Security log storage method and device

Abstract

The invention discloses a security log storage method and device. The method can be used in a vehicle-mounted wireless communication device and comprises the following steps of enabling or disabling a security log event according to a user scene associated with the security log event; the log total flow is distributed among all the enabled security log events; and processing the security log event according to the traffic allocated to the security log event. According to the method, the log is subjected to current limiting according to the user scene, so that the problem of equipment performance reduction caused by network attacks and the like is avoided.

Description

Technical Field

[0001] The present invention relates to log storage technology, and in particular to a security log storage method and device. Background Art

[0002] In vehicles, network security issues of on-board wireless communication devices such as T-Box (Telematics-Box) are very important. Therefore, when the on-board wireless communication device is working, the security logs generated in it need to be stored in a security file for analysis when needed. It is based on this point that an external attack source may launch a massive attack in a short period of time, resulting in a large number of security logs in a short period of time, exceeding the storage capacity of the security file, thereby causing the on-board wireless communication device to have problems such as performance degradation, and in severe cases, even unable to work or restart. Summary of the invention

[0003] In view of this, the present invention provides a security log storage method and device, which can avoid device performance degradation caused by network attacks and the like.

[0004] A security log storage method according to an embodiment of the present invention is used in a vehicle-mounted wireless communication device, comprising: enabling or disabling the security log event according to a user scenario associated with the security log event; allocating the total log flow among all enabled security log events; and processing the security log event according to the flow allocated to the security log event.

[0005] In some embodiments, the user scenario associated with the security log event includes at least: the vehicle state required to form the security log event; when the user scenario associated with the security log event is met, enabling the security log event; when the user scenario associated with the security log event is not met, disabling the security log event.

[0006] In some embodiments, the step of distributing the total log traffic among all enabled security log events includes: determining the proportion of each enabled security log event in allocating the total log traffic based on a preset traffic factor of each enabled security log event; and distributing the total log traffic to each enabled security log event based on the determined proportion.

[0007] In some implementations, the total log flow is the maximum number of log entries allowed within a preset time.

[0008] In some implementations, the method further includes: when an enabling condition of any security log event changes, reallocating the total log flow.

[0009] In some embodiments, the step of controlling the storage of the corresponding security log according to the traffic allocated to the security log event includes: when the traffic of the security log event is less than or equal to the allocated traffic, storing the corresponding security log; when the traffic of the security log event is greater than the allocated traffic threshold, discarding the security log event, accumulating the number of discards in the current cycle, and storing the number of discards when entering the next cycle.

[0010] In some embodiments, the security log event includes at least one of the following: security access events in non-programming sessions, security access events in programming sessions, diagnostic control and reset events, software upgrade events, CAN communication events, Ethernet communication events, system failure events, operating system error events, password operation events, security key update events, and user account events.

[0011] In some embodiments, the user scenario includes at least one of the following: vehicle speed, status of programming session and emergency call, status of diagnostic service, status of Ethernet, and status of diagnostic session corresponding to password / key operation.

[0012] A security log storage device according to an embodiment of the present invention is used in a vehicle, and includes: a user scenario monitoring module, which is used to enable or disable the security log event according to the user scenario associated with the security log event; a real-time traffic balancing module, which is used to distribute the total log traffic among all enabled security log events; and a log event processing unit, which is used to process the security log event according to the traffic allocated to the security log event.

[0013] A computer device / equipment / system according to an embodiment of the present invention includes a memory, a processor, and a computer program / instruction stored in the memory, wherein the processor executes the computer program / instruction to implement the steps of the method according to the embodiment of the present invention.

[0014] A computer-readable storage medium according to an embodiment of the present invention stores a computer program / instruction thereon, and when the computer program / instruction is executed by a processor, the steps of the method according to the embodiment of the present invention are implemented.

[0015] A computer program product according to an embodiment of the present invention includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method according to the embodiment of the present invention are implemented.

[0016] Beneficial effects of the embodiments of the present invention:

[0017] Enable or disable security log events according to user scenarios, and distribute the total log traffic among all enabled security log events, so as to achieve flow control of security log events. Because of flow control of security log events, even if a large number of security log events are generated during a network attack, the redundant security log events will be discarded due to flow control, so that it is not easy to cause problems such as performance degradation or even device restart due to excessive system burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Other details and advantages of the present invention will become apparent from the detailed description provided below. It should be understood that the following drawings are merely illustrative and thus cannot be considered as limiting the present invention, and the following will be described in detail with reference to the drawings, wherein:

[0019] Figure 1 It is a flowchart of an embodiment of a security log storage method of the present invention;

[0020] Figure 2 is a flow chart of another embodiment of the security log storage method of the present invention;

[0021] Figure 3 is a schematic structural diagram of an embodiment of a security log storage device of the present invention;

[0022] Figure 4 It is a schematic diagram of the structure of an embodiment of a computer device / equipment / system of the present invention. DETAILED DESCRIPTION

[0023] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention.

[0024] In the description of the present invention, it is to be understood that the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. Moreover, the terms "first", "second", etc. are applicable to distinguishing similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein.

[0025] like Figure 1, which is a flow chart of an embodiment of the security log storage method of the present invention. The method can be used in a vehicle, for example, in a vehicle-mounted wireless communication device such as a T-Box (T-box), a TCAM (Telematics & Connectivity Antenna Module), etc. Specifically, the method comprises the following steps:

[0026] Step S10: enabling or disabling security log events according to user scenarios associated with security log events.

[0027] Among them, the security log event (which can be referred to as "log event") can be associated with a specific user scenario in advance. When there is a security log event, it indicates that there is a corresponding security log that needs to be recorded. In this embodiment, the user scenario mainly refers to the vehicle state required to generate a security log event, such as the speed of the vehicle, whether it is in a diagnostic session state, etc. It should be noted that when the vehicle meets the state (or user scenario) required to generate a security log event, it only means that the corresponding security log event may be generated, and it does not mean that the corresponding security log event will inevitably be generated; and when the vehicle does not meet the corresponding state (or user scenario), the vehicle should not generate a corresponding security log event. For example, for software upgrades, the speed of the vehicle is required to be lower than a certain set value (such as 3km / h) and Ecall (Emergency Call) is not triggered. Therefore, when the speed of the vehicle is higher than a certain set value or Ecall is being triggered, the upgrade will not be allowed, and there will be no log of the upgrade event. Therefore, the upgrade log event can be disabled. For another example, a security access event under a programming session (Security Access Programming Session) requires the diagnosis to be in a programming session mode. Therefore, if the diagnosis module is not currently in a programming session mode, there will be no such security log event.

[0028] When the user scenario associated with the security log event is not satisfied, the security log event is disabled, indicating that the security log event should not exist in the current user scenario. When the user scenario associated with the security log event is satisfied, the security log event is enabled, indicating that the security log event may be generated in the current user scenario.

[0029] In addition, an enabling factor e can be set i To indicate the enabling status of log event i. For example, e i =1 indicates that log event i is enabled, e i =0 indicates that the log event i is in the disabled state.

[0030] In addition, the security log events of this embodiment include but are not limited to at least one of the following: security access events in non-programming sessions, security access events in programming sessions, diagnostic control and reset events, software upgrade events, CAN communication events, Ethernet communication events, system failure events, operating system error events, password operation events, security key update events and user account events.

[0031] In addition, the user scenarios of this embodiment include but are not limited to at least one of the following: vehicle speed, programming session status (e.g., whether in programming session) and emergency call status (e.g., whether Ecall is in progress), diagnostic service status (e.g., whether healthy), Ethernet status (e.g., whether linked), and the status of the diagnostic session corresponding to the password / key operation (e.g., whether switched to the corresponding session), etc. The user scenario can be determined based on the relevant status data of the vehicle obtained from the vehicle network.

[0032] It should be noted that the above description of the security log events, user scenarios, and the correlation between the security log events and the user scenarios is only an example and not a limitation of the present invention. Those skilled in the art can customize the security log events, user scenarios, and the correlation between the security log events and the user scenarios as needed.

[0033] Step S12: Distribute the total log traffic among all enabled security log events.

[0034] The total log flow rate may be a preset value, which may be obtained from a configuration file. The total log flow rate may be expressed as the maximum number of log entries t allowed within a preset time p.

[0035] Among them, all enabled security log events can be determined through step S10.

[0036] Wherein, the log total flow can be evenly divided between all enabled security log events in an evenly distributed manner. Alternatively, the log total flow can be distributed based on the importance of different types of security log events. In one embodiment, the flow factor of each security log event can be pre-configured, and then the log total flow is distributed based on the flow factor of all enabled security log events. Specifically, the ratio of the flow factor of each security log event (enabled) in the sum of the flow factors of all enabled security log events can be calculated first, and then the log total flow is distributed based on the proportion occupied.

[0037] For example, the total log flow can be allocated based on the following formula (1).

[0038]

[0039] Among them, t iThe amount of traffic allocated to the enabled security log event i. i Indicates the flow factor of security log event i, which is a preset value and can be obtained based on historical statistical data or customized by the user. Indicates all enabled (i.e. e i =1), so Indicates the ratio of the flow factor of security log event i to the sum of the flow factors of all enabled security log events.

[0040] In step S12, the security log event that enables participates in the distribution of total flow, so the log total flow can be fully utilized. In addition, because the enabling state of the security log event may change dynamically, therefore when the enabling state of any security log event changes, the log total flow can be redistributed to reach the purpose of dynamic balance.

[0041] Step S14: Process the security log event according to the traffic allocated to the security log event.

[0042] When the flow rate (in terms of number) of security log event i is less than or equal to the allocated flow rate t i When the security log event i is generated, the security log corresponding to the security log event i is stored in the security file.

[0043] When the flow of the security log event i reaches the threshold, the newly received security log event i is discarded, that is, the security log corresponding to the security log event i is not stored in the security file.

[0044] In addition, when the security log event i is discarded, the number of the discarded security log events i can be counted. Thus, at the end of the current cycle or the beginning of the next cycle, the number of discarded events is stored in the security file. The end of the current cycle is, for example, when the preset time p is reached. For example, the present embodiment processes the security log with p as the cycle. In addition, the current cycle can also be terminated in advance and a new cycle can be started because the enabling status of the security log event changes. For example, when a security log event is monitored to change from a disabled state to an enabled state, the current cycle is triggered to end in advance.

[0045] In this embodiment, security log events are enabled or disabled according to user scenarios, and the total log flow is distributed among all enabled security log events, thereby realizing current limiting processing of security log events. Because the security log events are current limited, even if a large number of security log events are generated during a network attack, the redundant security log events will be discarded due to current limiting, so that it is not easy to cause problems such as performance degradation or even device restart due to excessive system burden.

[0046] Combine the following Figure 2, a detailed embodiment of the present invention is described.

[0047] like Figure 2 FIG. 1 is a flow chart of another embodiment of the security log storage method of the present invention, which includes:

[0048] Step S201: Monitor user scenarios, such as monitoring the vehicle speed, whether it is in a programming session, whether it is in an Ecall, etc. Various data of the vehicle can be obtained through the vehicle network to monitor the user scenario.

[0049] Step S202: Update the enabling status of security log events according to the user scenario. For example, set the enabling factor e of each security log event. i The value of .

[0050] Step S203: Determine whether the enabling state of each security log event has changed. If the determination result is yes, execute step S204. If the determination result is no, execute step S206.

[0051] Step S204: Update the traffic of all enabled security log events. For example, based on the above formula (1), the total log traffic t is distributed among all enabled security log events.

[0052] Step S205: Restart the timing period and start the processing of a new cycle. The value of the timing period is set to the preset time p. When the timing period is restarted, the accumulated log flow of the previous cycle is cleared, the overflow of the log of the previous cycle, that is, the number of logs exceeding the flow, is stored in the security file, and the overflow is reset.

[0053] Step S206: Determine whether the timer has timed out, if the determination result is yes, execute step S205. Otherwise, execute step S207.

[0054] Step S207: When receiving a security log event, determine whether the flow of the security log event is less than or equal to the flow allocated to it. If less than or equal to, execute step S208. Otherwise, execute step S209.

[0055] Step S208: Store the security log in the security area and increase the count value by 1.

[0056] Step S209: discard the security log and increase the number of overflow entries by 1.

[0057] In this embodiment, the total log flow is distributed among the enabled security log events, so the utilization efficiency of the log flow can be improved. In addition, the enabled security log events are limited based on the user scenario, which can avoid the degradation of device performance caused by network attacks, etc.

[0058] like Figure 3 As shown, it is a structural schematic diagram of an embodiment of the electronic system of a vehicle of the present invention, and the electronic system of the vehicle includes: a functional module 10 related to a user scenario, for example, including: a diagnostic unit 101, a speed sensor 102 and an Ecall unit 10n, etc.; a security log storage device 20, including: a user scenario monitoring unit 201, a real-time traffic balancing unit 202 and a log event processing unit 202; an event reporting module 30, for reporting various types of log events, such as security access log events, upgrade log events, CAN communication log events, etc.; and a security file 40, for storing security logs.

[0059] In the security log storage device 20, the user scenario monitoring unit 201 updates the enabling factor of the log event in real time by dynamically monitoring the user scenarios of each log event type. Among them, the user scenario monitoring unit 201 can execute the content in the above step S10. The real-time traffic balancing unit 202 is used to calculate the traffic size of each log event. Among them, the real-time traffic balancing unit 202 can execute the content in the above step S12. The log event processing unit 202 is used to start the timer and receive external log events, and take actions such as discarding, writing to a security file, and recording the number of overflows according to the traffic size of different log events. When the timer times out, the number of overflows is updated to the security file, the parameters such as the number of overflows are reset, and the timer is restarted. Among them, the log event processing unit 202 is used to execute the content in the above step S14.

[0060] like Figure 4 , which is a flowchart of an embodiment of a computer device / equipment / system 4 of an embodiment of the present invention. The computer device / equipment / system 4 may be a vehicle, a T-box, a TCAM or an electronic system of a vehicle, etc. It includes: a memory 40, a processor 42 and a computer program / instruction stored in the memory 40. The processor 42 executes the computer program / instruction in the memory 40 to implement each step in the embodiment of the method of the present invention, such as Figure 1 and 2 The various steps in .

[0061] In addition, the embodiment of the present invention further provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, each step in the method embodiment of the present invention is implemented, such as Figure 1 and 2 The various steps in .

[0062] In addition, an embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements each step in the method embodiment of the present invention when executed by a processor, such as Figure 1 and 2The various steps in .

[0063] The description of the above device, storage medium and program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device, storage medium and program product embodiments of this application, please refer to the description of the method embodiment of this application for understanding.

[0064] The processor may be at least one of an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, a microprocessor, etc. It is understandable that the electronic device that implements the function of the processor may also be other, and the embodiments of the present application are not specifically limited.

[0065] The above-mentioned computer storage medium / memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM) and the like; it can also be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0066] It should be noted that the above description is only for example and not for limitation of the present invention. In other embodiments of the present invention, the method may have more, fewer or different steps, and the order, inclusion and function of each step may be different from that described and illustrated. For example, generally multiple steps can be combined into a single step, and a single step can also be divided into multiple steps. For those of ordinary skill in the art, without paying creative work, the sequential changes of each step are also within the scope of protection of the present invention.

[0067] The technical solution of the present invention, in essence or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor or a microcontroller to perform all or part of the steps of the method described in each embodiment of the present invention.

[0068] Those skilled in the art will appreciate that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed.

[0069] Although the present invention has been disclosed as above with preferred embodiments, the present invention is not limited thereto. Any changes and modifications made by any person skilled in the art without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention, and therefore the protection scope of the present invention should be subject to the scope defined by the claims.

Claims

1. A security log storage method, used in a vehicle-mounted wireless communication device, characterized in that: include: Enable or disable the security log event according to the user scenario associated with the security log event; Distribute the total log traffic among all enabled security log events; as well as Process the security log event according to the traffic to which the security log event is allocated.

2. The security log storage method according to claim 1, characterized in that: The user scenario associated with the security log event includes at least: the vehicle status required to form the security log event; When the user scenario associated with the security log event is satisfied, the security log event is enabled; when the user scenario associated with the security log event is not satisfied, the security log event is disabled.

3. The security log storage method according to claim 1, characterized in that: The step of distributing the total log traffic among all enabled security log events includes: Determining the proportion of each enabled security log event in allocating the total log flow according to the preset flow factor of each enabled security log event; According to the determined ratio, the total log flow is allocated to each enabled security log event.

4. The security log storage method according to claim 1, characterized in that: The total log flow is the maximum number of log entries allowed within a preset time.

5. The security log storage method according to claim 4, characterized in that: The method further comprises: When the enabling status of any security log event changes, the total log flow is reallocated.

6. The security log storage method according to claim 1, characterized in that: The step of processing the security log event according to the traffic allocated to the security log event comprises: When the flow rate of the security log event is less than or equal to the allocated flow rate, storing the corresponding security log; When the flow of the security log event is greater than the allocated flow, the corresponding security log event is discarded, and the number of discards in the current cycle is accumulated, and the number of discards is stored when entering the next cycle.

7. The security log storage method according to claim 1, characterized in that: The security log events include at least one of the following: security access events in non-programming sessions, security access events in programming sessions, diagnostic control and reset events, software upgrade events, CAN communication events, Ethernet communication events, system failure events, operating system error events, password operation events, security key update events, and user account events; The user scenario includes at least one of the following: vehicle speed, status of a programming session and a status of an emergency call, status of a diagnostic service, status of an Ethernet network, and status of a diagnostic session corresponding to a password / key operation.

8. A safety log storage device, used in a vehicle, characterized in that: include: A user scenario monitoring module, used to enable or disable the security log event according to the user scenario associated with the security log event; Real-time traffic balancing module, used to distribute the total log traffic among all enabled security log events; as well as The log event processing unit is used to process the security log event according to the flow allocated to the security log event.

9. A computer device / equipment / system comprising a memory, a processor and a computer program / instruction stored in the memory, characterized in that: The processor executes the computer program / instructions to implement the steps of the method of any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images