WO2023170907A1 - Encryption system, encryption device, encryption method, and computer-readable medium - Google Patents

Abstract

An encryption system (1) or an encryption device comprises: a reception unit (1c) that receives an instruction designating a range for execution of encryption prior to the start of log data acquisition; and a control unit (1e). The control unit (1e) controls, on the basis of the range, the timing of log data acquisition, the start position and the end position for encryption, and the saving of the log data. The control unit (1e) controls an encryption unit (1b) such that encryption is performed by inserting a start flag and an end flag, respectively, at the start position and the end position indicated by the range. If the entire range of the log data is designated as the range, the control unit (1e) controls the encryption unit (1b) such that encryption is performed without performing control to insert a start flag and an end flag. The control unit (1e) stores, in separate files, the post-encryption data for the log data of the portion corresponding to the range, and the as-is plaintext data for the log data of the portion that does not correspond to the range.

Description

Encryption system, encryption device, encryption method, and computer-readable medium

The present disclosure relates to an encryption system, an encryption device, an encryption method, and a program.

The amount of log data in various types of devices has been increasing due to recent advances in functionality. Furthermore, depending on the type of device and the information handled, log data collection must be kept confidential.

For example, Patent Document 1 describes a log collection system that aims to collect log information while preventing information leakage to a third party without using a dedicated tool or a dedicated user interface. There is. The log collection system includes a formatting section, a log acquisition section, an encryption section, and a log writing section. The formatting unit formats an external medium on which information can be read and written to include a public key in a volume label. The log acquisition unit acquires log information when an external medium is connected. The encryption unit encrypts the acquired log information using a public key included in the volume label. The log writing section writes the encrypted log information to external media.

Furthermore, in order to collect log data while maintaining confidentiality, it is also possible to adopt a method of encrypting each file, unlike the technique described in Patent Document 1. However, such a method has the problem that it occupies the computing resources of the device, and there is a risk of increasing the load on the device during operation. Therefore, a method has been proposed in which the load on computing resources is reduced by partially encrypting the data.

Furthermore, Patent Document 2 describes a method that makes it possible to adapt to high-speed lines by eliminating the need for processing using complex encryption algorithms, suppressing the deterioration of transmission efficiency due to redundant bits, and making it possible to conceal data using a simple method. A packet communication method for this purpose is described. The above packet communication method is a packet communication method for preventing data eavesdropping and tampering during data communication using bit synchronization, and includes an insertion step, a reception impossible step, and a reception enable step. In the insertion step, a synchronization flag sequence indicating the start and end of a frame, which is a unit of data to be transmitted, is inserted in a pseudo manner so that the frame length in packet communication is equal to or less than the minimum frame length. In the reception disabling step, the unauthorized receiving side discards frames with a length equal to or less than the minimum frame length as short frames, thereby making it impossible for an unauthorized person who attempts to eavesdrop or tamper with reception. The reception enable step enables the receiving side of the authorized person to delete the pseudo-inserted synchronization flag sequence and receive a frame with a minimum frame length or less as a regular frame.

Patent Document 3 describes a data encryption method that does not require adding an encryption function to an existing WWW (World Wide Web) server or WWW browser. The data encryption method performs data processing including encryption processing on data to be encrypted in which an instruction specifying a data processing method including an encryption processing method is incorporated in accordance with the embedded instruction. The data encryption method described above encrypts the range specified by the encryption range specification command for encryption target data in which an encryption range specification command that specifies the range to be encrypted is incorporated.

Patent Document 4 describes a log recording device that aims to achieve both confidentiality of user data and failure analysis performance. The log recording device includes a CDB (Command Description Block) determination means, a first encryption means, and a log output means. The CDB determination means determines whether the SCSI request of the SCSI log data is related to user data or not, based on CDB determination information for the input SCSI (Small Computer System Interface) log data. The first encryption means encrypts, based on an encryption key, a portion of the SCSI request that the CDB determination means determines is a SCSI request regarding user data, including user data. The log output means formats and analyzes the SCSI request that the CDB determination means has determined is a SCSI request that does not relate to user data, and the SCSI request in which the portion including the user data from the first encryption means has been encrypted. output as a log file.

JP 2017-215853 Publication Japanese Patent Application Publication No. 11-215190 Japanese Patent Application Publication No. 11-215122 JP2019-097028A

However, in the technology described in Patent Document 2, in order to achieve data confidentiality, it is necessary to insert a synchronization flag sequence even when encrypting all of the log data of the device.

Furthermore, with the technology described in Patent Document 3, the decryption range is limited not only when the data to be encrypted includes an encrypted part and an unencrypted part, but also when it only contains an encrypted part. Output as one piece of encrypted data incorporating the specified instruction. Therefore, even if the technology described in Patent Document 3 is applied to encrypt the log data of the device, even when all the log data is encrypted, one encrypted file incorporating the decryption range specification command is output. It turns out.

In addition, the technology described in Patent Document 4 outputs as one file when it includes an encrypted part and an unencrypted part, so in order to decrypt it, even if all the parts are encrypted, Even if the file has been encrypted, information indicating that it has been encrypted is required.

The present disclosure has been made to solve the above problem, and when encrypting device log data by specifying the range to be encrypted, even if the entire range is encrypted, the range is An object of the present invention is to provide an encryption system etc. that can avoid the need for information to be displayed.

In a first aspect, the encryption system includes an acquisition unit that acquires log data, an encryption unit that encrypts the log data, and a range in which the encryption unit executes encryption before starting to acquire the log data. a reception unit that receives an instruction to specify the log data, a storage unit that stores the log data, and a timing of acquisition of the log data by the acquisition unit and a start position and end position of the encryption by the encryption unit based on the range. , storage of log data by the storage unit, and a control unit for controlling the start position and the end position indicated by the range, a start flag that is a flag indicating the start position, respectively; The encryption unit is controlled to execute encryption by inserting an end flag, which is a flag indicating the end position, and when the entire range of log data is specified as the range, the start flag is inserted. and controlling the encryption unit to execute encryption without controlling the insertion of the end flag, and for log data of a portion that falls within the range, encrypted data that does not fall within the range. Partial log data is stored in plain text as separate files in the storage unit.

In a second aspect, the encryption device includes an acquisition unit that acquires log data, an encryption unit that encrypts the log data, and a range in which the encryption unit executes encryption before starting acquisition of log data. a reception unit that receives an instruction to specify the log data, a storage unit that stores the log data, and a timing of acquisition of the log data by the acquisition unit and a start position and end position of the encryption by the encryption unit based on the range. , storage of log data by the storage unit, and a control unit for controlling the start position and the end position indicated by the range, a start flag that is a flag indicating the start position, respectively; The encryption unit is controlled to execute encryption by inserting an end flag, which is a flag indicating the end position, and when the entire range of log data is specified as the range, the start flag is inserted. and controlling the encryption unit to execute encryption without controlling the insertion of the end flag, and for log data of a portion that falls within the range, encrypted data that does not fall within the range. Partial log data is stored in plain text as separate files in the storage unit.

In the third aspect, the encryption method includes acquiring log data, encrypting the log data, receiving an instruction specifying a range to perform encryption before starting to acquire the log data, and encrypting the log data. storing the data; and controlling the timing of acquiring the log data, the start and end positions of encryption, and the storage of the log data based on the range; , inserting a start flag indicating the start position and an end flag indicating the end position into the start position and end position indicated by the range, respectively, to perform encryption; If the entire range of data is specified, encryption should be executed without inserting the start flag and end flag, and the log data of the part corresponding to the range should be encrypted. This method includes storing the data in plain text for portions of the log data that do not fall within the above range as separate files.

In a fourth aspect, the program is a program for causing a computer to execute an encryption process, and the computer-readable medium stores the program. The encryption process includes acquiring log data, encrypting the log data, accepting an instruction specifying a range to perform encryption before starting to acquire the log data, and storing the log data. , and controlling the timing of acquiring log data, the start and end positions of encryption, and storage of log data based on the range, and the controlling includes controlling the timing of acquiring log data, the start position and end position of encryption, and storage of log data based on the range, and the controlling includes Encrypting is performed by inserting a start flag indicating the start position and an end flag indicating the end position into the start position and end position, respectively, and the range is the entire range of the log data. is specified, the encryption is executed without inserting the start flag and the end flag, and for the log data of the part corresponding to the range, the encrypted data is For log data that does not correspond to the above, the data is stored in plain text as separate files.

According to the present disclosure, when encrypting device log data by specifying the range to be encrypted, it is possible to avoid the need for information indicating the range even when encrypting the entire range. A possible encryption system etc. can be provided.

1 is a block diagram showing a configuration example of an encryption system according to a first embodiment; FIG. FIG. 2 is a block diagram showing an encryption device that is an example of the configuration of the encryption system in FIG. 1. FIG. 3 is a flow diagram for explaining an example of an encryption method in the encryption system of FIG. 1 or the encryption device of FIG. 2. FIG. 2 is a block diagram illustrating a configuration example of an encryption system according to a second embodiment. FIG. 5 is a diagram showing an example of a log acquisition command accepted as an instruction in the encryption system of FIG. 4. FIG. 5 is a flow diagram for explaining an example of processing in a target device in the encryption system of FIG. 4. FIG. 7 is a flow diagram following FIG. 6. FIG. 5 is a sequence diagram showing an example of the overall processing in the encryption system of FIG. 4. FIG. 9 is a sequence diagram following FIG. 8. FIG. 10 is a flow diagram for explaining an example of processing in a target device in an encryption system according to a third embodiment. FIG. It is a diagram showing an example of the hardware configuration of the device.

Hereinafter, embodiments will be described with reference to the drawings. Note that in the embodiments, the same or equivalent elements may be given the same reference numerals and redundant explanations may be omitted. Furthermore, in the following drawings, the same elements and similar elements are denoted by the same reference numerals, and redundant explanations are omitted as necessary.

<Embodiment 1>
FIG. 1 is a block diagram illustrating a configuration example of an encryption system according to a first embodiment.
As shown in FIG. 1, the encryption system 1 according to the present embodiment can include an acquisition section 1a, an encryption section 1b, a reception section 1c, a storage section 1d, and a control section 1e. The encryption system 1 includes a device from which log data is to be collected (hereinafter referred to as a target device) and a log collection device that collects logs from the target device, and collects various types of log data in the target device. Therefore, the encryption system 1 can be called a log collection system.

Note that the type of target device does not matter, as long as it can record logs. Further, the log collection device can be installed at the same location as the target device and directly connected to the target device, or can be installed at a remote location to the target device and connected via a network.

In the encryption system 1, the target device can include an acquisition unit 1a, an encryption unit 1b, a reception unit 1c, a storage unit 1d, and a control unit 1e. For example, a recording medium as one element constituting the storage unit 1d However, the present invention is not limited to this, such as providing the external device connected to the target device. Note that the storage unit 1d and the recording medium will be described later.

Further, the target device may adopt a configuration in which functions are distributed among multiple devices, and in that case, a method for distributing the acquisition unit 1a, encryption unit 1b, reception unit 1c, storage unit 1d, and control unit 1e It doesn't matter. For example, each device may be provided with the functions of the encryption section 1b and the storage section 1d, and one of the devices may be provided with the acquisition section 1a, the reception section 1c, and the control section 1e.

The acquisition unit 1a acquires log data in the target device. Regardless of the method of acquiring log data, it is possible to acquire log data of a type and period that are predetermined or included in instructions described below, for example. The encryption unit 1b encrypts the log data acquired by the acquisition unit 1a. However, as will be described later, the encryption unit 1b encrypts a specified range of log data, and does not encrypt log data outside the range. Further, the encryption method used in the encryption unit 1b is not limited as long as the encrypted data can be decrypted.

The reception unit 1c receives an instruction specifying the range to be encrypted by the encryption unit 1b before the acquisition unit 1a starts acquiring log data. This instruction may be sent from a log collection device connected to the target device via a network or P2P. Therefore, the reception unit 1c can include a communication unit (not shown) that communicates with the log collection device. This communication unit can include an interface for communicating with the outside wirelessly or by wire. However, the function of the log collection device may be provided in the target device. In this case, the encryption system 1 is constituted by the target device, and the above-mentioned instructions are also accepted from an operation unit provided in the target device.

The storage unit 1d stores encrypted log data and plaintext log data. The storage unit 1d can be a storage device including a recording medium and a writing unit that writes data to the recording medium. The type of recording medium does not matter.

The control unit 1e controls the timing of acquisition of log data by the acquisition unit 1a, the start and end positions of encryption by the encryption unit 1b, and the storage of log data by the storage unit 1d, based on the above range. .

The control unit 1e inserts a start flag indicating the start position and an end flag indicating the end position into the start position and end position indicated by the range accepted by the receiving unit 1c, respectively, and executes encryption. The encryption unit 1b is controlled so as to At this time, the control unit 1e also controls the acquisition unit 1a to acquire log data based on the above range. In this way, the encryption system 1 can partially encrypt log data.

Then, the control unit 1e stores the encrypted data for the portion of the log data that falls within the above range, and stores the plain text data for the portion of the log data that does not fall within the above range into separate files (separate files). It is stored in the storage unit 1d as a log file).

In particular, in this embodiment, when the entire range of log data is specified as the above range, the control unit 1e performs encryption so that encryption is executed without performing control to insert a start flag and an end flag. 1b. As a result, when encrypting the entire range of log data, a start flag and an end flag are not inserted, and a log file that does not include a start flag and an end flag is stored in the storage unit 1d.

The control unit 1e can be realized by, for example, a CPU (Central Processing Unit), a working memory, a nonvolatile storage device that stores a program, and the like. This program can be a program for causing the CPU to execute the processing of the acquisition section 1a, the encryption section 1b, the reception section 1c, and the writing section of the storage section 1d. Further, the recording medium of the storage device provided in the control section 1e can also be used as a recording medium of the storage section 1d.

The target device also includes a transmitter that transmits the file (log file) stored in the storage unit 1d to the log collection device that is the instruction device that sent the instruction, in response to the instruction received by the reception unit 1c. be able to. This transmitting section can utilize a communication section provided in the receiving section 1c. In this way, the target device includes an encryption unit 1b, a reception unit 1c, a storage unit 1d, and a transmission unit that transmits the log files stored in the storage unit 1d to the log collection device, and is configured as a log data collection target. It can be made into a device.

In this example, the log collection device is a device that transmits an instruction to the reception unit 1c to be accepted by the reception unit 1c. Although not shown, the log collection device can include a control unit that controls the entire log collection device, and a communication unit that communicates with the target device. This communication unit can include an interface for communicating with the outside wirelessly or by wire. Further, the log collection device can be configured to receive the log file stored in the storage unit 1d via the communication unit. The control unit of the log collection device can be realized by, for example, a CPU, a working memory, a nonvolatile storage device that stores a program, and the like. This program can be a program for causing the CPU to execute a process of generating an instruction to be transmitted to the reception unit 1c and a process of transmitting the instruction to the target device via the communication unit. Note that the recording medium of the storage device provided in the control unit of the log collection device can also be used as a recording medium for storing log files received in this manner.

Furthermore, the encryption system 1 can be configured as multiple devices with distributed functions, as illustrated by the log collection device and the target device, and the functions of each part illustrated as the target device are also distributed among multiple devices. The distribution method is not limited. When constructing the encryption system 1 by distributing functions to multiple devices, each device is equipped with a control unit, a communication unit, and if necessary, a storage unit, etc., and the multiple devices are connected by wireless or wired communication. The functions of the encryption system 1 may be realized by connecting and cooperating as necessary.

Furthermore, as shown in FIG. 2, the encryption system 1 can be constructed as one encryption device 2 including an acquisition section 1a, an encryption section 1b, a reception section 1c, a storage section 1d, and a control section 1e. . FIG. 2 is a block diagram showing an encryption device 2 that is an example of the configuration of the encryption system 1 in FIG. The encryption device 2 may be a device that has the functions of the target device described above, or a device that has the functions of the target device and the functions of the log collection device. The encryption device 2 may be configured to include a computer device including hardware including, for example, one or more processors and one or more memories. At least a part of the functions of each part in the encryption device 2 can be realized by one or more processors operating according to a program read from one or more memories.

Next, a processing example of the encryption system 1 or the encryption device 2 will be described with reference to FIG. FIG. 3 is a flow diagram for explaining an example of an encryption method in the encryption system 1 or the encryption device 2. The encryption method in the encryption system 1 will be described below, but the encryption method in the encryption device 2 is also similar.

First, before starting the acquisition of log data, the encryption system 1 receives an instruction specifying a range to perform encryption (step S1). Based on this instruction, the encryption system 1 acquires log data (step S2). Next, the encryption system 1 determines whether the instruction indicates that the entire range is to be encrypted (step S3).

If YES in step S3, the encryption system 1 executes encryption for the entire range of log data within the above range without inserting a start flag and an end flag, that is, without going through step S5 described below. (Step S6). Then, the encrypted log data is stored as one log file (step S7).

On the other hand, if NO in step S3, it is determined whether the log data acquired in step S2 falls within the above range (step S4). Then, for the log data determined as YES in step S4, that is, the log data corresponding to the above range, the encryption system 1 inserts a start flag and an end flag at the start position and end position of the log data in the above range, respectively. (Step S5). After that, the encryption system 1 executes encryption (step S6). Thereafter, the process similarly advances to step S7, and the encrypted log data is stored as one log file.

On the other hand, for log data for which the determination is NO in step S4, that is, log data that does not fall within the above range, the encryption system 1 stores the plaintext data as one file (step S8).

Note that the timing of obtaining the log data in step S2 is in the order shown in the figure, if it is the target to be encrypted, before encryption, and if it is in plain text, before the log file is stored (step S8). No question.

The encryptable log collection process according to this embodiment has been described. In this embodiment, any method of decrypting an encrypted log file is not concerned. The encrypted log file stored in this embodiment can be viewed by employing a decryption method that corresponds to the encryption method. Furthermore, in this embodiment, although there is no start flag and end flag in a log file that has been encrypted in all its ranges, this log file can be viewed by employing a general-purpose decryption method. Furthermore, since the plaintext log file stored in this embodiment is a separate file from the encrypted log file, it can be viewed as is.

As described above, according to the present embodiment, log data is not entirely encrypted when collecting logs from the target device, but only the confidential information is hidden by partially encrypting it, and only the information that can be provided is stored in the plain text log file. It can be published by doing this. For example, by partially encrypting the log, the information that can be published in the log, such as time information, can be immediately known, making it possible to quickly check the log when a problematic event occurs. In addition, in this embodiment, since the configuration allows selection of whether or not encryption is required, it is possible to collect logs without the hassle of decryption even when debugging, such as during in-house testing, where encryption is not required. .

Further, according to the present embodiment, when collecting logs of the target device, the log data can be partially encrypted, so the time occupied by CPU resources due to encryption can be shortened, and the log data of the target device can be partially encrypted. The load can be reduced.

For example, if a problem occurs in the target device and it is difficult to obtain log data by remote control, it is necessary to go to the site and collect the log data, and there are cases where this work is outsourced to a third party. Even in such a case, according to this embodiment, it is possible to reduce the load on the target device and ensure confidentiality only for the necessary portion, making it impossible for a third party to read the log file. This eliminates the risk of information leakage. In this way, in this embodiment, when logs are collected locally or remotely from a target device, the contents of the log files can be safely collected without being referenced by a third party.

In particular, according to this embodiment, when encrypting device log data by specifying a range to be encrypted, information indicating the range is required even when encrypting the entire range. It is possible to avoid this. In other words, according to this embodiment, in the case where the entire range is encrypted, it is possible to encrypt without the start flag and end flag, and the encrypted part and the non-encrypted part are separated into separate files. can be saved in Therefore, according to this embodiment, it is possible to reduce the amount of data by not inserting the flag when encrypting the entire range, and also to encrypt the necessary parts when viewing the file, so that necessary confidentiality can be achieved. It is possible to ensure sex.

<Embodiment 2>
Embodiment 2 will be described with reference to FIGS. 4 to 9, focusing on the differences from Embodiment 1, but various examples described in Embodiment 1 can be applied. First, a configuration example of the encryption system according to the present embodiment will be described with reference to FIGS. 4 and 5. FIG. 4 is a block diagram showing a configuration example of an encryption system according to the second embodiment, and FIG. 5 is a diagram showing an example of a log acquisition command accepted as an instruction in this encryption system.

The encryption system shown in FIG. 4 (hereinafter referred to as the present system) may include a target device 10 that functions as an encryption device according to the present embodiment, and a log collection device 20 that collects log files from the target device 10. can. As described in the first embodiment, the log collection device 20 may encrypt and collect log files at the location where the target device 10 is installed, or may encrypt and collect log files from the target device 10 connected remotely. Good too.

To simplify the explanation, an example will be given in which this system includes one target device 10. However, this system includes a plurality of target devices 10 for one log collection device 20, and the log collection device 20 sends instructions to each of the plurality of target devices 10 and collects log files from each. It can also be configured as

The log collection device 20 can include a control section 21, an operation section 22, a storage section 23, and a communication section 24. The log collection device 20 can be composed of a single device or a distributed device.

The control unit 21 is a control unit that controls the entire log collection device 20. The control unit 21 can be realized by, for example, a CPU, a working memory, a nonvolatile storage device that stores a program, and the like. This program can include a program for causing the CPU to execute processing for acquiring logs. Furthermore, the storage device provided in the control section 21 can also be used as a storage section 23, which will be described later.

The operation unit 22 receives an operation for requesting a log file from the target device 10 that is the target of log collection, passes the operation details to the control unit 21, and the control unit 21 requests a log file according to the operation details. be able to. This request is a command that requests (instructs) the target device 10 to acquire a log, and is hereinafter referred to as a log acquisition command.

As illustrated in Figure 5, the log acquisition command must include information indicating the log type to be collected, information indicating whether encryption is required, and information indicating the specified encryption range (in the case of partial encryption). I can do it. These pieces of information that can be included in the log acquisition command, that is, parameters, can be specified from the operation unit 22, for example.

The above-described information indicating the log type can be information indicating the type of log to be collected, such as a log of a certain application installed in the target device 10 or a log of a certain device provided in the target device 10. . In the example of FIG. 5, for the sake of simplification, the information indicating the log type will be described as being expressed as a log acquisition command name. However, each log acquisition command includes information indicating the log type, or the target device 10 is configured to be able to determine the log type from the log acquisition command name.

Here, the case where all data is encrypted and the case where no encryption is performed will be described on the premise that it is possible to specify the log data to be collected in the target device 10 only by the log type. However, as described later, in these cases, information indicating the log acquisition range should be included in the log acquisition command, and the target device 10 should be configured to specify the log data to be collected from the log type and the log acquisition range. You can also do it.

The above-mentioned information indicating whether or not encryption is necessary can be information indicating either fully encrypted, partially encrypted, or no encryption required. The above-mentioned information indicating the encryption range is information that specifies the encryption range for a log acquisition command in which partial encryption is specified, and is an invalid parameter in cases other than partial encryption. The information indicating the encryption range may be information indicating the range specified by the processing content, such as from processing α to processing β, for the log type indicated by the log acquisition command, or from the first date and time to the second date and time. The information can be information indicating the processing period. Alternatively, the information indicating the encryption range may be a combination thereof. In addition, the range specified by the processing content includes multiple ranges such as from processing α to processing β and from processing γ to processing δ, or from the first date and time to the second date and time and from the third date and time to the fourth date and time. It is also possible to have multiple processing periods.

The operations accepted by the operation unit 22 can include an operation of inputting information indicating the target device 10 that is the target of log collection. The operations accepted by the operation unit 22 can include operations for inputting information included in the log acquisition command. Therefore, the accepted operations include information indicating the log data to be acquired or the type of the log data, information indicating whether or not to perform encryption, and if encryption is to be performed, whether to execute all or part of the target. The operation may include an operation of inputting information indicating whether to execute the process. In addition, if the log data to be acquired is to be partially encrypted, the accepted operation can include an operation of inputting information indicating the encryption range.

Further, the operation unit 22 may simply accept an operation to input information indicating the target device 10. In that case, the control unit 21 can read or generate a log acquisition command based on predetermined contents regarding the necessity of encryption and specification of the encryption range (in the case of partial encryption).

The storage unit 23 is a storage device that stores the log file received from the target device 10 via the communication unit 24 in response to the above request. The communication unit 24 transmits the above request to the target device 10 under the control of the control unit 21, and receives the log file as a response. The communication unit 24 can include a wired or wireless communication interface.

The target device 10 is an example of the encryption device 2 in FIG. The target device 10 can include a main control section 11 that controls the entire device, and a communication section 12 that communicates with the outside. Under the control of the main control unit 11, a functional unit that realizes an original function (not shown) in the target device 10 can be operated.

Furthermore, the target device 10 can include the following components in order to function as an encryption device. That is, the target device 10 includes a log acquisition section 15, a buffer section 16, an encryption section 17, a writing section 18, and a log acquisition section 16, respectively, as examples of the acquisition section 1a, encryption section 1b, storage section 1d, and control section 1e in FIG. A recording medium 19 and a generation control section 14 can be provided. The communication unit 12 also has the function of the reception unit 1c in FIG. 2 as well as the function of transferring log files to the log collection device 20. The log acquisition unit 15, the buffer unit 16, the encryption unit 17, the writing unit 18, the recording medium 19, and the generation control unit 14 can function as the log generation unit 13 that generates logs in cooperation with each other. The target device 10 can be composed of a single device or a distributed device.

The main control unit 11 is a control unit that controls the entire target device 10. The main control unit 11 can be realized by, for example, a CPU, a working memory, a nonvolatile storage device storing a program, and the like. This program can be a program for causing the CPU to execute a process for instructing the generation control unit 14 of the log generation unit 13 to perform the process in the functional unit and the process related to log acquisition for functioning as an encryption device. . Further, the storage device provided in the main control section 11 can also be used as a recording medium 19. The communication unit 12 receives a log acquisition command from the log collection device 20, and transmits a log file in response. The communication unit 12 can include a wired or wireless communication interface.

The log generation unit 13 generates a log file under control from the main control unit 11. Specifically, the log generation unit 13 receives the log acquisition command received by the communication unit 12 from the main control unit 11, thereby causing the components included in the log generation unit 13, such as the generation control unit 14, to cooperate. Through this cooperation, the log generation unit 13 generates a log file and transmits the log file via the communication unit 12, as described below.

The generation control unit 14 is a control unit that controls the entire log generation unit 13 under control from the main control unit 11. The generation control unit 14 receives the log acquisition command received by the communication unit 12 from the main control unit 11, generates a log file according to the log acquisition command, and transmits the log file via the communication unit 12. As described above, this log acquisition command can include the necessity of encryption and the specified encryption range in the case where partial encryption is performed. Of course, if the log acquisition command includes only the encryption range, it also implicitly includes the necessity of encryption, so the generation control unit 14 determines whether encryption is necessary or not, whether full encryption/partial encryption is required. It can be said that it is possible to know the changes.

Based on the log acquisition command, the generation control unit 14 determines the timing of acquisition of log data by the log acquisition unit 15, the start and end positions of encryption by the encryption unit 17, and the recording medium 19 of log data by the writing unit 18. Write to and control.

In other words, the generation control unit 14 performs control to start collecting logs according to the log acquisition command received from the main control unit 11 in accordance with the contents described in the log acquisition command. This control includes control over the log acquisition section 15, encryption section 17, and writing section 18, and for each of them, log data acquisition processing, log data encryption processing, log data file creation, and file writing are performed. Execute the process. Further, the generation control unit 14 returns the written log file, which is the written file, to the log collection device 20 that sent the log acquisition command via the communication unit 12.

As the above encryption process, the generation control unit 14 inserts an encryption start flag indicating the start position and an encryption end flag indicating the end position into the start position and end position indicated by the encryption range, respectively, and performs encryption. The encryption unit 17 is controlled to execute the following.

However, if the entire range of log data is specified as the encryption range, the generation control unit 14 executes encryption without controlling to insert the encryption start flag and the encryption end flag. Controls the encryption unit 17. As a result, when encrypting the entire range of log data, the encryption start flag and encryption end flag are not inserted, and a log file that does not include the encryption start flag and encryption end flag is stored in the recording medium 19. It will be remembered.

The generation control unit 14 performs the following control as the log data file creation and file writing processing described above. That is, the generation control unit 14 generates separate logs by storing the encrypted data for the portion of the log data that falls within the encryption range, and the plain text data for the portion of the log data that does not fall within the encryption range. The writing unit 18 is controlled so as to store it as a file.

In particular, in this embodiment, when a partial range of log data is specified as an encryption range in a log acquisition command, a part of the log data including the encryption range and larger than the encryption range is specified in the log acquisition command. Contain instructions to specify the range of log acquisition. In other words, the operation unit 22 of the log collection device 20 also accepts an operation that specifies information indicating a partially encrypted log acquisition range, and the control unit 21 includes this information in the log acquisition command and sends it to the target device via the communication unit 24. 10. Thereby, in the target device 10, it is also possible to know the range for acquiring log data in plain text from the partially encrypted log acquisition range and the encrypted range.

Then, the generation control unit 14 controls the writing unit 18 to collectively store the encrypted data obtained in the partially encrypted log acquisition range as one log file 19a. Furthermore, the generation control unit 14 causes the writing unit 18 to store all the plaintext data obtained in a part (range) excluding the encrypted range of the partially encrypted log acquisition range as one log file 19b. control. With this control, even if the partially encrypted log acquisition range includes multiple encrypted ranges, all the data encrypted for these encrypted ranges are combined into one log file 19a, and the remaining ranges are All the plaintext data is combined into one log file 19b.

For example, in a certain log acquisition command, if the partially encrypted log acquisition range is specified as the encryption range from processing α to processing β and from processing γ to processing δ, one encrypted log file 19a and one plaintext log file 19b are stored.

The same concept can be applied even when the encryption range is specified in multiple processing periods, such as from the first date and time to the second date and time and from the third date and time to the fourth date and time. Note that here, the first date and time, the second date and time, the third date and time, and the fourth date and time are explained as dates and times that are closer to the present in this order. In this case, the encrypted log data from the first date and time to the second date and time and the encrypted log data from the third date and time to the fourth date and time are stored as one log file. Plaintext log data from the second date and time to the third date and time, plaintext log data from the start date and time of the partially encrypted log acquisition range to the first date and time, and from the fourth date and time to the end date and time of the partially encrypted log acquisition range plaintext log data is stored as one log file. However, if the start date and time of the partially encrypted log acquisition range and the first date and time are the same, the corresponding plaintext log data does not exist, and the end date and time of the partially encrypted log acquisition range and the fourth date and time are the same. In this case, the corresponding plaintext log data does not exist.

Under the control of the generation control unit 14, the log acquisition unit 15 acquires the log data in the target device 10 instructed by the log acquisition command, and temporarily stores it in the buffer unit 16. The buffer unit 16 is a temporary storage buffer for log data acquired by the log acquisition unit 15, and the temporarily stored log data is used when encrypted by the encryption unit 17 or written by the write unit 18. .

The encryption unit 17 encrypts the log data in the range (encryption range) specified by the log acquisition command among the log data acquired by the log acquisition unit 15. The encryption method in the encryption unit 17 does not matter, as long as the encrypted data can be decrypted. The encryption unit 17 also sets an encryption start flag to the start point indicated by the encryption range, and sets an encryption end flag to the encryption end point indicated by the encryption range. The encryption start flag and encryption end flag can be set by inserting the encryption start flag and encryption end flag, respectively.

Furthermore, the encryption unit 17 encrypts the plaintext log data to be encrypted, which is temporarily stored in the buffer unit 16, by storing it in a byte array and using the set encryption method and password, for example. In the encryption unit 17, the encryption method and password can also be set, and the setting of the encryption method must be accepted from the operation unit (not shown) of the target device 10, or be made according to the contents described in the log acquisition command. I can do it. The password can be set according to the contents described in the log acquisition command, but is not limited thereto. Furthermore, instead of using a password, the encryption method used by the encryption unit 17 does not matter, such as using public key encryption, TLS (Transport Layer Security), SSL (Secure Socket Layer), or the like. The encryption unit 17 can temporarily store the encrypted log data in the buffer unit 16. However, the encrypted log data can also be temporarily stored in a buffer section provided within the encryption section 17.

The writing unit 18 performs control to convert encrypted log data and plaintext log data temporarily stored in the buffer unit 16 into a file and write the file into a recording medium 19. As a result, the recording medium 19 stores at least one of a log file for encrypted flagged log data, a log file for encrypted log data without a flag, and a log file for plaintext log data. That will happen.

The type of recording medium 19 does not matter, and may be, for example, a hard disk drive, a solid state drive, or a portable recording medium. The recording medium 19 may be a storage device used by the target device 10 to perform its original functions.

Additionally, the generation control unit 14 and the log acquisition unit 15 are subsystems for causing the CPU of the main control unit 11 to execute log generation, log file return processing via the communication unit 12, and log data acquisition processing, respectively. Can be configured programmatically. The encryption unit 17 and the writing unit 18 may be configured with subprograms for causing the CPU of the main control unit 11 to execute processing for encrypting log data and processing for creating and writing log data into a file, respectively. can. However, these parts are not limited to being composed of subprograms; for example, the encryption unit 17 can be composed of hardware that performs encryption.

Next, an example of processing in the target device 10 in this system will be described with reference to FIGS. 6 and 7. FIG. 6 is a flowchart for explaining an example of processing in the log generation unit 13 of the target device 10 in this system, and FIG. 7 is a flowchart following FIG. 6.

In FIGS. 6 and 7, an example of processing for a certain log acquisition command will be explained as an example, but if there are multiple log acquisition commands for the target device 10, the following process will be executed for each log acquisition command. be done.

In the log generation unit 13, when the generation control unit 14 first receives the log acquisition command from the log collection device 20, it checks the information (parameters) written in the log acquisition command (step S11). Next, the generation control unit 14 determines whether encryption is necessary based on the check result (step S12).

If encryption is not necessary, that is, if NO in step S12, the generation control unit 14 causes the log acquisition unit 15 to acquire (collect) log data, and causes the buffer unit 16 to temporarily store the collected log data in plain text. (Step S13). Next, the generation control unit 14 controls the writing unit 18 to convert the plaintext log data temporarily stored in the buffer unit 16 into a file and write it to the recording medium 19 (step S14), and ends the process.

If encryption is required, that is, YES in step S12, the generation control unit 14 determines whether or not part of the data is encrypted (or all of it is encrypted) based on the check result in step S11 (step S15). ). If all are to be encrypted, that is, if NO in step S15, the generation control unit 14 causes the log acquisition unit 15 to acquire (collect) log data, and temporarily saves the collected log data in the buffer unit 16 in plain text. (Step S16).

After that, the generation control unit 14 causes the encryption unit 17 to execute encryption on the log data temporarily stored in the buffer unit 16, and causes the encrypted log data to be temporarily stored in the buffer unit 16 (step S17). ). The encryption unit 17 stores, for example, plaintext log data in a byte array, specifies an encryption method and password, and performs encryption. The encryption method and password may be set in the log acquisition command or may be determined in advance.

Next, the generation control unit 14 controls the writing unit 18 to convert the encrypted log data temporarily stored in the buffer unit 16 into a file and write it to the recording medium 19 (step S18), and ends the process.

If partial encryption is to be performed, that is, if YES in step S15, the generation control unit 14 executes the loop process from the start of the loop (step S21s) to the end of the loop (step S21e) until the log acquisition command ends. Execute.

When performing partial encryption, the encryption start position is specified by the encryption range in any of the partial encryption log acquisition ranges. Therefore, the generation control unit 14 first determines whether the encryption start position is the one indicated by the check result in step S11 based on the current acquisition status of the log data (step S22). Note that at the beginning of the loop process, if the start position of the partially encrypted log acquisition range and the encryption start position match, YES is returned in step S22; otherwise, in other words, the unencrypted If there is a range, the answer in step S22 is NO.

If NO in step S22, the generation control unit 14 causes the log acquisition unit 15 to acquire (collect) log data, and temporarily stores the collected log data in the buffer unit 16 in plain text (step S23). Next, similarly to step S22, the generation control unit 14 determines whether it is the encryption start position based on the current acquisition status of the log data (step S24). If NO in step S24, the process in step S23 is continued.

The generation control unit 14 continues the process in step S23 until the sequence advances to the encryption start position (until YES in step S24). When the encryption progresses to the encryption start position, that is, when the answer is YES in step S24, the generation control unit 14 saves the plaintext log data temporarily stored in the buffer unit 16 to the first file, which is a file for plaintext. The writing unit 18 is controlled to write to (step S25).

In step S25, in the first loop in which the first file is not generated, the generation control unit 14 controls the writing unit 18 to generate the first file by converting the temporarily saved plaintext log data into a file. and write it on the recording medium 19. In the subsequent loop processing, in step S25, the generation control unit 14 causes the writing unit 18 to add the temporarily stored plaintext log data to the first file stored in the recording medium 19. After step S25 ends, the process moves to the next loop process.

On the other hand, if YES in step S22, the generation control unit 14 causes the encryption unit 17 to insert an encryption start flag (step S26). At this stage, the log data of only the encryption start flag for the encryption section may be temporarily stored in the buffer section 16. Next to step S26, the generation control unit 14 causes the log acquisition unit 15 to acquire (collect) log data, temporarily stores the collected log data in the buffer unit 16 in plain text (step S27), and places the encryption end point It is determined whether the process has proceeded to (step S28). If NO in step S28, the process in step S27 is continued.

When the encryption end position has been reached, that is, YES in step S28, the generation control unit 14 controls the encryption unit 17 to insert an encryption end flag at the end of the temporarily saved log data. Then, the encryption unit 17 is caused to execute the insertion (step S29).

Next, the generation control unit 14 causes the encryption unit 17 to execute encryption on the flagged log data temporarily stored in the buffer unit 16, and causes the encrypted log data to be temporarily stored in the buffer unit 16. (Step S30). Here too, the encryption unit 17 stores, for example, plaintext log data in a byte array, specifies an encryption method and password, and performs encryption. The encryption method and password may be set in the log acquisition command or may be determined in advance.

The generation control unit 14 controls the writing unit 18 to write the encrypted log data that has been temporarily stored in the buffer unit 16 into the second file, which is an encryption file (step S31).

In step S31, in the first loop in which the second file is not generated, the generation control unit 14 controls the writing unit 18 to generate the second file by converting the temporarily stored encrypted log data into a file. It is generated and written on the recording medium 19. In subsequent loop processing, in step S31, the generation control unit 14 causes the writing unit 18 to add the temporarily stored encrypted log data to the second file stored in the recording medium 19. After step S31 ends, the process moves to the next loop process.

Next, a processing example of the log collection device 20 and the target device 10 will be described with reference to FIGS. 8 and 9. FIG. 8 is a sequence diagram showing an example of the overall processing in this system, and FIG. 9 is a sequence diagram following FIG. 8.

First, the log collection device 20 transmits a log acquisition request, which is a log acquisition command, to the target device 10, and the generation control unit 14 receives it (step S100). Although it has been explained that the log acquisition command can be specified from the operation unit 22 of the log collection device 20 etc., the contents set by the log acquisition command must be determined in advance, that is, it cannot be changed by the user of the log collection device 20. You can also make it impossible.

Next, the generation control unit 14 checks the parameters set in the received log acquisition command (step S101). Loop processing is executed for the number of log acquisition commands received. In this loop process, one of the following processes will be executed: no encryption, full encryption, or partial encryption, depending on the check result for the target log acquisition command. .

If the command is a log acquisition command without encryption, the generation control unit 14 executes the log acquisition command, thereby starting temporary storage (buffering) of the log data in the buffer unit 16 (step S102). Next, the generation control unit 14 requests the writing unit 18 to convert the log data into a file (step S103), and the writing unit 18 executes the file conversion and writes the plaintext log file to the recording medium 19. It is stored (step S104). Next, the writing unit 18 notifies the generation control unit 14 that the file creation has been completed in response to the request (step S105). Upon receiving this notification, the generation control unit 14 transmits (transfers) the plaintext log file stored in the recording medium 19 to the log collection device 20 via the communication unit 12 (step S106), and ends the process. .

If the log acquisition command is to encrypt everything, the generation control unit 14 executes the log acquisition command, and temporary storage of the log data in the buffer unit 16 is started (step S107). Next, the generation control unit 14 transmits an encryption request to the encryption unit 17 (step S108), and the encryption unit 17 responds to the request and executes encryption of the temporarily stored log data (step S109). ), notifies the generation control unit 14 of the end of encryption (step S110).

Upon receiving this notification, the generation control unit 14 requests the writing unit 18 to convert the log data into a file (step S111), and the writing unit 18 executes the file conversion and stores the encrypted data on the recording medium 19. The converted log file is stored (step S112). Next, the writing unit 18 notifies the generation control unit 14 that the file creation has been completed in response to the request (step S113). Next, the generation control unit 14 transmits (transfers) the encrypted log file stored in the recording medium 19 to the log collection device 20 via the communication unit 12 (step S114), and ends the process.

If the log acquisition command partially encrypts, one of the processing at the encryption start position, the process at the encryption end position, and the processing in the non-encryption section is performed until the end of the log acquisition command. The loop process to be executed is executed.

The encryption start position is not necessarily the beginning of the log data. Therefore, by executing the log acquisition command, the generation control unit 14 temporarily stores the log data in the buffer unit 16 as a process in a non-encrypted interval until the encryption start position is reached (step S126). . After that, the generation control unit 14 requests the writing unit 18 to convert the log data into a file (step S127), and the writing unit 18 executes the conversion into a file and writes the plaintext log file to the recording medium 19. It is stored (step S128). Next, in response to the request, the writing unit 18 notifies the generation control unit 14 that the file creation in this non-encrypted range has been completed (step S129). If there is the next unencrypted range, plaintext log data may be added to the plaintext log file stored in the recording medium 19 in step S127.

An example of processing at the encryption start position will be explained. When the encryption start position is reached, the generation control unit 14 executes a log acquisition command to start temporarily storing the log data in the buffer unit 16 (step S115). Next, the generation control unit 14 transmits an encryption start request to the encryption unit 17 (step S116). Upon receiving the encryption start request, the encryption unit 17 inserts an encryption start flag into the encryption start position of the unencrypted log data temporarily stored in step S115 (step S117), and generates an encryption start response. It is returned to the control unit 14 (step S118).

An example of processing at the encryption end position will be explained. When the process progresses to the encryption end position, the generation control unit 14 transmits an encryption end request to the encryption unit 17 (step S119). The encryption unit 17 inserts an encryption end flag at the end of the log data that is continuously temporarily stored in step S115 (step S120), and inserts an encryption end flag into the end of the log data that is continuously temporarily stored in step S115. Encryption is performed (step S121). Thereafter, the encryption unit 17 returns an encryption completion response to the generation control unit 14 (step S122).

After that, the generation control unit 14 requests the writing unit 18 to create a file of the encrypted log data for that section (step S123). Upon receiving this request, the writing unit 18 executes file creation and stores the encrypted log file in the recording medium 19 (step S124). Next, in response to the request, the writing unit 18 notifies the generation control unit 14 that the file creation within this encryption range has been completed (step S125). If there is the next encrypted range, the encrypted log data may be added to the encrypted log file stored in the recording medium 19 in step S124.

As described above, when the log data has been acquired using the target log acquisition command, partially encrypted, and created into a file, the loop processing for partial encryption ends. After that, the generation control unit 14 transmits (transfers) one plaintext log file and one encrypted log file stored in the recording medium 19 to the log collection device 20 via the communication unit 12 (step S130), Finish the process.

As described above, according to this embodiment, in addition to the effects of Embodiment 1, even when a log acquisition command includes multiple encryption ranges, multiple encryption ranges are combined into one encrypted log file. can be obtained as Furthermore, according to the present embodiment, even if a log acquisition command includes one or more encrypted ranges and as a result includes multiple unencrypted ranges, multiple unencrypted ranges are included. The converted range can be obtained as a single plaintext log file.

Furthermore, in the present embodiment, it has been explained that the log acquisition command that partially encrypts includes information indicating the partially encrypted log acquisition range. However, information indicating the log acquisition range may be included for both the log acquisition command for encrypting everything and the log acquisition command for not encrypting. As a result, the target device 10 can specify log data to be collected based on the log type and log acquisition range included in the log acquisition command for these two types of log acquisition commands.

Further, as illustrated in the sequence diagrams of FIGS. 8 and 9, the generation control unit 14 in this embodiment determines the insertion positions of the encryption start flag and the encryption end flag during execution of the log acquisition command, and It has a function to switch between encryption, partial encryption (partial encryption), and full encryption. By providing such a function, it is possible to switch processing and generate a log file in response to any of these three types of requests from the log collection device 20, and to transfer the log file to the log collection device 20. I can do it.

Finally, we will briefly explain how to use the encryption start flag and encryption end flag during viewing (decryption) when partially encrypting. In this case, even if the encryption start flag and encryption end flag are not used, the encrypted log file can be decrypted by ignoring these flags. However, these flags can be used when sequentially viewing log files for one log acquisition command. For example, the encrypted log file can be decrypted first, and the encrypted range and non-encrypted range can be presented in that order. Which comes first, the encrypted range or the non-encrypted range, is known after the log acquisition command is generated by the log collection device 20, so it can be obtained by referring to the log acquisition command. For example, after the encryption end flag, the next unencrypted range of the plaintext log file is read and presented, and when the presentation of the unencrypted range of the plaintext log file is finished, the next encryption start flag is used. The next encrypted range can be read and presented.

<Embodiment 3>
Embodiment 3 will be described with reference to FIG. 10 and the like, focusing on the differences from Embodiment 2, but the various application examples described in Embodiments 1 and 2 can be applied to Embodiment 3 as well. The configuration example of FIG. 4 can also be applied to the configuration example of the encryption system in the third embodiment, except for some processes, so the explanation will be based on the configuration example of FIG. 4.

In the second embodiment, when a log acquisition command includes multiple encrypted ranges, the multiple encrypted ranges are collected as one encrypted log file, and the multiple unencrypted ranges are collected as one encrypted log file. I am trying to get it as a plain text log file.

In contrast, the generation control unit 14 in this embodiment stores the encrypted log data in the recording medium 19 as one file every time the encryption range is delimited by the start position and end position, and stores the encrypted log data as one file in the recording medium 19. The log data is stored in the recording medium 19 as one file. In other words, in this embodiment, when the encryption range is divided into a plurality of parts, log files are stored every time the encryption range is divided in the processing order, and each stored log file is sent to the log collection device 20. I can do it.

A specific example of a file storage method will be given below. If the encryption range from processing α to processing β and from processing γ to processing δ is specified in the log acquisition command, the following two encrypted log files will be stored as encrypted log files. . That is, encrypted log files from processing α to processing β and encrypted log files from processing γ to processing δ are stored. Further, continuous log data other than those processes can be made into plain text log files. For example, log data of a series of processes from after process β to before process γ is stored as one plaintext log file. Additionally, if there is a series of processes before process α, the log data of that series of processes is stored as one plaintext log file, and if there is a series of processes after process δ, the log data of that series of processes is stored as one plaintext log file. will be stored as one plaintext log file. In this example, there will be a maximum of three plaintext log files.

The same concept can be applied even when the encryption range is specified in multiple processing periods, such as from the first date and time to the second date and time and from the third date and time to the fourth date and time. Note that here, the first date and time, the second date and time, the third date and time, and the fourth date and time are explained as dates and times that are closer to the present in this order. In this case, encrypted log files from the first date and time to the second date and time and encrypted log files from the third date and time to the fourth date and time are stored. In addition, the plaintext log files from the second date and time to the third date and time, the plaintext log files from the start date and time of the partially encrypted log acquisition range to the first date and time, and the end of the partially encrypted log acquisition range from the fourth date and time. Plaintext log files up to date and time are stored. However, if the start date and time of the partially encrypted log acquisition range and the first date and time are the same, the corresponding plaintext log file does not exist, and the end date and time of the partially encrypted log acquisition range and the fourth date and time are the same. In this case, the corresponding plaintext log file does not exist.

Note that here, as in the second embodiment, it is assumed that a partial encrypted log acquisition range is specified. Also in this embodiment, information indicating the log acquisition range may be included in the log acquisition command for encrypting everything and the log acquisition command for not encrypting.

Next, an example of processing in the log generation unit 13 of the target device 10 in this embodiment will be described with reference to FIG. 10. FIG. 10 is a flowchart for explaining an example of processing in the log generation unit 13 of the target device 10 in the encryption system according to the third embodiment, and is a flowchart for explaining another example of the processing following FIG. 6. It is a diagram.

6 and 10, a processing example for a certain log acquisition command will be explained as an example, but if there are multiple log acquisition commands for the target device 10, the following processing will be executed for each log acquisition command. be done. Note that explanations using sequence diagrams such as those illustrated in FIGS. 8 and 9 will be omitted.

In this embodiment, the processing is the same in the case of no encryption and the case of all encryption, and the processing example in FIG. 6 can be applied. In this embodiment, as shown in FIG. 10, in the case of a log acquisition command that partially encrypts, processing at the encryption start position, processing at the encryption end position, and A loop process is executed in which any one of the processes in the non-encrypted section is executed. In this loop process, in this embodiment, the processes in steps S25 and S31 in FIG. 7 are changed to processes in steps S25a and S31a, respectively.

In step S25a, if the result in step S24 is YES, the generation control unit 14 converts the plaintext log data temporarily stored in the buffer unit 16, which is the target of the loop processing at that point, into a plaintext file. The writing unit 18 is controlled to write to a certain first file.

In step S25a, the generation control unit 14 controls the writing unit 18 to generate a first file by converting the temporarily stored plaintext log data into a file and writes it into the recording medium 19. The first file here is a first file for each target section. Therefore, the first file is stored as the first file for each target section for the number of times the loop process is YES in step S24. After step S25a ends, the process moves to the next loop process.

In step S31a, the generation control unit 14 writes the encrypted log data temporarily stored in the buffer unit 16, that is, the encrypted log data that has not been converted into a file, to a second file that is an encryption file. The writing section 18 is controlled in such a manner.

In step S31a, the generation control unit 14 controls the writing unit 18 to create a second file by converting the temporarily stored encrypted log data, that is, the encrypted log data that has not been converted into a file, into a file. It is generated and written on the recording medium 19. The second file here is a second file for each target section. Therefore, the second file will be stored as the second file for each target section for the number of times the loop process is YES in step S28. After step S31a ends, the process moves to the next loop process.

As described above, according to this embodiment, in addition to the effects of Embodiment 1, even when a log acquisition command includes multiple encryption ranges, it is possible to obtain one encrypted log file for each encryption range. can be obtained as one plaintext log file for each unencrypted range.

Here, we will briefly explain how to use the encryption start flag and encryption end flag during viewing (decryption) when partially encrypting. In this case, even if the encryption start flag and encryption end flag are not used, the encrypted log file can be decrypted by ignoring these flags. However, these flags can be used when sequentially viewing encrypted log files for one log acquisition command. For example, the encrypted log file can be decrypted first, and the encrypted range and non-encrypted range can be presented in that order. Since this order is known after the log acquisition command is generated by the log collection device 20, it can be obtained by referring to the log acquisition command. Alternatively, this order can also be determined based on the last save date and time of the log file. For example, after the encryption end flag, the next unencrypted range of the plaintext log file is read and presented, and when the presentation of the unencrypted range of the plaintext log file is finished, the next encryption start flag is used. The next encrypted range can be read and presented.

In addition, the target device 10 is provided with a function to switch between the processes of the second embodiment and the third embodiment, and information indicating which process is applied is included in the log acquisition command sent by the log collection device 20. You can also do that.

<Other embodiments>
[a]
In each embodiment, the functions of the encryption system, encryption device, target device, log collection device, and devices that can be included in the encryption system have been described, but each device is limited to the illustrated configuration example. Instead, it is sufficient if each device can realize these functions.

[b]
Each of the devices described in Embodiments 1 to 3 may have the following hardware configuration. FIG. 11 is a diagram showing an example of the hardware configuration of the device. Note that the same applies to the other embodiment [a] above.

The device 100 shown in FIG. 11 can include a processor 101, a memory 102, and a communication interface (I/F) 103. The processor 101 may be, for example, a microprocessor, an MPU (Micro Processor Unit), or a CPU. Processor 101 may include multiple processors. The memory 102 is configured, for example, by a combination of volatile memory and nonvolatile memory. The functions of each device described in the first to third embodiments are realized by the processor 101 reading and executing a program stored in the memory 102. At this time, information can be exchanged with other devices via the communication interface 103 or an input/output interface (not shown).

In the examples above, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more of the functions described in the embodiments. The program may be stored on a non-transitory computer readable medium or a tangible storage medium. By way of example and not limitation, computer readable or tangible storage media may include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD - Including ROM, digital versatile disc (DVD), Blu-ray disc or other optical disc storage, magnetic cassette, magnetic tape, magnetic disc storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, transitory computer-readable or communication media includes electrical, optical, acoustic, or other forms of propagating signals.

Note that the present disclosure is not limited to the above embodiments, and can be modified as appropriate without departing from the spirit. Further, the present disclosure may be implemented by appropriately combining the respective embodiments.

Part or all of the above embodiments may be described as in the following additional notes, but are not limited to the following.

(Additional note 1)
an acquisition unit that acquires log data;
an encryption unit that encrypts log data;
a reception unit that receives an instruction to specify a range to be encrypted by the encryption unit before starting acquisition of log data;
a storage unit that stores log data;
a control unit that controls the timing of acquisition of log data by the acquisition unit, the start and end positions of encryption by the encryption unit, and storage of log data by the storage unit, based on the range;
Equipped with
The control unit includes:
The encryption unit is configured to perform encryption by inserting a start flag, which is a flag indicating the start position, and an end flag, which is a flag, which is a flag indicating the end position, into the start position and end position indicated by the range, respectively. control,
If the entire range of log data is specified as the range, controlling the encryption unit to execute encryption without controlling to insert the start flag and the end flag;
storing encrypted data for a portion of the log data that falls within the range, and storing plain text data for a portion of the log data that does not fall within the range as separate files in the storage unit;
encryption system.
(Additional note 2)
When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
The control unit stores the encrypted data obtained in the partially encrypted log acquisition range as one file in the storage unit, and excludes the range from the partially encrypted log acquisition range. storing the plaintext data obtained in the above sections as one file in the storage unit;
Encryption system described in Appendix 1.
(Additional note 3)
When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
The control unit stores the encrypted data as one file in the storage unit each time the range is divided by a start position and an end position, and stores the plaintext data as one file in the storage unit. to remember,
Encryption system described in Appendix 1.
(Additional note 4)
an instruction device that transmits an instruction to the reception unit to be accepted by the reception unit;
a target device from which log data is to be collected, comprising the encryption unit, the reception unit, the storage unit, and a transmission unit that transmits the file stored in the storage unit to the instruction device;
Equipped with
The encryption system according to any one of Supplementary Notes 1 to 3.
(Appendix 5)
an acquisition unit that acquires log data;
an encryption unit that encrypts log data;
a reception unit that receives an instruction to specify a range to be encrypted by the encryption unit before starting acquisition of log data;
a storage unit that stores log data;
a control unit that controls the timing of acquisition of log data by the acquisition unit, the start and end positions of encryption by the encryption unit, and storage of log data by the storage unit, based on the range;
Equipped with
The control unit includes:
The encryption unit is configured to perform encryption by inserting a start flag, which is a flag indicating the start position, and an end flag, which is a flag, which is a flag indicating the end position, into the start position and end position indicated by the range, respectively. control,
If the entire range of log data is specified as the range, controlling the encryption unit to execute encryption without controlling to insert the start flag and the end flag;
storing encrypted data for a portion of the log data that falls within the range, and storing plain text data for a portion of the log data that does not fall within the range as separate files in the storage unit;
Encryption device.
(Appendix 6)
When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
The control unit stores the encrypted data obtained in the partially encrypted log acquisition range as one file in the storage unit, and excludes the range from the partially encrypted log acquisition range. storing the plaintext data obtained in the above sections as one file in the storage unit;
The encryption device according to appendix 5.
(Appendix 7)
When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
The control unit stores the encrypted data as one file in the storage unit each time the range is divided by a start position and an end position, and stores the plaintext data as one file in the storage unit. to remember,
The encryption device according to appendix 5.
(Appendix 8)
comprising a transmitter configured to transmit the file stored in the storage unit to the instruction device that transmitted the instruction in response to the instruction received by the reception unit;
The encryption device according to any one of Supplementary Notes 5 to 7.
(Appendix 9)
obtaining log data;
encrypting log data;
Before starting to acquire log data, accept instructions to specify the range to be encrypted.
storing log data; and
Based on the range, controlling the timing of log data acquisition, the start and end positions of encryption, and the storage of log data;
Equipped with
The controlling includes:
performing encryption by inserting a start flag that is a flag that indicates the start position and an end flag that is a flag that indicates the end position for the start position and end position indicated by the range, respectively;
When the entire range of log data is specified as the range, performing encryption without inserting the start flag and the end flag;
storing encrypted data for a portion of the log data that falls within the range, and storing data in plain text for a portion of the log data that does not fall within the range as separate files;
encryption methods, including
(Appendix 10)
When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
The controlling means to collectively store the encrypted data obtained in the partially encrypted log acquisition range as one file, and to store the encrypted data obtained in the partially encrypted log acquisition range in a portion excluding the range from the partially encrypted log acquisition range. including storing the obtained plaintext data together as one file;
Encryption method described in Appendix 9.
(Appendix 11)
When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
The controlling includes storing the encrypted data as one file and storing the plaintext data as one file every time the range is divided by a start position and an end position.
Encryption method described in Appendix 9.
(Appendix 12)
The encryption method according to any one of appendices 9 to 11, comprising transmitting the stored file to the instruction device that transmitted the instruction in response to the instruction received by the acceptance.
(Appendix 13)
obtaining log data;
encrypting log data;
Before starting to acquire log data, accept instructions to specify the range to be encrypted.
storing log data; and
Based on the range, controlling the timing of log data acquisition, the start and end positions of encryption, and the storage of log data;
including;
The controlling includes:
performing encryption by inserting a start flag that is a flag that indicates the start position and an end flag that is a flag that indicates the end position for the start position and end position indicated by the range, respectively;
When the entire range of log data is specified as the range, performing encryption without inserting the start flag and the end flag;
storing encrypted data for a portion of the log data that falls within the range, and storing data in plain text for a portion of the log data that does not fall within the range as separate files;
including,
A computer-readable medium that stores a program for causing a computer to perform encryption processing.
(Appendix 14)
When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
The controlling means to collectively store the encrypted data obtained in the partially encrypted log acquisition range as one file, and to store the encrypted data obtained in the partially encrypted log acquisition range in a portion excluding the range from the partially encrypted log acquisition range. including storing the obtained plaintext data together as one file;
Computer-readable medium according to appendix 13.
(Additional note 15)
When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
The controlling includes storing the encrypted data as one file and storing the plaintext data as one file every time the range is divided by a start position and an end position.
Computer-readable medium according to appendix 13.
(Appendix 16)
The encryption process includes, in response to the instruction received by the acceptance, transmitting the stored file to the instruction device that transmitted the instruction.
The computer-readable medium according to any one of appendices 13 to 15.

Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above. The configuration and details of the present invention can be modified in various ways that can be understood by those skilled in the art within the scope of the invention.

1 Encryption system 1a Acquisition unit 1b Encryption unit 1c Reception unit 1d Storage unit 1e Control unit 2 Encryption device 10 Target device 11 Main control unit 12 Communication unit 13 Log generation unit 14 Generation control unit 15 Log acquisition unit 16 Buffer unit 17 Encryption unit 18 Writing unit 19 Recording medium 19a Encrypted log file 19b Plaintext log file 20 Log collection device 21 Control unit 22 Operation unit 23 Storage unit 24 Communication unit 100 Device 101 Processor 102 Memory 103 Communication interface

Claims (16)

1. an acquisition unit that acquires log data;
   an encryption unit that encrypts log data;
   a reception unit that receives an instruction to specify a range to be encrypted by the encryption unit before starting acquisition of log data;
   a storage unit that stores log data;
   a control unit that controls the timing of acquisition of log data by the acquisition unit, the start and end positions of encryption by the encryption unit, and storage of log data by the storage unit, based on the range;
   Equipped with
   The control unit includes:
   The encryption unit is configured to perform encryption by inserting a start flag, which is a flag indicating the start position, and an end flag, which is a flag, which is a flag indicating the end position, into the start position and end position indicated by the range, respectively. control,
   If the entire range of log data is specified as the range, controlling the encryption unit to execute encryption without controlling to insert the start flag and the end flag;
   storing encrypted data for a portion of the log data that falls within the range, and storing plain text data for a portion of the log data that does not fall within the range as separate files in the storage unit;
   encryption system.
2. When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
   The control unit stores the encrypted data obtained in the partially encrypted log acquisition range as one file in the storage unit, and excludes the range from the partially encrypted log acquisition range. storing the plaintext data obtained in the above sections as one file in the storage unit;
   The encryption system according to claim 1.
3. When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
   The control unit stores the encrypted data as one file in the storage unit each time the range is divided by a start position and an end position, and stores the plaintext data as one file in the storage unit. to remember,
   The encryption system according to claim 1.
4. an instruction device that transmits an instruction to the reception unit to be accepted by the reception unit;
   a target device from which log data is to be collected, comprising the encryption unit, the reception unit, the storage unit, and a transmission unit that transmits the file stored in the storage unit to the instruction device;
   Equipped with
   The encryption system according to any one of claims 1 to 3.
5. an acquisition unit that acquires log data;
   an encryption unit that encrypts log data;
   a reception unit that receives an instruction to specify a range to be encrypted by the encryption unit before starting acquisition of log data;
   a storage unit that stores log data;
   a control unit that controls the timing of acquisition of log data by the acquisition unit, the start and end positions of encryption by the encryption unit, and storage of log data by the storage unit, based on the range;
   Equipped with
   The control unit includes:
   The encryption unit is configured to perform encryption by inserting a start flag, which is a flag indicating the start position, and an end flag, which is a flag, which is a flag indicating the end position, into the start position and end position indicated by the range, respectively. control,
   If the entire range of log data is specified as the range, controlling the encryption unit to execute encryption without controlling to insert the start flag and the end flag;
   storing encrypted data for a portion of the log data that falls within the range, and storing plain text data for a portion of the log data that does not fall within the range as separate files in the storage unit;
   Encryption device.
6. When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
   The control unit stores the encrypted data obtained in the partially encrypted log acquisition range as one file in the storage unit, and excludes the range from the partially encrypted log acquisition range. storing the plaintext data obtained in the above sections as one file in the storage unit;
   The encryption device according to claim 5.
7. When a partial range of log data is specified as the range, the receiving unit receives an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range;
   The control unit stores the encrypted data as one file in the storage unit each time the range is divided by a start position and an end position, and stores the plaintext data as one file in the storage unit. to remember,
   The encryption device according to claim 5.
8. comprising a transmitter configured to transmit the file stored in the storage unit to the instruction device that transmitted the instruction in response to the instruction received by the reception unit;
   The encryption device according to any one of claims 5 to 7.
9. obtaining log data;
   encrypting log data;
   Before starting to acquire log data, accept instructions to specify the range to be encrypted.
   storing log data; and
   Based on the range, controlling the timing of log data acquisition, the start and end positions of encryption, and the storage of log data;
   Equipped with
   The controlling includes:
   performing encryption by inserting a start flag that is a flag that indicates the start position and an end flag that is a flag that indicates the end position for the start position and end position indicated by the range, respectively;
   When the entire range of log data is specified as the range, performing encryption without inserting the start flag and the end flag;
   storing encrypted data for a portion of the log data that falls within the range, and storing data in plain text for a portion of the log data that does not fall within the range as separate files;
   encryption methods, including
10. When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
    The controlling means to collectively store the encrypted data obtained in the partially encrypted log acquisition range as one file, and to store the encrypted data obtained in the partially encrypted log acquisition range in a portion excluding the range from the partially encrypted log acquisition range. including storing the obtained plaintext data together as one file;
    The encryption method according to claim 9.
11. When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
    The controlling includes storing the encrypted data as one file and storing the plaintext data as one file every time the range is divided by a start position and an end position.
    The encryption method according to claim 9.
12. The encryption method according to any one of claims 9 to 11, comprising transmitting the stored file to the instruction device that transmitted the instruction in response to the instruction received by the acceptance.
13. obtaining log data;
    encrypting log data;
    Before starting to acquire log data, accept instructions to specify the range to be encrypted.
    storing log data; and
    Based on the range, controlling the timing of log data acquisition, the start and end positions of encryption, and the storage of log data;
    including;
    The controlling includes:
    performing encryption by inserting a start flag that is a flag that indicates the start position and an end flag that is a flag that indicates the end position for the start position and end position indicated by the range, respectively;
    When the entire range of log data is specified as the range, performing encryption without inserting the start flag and the end flag;
    storing encrypted data for a portion of the log data that falls within the range, and storing data in plain text for a portion of the log data that does not fall within the range as separate files;
    including,
    A computer-readable medium that stores a program for causing a computer to perform encryption processing.
14. When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
    The controlling means to collectively store the encrypted data obtained in the partially encrypted log acquisition range as one file, and to store the encrypted data obtained in the partially encrypted log acquisition range in a portion excluding the range from the partially encrypted log acquisition range. including storing the obtained plaintext data together as one file;
    14. The computer readable medium of claim 13.
15. When a partial range of log data is specified as the range, accepting an instruction to specify a partially encrypted log acquisition range that includes the range and is larger than the range. including;
    The controlling includes storing the encrypted data as one file and storing the plaintext data as one file every time the range is divided by a start position and an end position.
    14. The computer readable medium of claim 13.
16. The encryption process includes, in response to the instruction received by the acceptance, transmitting the stored file to the instruction device that transmitted the instruction.
    Computer readable medium according to any one of claims 13 to 15.

Images