal bus connecting these. By executing software on this hardware, the log management device 100 can be configured to perform the functions of each functional block shown in Figure 2. The same applies to the center device 200 shown in Figure 6, which will be described later.
Of course, the log management device 100 may be realized by dedicated hardware such as an LSI. The same applies to the center device 200.

In this embodiment, the log management device 100 is assumed to be in the form of an electronic control unit (ECU (Electric Control Unit), hereinafter abbreviated as ECU) as a semi-finished product, but is not limited to this. For example, the log management device 100 may be in the form of a component or a finished product.
The log management device 100 may be configured with a single ECU or multiple ECUs.
The same applies to the center device 200.

The log receiving unit 101 is connected to one or more ECUs connected to the log management device 100 via an in-vehicle network, and receives security logs generated by and transmitted from the security sensors provided in each ECU. The security sensors monitor each ECU itself and its communications, detect abnormalities such as attacks, and report normal or abnormal conditions via the security log.

Note that security logs generally include both normal logs that report normal operations and abnormal logs that report abnormal operations. However, this embodiment will be described assuming that the security log is an abnormal log, i.e., that the log management device 100 has received an abnormal log. Of course, this embodiment may also be applied to cases where the security log is a normal log and an abnormal log, i.e., when the log management device 100 has received either a normal log or an abnormal log.

In FIG. 2, the log receiving unit 101 is connected to ECU1, ECU2, and ECU3 via an in-vehicle network. ECU1 and ECU2 are equipped with security sensors that monitor the ECUs themselves and their communications. ECU3 is not equipped with a security sensor.

In addition to the security sensors, ECU1, ECU2, and ECU3 may also be equipped with defensive functions and the ability to generate logs that notify the operating status of each ECU. These logs may then be processed in this embodiment instead of or in addition to the security logs.

ECU1, ECU2, and ECU3 may be any ECU, but examples include drive system electronic control units that control the engine, steering, brakes, etc., vehicle body electronic control units that control meters and power windows, information system electronic control units such as navigation systems, and safety control system electronic control units that perform control to prevent collisions with obstacles or pedestrians. Furthermore, the ECUs may not be connected in parallel, but may be classified as master and slave.

Note that ECU1, ECU2, and ECU3 may be physical ECUs, or may be ECUs implemented as virtual machines using virtualization technology.

The in-vehicle network can use any communication method, such as CAN (Controller Area Network) or LIN (Local Interconnect Network), as well as Ethernet (registered trademark), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

Figure 3 shows an example of security log specifications. The security log has the following fields: ECU ID, which indicates the identification information of the ECU in which the security sensor is installed; sensor ID, which indicates the identification information of the security sensor; event ID, which indicates the identification information of the security event; a counter, which indicates the number of times the event has occurred; and context data, which indicates details of the security sensor output. The security log may also have a header that stores information indicating the protocol version and the status of each field.

Note that while Figure 3 is an example of an abnormal log, normal logs may also have the same specifications as Figure 3. In this case, the context data for normal logs can be omitted. Also, by setting a flag in the header indicating whether or not context data is present, abnormal logs can be distinguished from normal logs by checking this flag.

The buffer 102 temporarily stores the security logs received by the log receiving unit 101. The buffer 102 may be configured as either non-volatile memory or volatile memory, but volatile memory is preferable due to its fast read/write speed.

The log storage unit 103 stores the security log received by the log receiving unit 101 by obtaining it from the log receiving unit 101 or the buffer 102 via the control unit 104 or directly from the log receiving unit 101 or the buffer 102 .
The log storage unit 103 may be configured as either a nonvolatile memory or a volatile memory, but a nonvolatile memory that has a large storage capacity and can store security logs independent of the power supply state is preferable.

Note that the log storage unit 103 does not need to store all of the security logs received by the log receiving unit 101. Specific details will be explained in the section on the priority setting unit 110.

The control unit 104 controls the operation of the log receiving unit 101, buffer 102, log storage unit 103, transmitting unit 105, and receiving unit 106. The control unit 104 also implements the request message generating unit 107, transmission timing determining unit 108, deletion instruction unit 109, and priority setting unit 110.

The request message generation unit 107 generates a "request message" that inquires about the reception status at the center device 200 for all security logs stored in the log storage unit 103. Specifically, the request message generation unit 107 reads the ECU ID, sensor ID, event ID, and counter of all security logs stored in the log storage unit 103, and generates a request message that stores these. This makes it possible to know the type and number of security logs that are stored in the log storage unit 103 and have not yet been deleted.
Here, the "request message" may be called by any name as long as it can be understood as a request to the center device. In other words, it does not have to be called a message, and may be called, for example, a command, instruction, etc.

FIG. 4 is an example of a request message.
The request message is assigned a serial number for each security log. The security log with serial number 1 is identified by ECU #1, sensor #1, event #1, and counter #1, which are all 1. The security log with serial number 2 is identified by ECU #1, sensor #2, event #2, and counter #1, which indicates that it was generated by the same ECU as the security log with serial number 1, but by a different security sensor. The security log with serial number 3 is identified by ECU #1, sensor #1, and event #1, which indicates that it is the second security log generated, but it is generated by the same ECU, same security sensor, and same event as the security log with serial number 1. The security log with serial number 4 is identified by ECU #2, sensor #3, event #3, and counter #1, which indicates that it was generated by a different ECU from the security logs with serial numbers 1 to 3.

The transmission timing determination unit 108 determines the "transmission timing," which is the timing at which the request message generated by the request message generation unit 107 is transmitted from the transmission unit 105, which will be described later. When determining the transmission timing, the transmission timing determination unit 108 can refer to the storage status of the security log in the log storage unit 103. A specific method for determining the transmission timing will be described later.
Here, "transmission timing" is sufficient as long as the timing for sending the request message can be directly or indirectly identified, and may be, for example, time, duration, or period, or a correlation with the timing for sending the security log.

The transmitting unit 105 transmits the security log and the request message to the center device 200. That is, the transmitting unit 105 transmits the security log received by the log receiving unit 101 to the center device 200, and also transmits the request message generated by the request message generating unit 107 to the center device 200 at the transmission timing determined by the transmission timing determining unit 108. The security log that has been transmitted is deleted from the buffer 102.
Here, "together" means that it is sufficient that the security log and the request message can be transmitted separately, and is not limited to the security log and the request message being transmitted simultaneously or consecutively.

The timing of security log transmission and the timing of request message transmission may be related to each other (i.e., synchronized), or unrelated to each other (i.e., unsynchronized). An example of the former will be explained in Example 1 below, and an example of the latter will be explained in Example 2 below.

The receiving unit 106 receives from the center device 200 a “response message” that is a response from the center device 200 to the request message sent from the sending unit 105 .
Here, the "response message" may be any name as long as it can be understood as a response from the center device to a request message. In other words, it does not need to be called a message.

Figure 5 is an example of a response message. The response message indicates the reception status of each security log identified in the request message. Specifically, it indicates whether each security log identified in the request message has been received by the center device 200.

5, the security logs for serial numbers 1 and 2 have a reception flag of 1, which indicates that they have been received by the center device 200. In contrast, the security logs for serial numbers 3 and 4 have a reception flag of 0, which indicates that they have not been received by the center device 200.
Based on the response message, the transmitting unit 105 may retransmit security logs that have not been received by the center device 200 .

Based on the response message received by the receiving unit 106, the deletion instruction unit 109 deletes security logs that have already been received by the center device 200 from the log storage unit 103. Specifically, in FIG. 5, it has been confirmed that the security logs for serial numbers 1 and 2 have already been received by the center device 200, so they are deleted from the log storage unit 103, while it has been confirmed that the security logs for serial numbers 3 and 4 have not been received by the center device 200, so they are not deleted from the log storage unit 103. Note that security logs that have been confirmed not to have been received by the center device 200 are retransmitted from the transmitting unit 105.

The priority setting unit 110 sets the priority of the security log received by the log receiving unit 101 based on a predetermined criterion. For example, the predetermined criterion may be the type of ECU that generated the security log, the type of security sensor, the type of security event, or/and the number of occurrences of the security event.
Other than that, the distance from the communication ECU or the central ECU (C-ECU) or the hierarchy level can also be used as the predetermined criterion.

For example, if a drivetrain ECU is specified as a predetermined criterion, the priority of the security log generated by the security sensor of the drivetrain ECU is set higher than the priority of the security log generated by the security sensor of another ECU.
For example, if a health check event is specified as the predetermined criterion, the priority of the security log relating to the health check event is set higher than the priority of the security log relating to other events.
For example, if the predetermined standard specifies that the number of times a security event occurs is three, the priority of a security log in which the number of times a security event occurs is three or more is set higher than the priority of a security log in which the number of times a security event occurs is two or less.

Priority can be set to any number of levels, including two, three, or more.

The priority can be used to determine the order in which security logs are sent and whether or not they need to be saved. For example, security logs set with a high priority are sent from the sending unit 105 before other security logs. Accordingly, security logs set with a high priority are sent immediately, so they can be prevented from being saved in the log saving unit 103. This makes it possible to reduce the amount of data used by the log saving unit 103.

The priority can be used to determine the order in which security logs are saved in the log storage unit 103. For example, security logs with a higher priority may be saved in the log storage unit 103 before security logs with a lower priority. For example, if there are three levels of priority, high, medium, and low, the logs may be saved in the log storage unit 103 in the order of high, medium, and low. Alternatively, as in the previous paragraph, security logs with a high priority may not be saved in the log storage unit 103 but may be sent immediately to the center device 200, and the logs may be saved in the order of medium and low priority in the log storage unit 103.

(3) Configuration of the Center Device 200 The configuration of the center device 200 of this embodiment will be described with reference to FIG.

The center device 200 consists of a receiving unit 201, a control unit 202, a storage unit 204, and a transmitting unit 205.

The receiving unit 201 receives security logs and request messages from the log management device 100.

The control unit 202 controls the operation of the receiving unit 201, the storage unit 204, and the transmitting unit 205. The control unit 202 also implements the response message generating unit 203 itself.

The response message generation unit 202 generates a response message in response to a request message received by the reception unit 201 to report the reception status of the security log identified in the request message. Specific examples of response messages are as described in Figure 5.

The storage unit 204 stores the security log and request message received by the receiving unit 201.

The transmission unit 203 transmits the response message generated by the response message generation unit 202 to the log management device 100.

(4) Specific Example of Transmission Timing A specific example of a method for determining the transmission timing in the transmission timing determination unit 108 will be described.
(a) Example 1: When the transmission timing of the security log and the request message are asynchronous In this example, the transmission unit 105 periodically transmits the request message regardless of the transmission timing of the security log. In other words, the transmission timing determination unit 108 determines the "period" for transmitting the request message as the transmission timing.
Here, the "period" is sufficient as long as it can specify the time interval for transmitting the request messages, and may be the number of transmissions of the request messages or the number of clock ticks per predetermined time, in addition to the time between request messages. It may also be an increase or decrease in the current period.

As a more specific example, the transmission timing determination unit 108 determines the cycle based on the "amount of security logs" stored in the log storage unit 103 within a predetermined period.
Here, the "amount of security logs" may refer to the number of security logs in addition to the size of the security logs. The number of security logs saved within a predetermined period can be evaluated as the saving frequency.

The size of the security logs can be used as the quantity of security logs. For example, the transmission timing determination unit 108 shortens the cycle when the size of the security logs stored in the log storage unit 103 within a predetermined period is equal to or greater than a first reference value, and lengthens the cycle when the size of the security logs stored in the log storage unit 103 within a predetermined period is equal to or less than a second reference value.
where:
The term "equal to or greater than" includes both cases where the first reference value is included and cases where the first reference value is not included.
The term "equal to or less than" includes both cases where the second reference value is included and cases where the second reference value is not included.

For example, the specified period is 1 hour, the first reference value is 2 GB, the second reference value is 500 MB, the standard cycle is 4 hours, and the increase/decrease amount is 20%. In this case, if the size of the security log stored in the log storage unit 103 within the past hour is 2 GB or larger, the transmission timing determination unit 108 will subtract 20% from the cycle that had been applied up to that point, and if it is 500 MB or smaller, it will add 20% to the cycle that had been applied up to that point.

Alternatively, the number of security logs can be used as the quantity of security logs. For example, the transmission timing determination unit 108 shortens the cycle if the number of security logs stored in the log storage unit 103 within a specified period is equal to or greater than a first reference value, and lengthens the cycle if the number of security logs stored in the log storage unit 103 within a specified period is equal to or less than a second reference value. The number of security logs stored in the log storage unit 103 within a specified period is synonymous with the frequency at which security logs are stored.

For example, the specified period is 1 hour, the first reference value is 10, the second reference value is 1, the standard cycle is 4 hours, and the increase/decrease range is 20%. In this case, if the number of security logs stored in the log storage unit 103 within the past hour is 10 or more, the transmission timing determination unit 108 will subtract 20% from the cycle that had been applied up to that point; if the number is 1 or less, the transmission timing determination unit 108 will add 20% to the cycle that had been applied up to that point.

The quantity of security logs can also be determined by both the size of the security logs and the number of security logs. For example, the transmission timing determination unit 108 shortens the cycle if the size of the security logs stored in the log storage unit 103 within a specified period is equal to or greater than a first reference value, and lengthens the cycle if the number of security logs stored in the log storage unit 103 within a specified period is equal to or less than a second reference value.

The reason why the first reference value is the size of the security log is because the purpose of the first reference value is to free up the log storage unit 103, so it is desirable to focus on the capacity of the log storage unit 103. Furthermore, the reason why the second reference value is the number of security logs is because the purpose of the second reference value is to evaluate the risk of cyber attacks, so it is desirable to focus on the number of times security logs are received.

Note that in the previous two examples, the first reference value and the second reference value were different values, but the first reference value and the second reference value may also be the same value.

Other examples of the amount of security logs that can be used include the size of the security logs stored in the log storage unit 103, or the ratio of the size of the security logs stored in the log storage unit 103 to the storage capacity of the log storage unit 103.

As described above, according to the transmission timing determination method of the transmission timing determination unit 108 of Example 1, a period is determined as the transmission timing, so that a request message can be sent regardless of the transmission timing of the security log, and as a result, the memory space of the log storage unit 103 can be released appropriately at an appropriate timing depending on the storage status of the security log in the log storage unit 103.
In addition, since the reception status at the center device 200 for multiple security logs can be reported at once, the amount of communication traffic can be reduced and the amount of security log deletion processing at the log management device 100 can be reduced.

(b) Example 2: When the transmission timing of the security log and the request message are synchronized In this example, the transmission unit 105 transmits the request message at the timing of transmitting the security log. However, the request message is not transmitted at every timing of transmitting the security log. In other words, the transmission timing determination unit 108 determines whether or not to transmit the request message "simultaneously" with the transmission of the security log. In this example, the timing determined by the transmission timing determination unit 108 is the time when the security log is transmitted.
Here, "simultaneous" includes not only simultaneous in the narrow sense, but also consecutive.

As a more specific example, the transmission timing determination unit 108 determines whether to send a request message at the same time as sending the security log based on the "amount of security logs" stored in the log storage unit 103 within a predetermined period.
Here, the "amount of security logs" may refer to the number of security logs in addition to the size of the security logs. The number of security logs saved within a predetermined period can be evaluated as the saving frequency.

The size of the security log can be used as the quantity of the security log. For example, if the size of the security log stored in the log storage unit 103 within a predetermined period is equal to or greater than a first reference value, the transmission timing determination unit 108 determines to transmit the request message simultaneously with the transmission of the security log.
Here, "equal to or greater than" includes both cases where the first reference value is included and cases where the first reference value is not included.

For example, the specified period is 1 hour, and the first reference value is 2 GB. In this case, if the size of the security log stored in the log storage unit 103 within the past hour is 2 GB or larger, the transmission timing determination unit 108 determines to send a request message at the same time as sending the security log.

Alternatively, the number of security logs can be used as the quantity of security logs. For example, if the number of security logs stored in the log storage unit 103 within a predetermined period is equal to or greater than a first reference value, the transmission timing determination unit 108 determines to send a request message simultaneously with the transmission of the security logs.

For example, the specified period is one hour, and the first reference value is 10. In this case, if the number of security logs stored in the log storage unit 103 within the past hour is 10 or more, the transmission timing determination unit 108 determines to send a request message at the same time as sending the security logs.

In this embodiment, the transmission timing determination unit 108 determines the transmission timing when the security log is transmitted, but this may be unrelated to the time when the security log is transmitted. For example, the transmission timing may be determined periodically, and a request message may be sent simultaneously with the security log sent to the center device 200 immediately after the transmission timing is determined. In this case, the period for determining the transmission timing may be fixed or variable. For example, the period for determining the transmission timing may be changed based on the frequency with which the amount of security logs stored in the log storage unit 103 within a specified period exceeds a first reference value.

As described above, according to the transmission timing determination method of the transmission timing determination unit 108 of Example 2, the transmission timing of whether or not to send a request message is determined to coincide with the transmission of the security log, so that the request message can be sent at a timing that coincides with the transmission timing of the security log, and as a result, the memory space of the log storage unit 103 can be released appropriately at an appropriate timing depending on the storage status of the security log in the log storage unit 103.
In addition, since the reception status at the center device 200 for multiple security logs can be reported at once, the amount of communication traffic can be reduced and the amount of security log deletion processing at the log management device 100 can be reduced.

(5) Example of Operation of the Log Management Analysis System The operation of the log management analysis system 1 of this embodiment, that is, the log management device 100 and the center device 200, will be described using the flowchart of FIG.
The following operations not only indicate a log management method executed by the log management device 100 or the center device 200 but also indicate the processing procedures of a log management program that can be executed by the log management device 100 or the center device 200.
These processes are not limited to the order shown in Fig. 7. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a step uses the result of a previous step.

The log receiving unit 101 of the log management device 100 receives a security log from a security sensor (S101).
The log storage unit 103 stores the security log received in S101 (S102).
The request message generating unit 107 generates a request message inquiring about the reception status at the center device 200 for all security logs stored in the log storage unit 103 (S103).
The transmission timing determination unit 108 determines the transmission timing, which is the timing for transmitting the request message (S104).
The transmitting unit 105 transmits the request message generated in S103 to the center device 200 at the transmission timing determined in S104 (S105).

The receiving unit 201 of the center device 200 receives a request message from the log management device 100 (S201).
In response to the request message received in S201, the response message generating unit 203 generates a response message for reporting the reception status of the security log specified in the request message (S202).
The transmitting unit 205 transmits the response message generated in S202 to the log management device 100 (S203).

The receiving unit 106 of the log management device receives from the center device 200 a response message that is a response to the request message generated in S103 and transmitted in S105 (S106).
Based on the response message received in S106, the deletion instruction unit 109 deletes the security log already received by the center device 200 from the log storage unit 103 (S107).

Note that S102 and S103 do not necessarily need to be sequential in time, and may be executed independently. For example, in the case of Example 1, the request message may be generated in accordance with the period for sending the request message, regardless of the timing of S102. Furthermore, in the case of Example 2, the request message may be generated following the timing of S102, but the request message may also be generated appropriately by referring to the amount of security logs stored in the log storage unit 103, regardless of the timing of S102.

In addition, although the timing of transmitting the security log saved in S102 is not shown in Figure 7, it can be transmitted from the transmitting unit 105 as appropriate. For example, in the case of Example 1, the security log received in S101 or the security log saved in S102 can be transmitted sequentially in the order in which they were stored in the buffer 102 or in order of priority. In addition, in the case of Example 2, when transmitting the security log, S103 to S104 are executed, and if the conditions are met, a request message is transmitted in S105 along with the security log.

(6) Summary As described above, according to this embodiment, a request message is generated for all security logs stored in the log storage unit 103, and security logs already received by the center device 200 are deleted from the log storage unit 103 based on a response message that is a response to the request message. This reduces the amount of communication between the log management device 100 and the center device 200, and also reduces the amount of security log deletion processing in the log management device 100.
Furthermore, according to this embodiment, the timing for sending a request message is determined based on the amount of security logs stored in the log storage unit 103, thereby preventing overflow of the log storage unit 103 and pressure on the storage area.

(7) Aspects of the Log Management Device 100 The log management device 100 shown in Fig. 8(a) is the log management device 100 of the embodiment already described. The log management device 100 is realized by an ECU that is capable of communicating with the center device 200, which is an external device, i.e., has a communication function.
The log management device 100 shown in Fig. 8(b) is an embodiment in which the ECU that realizes the log management device 100 and the communication ECU are separated. In this case, the transmitter 105 and receiver 106 of the log management device 100 transmit and receive request messages and response messages to and from the center device 200 via the in-vehicle network and the communication ECU. The log management device 100 in the embodiment shown in Fig. 8(a) or 8(b) can be realized as one function of the communication ECU, central ECU, or gateway ECU.
The log management device 100 shown in FIG. 8C is implemented by a dedicated ECU that implements the log management function.
The log management device 100 shown in FIG. 8D is an embodiment in which the log management device 100 is realized by a general-purpose ECU having a security sensor (SS).

In this way, the log management device 100 can be implemented in various ECUs within an in-vehicle network.

2. Summary The features of the log management device, center device, and log management analysis system in each embodiment of the present invention have been described above.

The terms used in each embodiment are for illustrative purposes only and may be replaced with synonymous terms or terms with equivalent functions.

The block diagrams used to explain the embodiments classify and organize the device configuration by function. The blocks representing each function can be realized by any combination of hardware or software. Furthermore, because they represent functions, these block diagrams can also be understood as disclosures of method inventions and program inventions that realize those methods.

The order of the processes, flows, and functional blocks that can be understood as methods described in each embodiment may be changed, as long as there are no constraints, such as one step using the results of another step that precedes it.

The terms "first," "second," "up to," and "Nth" (where N is an integer) used in each embodiment and in the claims are used to distinguish between two or more similar configurations or methods, and do not limit the order or superiority of the methods.

Each embodiment is based on a vehicle log management device installed in a vehicle, but the present invention also includes dedicated or general-purpose log management devices other than those for vehicles, unless otherwise limited by the claims.

In each embodiment, the log management device disclosed in each embodiment is described as being installed in a vehicle, but it may also be carried by a pedestrian.

The log management device and center device of the present invention may take the following forms.
The components may take the form of semiconductor elements, semiconductor circuits, electronic circuits, modules, and microcomputers.
Examples of semi-finished products include an electronic control unit (ECU), an electronic control unit, and a system board.
Finished product forms include mobile phones, smartphones, mobile routers, tablets, personal computers (PCs), workstations, and servers.
Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

In addition, necessary functions such as antennas and communication interfaces may be added to the log management device and center device.

The center device of the present invention is expected to be used for the purpose of providing various services. In providing such services, the center device of the present invention will be used, the method of the present invention will be used, and/or the program of the present invention will be executed.

In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a combination of a program for implementing the present invention recorded on a recording medium such as memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory that can execute the program.

Programs for the device of the present invention that are stored on non-transient physical recording media for dedicated or general-purpose hardware (for example, external storage devices (hard disks, USB memory, CDs/BDs, etc.) or internal storage devices (RAM, ROM, etc.)) can also be provided to the dedicated or general-purpose hardware via the recording media, or from a server via a communication line without using a recording media. This makes it possible to always provide the latest functions through program upgrades.

The log management device of the present invention has been described as an electronic control device for vehicles primarily mounted on automobiles, but it can also be applied to all types of moving objects, including motorcycles, motorized bicycles, trains, pedestrians, ships, aircraft, etc.
The present invention is also applicable to devices used for a variety of purposes, such as mobile phones, tablets, and game consoles.

100 Log management device, 101 Log receiver, 102 Buffer, 103 Log storage unit, 104 Control unit, 105 Transmitter, 106 Receiver, 107 Request message generator, 108 Transmission timing determination unit, 109 Deletion instruction unit, 110 Priority setting unit, 200 Center device, 201 Receiver, 202 Control unit, 203 Response message generator, 204 Storage unit, 205 Transmitter

Claims (14)

A log management device (100) that transmits a security log generated by a security sensor to a center device (200),
a log receiving unit (101) that receives the security log from the security sensor;
a log storage unit (103) for storing the security log;
a request message generating unit (107) that generates a request message inquiring about the reception status at the center device for all of the security logs stored in the log storage unit;
a transmission timing determination unit (108) that determines a transmission timing that is a timing for transmitting the request message;
a transmission unit (105) that transmits the security log to the center device and transmits the request message to the center device at the transmission timing;
Log management device (100). a receiving unit (106) for receiving a response message from the center device, the response message being a response to the request message;
a deletion instruction unit (109) that deletes the security log that has been received by the center device from the log storage unit based on the response message;
The log management device according to claim 1. the transmission timing determination unit determines a period for transmitting the request message as the transmission timing.
The log management device according to claim 1. the transmission timing determination unit determines the period based on the amount of the security logs stored in the log storage unit within a predetermined period.
4. The log management device according to claim 3. the transmission timing determination unit shortens the period when the amount of security logs is equal to or greater than a first reference value, and lengthens the period when the amount of security logs is equal to or less than a second reference value;
5. The log management device according to claim 4. the transmission timing determination unit shortens the cycle when the size of the security logs stored in the log storage unit within a predetermined period is equal to or greater than a first reference value, and lengthens the cycle when the number of the security logs stored in the log storage unit within a predetermined period is equal to or less than a second reference value;
5. The log management device according to claim 4. the transmission timing determination unit determines, as the transmission timing, whether or not to transmit the request message simultaneously with the transmission of the security log.
The log management device according to claim 1. the transmission timing determination unit determines whether to transmit the request message simultaneously with transmitting the security log based on the amount of the security log stored in the log storage unit within a predetermined period.
8. The log management device according to claim 7. the transmission timing determination unit determines to transmit the request message simultaneously with transmitting the security log when the volume of the security log is equal to or greater than a first reference value;
9. The log management device according to claim 8. Furthermore, a priority setting unit (110) is provided for setting the priority of the security log based on a predetermined standard,
Among the security logs received by the log receiving unit, the security logs for which a high priority has been set by the priority setting unit are not stored in the log storage unit.
The log management device according to claim 1. The log management device is mounted on a mobile object.
The log management device according to any one of claims 1 to 10. A log management analysis system (1) comprising a log management device (100) that transmits security logs generated by security sensors to a center device (200) and the center device (200),
The log management device (100)
a log receiving unit (101) that receives the security log from the security sensor;
a log storage unit (103) for storing the security log;
a request message generating unit (107) that generates a request message inquiring about the reception status at the center device for all of the security logs stored in the log storage unit;
a transmission timing determination unit (108) that determines a transmission timing that is a timing for transmitting the request message;
a transmitting unit (105) that transmits the security log to the center device and also transmits the request message to the center device at the transmission timing;
a receiving unit (106) for receiving a response message from the center device, the response message being a response to the request message;
a deletion instruction unit (109) that deletes the security log already received by the center device from the log storage unit based on the response message,
The center device (200)
a receiving unit (201) that receives the security log and the request message from the log management device;
a response message generating unit (203) that generates the response message for reporting the reception status of the security log specified in the request message in response to the request message;
a transmission unit (205) that transmits the response message to the log management device,
Log management analysis system (1). A log management method executed by a log management device (100) that transmits a security log generated by a security sensor to a center device (200), comprising:
Receive the security log from the security sensor (S101);
The security log is stored in a log storage unit (S102).
A request message is generated to inquire about the reception status at the center device for all of the security logs stored in the log storage unit (S103).
A transmission timing is determined as a timing for transmitting the request message (S104).
Transmitting the security log to the center device and transmitting the request message to the center device at the transmission timing (S105);
Log management methods. A log management program executable by a log management device (100) that transmits a security log generated by a security sensor to a center device (200),
Receive the security log from the security sensor (S101);
The security log is stored in a log storage unit (S102).
A request message is generated to inquire about the reception status at the center device for all of the security logs stored in the log storage unit (S103).
A transmission timing is determined as a timing for transmitting the request message (S104).
Transmitting the security log to the center device and transmitting the request message to the center device at the transmission timing (S105);
Log management program.