Log management apparatus, log management method, log management program, and log management system

Abstract

To provide a log management apparatus, method, program and system configured to properly collect logs necessary for log analysis to detect an anomaly even when a device configured to collect logs and detect abnormal logs is subjected to a cyberattack.SOLUTION: A log management apparatus 100 which is mounted on a mobile body and collects logs with other log management apparatuses from an electronic control apparatus includes: a log acquisition unit 101 which acquires logs from the electronic control apparatus; a master failure information storage unit 102 which stores main device information indicating a main log management apparatus that transmits logs to the outside of the mobile body; a determination unit 106 which determines, based on the main device information, whether the log management apparatus is the main log management apparatus; and a transmission unit 108 which transmits logs to the outside of the mobile body. When the determination unit determines that the log management apparatus is the main log management apparatus, the transmission unit transmits logs to the outside of the mobile body. When the log management apparatus is not the main log management apparatus, the transmission unit does not transmit logs to the outside of the mobile body.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a log management device that manages logs generated by electronic control devices mounted on mobile objects such as automobiles and transmits them outside the mobile object, a method and program executed by the log management device, and a log management system. [Background technology]

[0002] In recent years, technologies for driver assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication) and vehicle-to-infrastructure communication, have been attracting attention. As a result, vehicles are increasingly equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks, such as unauthorized access, is increasing.

[0003] Therefore, it is necessary to analyze cyber attacks against vehicles and develop countermeasures. One possible solution is to transmit information about abnormalities occurring in the vehicle outside the vehicle and analyze the cyber attacks on a server device or other device with sufficient resources.

[0004] For example, Patent Document 1 describes that a log collection device mounted on a vehicle collects logs from an on-board ECU based on instructions from a server device and transmits aggregated log information that aggregates the collected logs to the server. Patent Document 2 also describes that an attack detection device mounted on a vehicle acquires log data indicating an abnormality that has occurred in the on-board system and makes an attack determination based on the acquired log data, or transmits a log data set to an attack determination device provided outside the vehicle and makes an attack determination outside the vehicle. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2019-016248 [Patent Document 2] WO2020 / 179021 Summary of the Invention [Problem to be solved by the invention]

[0006] Here, the present inventors have found the following problems as a result of detailed investigation. In both Patent Documents 1 and 2, a single log collection device or attack determination device mounted on a vehicle collects logs from an on-board system and transmits the logs in a consolidated manner to an external device. However, if such a log collection device is subjected to a cyberattack or experiences some kind of malfunction, it may not be able to properly collect logs. Furthermore, if the log collection device itself performs cyberattack determination, the log collection device may not be able to properly detect a cyberattack that has occurred in the on-board system, resulting in low reliability of the determination results. Therefore, it is desirable to be able to properly collect logs necessary for analysis and to perform highly reliable attack determination even when the log collection device is subject to a cyberattack or is experiencing a malfunction.

[0007] Therefore, an object of the present invention is to realize a device that can collect logs necessary for analysis in a vehicle even if the log collection device is subjected to a cyber attack, etc. Another object of the present invention is to realize a device that can execute reliability anomaly detection processing in a vehicle even if the log collection device is subjected to a cyber attack, etc. [Means for solving the problem]

[0008] The log management device of the present disclosure is a log management device (100, 200, 300, 400) that is mounted on a mobile body and acquires logs from an electronic control device together with other log management devices, and includes a log acquisition unit (101) that acquires logs from the electronic control device, a storage unit (102, 202, 301, 404) that stores main device information indicating a main log management device that is a log management device that transmits logs outside the mobile body, among the log management device and the other log management devices, a determination unit (106) that determines whether the log management device is the main log management device based on the main device information, and a transmission unit (108) that transmits the log outside the mobile body, wherein if the determination unit determines that the log management device is the main log management device, the transmission unit transmits the log outside the mobile body, and if the determination unit determines that the log management device is not the main log management device, the transmission unit does not transmit the log outside the mobile body.

[0009] It should be noted that the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. [Effects of the Invention]

[0010] With the above-described configuration, the log management device etc. of the present disclosure can collect logs necessary for analyzing the cyber attack from the electronic control device even if the log management device or another log management device is subjected to a cyber attack. Furthermore, the log management device etc. of the present disclosure can perform highly reliable anomaly detection processing even if the log management device or another log management device is subjected to a cyber attack or the like. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is an explanatory diagram illustrating the arrangement of a log management device and its relationship with related devices in each embodiment. [Figure 2] FIG. 1 is an explanatory diagram illustrating an example of the configuration of an electronic control system according to each embodiment. [Figure 3]FIG. 10 is a diagram illustrating a security log generated by a security sensor of an electronic control device according to each embodiment. [Figure 4] FIG. 1 is a block diagram showing an example of the configuration of a log management device according to a first embodiment. [Figure 5] FIG. 10 is a diagram illustrating the correspondence between main device information and master abnormality information according to the first embodiment. [Figure 6] 1 is a flowchart illustrating the operation of the log management device according to the first embodiment. [Figure 7] 1 is a flowchart illustrating the operation of the log management device according to the first embodiment. [Figure 8] FIG. 10 is a block diagram showing an example of the configuration of a log management device according to a second embodiment. [Figure 9] 10 is a flowchart illustrating the operation of the log management device according to the second embodiment. [Figure 10] FIG. 10 is a block diagram showing an example of the configuration of a log management device according to a third embodiment. [Figure 11] FIG. 10 is a diagram illustrating main device information according to the third embodiment. [Figure 12] FIG. 10 is a block diagram showing a configuration example of a log management device according to a fourth embodiment. [Figure 13] FIG. 10 is a diagram illustrating main device information according to the fourth embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] The present invention refers to the inventions described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks refer to the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0014] The configurations and methods recited in the dependent claims are optional configurations and methods in the inventions recited in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods recited in the dependent claims, as well as the configurations and methods recited only in the embodiments without being recited in the claims, are optional configurations and methods in the present invention. The configurations and methods recited in the embodiments when the recitation of the claims is broader than the recitation of the embodiments are also optional configurations and methods in the present invention, in the sense that they are examples of the configurations and methods of the present invention. In either case, by being recited in the independent claims, they become essential configurations and methods of the present invention.

[0015] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention has.

[0016] When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in multiple embodiments may be collected and combined.

[0017] The problem described in the section on the problem to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this fact, together with the configuration and method of the present invention, affirms the inventive step of the invention.

[0018] 1. Configuration underlying each embodiment (1) Location of the log management device and its relationship with related devices FIG. 1 is a diagram illustrating the arrangement of log management devices according to each embodiment and their relationships with related devices. As shown in FIG. 1, log management devices 100, 200, 300, and 400 according to each embodiment are "mounted" together with an "electronic control device" (hereinafter referred to as an ECU (Electronic Control Unit)) 10 in a vehicle, which is a "mobile body." Hereinafter, the log management devices 100, 200, 300, and 400 will be collectively referred to as the log management devices 100, etc. The log management devices 100, etc. constitute a log management system 1. Note that while FIG. 1 illustrates only one log management device 100, etc. and one ECU 10, a mobile body may be equipped with multiple log management devices 100, etc. and multiple ECUs 10, as will be described later.

[0019] Here, "mobile body" refers to an object that can move at any speed. It also naturally includes cases where the moving body is stationary. Examples include, but are not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these vehicles. "Mounted" includes not only cases where the device is directly fixed to the mobile body, but also cases where the device is not fixed to the mobile body but moves with the mobile body. For example, cases where the device is carried by a person riding on the mobile body, or cases where the device is mounted on cargo placed on the mobile body, are included. The "electronic control device" may be a physically independent electronic control device, or may be a virtualized electronic control device realized using virtualization technology.

[0020] 1 illustrates the electronic control system S as a system including the log management system 1, and in each embodiment, the log management device 100 and the like are described as devices provided in multiple ECUs 10. However, the log management system 1 may be provided outside the electronic control system S, or may be provided as a device separate from the ECUs 10.

[0021] The external device 20 is any device provided outside the vehicle, and an example of such a device is a Security Operations Center (SOC). The external device 20 uses security logs transmitted from the log management device 100 or the like to detect and analyze cyber-attacks.

[0022] In FIG. 1, the electronic control system S and the external device 20 are connected via a communication network using a wireless communication method such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, or 5G. Alternatively, DSRC (Dedicated Short Range Communication) can be used. When the vehicle is parked in a parking lot or in a repair shop, a wired communication method can be used instead of a wireless communication method. For example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used. Alternatively, the line may be a combination of a wireless communication system and a wired communication system. For example, the electronic control system S and a base station device in a cellular system may be connected by a wireless communication system such as 4G, and the base station device and the external device 20 may be connected by a wired communication system such as a trunk line of a telecommunications carrier or the Internet. A gateway device may be provided at the point of contact between the trunk line and the Internet.

[0023] (2) Configuration of electronic control system S FIG. 2 is a diagram showing an example of the configuration of an electronic control system S. The electronic control system S is made up of multiple ECUs 10 and an in-vehicle network connecting these. FIG. 2 shows eight ECUs (ECU10a to ECU10h) as an example, but the electronic control system S may naturally be made up of any number of ECUs. In the following explanation, when describing one or multiple electronic control devices collectively, they will be referred to as ECU10 or each ECU 10, and when describing individual electronic control devices specifically, they will be referred to as ECU10a, ECU10b, ECU10c, ...

[0024] 2, the ECUs 10 are connected to each other via an in-vehicle communication network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). Alternatively, the ECUs 10 may be connected to each other using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), or Bluetooth (registered trademark). Note that connection refers to a state in which data can be exchanged, and includes not only cases in which different hardware is connected via a wired or wireless communication network, but also cases in which virtual ECUs (also called virtual machines) realized on the same hardware are virtually connected to each other.

[0025] The electronic control system S shown in FIG. 2 includes an integrated ECU 10a, an external communication ECU 10b, zone ECUs (10c, 10d), and individual ECUs (10e to 10h).

[0026] The electronic control system S also has a plurality of zones (A to D). Each ECU 10 belongs to one of the plurality of zones. A log management device 100 (to be described later) also belongs to one of the plurality of zones. The electronic control system S is divided into a plurality of zones, for example, according to the function of the ECU 10 or the location where the ECU 10 is installed.

[0027] The integrated ECU 10a is an ECU that has a function of controlling the entire electronic control system S and also has a gateway function of mediating communication between the ECUs. The integrated ECU 10a is also called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 10a may also be a relay device or a gateway device.

[0028] The external communication ECU 10b is an ECU having a communication unit that communicates with an external device 20 provided outside the vehicle. The communication method used by the external communication ECU 10b is the wireless communication method or wired communication method described above. In order to realize a plurality of communication methods, a plurality of external communication ECUs 10b may be provided. Also, instead of providing the external communication ECU 10b, the integrated ECU 10a may include the functions of the external communication ECUb.

[0029] The zone ECUs (10c, 10d) are ECUs equipped with a gateway function that are appropriately arranged according to the location and function of the individual ECUs. In the example of FIG. 2, the zone ECUs (10c, 10d) function as gateways in zones (C, D), respectively. For example, the zone ECU 10c is an ECU equipped with a gateway function that mediates communication between the individual ECUs 10e and 10f arranged at the front of the vehicle and other ECUs 10, and the zone ECU 10d is an ECU equipped with a gateway function that mediates communication between the individual ECUs 10g and 10h arranged at the rear of the vehicle and other ECUs 10.

[0030] The individual ECUs (10e to 10h) can be configured with ECUs having any desired functions. Examples include drivetrain electronic control units that control the engine, steering, brakes, etc., body electronic control units that control meters, power windows, etc., information system electronic control units such as navigation systems, and safety control system electronic control units that perform control to prevent collisions with obstacles or pedestrians. Furthermore, the ECUs may be classified as master and slave rather than parallel.

[0031] 2, a security sensor is installed in each ECU 10 other than ECU 10h (abbreviated as SS in the figure). In this way, it is not necessary for all ECUs 10 constituting the electronic control system S to be equipped with a security sensor.

[0032] A security sensor mounted on each ECU 10 generates a security log when it detects an event that occurs on the ECU 10 or on the in-vehicle communication network to which the ECU 10 is connected. The security sensor then transmits the generated security log to a log management device 100 (described later) or the like. As will be described in each embodiment, the log management system 1 has multiple log management devices 100, and the security sensor transmits the security log to all of the multiple log management devices 100.

[0033] 3 is a diagram showing a specific example of a security log generated by a security sensor. The security log has fields: an ECU ID indicating identification information of the ECU 10 in which the security sensor is installed; a sensor ID indicating identification information of the security sensor; an event ID indicating identification information of a security event; a counter indicating the number of times the event has occurred; a timestamp indicating the time the event occurred; and context data indicating details of the security sensor output. The security log may further have a header storing information indicating the protocol version and the state of each field.

[0034] (3) Log management device 100, etc. The log management system 1 includes multiple log management devices 100, etc. The multiple log management devices 100, etc. all have the same configuration and execute the same processing, with the exceptions described in each embodiment below. While FIG. 2 illustrates an example of a configuration in which the log management system 1 includes two log management devices, the number of log management devices 100 is arbitrary. The log management devices 100, etc. are also referred to as IdsR (Intrusion Detection System Reporter) in the specifications defined by AUTOSAR (AUTomotive Open System ARchitecture).

[0035] 2, the log management device 100 and the like are provided in the zone ECUs 10c and 10d. In the following embodiments, the log management device provided in the zone ECU 10c is referred to as the log management device 100a, 200a, 300a, or 400a, and the log management device provided in the zone ECU 10d is referred to as the log management device 100b, 200b, 300b, or 400b. However, the log management device 100 and the like may be provided in the integrated ECU 10a and the external communication ECU 10b in addition to the zone ECUs 10c and 10d. Alternatively, the log management device 100 and the like may be provided in the individual ECUs (10e to 10h) instead of the zone ECUs.

[0036] Furthermore, it is desirable that the log management device 100 and the like are all installed in a secure area (hereinafter referred to as a secure area). A secure area is an area that is physically or logically resource-separated from a non-secure area that can communicate with the outside of the vehicle but may be compromised by attacks from outside the vehicle. While a non-secure area is an area that can communicate with the outside of the vehicle, a secure area is resource-separated from the non-secure area, so that even if the non-secure area is attacked, the secure area is likely to maintain a normal state.

[0037] For example, since the external communication ECU 10b has a function of communicating with the outside of the vehicle, it is highly likely to be subject to cyber-attacks from outside the vehicle. Therefore, if the external communication ECU 10b has a function as the log management device 100 or the like, the log management device 100 or the like may also be subject to cyber-attacks. Therefore, if the external communication ECU 10b has a function as the log management device 100 or the like, for example, the external communication ECU 10b may be an ECU having a hypervisor-type virtual machine, and the virtual machine that functions as the log management device 100 or the like may be provided in a secure area, and the virtual machine that functions as the external communication device may be provided in a non-secure area. Note that, similarly, when the log management device 100 or the like is provided in an ECU 10 other than the external communication ECU 10b, it is desirable to provide the log management device 100 or the like in the secure area.

[0038] 2. Embodiment 1 (1) Configuration of the Log Management Device 100 An example of the configuration of the log management device 100 in this embodiment will be described with reference to Fig. 4. The log management device 100 includes a log acquisition unit 101, a master anomaly information storage unit 102, a log storage unit 103, a control unit 104, a transmission unit 108, a detection result output unit 109, and a detection result acquisition unit 110. The control unit 104 realizes an anomaly detection unit 105, a determination unit 106, a log processing unit 107, and a comparison unit 111.

[0039] The log acquisition unit 101 acquires a security log (corresponding to a "log") generated by a security sensor of each ECU 10 via an in-vehicle communication network.

[0040] The master anomaly information storage unit 102 (corresponding to the "storage unit") stores master anomaly information that is used by the anomaly detection unit 105, which will be described later, to detect anomalies from security logs. In this embodiment, the master anomaly information storage unit 102 further stores main device information that "indicates" a main log management device, among the multiple log management devices 100, that functions as a log management device that transmits logs to the external device 20, in association with the master anomaly information.

[0041] Here, "indicating" may directly indicate that it is the main log management device, or may indirectly indicate that it is the main log management device.

[0042] Fig. 5 shows an example of a table showing the correspondence between main device information and master anomaly information stored in the master anomaly information storage unit 102 of this embodiment. In the example of Fig. 5, the master anomaly information includes anomalies predicted to occur in the electronic control system S and security log patterns that occur when the anomalies occur (hereinafter referred to as log occurrence patterns).

[0043] The master anomaly information in Figure 5 indicates, for example, that when anomaly X occurs, a security log is generated by the security sensor mounted on ECU 10b, and when anomaly Y occurs, a security log is generated by the security sensors mounted on ECU 10e and ECU 10f. The master anomaly information may include a log generation pattern spanning multiple zones. For example, an anomaly AB shown in Figure 5 indicates that a security log is generated by the security sensors mounted on ECU 10e and ECU 10f, which belong to zone C, and ECU 10g, which belongs to zone D.

[0044] 5 indicates whether or not a log is generated in each ECU 10. However, the log generation pattern may be a combination of specific log generation patterns. For example, in ECU 10b, if three types of logs (log b1, log b2, and log b3) may be generated as security logs, the master abnormality information may include, for example, a combination of log b1 and log b2 as the log generation pattern. In this case, it indicates that when abnormality X occurs, security logs b1 and b2 are generated by the security sensor mounted on ECU 10b.

[0045] The main device information associated with the master abnormality information indicates, for example, that when abnormality X occurs, log management device 100a operates as the main log management device, and when abnormality Y occurs, log management device 100b operates as the main log management device.

[0046] The main log management device indicated by the main device information is a log management device that belongs to a zone different from the zone to which the ECU 10 in which the abnormality indicated by the master abnormality information occurs belongs. For example, when abnormality Y occurs, a security log is generated in ECUs 10e and 10f. Since both ECUs 10e and 10f belong to zone C, there is a possibility that some abnormality has occurred in zone C or that the ECU 10c in zone C is under a cyberattack. Therefore, there is a possibility that the log management device 100a provided in the ECU 10c in zone C has also occurred an abnormality or is under a cyberattack. Therefore, the reliability of the abnormality detection result by the log management device 100a is questionable, and it is not desirable to analyze logs based on the abnormality detection result output from the log management device 100a to the external device 20. Therefore, in the example of FIG. 5, the log management device 100b in zone D, which is different from zone C, is shown as the main log management device. In this way, by using a log management device 100 that belongs to a zone different from the zone to which the ECU 10 in which the abnormality occurred belongs as the main log management device, even if the reliability of the abnormality detection results by one log management device 100 is in doubt, another log management device 100 that is more reliable can be used as the main log management device.

[0047] Returning to Fig. 4, the log storage unit 103 stores a group of logs generated by the log processing unit 107, which will be described later. Both the master abnormality information storage unit 102 and the log storage unit 103 may be either an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, etc.). They may also be volatile or non-volatile. The same applies to the storage units of each embodiment, which will be described later.

[0048] The abnormality detection unit 105 of the control unit 104 detects an abnormality that has occurred in the ECU 10 based on the security log acquired by the log acquisition unit 101. The abnormality detection unit 105 detects an abnormality by using the master abnormality information stored in the master abnormality information storage unit 102. Specifically, the abnormality detection unit 105 detects an abnormality that has occurred in the ECU 10 by performing a matching process between the log occurrence pattern of the master abnormality information stored in the master abnormality information storage unit 102 and a combination of the security log acquired by the log acquisition unit 101.

[0049] For example, if the log acquisition unit 101 acquires security logs from the ECU 10e and the ECU 10f within a predetermined time, the abnormality detection unit 105 detects that an abnormality Y has occurred in the ECU 10.

[0050] The abnormality detection unit 105 further generates detection result information and outputs the detection result information to the determination unit 106. The detection result information indicates, for example, an abnormality that has occurred in the ECU 10 (for example, abnormality X, abnormality Y, etc.).

[0051] As described above, each log management device 100 has the same configuration and performs the same processing. However, the time set for the anomaly detection unit 105 to detect an anomaly may be changed depending on the zone to which the ECU 10 that generated the security log belongs.

[0052] For example, when detecting an abnormality based on a security log (corresponding to a "first log") acquired from an ECU 10 that belongs to the same zone as the zone to which the log management device 100 belongs, the abnormality detection unit 105 detects the abnormality based on one or more security logs acquired within a first time period (e.g., 10 seconds) after the log acquisition unit 101 acquires the security log. On the other hand, when detecting an abnormality based on a security log (corresponding to a "second log") acquired from an ECU 10 that belongs to a zone different from the zone to which the log management device 100 belongs, the abnormality detection unit 105 detects the abnormality based on one or more security logs acquired within a second time period (e.g., 5 seconds) after the log acquisition unit 101 acquires the security log. Here, the second time period may be set to be shorter than the first time period, i.e., the first time period may be set to be longer than the second time period. By setting the first time period to be longer than the second time period in this manner, the log management device 100 can perform more detailed abnormality detection for security logs of ECUs 10 that belong to the same zone than for security logs of ECUs 10 that belong to different zones.

[0053] The determination unit 106 determines whether the log management device 100 in which the determination unit 106 is provided is the main log management device "based on" the main device information. Specifically, the determination unit 106 determines whether the log management device 100 is the main log management device based on the main device information associated with the master abnormality information corresponding to the abnormality indicated by the detection result information output from the abnormality detection unit 105. The determination result by the determination unit 106 is then output to the log processing unit 107.

[0054] Here, "determining based on" the main device information not only means making a determination by referring to the contents of the main device information, but also includes making a determination based on whether or not the main device information is stored in the storage unit.

[0055] 5, when the detection result information indicates an abnormality X, the main device information associated with the master abnormality information corresponding to the abnormality X indicates the log management device 100a. Therefore, the determination unit 106 of the log management device 100a determines that its own log management device 100a is the main log management device. In contrast, the determination unit 106 of the log management device 100b determines that its own log management device 100b is not the main log management device.

[0056] If the determination result output from the determination unit 106 indicates that the log management device 100 is the main log management device, the log processing unit 107 aggregates security logs related to the abnormality detected by the anomaly detection unit 105 from among the security logs acquired by the log acquisition unit 101 to generate a log group and stores the log group in the log storage unit 103. The security logs related to the abnormality may be logs corresponding to a log occurrence pattern as well as logs that do not correspond to a log occurrence pattern, or logs acquired within a predetermined time period set by the anomaly detection unit 105 for detecting the abnormality. Furthermore, in addition to the contents of the logs acquired by the log acquisition unit 101, the log group may further include, for example, a log management device ID indicating the log management device 100 functioning as the main log management device, a table ID indicating the table used by the anomaly detection unit 105 to detect the abnormality, an abnormality ID indicating the abnormality detected by the anomaly detection unit 105, and the like.

[0057] On the other hand, if the determination result output from the determining unit 106 indicates that the log management device 100 is not the main log management device, the log processing unit 107 discards the log acquired by the log acquiring unit 101.

[0058] The transmission unit 108 outputs the log group stored in the log storage unit 107 to the external device 20. When the log management device 100 is provided in an ECU that does not have a function for communicating with the outside, the log management device 100 outputs the log group to the external device 20 via the external communication ECU 10b. Note that the transmission unit 108 may output the log group to the external device 20 without storing it in the log storage unit 107.

[0059] In the present embodiment, it is assumed that the transmission unit 108 transmits the log group to the external device 20 via the wireless communication network immediately after the log group is stored in the log storage unit 103. However, if the communication conditions of the wireless communication network are not good, the transmission unit 108 may store the log group in the log storage unit 103, and transmit the log group to the external device 20 when the communication conditions improve or when the electronic control system S and the external device 20 are connected by wired communication. Alternatively, the transmission unit 108 may transmit the log group stored in the log storage unit 103 when the power of the vehicle is turned off.

[0060] In each embodiment, a configuration will be described in which, when the log management device 100 is not the main log management device, the log processing unit 107 does not generate a log group and discards the security log acquired by the log acquisition unit 101. However, even when the log management device 100 is not the main log management device, the log processing unit 107 may generate a log group and store the log group in the log storage unit 107. However, even in this case, the generated log group is not sent to the external device 20. This is to prevent duplicate log groups from being sent to the external device 20, since the main log management device is sending the log group to the external device 20.

[0061] Furthermore, in each embodiment, a configuration will be described in which the anomaly detection unit 105 generates a log group by aggregating logs used to detect an anomaly and transmits the log group to the external device 20. However, even when the anomaly detection unit 105 does not detect an anomaly, the transmission unit 108 may transmit a log group in which security logs are aggregated to the external device 20. In this case, as with logs related to an anomaly, the main log management device 100 transmits the log group to the external device 20. The main log management device that transmits the log group when no anomaly is detected is the log management device 100 that was determined to be the main log management device immediately before that. Alternatively, a log management device 100 may be set to be the main log management device by default, and if no anomaly is detected for a predetermined period of time, the default log management device 100 may operate as the main log management device.

[0062] When the determining unit 104 determines that the log management device is not the main log management device, the detection result output unit 109 outputs the detection result information generated by the abnormality detecting unit 105 to the log management device 100, which is the main log management device.

[0063] The detection result acquisition unit 110 acquires detection result information (corresponding to "first detection result information") output from another log management device 100. As described above, when a log management device 100 determines that its own log management device 100 is not the master log management device, it outputs the detection result information to the main log management device from the detection result output unit 109. Therefore, when it is determined that the log management device 100 is the main log management device, the detection result acquisition unit 110 acquires detection result information from the other log management device 100.

[0064] If the determination unit 106 determines that the log management device is the main log management device, the comparison unit 111 compares the detection result information (corresponding to the "second detection result information") generated by the abnormality detection unit 105 with the detection result information acquired from the other log management device 100.

[0065] Here, when the detection result information generated by the anomaly detection unit 105 is compared with the detection result information acquired from the other log management device 100 and the detection results are different, the transmission unit 108 transmits the comparison result information indicating the comparison result together with the log group or separately from the log group to the external device 20. The comparison result information may include, for example, information indicating that the detection results are different, the detection result information of the other log management device 100, identification information of the other log management device 100, etc.

[0066] If the comparison by the comparison unit 111 shows that the detection result information is different, it is highly likely that the other log management device 100 is in a state where it cannot normally detect an abnormality. Therefore, the comparison result is transmitted to the external device 20, and a notice is sent that the other log management device 100 is in a state where it cannot detect an abnormality. Note that, if the detection result information is the same, the transmission unit 108 may transmit a comparison result indicating that the detection result information is the same to the external device 20.

[0067] (2) Operation of the Log Management Device 100 Next, the operation of the log management device 100 will be described with reference to Figures 6 and 7. Figures 6 and 7 not only show the log management method executed by the log management device 100, but also show the processing procedure of a log management program that can be executed by the log management device 100. These processes are not limited to the order shown in Figures 6 and 7. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a certain step uses the result of the previous step. The same applies to the diagrams showing the log management methods of the embodiments described below.

[0068] FIG. 7 shows the operation of each of the plurality of log management devices 100, and illustrates the case where the log management device 100a is the main log management device.

[0069] The log acquisition unit 101 acquires a security log from a security sensor mounted in each ECU 10 (S101). The abnormality detection unit 105 detects an abnormality that has occurred in the ECU 10 using the master abnormality information based on the security log acquired in S101 (S102). If the abnormality detection unit 105 detects an abnormality (S102: Y), the abnormality detection unit 105 generates detection result information (S103). Next, the determination unit 106 determines whether its own log management device 100 is the main log management device based on the main device information associated with the master abnormality information corresponding to the abnormality indicated by the detection result information generated in S103 (S104). If it is determined that its own log management device 100 is not the main log management device (S105: N), the log processing unit 107 discards the security log acquired by the log acquisition unit 101 (S106). Then, the detection result output unit 109 outputs the detection result information generated in S103 to the main log management device (S107).

[0070] On the other hand, if it is determined in S105 that its own log management device 100 is the main log management device (S105: Y), the log processing unit 107 generates a log group and stores it in the log storage unit 103 (S108). Then, the transmitting unit 108 transmits the log group stored in the log storage unit 103 to the external device 20 (S109). The detection result acquisition unit 110 acquires the detection result information output from the other log management devices 100 (S110). The comparison unit 111 compares the detection result information generated in S103 with the detection result information acquired in S110 (S111). If the detection result information is different as a result of comparing the detection result information in S111 (S112: N), the transmitting unit 108 transmits the comparison result to the external device 20 (S113).

[0071] (3) Summary According to this embodiment, the log management system has multiple log management devices and acquires logs from each ECU, so that even if one log management device may be subject to a cyber attack, other log management devices can collect logs and send them to an external device. Furthermore, even if the log management device may have been subjected to a cyber-attack and the reliability of the abnormality detection results of the log management device is in doubt, other log management devices that are unlikely to have been subjected to a cyber-attack can detect the abnormality and send the abnormality detection results to an external device, thereby making it possible to maintain the abnormality detection function of the log management system as a whole.

[0072] 3. Embodiment 2 In the first embodiment, a configuration was described in which it is determined whether or not a log management device is the main log management device by using the detection result by the abnormality detection unit 105. In this embodiment, a configuration in which it is determined whether or not a log management device is the main log management device without using the detection result by the abnormality detection unit 105 will be described, focusing on the differences from the first embodiment.

[0073] (1) Configuration of the Log Management Device 200 An example of the configuration of the log management device 200 in this embodiment will be described with reference to Fig. 8. The log management device 200 includes a main device information receiving unit 201 and a main device information saving unit 202 in addition to the components of the log management device 100 in the first embodiment.

[0074] The main device information receiving unit 201 (corresponding to the "receiving unit") receives main device information from a device other than the log management device 200. In this embodiment, the main device information receiving unit 108 will be described taking as an example a case where it receives main device information from the external device 20, but instead of the external device 20, it may also receive main device information from another device mounted on the vehicle.

[0075] The main device information storage unit 202 (corresponding to a "storage unit") stores the main device information received by the main device information receiving unit 201. In the first embodiment, the main device information was stored in the master abnormality information storage unit 102 in association with the master abnormality information. However, in this embodiment, the main device information may be stored without being associated with the master abnormality information. Therefore, although the master abnormality information storage unit 102 and the main device information storage unit 202 are illustrated in FIG. 8 as different storage units, the main device information and the master abnormality information may be stored in the same storage unit, as in the first embodiment.

[0076] The main device information is, for example, information that identifies the log management device 200 that is the main log management device among the multiple log management devices 200 (a, b, ... n) that the log management system 1 has, and all of the log management devices 200 in the log management system 1 receive the main device information transmitted from the external device 20. Alternatively, the main device information may be information that indicates that the log management device having the main device information is the main log management device. In this case, only the log management device 200 that functions as the main log management device receives the main device information.

[0077] Furthermore, the main device information may directly or indirectly indicate the main log management device. Main device information that indirectly indicates the main log management device is, for example, information that notifies the occurrence of a specific abnormality. In this example, as in the first embodiment, master abnormality information and information that indicates the log management device that will become the main log management device are stored in association with each other. As an example, master abnormality information that indicates a specific abnormality V and information that indicates the log management device 200a are stored in association with each other. Then, when the main device information receiving unit 201 receives main device information that notifies the occurrence of the abnormality V, the log management device 200a that is associated with the master abnormality information that corresponds to the abnormality V becomes the main log management device.

[0078] The determination unit 106 of this embodiment determines whether its own log management device 200 is the main device information based on the main device information stored in the main device information storage unit 202. In a configuration in which only the log management device 200 operating as the main log management device receives the main device information, the determination unit 106 may determine whether its own log management device 200 is the main log management device based on whether the main device information is stored in the main device information storage unit 202.

[0079] (2) Operation of the Log Management Device 200 Next, the operation of the log management device 200 regarding the acquisition of main device information will be described with reference to FIG. The main device information receiving unit 201 acquires main device information from the external device 20 (S201). The main device information storage unit 202 stores the main device information acquired in S201 (S202).

[0080] The processing performed by the log management device 200 of this embodiment after acquiring the security log is basically the same as the operation of the log management device 100 shown in Fig. 6. However, in this embodiment, when the determination unit 106 determines the main log management device in S104, it determines the main log management device based on the main device information acquired in S201.

[0081] (3) External device 20 In this embodiment, the external device 20 transmits main device information to the log management device 200. The external device 20 determines the log management device 200 that will operate as the main log management device based on, for example, the detection and analysis results of a cyber attack, generates main device information indicating the determined log management device 200 as the main log management device, and transmits the main device information to the log management device 200.

[0082] For example, assume that the external device 20 discovers a vulnerability in an ECU 10 that constitutes the electronic control system S based on a group of logs transmitted from a large number of vehicles. In this case, the ECU 10 in which the vulnerability was discovered is at high risk of being subjected to a cyber-attack. Therefore, if this ECU 10 has the function of the log management device 200, there is a risk that abnormalities will not be detected correctly if this log management device 200 is designated as the main log management device. Therefore, the external device 20 generates main device information that indicates a log management device other than the ECU 10 in which the vulnerability was discovered (i.e., the log management device) as the main log management device, and transmits this main device information to the log management system 1.

[0083] In this embodiment, the case where the device that transmits the main device information to the log management device 200 is the external device 20 installed outside the vehicle is described as an example. However, instead of the external device 20, a device installed in the vehicle may analyze the cyber-attack and transmit the main device information to the log management device 200.

[0084] (4) Summary In this embodiment, a plurality of log management devices determine the main log management device based on main device information received from devices other than the log management devices. According to this embodiment, by determining the main log management device based on main device information generated based on the analysis results of logs from external devices, etc., it is possible to designate a log management device other than a log management device that is likely to malfunction or be subject to a cyber attack as the main log management device in advance, thereby preventing a high-risk log management device from becoming the main log management device.

[0085] 4. Embodiment 3 In this embodiment, a configuration will be described in which a main log management device is determined based on the alive-or-dead monitoring log.

[0086] The log management device 300 of this embodiment acquires a life-or-death monitoring log in addition to a security log from a security sensor mounted on the ECU 10. The life-or-death monitoring log is a log that is periodically generated regardless of whether an event occurs, as long as the security sensor, and therefore the ECU 10, is operating. The life-or-death monitoring log is also called a heartbeat log.

[0087] (1) Log management device configuration An example of the configuration of the log management device 300 of this embodiment will be described with reference to FIG. The log acquisition unit 101 of this embodiment periodically acquires a health monitoring log indicating that the ECU 10 is operating, in addition to a security log that is generated when a security sensor detects an event.

[0088] The main device information storage unit 301 of this embodiment stores main device information, similar to embodiment 2. The main device information of this embodiment indicates the main log management device when an ECU 10 belonging to a specific zone (corresponding to the "first zone") among multiple zones is not operating. Here, the zone to which the main log management device belongs is a zone (corresponding to the "second zone") different from the specific zone.

[0089] If an ECU 10 belonging to a certain zone is not operating normally, the entire zone may be subject to a cyber-attack. Therefore, by designating a log management device 300 belonging to a zone different from the zone to which the ECU 10 that has not received the alive management log belongs as the main log management device, the log management device 300 that may have been subject to a cyber-attack is prevented from becoming the main log management device.

[0090] FIG. 11 is a diagram illustrating an example of main device information according to this embodiment. In FIG. 11, an inactive ECU 10, the zone to which the ECU 10 belongs, and the main device information are stored in association with each other. In the example illustrated in FIG. 11, when an ECU (10c, 10e) belonging to zone C is not operating, the main device information indicates that the log management device 300b belonging to zone D, not the log management device 300a belonging to zone C, is the main log management device. On the other hand, when an ECU 10d belonging to zone D is not operating, the main device information indicates that the log management device 300a belonging to zone C, not the log management device 300b belonging to zone D, is the main log management device. Therefore, for example, when the log acquisition unit 101 of the log management device 300 does not acquire an alive-or-dead monitoring log from the ECU 10d belonging to zone D, the determination unit 106 of the log management device 300a determines that the log management device is the main log management device, and the determination unit 106 of the log management device 300b determines that the log management device is not the main log management device.

[0091] (2) Operation of the Log Management Device 300 The processing performed by the log management device 300 of this embodiment after acquiring the security log is basically the same as the operation of the log management device 100 shown in Fig. 6. However, in this embodiment, when the determination unit 106 determines the main log management device in S104, the determination unit 106 determines the main log management device based on the main device information associated with the ECU 10 for which the alive-or-dead monitoring log has not been acquired.

[0092] (3) Summary According to this embodiment, a log management device that belongs to a zone different from the zone to which the ECU that has not received the alive management log belongs is designated as the main log management device, thereby preventing a log management device that may have been subjected to a cyber attack from becoming the main log management device.

[0093] 5. Embodiment 4 In this embodiment, a configuration will be described in which a main log management device is determined depending on the load status of the log management device.

[0094] (1) Log management device configuration An example of the configuration of a log management device 400 according to an embodiment will be described with reference to Fig. 12. The control unit 104 of the log management device 400 implements a load measurement unit 401. In addition to the same components as those in the first and second embodiments, the log management device 400 also includes a load information output unit 402 and a load information acquisition unit 403. Unlike the first to third embodiments, the detection result output unit 109, the detection result acquisition unit 110, and the comparison unit 111 are omitted in Fig. 12. However, the log management device 400 according to this embodiment may include these components, similar to the log management devices 100, 200, and 300.

[0095] The load measurement unit 401 measures the processing load (for example, CPU load) in the log management device 400 and the load of the in-vehicle communication network to which the log management device 400 is connected, and generates load information. These loads are collectively defined as the load of the log management device 400.

[0096] The load information output unit 402 outputs the load information generated by the load measurement unit 401 to the other log management devices 400 .

[0097] The load information acquisition unit 403 acquires, from the other log management devices 400, load information indicating the load of the other log management devices 400.

[0098] The main device information storage unit 404 of this embodiment stores main device information, as in embodiments 2 and 3. However, the main device information of this embodiment indicates a main log management device when the load of one of the multiple log management devices 400 that the log management system 1 has is "equal to or greater than" a predetermined threshold.

[0099] Here, "greater than or equal to" includes both cases where the value is the same as the comparison target and cases where it is not.

[0100] 13 is a diagram showing an example of main device information according to this embodiment. In FIG. 13, high-load device information indicating log management devices whose load is equal to or greater than a predetermined threshold is stored in association with main device information. Here, the log management device indicated by the high-load device information and the log management device indicated by the main device information are different log management devices.

[0101] 13 shows that when the load on log management device 400a is equal to or greater than a predetermined threshold, log management device 400b becomes the main log management device, and when the load on log management device 400b is equal to or greater than the predetermined threshold, log management device 400a becomes the main log management device. Therefore, for example, when load information acquisition unit 403 of log management device 400a acquires load information indicating a load equal to or greater than a predetermined threshold from log management device 400b, determination unit 106 of log management device 400a determines that log management device 400a is the main log management device.

[0102] However, if the load measured by the load measurement unit 401 is equal to or greater than a predetermined threshold, the load on the log management device 400 itself is also high, and therefore it is desirable that the log management device 400 not function as the main log management device regardless of the information indicated by the main device information. Therefore, in this case, another log management device 400c (not shown) with a load lower than the predetermined threshold functions as the main log management device. Alternatively, of multiple log management devices 400 with loads equal to or greater than a predetermined threshold, the log management device 400 with the lowest load may be set as the main log management device.

[0103] (2) Operation of the Log Management Device 400 The processing performed by the log management device 400 of this embodiment after acquiring the security log is basically the same as the operation of the log management device 100 shown in Fig. 6. However, in this embodiment, when the determination unit 106 determines the main log management device in S104, it determines whether the load indicated by the load information of the log management device 400 itself and the load information of the other log management devices 400 acquired by the load information acquisition unit 403 is equal to or greater than a predetermined threshold, and if the load is equal to or greater than the predetermined threshold, it determines the main log management device based on the main device information associated with the log management device whose load is equal to or greater than the predetermined threshold.

[0104] (3) Summary The main log management device performs processes such as generating log groups, transmitting log groups to external device 20, and comparing detection results, and therefore has a higher processing load than other log management devices. Therefore, when log management device 400 with a high processing load operates as the main log management device, the processing load of the log management device increases further. Therefore, in this embodiment, when the load on a log management device is equal to or greater than a predetermined threshold, a log management device other than the log management device with the high load is designated as the main log management device, thereby preventing the load from concentrating on a specific log management device.

[0105] 6. Summary The features of the log management device and the like in each embodiment of the present invention have been described above.

[0106] The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0107] The block diagrams used to explain the embodiments classify and organize the device configuration by function. The blocks representing each function can be realized by any combination of hardware or software. Furthermore, because they represent functions, the block diagrams can also be understood as disclosures of method inventions and program inventions that realize the methods.

[0108] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints, such as one step utilizing the results of another step that precedes it.

[0109] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish between two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0110] The following are examples of the configuration of the log management device of the present invention. Examples of the component include semiconductor elements, electronic circuits, modules, and microcomputers. Examples of semi-finished products include an electronic control unit (ECU) and a system board. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0111] Furthermore, necessary functions such as an antenna and a communication interface may be added to the log management device.

[0112] The present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a combination of a program for realizing the present invention recorded on a recording medium such as a memory or hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory that can execute the program.

[0113] A program stored in a non-transitory physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0114] The log management device of the present invention is primarily intended for log management devices that manage logs generated by electronic control systems installed in automobiles, but may also be intended for log management devices that manage logs generated by general-purpose electronic control systems that are not installed in automobiles. [Explanation of symbols]

[0115] 100, 200, 300, 400 log management device, 101 log acquisition unit, 102, 202, 301, 404 storage unit, 106 determination unit, 108 transmission unit

Claims

1. A log management device (100, 200, 300, 400) mounted on a moving body and acquiring logs from an electronic control device together with other log management devices, a log acquisition unit (101) that acquires a log from the electronic control device; a storage unit (102, 202, 301, 404) for storing main device information indicating a main log management device, which is a log management device that transmits logs to the outside of the mobile body, among the log management device and the other log management devices; a determination unit (106) that determines whether the log management device is the main log management device based on the main device information; a transmitting unit (108) that transmits the log to an outside of the mobile unit; Equipped with When the determination unit determines that the log management device is the main log management device, the transmission unit transmits the log to an outside of the mobile object; If the determination unit determines that the log management device is not the main log management device, the transmission unit does not transmit the log to an outside of the mobile object. Log management device.

2. The log management device further includes an abnormality detection unit (105) that detects an abnormality that has occurred in the electronic control device based on the log and generates detection result information, The transmission unit transmits a log related to the abnormality. The log management device according to claim 1.

3. the storage unit stores the main device information in association with master abnormality information indicating an abnormality predicted to occur in the electronic control unit; the determination unit determines whether the log management device is the main log management device based on the main device information associated with the master abnormality information to which the abnormality indicated by the detection result information corresponds.

3. The log management device according to claim 2.

4. the mobile body is equipped with an electronic control system that is composed of a plurality of the electronic control devices and has a plurality of zones that are divided according to the functions or locations of the electronic control devices; the log management device and the other log management device each belong to one of the plurality of zones, The main log management device indicated by the main device information belongs to a zone different from a zone to which the electronic control device in which the abnormality occurred belongs.

4. The log management device according to claim 3.

5. The log management device further includes a detection result output unit (109) that outputs the detection result information to the main log management device indicated by the main device information when the determination unit determines that the log management device is not the main log management device.

3. The log management device according to claim 2.

6. The log management device further comprises: a detection result acquisition unit (110) that acquires, from the other log management device, first detection result information that is detection result information generated by the other log management device when the determination unit determines that the log management device is the main log management device; a comparison unit (111) that compares the first detection result information with second detection result information that is the detection result information generated by the abnormality detection unit, the transmitting unit, when the first detection result information and the second detection result information are different as a result of the comparison by the comparing unit, transmits comparison result information indicating the comparison result by the comparing unit to an outside of the moving object.

6. The log management device according to claim 5.

7. The log management device further includes a receiving unit (201) for receiving the main device information, The storage unit stores the main device information received by the receiving unit. The log management device according to claim 1.

8. the mobile body is equipped with an electronic control system that is composed of a plurality of the electronic control devices and has a plurality of zones that are divided according to the functions or locations of the electronic control devices; the log management device and the other log management device each belong to one of the plurality of zones, The log acquisition unit further periodically acquires a health monitoring log from the electronic control unit, the main device information indicates the main log management device when the electronic control device belonging to a first zone among the plurality of zones is not operating, and the main log management device belongs to a second zone different from the first zone; the determination unit determines whether the log management device is the main log management device based on the main device information when the log acquisition unit has not acquired the alive monitoring log from the electronic control device. The log management device according to claim 1.

9. the log management device further comprises a load information acquisition unit (403) that acquires load information indicating a load of the other log management device from the other log management device; the main device information indicates the main log management device when a load of one of the log management devices, the log management device in question and the other log management devices, is equal to or greater than a predetermined threshold; the determining unit determines whether the log management device is the main log management device based on the main device information when the load indicated by the load information is equal to or greater than the predetermined threshold. The log management device according to claim 1.

10. The log management device further comprises a load measurement unit (401) that measures the load of the log management device; the determining unit determines that the log management device is not the main log management device regardless of the main device information when the load measured by the load measuring unit is equal to or greater than the predetermined threshold.

10. The log management device according to claim 9.

11. the transmission unit transmits the log via a communication device that communicates with an outside of the mobile object; the log management device is provided in a secure area, the communication device is located in a non-secure domain; The log management device according to claim 1.

12. When the log is a first log acquired from the electronic control device that belongs to the same zone as the log management device, the abnormality detection unit detects an abnormality based on one or more logs acquired within a first time period after the log acquisition unit acquires the first log, When the log is a second log acquired from the electronic control device that belongs to a different zone from the log management device, the abnormality detection unit detects the abnormality based on one or more logs acquired within a second time period that is shorter than the first time period after the log acquisition unit acquires the second log.

5. The log management device according to claim 4.

13. A log management method executed by a log management device (100, 200, 300, 400) that is mounted on a moving body and acquires logs from an electronic control device together with other log management devices, comprising: the log management device includes a storage unit (102, 202, 301, 404) for storing main device information indicating a main log management device, which is a log management device that transmits a log to an outside of the mobile object, among the log management device and the other log management devices; A log is acquired from the electronic control unit (S101). Based on the main device information, it is determined whether the log management device is the main log management device (S104); If the log management device is determined to be the main log management device, the log management device transmits the log to an outside of the mobile unit (S109); If it is determined that the log management device is not the main log management device, the log management device does not transmit the log to an outside of the mobile object. Log management methods.

14. A log management program executable by a log management device (100, 200, 300, 400) that is mounted on a moving body and acquires logs from an electronic control device together with other log management devices, the log management device includes a storage unit (102, 202, 301, 404) for storing main device information indicating a main log management device, which is a log management device that transmits a log to an outside of the mobile object, among the log management device and the other log management devices; A log is acquired from the electronic control unit (S101). Based on the main device information, it is determined whether the log management device is the main log management device (S104); If the log management device is determined to be the main log management device, the log management device transmits the log to an outside of the mobile unit (S109); If it is determined that the log management device is not the main log management device, the log management device does not transmit the log to an outside of the mobile object. A log management program that causes the log management device to execute processing.

15. A log management system (1) is mounted on a mobile body and has a first log management device (100a, 200a, 300a, 400a) and a second log management device (100b, 200b, 300b, 400b) that acquire logs from an electronic control device, the first log management device, a first log acquisition unit (101) that acquires a log from the electronic control device; a first storage unit (102, 202, 301, 404) for storing main device information indicating a main log management device that is a log management device that transmits logs to an outside of the mobile object, among a plurality of log management devices provided in the log management system; a first determination unit (106) that determines, based on the main device information, that the first log management device is not the main log management device; Equipped with the second log management device, a second log acquisition unit (101) that acquires the log from the electronic control unit; a second storage unit (102, 202, 301, 404) for storing the main device information indicating the main log management device; a second determination unit (106) that determines that the second log management device is the main log management device based on the main device information; a transmitting unit (108) that transmits the log to an outside of the mobile unit; Equipped with Log management system.

16. A log management method executed in a log management system (1) that is mounted on a mobile body and has a first log management device (100a, 200a, 300a, 400a) and a second log management device (100b, 200b, 300b, 400b) that acquire logs from electronic control devices, comprising: the first log management device and the second log management device each include a storage unit (102, 202, 301, 404) for storing main device information indicating a main log management device that is a log management device that transmits logs to an outside of the mobile object, among a plurality of log management devices provided in the log management system; In the first log management device, A log is acquired from the electronic control unit (S101). Based on the main device information, it is determined that the first log management device is not the main log management device (S104); In the second log management device, The log is acquired from the electronic control unit (S101). Based on the main device information, it is determined that the second log management device is the main log management device (S104); The log is transmitted to the outside of the mobile unit (S109). Log management methods.

Images