Patent Description:
Modern electronic devices, which are used in vehicles for communication and entertainment, for example, may nowadays use a wide range of services from the internet. When the electronic device is used inside a vehicle, an OCU (Online Connectivity Unit) may establish the connection to the internet and to the internet services. However, sufficient safety measures must be taken when devices may have access to the internet. One safety tool is an intrusion detection system (IDS), which allows to monitor a network or systems for malicious activity or policy violations.

However, there may be delays in the logging and/or evaluation of the entries for various reasons. For example, when the electronic device is used inside the vehicle, IDS events may be logged via a Linux kernel system log. These log entries may afterwards be transferred to another control unit (ECU) via an asynchronous interface. Establishing a connection between this ECU and the OCU of the vehicle may be very time-consuming. This means that many log entries are already being generated and the interface may become overloaded. Therefore, the sufficient rapid logging and/or evaluation of entries may be problematic.

<CIT> discloses a computer architecture for an IDS with a control agent to interface with a management system and for a monitoring of a system activity.

<CIT> discloses a method to search and analyze data in different databases for pre-processing purposes.

It is therefore an object of the invention to at least partially eliminate the disadvantages mentioned above. Particularly, it is the object of the present invention to provide an improved method for the handling of log entries of a system log.

Aforesaid object is solved by a method according to independent claim <NUM>, a system according to independent claim <NUM>, a vehicle according to independent claim <NUM> and a computer program product according to independent claim <NUM>. Further features and details of the present invention result from the dependent claims, the description and the drawings. Features and details discussed with respect to the method according to the invention also apply to the system, the vehicle and the computer program product, and vice versa.

According to a first aspect of the invention, a method (particularly computer-implemented method) is provided that is used to provide log entries (also termed protocol entries) of a system log (also termed system protocol, particularly of a system according to the invention). To this end, the following steps may be carried out, wherein particularly the steps of "reading the log entries" are performed at least partially simultaneously:.

This has the advantage that it is not necessary to wait until the readout process completely has read the older log entries to read the newer (current) log entries, which would otherwise be the case when a sequential readout of the log entries is used. It may therefore be an idea, according to the invention, to use a non-sequential readout of log entries. The readout process is also not limited to provide either the older log entries or the current log entries. Instead, two readout information are used simultaneously, one may be used to read the older log entries and the other may be used to read the current log entries. Therefore, different time periods of the system log may be read at the same time.

It is also conceivable that the (at least or exactly) two readout results, also herein referred to as readout information, are each configured as a read pointer. In other words, instead of using only one read pointer, (at least or exactly) two read pointers may be used to perform the reading. Therefore, both read pointers are used in parallel. The parallel reading using both readout information may be partially (or fully) parallel (related to the time of execution). However, the parallel usage of the readout information by the readout process does not necessarily have to be accompanied by a parallel execution in the sense of parallel computing. Therefore, the readout process may be performed by a single processing unit, and only optionally by multiple processors (or processor cores). The parallel usage of the first and second readout information may also be implemented in a way that a single processor executes the steps of reading using the first and second readout information repeatedly one after the other. This does also cover the inventive idea of not being limited to reading the log entries one after the other exclusively from the older to the newer log entries, but to read different time periods of the log entries at the same time.

Each of the readout information is a (read) pointer. A pointer comprises an information with a reference to a particular log entry. Therefore, each of the pointers may point to a particular log entry. However, the two pointers - when used for reading - always point to different log entries. For the readout process, the pointers may be incremented, so that each pointer is used to read out log entries in a successive manner. Since the starting points of the pointers are different, after a particular amount of incrementations, the first pointer (i.e. the first readout information) reaches the starting point of the second pointer (i.e. the second readout information). After this, it is no longer necessary to use the first pointer (which may be released).

The system log may be stored in a log file (stored in a non-volatile memory of a computer system) and may comprise the automatically maintained log of all or certain actions of processes on the computer system. The system log may be configured as a system log (particularly kernel system log) of an operating system like Linux and/or a kernel log and/or a syslog application. The log entries may be logged by a processing system, wherein the log entries logged by the system prior to the reading or the readout time are regarded as historical log entries. The historical log entries may be relevant for a further evaluation; however, the current log entries may have a higher priority for this. Therefore, according to the invention, these different types of log entries (the historical and the current log entries) are particularly not read exclusively subsequentially but simultaneously.

The logging of the log entries may particularly be performed in the following way:.

For the storage of the information and the timestamp, both data elements may be saved in a common file, or in different files, which represent the system log. The timestamp may comprise a reference to the corresponding information and/or vice versa.

The readout time may be a point in time at which the system log is monitored by an IDS, particularly an IDS sensor, preferably in real time or at normal rate. In other words, the monitoring starts at the readout time. The log entries logged in a time period between the starting point of the first readout information and the second readout information may be regarded as backend for an analysis at a reduced rate. The log entries logged afterwards, i.e. following the starting point of the second readout information, may be regarded as backend for the analysis at a normal rate (higher than the reduced rate). Since the system log generates too much data at the startup before the monitoring begins, the usage of the two readout information may help to improve the further monitoring.

Furthermore, it is possible that the reading using the first readout information is performed with a lower rate than the reading using the second readout information. In other words, the log entries logged before the readout time are read with a lower speed by the readout process than the log entries logged after the readout time. Therefore, if the readout information is each regarded as pointer or reference to specific log entries, the first readout information is incremented with a lower rate than the second readout information during the readout process. This has the advantage that the different priorities of the log entries are considered. The incrementation may refer to a timestamp of the log entries.

It is possible that the first readout information is used to read historical log entries of the system log and the second readout information, in contrast to the first readout information, is used to read current log entries of the system log. This allows for considering both historical and current entries at the same time. It is not necessary to discard the older log entries to have an immediate consideration of the current log entries.

It may be provided that the reading is performed in such a way that an overlapping of log entries read out by using the first readout information and those read out by using the second readout information is prevented. It is not necessary to read out log entries twice. Therefore, it may be possible that the first readout information is not used anymore when it reaches the log entries of the second readout information.

It may be intended that the first readout information is used to start reading those log entries that were logged at an earlier point in time (than the readout time when the initiation began) and to continue reading to at least one log entry logged at the readout time to stop reading at this point. In other words, the reading using the first readout information may stop reading when it reaches the at least one log entry at the readout time.

It is also possible that the method steps are performed at a startup of the system according to the invention and/or of an intrusion detection system. Particularly, due to the delay at the startup, it is not possible to read the log entries in real time. Therefore, the inventive solution provides an improved way of reading the log entries.

The log entries may also be logged by a processing system, so that the log entries comprise information about an operation of the processing system, particularly of the operating system. Preferably, and particularly after the steps of reading, the (read out) log entries are saved and/or evaluated, and the operation of the processing system is adapted depending on the evaluation. The adaption of the operation may be an execution of security actions, which may be necessary when security problems are detected using the log entries.

Furthermore, it is possible that the processing system is part of a vehicle, and particularly the operation of the vehicle is adapted depending on the evaluation, wherein preferably the evaluation is performed by an intrusion detection system.

The processing system may be configured as a system according to the invention and/or may comprise at least a first and second processing unit, described as follows.

It may be intended that the steps of initiating and reading are carried out by a first (electronic) processing unit. Furthermore, it is possible that previously a connection for a data transmission is initiated between the first processing unit and a second (electronic) processing unit. The data transmission may be used for a transmission of the readout log entries. However, the initiation of the connection may cause a delay, so that it is useful to use two readout information at the same time.

It is also possible that the method steps are carried out by at least one (electronic) processing unit of a vehicle. The vehicle may use functions that are at least partially provided by the at least one processing unit. The at least one processing unit may comprise the first and second processing unit, as also described as follows.

In some embodiments, the initiating and reading are carried out by a first processing unit, whereupon the following is carried out:.

For the operation of the system according to the invention or vehicle, it may be necessary that the log entries are passed over the asynchronous interface to the second processing unit. The interface and/or at least one of the processing units may each be configured as an electronic device. At least one of the processing units may be configured as an ECU (Electronic Control Unit) and may comprise a controller or microcontroller. Furthermore, the first or second processing unit may be configured as an OCU (Online Connectivity Unit). The moment that the second processing unit connects to the first processing unit via the interface may take a lot of time. This means that a lot of log entries (also termed as syslog entries) are already generated and may flood the interface. Therefore, the method according to the invention provides an improved way of reading as well the older log entries as the (often more relevant) current log entries. In other words, two read pointers (the first and second readout information) are used for the system log.

The first read pointer may be used for the reading from the beginning of the system log (historical events), particularly at a slow rate. The second read pointer may be used to directly log all current log entries. At a certain point in time, the first pointer will stop when it reaches the point where the second read pointer started.

If one of the processing units is configured as IDS (intrusion detection system), then the log entries may be configured as IDS events that are logged via the system log.

It is also possible that the processing system, and particularly at least one processing unit of the processing system, comprises at least one of the following devices:.

The OCU may also be termed an online or internet interface, which allows the internet/online functionalities to be used by the vehicle. The OCU may be used for the ECU to provide mobile online services for the vehicle, particularly for vehicle devices, preferably in a publish-subscribe messaging environment using different topics provided by various backend brokers. The vehicle devices may use the mobile online services by the OCU, such as sensor, safety, environment, information, entertainment and/or comfort devices, preferably configured to subscribe to the publish-subscribe messaging environment using different topics provided by various backend brokers. This has the advantage that different functions may be provided within the vehicle using flexible and adaptable online services. However, the usage of an OCU may require the implementation of an IDS for security reasons.

According to another aspect of the invention, a system for a vehicle is provided, comprising at least one processing unit, particularly data processing unit, for performing the steps of a method according to the invention. Also, a vehicle with a system according to the invention may be provided according to another aspect of the invention. The vehicle may be a motor vehicle, in particular a passenger or goods vehicle. Furthermore, the vehicle may be an electric vehicle and/or an autonomous vehicle.

According to another aspect of the invention, a computer program product, particularly computer program, may be provided comprising a program code for carrying out a method as described above. The computer program product comprises instructions which, when the program is executed by a computer, cause the computer to carry out embodiments of the method described above. The computer program product may be stored in a non-volatile data memory of embodiments of the system described above. Furthermore, the computer program product may be readout by the memory and executed by at least one processing unit to carry out the method according to the invention.

The invention and its further developments, as well as its advantages, will be explained in more detail below using figures. The figures show:.

<FIG> visualizes the steps of a method according to an embodiment of the invention. The method is intended for providing log entries <NUM> of a system log <NUM>. First, an initiation <NUM> takes place at a readout time <NUM>, which initiates a readout process <NUM>. As shown in <FIG>, the readout process <NUM> uses a first readout information <NUM> and a second readout information <NUM> in parallel to read the log entries <NUM> of the system log <NUM>. This subsequent reading of the log entries <NUM> using the first readout information and the second readout information is represented in <FIG> by reference numerals <NUM> and <NUM> respectively.

As also shown in <FIG>, the reading of the log entries <NUM> logged before the readout time <NUM> is performed by using the first readout information <NUM>. The readout time <NUM> may be identified by using an electronic time component of the system, and the presence of a log before the readout time <NUM> may be identified by comparing a timestamp of the log entries <NUM> with the readout time <NUM>. The reading of the log entries <NUM> logged after the readout time <NUM> is performed by using the second readout information <NUM>. In other words, both pieces of readout information are used for performing both reading steps in parallel. Again, the presence of a log after the readout time <NUM> may be identified by comparing a timestamp of the log entries <NUM> with the readout time <NUM>.

<FIG> shows a system <NUM>, particularly processing system <NUM>, according to an embodiment of the invention, which may be part of a vehicle. The system <NUM> may comprise a first processing unit <NUM>, a second processing unit <NUM> and an interface like an asynchronous interface <NUM> for a data transmission between the first processor unit <NUM> and the second processor unit <NUM>. Furthermore, the system <NUM> may comprise the system log <NUM> in a non-volatile data memory.

<FIG> shows a system <NUM> according to a further embodiment of the invention with more details. The system <NUM> may also comprise an electronic control unit (ECU) <NUM> and/or an online connectivity unit (OCU) <NUM> and/or an intrusion detection system (IDS) <NUM>.

The system <NUM> may be configured as a vehicle-to-cloud system <NUM>, which uses the OCU <NUM> to connect to online services that are used for functions of the vehicle <NUM>. Therefore, the OCU <NUM> may be used to provide cloud services for the vehicle <NUM>. However, this functionality requires the implementation of security functions, as for example provided by the IDS <NUM>. Such security functions usually require the evaluation and logging of log entries <NUM> that provide information about the operation of the system <NUM>. The method according to some embodiments of the invention may provide an improved way of reading these log entries <NUM>.

The log entries <NUM> may be logged by the system <NUM> and may be specific for the operation of the system <NUM>. This means, the log entries <NUM> may indicate errors, events and/or other information about the operation. This also allows for identifying security issues using the log entries <NUM>, particularly by the IDS <NUM>. In this case, the log entries <NUM> may be termed IDS events. The log entries <NUM> logged by the system <NUM> prior to the reading or the readout time <NUM>, respectively, are regarded as historical log entries <NUM>.

According to <FIG>, the first readout information <NUM> may be used to read historical log entries <NUM> of the system log <NUM> and the second readout information <NUM>, in contrast to the first readout information <NUM>, may be used to read current log entries <NUM> of the system log <NUM>.

The reading by using the first readout information <NUM> may be performed with a lower rate than the reading by using the second readout information <NUM>. This allows reading and/or logging and/or evaluating the current log entries <NUM> with a higher priority than the historical log entries <NUM>.

Also, the reading may be performed in such a way that an overlapping of log entries <NUM> read out by using the first readout information <NUM> and those read out by using the second readout information <NUM> is prevented. According to <FIG>, this means that the reading using the first readout information <NUM> stops when it reaches the dashed line <NUM>. Therefore, the first readout information <NUM> may be used to start reading those log entries <NUM> that were logged at an earlier point in time and to continue reading to at least one log entry <NUM> logged at the readout time <NUM> to stop reading at this point. This means, the reading is stopped when it reaches the at least one log entry at the readout time <NUM>.

It may be provided that embodiments of the method are performed at a startup of an intrusion detection system <NUM>. The log entries <NUM> may be logged by the system <NUM>, so that the log entries <NUM> comprise information about an operation of the system <NUM>. After the reading, the readout log entries <NUM> may be processed, particularly evaluated, preferably by the IDS <NUM>.

The operation of the system <NUM> may be adapted depending on the processing or evaluation. For example, a warning message may be output to a user that a security issue is detected by using the evaluation. Also, the operation of the vehicle may be at least partially stopped as a reaction to the detection of a security issue by the evaluation of the log entries. Therefore, the rapid read out of current log entries and historical log entries in parallel may be crucial for a timely warning and initiation of other consequences.

In some applications, the readout may be delayed on startup. The initiating and reading may be carried out by a first processing unit <NUM>, and (previously) a connection for a data transmission may have taken place between the first processing unit <NUM> and a second processing unit <NUM>. The establishment of the connection may be responsible for the delay, so that a security issue cannot be detected in this period of time. The parallel read out of the log entries may mitigate such delay.

Initiating and reading may be carried out by a first processing unit <NUM>, whereupon a transmission of the readout log entries <NUM>, via an (for example asynchronous) interface <NUM>, to a second processing unit <NUM> is performed. Afterwards, a processing and/or evaluating the transmitted log entries <NUM> by the second processing unit <NUM> is performed. This processing and/or evaluation may serve to detect security issues and/or may comprise a further logging of the log entries.

It is possible that the readout information <NUM>, <NUM>, particularly read pointer, may be used to read the log entries <NUM> simultaneously, but with a different clock rate. The first read pointer <NUM> may be used to start reading from the beginning (i.e. the historical events) at a slow rate, and the second read pointer <NUM> may be used to log the current events. At a given time t, the first read pointer <NUM> stops when it reaches the point where the second read pointer <NUM> started. In other words, the IDS <NUM> log is not transferred sequentially, but the current and historical events are read in parallel. This procedure adapts the reading of the log of a (particularly Linux) system <NUM> when the IDS <NUM> is started (i.e. the startup). Specifically, a Linux kernel log may be used for this (the "system logbook" or "syslog"). The method may, for example, be used for any embedded system <NUM> that requires an IDS <NUM>, such as consumer electronics or loT (internet-of-things) devices.

As shown in <FIG>, the system <NUM>, and particularly at least one processing unit <NUM>, <NUM> of the system <NUM>, may comprise at least one of the following devices:.

The method described above, e.g. the embodiments depicted in <FIG>, may be carried out by a computer program product. The computer program product may comprise instructions which, when the program is executed by a computer, cause the computer to carry out embodiments of the method described above.

Claim 1:
A method for providing log entries (<NUM>) of a system log (<NUM>), the method comprising:
- Initiating, at a readout time (<NUM>), a readout process (<NUM>) using a first and a second readout information (<NUM>, <NUM>) in parallel to read the log entries (<NUM>), wherein the readout information (<NUM>, <NUM>) is a pointer comprising an information with a reference to a particular log entry (<NUM>),
- Reading the log entries (<NUM>) logged before the readout time (<NUM>) by using the first readout information (<NUM>),
- Reading the log entries (<NUM>) logged after the readout time (<NUM>) by using the second readout information (<NUM>).