Log management device, log management method, and log management program

Abstract

To provide a log management device for preserving, without discarding, logs for which the necessity for analysis by a server device is high until these are transmitted to the server device.SOLUTION: The log management device comprises: a log acquisition unit for acquiring logs generated by a security sensor; a transmission allowability assessment unit for assessing whether or not the logs can be transmitted; a memory which has a first region which is disabled from overwriting the logs and is allocated a first storage capacity and a second region which is enabled for overwriting the logs and is allocated a second storage capacity; a log storage area determination unit which, when assessed by the transmission allowability assessment unit as unable to transmit the logs, determines, as a log storage area, the first region when the importance of the logs is higher than prescribed importance or the second region when said importance is lower than the prescribed importance; and a memory control unit for causing the allocation rate of the log storage area to the storage capacity to increase when the free space of the log storage area is smaller than a data volume and stores the logs in the log storage area.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a log management device that manages logs generated by security sensors and is mounted on a mobile body, as well as a log management method and a log management program executed by the log management device. [Background technology]

[0002] In recent years, technologies for driver assistance and autonomous driving control, including V2X (vehicle-to-everything) such as vehicle-to-vehicle and vehicle-to-infrastructure communications, have been attracting attention. As a result, vehicles are increasingly equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks is increasing.

[0003] When a cyber-attack occurs on a vehicle, there is a risk that the attack may cause a disruption to vehicle control, so it is important to analyze the incident in order to prevent this beforehand or to quickly respond to and recover from the attack. For example, as disclosed in Patent Document 1, it is known that a server device with abundant resources collects and analyzes logs generated by on-board devices. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2019-175017 Summary of the Invention [Problem to be solved by the invention]

[0005] However, if the communication environment between the vehicle and the server device is poor and the log generated by the in-vehicle device cannot be sent to the server device, the in-vehicle device must manage and store the log until it can be sent to the server device.

[0006] If the inability to send logs generated by the in-vehicle device to the server device continues for a long period of time, many logs that should be sent to the server device may accumulate in the memory of the in-vehicle device, and the memory may reach its capacity. As a result, newly acquired logs may be discarded without being saved in the memory, or important logs saved in the memory may be overwritten, making it impossible to collect logs necessary for analyzing incidents such as external attacks.

[0007] Therefore, the present invention aims to realize a log management device, etc., that can properly manage and store logs necessary for analyzing incidents such as external attacks or abnormalities occurring in an in-vehicle device until the logs generated by the in-vehicle device cannot be sent to a server device in a situation where the logs cannot be sent to a server device. [Means for solving the problem]

[0008] The log management device (100, 200) of the present disclosure is a log management device mounted on a mobile body, and includes a log acquisition unit (101) that acquires a log generated by a security sensor mounted on the mobile body, a transmission permission determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body, and a storage area consisting of a first area and a second area, wherein the first area is an area in which overwriting of a first log that is a log stored in the first area is prohibited and a first storage capacity is allocated among the storage capacity of the storage area, and the second area is an area in which overwriting of a second log that is a log stored in the second area is permitted and The log storage device includes: a memory (102) which is an area allocated with a second storage capacity; a log storage area determination unit (106) which, when the transmission possibility determination unit determines that the log cannot be transmitted, determines the importance of the log and determines the first area as the log storage area in which to store the log if the importance is higher than a predetermined importance, or the second area in which the importance is lower than the predetermined importance; and a memory control unit (107) which, when the free space in the log storage area is less than the data amount of the log, increases the allocation ratio of the storage capacity of the log storage area to the storage capacity, and stores the log in the log storage area.

[0009] It should be noted that the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. [Effects of the Invention]

[0010] With the above-described configuration, in a situation where logs generated by an in-vehicle device cannot be sent to a server device, logs that are highly necessary for analysis by the server device can be stored without being damaged until they are sent to the server device. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a log collection system according to each embodiment. [Figure 2] FIG. 1 is a diagram illustrating an example of the configuration of an electronic control system including a log management device according to each embodiment. [Figure 3] FIG. 1 is a block diagram showing an example of the configuration of a log management device according to a first embodiment. [Figure 4] FIG. 1 is a diagram illustrating a memory of a log management device according to first and second embodiments. [Figure 5] FIG. 1 is a diagram illustrating the operation of the log management device according to the first and second embodiments. [Figure 6] FIG. 1 is a diagram illustrating the operation of the log management device according to the first and second embodiments. [Figure 7] FIG. 1 is a diagram illustrating the operation of the log management device according to the first and second embodiments. [Figure 8] FIG. 1 is a diagram illustrating the operation of the log management device according to the first and second embodiments. [Figure 9] FIG. 10 is a block diagram showing an example of the configuration of a log management device according to a second embodiment. [Figure 10] FIG. 10 is a diagram illustrating a memory according to a modified example of each embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] The present invention refers to the inventions described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks refer to the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0014] The configurations and methods recited in the dependent claims are optional configurations and methods in the inventions recited in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods recited in the dependent claims, as well as the configurations and methods recited only in the embodiments without being recited in the claims, are optional configurations and methods in the present invention. The configurations and methods recited in the embodiments when the recitation of the claims is broader than the recitation of the embodiments are also optional configurations and methods in the present invention, in the sense that they are examples of the configurations and methods of the present invention. In either case, by being recited in the independent claims, they become essential configurations and methods of the present invention.

[0015] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention has.

[0016] When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in multiple embodiments may be collected and combined.

[0017] The problem described in the section on the problem to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this fact, together with the configuration and method of the present invention, affirms the inventive step of the invention.

[0018] 1. Configuration common to all embodiments (1) Overall configuration of the log collection system The overall configuration of a log collection system 1 common to all embodiments will be described using Figure 1. The log collection system S is composed of an electronic control system 1 "mounted" on a vehicle, which is a "mobile body," and a server device 2 located outside the vehicle. The electronic control system 1 and the server device 2 communicate via a communication network 3.

[0019] Here, "mobile body" refers to an object that can move at any speed. It also naturally includes cases where the moving body is stationary. Examples include, but are not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these vehicles. "Mounted" includes not only cases where the device is directly fixed to the mobile body, but also cases where the device is not fixed to the mobile body but moves with the mobile body. For example, cases where the device is carried by a person riding on the mobile body, or cases where the device is mounted on cargo placed on the mobile body, are included.

[0020] The configuration of the electronic control system 1 will be described in detail below. In the following embodiments, the electronic control system 1 will be described as an in-vehicle system installed in a vehicle. However, the electronic control system 1 is not limited to an in-vehicle system.

[0021] The server device 2 collects logs from the electronic control system 1 and analyzes cyber attacks and abnormalities that occur in the electronic control system 1. The server device 2 may be, for example, a workstation or a personal computer (PC), but may also be an electronic control unit (ECU), a semiconductor circuit element, a smartphone, a mobile phone, or the like.

[0022] The communication network 3 may be a wireless communication network or a wired communication network. For example, wireless communication standards such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, and 5G can be used. Alternatively, DSRC (Dedicated Short Range Communication) can be used. For example, wired communication standards such as LAN (Local Area Network), the Internet, and fixed telephone lines can be used. The wireless communication network may combine wireless communication and wired communication. For example, the electronic control system 1 and a base station device in a cellular system may be connected via a wireless communication system, and the base station device and the server device 2 may be connected via a wired communication system such as a trunk line of a telecommunications carrier or the Internet.

[0023] (2) Configuration of Electronic Control System 1

[0024] The configuration of the electronic control system 1 will be described with reference to Figure 2. The electronic control system 1 has a central gateway device (hereinafter referred to as CGW) 10, an external communication electronic control unit (hereinafter referred to as external communication ECU) 11, an electronic control unit (hereinafter referred to as ECU) 12, and a network 13 connecting these.

[0025] The CGW 10 is an electronic control device that relays communication between the external communication ECU 11 and the ECU 12, or between the ECUs 12, via the network 13. In each embodiment described below, it is assumed that the CGW 10 functions as a log management device (100, 200). However, any electronic control device that constitutes the electronic control system 1 may have the function of a log management device.

[0026] The external communication ECU 11 is an electronic control unit that communicates with the server device 2 via the communication network 3.

[0027] The ECU 12 is an electronic control unit that realizes various vehicle functions. Any ECU can be assigned to the ECU 12. Examples include a drivetrain electronic control unit that controls the engine, steering, brakes, etc., a body electronic control unit that controls meters, power windows, etc., an information system electronic control unit such as a navigation system, and a safety control system electronic control unit that performs control to prevent collisions with obstacles or pedestrians.

[0028] The ECU 12 is provided with a security sensor that monitors each ECU itself and the communications of each ECU. The security sensor monitors the ECU itself and the communications of the ECU, detects external attacks or abnormalities, and generates a security log (hereinafter, "log"). The log generated by the security sensor includes information indicating the occurrence of an external attack or abnormality. The security sensor may also generate a log indicating that no attack or abnormality has occurred and that the status of the ECU itself or its communications is normal. The log may further include information indicating the time when the security sensor generated the log, and information identifying the security sensor that generated the log or the ECU in which the security sensor is installed. The log generated by the security sensor is transmitted to the CGW 10.

[0029] 2, each ECU 12 may be provided with a log filter that selects logs generated by the security sensor. For example, the log filter selects logs indicating the occurrence of an attack or an abnormality from the logs generated by the security sensor, and transmits only the selected logs to the CGW 10.

[0030] The network 13 is a network that connects the CGW 10, the external communication ECU 11, and the ECU 12. In each of the embodiments described below, the network 13 is an in-vehicle network, and any communication method such as a controller area network (CAN) or a local interconnect network (LIN) can be used.

[0031] 2. First embodiment (1) Configuration of the Log Management Device 100 The configuration of the log management device 100 of this embodiment will be described with reference to Fig. 3. The log management device 100 includes a log acquisition unit 101, a memory 102, a control unit 103, and a transmission unit 104. The control unit 103 also implements a transmission permission determination unit 105, a log storage area determination unit 106, and a memory control unit 107.

[0032] The log management device 100 of this embodiment, which is the CGW 10, can be configured with a general-purpose CPU (Central Processing Unit), volatile memory such as RAM, non-volatile memory such as ROM, flash memory, or hard disk, various interfaces, and an internal bus connecting these. By executing software on this hardware, the log management device 100 can be configured to perform the functions of each functional block shown in Fig. 3. Of course, the log management device 100 may also be realized by dedicated hardware such as an LSI.

[0033] In this embodiment, the log management device 100 is assumed to be in the form of an electronic control unit (ECU (Electric Control Unit), hereinafter abbreviated as ECU) as a semi-finished product, but is not limited to this. For example, components may be in the form of a semiconductor circuit or a semiconductor module, and finished products may be in the form of a personal computer (PC), a smartphone, a mobile phone, or a navigation system.

[0034] The log acquisition unit 101 acquires logs generated by security sensors provided in each ECU 12. Although not shown in Fig. 3, the logs acquired by the log acquisition unit 101 may be stored in a buffer (not shown) and then saved in a memory 102 (described later) or transmitted from a transmission unit 104.

[0035] The memory 102 stores the logs acquired by the log acquisition unit 101. The memory 102 described in the following embodiments is assumed to be a non-volatile memory, but may be configured as a volatile memory.

[0036] 4 is a diagram illustrating the outline of the memory 102. The memory 102 has a storage area A having a predetermined storage capacity. This storage area A is an area consisting of a first area A1 and a second area A2, and stores the logs acquired by the log acquisition unit 101.

[0037] The first area A1 is allocated a first storage capacity out of the storage capacity of the storage area A. The first storage capacity is determined by the allocation ratio of the first area A1 to the storage capacity of the storage area A. Overwriting of the log stored in the first area A1 (corresponding to the "first log") is prohibited.

[0038] The second area A2 is allocated a second storage capacity out of the storage capacity of the storage area A. The second storage capacity is determined by the allocation ratio of the second area A2 to the storage capacity of the storage area A. It is possible to overwrite the log stored in the second area A2 (corresponding to the "second log").

[0039] Here, the allocation ratio of the storage capacity of the storage area A to the first area A1 and the allocation ratio of the storage capacity of the storage area A to the second area A2 can be changed to any value. The allocation ratios to the first area A1 and the second area A2 are controlled by the memory control unit 107, which will be described later. Note that the memory control unit 107 may change the allocation ratios to the first area A1 and the second area A2 of the storage capacity of the storage area A by changing the storage capacity [Byte] allocated to the first area A1 and the second area A2 from the predetermined storage capacity.

[0040] When the allocation rate to the first area A1 is increased, the allocation rate to the second area A2 is decreased accordingly. For example, Fig. 4a shows a case where the allocation rate to the first area A1 of the storage capacity of the storage area A is 50% and the allocation rate to the second area A2 is 50%. In contrast, Fig. 4b shows a case where the allocation rate to the first area A1 of the storage capacity of the storage area A is 70% and the allocation rate to the second area A2 is 30%.

[0041] 4 illustrates an example in which memory 102 has only storage area A as an area for storing logs. However, memory 102 may naturally have an area other than storage area A in which data can be stored, and logs acquired by log acquisition unit 101 or data other than logs may be stored in this area. In other words, the storage capacity of storage area A is not necessarily equal to the storage capacity of memory 102.

[0042] Control unit 103 controls the operations of log acquisition unit 101, memory 102, and transmission unit 104. Control unit 103 also realizes transmission permission determination unit 105, log storage area determination unit 106, and memory control unit 107 by itself.

[0043] The transmission possibility determination unit 105 determines whether the log acquired by the log acquisition unit 101 can be transmitted to the server device 2 located outside the vehicle. For example, the transmission possibility determination unit 105 determines whether the communication network 3 between the external communication ECU 11 and the server device 2 is established or whether the communication speed between the external communication ECU 11 and the server device 2 is equal to or higher than a predetermined speed, and determines that transmission is not possible if the communication network 3 is not established or the communication speed is equal to or lower than the predetermined speed. Alternatively, even if the communication network 3 is established, if the log acquisition unit 101 acquires a large number of logs, the transmission unit 104 (described later) cannot immediately transmit all of the logs to the server device 2. Therefore, the transmission possibility determination unit 105 may determine that the log cannot be transmitted even if the log acquisition unit 101 acquires more logs than a predetermined number or data volume.

[0044] If the transmission permission determining unit 105 determines that the log cannot be transmitted, the log storage area determining unit 106 determines the "importance" of the log.

[0045] Here, "importance" is an indicator of the importance of a log determined based on predetermined evaluation criteria, and may be expressed numerically or may be expressed using multiple pre-classified levels.

[0046] Furthermore, if the determined importance of the log is "higher" than a "predetermined" importance, the log storage area determination unit 106 determines a first area A1 of the storage area A in the memory 102 as the log storage area in which to store the log. On the other hand, if the determined importance of the log is "lower" than a "predetermined" importance, the log storage area determination unit 106 determines a second area A2 of the storage area A as the log storage area in which to store the log.

[0047] Here, "predetermined" includes not only the case where it is always constant, but also the case where it is uniquely determined depending on conditions. The term "than" includes both cases where the value is the same as the value of the comparison target and cases where the value is not the same as the value of the comparison target.

[0048] In the following example, the log storage area determination unit 106 determines whether the importance of a log is high or low, and if it determines that the importance of a log is high, it determines that the importance is higher than a predetermined importance, and if it determines that the importance of a log is low, it determines that the importance is lower than the predetermined importance. However, the log storage area determination unit 106 may also determine the importance of a log as a numerical value based on various parameters, and determine whether the determined numerical value is higher or lower than a numerical value set as the predetermined importance.

[0049] For example, if a log indicates that an external attack or an abnormality has occurred in an ECU or communication, the log storage area determination unit 106 determines that the importance of the log is high.

[0050] As another example, the log storage area determination unit 106 determines the importance of a log based on the security sensor that generated the log. From the perspective of safe vehicle operation, it is undesirable for an ECU that implements a function related to vehicle operation (e.g., a function related to braking or steering the vehicle) to be attacked from the outside or for an abnormality to occur, and therefore there is a high need to analyze the log generated by the security sensor provided in such an ECU. Therefore, the log storage area determination unit 106 determines that a log generated by a specific ECU, for example, a security sensor provided in an ECU that implements a function related to vehicle operation, is of high importance. The log storage area determination unit 106 can identify the security sensor that generated the log and the ECU that includes the security sensor based on the identification information of the security sensor included in the log.

[0051] As yet another example, the log storage area determination unit 106 determines the importance of a log based on the time the log was generated. For example, if a security sensor detects an external attack, it may be possible to analyze the attack path, details of the attack, and the impact of the attack by analyzing logs generated before and after the attack was detected. Therefore, the log storage area determination unit 106 determines that logs generated within a predetermined time from the time the security sensor detected the attack or abnormality are of high importance. The log storage area determination unit 106 can determine the time the log was generated based on time information included in the log.

[0052] In all of the above examples, the log storage area determination unit 106 determines the importance level based on information contained in the log. However, a security sensor provided in each ECU 12 may determine the importance level of the log itself and assign the determined importance level to the log. In this case, the log storage area determination unit 106 can determine the importance level of the log using the importance level assigned to the log.

[0053] The memory control unit 107 stores the logs in the log storage area determined by the log storage area determination unit 106. Here, the memory control unit 107 compares the free space in the log storage area with the amount of log data acquired by the log acquisition unit 101. If the free space in the log storage area is less than the amount of log data, the memory control unit 107 increases the allocation ratio of the storage capacity to the log storage area relative to the storage capacity of storage area A, thereby ensuring capacity for storing logs.

[0054] A specific example of memory control by memory control unit 107 will be described below. First, a case will be described in which the importance of the log is higher than a predetermined importance and log storage area determination unit 106 determines first area A1 as the log storage area.

[0055] If the free space in the first area A1 is larger than the amount of log data, the memory control unit 107 stores the log in the first area A1, which is a log storage area.

[0056] On the other hand, if the free space in the first area A1 is less than the amount of log data, the log cannot be saved in the first area A1. Furthermore, because overwriting of logs is prohibited in the first area A1, it is also not possible to save a log by overwriting a log saved in the first area A1. Therefore, the memory control unit 107 compares the free space in the second area A2, which is not a log saving area, with the amount of log data. If the free space in the second area A2 is greater than the amount of log data, the memory control unit 107 secures free space for saving logs in the first area A1 by increasing the allocation ratio of the storage capacity of the first area A1 to the storage capacity of the storage area A. Then, the log is saved in the first area A1, to which the increased storage capacity has been allocated. Note that the allocation ratio of the storage capacity of the second area A2 is reduced.

[0057] Furthermore, if the free space in the second area A2 is less than the amount of log data, the memory control unit 107 cannot increase the allocation rate to the storage capacity of the first area A1. Therefore, the memory control unit 107 first deletes one or more logs stored in the second area A2. This creates free space in the second area A2. Next, the memory control unit 107 secures free space for storing logs in the first area A1 by increasing the allocation rate to the storage capacity of the first area A1 relative to the storage capacity of the storage area A. Then, the logs are stored in the first area A1 to which the increased storage capacity has been allocated. In this case, by deleting the logs stored in the second area A2 and increasing the allocation rate to the first storage capacity, logs of higher importance than the deleted logs are stored.

[0058] Here, it is desirable that the memory control unit 107 deletes the logs stored in the second area A2 starting from the log that was generated by the security sensor, that is, the log that contains the oldest time information.

[0059] Note that the time information of the logs acquired by the log acquisition unit 101 may be older than the time information of the logs stored in the second area A2. As shown in FIG. 2, the log management device 100, which is the CGW 10, collects logs generated by security sensors provided in multiple ECUs via the network 13. Therefore, depending on the network congestion, the log acquisition unit 101 may acquire each log in an order different from the order in which the logs were generated by the security sensors. In other words, there is a possibility that logs generated after the logs acquired by the log acquisition unit 101 have already been stored in the memory 102. In such a case, it is not desirable to delete logs with newer time information. Therefore, the logs to be deleted from the second area A2 are logs with time information older than the logs acquired by the log acquisition unit 101. Furthermore, if the time information of all the logs stored in the second area A2 is newer than the time information included in the logs acquired by the log acquisition unit 101, the memory control unit 107 may discard the logs acquired by the log acquisition unit 101 without saving them.

[0060] Next, a case will be described in which the importance of the log is lower than a predetermined importance and the log storage area determination unit 106 determines the second area A2 as the log storage area.

[0061] If the free space in the second area A2 is larger than the amount of log data, the memory control unit 107 stores the log in the second area A2, which is a log storage area.

[0062] On the other hand, if the free space in the second area A2 is less than the amount of log data, the log cannot be stored in the second area A2. Therefore, the memory control unit 107 compares the free space in the first area A1, which is not a log storage area, with the amount of log data. If the free space in the first area A1 is greater than the amount of log data, the memory control unit 107 secures free space for storing logs in the second area A2 by increasing the allocation ratio of the storage capacity of the second area A2 to the storage capacity of the storage area A. Then, the log is stored in the second area A2 to which the increased storage capacity has been allocated. Note that the allocation ratio of the storage capacity of the first area A1 will decrease.

[0063] Furthermore, if the free space in the first area A1 is smaller than the amount of log data, the memory control unit 107 cannot increase the allocation rate of the storage capacity of the second area A2. Therefore, the memory control unit 107 overwrites the logs stored in the second area A2 to store the logs. Here, it is desirable that the log to be overwritten is the log stored in the second area A2 that was generated by the security sensor, i.e., the log that contains the oldest time information. Also, as in the above example, if the time information of all the logs stored in the second area A2 is newer than the time information contained in the logs acquired by the log acquisition unit 101, the memory control unit 107 discards the logs acquired by the log acquisition unit 101 without saving them.

[0064] The transmission unit 104 transmits the log to the server device 2 located outside the vehicle via the external communication ECU 11. Here, the log transmitted by the transmission unit 104 differs depending on the timing at which the transmission possibility determination unit 105 determines that the log can be transmitted. If the transmission possibility determination unit 105 determines that the log can be transmitted at the time the log acquisition unit 101 acquires the log, the transmission unit 104 transmits the log acquired by the log acquisition unit 101 as is.

[0065] On the other hand, if transmission permission determination unit 105 determines that the log cannot be transmitted at the time log acquisition unit 101 acquires the log, and then memory control unit 107 stores the log in memory 102 and then transmission permission determination unit 105 determines that the log can be transmitted, transmission unit 104 transmits the log stored in first area A1 or second area A2 of memory 102. In this case, memory control unit 107 deletes the log transmitted from transmission unit 104 from memory 102.

[0066] The transmitting unit 104 may transmit the logs stored in the memory 102 in order of importance, for example, the logs stored in the first area A1, or may transmit the logs in order of oldest time information.

[0067] (2) Operation of the Log Management Device 100 The operation of the log management device 100 will be described with reference to FIGS. The following operations not only indicate a log management method executed by the log management device 100 but also indicate the processing procedures of a log management program that can be executed by the log management device 100. These processes are not limited to the order shown in Figures 5 to 8. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a step uses the result of a previous step. Explain.

[0068] The log acquisition unit 101 acquires a log generated by a security sensor provided in each ECU 12 (S101). The transmission permission determining unit 105 determines whether the log acquired by the log acquiring unit 101 can be transmitted (S102). Here, if the transmission possibility determination unit 105 determines that the log can be transmitted (S102: Y), the transmission unit 104 transmits the log acquired in S101 to the server device 2 located outside the vehicle (S103). On the other hand, if the transmission possibility determination unit 105 determines that the log cannot be transmitted (S102: N), the log storage area determination unit 106 determines the importance of the log acquired in S101 and determines whether the determined importance of the log is higher than a predetermined importance (S104). If the importance of the log is higher than a predetermined importance (S104: Y), the first area A1 is determined as the log storage area (S105), and the process proceeds to the process shown in Fig. 6. On the other hand, if the importance of the log is lower than the predetermined importance (S104: N), the second area A2 is determined as the log storage area (S106), and the process proceeds to the process shown in Fig. 7.

[0069] Next, the processing after the first area A1 is determined as the log storage area (S105) in FIG. 5 will be described with reference to FIG. The memory control unit 107 compares the free space in the first area A1, which is a log storage area, with the amount of data in the log (S201). Here, if the free space in the first area A1 is greater than the amount of data in the log (S201: Y), the memory control unit 107 stores the log in the first area A1 (S202). If the free space in the first area A1 is smaller than the amount of log data (S201: N), the memory control unit 107 compares the free space in the second area A2, which is not a log storage area, with the amount of log data (S203). In S203, if the result of comparing the free space in the second area A2 with the amount of data in the log shows that the free space in the second area A2 is greater than the amount of data in the log (S203: Y), the memory control unit 107 increases the allocation ratio of the storage capacity of the first area A1 to the storage capacity of the storage area A (S204). Then, the log is stored in the first area A1 (S202).

[0070] Furthermore, in S203, if the result of comparing the free space in the second area A2 with the data volume of the log shows that the free space in the second area A2 is less than the data volume of the log (S203: N), the memory control unit 107 further determines whether or not a log containing time information older than the time information contained in the log acquired in S101 is stored in the second area A2 (S205). Here, if a log containing time information older than the time information contained in the log acquired in S101 is stored in the second area A2 (S205: Y), the memory control unit 107 deletes the log (S206). Then, the memory control unit 107 increases the allocation ratio of the storage capacity of the first area A1 to the storage capacity of the storage area A (S204), and stores the log in the first area A1 (S202). Furthermore, if no log containing time information older than the time information contained in the log acquired in S101 is stored in the second area A2 (S205: N), the memory control unit 107 discards the log acquired in S101 (S207).

[0071] Next, the processing after the second area A2 is determined as the log storage area (S106) in FIG. 5 will be described with reference to FIG. The memory control 107 compares the free space in the second area A2, which is a log storage area, with the amount of data in the log (S301). Here, if the free space in the second area A2 is greater than the amount of data in the log (S301: Y), the memory control unit 107 stores the log in the second area A2 (S302). If the free space in the second area A2 is smaller than the amount of log data (S301: N), the memory control unit 107 compares the free space in the first area A1, which is not a log storage area, with the amount of log data (S303). In S303, if the result of comparing the free space in the first area A1 with the amount of data in the log shows that the free space in the first area A1 is greater than the amount of data in the log (S303: Y), the memory control unit 107 increases the allocation ratio of the storage capacity of the second area A2 to the storage capacity of the storage area A (S304). Then, the log is stored in the second area A2 (S302).

[0072] Furthermore, in S303, if the result of comparing the free space in the first area A1 with the data volume of the log shows that the free space in the first area A1 is less than the data volume of the log (S303: N), the memory control unit 107 further determines whether a log containing time information older than the time information contained in the log acquired in S101 is stored in the second area A2 (S305). Here, if a log containing time information older than the time information contained in the log acquired in S101 is stored in the second area A2 (S305: Y), the memory control unit 107 overwrites the log and saves the log acquired in S101 (S306). Furthermore, if no log containing time information older than the time information contained in the log acquired in S101 is stored in the second area A2 (S305: N), the memory control unit 107 discards the log acquired in S101 (S307).

[0073] In the above-described embodiment, a configuration has been described in which, in S207 and S307, logs that cannot be saved in the saving area A of the memory 102 are immediately discarded. However, if the log acquired by the log acquisition unit 101 cannot be saved in the saving area A, the log may not be immediately discarded, but the log saving process may simply be interrupted. In this case, the memory control unit 107 may perform the process shown in FIG. 6 or 7 again after a predetermined time has elapsed since the log saving process was interrupted. Then, if the log cannot be saved in the memory after performing the saving process in the memory a predetermined number of times, the log may be discarded.

[0074] Next, the operation of the log management device 100 after the log has been stored in the storage area A of the memory 102 will be described with reference to FIG. The communication availability determination unit 105 determines whether or not a log can be transmitted to a server device outside the vehicle (S401). If it is determined that communication is possible, the transmitting unit 104 transmits the log stored in the memory 102 to the server device (S402). Then, the memory control unit 107 deletes the transmitted log from the memory 102 (S403).

[0075] (3) Summary According to this embodiment, logs with high importance are stored in an area where overwriting is prohibited, so even if logs accumulate in memory and reach the memory capacity, it is possible to prevent logs with high importance from being overwritten. Also, logs with low importance are stored by overwriting older logs, so it is possible to store the latest logs.

[0076] Furthermore, according to this embodiment, it is possible to efficiently use the memory storage area by appropriately changing the allocation ratio of storage capacity to areas where overwriting is prohibited or areas where overwriting is possible.

[0077] 2. Second embodiment In this embodiment, an example will be described in which an electronic control device having a virtual machine realizes the function of a log management device.

[0078] 9 shows an electronic control device 200 that functions as a log management device of this embodiment. The electronic control device 200 includes a hypervisor (HV) 210, a plurality of virtual machines (220, 230) managed by the hypervisor 210, and a memory 102. As in the first embodiment, the electronic control device 200 is assumed to be the CGW 10 of FIG. 2, but is not limited to this.

[0079] The hypervisor 210 is software that virtualizes the electronic control unit 200. In the example of Fig. 9, the first virtual machine 220 and the second virtual machine 230 are constructed on the hypervisor 210. In this example, a configuration in which the electronic control unit 200 has only one hypervisor 210 is described, but the electronic control unit 200 may have multiple hypervisors and virtual machines managed by multiple hypervisors.

[0080] Each of the virtual machines included in the electronic control device 200 has a platform (hereinafter, referred to as a PF). In Fig. 9, the first virtual machine 220 has a first PF 222, and the second virtual machine 230 has a second PF 232. Fig. 9 also shows applications (221, 231) running on the PF of each virtual machine.

[0081] There are various types of PFs, and any PF can be used as the first and second PFs (222, 232). For example, the first PF 222 is a platform that optimizes static functions, known as a Classic Platform (hereinafter referred to as a CP) in AUTOSAR (AUTomotive Open System ARchitecture). CPs are primarily suitable for electronic control units (ECUs) for vehicle control. The second PF 232 is a platform that allows dynamic expansion of functions, known as an Adaptive Platform (hereinafter referred to as an AP) in AUTOSAR. APs are primarily suitable for ECUs for autonomous driving. By mixing multiple virtual machines with different PFs in a single ECU in this way, it becomes possible to integrate multiple functions into a single ECU, thereby reducing the total number of ECUs.

[0082] In such a configuration, the OS of the virtual machine may be configured to be provided between the hypervisor and the PF, or to be integrated with the hypervisor or included in the PF, for example.

[0083] The first application 221 running on the first virtual machine 220 includes a security sensor. This security sensor has the same function as the security sensor mounted on the ECU 12 shown in Fig. 2. That is, each security sensor monitors the operation of each virtual machine and generates a log.

[0084] The second application 231 running on the second virtual machine 230 includes a log acquisition unit 101, a transmission unit 104, a transmission permission determination unit 105, a log storage area determination unit 106, and a memory control unit 107. The functions and operations of the log acquisition unit 101, the transmission unit 104, the transmission permission determination unit 105, the log storage area determination unit 106, and the memory control unit 107 are the same as those in the first embodiment.

[0085] In the first embodiment, the log acquisition unit 101 acquires a log generated by a security sensor mounted on an electronic control unit (ECU 12) different from the electronic control unit 100, which is the log management device. In contrast, the log acquisition unit 101 of the second embodiment acquires a log generated by a security sensor mounted on an electronic control unit 200 that has the function of the log management device. Naturally, the log acquisition unit 101 may acquire a log generated by a security sensor mounted on an ECU 12 connected to the electronic control unit 200 via the network 13, as in the first embodiment.

[0086] 3. Modifications of each embodiment (1) Variation 1 In this modification, an electronic control device (100, 200) that functions as a log management device is described as being equipped with an application that realizes other functions in addition to the application that realizes the log management function.

[0087] Fig. 10 is a diagram illustrating the memory of this modified example 1. Unlike Fig. 4, the memory 102 has a shared area and a dedicated area. The shared area is an area shared by multiple applications installed in the electronic control devices 100, 200. The dedicated area is an area that can be used only by a specific application among the multiple applications installed in the electronic control devices 100, 200, and access from applications other than the specific application is restricted.

[0088] When the memory 102 has a shared area and a dedicated area as in this modification, the storage area A of this embodiment, that is, the first area A1 and the second area A2, are provided in the dedicated area.

[0089] Naturally, the CGW 10 may have other functions in addition to functioning as a log management device. Therefore, when this modification is applied to the first embodiment, in the electronic control device 100, an area that can be accessed by both the application that executes the log management function and the applications that execute other functions is a shared area, and an area that can be used only by the application that executes the log management function is a dedicated area.

[0090] Furthermore, when this modified example is applied to embodiment 2, the shared area is accessible to both the first application 221 and the second application 231, and the area that is shared and used by these applications is the shared area, while the area that can be used only by either the first application 221 or the second application 231 is the dedicated area.

[0091] The logs generated by the security sensors are necessary for the server device 2 to analyze attacks and abnormalities on the ECU, and are therefore highly necessary. Therefore, by providing a dedicated area for saving logs, sufficient memory capacity for saving logs can be ensured even when other applications are using the memory.

[0092] In this modified example, when the log acquired by the log acquisition unit 101 in the above-described embodiment cannot be saved in the saving area A, the log for which the saving process has been interrupted may be temporarily saved in the shared area.

[0093] (2) Variation 2 In the above-described embodiment, a configuration has been described in which the allocation ratio of storage capacity to the first area A1 and the second area A2 among the storage areas of the memory 102 can be constantly changed. However, the allocation ratio of the first area A1 and the second area A2 does not have to be constantly changeable, and whether or not it can be changed may be switched.

[0094] In this modification, the memory control unit 107 switches between a first mode, in which the allocation rate of the storage capacity can be changed, and a second mode, in which the allocation rate cannot be changed. For example, the memory control unit 107 switches between the first mode and the second mode based on the free space in the first area A1 and the free space in the second area A2. Specifically, in the second mode, in which the allocation rate of the storage capacity cannot be changed, if the difference between the free space in the first area A1 and the free space in the second area A2 is large, it may be possible that logs cannot be saved even if one of the areas has free space. Therefore, when the difference between the free space in the first area A1 and the free space in the second area A2 becomes larger than a predetermined value, the memory control unit 107 switches from the first mode to the second mode. Then, when the difference between the free space in the first area A1 and the free space in the second area A2 becomes smaller than a predetermined value, the memory control unit 107 switches from the second mode to the first mode.

[0095] As another example, the memory control unit 107 may switch between the first mode and the second mode in a situation where a large number of logs are generated. For example, if the electronic control system 1 is under attack from the outside, the security sensor may detect the attack or an abnormality and generate a large number of logs. In particular, the logs generated under such a situation are logs necessary for analyzing the attack and are likely to be of high importance, and there is a high possibility that a large number of logs will need to be stored in the first area A1. Therefore, the memory control unit 107 switches from the second mode to the first mode when the log acquired by the log acquisition unit 101 indicates that the security sensor has detected an abnormality.

[0096] In the second mode, the allocation ratios of the first area A1 and the second area A2 cannot be changed, so for example, if the importance of the log acquired by the log acquisition unit 101 is higher than a predetermined importance and the free space in the first area A1, which is the log storage area, is less than the data amount of the log, the log cannot be stored in the first area A1. Therefore, if the log cannot be stored in the log storage area in the second mode, the storage process of the log acquired by the log acquisition unit 101 is interrupted.

[0097] 4. Summary The features of the log management device and the like in each embodiment of the present invention have been described above. The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0098] The block diagrams used to explain the embodiments classify and organize the device configuration by function. The blocks representing each function can be realized by any combination of hardware or software. Furthermore, because they represent functions, the block diagrams can also be understood as disclosures of method inventions and program inventions that realize the methods.

[0099] The order of the processes, flows, and blocks that can be understood as methods described in each embodiment may be changed as long as there are no constraints, such as one step utilizing the results of another step that precedes it.

[0100] Each embodiment is based on a vehicle log management device that is installed in a vehicle, but the present invention also includes dedicated or general-purpose log management devices other than those for vehicles, unless otherwise limited in the claims.

[0101] In each embodiment, the log management device disclosed in each embodiment has been described on the assumption that it is mounted on a vehicle, but it may also be carried by a pedestrian.

[0102] Furthermore, examples of the form of the log management device of the present disclosure include a semiconductor element, an electronic circuit, a module, and a microcomputer. Examples of semi-finished products include an electronic control unit (ECU) and a system board. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as car navigation systems.

[0103] Furthermore, the log management device of the present disclosure may be provided with additional necessary functions, such as an antenna and a communication interface.

[0104] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a combination of a program for realizing the present invention recorded on a recording medium such as a memory or hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory that can execute the program.

[0105] A program for the log management device of the present invention, which is stored in a non-transient physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware, can also be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0106] The log management device of the present invention has been described as an electronic control device for vehicles primarily mounted on automobiles, but it can also be applied to all types of moving objects, including motorcycles, motorized bicycles, trains, pedestrians, ships, aircraft, etc. [Explanation of symbols]

[0107] 100 Log management device, 200 Electronic control device, 101 Log acquisition unit, 102 Memory, 104 Transmission unit, 105 Transmission permission determination unit, 106 Log storage area determination unit, 107 Memory control unit

Claims

1. A log management device mounted on a moving object, a log acquisition unit (101) that acquires a log generated by a security sensor mounted on the moving object; a transmission possibility determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body; a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log stored in the second area is permitted and to which a second storage capacity is allocated among the storage capacity; a log storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as the log storage area in which to store the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation ratio of the storage capacity to the storage capacity of the log storage area and stores the log in the log storage area; Equipped with When the importance is higher than the predetermined importance, and when the free space of the first area, which is the log storage area, is less than the amount of data, and the free space of the second area is greater than the amount of data, the memory control unit increases the allocation rate to the first storage capacity, and stores the log in the first area to which the increased first storage capacity is allocated. Log management device (100, 200).

2. A log management device mounted on a mobile body, a log acquisition unit (101) that acquires a log generated by a security sensor mounted on the moving object; a transmission possibility determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body; a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log stored in the second area is permitted and to which a second storage capacity is allocated among the storage capacity; a log storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as the log storage area in which to store the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation ratio of the storage capacity to the storage capacity of the log storage area and stores the log in the log storage area; Equipped with When the importance is higher than the predetermined importance, and when the free space of the first area, which is the log storage area, is less than the data amount, and when the free space of the second area is less than the data amount, the memory control unit deletes the second log stored in the second area, increases the allocation rate to the first storage capacity, and stores the log in the first area to which the increased first storage capacity is allocated. Log management device (100, 200).

3. A log management device mounted on a mobile body, a log acquisition unit (101) that acquires a log generated by a security sensor mounted on the moving body; a transmission possibility determination unit (105) that determines whether or not the log can be transmitted to the outside of the mobile body; a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log stored in the second area is permitted and to which a second storage capacity is allocated among the storage capacity; a log storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as the log storage area in which to store the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation ratio of the storage capacity to the storage capacity of the log storage area and stores the log in the log storage area; Equipped with When the importance is lower than the predetermined importance, and when the free space of the second area that is the log storage area is smaller than the amount of data and the free space of the first area is larger than the amount of data, the memory control unit increases the allocation rate to the second storage capacity and stores the log in the second area to which the increased second storage capacity is allocated. Log management device (100, 200).

4. A log management device mounted on a mobile body, a log acquisition unit (101) that acquires a log generated by a security sensor mounted on the moving object; a transmission possibility determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body; a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log stored in the second area is permitted and to which a second storage capacity is allocated among the storage capacity; a log storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as the log storage area in which to store the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation ratio of the storage capacity to the storage capacity of the log storage area and stores the log in the log storage area; Equipped with If the importance is lower than the predetermined importance, and if the free space of the second area, which is the log storage area, is less than the amount of data, and if the free space of the first area is less than the amount of data, the memory control unit overwrites the second log stored in the second area and stores the log. Log management device (100, 200).

5. A log management device mounted on a mobile body, a log acquisition unit (101) that acquires a log generated by a security sensor mounted on the moving body; a transmission possibility determination unit (105) that determines whether or not the log can be transmitted to the outside of the mobile body; a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log stored in the second area is permitted and to which a second storage capacity is allocated among the storage capacity; a log storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as the log storage area in which to store the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation ratio of the storage capacity to the storage capacity of the log storage area and stores the log in the log storage area; Equipped with the memory control unit is capable of switching between a first mode in which an allocation ratio between the first storage capacity and the second storage capacity can be changed and a second mode in which an allocation ratio between the first storage capacity and the second storage capacity cannot be changed; Log management device (100, 200).

6. The log management device further comprises: a transmitting unit (104) that transmits the log acquired by the log acquiring unit to an outside of the mobile object when the transmission possibility determining unit determines that the log can be transmitted; The log management device according to any one of claims 1 to 5.

7. After the memory control unit stores the log in the log storage area, if the transmission permission determination unit determines that the log can be transmitted, the transmission unit transmits the log stored in the log storage area to an outside of the mobile object; the memory control unit deletes the log transmitted from the transmission unit from the log storage area.

7. The log management device according to claim 6.

8. the log includes time information indicating a time when the security sensor generated the log; the memory control unit deletes, from the second logs stored in the second area, second logs that include time information older than time information included in the logs acquired by the log acquisition unit.

3. The log management device according to claim 2.

9. When time information included in the second log stored in the second area is newer than the time information included in the log acquired by the log acquisition unit, the memory control unit suspends saving of the log in the first area.

9. The log management device according to claim 8.

10. the log management device is an electronic control device, the memory has a shared area shared by a plurality of applications installed in the electronic control device and a dedicated area used by only one of the plurality of applications, The log storage area is provided in the dedicated area. The log management device according to any one of claims 1 to 5.

11. the memory control unit switches between the first mode and the second mode based on the free space of the first area and the free space of the second area.

6. The log management device according to claim 5.

12. the memory control unit switches from the second mode to the first mode when the log indicates that the security sensor has detected an abnormality; 6. The log management device according to claim 5.

13. An electronic control device mounted on a mobile body, the electronic control device having a memory (102), a first virtual machine (220), and a second virtual machine (230), The memory includes: a storage area consisting of a first area and a second area, wherein the first area is an area in which overwriting of a first log that is a log stored in the first area is prohibited and a first storage capacity is allocated among the storage capacity of the storage area, and the second area is an area in which overwriting of a second log that is a log stored in the second area is possible and a second storage capacity is allocated among the storage capacity; The first virtual machine a security sensor that generates a log; The second virtual machine a log acquisition unit (101) that acquires the log generated by the security sensor; a transmission possibility determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body; a storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as a log storage area for storing the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation rate of the storage capacity of the log storage area to the storage capacity, and stores the log in the log storage area; When the importance is higher than the predetermined importance, and when the free space of the first area, which is the log storage area, is less than the amount of data, and the free space of the second area is greater than the amount of data, the memory control unit increases the allocation rate to the first storage capacity, and stores the log in the first area to which the increased first storage capacity is allocated. An electronic control unit (200).

14. An electronic control device mounted on a mobile body, the electronic control device having a memory (102), a first virtual machine (220), and a second virtual machine (230), The memory includes: a storage area consisting of a first area and a second area, wherein the first area is an area in which overwriting of a first log that is a log stored in the first area is prohibited and a first storage capacity is allocated among the storage capacity of the storage area, and the second area is an area in which overwriting of a second log that is a log stored in the second area is possible and a second storage capacity is allocated among the storage capacity; The first virtual machine a security sensor that generates a log; The second virtual machine a log acquisition unit (101) that acquires the log generated by the security sensor; a transmission possibility determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body; a storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as a log storage area for storing the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation rate of the storage capacity of the log storage area to the storage capacity, and stores the log in the log storage area; When the importance is higher than the predetermined importance, and when the free space of the first area, which is the log storage area, is less than the data amount, and when the free space of the second area is less than the data amount, the memory control unit deletes the second log stored in the second area, increases the allocation rate to the first storage capacity, and stores the log in the first area to which the increased first storage capacity is allocated. An electronic control unit (200).

15. An electronic control device mounted on a mobile body, the electronic control device having a memory (102), a first virtual machine (220), and a second virtual machine (230), The memory includes: a storage area consisting of a first area and a second area, wherein the first area is an area in which overwriting of a first log that is a log stored in the first area is prohibited and a first storage capacity is allocated among the storage capacity of the storage area, and the second area is an area in which overwriting of a second log that is a log stored in the second area is possible and a second storage capacity is allocated among the storage capacity; The first virtual machine a security sensor that generates a log; The second virtual machine a log acquisition unit (101) that acquires the log generated by the security sensor; a transmission possibility determination unit (105) that determines whether the log can be transmitted to the outside of the mobile body; a storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as a log storage area for storing the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation rate of the storage capacity of the log storage area to the storage capacity, and stores the log in the log storage area; When the importance is lower than the predetermined importance, and when the free space of the second area that is the log storage area is smaller than the amount of data and the free space of the first area is larger than the amount of data, the memory control unit increases the allocation rate to the second storage capacity and stores the log in the second area to which the increased second storage capacity is allocated. An electronic control unit (200).

16. An electronic control device mounted on a mobile body, the electronic control device having a memory (102), a first virtual machine (220), and a second virtual machine (230), The memory includes: a storage area consisting of a first area and a second area, wherein the first area is an area in which overwriting of a first log that is a log stored in the first area is prohibited and a first storage capacity is allocated among the storage capacity of the storage area, and the second area is an area in which overwriting of a second log that is a log stored in the second area is possible and a second storage capacity is allocated among the storage capacity; The first virtual machine a security sensor that generates a log; The second virtual machine a log acquisition unit (101) that acquires the log generated by the security sensor; a transmission possibility determination unit (105) that determines whether or not the log can be transmitted to the outside of the mobile body; a storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as a log storage area for storing the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation rate of the storage capacity of the log storage area to the storage capacity, and stores the log in the log storage area; If the importance is lower than the predetermined importance, and if the free space of the second area, which is the log storage area, is less than the amount of data, and if the free space of the first area is less than the amount of data, the memory control unit overwrites the second log stored in the second area and stores the log. An electronic control unit (200).

17. An electronic control device mounted on a mobile body, the electronic control device having a memory (102), a first virtual machine (220), and a second virtual machine (230), The memory includes: a storage area consisting of a first area and a second area, wherein the first area is an area in which overwriting of a first log that is a log stored in the first area is prohibited and a first storage capacity is allocated among the storage capacity of the storage area, and the second area is an area in which overwriting of a second log that is a log stored in the second area is possible and a second storage capacity is allocated among the storage capacity; The first virtual machine a security sensor that generates a log; The second virtual machine a log acquisition unit (101) that acquires the log generated by the security sensor; a transmission possibility determination unit (105) that determines whether or not the log can be transmitted to the outside of the mobile body; a storage area determination unit (106) that, when the transmission permission determination unit determines that the log cannot be transmitted, determines the importance of the log, and determines the first area as a log storage area for storing the log if the importance is higher than a predetermined importance, or the second area if the importance is lower than the predetermined importance; a memory control unit (107) that, when the free space in the log storage area is smaller than the amount of data in the log, increases the allocation rate of the storage capacity of the log storage area to the storage capacity, and stores the log in the log storage area; the memory control unit is capable of switching between a first mode in which an allocation ratio between the first storage capacity and the second storage capacity can be changed and a second mode in which an allocation ratio between the first storage capacity and the second storage capacity cannot be changed; An electronic control unit (200).

18. A log management method executed by a log management device mounted on a moving object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management method, when the free space of the log storage area is smaller than the amount of data of the log, an allocation ratio of the storage capacity of the log storage area to the storage capacity is increased, and the log is stored in the log storage area (S202, S302, S306), If the importance is higher than the predetermined importance, and if the free space of the first area, which is the log storage area, is less than the data amount and the free space of the second area is greater than the data amount, the allocation rate to the first storage capacity is increased, and the log is stored in the first area to which the increased first storage capacity is allocated (S204, S202). Log management methods.

19. A log management method executed by a log management device mounted on a mobile object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management method, when the free space of the log storage area is smaller than the amount of data of the log, an allocation ratio of the storage capacity of the log storage area to the storage capacity is increased, and the log is stored in the log storage area (S202, S302, S306), If the importance is higher than the predetermined importance, and if the free space of the first area, which is the log storage area, is less than the data amount, and the free space of the second area is less than the data amount, the second log stored in the second area is deleted, the allocation rate to the first storage capacity is increased, and the log is stored in the first area to which the increased first storage capacity is allocated (S206, S204, S202). Log management methods.

20. A log management method executed by a log management device mounted on a mobile object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management method, when the free space of the log storage area is smaller than the amount of data of the log, an allocation ratio of the storage capacity of the log storage area to the storage capacity is increased, and the log is stored in the log storage area (S202, S302, S306), If the importance is lower than the predetermined importance, and the free space of the second area, which is the log storage area, is less than the data amount, and the free space of the first area is greater than the data amount, the allocation rate to the second storage capacity is increased, and the log is stored in the second area to which the increased second storage capacity is allocated (S304, S302). Log management methods.

21. A log management method executed by a log management device mounted on a mobile object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management method, when the free space of the log storage area is smaller than the amount of data of the log, an allocation ratio of the storage capacity of the log storage area to the storage capacity is increased, and the log is stored in the log storage area (S202, S302, S306), If the importance is lower than the predetermined importance, and if the free space of the second area, which is the log storage area, is less than the data amount, and if the free space of the first area is less than the data amount, the second log stored in the second area is overwritten and the log is stored (S306, S302). Log management methods.

22. A log management method executed by a log management device mounted on a moving object, comprising: The log management device a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated among the storage capacity; a first mode in which an allocation ratio between the first storage capacity and the second storage capacity can be changed, and a second mode in which an allocation ratio between the first storage capacity and the second storage capacity cannot be changed; A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). When the free space in the log storage area is smaller than the amount of data in the log, the allocation ratio of the storage capacity to the log storage area is increased, and the log is stored in the log storage area (S202, S302, S306). Log management methods.

23. A log management program executable by a log management device mounted on a mobile object, The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management program, when the free space in the log storage area is smaller than the amount of data in the log, an allocation ratio of the storage capacity to the log storage area is increased and the log is stored in the log storage area (S202, S302, S306), If the importance is higher than the predetermined importance, and if the free space of the first area, which is the log storage area, is less than the data amount and the free space of the second area is greater than the data amount, the allocation rate to the first storage capacity is increased, and the log is stored in the first area to which the increased first storage capacity is allocated (S204, S202). A log management program that causes the log management device to execute processing.

24. A log management program executable by a log management device mounted on a mobile object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management program, when the free space in the log storage area is smaller than the amount of data in the log, an allocation ratio of the storage capacity to the log storage area is increased and the log is stored in the log storage area (S202, S302, S306), If the importance is higher than the predetermined importance, and if the free space of the first area, which is the log storage area, is less than the data amount, and the free space of the second area is less than the data amount, the second log stored in the second area is deleted, the allocation rate to the first storage capacity is increased, and the log is stored in the first area to which the increased first storage capacity is allocated (S206, S204, S202). A log management program that causes the log management device to execute processing.

25. A log management program executable by a log management device mounted on a mobile object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management program, when the free space in the log storage area is smaller than the amount of data in the log, an allocation ratio of the storage capacity to the log storage area is increased and the log is stored in the log storage area (S202, S302, S306), If the importance is lower than the predetermined importance, and the free space of the second area, which is the log storage area, is less than the data amount, and the free space of the first area is greater than the data amount, the allocation rate to the second storage capacity is increased, and the log is stored in the second area to which the increased second storage capacity is allocated (S304, S302). A log management program that causes the log management device to execute processing.

26. A log management program executable by a log management device mounted on a mobile object, comprising: The log management device includes a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated out of the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated out of the storage capacity, A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). In the log management program, when the free space in the log storage area is smaller than the amount of data in the log, an allocation ratio of the storage capacity to the log storage area is increased and the log is stored in the log storage area (S202, S302, S306), If the importance is lower than the predetermined importance, and if the free space of the second area, which is the log storage area, is less than the data amount, and if the free space of the first area is less than the data amount, the second log stored in the second area is overwritten and the log is stored (S306, S302). A log management program that causes the log management device to execute processing.

27. ​​A log management program executable by a log management device mounted on a mobile object, comprising: The log management device a memory (102) having a storage area consisting of a first area and a second area, the first area being an area in which overwriting of a first log that is a log stored in the first area is prohibited and to which a first storage capacity is allocated among the storage capacity of the storage area, and the second area being an area in which overwriting of a second log that is a log stored in the second area is possible and to which a second storage capacity is allocated among the storage capacity; a first mode in which an allocation ratio between the first storage capacity and the second storage capacity can be changed, and a second mode in which an allocation ratio between the first storage capacity and the second storage capacity cannot be changed; A log generated by a security sensor mounted on the mobile object is acquired (S101); It is determined whether or not the log can be transmitted to the outside of the mobile unit (S102); If it is determined that the log cannot be transmitted, the importance of the log is determined, and if the importance is higher than a predetermined importance, the first area is determined as the log storage area in which the log is to be stored, or if the importance is lower than the predetermined importance, the second area is determined as the log storage area in which the log is to be stored (S104, S105, S106). When the free space in the log storage area is smaller than the amount of data in the log, the allocation ratio of the storage capacity to the log storage area is increased, and the log is stored in the log storage area (S202, S302, S306). A log management program that causes the log management device to execute processing.

Images