DE102022113106A1 - Data protection configuration in a data system for vehicles - Google Patents

Abstract

Log messages should be transmitted or collected in a data system for vehicles according to the data protection needs of a user. For this purpose, a method is proposed in which configuration data is created in a terminal or a vehicle (FZ) of the data system (S1). The configuration data is transferred to a data source (SWC, CS) (S2). There they are used to block the log message (S7) or to add a data protection attribute (S3). Alternatively, the configuration data is transferred to a filter (S8) in order to filter log messages accordingly (S5). The log messages are transmitted depending on the data sources and/or filters configured in this way.

Description

The present invention relates to a method for transmitting a log message in a data system for vehicles. In addition, the present invention relates to a corresponding data system as well as a computer program and a computer-readable storage medium.

So-called “connected cars” are wirelessly connected to a device for data transmission. For example, a vehicle door can be opened using a smartphone, the vehicle's charge status can be retrieved remotely, or a remote diagnosis can be carried out.

The functions of “connected cars” can be distributed across many software components, ECUs (electronic control units) in the vehicle, but also in IT systems in the (cloud) backend. For a single function, several software components often work together over long function chains (in the vehicle and/or cloud backend). In order to be able to optimally analyze the behavior of these long function chains in the event of an error and also for vehicles in development, production and "in the field", protocol or log data (i.e. log entries produced by the software components themselves, which provide information about the internal behavior of the respective software component) from all components involved can be brought to a central analysis point (data lake or data collection device, if necessary with an analysis system) and can be evaluated there in the correct chronological order. The problem here is bandwidth and resource limitations, especially in the vehicle on the communication route between the vehicle and the cloud backend (mobile wireless networks). A naive approach of collecting all log data at the highest verbosity level is therefore not feasible.

The publication WO 2018/190965 A1 discloses a method for ensuring data protection and security in a processing system. Interfaces between a secure element and an external device are configured with one or more masking rules.

In addition, the publication discloses US 2020/0125473 A1 Implementations of finite or infinite log sources. Log filters are used at communication nodes.

Furthermore, the publication describes US 2015/0178999 A1 a method for secure data management in which filtering based on the privacy settings of a vehicle user is carried out before operating data is transmitted.

The publication US 2014/0157349 A1 describes a method for sensor data processing in which the sensor data is filtered before transmission based on a user-selectable filter policy.

The publication also reveals US 2019/0095304 A1 a log monitoring system that provides various information management policies customizable by a user through a user interface.

The publication also describes US 2004/0054918 A1 a method of enforcing privacy rules by classifying sensor data and setting rules/policies for handling the sensor data according to the classification.

The object of the present invention is to be able to design data transmission in vehicle-related data systems more individually with regard to data protection.

According to the present invention, a method for transmitting a log message in a data system for vehicles is provided. A data system includes, for example, one or more vehicles that are connected to a (cloud) backend for data technology. If necessary, the data system also has at least one end device (e.g. smartphone), which can also function as a data source. These devices or vehicles are, for example, part of an “Internet of Things” (IOT). If necessary, log messages should be collected in a data collection device from one or more data sources that can be implemented in the vehicles or end devices. Accordingly, these log messages are transmitted, for example, from the data sources to the data collection device.

In a first method step, configuration data is created in a terminal or a vehicle of the data system. The configuration data should be used to set or configure a data source or a filter. In a very simple case, the configuration data is just a single number. This number (e.g. “2”) can represent a data protection level, for example. However, the configuration data can also be significantly more complex. For example, certain data source types can each be assigned their own data protection level. About it In addition, the configuration data may also differentiate between data source settings and filter settings.

The data system can have one or more vehicles and/or one or more terminal devices. It should be possible to create the configuration data in at least one of these devices or vehicles. For example, a so-called “privacy setup” can be created in a vehicle’s infotainment system.

1. a) Die Konfigurationsdaten werden zu einer Datenquelle des Datensystems übertragen. Dort werden sie zum Einstellen eines Datenschutzattributs in der Lognachricht der Datenquelle entsprechend den Konfigurationsdaten genutzt. Dies bedeutet, dass eine Lognachricht mit einem Datenschutzattribut versehen ist, und dieses Attribut einen Wert erhält, der sich aus den Konfigurationsdaten ergibt. Beispielsweise schreiben die Konfigurationsdaten vor, dass das Datenschutzattribut der Lognachricht den Wert „privat“ erhält. Damit wird die Lognachricht als datenschutzrechtlich relevant beziehungsweise als privat eingestuft. Gegebenenfalls werden sämtliche Lognachrichten der Datenquelle ebenfalls als „privat“ gekennzeichnet, wenn dies die Konfigurationsdaten entsprechend vorschreiben. Unter Umständen beinhalten die Konfigurationsdaten aber auch eine dynamische Regelung, wonach die Lognachrichten beispielsweise nur zu bestimmten Zeiten als „privat“ gekennzeichnet werden. So sind auch beliebige andere Vorschriften zur Kennzeichnung der datenschutzrechtlichen Relevanz der Lognachrichten denkbar. Die mit dem so eingestellten Datenschutzattribut versehenen Lognachrichten werden schließlich von der Datenquelle ausgesandt. Nachgeschaltete Datenverarbeitungseinrichtungen können die Datenschutzattribute der Lognachrichten entsprechend auswerten.
2. b) Die in dem Endgerät oder dem Fahrzeug erstellten Konfigurationsdaten werden auch hier zu der jeweiligen Datenquelle übertragen. In diesem Fall werden jedoch nicht die Lognachrichten mit einem spezifischen Datenschutzwert versehen, sondern die Datenquelle selbst wird durch die Konfigurationsdaten beeinflusst. Speziell wird das Senden der Lognachricht durch die Datenquelle anhand der Konfigurationsdaten gesteuert. In Abhängigkeit von den Konfigurationsdaten wird die Lognachricht nämlich blockiert. Dies bedeutet, dass die Lognachricht im Falle der Blockade von der Datenquelle nicht nach außen versandt wird. Wenn also beispielsweise eine Datenquelle als Konfigurationsdaten die Datenschutzanweisung „privat“ erhält, so schickt sie beispielsweise keine oder nur bestimmte Lognachrichten nach außen (z.B. von einem von mehreren Logkanälen aus). Die Datenquelle besitzt hier quasi ihr eigenes Filter, das verhindert, dass die als „privat“ eingestuften Lognachrichten der Datenquelle nach außen geschickt werden.
3. c) Die von dem Endgerät oder dem Fahrzeug erstellten Konfigurationsdaten werden zu einem Filter des Datensystems übertragen. Ein derartiges Filter kann beispielsweise in einem Steuergerät und insbesondere in einer Konzentrationseinrichtung, in der Lognachrichten zusammenlaufen, vorgesehen sein. Das Filter wird entsprechend den Konfigurationsdaten konfiguriert. Dies bedeutet, dass einer oder mehrere Parameter des Filters entsprechend den Konfigurationsdaten eingestellt werden. So kann ein Filterparameter beispielsweise lauten, dass nur Lognachrichten hindurch gelassen werden, die als „nicht privat“ gekennzeichnet sind. So werden beispielsweise Lognachrichten, die als „privat“ oder als „bedingt privat“ eingestuft sind, ausgefiltert beziehungsweise blockiert. Die Filterfunktion des Filters ist über die Konfigurationsdaten somit anpassbar beziehungsweise veränderbar.

In a further step, the configuration data is transferred to a data source or to a filter of the data system. At the respective destination, the configuration data should be used to process the log message or log messages. Three cases can be distinguished:

1. a) The configuration data is transferred to a data source of the data system. There they are used to set a data protection attribute in the data source log message according to the configuration data. This means that a log message is tagged with a privacy attribute, and this attribute receives a value that results from the configuration data. For example, the configuration data requires that the privacy attribute of the log message be set to “private”. This means that the log message is classified as relevant to data protection law or as private. If necessary, all log messages from the data source are also marked as “private” if the configuration data requires this. However, the configuration data may also contain a dynamic regulation, according to which the log messages are only marked as “private” at certain times, for example. Any other regulations for identifying the data protection relevance of the log messages are also conceivable. The log messages containing the data protection attribute set in this way are ultimately sent out by the data source. Downstream data processing devices can evaluate the data protection attributes of the log messages accordingly.
2. b) The configuration data created in the end device or the vehicle is also transferred to the respective data source. In this case, however, it is not the log messages that are given a specific data protection value, but rather the data source itself is influenced by the configuration data. In particular, the sending of the log message by the data source is controlled based on the configuration data. Depending on the configuration data, the log message is blocked. This means that the log message will not be sent to the outside world in the event of a blockage from the data source. For example, if a data source receives the data protection instruction “private” as configuration data, it sends no or only certain log messages to the outside world (e.g. from one of several log channels). The data source essentially has its own filter, which prevents the log messages from the data source that are classified as “private” from being sent to the outside world.
3. c) The configuration data created by the terminal or the vehicle is transmitted to a filter in the data system. Such a filter can be provided, for example, in a control device and in particular in a concentration device in which log messages converge. The filter is configured according to the configuration data. This means that one or more parameters of the filter are set according to the configuration data. For example, a filter parameter could be that only log messages that are marked as “not private” are allowed through. For example, log messages that are classified as “private” or “conditionally private” are filtered out or blocked. The filter function of the filter can therefore be adjusted or changed via the configuration data.

The data source and/or the filter can be located in the at least one vehicle or in a (cloud) backend or a terminal device (from the “Internet of Things”). The corresponding individual data protection settings can then be made with regard to the log messages everywhere.

In one exemplary embodiment it is provided that the configuration data is created in a smartphone as a terminal and transmitted to the vehicle. If necessary, a corresponding application is provided on the smartphone, with the help of which the configuration data can be generated. The data protection settings in the vehicle and, if necessary, also in other components of the data system can be made very conveniently from the smartphone. If necessary, a corresponding data protection setting also has an effect in other parts of the data system if the configuration data is not only transferred to one vehicle, but also to other components (e.g. in the backend).

In a further exemplary embodiment, the configuration data is transmitted to the data source, the data source having several log channels and the configuration data having specific channel configuration data for each log channel. The steps a) or b) mentioned above are then carried out channel-specifically. For example, a camera device not only has a video channel for outputting the video/audio data, but also an evaluation channel through which data relating to object or gesture recognition can be provided. Each of these channels can be individually configured with regard to data protection. In this way, for example, the log messages from the video channel can be marked as “private” and the log messages from the evaluation channel as “not private”. In principle, each log channel of a data source can have its own configuration in order to mark its respective log messages with regard to data protection.

In a further advantageous embodiment of the method according to the invention, it is provided that the configuration data is distributed to several data sources and/or filters in the entire data system inside and/or outside the vehicle. This means that the configuration data created in the terminal or the vehicle is not only transmitted to a single data source or a single filter, but possibly simultaneously to several data sources and/or several filters. These data sources or filters can be located inside or outside the vehicle, possibly also inside and outside the vehicle. This means that multiple data sources or filters can be configured with regard to data protection, regardless of their location in the data system. This allows the data sources or filters to be synchronized with regard to data protection. In this case, the configuration data is obtained and set indirectly via the protection level. This makes data protection-specific settings easier for the user. He does not have to enter the configuration data directly, but can carry out the configuration in a simplified manner using protection levels. In the simplest case, the configuration data corresponds to a respective protection level. In a more complex design, a protection level can also encode more extensive configuration data. Especially in this case, protection levels make application easier.

• - Erstellen einer Logging-Kampagne, die mindestens eine Filterkonfigurationsnachricht aufweist,
• - automatisches Übertragen der Filterkonfigurationsnachricht an eine Datenquelle des Datensystems, wobei die Filterkonfigurationsnachricht eine Zuordnungsvorschrift zum Zuordnen einer Datenschutzkennung zu dem Attribut einer Lognachricht der Datenquelle aufweist, und
• - Durchführen eines Verfahren zum Übertragen der Lognachricht, wie es oben geschildert wurde.

According to the invention, a method for collecting log messages in a data system for vehicles can also be provided, comprising the steps:

• - Creating a logging campaign that has at least one filter configuration message,
• - automatically transmitting the filter configuration message to a data source of the data system, the filter configuration message having an assignment rule for assigning a data protection identifier to the attribute of a log message of the data source, and
• - Perform a procedure to transfer the log message as described above.

This means that log messages can be collected in the data system, with the data sources being distributed, for example, in one or more vehicles and possibly also in a (cloud) backend. The logging campaign can be created centrally in a management system and transmitted to the data sources or control devices or software components within the data system. For this purpose, the corresponding configurations of the data sources or data filters are sent upstream to the data sources. After the data sources and/or filters have been configured accordingly with regard to data protection, the log messages are sent out from the data sources with the corresponding data protection attributes if necessary or are filtered out in the filters according to the configurations. In this way, centrally organized logging campaigns can be carried out very effectively and the necessary data protection regulations can be adhered to.

• - eine Konfigurationseinrichtung zum Erstellen von Konfigurationsdaten, wobei die Konfigurationseinrichtung in einem Endgerät des Datensystems oder in dem mindestens einen Fahrzeug (z. B. im Infotainmentsystem) angeordnet ist („Privacy Setup“), und
• - eine Übertragungseinrichtung zum Übertragen der Konfigurationsdaten von der Konfigurationseinrichtung
  1. a) zu der Datenquelle des Datensystems, wobei die Datenquelle ausgebildet ist zum Einstellen eines Datenschutzattributs in der Lognachricht entsprechend den Konfigurationsdaten und zum Senden der Lognachricht mit dem eingestellten Datenschutzattribut, oder
  2. b) zu der Datenquelle, wobei die Datenquelle ausgebildet ist zum Blockieren der Lognachricht in Abhängigkeit von den Konfigurationsdaten, oder
  3. c) zu einem Filter des Datensystems, wobei das Filter ausgebildet ist, die Lognachricht entsprechend den Konfigurationsdaten zu filtern.

The above-mentioned object is also achieved according to the invention by a data system with at least one vehicle, whereby
the data system is designed to transmit a log message from a data source of the data system. The data system has:

• - a configuration device for creating configuration data, the configuration device being arranged in a terminal of the data system or in the at least one vehicle (e.g. in the infotainment system) (“privacy setup”), and
• - a transmission device for transmitting the configuration data from the configuration device
  1. a) to the data source of the data system, wherein the data source is designed to set a data protection attribute in the log message according to the configuration data and to send the log message with the set data protection attribute, or
  2. b) to the data source, wherein the data source is designed to block the log message depending on the configuration data, or
  3. c) to a filter of the data system, wherein the filter is designed to filter the log message according to the configuration data.

The invention also includes further developments of the data system according to the invention, which have features as have already been described in connection with the further developments of the method according to the invention. For this reason, the corresponding developments of the data system according to the invention are not described again here.

In a preferred embodiment of the data system according to the invention, the vehicle has a control device, and the data source is part of the control device. If necessary, the vehicle also has several control devices and thus also several data sources for log messages. Each control device or each data source can itself have one or more log channels. If necessary, the log messages are already bundled in a control device by a concentration device. In addition, a central control device can be provided that bundles or concentrates the log messages from several control devices.

As already mentioned above, the data source or the filter can be located in the vehicle or in a backend, in particular a cloud backend, of the data system. The backend can therefore use cloud storage or be housed in it. In this way, it can be ensured that logging messages from the vehicle or from the vehicles and the backend can be collected in relation to relevant data protection guidelines.

In a preferred embodiment of the data system according to the invention it is provided that the configuration device is part of an infotainment system of the vehicle. This means that the configuration of the data sources or filters of the data system with regard to data protection can be done with the help of the vehicle's infotainment system. As a result, a vehicle owner can decide for himself which log messages he wants to share, for example, and which he considers private. Alternatively, there is of course also the possibility that the vehicle user can use this configuration with regard to the processing of log messages with regard to data protection using another device from the “Internet of Things”, e.g. B. a smartphone. The above-mentioned transmission device for transmitting the configuration data from the configuration device to the data source or the filter can also be part of the infotainment system of the vehicle or another terminal of the data system. This makes it possible to ensure that the corresponding configuration data is also transmitted from the infotainment system to the desired destinations of the data system.

For use cases or application situations that may arise with the method and that are not explicitly described here, it can be provided that an error message and/or a request to enter user feedback and/or a standard setting and/or a predetermined one can be issued according to the method Initial state is set.

The data system can have a control device or a processor device that is set up to carry out an embodiment of the method according to the invention. For this purpose, the processor device can have at least one microprocessor and/or at least one microcontroller and/or at least one FPGA (Field Programmable Gate Array) and/or at least one DSP (Digital Signal Processor). Furthermore, the processor device can have program code that is designed to carry out the embodiment of the method according to the invention when executed by the processor device. The program code can be stored in a data memory of the processor device.

As a further solution, the invention also includes a computer program comprising commands which, when the program is executed by a control device of the data system, cause it to carry out the method mentioned. Likewise, a computer-readable storage medium can be provided, comprising instructions which, when executed by a control device of the data system, cause it to carry out the method mentioned. The storage medium can, for example, be designed at least partially as a non-volatile data storage (e.g. as a flash memory and/or as an SSD - solid state drive) and/or at least partially as a volatile data storage (e.g. as a RAM - random access memory). . The storage medium can be implemented in a processor circuit in its data memory. The storage medium can also be operated on the Internet as a so-called app store server, for example. The computer or computer network can provide a processor circuit with at least one microprocessor. The instructions may be provided as binary code or assembler and/or as source code of a programming language (e.g. C).

The vehicle is preferably designed as a motor vehicle, in particular as a passenger car or truck, or as a passenger bus or motorcycle.

The invention also includes the combinations of the features of the described embodiments. The invention therefore also includes implementations that each have a combination of the features of several of the described embodiments, provided that the embodiments have not been described as mutually exclusive.

• 1 ein schematisches Blockdiagramm eines Verfahrens beziehungsweise Datensystems zum Übertragen und Sammeln von Lognachrichten; und
• 2 ein schematisches Blockdiagramm zum Ablauf eines Ausführungsbeispiels eines erfindungsgemäßen Verfahrens.

Examples of embodiments of the invention are described below. This shows:

• 1 a schematic block diagram of a method or data system for transmitting and collecting log messages; and
• 2 a schematic block diagram of the sequence of an exemplary embodiment of a method according to the invention.

The exemplary embodiments explained below are preferred embodiments of the invention. In the exemplary embodiments, the described components of the embodiments each represent individual features of the invention that are to be considered independently of one another and which also further develop the invention independently of one another. Therefore, the disclosure is intended to include combinations of the features of the embodiments other than those shown. Furthermore, the described embodiments can also be supplemented by further features of the invention that have already been described.

The problem on which the present invention is based is that a user of a vehicle should be able to determine for himself which log messages, for example from his vehicle or his terminal, may be transmitted or collected in the data system. This should give the user the opportunity to give or not consent to the transmission or collection of log messages, for example if this is necessary under data protection law. The solution approach according to the invention is that the user can configure the data sources and/or filters of a data system in relation to his data protection wishes from his vehicle or end device. Overall, the following examples show how a method for transmitting a log message can be provided in a data system for vehicles.

1 shows a central unit or a backend BE in which a data collection or logging campaign can be created and the corresponding data can be collected. Next to it shows 1 As a frontend, for example, a so-called Internet-of-Things IOT on both sides of the backend BE. However, the IOT should be viewed as a whole and only for the sake of clarity 1 divided into two. The IOT includes, for example, vehicles or their control devices SGP-1, ..., SGP-m (generally SGP) and Z, but also end devices such as smartphones SP, as shown in 1 are shown on the right. The latter can be connected to a central data collection device DL of a cloud CL.

A logging campaign can, for example, be created by a campaign creator KE using a logging management system LMS in the backend BE or in the central unit, for example for the ongoing operation of a vehicle fleet. Alternatively, the logging campaign can also be created, for example, for the development phase or the production phase by a developer EW or production technician in a production system PS.

• - Eine Sammlung von Filterkonfigurationen beispielsweise in Form eines n-Tupel [Datenquelle-ID, Filterbedingung(en)], wobei die Datenquellen Software-Komponenten (SWC beziehungsweise CS) sein können und die Filterbedingungen unten näher definiert sind.
• - Vorverarbeitungsanweisungen (z.B. Skripte)
• - Triggerbedingungen, mit denen definiert werden kann, wann Logdaten erzeugt werden sollen.
• - Laufzeiten, mit denen definiert werden kann, dass eine Kampagne in einem bestimmten Zeitraum ausgeführt werden soll, wobei beispielsweise pro Fahrzeug auch mehrere Kampagnen parallel ausgeführt werden können.
• - Speichervorgaben beispielsweise für einen Ringpuffer FR (Flight Recorder) in einem Fahrzeug, wie etwa Ablageort im Dateisystem, maximale Größe des Ringpuffers für die Kampagne, maximal nutzbarer Speicher auf einem Flash-Speicher eines Zentralsteuergeräts Z oder auf einem externen Speichermedium (z.B. USB-Stick) z.B. für sogenannte „Snapshots“ (Datenschnappschüsse) der Kampagne und maximale Größe pro Snapshot-Datei.
• - Attribute (Parameter/Werte-Paare) z.B. für die Angabe von Authentifizierungsinformationen oder Schlüsselinformationen für die Verschlüsselung der Snapshot-Dateien.

A logging campaign can be seen as a data element and contains, for example, one or more of the following components:

• - A collection of filter configurations, for example in the form of an n-tuple [data source ID, filter condition(s)], where the data sources can be software components (SWC or CS) and the filter conditions are defined in more detail below.
• - Preprocessing instructions (e.g. scripts)
• - Trigger conditions that can be used to define when log data should be generated.
• - Runtimes that can be used to define that a campaign should be carried out within a certain period of time; for example, several campaigns can be carried out in parallel per vehicle.
• - Storage specifications, for example for a ring buffer FR (flight recorder) in a vehicle, such as storage location in the file system, maximum size of the ring buffer for the campaign, maximum usable memory on a flash memory of a central control device Z or on an external storage medium (e.g. USB stick ) e.g. for so-called “snapshots” (data snapshots) of the campaign and maximum size per snapshot file.
• - Attributes (parameter/value pairs) e.g. for specifying authentication information or key information for encrypting the snapshot files.

The filter conditions for configurable data sources can be defined using the filter configurations. Selectable and configurable data sources include so-called “log channels” from software components SWC in the software partitions of control devices SGP-1 to SGP-m, i.e. corresponding sources with source indices Q1-1 ... Q1-n, .. ., Qm-1 ... Qm-n in a vehicle in question. The “log channels” can also be parts of these data sources. Furthermore, “log channels” can also be used by so-called CloudServices CS1-1 ... CS1-n, ..., CSm-1 ... CSm-n (generally CS) in various cloud backend systems BES-1, ... ., BES-m, who are involved in the implementation of a connected car function, for example.

• - Maximaler Log-Level: Z.B. Kategorien wie „Fatal“, „Error“, „Warning“, „Info“, „Debugg“, „Verbose“ (sortiert nach steigendem Datenumfang).
• - Logging-Kategorie: Z.B. die Kategorien „Trace“, „Log“, „Recording“, wobei „Log“ ein standardmäßiges Logging, „Trace“ ein ausführlicheres Logging und „Recording“ ein Logging mit zusätzlich eingebetteten Referenzen (z.B. Videodateien) bedeuten kann.
• - Datenschutzrechtliche Relevanz der Logdaten (z.B. keine Erfassung von personenbezogenen Daten erlaubt, Indikation einer notwendigen Verschleierung von Standortdaten).
• - Sicherheitsrelevanz der Logdaten: Z.B. keine, authentisch, vertraulich
• - Wertebereiche von beliebigen Attributen, d.h. Konfigurationsinformationen: Z.B. Auswahl von Parameter/Werte-Paaren unter Eingabe eines oder mehrerer Vergleichsoperatoren und eines Referenzwerts, mit dem der jeweilige Wert verglichen werden soll.

One or more of the following conditions can be used as filter conditions:

• - Maximum log level: E.g. categories such as “Fatal”, “Error”, “Warning”, “Info”, “Debugg”, “Verbose” (sorted according to increasing data size).
• - Logging category: E.g. the categories “Trace”, “Log”, “Recording”, where “Log” can mean standard logging, “Trace” can mean more detailed logging and “Recording” can mean logging with additional embedded references (e.g. video files). .
• - Relevance of the log data under data protection law (e.g. no collection of personal data permitted, indication of necessary concealment of location data).
• - Security relevance of the log data: E.g. none, authentic, confidential
• - Value ranges of any attributes, ie configuration information: E.g. selection of parameter/value pairs by entering one or more comparison operators and a reference value with which the respective value should be compared.

In the main use case, as indicated above, campaigns are created by users (campaign creator KE) using, for example, a logging management system LMS in a cloud backend (backend in a cloud). The LMS in turn automatically distributes the campaigns to selected vehicles or entire vehicle fleets, for example using an order management service DCOM of a vehicle fleet data collection system GDC. The LMS also configures, for example, the cloud backend systems BES-1, ..., BES-m connected to the vehicles so that the filter configurations contained in the campaign for the backend data sources (e.g. smartphone SP) are sent to the affected cloud services (CS1-1 ... CS1-n, ..., CSm-1 ... CSm-n) are distributed (during the period for which a campaign is active). This occurs “upstream” (solid arrows in 1 ; against the downstream flowing log data stream (dashed arrows)) via a cascade of logging concentration devices VLK-1, ..., VLK-m or BLK-1, ..., BLK-m (generally VLK or BLK) to to the cloud services CS1-1 ... CS1-n, ..., CSm-1 ... CSm-n (generally CS) affected by a campaign, whose log channels are configured accordingly so that they only contain the desired data to produce. This may involve forwarding from CS to end devices SP (smartphone).

After creation by the order management service DCOM, the campaigns and the filter configurations they contain for the SWC software components in the vehicles are sent to the respective vehicle in the IOT via wireless connections (over-the-air, OTA) and there, for example, in the central control unit Z ( Gateway) is received by the data collection master DCM and forwarded, for example, to the ring buffer FR. The ring buffer FR can control the runtime of a campaign in the vehicle, i.e. in which period of time the log data sources there should be configured with the filter configuration data contained in the campaign.

When the campaign is active, the filter configuration data is first passed on, for example, from the ring buffer FR to the central logging concentration device VLK-Z in the central control unit Z. Afterwards, a cascade of intermediate collection points, so-called “logging concentrator services” VLK or VLK-1 ... VLK-m, initially distributes (routing) the filter configurations “upstream” to fine-grained, selectable log data sources (“log channels”) the software components of the control units in the vehicle. This results in extensive control of the log data volume that occurs via the filter configurations contained in the campaign.

If possible, the filter configurations should already be applied at the sources so that only the minimum amount of log data has to be processed downstream. Depending on the performance of the systems (both on-board and in the cloud), it can be decided whether more complex filter conditions will also be implemented in the logging concentrator services VLK.

The advantage of these filter configurations, which can be adjusted in detail, allows for selective and fine precisely those data sources are developed in a granular manner that are suspected of being responsible for an error pattern reported in the field, if necessary including historical log data that led to an error event. This means that efficient troubleshooting and analysis can be carried out in a resource-saving manner and despite low bandwidth resources and, if necessary, transmission volumes.

• Entwickler EW wollen direkt am Fahrzeug die Logdatenquellen für die Analyse eines beobachteten Fehlers konfigurieren. Sie erstellen hierzu ähnlich wie der Kampagnenhersteller KE eine Kampagne, die in diesem Fall beispielsweise über ein lokales Netz LN oder ein Speichermedium ins Zentralsteuergerät Z des Fahrzeugs übertragen wird. Im Zentralsteuergerät Z empfängt der Fahrzeugdiagnoseservice VDS die Kampagne und übergibt sie an den Ringpuffer FR. Von dort wird die Kampagne stromaufwärts über den Loggingkonzentrator VLK-Z des Zentralsteuergeräts Z an Software-Komponenten SWC QZ-1 ... SWC QZ-n des Steuergeräts Z und/oder an andere Steuergerät-Softwarepartitionen SGP-1 ... SGP-m verteilt. Die Loggingkonzentratoren VLK-1 ... VLK-m der Steuergerät-Softwarepartitionen SGP-1 ... SGP-m verteilen die jeweiligen Filterkonfigurationen der Loggingkampagne an die steuergerätinternen Software-Komponenten SWC Q1-1 ... SWC Q1-n, ..., SWC Qm-1 ... SWC Qm-n.

The system described is open to further use cases with alternative introduction of campaigns. In addition to defining campaigns via the logging management system LMS and the data collection system for vehicle fleets GDC, the invention makes it possible to introduce campaigns via diagnostic access to the vehicle. For example, a component called vehicle diagnostic service VDS is provided in the vehicle. This enables, for example, the following two use cases:

• Developers EW want to configure the log data sources directly on the vehicle for analyzing an observed error. To do this, you create a campaign similar to the campaign manufacturer KE, which in this case is transmitted, for example, via a local network LN or a storage medium to the central control unit Z of the vehicle. In the central control unit Z, the vehicle diagnostic service VDS receives the campaign and transfers it to the ring buffer FR. From there, the campaign is sent upstream via the logging concentrator VLK-Z of the central control unit Z to software components SWC QZ-1 ... SWC QZ-n of the control unit Z and/or to other control unit software partitions SGP-1 ... SGP-m distributed. The logging concentrators VLK-1 ... VLK-m of the ECU software partitions SGP-1 ... SGP-m distribute the respective filter configurations of the logging campaign to the ECU-internal software components SWC Q1-1 ... SWC Q1-n, .. ., SWC Sqm-1 ... SWC Sqm-n.

During the campaign, the log data generated according to the respective filter configurations of the data sources flows from the software components via the logging concentrators according to the dashed arrows 1 preferably to the ring buffer FR. According to the configuration of the campaign, snapshots SN can be obtained from the ring buffer. After the campaign has ended, the created snapshots SN can be downloaded to the developer system (symbolized by the developer EW) via the vehicle diagnostic service VDS or manually transferred to the central data collection device DL. For example, this transfer can take place from the central control device Z to the developer system using a USB stick.

In another application, in vehicle production (factory), the internal behavior of the software components SWC on the control devices or the control device partitions SGP should be observed during commissioning in order to be able to detect production errors, for example. For this purpose, the factory's IT systems, such as a production system service PS, can introduce campaigns via the local network LN via the vehicle diagnostic service VDS into the ring buffer FR or filter configurations into the central logging concentrator VLK-Z for further distribution. In this way, exactly the relevant log channels can be tapped for each production step.

• - Eindeutige Angabe der Logdatenquelle (Logkanal) per UUID oder anderer global eindeutiger Identifikationsinformation; beispielsweise besitzt eine Software-Komponente SWC einen oder mehrere Logkanäle.
• - Hochauflösender (z.B. 1µs) und präziser Zeitstempel (z.B. Abweichung maximal +/- 50 µs von der global synchronisierten Referenzzeit SRZ, die beispielsweise in jedem Steuergerät beziehungsweise jedem Cloud-Backend-System BES zur Verfügung steht und auf eine Referenzzeit RZ einer zentralen Zeitbasis bezogen ist). Der Zeitstempel sollte immer in eine absolute Zeit beispielsweise als Differenz zum Datum 01.01.1970 UTC umgerechnet werden können. Hierzu kann es notwendig sein, dass ein Integer-Datentyp mit 64 Bit Größe zur Verfügung gestellt wird. Mit einem derartigen Zeitstempel kann sichergestellt werden, dass in der zentralen Datensammeleinrichtung DL alle Lognachrichten zeitlich korrekt einsortiert werden können. Somit lässt sich eine hohe Datenqualität für gute Auswerteergebnisse beispielsweise in einem großen Datenanalysesystem BDAS, welches mehrere Datenanalysesysteme DAS1 ... DASn aufweisen kann, sicherstellen.
• - Ein sogenannter Loglevel, d.h. eine Kritikalitätsstufe der Lognachrichten, kann beispielsweise folgende Werte annehmen:
  • • FATAL (fataler Fehler)
  • • ERROR (Fehler in Bezug auf korrekte Funktionalität)
  • • WARN (Warnung, wenn korrektes Verhalten nicht sichergestellt werden kann)
  • • INFO (hochrangige Information)
  • • DEBUG (detaillierte Information für Programmierer)
  • • VERBOSE (ausführliche Debug-Nachricht)
• - Nicht-unterdrückbar-Flag: Falls dieses Flag gesetzt ist, darf die Nachricht nicht ausgefiltert werden. Hiermit markierte Lognachrichten werden für die Propagierung interner Fehler des Logging-Systems verwendet.
• - Liste von Attributen (Parameter-Werte-Paare). Eine Lognachricht kann also beispielsweise folgende Attribute aufweisen:
  • • „Sicherheitsniveau“ beziehungsweise „Security Level“ (mögliche Werte: keines, authentisch, vertraulich): Gibt die Schutzwürdigkeit der Lognachricht an in Bezug auf Cyber-Security-Eigenschaften wie „Authentizität“ und „Vertraulichkeit“. Das Sicherheitsniveau wird zur Filterung und Entscheidung verwendet, ob die Logdaten über bestimmte Verbindungen gesendet beziehungsweise auf Medien gespeichert werden dürfen beziehungsweise in welcher Form (z.B. verschlüsselt). Fehlt die Angabe, so wird die höchste Schutzwürdigkeit angenommen (d.h. vertraulich).
  • • „Datenschutzniveau“: Gibt die Schutzwürdigkeitsklasse der Lognachricht in Bezug auf ihre datenschutzrechtliche Relevanz an. Bei fehlender Angabe soll die höchste Schutzwürdigkeitsklasse angenommen werden, da eine datenschutzrechtliche Signifikanz nicht bewertet werden kann.
  • • „Kategorie“ mit folgenden möglichen Werten:
    • ▪ „Trace“: Diese Kategorie weist beispielsweise darauf hin, dass die Lognachricht instrumentierten Code aufweist.
    • ▪ „Log“: Hierbei kann es sich um Standard-Lognachrichten durch Programmablauf handeln.
    • ▪ „Recording“: Bei dieser Kategorie kann die Lognachricht eingebettete Dateien im Ereignisstrom aufweisen, wie etwa einen Screenshot.
    • ▪ „Referenz“: Die Lognachricht erhält einen Verweis auf eine Datei beziehungsweise Nachricht, die persistent in dem System gespeichert ist (z.B. in Form einer URI, die für ein Log-Ereignis abgelegt ist).
    • ▪ „Statistik“: Statistische Informationen
    • ▪ „Performance“: Performance-relevante Informationen
• - Nachrichteninhalt(e) („Payload“): Pro Lognachricht, d.h. pro Zeitstempel und gemeinsamen Attributen, können auch mehrere Nachrichteninhalte registriert werden.

The production and forwarding of log data is explained in more detail below. Log data may consist of individual log messages, for example with the following properties and data fields:

• - Clear indication of the log data source (log channel) via UUID or other globally unique identification information; For example, a software component SWC has one or more log channels.
• - High-resolution (e.g. 1µs) and precise time stamp (e.g. maximum deviation of +/- 50 µs from the globally synchronized reference time SRZ, which is available, for example, in every control unit or every cloud backend system BES and based on a reference time RZ of a central time base is). The timestamp should always be able to be converted into an absolute time, for example as a difference to the date 01/01/1970 UTC. For this purpose, it may be necessary to provide an integer data type with a size of 64 bits. With such a time stamp it can be ensured that all log messages can be sorted in the correct time in the central data collection device DL. This makes it possible to ensure high data quality for good evaluation results, for example in a large data analysis system BDAS, which can have several data analysis systems DAS1 ... DASn.
• - A so-called log level, ie a criticality level of the log messages, can, for example, assume the following values:
  • • FATAL (fatal error)
  • • ERROR (error related to correct functionality)
  • • WARN (warning when correct behavior cannot be ensured)
  • • INFO (high-level information)
  • • DEBUG (detailed information for programmers)
  • • VERBOSE (verbose debug message)
• - Non-suppressable flag: If this flag is set, the message may not be filtered out. Log messages marked here are used to propagate internal errors in the logging system.
• - List of attributes (parameter-value pairs). For example, a log message can have the following attributes:
  • • “Security level” or “security level” (possible values: none, authentic, confidential): Indicates the level of protection of the log message in terms of cyber security properties such as “authenticity” and “confidentiality”. The security level is used to filter and decide whether the log data can be sent over certain connections or stored on media or in what form (e.g. encrypted). If the information is missing, the highest level of protection is assumed (ie confidential).
  • • “Data protection level”: Indicates the level of protection of the log message in relation to its relevance to data protection law. If no information is provided, the highest level of protection should be assumed, as significance under data protection law cannot be assessed.
  • • “Category” with the following possible values:
    • ▪ “Trace”: This category indicates, for example, that the log message contains instrumented code.
    • ▪ “Log”: This can be standard log messages from the program flow.
    • ▪ “Recording”: In this category, the log message can have embedded files in the event stream, such as a screenshot.
    • ▪ “Reference”: The log message receives a reference to a file or message that is persistently stored in the system (e.g. in the form of a URI that is stored for a log event).
    • ▪ “Statistics”: Statistical information
    • ▪ “Performance”: Performance-relevant information
• - Message content(s) (“Payload”): Multiple message contents can be registered per log message, ie per timestamp and common attributes.

The log data can be transferred and stored in a standardized format. Such a standardized format (“canonical form”) can, with given flexibility, enable the conversion or embedding of other existing log data formats into this “canonical form”. However, other log data formats (e.g. AUTOSAR DLT) can also be adapted to support the above properties and data fields.

The log messages from the respective sources resulting from the application of the filter configurations are forwarded “downstream” via the same cascade of logging concentrators VLK or BLK - as mentioned above - to a central data collection device DL in the backend BE.

• - Direkte Weiterleitung einzelner Lognachrichten vom zentralen Logging-Konzentrator VLK-Z über den Datensammlungsmaster DCM und die Drahtlosschnittstelle OTA via das Datensammelsystem GDC für die Fahrzeugflotte beziehungsweise dessen Datenpumpe DP in die zentrale Datensammeleinrichtung DL.
• - Ringpuffer-Funktionalität („Flight Recorder“ FR): Hierbei zunächst onbordseitige Aufzeichnung und Zwischenspeicherung mehrerer Lognachrichten in Form von Schnappschüssen SN („Log Snapshot Dateien“) in einem persistenten Speicher des Zentralsteuergeräts Z (z.B. Flash-Speicher, am Zentralsteuergerät Z angeschlossener USB-Stick, et cetera). Anschließend erfolgt eine Abgabe der Schnappschüsse SN an den Datensammlungsmaster DCM mit OTA-Weiterleitung an das Datensammelsystem GDC und die Datensammeleinrichtung DL, oder die Schnappschüsse SN werden über die Diagnoseschnittstelle des Fahrzeugs beziehungsweise den Fahrzeugdiagnoseservice VDS ausgelesen.

There are several options from the vehicle:

• - Direct forwarding of individual log messages from the central logging concentrator VLK-Z via the data collection master DCM and the wireless interface OTA via the data collection system GDC for the vehicle fleet or its data pump DP into the central data collection device DL.
• - Ring buffer functionality (“Flight Recorder” FR): Initially, on-board recording and buffering of several log messages in the form of snapshots SN (“Log Snapshot Files”) in a persistent memory of the central control unit Z (e.g. flash memory, USB connected to the central control unit Z -Stick, etc.). The snapshots SN are then sent to the data collection master DCM with OTA forwarding to the data collection system GDC and the data collection device DL, or the snapshots SN are read out via the diagnostic interface of the vehicle or the vehicle diagnostic service VDS.

The log data is forwarded in a preferably uniform, standardized format. A possible specification of the format could, for example, become part of the “AUTOSAR” standard.

Optionally, filtering and preprocessing can take place in the logging concentrators or concentrator devices VLK and BLK. The introduction of the “intermediate collection points” VLK and BLK in the collection cascade enables pre-processing (e.g. pre-analyses, extended filtering) by aggregating and temporarily storing the log data (= “Flight Recorder” functionality). options, data compression, etc.) already in the vehicle (“IOT Edge Computing”).

The preprocessing instructions to be carried out are introduced, for example, in the form of scripts as part of the campaign data. LUA, for example, can be used as a scripting language.

Optionally, a special triggering of the snapshots from the ring buffer FR can also take place. By aggregating log data in one or more ring buffers (at least one per campaign and its filter configurations) and storing them as snapshot files when the trigger conditions defined in the campaign are met, the history of log messages up to a specific event (e.g. occurrence of an error). For example, the last two minutes of log messages can always be stored in the ring buffer and accessed when necessary.

• - Der Erhalt einer (bestimmten) Lognachricht auf einem (bestimmten) Logkanal.
• - Eine konfigurierbare Boole'sche Verknüpfung mehrerer Filterbedingungen, die auf die im Ringpuffer FR ankommenden Logdaten angewendet werden.
• - Ein Ergebnis einer Vorverarbeitung per Skript. Dies ermöglicht z.B. auf Statistiken oder Voranalysen der im Ringpuffer FR ankommenden Logdaten basierende Triggerungen.
• - „Manuelle Trigger“: Hierbei handelt es sich um einen expliziten Methodenaufruf am Ringpuffer FR (z.B. durch andere Services im Fahrzeug), der die Speicherung des aktuellen Ringpuffer-Inhalts als Schnappschuss auslöst.

Trigger conditions can be:

• - The receipt of a (specific) log message on a (specific) log channel.
• - A configurable Boolean combination of several filter conditions that are applied to the log data arriving in the ring buffer FR.
• - A result of pre-processing via script. This enables, for example, triggering based on statistics or pre-analyses of the log data arriving in the ring buffer FR.
• - “Manual trigger”: This is an explicit method call on the ring buffer FR (e.g. by other services in the vehicle), which triggers the storage of the current ring buffer contents as a snapshot.

The log data in the snapshots is preferably stored in a uniform standardized format, which in turn can be part of the AUTOSAR standard.

Through the optional use of a data collection system GDC for an entire vehicle fleet, the campaigns can be extended to vehicle fleets in order to be able to use analysis methods based on machine learning (e.g. automatic error pattern recognition, correlation with environmental events, etc.). Such analyzes can be carried out in a large data analysis system BDAS, which, for example, has several data analysis services DAS1 ... DASn (generally DAS). For this purpose, the data analysis system BDAS can access the logging files of the central data collection device DL. Customers KD, Sales VT and Quality Assurance QS can benefit from the corresponding analysis systems.

In special exemplary embodiments, it can be provided that the central evaluation of the log messages from the distributed sources is ensured by specifying a time-synchronized timestamp (synchronized time reference SRZ) and a unique identification of log messages with a source UUID. It can also be advantageous to additionally influence the filtering by using a data protection attribute in the log data. Furthermore, a selection of cyber security procedures to be applied between the concentration points can be made possible by using a security attribute in the log data. In a further advantageous embodiment of the method or system according to the invention, log data filters can be adjusted automatically or dynamically. Further advantages can be achieved when using a canonical data log and configuration data transfer format or protocol.

Vehicle users should be able to influence which log messages from their vehicle or from their device can be collected in the data system. For this purpose, it can be provided that vehicle users can, for example, give their consent or non-consent to the collection of certain data in several stages (“privacy setup”). In this case, from the time a new level is selected, the log data filters must be adjusted at appropriate points in the data collection chain so that only the permissible data is transmitted or saved. Filtering the log messages in this regard is possible, for example, if the log messages have a data protection attribute that can be assigned a corresponding value (e.g. “private”, “not private”). The filters can be present both onboard and in the (cloud) backend. This requires that the data protection settings desired by the vehicle user can be accessed in both places or be synchronized accordingly.

For example, the user sets a protection level in their vehicle's infotainment system. If necessary, this is translated into configuration data for filters and/or data sources. This means that the log messages can be filtered in the data sources, but also in the concentration devices or, for example, in the ring buffer.

For example, if position data from vehicles is to be collected using a campaign, but the vehicle user does not agree to the collection of position data, the campaign must be aligned with the user's wishes. In this case, at the vehicle user's request, the campaign will not be started for him or only part of the campaign will be carried out, namely the one to which the vehicle user has given his consent.

2 shows an exemplary embodiment of a method according to the invention for transmitting or collecting log messages in a data system for vehicles. In a first step S1, configuration data is created in a terminal (e.g. smartphone) or a vehicle (e.g. infotainment system) of the data system. This allows the vehicle user, for example, to specify a private data protection setting.

In a second step S2, the configuration data is transferred to the respective data source. If the data source has several log channels, the configuration data can also be transferred directly to the respective log channels. If necessary, the configuration data is also transferred to other data sources or filters.

With the configuration data, the data sources or filters are configured accordingly, which in 2 is not explicitly shown. Depending on the configuration data or the configuration, in one exemplary embodiment the data source basically blocks the sending of log messages if the vehicle user sets this accordingly with the configuration data (see step S7).

In an alternative exemplary embodiment, the respective data source is configured using the configuration data so that one, several or all log messages receive a respective data protection attribute according to step S3. This privacy attribute can be given the values “private”, “not private” or similar.

In a subsequent step S4, the log message including the data protection attribute is sent from the data source. For example, the log message is sent within a control device to a concentration device and from there to a central control device, from which the log messages can be sent to a central data collection device.

On the way from the data source to the data collection device, one or more filters can be provided in which the log message (EN) is filtered according to step S5. In this case, the data protection attribute can be used for this filtering.

If necessary, a log message is forwarded in accordance with step S6. This is the case, for example, if the vehicle user marks the log message from the data source as “not private”. Otherwise, if the log message is marked as “private”, it is blocked according to step S7.

The vehicle user can alternatively or additionally configure filters provided in the log message stream from the respective data sources to the data collection device. For this purpose, the configuration data created in step S1 is transferred to the filter or to the filters according to step S8. The filter is then configured according to step S9 in order to influence the filter effect according to step S5. In this way, it is possible for the vehicle user to specifically configure certain data sources or log channels. For example, if it is important to him that no personal data from the address book is transferred to log messages, he can filter out relevant log messages in a specific filter. On the other hand, if he agrees to the transmission of position data in log messages, then another filter that filters log messages from a position data source is configured so that these log messages, for example. B. be sent to the data collection device.

In this way, a vehicle user can adapt the collection of log messages individually to his needs. Advantageously, unauthorized collection and storage of log data can be prevented, as they can be filtered out or discarded based on the individual data protection setting.

Reference symbol list

BDAS

large data analysis system

BE

Backend

ES

Cloud backend system

BLK

Logging concentrator

CL

Cloud

C.S

Cloud service

THE

Data analysis service

DCM

Data Collection Master

DCOM

Data collection order management

DL

Data collection facility

DP

Data pump

EW

developer

FR

Ring buffer

FZ

vehicle

GDC

Vehicle fleet data collection system

IOT

Internet of Things

KD

Customer service

KE

Campaign creator

LMS

Logging management system

LN

Local network

OTA

Wireless connection

P.S

Production system

Q1-1 ...Sqm-n

Source index

QS

quality assurance

QZ-1 ...QZ-n

Source index

RZ

Reference time

SGP

ECU software partition

SN

snapshot

SRZ

synchronized time reference

SWC

Software component

S1 to S9

steps

VDS

Vehicle diagnostic service

VLK

Logging concentrator

VT

distribution

Z

Central control unit

Currently

Central time base

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 2018190965 A1 [0004]
• US 20200125473 A1 [0005]
• US 20150178999 A1 [0006]
• US 20140157349 A1 [0007]
• US 20190095304 A1 [0008]
• US 20040054918 A1 [0009]

Claims (12)

Method for transmitting a log message in a data system for vehicles (FZ), characterized by - creating (S1) configuration data in a terminal (SP) or a vehicle (FZ) of the data system, - transmitting (S2, S8) the configuration data a). a data source (SWC, CS), setting (S3) a data protection attribute in the log message of the data source (SWC, CS) according to the configuration data and sending (S4) the log message with the set data protection attribute from the data source (SWC, CS), or b ) to the data source (SWC, CS) and blocking (S7) the log message of the data source (SWC, CS) depending on the configuration data, or c) to a filter of the data system, configuring (S9) the filter according to the configuration data and filtering ( S5) the log message with the configured filter. Method according to one of the preceding claims, characterized in that the configuration data is created in a smartphone as a terminal (SP) and transmitted to the vehicle. Method according to one of the preceding claims, characterized in that the configuration data is transmitted (S2) to the data source (SWC, CS), the data source (SWC, CS) has several log channels, the configuration data has channel configuration data specific for each log channel and steps a ) or b) can be carried out channel-specifically. Method according to one of the preceding claims, characterized in that the configuration data is distributed to several data sources and/or filters in the entire data system inside and/or outside the vehicle. Method according to one of the preceding claims, characterized in that the creation (S1) of the configuration data is triggered by manually entering a protection level, based on which the configuration data is automatically generated specific to the protection level. Method for collecting log messages in a data system for vehicles (vehicles), comprising the steps: - Creating a logging campaign that has at least one filter configuration message, - automatically transmitting the filter configuration message to a data source (SWC, CS) of the data system, the filter configuration message having an assignment rule for assigning a data protection identifier to the attribute of a log message of the data source (SWC, CS, SP), and - A method for transmitting the log message is carried out according to one of the preceding claims. Data system with at least one vehicle (FZ), wherein - the data system is designed to transmit a log message from a data source (SWC, CS) of the data system, characterized by - a configuration device for creating (S1) of configuration data, the configuration device in a terminal (SP ) of the data system or in which at least one vehicle (FZ) is arranged, and - a transmission device for transmitting (S2, S8) the configuration data from the configuration device a) to the data source (SWC, CS) of the data system, the data source (SWC, CS) is designed to set (S3) a data protection attribute in the log message according to the configuration data and to send (S4) the log message with the set data protection attribute, or b) to the data source (SWC, CS), whereby the data source (SWC, CS) is designed to block (S7) the log message depending on the configuration data, or c) to a filter of the data system, wherein the filter is designed to filter the log message according to the configuration data (S5). data system Claim 7 characterized in that the vehicle (FZ) has a control device (SGP), and the data source (SWC, CS) is part of the control device (SGP). data system Claim 7 or 8th , characterized in that the data source (SWC, CS) or the filter is located in the vehicle (FZ) or in a backend (BE), in particular a cloud backend, of the data system. Data system according to one of the Claims 7 until 9 , characterized in that the configuration device is part of an infotainment system of the vehicle (vehicle). Computer program comprising instructions that are used when the program is executed by a control device of a data system according to one of the Claims 7 until 10 cause this to carry out the procedure according to one of the Claims 1 until 6 to carry out. Computer-readable storage medium comprising instructions that can be used when executed by a control device of a data system according to one the Claims 7 until 10 cause this to carry out the procedure according to one of the Claims 1 until 6 to carry out.

Images