Log management methods and log management systems

Abstract

This invention relates to a log management method and a log management system. Embodiments for reliable, safety-critical system logs are disclosed. In one embodiment, a method includes: obtaining data to be added to a log; creating entries for the data; and adding the entries to a linked sequence of entries in the log, wherein the linked sequence of entries includes a plurality of data entries and a plurality of sentinels intertwined with the plurality of data entries, wherein each data entry in the entry chain is appended to an error detection code calculated for that entry and a previously calculated error detection code or error detection root of the preceding data entry, and each sentinel in the entry chain includes an error detection code calculated for that sentinel and a previously calculated error detection code or error detection root of the preceding data entry, and each sentinel includes a previously calculated and encrypted blockchain value or blockchain root value of the preceding sentinel.

Description

Technical Field

[0001] The following instructions generally relate to protecting the logs of safety-critical systems, and particularly to protecting the logs of safety-critical systems that are constrained by computing power and logging frequency. Background Technology

[0002] An event log is a computer data structure used to record events that occur during system operation to provide a data trail that can be used to understand system activity and diagnose problems. Because logs are important for reconstructing safety incidents in safety-critical systems, it is desirable to ensure that log entries are not tampered with. For example, it is important to maintain verifiable and accurate log entries for autonomous vehicles so that these entries can be used to determine the causes of safety incidents involving autonomous vehicles and pedestrians or other vehicles. Summary of the Invention

[0003] Provides technology for reliable, safety-critical system logs.

[0004] In one embodiment, a method includes: obtaining data to be added to a log; creating entries for the data; and adding the entries to a linked sequence of entries in the log, wherein the linked sequence of entries includes a plurality of data entries and a plurality of sentinels intertwined with the plurality of data entries, wherein each data entry in the entry chain is appended to an error detection code calculated for that entry and a previously calculated error detection code or error detection root of the preceding data entry, and each sentinel in the entry chain includes an error detection code calculated for that sentinel and a previously calculated error detection code or error detection root of the preceding data entry, and each sentinel includes a blockchain root value or a previously calculated and encrypted blockchain value of the preceding sentinel.

[0005] In this embodiment, the error detection code is a Cyclic Redundancy Check (CRC) code.

[0006] In an embodiment, the first entry in the entry chain includes the blockchain root value, and the second entry in the entry chain following the first entry includes the error detection root.

[0007] In an embodiment, the first entry in the entry chain includes the error detection root, and the second entry in the entry chain following the first entry includes the blockchain root value.

[0008] In one embodiment, each sentry also includes identification data indicating that the sentry is a sentry.

[0009] In one embodiment, the sentinel interleaves with the data entries at a specified frequency determined by a timing constraint.

[0010] In one embodiment, the sentinel interleaves with the data entries at a specified frequency determined by the attention window in the log.

[0011] In this embodiment, each encrypted blockchain value is a hash generated by an encryption operation.

[0012] In this embodiment, each data entry and each sentinel includes a timestamp.

[0013] In this embodiment, the data entries include data associated with the autonomous vehicle.

[0014] In one embodiment, the log management system includes: at least one processor; and a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to add entries to a log, the log including a sequence of linked entries, wherein each linked entry in the sequence of linked entries is a data entry or a sentinel, wherein each sentinel includes a cryptographic blockchain value based on a previously computed blockchain value stored in a previous sentinel and a previously computed error detection code stored in a previous data entry, and wherein the error detection code is tracked through sentinels and data entries in the entry chain.

[0015] In an embodiment, when the log is created, the blockchain root value and the error detection root value are written to the log, and an initial sentinel entry is created and written to the log. When a CRC is created for a new log entry for the sentinel entry and the data entry, subsequent entries in the log use the in-memory value of the CRC, and the in-memory blockchain value is used whenever a sentinel entry is written.

[0016] One or more of the disclosed embodiments provide one or more of the following advantages: combining the rate advantage of the linked entry method with the cryptographic advantage of blockchain technology to provide a reliable, verifiable, and accurate security-critical system log, which can be created and maintained by a system constrained by computing power and logging frequency.

[0017] These and other aspects, features, and implementations may be represented as methods, apparatus, systems, components, program products, means, or steps for performing functions, and in other ways.

[0018] These and other aspects, features, and implementations will become apparent from the following description, including the claims. Attached Figure Description

[0019] Figure 1 Examples of autonomous vehicles (AVs) with autonomous capabilities according to one or more embodiments are shown.

[0020] Figure 2 An example "cloud" computing environment is illustrated according to one or more embodiments.

[0021] Figure 3 Examples of computer systems according to one or more embodiments.

[0022] Figure 4 An example architecture of an AV is shown according to one or more embodiments.

[0023] Figure 5 It is a block diagram of a log management system for creating and maintaining reliable safety-critical system logs, according to one or more embodiments.

[0024] Figure 6A Example sequences of entries are illustrated according to one or more embodiments.

[0025] Figure 6B An example of a Cyclic Redundancy Check (CRC) enhanced logging method according to one or more embodiments is provided.

[0026] Figure 6C An example of a CRC enhancement entry method according to one or more embodiments is provided.

[0027] Figure 6D An example of a CRC enhancement log is provided, illustrating a CRC enhancement entry method according to one or more embodiments.

[0028] Figure 6E Examples of CRC linking entry methods according to one or more embodiments.

[0029] Figure 6F An entry blockchain method according to one or more embodiments is illustrated.

[0030] Figure 7 Examples include a combination of a CRC linking entry method and an entry blockchain method according to one or more embodiments.

[0031] Figure 8 This is a flowchart illustrating the process of generating a reliable safety-critical system log that combines a CRC-linked entry method with a blockchain entry method, according to one or more embodiments. Detailed Implementation

[0032] In the following description, numerous specific details are set forth for purposes of explanation in order to provide a thorough understanding of the invention. However, it will be apparent that the invention may be practiced without these specific details. In other instances, well-known constructions and apparatuses are shown in block diagram form to avoid unnecessarily obscuring the invention.

[0033] In the accompanying drawings, for ease of description, a specific arrangement or order of schematic elements (such as those representing devices, modules, instruction blocks, and data elements) is shown. However, those skilled in the art will understand that the specific order or arrangement of schematic elements in the drawings is not intended to imply a requirement for a particular processing order or sequence, or a separation of processing procedures. Furthermore, the inclusion of schematic elements in the drawings is not intended to imply that such elements are required in all embodiments, nor is it intended to imply that features represented by such elements cannot be included in some embodiments or cannot be combined with other elements in some embodiments.

[0034] Furthermore, in the accompanying drawings, connecting elements, such as solid or dashed lines or arrows, are used to illustrate connections, relationships, or associations between two or more other schematic elements. The absence of any such connecting element does not imply that connections, relationships, or associations cannot exist. In other words, connections, relationships, or associations between some elements are not shown in the drawings so as not to obscure the content of this disclosure. Additionally, for ease of illustration, a single connecting element is used to represent multiple connections, relationships, or associations between elements. For example, if a connecting element represents communication of signals, data, or instructions, those skilled in the art will understand that such an element represents one or more signal paths (e.g., a bus) that may be necessary to influence the communication.

[0035] Reference will now be made in detail to embodiments, examples of which are illustrated in the accompanying drawings. Numerous specific details are set forth in the following detailed description in order to provide a thorough understanding of the various embodiments described. However, it will be apparent to those skilled in the art that the various embodiments described can be practiced without these specific details. In other instances, well-known methods, procedures, components, circuits, and networks have not been described in detail so as not to unnecessarily obscure aspects of the embodiments.

[0036] The features described below can each be used independently of each other or in any combination with other features. However, any individual feature may not solve any of the problems discussed above, or may only solve one of the problems discussed above. Some of the problems discussed above may not be adequately solved by any of the features described herein. Although headings are provided, information relating to specific headings but not found in the sections bearing those headings can be found elsewhere in this specification. Embodiments are described herein based on the following summary:

[0037] 1. General Overview

[0038] 2. Overview of Autonomous Vehicle Systems

[0039] 3. Example Cloud Computing Architecture

[0040] 4. Example Computer System

[0041] 5. Example Autonomous Vehicle Architecture

[0042] 6. Sample Log Management System

[0043] 7. Overview of Reliable System Logging Methods

[0044] 8. Reliable safety-critical system logs

[0045] General Overview

[0046] The disclosed embodiments combine the speed advantage of the linked entry method with the security advantage of blockchain technology to ensure verifiable and accurate log data for safety-critical systems with constrained computing power or logging frequency.

[0047] Overview of Autonomous Vehicle Systems

[0048] Figure 1 An example of an autonomous vehicle 100 with autonomous capabilities is shown.

[0049] As used herein, the term “autonomy” refers to a function, feature, or facility that enables a vehicle to operate partially or fully without real-time human intervention, including but not limited to fully autonomous vehicles, highly autonomous vehicles, and conditionally autonomous vehicles.

[0050] As used in this article, an autonomous vehicle (AV) is a vehicle with autonomous capabilities.

[0051] As used in this article, "vehicle" includes any mode of transport for goods or people. Examples include cars, buses, trains, airplanes, drones, trucks, ships, vessels, submersibles, and spacecraft. Driverless cars are an example of vehicles.

[0052] "One or more" includes functions performed by a single element, functions performed by multiple elements, such as in a distributed manner, several functions performed by a single element, several functions performed by several elements, or any combination of the foregoing.

[0053] It will also be understood that, although in some cases the terms “first,” “second,” etc., are used herein to describe various elements, these elements should not be limited by these terms. These terms are used only to distinguish one element from another. For example, without departing from the scope of the various described embodiments, a first contact may be referred to as a second contact, and similarly, a second contact may be referred to as a first contact. Both the first contact and the second contact are contacts, but they are not the same contact.

[0054] The terminology used in the description of the various embodiments described herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used in the description of the various embodiments described and the appended claims, the singular forms “a,” “an,” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that “and / or” as used herein refers to and includes any and all possible combinations of one or more of the relevant list items. It will also be understood that when the terms “comprising,” “including,” “possessing,” and / or “having” are used in this specification, they specifically indicate the presence of the stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0055] As used herein, depending on the context, the term "if" may optionally be understood as meaning "when" or "at that time" or "in response to being determined" or "in response to being detected." Similarly, depending on the context, the phrase "if determined" or "if [the stated condition or event] has been detected" may optionally be understood as meaning "when determined" or "in response to being determined" or "when [the stated condition or event] is detected" or "in response to being detected."

[0056] As used herein, an AV system refers to an AV and an array of hardware, software, stored data, and real-time generated data that support AV operation. In embodiments, the AV system is incorporated within an AV. In embodiments, the AV system is distributed across several locations. For example, some of the software of the AV system is similar to that described below. Figure 3 The cloud computing environment described is implemented on the cloud computing environment 300.

[0057] refer to Figure 1 The AV system 120 enables the AV 100 to operate along a trajectory 198, traversing the environment 190 to a destination 199 (sometimes referred to as the final location), while avoiding objects (e.g., natural obstacles 191, vehicles 193, pedestrians 192, cyclists and other obstacles) and complying with road rules (e.g., operating rules or driving preferences).

[0058] In one embodiment, the AV system 120 includes means 101 for receiving and operating operation commands from a computer processor 146. In another embodiment, the computer processor 146 is referenced below. Figure 3 The processor 304 described is similar. Examples of the device 101 include a steering controller 102, a brake 103, a gear, an accelerator pedal or other acceleration control mechanism, a windshield wiper, a side door lock, a window controller, and a turn indicator.

[0059] In an embodiment, the AV system 120 includes sensors 121 for measuring or inferring attributes of the state or condition of the AV 100, such as the AV's position, linear velocity and linear acceleration, angular velocity and angular acceleration, and heading (e.g., the direction of the front of the AV 100). Examples of sensors 121 are GNSS, inertial measurement units (IMUs) that measure both linear acceleration and angular rate of the vehicle, wheel rate sensors for measuring or estimating wheel slip ratio, wheel braking pressure or braking torque sensors, engine torque or wheel torque sensors, and steering angle and angular rate sensors.

[0060] In an embodiment, sensor 121 also includes sensors for sensing or measuring properties of the AV's environment. Examples include a monocular or stereo camera 122 with visible, infrared, or thermal (or both) spectra, a LiDAR 123, a RADAR, an ultrasonic sensor, a time-of-flight (TOF) depth sensor, a rate sensor, a temperature sensor, a humidity sensor, and a precipitation sensor.

[0061] In one embodiment, the AV system 120 includes a data storage unit 142 and a memory 144 for storing machine instructions associated with a computer processor 146 or data collected by the sensor 121. In another embodiment, the data storage unit 142 is associated with the following... Figure 3 The described ROM 308 or storage device 310 is similar. In this embodiment, memory 144 is similar to main memory 306 described below. In this embodiment, data storage unit 142 and memory 144 store historical, real-time, and / or predictive information about environment 190. In this embodiment, the stored information includes maps, driving performance, traffic congestion updates, or weather conditions. In this embodiment, data related to environment 190 is transmitted from remote database 134 to AV 100 via a communication channel.

[0062] In an embodiment, AV system 120 includes communication devices 140 for transmitting measured or inferred attributes of the state and conditions of other vehicles, such as position, linear velocity and angular velocity, linear acceleration and angular acceleration, and linear heading and angular heading, to AV 100. These devices include vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication devices, as well as devices for wireless communication via point-to-point or ad hoc networks, or both. In an embodiment, communication device 140 communicates across the electromagnetic spectrum (including radio and optical communications) or other media (e.g., air and acoustic media). Combinations of vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I) communication (and in some embodiments, one or more other types of communication) are sometimes referred to as vehicle-to-all-things (V2X) communication. V2X communication typically conforms to one or more communication standards for communication with and between autonomous vehicles.

[0063] In an embodiment, the communication device 140 includes a communication interface. For example, this may be a wired, wireless, WiMAX, Wi-Fi, Bluetooth, satellite, cellular, optical, near-field, infrared, or radio interface. The communication interface transmits data from a remote database 134 to the AV system 120. In an embodiment, the remote database 134 is embedded in, for example... Figure 2 In the cloud computing environment 200 described herein, communication interface 140 transmits data collected from sensor 121 or other data related to the operation of AV 100 to remote database 134. In some embodiments, communication interface 140 transmits information related to teleoperation to AV 100. In some embodiments, AV 100 communicates with other remote (e.g., "cloud") servers 136.

[0064] In this embodiment, the remote database 134 also stores and transmits digital data (e.g., data such as road and street locations). This data is stored in memory 144 on the AV 100 or transmitted from the remote database 134 to the AV 100 via a communication channel.

[0065] In one embodiment, the remote database 134 stores and transmits historical information (e.g., rate and acceleration distribution) related to driving attributes of vehicles that previously traveled along trajectory 198 at similar times of day. In one implementation, such data may be stored in memory 144 on the AV 100 or transmitted from the remote database 134 to the AV 100 via a communication channel.

[0066] The computing device 146 located on AV 100 generates control actions in an algorithmic manner based on both real-time sensor data and prior information, allowing AV system 120 to perform its autonomous driving capabilities.

[0067] In one embodiment, the AV system 120 includes a computer peripheral device 132 coupled to a computing device 146 for providing information and alerts to a user of the AV 100 (e.g., an occupant or a remote user) and receiving input from that user. In another embodiment, the peripheral device 132 is similar to the one described in the following reference. Figure 3 The discussed display 312, input device 314, and cursor controller 316 are coupled wirelessly or wiredly. Any two or more interface devices can be integrated into a single device.

[0068] Example cloud computing environment

[0069] Figure 2 Example of a "cloud" computing environment. Cloud computing is a service delivery model that enables convenient, on-demand access over a network to a shared pool of configurable computing resources, such as networks, network bandwidth, servers, processing power, memory, storage, applications, virtual machines, and services. In a typical cloud computing system, one or more large cloud data centers house the machines used to deliver the services provided by the cloud. Now refer to... Figure 2 The cloud computing environment 200 includes cloud data centers 204a, 204b, and 204c interconnected via cloud 202. Data centers 204a, 204b, and 204c provide cloud computing services to computer systems 206a, 206b, 206c, 206d, 206e, and 206f connected to cloud 202.

[0070] A cloud computing environment 200 includes one or more cloud data centers. Generally, a cloud data center (e.g.) Figure 2 The cloud data center 204a shown refers to the cloud (e.g., Figure 2 The physical arrangement of servers in cloud 202 (or a specific portion of the cloud) is illustrated. For example, servers are physically arranged in rooms, groups, rows, and racks within a cloud data center. A cloud data center has one or more regions, each containing one or more server rooms. Each room has one or more rows of servers, and each row includes one or more racks. Each rack includes one or more individual server nodes. In some implementations, servers in regions, rooms, racks, and / or rows are arranged into groups based on the physical infrastructure requirements of the data center facility, including power, energy, heat, heat sources, and / or other requirements. In this embodiment, server nodes are similar to... Figure 3 The computer system described herein. Data center 204a has many computing systems distributed across multiple racks.

[0071] Cloud 202 includes cloud data centers 204a, 204b, and 204c, and networks and network resources (e.g., network devices, nodes, routers, switches, and network cables) for connecting cloud data centers 204a, 204b, and 204c and facilitating access to cloud computing services by computing systems 206a-f. In embodiments, the network represents one or more local area networks, wide area networks, or any combination of wired or wireless networks coupled using terrestrial or satellite connections. Data exchanged over the network is transmitted using various network layer protocols, such as Internet Protocol (IP), Multiprotocol Label Switching (MPLS), Asynchronous Transfer Mode (ATM), Frame Relay, etc. Furthermore, in embodiments where the network represents a combination of multiple subnetworks, different network layer protocols are used on the various underlying subnetworks. In some embodiments, the network represents one or more interconnected internetworks (such as the public Internet).

[0072] The computing system 206a-f or cloud computing service consumer connects to the cloud 202 via a network link and a network adapter. In embodiments, the computing system 206a-f is implemented as various computing devices, such as servers, desktops, laptops, tablets, smartphones, Internet of Things (IoT) devices, autonomous vehicles (including cars, drones, space shuttles, trains, buses, etc.), and consumer electronics. In embodiments, the computing system 206a-f is implemented in other systems or as part of other systems.

[0073] Example computer system

[0074] Figure 3 Example: Computer system 300. In implementation, computer system 300 is a dedicated computing device. The dedicated computing device is hardwired to perform these technologies, or includes a digital electronic device such as one or more application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs) that is persistently programmed to perform the aforementioned technologies, or may include one or more general-purpose hardware processors programmed to perform these technologies according to program instructions in firmware, memory, other memory, or a combination thereof. Such a dedicated computing device may also combine custom hardwired logic, ASICs, or FPGAs with custom programming to accomplish these technologies. In various embodiments, the dedicated computing device is a desktop computer system, a portable computer system, a handheld device, a network device, or any other device that includes hardwired and / or program logic to implement these technologies.

[0075] In an embodiment, computer system 300 includes a bus 302 or other communication mechanism for conveying information, and a hardware processor 304 coupled to the bus 302 to process information. The hardware processor 304 is, for example, a general-purpose microprocessor. Computer system 300 also includes main memory 306, such as random access memory (RAM) or other dynamic storage device, coupled to the bus 302 to store information and instructions executed by processor 304. In one implementation, main memory 306 is used to store temporary variables or other intermediate information during the execution of instructions to be executed by processor 304. When these instructions are stored in a non-transitory storage medium accessible to processor 304, computer system 300 becomes a dedicated machine customized to perform the operations specified in the instructions.

[0076] In an embodiment, the computer system 300 further includes a read-only memory (ROM) 308 or other static storage device coupled to the bus 302 for storing static information and instructions of the processor 304. A storage device 310, such as a disk, optical disk, solid-state drive, or three-dimensional cross-point memory, is provided and coupled to the bus 302 to store information and instructions.

[0077] In this embodiment, the computer system 300 is coupled via a bus 302 to a display 312, such as a cathode ray tube (CRT), liquid crystal display (LCD), plasma display, light-emitting diode (LED) display, or an organic light-emitting diode (OLED) display for displaying information to a computer user. An input device 314, including alphanumeric keys and other keys, is coupled to the bus 302 for transmitting information and command selections to the processor 304. Another type of user input device is a cursor controller 316, such as a mouse, trackball, touchscreen, or cursor arrow keys, for transmitting directional information and command selections to the processor 304 and for controlling the movement of the cursor on the display 312. Such input devices typically have two degrees of freedom on two axes (a first axis (e.g., the x-axis) and a second axis (e.g., the y-axis)), which allow the device to specify a position in a plane.

[0078] According to one embodiment, the techniques described herein are executed by computer system 300 in response to processor 304 executing one or more sequences of one or more instructions contained in main memory 306. These instructions are read into main memory 306 from another storage medium, such as storage device 310. Executing the sequence of instructions contained in main memory 306 causes processor 304 to perform the process steps described herein. In alternative embodiments, hardwired circuitry is used instead of or in combination with software instructions.

[0079] As used herein, the term "storage medium" refers to any non-transitory medium that stores data and / or instructions that enable a machine to operate in a particular manner. Such storage media include non-volatile media and / or volatile media. Non-volatile media include, for example, optical discs, magnetic disks, solid-state drives, or three-dimensional cross-point memory such as storage device 310. Volatile media include dynamic memory, such as main memory 306. Common forms of storage media include, for example, floppy disks, floppy disks, hard disks, solid-state drives, magnetic tape or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with perforations, RAM, PROMs and EPROMs, FLASH-EPROMs, NV-RAMs, or any other memory chips or memory cartridges.

[0080] Storage media differ from transmission media, but can be used in conjunction with them. Transmission media participate in the information transmission between storage media. For example, transmission media include coaxial cables, copper wires, and optical fibers, which include wires with a bus 302. Transmission media can also take the form of sound waves or light waves, such as those generated during radio wave and infrared data communication.

[0081] In embodiments, various forms of media involve carrying one or more sequences of one or more instructions to processor 304 for execution. For example, these instructions may initially be executed on a disk or solid-state drive of a remote computer. The remote computer loads the instructions into its dynamic memory and transmits them over a telephone line using a modem. A local modem of computer system 300 receives data over the telephone line and converts the data into an infrared signal using an infrared transmitter. An infrared detector receives the data carried in the infrared signal, and appropriate circuitry places the data on bus 302. Bus 302 carries the data to main memory 306, from which processor 304 retrieves and executes the instructions. The instructions received by main memory 306 may optionally be stored on storage device 310 before or after execution by processor 304.

[0082] Computer system 300 also includes a communication interface 318 coupled to bus 302. Communication interface 318 provides bidirectional data communication coupled to network link 320 connected to local network 322. For example, communication interface 318 is an Integrated Services Digital Network (ISDN) card, a cable modem, a satellite modem, or a modem used to provide data communication connectivity with a corresponding type of telephone line. As another example, communication interface 318 is a Local Area Network (LAN) card used to provide data communication connectivity with a compatible LAN. In some implementations, a wireless link is also implemented. In any such implementation, communication interface 318 transmits and receives electrical, electromagnetic, or optical signals carrying digital data streams representing various types of information.

[0083] Network link 320 typically provides data communication to other data devices via one or more networks. For example, network link 320 provides connectivity to host computer 324 or to a cloud data center or device operated by Internet Service Provider (ISP) 326 via local network 322. ISP 326, in turn, provides data communication services via a global data communication network now commonly referred to as the “Internet” 328. Both local network 322 and Internet 328 use electrical, electromagnetic, or optical signals that carry digital data streams. Signals through various networks and signals on network link 320 via communication interface 318 are example forms of transmission media carrying digital data entering and leaving computer system 300. In embodiments, network 320 includes the aforementioned cloud 202 or a portion of cloud 202.

[0084] Computer system 300 sends messages and receives data including program code through one or more networks, network links 320, and communication interfaces 318. In an embodiment, computer system 300 receives code for processing. The received code is executed by processor 304 upon receipt and / or stored in storage device 310, or in other non-volatile storage devices for later execution.

[0085] Example Autonomous Vehicle Architecture

[0086] Figure 4 This illustrates the use of autonomous vehicles (e.g., Figure 1 The example architecture 400 of the AV 100 shown is illustrated. Architecture 400 includes a sensing module 402 (sometimes called a sensing circuit), a planning module 404 (sometimes called a planning circuit), a control module 406 (sometimes called a control circuit), a positioning module 408 (sometimes called a positioning circuit), and a database module 410 (sometimes called a database circuit). Each module plays a role in the operation of the AV 100. Commonly, modules 402, 404, 406, 408, and 410 can be... Figure 1 This is part of the AV system 120 shown. In some embodiments, any of modules 402, 404, 406, 408, and 410 is a combination of computer software (e.g., executable code stored on a computer-readable medium) and computer hardware (e.g., one or more microprocessors, microcontrollers, application-specific integrated circuits (ASICs), hardware memory devices, other types of integrated circuits, other types of computer hardware, or any or all combinations of these hardware).

[0087] In use, the planning module 404 receives data representing the destination 412 and determines data representing the trajectory 414 (sometimes called the route) that the AV 100 can travel to reach (e.g., arrive at) the destination 412. In order for the planning module 404 to determine the data representing the trajectory 414, the planning module 404 receives data from the sensing module 402, the positioning module 408, and the database module 410.

[0088] The sensing module 402 is used, for example, as follows Figure 1 One or more sensors 121 are shown to identify nearby physical objects. The objects are classified (e.g., grouped into types such as pedestrians, bicycles, cars, traffic signs, etc.), and a scene description including the classified objects 416 is provided to the planning module 404.

[0089] The planning module 404 also receives data representing the location 418 of the AV from the positioning module 408. The positioning module 408 determines the location of the AV by using data from the sensor 121 and data (e.g., geographic data) from the database module 410. For example, the positioning module 408 uses data from GNSS (Global Navigation Satellite System) sensors and geographic data to calculate the longitude and latitude of the AV. In embodiments, the data used by the positioning module 408 includes high-precision maps with lane geometry properties, maps describing road network connectivity properties, maps describing lane physical properties (such as traffic speed, traffic volume, number of vehicle and bicycle lanes, lane width, lane traffic direction, or lane marking type and location, or combinations thereof), and maps describing spatial locations of road features (such as intersections, traffic signs, or various types of other traffic signals).

[0090] The control module 406 receives data representing trajectory 414 and data representing AV position 418, and operates the AV's control functions 420a-420c (e.g., steering, throttle, braking, ignition) in a manner that will cause the AV 100 to travel along trajectory 414 to reach destination 412. For example, if trajectory 414 includes a left turn, the control module 406 will operate the control functions 420a-420c in such a way that the steering angle of the steering function will cause the AV 100 to turn left, and the throttle and brake will cause the AV 100 to pause before turning and wait for passing pedestrians or vehicles.

[0091] Example Log Management System

[0092] Figure 5This is a block diagram of a log management system 500 for creating and maintaining reliable safety-critical system logs according to one or more embodiments. System 500 includes an ingestion engine 501, a log analysis engine 502, a linked entry generator 503, a search and reporting system 504, and a time source 507. System 500 generates linked entries 506-1 to 506-N. System 500 can be used in any system that needs to generate reliable safety-critical system logs and is constrained by computing power or log recording frequency. In embodiments, system 500 can be centralized or distributed. In embodiments, system 500 is used by AV system 120 and / or AV 100. For example, reliable safety-critical system logs can be stored in database 134 (…). Figure 1 (1) storage device 310 of computer system 300, cloud data center 204a or sensor database 410 or one thereof.

[0093] The types of log data that can be stored include data generated by sensor 121, sensing module 402, planning module 404, control module 406, positioning module 408, or any other output from the AV software stack or hardware components of AV 100 and / or AV system 120. System log data may also include data received from data sources external to AV 100, such as weather and traffic conditions, or data provided by other vehicles or infrastructure.

[0094] refer to Figure 5 The ingestion engine 501 is responsible for receiving and / or collecting data to be logged from various data sources. In embodiments, the ingestion engine 501 is configured to receive or collect event log data sent from various data sources in AV 100. For example, data streams from sensors (e.g., optical, LiDAR, RADAR, SONAR) and AV software stacks (such as from modules 402, 404, 406, 408, etc.) can be received or collected by the ingestion engine 501. Data streams can be obtained, for example, from a Controller Area Network (CAN) bus, a CAN Flexible Data Rate (CAN-FD) bus, and / or from a vehicle Ethernet. Log entries can be plain text, binary data, or a combination of both. Each entry is described in such a way that it is allowed to be separated from adjacent entries in the entry sequence. It is assumed that each entry includes a timestamp provided by time source 507. It is assumed that the timestamp has a resolution that is meaningful in the context of the logging frequency. To aid the reader in understanding the appended embodiments, several reliable system logging methods and their inherent advantages and disadvantages are described below.

[0095] The log analysis engine 502 can be implemented using one or more computers (e.g., computer system 300) with a graphical user interface (GUI) and / or command line, which allows data analysts to query specific log entries using the search and reporting engine 504. The log analysis engine 502 performs various types of log analysis for use by data analysts, including analyses related to data security and integrity.

[0096] Link entry generator 503 uses blockchain technology to create link entries, as shown in the reference. Figures 6A-6F , Figure 7 and Figure 8 Further detailed description.

[0097] Overview of Reliable System Logging Methods

[0098] Figure 6A An example of a log 600 according to one or more embodiments is illustrated. One purpose of log files within a system is to provide a record of events that lead to an accident. For example, in an AV, an accident might be a collision between the AV and a pedestrian or other vehicle. Determining that the log file has not been altered is critical, thereby making it difficult to determine the actual event that caused the accident. In some embodiments, no protection measures are provided to prevent tampering. In the illustrated example, log 600 comprises a continuous sequence of “n” entries (E1…En). Suppose that the log management system 500 is constrained such that the computational power of the encryption unit used to perform encryption operations on the log data in a timely manner (such as encrypting individual log entries or decrypting and reencrypting the entire log file when a new entry is added) is insufficient to match the required logging frequency of the system.

[0099] Cyclic Redundancy Check (CRC) Enhanced Logging Method

[0100] Figure 6B An illustrative example of a cyclic redundancy check (CRC) enhanced logging method is presented according to one or more embodiments. The overall integrity of the log can be established using CRC. CRC is an error detection code commonly used in digital networks and storage devices to detect unintended alterations to the original data. The CRC enhancement method calculates a short, fixed-length binary sequence (hereinafter also referred to as "CRC") to form a codeword for log 600. When the log management system 500 reads the codeword, it compares the CRC of the codeword with a new CRC calculated based on the entries in log 600, or performs a CRC on the entire codeword and compares the resulting CRC with the expected residual constant. If the CRC does not match, it is assumed that log 600 contains data errors. The log management system 500 can then take corrective actions, such as rereading log 600. Otherwise, it is assumed that log 600 is error-free, where the probability that the log may contain undetected errors inherent in the CRC method is small.

[0101] CRC enhanced logging is Figure 6B For example, each time a new entry is added to log 600, a single CRC (“CRC”) for the entire log is updated. To reflect the possibility that logging may be interrupted due to an accident, the log CRC is located at the beginning of log 600. After a new entry is appended to log 600, the log CRC is updated. Note that while unintentional corruption can be detected by the log CRC, intentional alterations to both the contents of the entries (E1…En) and the log CRC cannot be detected.

[0102] In summary, the CRC-enhanced logging method has negligible additional computational costs and does not provide detection of unintentional or intentional damage to individual log entries.

[0103] CRC Enhanced Entry Method

[0104] Figure 6C An example of a CRC enhancement entry method according to one or more embodiments is illustrated. Instead of using a single CRC to enhance log 600, each entry in log 600 is enhanced with its own entry CRC. In the example shown, entry E1 is enhanced with a CRC1 calculated based on data entry E1.

[0105] While the CRC-enhanced entry method can detect corruption of entry content, this comes at the cost of increasing the log size by multiplying the number of entries by the size of the CRC codeword. Furthermore, the CRC-enhanced entry method does not detect intentional data insertion or deletion of entries. Therefore, the CRC-enhanced entry method has low additional computational cost and prevents unintentional corruption of entries, but it does not prevent intentional corruption of entries.

[0106] CRC Enhancement Log of CRC Enhancement Entry Method

[0107] Figure 6D An example of a CRC enhancement log is provided, illustrating a CRC enhancement entry method according to one or more embodiments. The log CRC is located at the beginning of log 600, and entry CRCs are appended to each entry in log 600. In the example shown, the first enhancement entry (AE1) includes entry data E1 and CRC1. Each subsequent entry (E2…En) also has a corresponding CRC value (CRC2…CRCn).

[0108] Combining the CRC-enhanced logging method with the CRC-enhanced entry method allows for the detection of trivial insertions or deletions in Log 600. However, no deliberate manipulation of the data and / or CRC was detected.

[0109] CRC Linked Entry Method

[0110] Figure 6EAn illustrative method for linking CRC entries according to one or more embodiments is given. Using this method, log 600 includes CRC linked entries (CE1…CEn), wherein the CRC of each entry (C1…Cn) is linked to the CRC of its preceding entry as the first element in the CRC calculation of the current entry. In the example shown, an arbitrary root CRC (C0) is located at the beginning of log 600 and linked to C1 of entry CE1. Similarly, C1 is linked to C2 of CE2, and so on.

[0111] The cost of the CRC entry chaining method is similar to that of the CRC enhanced log method, but it provides better tamper / corruption detection because it updates the CRC of all entries after inserting a new entry or deleting an existing one.

[0112] Entry Blockchain Method

[0113] Figure 6F This section illustrates an entry-based blockchain method according to one or more embodiments. Generally, a blockchain is a continuously growing list of records called blocks, linked together using cryptography. Each block contains a cryptographic hash, timestamp, and transaction data (referred to herein as a blockchain value) of previous blocks in the blockchain. By design, a blockchain is resistant to modification of the data; it efficiently and verifiably records transactions between parties in a permanent manner. When used in distributed ledger applications, a blockchain is managed by a peer-to-peer (P2P) network of nodes that collectively adhere to protocols for inter-node communication and verification of new blocks. Once recorded, transaction data in any given block cannot be retroactively altered without changing all subsequent blocks in the blockchain, which requires consensus from a majority of the P2P network nodes in distributed ledger applications.

[0114] For the reliable, security-critical system log application described in this paper, a proposal is made to integrate the cryptographic aspects of blockchain technology (without using a P2P network for new entry verification) with the aspects discussed above. Figure 6E The described CRC-linked entry method is combined to eliminate the possibility of log rewriting after entries are inserted or deleted from the log entry sequence. In logging applications (such as AV's system event logs), P2P network node authentication would be impractical in systems constrained by computing power or log recording frequency.

[0115] Figure 6F The illustrated blockchain method is used in conjunction with Figure 6EThe illustrated method of linking CRC entries operates in a largely similar manner. However, adding encrypted blockchain values ​​provides a more reliable mechanism that cannot be replicated without the information stored in the encrypted unit. In the example shown, B0 is the blockchain root value starting at log 600, and the blockchain entries (BE1…BEn) include their respective data entries (E1…En) and encrypted blockchain values ​​(B1…Bn). The blockchain root value B0 is linked to the blockchain value B1 in BE1, B1 is linked to B2 in BE2, and so on. In this embodiment, each blockchain value is a hash generated by a cryptographic operation (e.g., a message digest). The blockchain entries also include a timestamp and an optional digital signature to authenticate the data source of the entry.

[0116] The entry-based blockchain approach prevents both unintentional and intentional corruption, but incurs high additional computational costs due to the complexity of the cryptographic operations. Because of this high computational cost, it is impossible to guarantee timely addition of entries to the log for systems constrained by log recording frequency (such as AV log systems).

[0117] Reliable safety-critical system logs

[0118] Figure 7 This is a flowchart of a reliable, safety-critical system logging method, which will refer to... Figure 6E and 6F The described CRC-linked entry method is combined with the entry blockchain method. Example log 700 is shown as having [something] based on [something]. Figure 7 The entries are filled with line patterns as shown in the illustration.

[0119] Referring to the beginning of Log 700 (the leftmost entry in the sequence), Log 700 begins with the blockchain root block (B0), followed by the CRC root (C0), as previously referenced. Figure 6E and 6FAs described. In other embodiments, B0 may appear before C0 in the sequence of entries of log 700. Log 700 also includes link CRC entries (CE1…CEn) and link sentinels (BCS1…BCS1m) interleaved between the link CRC entries in log 700. Hereinafter, the link CRC entries (CE1…CEn) will also be referred to as "data entries" to distinguish them from the link sentinel entries (BCS1…BCS1m). Note that the subscripts n and m are positive integers, which respectively represent the number of data log entries and sentinel entries in log 700, where m < n. The frequency of the sentinels in log 700 is determined by the timing constraints of the system being logged and the actual window of interest within the log. The actual window of interest may be based on the data rate available for detecting system events (e.g., sensor data rate) and / or the accident time window. For example, the logging frequency should ensure that important events that may be used in reconstructing an accident are captured in the log entries. In an embodiment, each sentinel includes identification data (e.g., arbitrary data) for indicating that the entry is a sentinel (Ss1…Ssm), a CRC entry (Cs1…Csm), and an encrypted blockchain value (Bs1…Bsm). Each sentinel includes a CRC and is chained together, where each sentinel blockchain value (Bs1…Bsm) is linked to the previous blockchain value stored in the previous sentinel. The CRC entries (Cs1…Csm) are linked through the sentinels and the data log entries (i.e., non-sentinel entries). In this way, the sentinels are anchored within the sequence of entries in log 700.

[0120] Note that the difference between the Cs# and C# elements is only symbolic. Both are CRCs and are calculated in the same way. In operation, the logging system will maintain a set of up-to-date blockchain values and CRC values in memory. These values will then be used when creating the next entry to be written to the log, whether it is a sentinel or data. These values originate from B0 and C0, where B0 is typically linked to the trust root of the device and C0 is randomly generated.

[0121] When creating the log, the B0 and C0 blocks are written to the log, and the initial sentinel entry (BCS1) is created and written. When creating the CRC for a new entry, the subsequent entry will use the in-memory value of the CRC. This is the case for both sentinel entries and data entries. Whenever a sentinel entry is written, the in-memory blockchain value will also be used.

[0122] Normally, when a log file is created, the logging system itself writes an entry (log file creation). However, this is not mandatory. Thus, there can be another sentinel after the initial one, without any intermediate data entries. This is also true for any point in the log. This may indicate a sentinel cadence with a higher resolution than the input log data.

[0123] Sentinels only need to be written to at the shortest possible granularity. In other words, if data is analyzed in blocks of X seconds, then setting up sentinels every X / 2 seconds would be of no benefit.

[0124] Referring again to the beginning of log 700, after B0 and C0 is the first sentinel entry (BCS1). BCS1 includes Ss1, Cs1, and Bs1. Cs1 links to C0, and Bs1 links to B0. Following BCS1 is the link entry CE1, which includes data log entries E1 and C1. C1 links to C2 in link entry CE2, C2 links to C3 in CE3, and so on, until the next sentinel in the entry sequence, BCS2. Bs1 in BCS1 links to B0 and Bs2 in BCS2, and so on.

[0125] The combined CRC-linked entries and entry blockchain method described above offers the advantage of preventing unintentional and intentional damage to entries, and has a lower computational cost than the entry blockchain method. These advantages make... Figure 7 The embodiments are suitable for safety-critical systems constrained by computing power and logging frequency, such as event logging systems for AV.

[0126] Figure 8 This is a flowchart of a process 800 for generating reliable safety-critical system logs according to one or more embodiments. References may be used, for example... Figure 3 The computer system 300 described implements process 800.

[0127] Process 800 begins by obtaining log data (801) to be stored in a log file using at least one processor. For example, a log management system (see...) Figure 5 The ingestion engine can be configured to receive or collect event log data sent from various data sources. For example, for an AV logging system, the data stream can originate from sensors (e.g., cameras, LiDAR, RADAR, SONAR) and the AV software stack (such as those from reference sensors). Figure 4 The modules described (402, 404, 406, 408, etc.) are provided. Data streams can be obtained, for example, from a Controller Area Network (CAN) bus, a CAN Flexible Data Rate (CAN-FD) bus, and / or from a vehicle Ethernet network.

[0128] Process 800 continues by creating data log entries (802) for the log data using at least one processor. For example, a log entry may be a data structure that includes log data, a timestamp, and an error correction code (such as a CRC codeword).

[0129] Process 800 continues by adding data log entries to the log entry blockchain in the log file using at least one processor (803). In an embodiment, the linked entry sequence includes a plurality of data entries and a plurality of sentinels intertwined with the plurality of data entries, wherein each data entry in the entry chain is appended to an error detection code calculated for that entry and a previously calculated error detection code or error detection root of the preceding data entry, and each sentinel in the entry chain includes an error detection code calculated for that sentinel and a previously calculated error detection code or error detection root of the preceding data entry, and each sentinel includes a previously calculated and encrypted blockchain value or blockchain root value of the preceding sentinel.

[0130] In the preceding description, embodiments of the invention have been described with reference to numerous specific details, which may vary from implementation to implementation. Therefore, the specification and drawings should be considered illustrative rather than restrictive. The sole and exclusive indication of the scope of the invention, and what the applicant expects to be the scope of the invention, is the literal and equivalent scope of the claims published from this application in the specific form of the claims, including any subsequent amendments. Any definitions of terms expressly set forth herein for inclusion in such claims should be taken as meaning as such terms are used in the claims. Furthermore, when the term “comprising” is used in the preceding specification or appended claims, what follows that phrase may be an additional step or entity, or a sub-step / sub-entity of a previously stated step or entity.

Claims

1. A log management method, comprising: Using at least one processor of a log system to obtain data to be added to the log; Using the at least one processor to create an entry for the data; And Using the at least one processor to add the entry to a linked entry sequence in the log, wherein the linked entry sequence includes a plurality of data entries and a plurality of sentinels interleaved with the plurality of data entries, wherein each data entry in the linked entry sequence is appended with an error detection code calculated for that entry and a previously calculated error detection code of the previous data entry, and each sentinel in the linked entry sequence includes an error detection code calculated for that sentinel, a previously calculated error detection code of the previous data entry, and a blockchain root value or a previously calculated and encrypted blockchain value of the previous sentinel, wherein the error detection code is tracked through the sentinels and data entries in the linked entry sequence.

2. The method according to claim 1, wherein The error detection code is a cyclic redundancy check code, i.e., a CRC code.

3. The method according to claim 1, wherein The first entry in the linked entry sequence includes the blockchain root value, and the second entry after the first entry in the linked entry sequence includes an error detection root.

4. The method according to claim 1, wherein The first entry in the linked entry sequence includes an error detection root, and the second entry after the first entry in the linked entry sequence includes the blockchain root value.

5. The method according to claim 1, wherein Each sentinel further includes identification data indicating that the sentinel is a sentinel.

6. The method according to claim 1, wherein The sentinels are interleaved with the data entries at a specified frequency determined by a timing constraint.

7. The method according to claim 1, wherein The sentinels are interleaved with the data entries at a specified frequency determined by a window of interest within the log.

8. The method according to claim 1, wherein Each encrypted blockchain value is a hash generated by an encryption operation.

9. The method according to claim 1, wherein Each data entry and each sentinel include a timestamp.

10. The method according to claim 1, wherein, The data entries include data associated with an autonomous vehicle.

11. A log management system, comprising: At least one processor; And A memory storing instructions that, when executed by the at least one processor, cause the at least one processor to add entries to a log, the log including a linked entry sequence, wherein the linked entry sequence includes a plurality of data entries and a plurality of sentinels interleaved with the plurality of data entries, wherein each sentinel in the linked entry sequence includes an error detection code calculated for that sentinel, a previously calculated error detection code of the previous data entry, and a previously calculated and encrypted blockchain value of the previous sentinel, wherein the error detection code is tracked through the sentinels and data entries in the linked entry sequence.

12. The system according to claim 11, wherein, The error detection code is a cyclic redundancy check code, i.e., a CRC code.

13. The system according to claim 11, wherein, The first two values in the log are respectively a blockchain root value B0 and an error detection root value C0, or the first two values in the log are respectively an error detection root value C0 and a blockchain root value B0.

14. The system according to claim 11, wherein, When creating the log, the blockchain root value B0 and the error detection root value C0 are written into the log, and an initial sentinel entry BCS1 is created and written into the log. For subsequent entries in the log when creating CRCs for new log entries of sentinel entries and data entries, the in-memory value of the CRC is used, and whenever a sentinel entry is written, the in-memory blockchain value is used.

15. The system according to claim 11, wherein The first entry in the sequence of linked entries is a sentinel entry and includes an error detection root value and a blockchain root value.

16. The system according to claim 11, wherein Each sentinel also includes identification data indicating that it is a sentinel.

17. The system according to claim 11, wherein The sentinels are interleaved with the data entries at a specified frequency determined by a timing constraint.

18. The system according to claim 11, wherein, The sentinels are interleaved with the data entries at a specified frequency determined by a window of interest within the log.

19. The system according to claim 11, wherein, Each encrypted blockchain value is a hash generated by an encryption operation.

20. The system according to claim 11, wherein Each data entry and each sentinel include a timestamp.

21. The system according to claim 11, wherein, The data entries include data associated with an autonomous vehicle.

22. A computer program product comprising a program that causes a computer to perform the method according to any one of claims 1 to 10.

Images