A security monitoring log collection device and storage medium based on cloud modular management

Abstract

The present invention proposes a security monitoring log collection device and storage medium based on cloud modular management. The device sets the security monitoring log collection device independently from the vehicle-mounted system, independently carries a log collection and upload system, and sets a vehicle-side log policy management component, a log collection component, a log landing component and a log reporting component in the device. Through the joint work of each component, the user is allowed to remotely and dynamically configure and manage the log collection strategy, support the dynamic expansion of collection function items, support the dynamic switching of reporting addresses, and prevent log loss due to cloud service failure.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a security monitoring log collection device and storage medium based on cloud modular management. Background Art

[0002] In the field of automotive electronics and intelligence, in order to solve the problem of vehicle data security and achieve efficient network security protection, existing technologies or methods achieve this goal by establishing a vehicle-side security monitoring log collection system. These systems are designed to record key information such as vehicle operating status, abnormal events, and user behavior, which are important for quickly locating the cause of faults, discovering potential security threats, and providing a basis for post-audit. Therefore, flexible log collection management has become increasingly important in system operation and maintenance and fault diagnosis.

[0003] Existing vehicle-side log collection systems usually include data collection, anomaly detection, log recording and storage, data transmission, analysis and reporting, aiming to fully ensure the security and availability of vehicle data.

[0004] Traditional vehicle log collection devices usually use fixed demand configuration to collect data, which is not flexible enough and difficult to adapt to a variety of vehicle models, especially when the collection requirements need to be customized for different vehicle models. Therefore, a more flexible, efficient and secure log collection solution is needed to meet the diverse data collection requirements of modern vehicles.

[0005] Given that existing security monitoring log collection devices usually rely on traditional, fixed configuration methods, this leads to problems such as insufficient flexibility in data collection, inefficient resource utilization, and difficulty in adapting to rapidly changing needs. Especially for vehicle-mounted systems, these limitations may affect the efficiency and security of data processing.

[0006] Moreover, since the current log upload system usually relies on the vehicle-side system and is a working module of the vehicle-side system, and is a program uniformly edited during the development of the vehicle-mounted system, the log upload process cannot be controlled by any user independently and has poor autonomy. At the same time, the device related to the log upload cannot be handled independently and is part of the vehicle-side system, so corresponding processing cannot be performed on the individual component.

[0007] In order to solve the above technical problems, the present invention proposes a security monitoring log collection device based on cloud-based modular management. The device is designed to control the log collection device on the vehicle side by issuing log management policy configuration from the cloud, so as to have the following characteristics: dynamic enable or disable control of collection function items, unified log reporting format, flexible expansion capability and secure storage and reporting mechanism. These characteristics can significantly improve the efficiency and security of vehicle-mounted data collection and processing, and better meet the needs of modern vehicle intelligent management. At the same time, the log collection and upload processes can be managed separately, and the hardware carried by the log collection and upload processes can be applied independently of the vehicle side, which can make the log collection process more flexible, the log management strategy is widely used, and a log management network can be established independently of the Internet of Vehicles. Summary of the invention

[0008] The present invention proposes a cloud-based modular security monitoring log collection device and storage medium, which aims to achieve effective collection, storage and transmission of log data by unified management of log collection strategies in the cloud, thereby improving the scalability, operation and maintenance efficiency and security of the system. The device and method support flexible log collection strategy configuration, log blacklist filtering, various reporting strategies, maximum log storage capacity limit, data compression options, dynamic selection of cloud service addresses, deduplication mechanism and encryption measures, etc., to ensure that log management is both efficient and secure, while complying with the latest security management standards.

[0009] To achieve the above object, the present invention provides a security monitoring log collection device based on cloud modular management, including: a vehicle-side log policy management component, a log collection component, a log landing component and a log reporting component; wherein the vehicle-side log policy management component specifically includes:

[0010] Log collection policy configuration and management module: Users connect to the cloud based on the log collection policy configuration and management module to control the enabling or disabling of the log collection function;

[0011] The user can customize the type of log data collected based on the log collection strategy configuration and management module;

[0012] Log blacklist filtering module: Users define blacklist rules based on the log blacklist filtering module to filter log entries that do not need to be reported;

[0013] The blacklist rules can be updated in real time based on user modifications;

[0014] Reporting strategy management module: supports multiple reporting modes, including immediate reporting, cyclic overwriting after the local cache is full, or periodic reporting;

[0015] The reporting mode is determined based on manual adjustment by the user;

[0016] Log storage module: The user sets a preset threshold for the maximum capacity of local log storage. When the preset threshold is reached, a cyclic overwriting mechanism is automatically executed;

[0017] The log storage module stores a variety of compression algorithms, and different compression algorithms correspond to different compression levels. After the user determines that the compression algorithm is started, the log storage module executes the compression process;

[0018] Cloud service address dynamic selection module: automatically monitors the status of cloud services, searches for available cloud service addresses in real time and records them to implement multi-service address configuration, ensuring that it can quickly adapt and switch to the new service address when the service is switched;

[0019] Data encryption module: The encryption key is agreed upon with the cloud before transmission, the data is double-encrypted using symmetric encryption, and Base64 encoding is performed; HTTPS channel encryption is performed on all data during data transmission.

[0020] Furthermore, the log collection policy configuration and management module provides a user interface to enable an administrator to configure and manage various log collection policies.

[0021] Furthermore, the types of log data collected by the user are specifically:

[0022] Set up the collection of performance indicator data, error information data, fault data, interruption data, third-party control information data, and system exception data.

[0023] Furthermore, the filtering of log entries that do not need to be reported is specifically:

[0024] The user's privacy information does not need to be reported and is stored in the privacy storage module of the security monitoring log collection device.

[0025] Furthermore, the log storage module intelligently analyzes the log files to determine the priority of each log file, and stores the log files based on the priority order.

[0026] Furthermore, the log storage module is provided with a deduplication cycle, which aggregates and removes duplicate log records within a set time period based on a deduplication algorithm.

[0027] Furthermore, the safety monitoring log collection device is located at the vehicle end;

[0028] The safety monitoring log collection device is independent of the vehicle end;

[0029] The safety monitoring log collection device is connected to the vehicle end via an external interface;

[0030] The security monitoring log collection device starts the working process after identity authentication.

[0031] Furthermore, the external interface is: a USB interface, a wireless network interface, a Bluetooth interface, and a WiFi interface.

[0032] Furthermore, the safety monitoring log collection device is located at the vehicle end;

[0033] The safety monitoring log collection device is built into the vehicle end;

[0034] The safety monitoring log collection device is integrated into the vehicle central control system;

[0035] The safety monitoring log collection device is started together with the vehicle central control system after the vehicle is started.

[0036] The present invention also provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a security monitoring log collection device to execute a corresponding process.

[0037] The present invention has the following beneficial effects:

[0038] 1. The security monitoring log collection device is located on the vehicle side and is independent of the vehicle side; the security monitoring log collection device is connected to the vehicle side through an external interface; the security monitoring log collection device starts the working process after identity authentication; or; the security monitoring log collection device is located on the vehicle side; and is integrated into the vehicle central control system. After the vehicle is started, the security monitoring log collection device is started together with the vehicle central control system, and the log collection and upload processes can be managed separately. The hardware carried by the log collection and upload process can be applied independently of the vehicle side, which can make the log collection process more flexible, the log management strategy is widely used, and the log management network can be established independently of the Internet of Vehicles.

[0039] 2. Through the pre-negotiation of management rules between users and the cloud, a cloud-based modular log collection strategy configuration and management method can be provided, allowing users to remotely and dynamically configure and manage log collection strategies.

[0040] 3. By setting the blacklist filtering situation by the user to determine the upload situation, the dynamic expansion of the collection function items can be supported, and the present invention supports the dynamic switching of the reporting address to prevent the loss of logs due to cloud service failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is an overall flow chart of the security monitoring log collection device for cloud modular management in the present invention;

[0043] Figure 2 This is a flow chart of the log policy management component in the present invention;

[0044] Figure 3 This is a log landing flow chart in the present invention;

[0045] Figure 4 This is a log reporting flow chart of the present invention. DETAILED DESCRIPTION

[0046] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0047] The present invention provides a security monitoring log collection device based on cloud modular management, including: a vehicle-side log policy management component, a log collection component, a log landing component and a log reporting component; Figure 1 As shown in the figure, the overall process of the cloud-based modular management security monitoring log collection device is as follows. The system is divided into four core components according to function, namely the vehicle-side log policy management component, the log collection component, the log landing component and the log reporting component. These components work together to collect log data from the vehicle side and make log decision processing according to the log management strategy issued by the cloud.

[0048] The vehicle-side log policy management components specifically include:

[0049] Log collection policy configuration and management module: Users connect to the cloud based on the log collection policy configuration and management module to control the enabling or disabling of the log collection function;

[0050] The user can customize the type of log data collected based on the log collection strategy configuration and management module;

[0051] Log blacklist filtering module: Users define blacklist rules based on the log blacklist filtering module to filter log entries that do not need to be reported;

[0052] The blacklist rules can be updated in real time based on user modifications;

[0053] Reporting strategy management module: supports multiple reporting modes, including immediate reporting, cyclic overwriting after the local cache is full, or periodic reporting;

[0054] The reporting mode is determined based on manual adjustment by the user;

[0055] Log storage module: The user sets a preset threshold for the maximum capacity of local log storage. When the preset threshold is reached, a cyclic overwriting mechanism is automatically executed;

[0056] The log storage module stores a variety of compression algorithms, and different compression algorithms correspond to different compression levels. After the user determines that the compression algorithm is started, the log storage module executes the compression process;

[0057] Cloud service address dynamic selection module: automatically monitors the status of cloud services, searches for available cloud service addresses in real time and records them to implement multi-service address configuration, ensuring that it can quickly adapt and switch to the new service address when the service is switched;

[0058] Data encryption module: The encryption key is agreed upon with the cloud before transmission, the data is double-encrypted using symmetric encryption, and Base64 encoding is performed; HTTPS channel encryption is performed on all data during data transmission.

[0059] The format of a log management policy is as follows:

[0060]

[0061] Furthermore, the log collection policy configuration and management module provides a user interface to enable an administrator to configure and manage various log collection policies.

[0062] Furthermore, the types of log data collected by the user are specifically:

[0063] Set up the collection of performance indicator data, error information data, fault data, interruption data, third-party control information data, and system exception data.

[0064] Furthermore, the filtering of log entries that do not need to be reported is specifically:

[0065] The user's privacy information does not need to be reported and is stored in the privacy storage module of the security monitoring log collection device.

[0066] Furthermore, the log storage module intelligently analyzes the log files to determine the priority of each log file, and stores the log files based on the priority order.

[0067] Furthermore, the log storage module is provided with a deduplication cycle, which aggregates and removes duplicate log records within a set time period based on a deduplication algorithm.

[0068] Furthermore, the safety monitoring log collection device is located at the vehicle end;

[0069] The safety monitoring log collection device is independent of the vehicle end;

[0070] The safety monitoring log collection device is connected to the vehicle end via an external interface;

[0071] The security monitoring log collection device starts the working process after identity authentication.

[0072] Furthermore, the external interface is: a USB interface, a wireless network interface, a Bluetooth interface, and a WiFi interface.

[0073] Furthermore, the safety monitoring log collection device is located at the vehicle end;

[0074] The safety monitoring log collection device is built into the vehicle end;

[0075] The safety monitoring log collection device is integrated into the vehicle central control system;

[0076] The safety monitoring log collection device is started together with the vehicle central control system after the vehicle is started.

[0077] like Figure 2 As shown, the log policy management component is the core part of the security monitoring log collection device, which is responsible for managing the log collection, storage and reporting strategies of the vehicle. By regularly requesting the latest log management strategy from the cloud, the cloud will verify the version number, and return the log policy if there is an update. The vehicle will perform base64 decoding, data symmetric decryption, and signature verification on the strategy. Only after the verification is passed will the log policy be loaded into the memory, and the log policy version number will be updated to prevent duplicate updates. If the RSA signature verification of the source of the log policy fails (the cloud will sign the SHA256 summary of the rule file), it means that the rule policy was issued maliciously and the rule needs to be rolled back. The specific log policy management component process is as follows:

[0078] A1. The security monitoring log collection device waits for a periodic policy update trigger to determine whether the policy request cycle specifies the time;

[0079] A2. If the time specified in the policy request cycle is reached, the policy version number is obtained;

[0080] A21. The acquisition policy version number is the version number of the next policy version determined based on the current policy version number, called the version number to be acquired; the next policy version number of the current policy is determined and stored in advance after consultation between the user and the cloud;

[0081] A22. The policy information includes policy rules, which include management policies;

[0082] The policy rules are obtained by the cloud service through negotiation with the user in advance before the log collection;

[0083] A221. The cloud service negotiates with the user in advance to obtain the policy rules, specifically:

[0084] The cloud service sends specific log types and keyword information for log collection, reporting and filtering to the user, and the user makes a selection. Based on the content selected by the user, the cloud service generates the policy rules;

[0085] A3. Based on the policy version number to be obtained, construct a policy request packet;

[0086] A4. The policy request packet is encrypted with AES256 and the encrypted policy request packet is sent to the cloud service;

[0087] A5. The cloud service decrypts the policy request packet, and after identity authentication, issues policy rule data, and encrypts the policy data with AES256 and signs it;

[0088] A6. The security monitoring log collection device receives the policy rule data, performs AES256 decryption, and performs signature verification;

[0089] A7. The full monitoring log collection device parses the policy rule data to obtain the log management strategy;

[0090] A8. The full monitoring log collection device updates the version policy number and stores the policy accordingly.

[0091] The log collection component will obtain the collection function list switch from the policy cache. If the corresponding function item is not enabled, the collection thread of the corresponding function will be closed. The collected or generated logs will be formatted and packaged according to the log format. The package structure is different according to different log types. The log contains the timestamp and SHA1 value (signature value) of the generated log, and then stored in the log buffer. When the log buffer set in the log management policy is full, the network communication component is called to send the log.

[0092] like Figure 3As shown in the figure, the log landing component receives the log reporting request from the collection component, parses the request ID, finds that it is a log reporting request, calls the log landing policy management, and decides how to deal with the log according to the relevant parameter values ​​of the policy cache. The logs that hit the keywords that are not allowed to be reported are discarded, and the logs within the collection cycle are deduplicated and encrypted, and the logs written to the disk are compressed according to the compression method in the log policy to save storage space and reduce log loss due to overwriting. When the network is unavailable or the reporting mode is periodic reporting, the logs will be cached locally, and AES256 will be used for encryption protection when the logs are stored. The encryption key is protected by white box AES256 so that logs can be reported when conditions are appropriate.

[0093] like Figure 4 The figure shows the workflow of the log reporting component. Log management uploads log data according to the configured rule strategy. If it is a real-time reporting strategy, the log data will be compressed to save transmission bandwidth. If it is a periodic report, the log of the log landing component is read as the data source for reporting. At the same time, the reporting strategy can be dynamically switched by the cloud. If the report fails during the reporting process, it will be re-reported according to the maximum number of retries set in the policy cache. If all fail, it will quickly adapt and switch to the new service address to reconnect and report to prevent log loss due to cloud service failure.

[0094] The present invention also provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a security monitoring log collection device to execute a corresponding process.

[0095] The present invention has the following beneficial effects:

[0096] 1. The security monitoring log collection device is located on the vehicle side and is independent of the vehicle side; the security monitoring log collection device is connected to the vehicle side through an external interface; the security monitoring log collection device starts the working process after identity authentication; or; the security monitoring log collection device is located on the vehicle side; and is integrated into the vehicle central control system. After the vehicle is started, the security monitoring log collection device is started together with the vehicle central control system, and the log collection and upload processes can be managed separately. The hardware carried by the log collection and upload process can be applied independently of the vehicle side, which can make the log collection process more flexible, the log management strategy is widely used, and the log management network can be established independently of the Internet of Vehicles.

[0097] 2. Through the pre-negotiation of management rules between users and the cloud, a cloud-based modular log collection strategy configuration and management method can be provided, allowing users to remotely and dynamically configure and manage log collection strategies.

[0098] 3. By setting the blacklist filtering situation by the user to determine the upload situation, the dynamic expansion of the collection function items can be supported, and the present invention supports the dynamic switching of the reporting address to prevent the loss of logs due to cloud service failure.

[0099] The medium in the present invention may adopt any combination of one or more computer-readable media. The medium may be a computer-readable signal medium or a computer-readable storage medium. The medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of the medium (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, the medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device, or device.

[0100] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A security monitoring log collection device based on cloud modular management, characterized in that: include: Vehicle-side log policy management component, log collection component, log landing component and log reporting component; among them, the vehicle-side log policy management component specifically includes: Log collection policy configuration and management module: Users connect to the cloud based on the log collection policy configuration and management module to control the enabling or disabling of the log collection function; The user can customize the type of log data collected based on the log collection strategy configuration and management module; Log blacklist filtering module: Users define blacklist rules based on the log blacklist filtering module to filter log entries that do not need to be reported; The blacklist rules can be updated in real time based on user modifications; Reporting strategy management module: supports multiple reporting modes, including immediate reporting, cyclic overwriting after the local cache is full, or periodic reporting; The reporting mode is determined based on manual adjustment by the user; Log storage module: The user sets a preset threshold for the maximum capacity of local log storage. When the preset threshold is reached, a cyclic overwriting mechanism is automatically executed; The log storage module stores a variety of compression algorithms, and different compression algorithms correspond to different compression levels. After the user determines that the compression algorithm is started, the log storage module executes the compression process; Cloud service address dynamic selection module: automatically monitors the status of cloud services, searches for available cloud service addresses in real time and records them to implement multi-service address configuration, ensuring that it can quickly adapt and switch to the new service address when the service is switched; Data encryption module: The encryption key is agreed upon with the cloud before transmission, the data is double-encrypted using symmetric encryption, and Base64 encoding is performed; HTTPS channel encryption is performed on all data during data transmission.

2. A security monitoring log collection device based on cloud modular management according to claim 1, characterized in that: The log collection policy configuration and management module provides a user interface to enable administrators to configure and manage various log collection policies.

3. A security monitoring log collection device based on cloud modular management according to claim 2, characterized in that: The specific types of log data collected by the custom collection are: Set up the collection of performance indicator data, error information data, fault data, interruption data, third-party control information data, and system exception data.

4. A security monitoring log collection device based on cloud modular management according to claim 3, characterized in that: The log entries that do not need to be reported are: The user's privacy information does not need to be reported and is stored in the privacy storage module of the security monitoring log collection device.

5. A security monitoring log collection device based on cloud modular management according to claim 4, characterized in that: The log storage module intelligently analyzes the log files and determines the priority of each log file, and stores the log files based on the priority order.

6. A security monitoring log collection device based on cloud modular management according to claim 5, characterized in that: The log storage module is provided with a deduplication cycle, and based on a deduplication algorithm, duplicate log records are aggregated and removed within a set time period.

7. A security monitoring log collection device based on cloud modular management according to claim 6, characterized in that: The safety monitoring log collection device is located at the vehicle end; The safety monitoring log collection device is independent of the vehicle end; The safety monitoring log collection device is connected to the vehicle end via an external interface; The security monitoring log collection device starts the working process after identity authentication.

8. The security monitoring log collection device based on cloud modular management according to claim 7 is characterized in that: The external interfaces are: USB interface, wireless network interface, Bluetooth interface, and WiFi interface.

9. The security monitoring log collection device based on cloud modular management according to claim 6, characterized in that: The safety monitoring log collection device is located at the vehicle end; The safety monitoring log collection device is built into the vehicle end; The safety monitoring log collection device is integrated into the vehicle central control system; The safety monitoring log collection device is started together with the vehicle central control system after the vehicle is started.

10. A computer-readable storage medium, characterized in that: The medium stores computer instructions, and the computer instructions are used to enable the computer to support the device of any one of claims 1-9 to execute a corresponding process.

Images