Method for updating software components of a network participant of a network

Abstract

The invention relates to a method for updating software components of a network participant of a network, wherein a program code of the network participant has at least two manufacturer-specific blocks, wherein each of the manufacturer-specific blocks has at least one software component, wherein a block field is respectively assigned to each manufacturer-specific block, wherein a component field is respectively assigned to at least one software component of each manufacturer-specific block, wherein an address of a source responsible for updating is respectively stored in at least one of the block fields and / or in at least one of the component fields, wherein for at least one software component of each manufacturer-specific block, the address of the source responsible for updating the at least one software component is selected based on the component field assigned to the at least one software component and based on the block field assigned to the corresponding manufacturer-specific block, and the updating of the at least one software component is performed with the aid of the selected source.

Description

Technical Field

[0001] The invention relates to a method for updating software components of a network participant of a network. Background Art

[0002] When networking machines, for example in the field of automation technology, the term "Industry 4.0" has become popular in the meantime. This term is to be understood as the networking of machines or equipment, and in particular also as the connection of these machines or equipment to the Internet or the Internet of Things (so-called IoT, "Internet of Things"). Networked devices can range from sensors and security cameras to vehicles and production machines. Since such networked IoT devices are usually connected to the Internet, it is necessary to ensure that the program code implemented on the IoT devices is regularly subject to security updates and is up-to-date in order to be less vulnerable to attacks.

[0003] The program code executed on such an IoT device may often consist of a plurality of individual software components which have been developed by the original manufacturer and, if applicable, by a plurality of original equipment manufacturers or OEMs (Original Equipment Manufacturers).

[0004] Here, the basic software and the corresponding platform can first be formulated by the original manufacturer. Another manufacturer (especially the first OEM) can obtain the basic software and the platform from the original manufacturer in order to expand his own software components and thus generate the program code of the first extended version. Another manufacturer (especially the second OEM) can obtain the program code of the first extended version from the first OEM, expand the program code of the first extended version with his own software components, and generate the program code of the second extended version. This cascade can continue for a long time until the last n-th manufacturer or OEM formulates the n-th extended final version of the program code, which is finally placed on the IoT device and implemented by the IoT device.

[0005] However, the update of such a program code may prove to be very complicated. When, for example, the original manufacturer finds a safety-critical error in his basic software, the manufacturer, for example, formulates an update for his basic software, in which the error is eliminated. The first OEM is mostly informed of the update, for example, by means of a trigger. Then, the first OEM loads the update into his program code version and generates a first expanded program code of the updated version. The second OEM is again informed of the update, loads the update into his program code version, and therefore generates a second expanded program code of his updated version. The cascade also continues until the last OEM, which finally discloses the final program code of the updated version.

[0006] Therefore, until the final updated program code is finally implemented on the IoT device, a long period of time may pass, because each individual manufacturer involved must update his specific extended program code. During this period of time, the corresponding IoT device may be vulnerable to attack. Summary of the invention

[0007] According to the invention, a method for updating software components of a network participant of a network and a computing unit for executing the same are proposed, having the features of the independent claims. Advantageous embodiments are the subject matter of the dependent claims and the subsequent description.

[0008] In particular, the invention provides the possibility to automatically update a plurality of and preferably all software components of network participants and, if necessary, also a plurality of and preferably all software components of different sources. In this case, so-called block fields and component fields are assigned to the individual software components, in which the addresses of the sources are stored, with the aid of which the update of the individual software components can be automatically performed.

[0009] The program code of the network participant has at least two manufacturer-specific blocks for software components. Each block in the manufacturer-specific blocks has at least one software component. Such manufacturer-specific blocks especially represent separate areas or separate slots, in which the corresponding manufacturer-specific software components are merged. In particular, a specific manufacturer or OEM cannot change the remaining manufacturer-specific blocks that are not provided for it. In other words, the different manufacturers participating in the program code therefore each have their own blocks or areas for characterizing or describing their own software components. How these components are physically stored and act together is not important here. In particular, these software components of a manufacturer do not have to be physically located in a common storage area.

[0010] Each manufacturer-specific block is assigned a block field. Each at least one software component of each manufacturer-specific block is assigned a component field. The manufacturer can store the following information in such a block field or in such a component field: the information describes the corresponding assigned manufacturer-specific block or the corresponding assigned software component. Such a block field (especially the information stored in such a block field) is suitable for all software components of the block. Such a component field (especially the information stored in such a component field) is especially only suitable for the corresponding assigned software component. It should be noted that the block field and / or the component field can also be empty and may not contain information. The block field or the component field can especially be regarded as a digital label or a digital sign, which gives a response about the assigned block or the assigned software component.

[0011] In at least one block field in the block field and / or in at least one component field in the component field, the address of the source responsible for the update is stored respectively. Such a source is especially responsible for updating one or more software components. Such a source can be another network participant of the network, for example a distributed system (so-called cloud) of servers or computing units. It should be understood that in each block field and in each component field, the same address of the same source can be stored respectively, or different addresses of different sources can be stored respectively.

[0012] When a manufacturer introduces one or more software components into a block assigned to him, he expediently stores the corresponding addresses in the corresponding block fields and / or in the component fields, and thus specifies in particular the source(s) that is responsible for updating the software components introduced by it.

[0013] In order to perform an update of a software component, within the scope of the method, for each at least one software component of a manufacturer-specific block, an address of a source responsible for updating the at least one software component is selected, respectively, based on a component field assigned to the at least one software component and based on a block field assigned to the corresponding manufacturer-specific block. The update of the at least one software component is performed using the selected source.

[0014] The address stored in the block field applies in particular to all software components of the block, and is hereinafter also referred to as slot address or block-specific address. The address stored in the component field applies in particular only to the software component assigned to the component field, and is hereinafter also referred to as component address or component-specific address.

[0015] If no component address is stored in the component field of a software component, in particular the slot address stored in the block field of the corresponding block is selected for the software component. The component address can expediently have a greater relevance than the slot address, i.e. in particular the component address is selected for the software component when the component address is stored in the component field of the software component and when the slot address is also stored in the block field of the corresponding block of the software component.

[0016] Alternatively, it is also expedient for the slot address to have a greater relevance than the component address. If a slot address is stored in the block field, this slot address is selected for all software components of the block, even if a software component is assigned a component address that does not correspond to the slot address. If no update is available for the software component at the selected slot address, the component address stored in the component field of the software component can be used expediently.

[0017] It can be expediently specified for each individual block and / or for all blocks in common as to which of the above-explained possibilities the address is to be selected, thus in particular whether the component address or the slot address has greater relevance.

[0018] After the corresponding address of the corresponding source has been selected, the source is in particular contacted and a secure connection is expediently established from the network participant to the source (preferably by means of a common encryption method, such as a connection via https). A check is performed to see whether an update is available for the software component, in particular for the current version of the software component. If an update is available, the update is in particular executed.

[0019] The method provides a possibility to perform efficient and rapid updating of software components of program code. Since the source responsible for its update is indicated in the block field and / or in the component field, in particular for each software component, it is possible to perform the updating of all software components automatically in a simple manner.

[0020] As mentioned at the outset, conventionally, the manufacturers involved in the program code only introduce software components into the program code without providing them with information for a subsequent update. Conventionally, each manufacturer involved individually carries out a corresponding update of his specifically expanded program code, which is then used further by the superordinate manufacturer. In contrast, the present method makes it possible to carry out an automatic update of all software components.

[0021] The present invention provides a platform, in particular, by which the participating manufacturers can determine how to carry out updates of their software components. Via the block field and the component field, the respective manufacturer can fully describe his software components introduced into the program code so that they are fully classified for updates.

[0022] The stored address can be used to predetermine the source from which updates for the respective software component are to be obtained. If, for example, a manufacturer introduces a software component into a program code and carries out updates for the program code itself at a later stage (for example because the manufacturer operates an update server itself or provides updates via the cloud), the manufacturer can accordingly predetermine this in the corresponding block field or component field. If another manufacturer wants to carry out an update, this can similarly be predetermined in his corresponding block field or component field.

[0023] For example, there may also be situations where the manufacturer does not develop the software component itself, but rather obtains it from a supplier and only introduces it into the program code. If the supplier carries out an update of the software component at a later stage, the manufacturer can define this in the corresponding block field or component field by means of the corresponding address of the supplier source.

[0024] According to an advantageous embodiment, the software component is introduced into the program code in the course of the manufacturing process. The manufacturing process is carried out in particular at a first point in time, in particular before the program code is introduced into the network participants and implemented by the network participants. In the course of the manufacturing process, the program code can be prepared in particular by the original manufacturer, so that in particular the basic software and / or the corresponding platform can be prepared by the original manufacturer. It is also conceivable that in the course of the manufacturing process, an already existing executable program code is expanded. In this case, for example, other manufacturers can carry out the expansion of the program code, which manufacturer has obtained the program code directly from the original manufacturer of the program code or from another other manufacturer.

[0025] The method steps of selecting an address and performing an update are performed in particular after the manufacturing process, in particular after the program code has been introduced into the network participant, further in particular after the network participant has been introduced into the corresponding network, and further in particular when the program code is executed by the network participant. In particular, the method steps of selecting an address and performing an update are performed at a second point in time, which is temporally after the first point in time. When the second point in time occurs exactly can be determined at the first point in time, in particular during the manufacturing process. For example, the second point in time can be predetermined by a time interval after the expiration of which the search for an update is to be performed.

[0026] Advantageously, during the course of the manufacturing process, the manufacturer stores in each case the address of the source responsible for the update in a block field of his manufacturer-specific block and / or in at least one component field of his manufacturer-specific block.

[0027] If the original manufacturer develops the program code during the course of the manufacturing process, the at least one software component can also be, for example, the first software component or a software component of the first software component that is introduced into the program code. If, for example, another manufacturer expands the program code during the course of the manufacturing process, a plurality of further software components of the original manufacturer and, if necessary, a plurality of further software components of further manufacturers can already be implemented in the program code.

[0028] When the software components of the corresponding manufacturer are introduced in the course of the manufacturing process, the corresponding manufacturer can therefore assign a component address or a slot address to each software component of his block or his slot. In particular, the corresponding manufacturer has therefore already predetermined in the manufacturing process: which source (which sources) performs the update of the software components introduced by the manufacturer in the later normal operation of the program code. In particular, the source responsible for the later update is therefore already predetermined in the course of the manufacturing process for each software component of the program code by the corresponding manufacturer / OEM. As further explained above, the following platform is therefore provided by the method: with the help of this platform, the manufacturer can already determine in the manufacturing process: how to perform the update of its software components in the later operation.

[0029] According to a particularly advantageous embodiment of the invention, the following possibility is provided: in the course of the manufacturing process, a manufacturer introduces a new software component into the program code, and both the update of the software component and the update of other software components already present in the program code (i.e., therefore subordinate or subordinate) are carried out by another manufacturer. For this purpose, the manufacturer can store the address of the source responsible for the update in a block field of an already existing, i.e., therefore external, manufacturer-specific block. In particular, a superior manufacturer can thus also provide updates for subordinate software components (e.g., drivers, operating system components) if desired.

[0030] In the foreign block field, the subordinate manufacturer may already store further addresses which are then overwritten or also deleted. If the address of a foreign block is deleted, for example, and the corresponding block field of the block is therefore empty, in particular the address which is stored in the block field of the superordinate block can be selected for the foreign subordinate block.

[0031] As explained, the block field or the component field can also be empty and contain no information. If the component field does not contain an address, the associated block field can provide the address. If the block field does not contain an address, the block field of the superordinate block can provide the address. In particular, this provides a flexible possibility to store different addresses of software components, as explained below.

[0032] According to a preferred embodiment, the component address can have a greater relevance than the slot address. If an address is stored in the component field of at least one software component assigned to the corresponding manufacturer-specific block, this address is advantageously selected for the update of the at least one software component, and the update of the at least one software component is carried out with the help of the selected source. For the software component, the address is therefore selected in the case of an existing component address, in particular when a slot address is stored in the block field of the corresponding block, which slot address may not correspond to the existing component address. The slot address is in this case particularly suitable for software components to which no component address is assigned.

[0033] If no address is stored in the component field of at least one software component assigned to the corresponding manufacturer-specific block, an address stored in the block field assigned to the corresponding manufacturer-specific block is advantageously selected for updating the at least one software component, and the updating of the at least one software component is performed with the aid of the selected source. As explained above, the slot address in this case is particularly suitable for software components to which no component address is assigned.

[0034] For example, it is possible in this way that a manufacturer introduces a plurality of software components into his block and that different sources are responsible for the updating of the introduced software components. When a manufacturer introduces a plurality of software components into a program code, for example, in the course of a manufacturing process and carries out an update for all of these software components, the manufacturer cannot, for example, store addresses in the individual component fields of the software components, but can store the corresponding addresses in the block fields of his block. It is therefore expedient to select the address in the block field for all software components in the block. Alternatively, the manufacturer can also store the same address in each component field of a plurality of software components and not store the address in the block field.

[0035] For example, in the course of a manufacturing process, a manufacturer can introduce into the program code its own software components that it has developed itself, and introduce into the program code external software components that it has obtained from suppliers. For its own software components, the manufacturer can, for example, undertake updates itself and store this in the component field of its own software components accordingly. If the manufacturer does not undertake updates of external software components, but, for example, the supplier undertakes updates of external software components, the manufacturer can store this in the component field of the external software components accordingly. For example, the manufacturer can store the address of the corresponding server or the corresponding cloud in the corresponding component field for this purpose.

[0036] Alternatively, it is also conceivable in this case that the manufacturer does not store addresses in the component fields of those software components whose updates he is responsible for, and instead stores the addresses of the sources responsible for updating these software components in the block fields of his blocks. In the component fields of external software components of a supplier who is also responsible for updating, the manufacturer can store the corresponding addresses of the sources of this supplier.

[0037] According to another preferred embodiment, the slot address can also have a greater relevance than the component address. If an address is stored in the block field of the corresponding manufacturer-specific block, this address is advantageously selected for the update of at least one software component of the corresponding manufacturer-specific block, and the update of the at least one software component is carried out with the aid of the selected source. In the case of an existing slot address of a block, this address is in particular selected for all software components of the block, even if a component address that does not correspond to the slot address is stored in the component field.

[0038] However, if no update is available for the software component at the selected slot address, the component address stored in the component field of the software component can preferably be selected. If no update is available for at least one software component at the selected address stored in the block field of the corresponding manufacturer-specific block, the address stored in the component field assigned to the at least one software component is advantageously selected for the update of the at least one software component, and the update of the at least one software component is preferably performed with the aid of the selected source. Advantageously, it is predefined for each individual block and / or for all blocks in common: in particular, in the course of the manufacturing process, how these addresses are selected and whether the component address or the slot address has greater relevance. Alternatively or additionally, this is a freely configurable selection (even during operation), which is changeable in particular in the course of the update.

[0039] According to a preferred embodiment, update-specific information is stored in each component field assigned to at least one software component. In particular, update-specific information is required to carry out the update. In a component field, therefore, different information, in particular component addresses and such update-specific information, can be stored expediently at the same time. For example, a component field can include different entries for this purpose. It is also conceivable that two or more unrelated component fields are assigned to each software component, wherein the corresponding address can be stored in the first of these component fields and the corresponding update-specific information can be stored in the second component field.

[0040] Advantageously, in the component field assigned to at least one software component, information about the current version of the at least one software component is stored as update-specific information. In particular, the update-specific information can include a unique identifier of the corresponding software component, for example a GUID (Globally Unique Identifier). The update-specific information is expediently semantic information and has a semantic meaning, i.e. a self-interpretable meaning, for the manufacturer. For example, the update-specific information can describe the version and / or version number of the corresponding software component.

[0041] Preferably, the updating of the at least one software component is performed with the aid of the selected source based on the update-specific information stored in the component field of the at least one software component. For this purpose, the update-specific information can be transmitted by the network participant to the selected source, which in particular checks whether an update exists for the version of the software component.

[0042] Advantageously, the update is performed for all software components in a continuous or cascaded manner, in particular in a predetermined order. Preferably, for each software component, starting with the hierarchically highest software component down to the hierarchically lowest software component, the address of the source responsible for the update of the respective software component is selected, respectively, based on the component field assigned to the respective software component and based on the block field assigned to the respective manufacturer-specific block, and the update of the respective software component is performed with the aid of the selected source. The hierarchically highest software component is in particular the latest or last introduced software component in the program code, such as an application. The hierarchically lowest software component is in particular the oldest or first introduced software component, such as an operating system.

[0043] In particular, for this purpose, the corresponding selected source is contacted successively for each software component. In particular, the update thus always starts from the network participant and not from the corresponding source, thereby making attacks on the network participant more difficult. In the event that an update is available for the corresponding software component, it is preferably loaded, verified and executed by the source.

[0044] Advantageously, during the updating of at least one software component, in particular after the successful execution of the update, the component field assigned to the at least one software component and / or the block field assigned to the corresponding manufacturer-specific block is updated. After the execution of the update, the update-specific information of the corresponding software component is preferably updated, in particular the identifier of the latest updated version of the software component is stored in the update-specific information.

[0045] Preferably, safety measures are carried out when the selected source cannot be reached. Safety measures can ensure, in particular, that no harm can be done to the network participants by attacks, since the program code of the network participants cannot be updated. In particular, such safety measures include incrementing an error counter and / or placing the network participant in a safe state. In particular, when the error counter reaches a limit value, the network participant is placed in a safe state and, in this case, for example, is separated from the network.

[0046] Advantageously, the program code is executed on a network participant designed as an “Internet of Things” device. Such an “Internet of Things” device (IoT device) is to be understood in particular as a device that is networked with other such IoT devices via a network, in particular the Internet.

[0047] In particular, an IoT device can be constructed as a sensor, an actuator, a control device or another machine component of a machine or an installation, which, in particular in the process of so-called "Industry 4.0", is networked with other such machine components constructed as IoT devices via a network (in particular the Internet).

[0048] Such a control device can be designed, for example, as a CNC control (Computerized Numerical Control), an NC control (Numerical Control), a programmable logic control (SPC) and / or a motion logic control (MC—Motion Control).

[0049] The invention is suitable for applications with a wide bandwidth, for example for tunnel boring machines, hydraulic presses / extrusions, general automation, semiconductor processing, robotics, etc. The method is particularly suitable for controlling machines. Such machines can be configured in particular as machine tools, such as welding systems, screwing systems (Schraubsystem), wire saws or milling machines, or as web processing machines (Bahnbearbeitungsmaschine), such as printing presses, newspaper printing presses, gravure printing presses, screen printing presses, online flexographic printing presses or packaging machines. Such machines can also be configured as (belt) equipment for manufacturing automobiles or for manufacturing components of automobiles (such as internal combustion engines or control devices).

[0050] For example, an IoT device may also be designed as a so-called “smart device”, in particular as a portable handheld device, expediently as a touchscreen handheld device, for example as a smartphone or as a tablet PC.

[0051] An IoT device may also be, in particular, a household appliance in a private household, which is networked with other IoT devices via a network, in particular the Internet, such as a refrigerator, a washing machine, a television or a suitable component for home automation.

[0052] A computing unit according to the invention, in particular such a network participant or such an IoT device, for example a control device of a printing press, is to be configured, in particular in terms of programming, to carry out the method according to the invention.

[0053] The implementation of the method in the form of a computer program is also advantageous, since this results in particularly low costs, in particular when the control device being implemented is also used for other tasks and is therefore already present. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs and many more. It is also possible to download the program via a computer network (Internet, intranet, etc.).

[0054] Further advantages and embodiments of the invention emerge from the description and the attached drawings.

[0055] It goes without saying that the features mentioned above and those yet to be explained below can be used not only in the respectively specified combination but also in other combinations or alone, without departing from the scope of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The invention is schematically illustrated by means of exemplary embodiments in the drawings and is described in detail below with reference to the drawings.

[0057] Figure 1 A machine is schematically shown having machine components designed as IoT devices, which are each configured to carry out a preferred embodiment of the method according to the invention.

[0058] Figure 2 A program code is schematically shown which is configured to be updated within the scope of a preferred embodiment of the method according to the invention.

[0059] Figure 3 A preferred embodiment of the method according to the invention is shown schematically as a block diagram. DETAILED DESCRIPTION

[0060] exist Figure 1 In FIG. 1 , a machine is schematically shown and denoted by 100 , which machine can be designed, for example, as a web processing machine for producing and / or processing workpieces.

[0061] The machine 100 has a plurality of machine components, for example, a plurality of sensors 110, a plurality of actuators 120, and a plurality of control devices 130, which can be designed, for example, as a programmable logic controller (SPC). The control device 130 can be connected to the sensors 110 and receive measured values ​​of the sensors 110, and can also be connected to the actuators 120 and transmit control commands to the actuators 120. For example, with the aid of the sensors 110 and the actuators 120, a production line can be moved and a robot-guided tool can be controlled in order to process a workpiece moving on the production line.

[0062] Machine components 110 , 120 , 130 are designed, for example, as components of so-called field and control levels. Machine 100 may also have machine components 140 of so-called command levels, for example computers or smart devices such as tablet computers or smart phones.

[0063] The individual machine components 110, 120, 130, 140 are each configured as an IoT device and are networked with one another via a network 150 (eg, the Internet). It should be understood that the machine 100 may also have other machine components configured as IoT devices.

[0064] For example, via the networking, the measured values ​​of the sensor 110 can be transmitted directly to the tablet computer 140 of the employee via the Internet 150. For example, the employee can control the machine via the tablet computer 140 by, for example, inputting desired values, which are transmitted via the Internet 150 to the SPS 130, which then controls the actuator 120 according to the input desired values.

[0065] A specific program code can be implemented in each of the IoT devices 110, 120, 130, 140. Since the IoT devices 110, 120, 130, 140 are connected to the Internet 150, it is important that the program code implemented in the IoT devices 110, 120, 130, 140 receives regular security updates and is up to date so that the machines are not vulnerable to attacks. Therefore, the IoT devices 110, 120, 130, 140 are each configured to be updated within the scope of a preferred embodiment of the method according to the invention, such as subsequently according to Figure 2 and Figure 3 As described.

[0066] exist Figure 2 The program code 200 is schematically shown in FIG. 1 , and the program code 200 may be stored in, for example, Figure 1 On one of the IoT devices 110, 120, 130, 140 in the example, and can be implemented by the IoT device.

[0067] The program code 200 consists of a plurality of software components 210, 220, 230, 240, 250, which originate from different manufacturers. The software components 210, 220, 230, 240, 250 are thus assigned to manufacturer-specific blocks or areas 201, 202, 203, 204, depending on which manufacturer the software components 210, 220, 230, 240, 250 originate from.

[0068] A block field 201a, 202a, 203a, 204a for a so-called block-specific address or slot address is assigned to each of the manufacturer-specific blocks 201, 202, 203, 204. Furthermore, component fields 211, 212, 221, 231, 241, 242, 251, 261, 262 are assigned to the individual software components 210, 220, 230, 240, 250 for so-called component addresses or component-specific addresses and for update-specific information.

[0069] Based on the block fields 201a, 202a, 203a, 204a and the component fields 211, 212, 221, 231, 241, 242, 251, 261, 262 or the information stored therein, within the scope of a preferred embodiment of the method according to the invention, an update of the software components 210, 220, 230, 240, 250 is performed, such as subsequently with regard to Figure 3 Just as described.

[0070] exist Figure 3 In FIG. 1 , a preferred embodiment of the method according to the invention is schematically shown as a block diagram.

[0071] Before the program code 200 is placed on the corresponding IoT device and executed by it at the second point in time 320 , within the scope of a preferred embodiment of the method according to the invention, the program code is first prepared in the course of the production process.

[0072] At a first point in time 310 (which is therefore chronologically before the second point in time), in step 311, the original manufacturer of the program code, together with the corresponding platform, for example, prescribes a first software component 210 as basic software. The first software component 210 is therefore assigned to the slot 201 of the original manufacturer. At the first point in time 310, the manufacturer also assigns two component fields 211 and 212 to the first software component 210 in step 312. The manufacturer stores update-specific information in component field 211, which specifies the version of software component 210. The manufacturer stores the address of a source, for example a cloud, in component field 212, which can perform an update of software component 210 at a second point in time 320 after program code 200 has been put into operation. For example, block field 201a remains empty in this case.

[0073] It is also conceivable that at the first point in time 310, the original manufacturer did not develop the program code, but rather a higher-level manufacturer (e.g., OEM) expanded the already existing program code at the first point in time. In this case, for example, at the first point in time 310, in step 311, the first OEM obtains the basic software and platform together with the first software component 210 from the manufacturer and expands the basic software and platform together with the first software component 210 with software components 220 and 230. These software components 220 and 230 are therefore assigned to the slot 202 of the first OEM. The second software component 220 may, for example, have been developed by the first OEM itself, and the first OEM may, for example, have obtained the third software component 230 from a supplier.

[0074] In step 312, the first OEM assigns the component field 221 to the second software component 220 and stores therein information specific to the update, which for example gives an answer about the version of the software component 220. Similarly, the component field 231 is assigned to the third software component 230 and stores therein information specific to the update, which for example gives an answer about the version of the software component 230.

[0075] The first OEM may undertake the updating of the two software components 220 and 230 itself. Thus, in step 312, the OEM stores in block field 202a the address of, for example, the first OEM's cloud, which performs the updating of the two software components 220 and 230.

[0076] For example, the first OEM can also perform an update of the original manufacturer's first software component 210. Thus, the first OEM changes the address stored in the block field 201a of the block 201 in step 313 and clears the address or adopts its own address there.

[0077] Furthermore, it is also conceivable that at first time 310 another second OEM obtains the program code expanded by the first OEM with software components 210, 220 and 230 and expands the program code with further software components 240 and 250. In this case, the second OEM introduces these software components 240 and 250 into the program code at first time 310 in step 311.

[0078] For example, the second OEM may have obtained the fourth software component 240 from a supplier and assigned the component fields 241 and 242 to the software component 240 in the slot 203 provided for the software component in step 312. The second OEM stores update-specific information in the component field 241, which gives information about the version of the software component 240. For example, the second OEM cannot undertake the update of the software component 240 itself, but the corresponding supplier undertakes the update. In this case, the second OEM stores the address of the corresponding source (e.g., the supplier's cloud) in the component field 242 in step 312.

[0079] The fifth software component 250 can be developed by the second OEM itself, for example, and the second OEM can also be responsible for updating the fifth software component 250. In step 312, the second OEM assigns a component field 251 to the software component 250 and stores the version of the software component 250 therein as update-specific information. In addition, the second OEM stores in step 312 the address of a source (e.g., its own cloud) in block field 203a, which is responsible for updating its own software component 250.

[0080] Furthermore, the second OEM predetermines that in its block 203, the component address has a higher relevance than the slot address. Therefore, for software component 240, the component address stored in component field 242 applies, but the slot address does not apply. Since software component 250 has not been assigned a component address, while software component 240 has been assigned a component address, the slot address stored in block field 203a applies to software component 250.

[0081] Alternatively, the second OEM can also predetermine, for example, that the slot address has a higher relevance than the component address. In this case, the slot address first applies to all software components 240, 250 of this slot 203. Only when no update for the software component is available under this slot address, the component address of this software component is selected.

[0082] The second OEM does not undertake the updating of the remaining already existing software components 210, 220 and 230 and thus leaves the already existing block fields unchanged. In this case, step 313 is therefore not performed.

[0083] After the second OEM has extended the program code and has developed a final version of the program code 200, the program code can be loaded onto the corresponding IoT device in step 314. In particular, the end user has the possibility here to store other information in the slot 204 provided for the end user. For example, the end user can describe the version of the program code or the characteristics of the IoT device in the component field 261 and the time interval after which an update for the IoT device is to be searched in the component field 262. The block field 204a remains empty in this example.

[0084] After the program code 200 has been started on the IoT device in step 315 , the IoT device has been introduced into the network 150 and connected to other IoT devices 110 , 120 , 130 , 140 , and a predetermined time interval has expired, an update for the program code 200 is searched for at a second time point.

[0085] Here, at a second time point 320, for each software component 210, 220, 230, 240, 250 of the program code 200, starting with the hierarchically highest software component to the hierarchically lowest software component, a check is made continuously or cascade-wise based on the corresponding block fields and component fields of the corresponding software components 210, 220, 230, 240, 250 to determine whether an update is available for the corresponding software components 210, 220, 230, 240, 250.

[0086] In this example, the second OEM's last introduced software components 240 and 250 are to be considered as the highest software components in the hierarchy.

[0087] Since the second OEM has already predefined that the component address has a higher relevance than the slot address in his block 203, a check is first performed in step 321: whether a component address exists for software components 240 and 250, i.e. whether the address is stored in the component field. Since this is the case for software component 240, the address stored in component field 242 is selected and the corresponding source or the cloud of the corresponding supplier is contacted. If the address is not reachable, an error counter is incremented as a safety measure in step 322. If the error counter reaches a limit value here, program code 200 and therefore the IoT device are separated from Internet 150 and placed in a safe state.

[0088] However, when the address or the cloud is reachable, a secure connection to the network address is established in step 323 and the update-specific information of the component field 241 is transmitted to the cloud, which describes the current version of the software component 240. Then, in step 324, the cloud checks whether there is an update for this version of the software component 240. If not, in step 325, the cloud informs the IoT device of this and the secure connection is disconnected. However, when there is an update, in step 326, the update is transmitted to the IoT device, where it is verified and executed. After the executed update, in step 327, the component-specific, update-specific information in the component field 241 is updated and the new version of the software component is noted therein. In step 328, the connection to the cloud is disconnected.

[0089] After all software components have thus been checked for component addresses, ie for component-specific information having network addresses stored therein, software components without such component addresses, nominally software components 250 , are now checked and steps 321 to 328 are executed analogously for software components 250 .

[0090] In step 321, the address stored in block field 203a is selected for software component 250, and the corresponding source, for example the cloud of the second OEM, is contacted. Analogously to the above description, either an error counter is incremented in step 322 when the cloud does not reply, or a secure connection is established in step 323 and the component-specific information of component field 251 is transmitted to the cloud. The cloud then checks in step 324 whether an update is available for this version of software component 250. If this is the case, the update is performed in step 326, the component-specific information 251 is updated in step 327, and the connection to the cloud is disconnected in step 328.

[0091] As explained above, the second OEM may also be able to predetermine that in slot 203, the slot address has a higher relevance than the component address. In this case, for software component 240, the slot address of block field 203a is first selected and associated in step 321. In particular, a secure connection to the cloud of this slot address is first established, and update-specific information of software component 240 is transmitted to the cloud. The cloud then informs that the cloud is not responsible for updating this software component 240 and that no update is available, and terminates the secure connection. The component address stored in component field 242 of software component 240 is then selected, and the update of software component 240 is carried out as explained above. Subsequently, the slot address is also selected for software component 250, and software component 250 is updated as explained above.

[0092] Thus, after having searched for updates to software components 240 and 250 of slot 203 , one continues with the next lowest software components in the hierarchy, nominally software components 220 and 230 of the first OEM and of slot 202 .

[0093] Since only addresses or slot addresses are stored in block field 202 a for software components 220 and 230 , the corresponding address is selected in step 321 and the source, ie the cloud of the first OEM, is contacted.

[0094] Analogously to the above description, in step 322, when the cloud cannot be reached at the network address, an error counter is incremented. Otherwise, in step 323, a secure connection is established and first the component-specific information of the component field 231 of the software component 230 is transmitted to the cloud, which checks in step 324 whether an update is available for this version of the software component 230. If this is the case, the update is performed in step 326 and the component-specific information of the component field 231 is updated in step 327. In a similar manner, processing is then carried out for the software component 220. Subsequently, in step 328, the secure connection is disconnected.

[0095] Next, an update is searched for the hierarchically lowest software component 210. For this purpose, the address or component address stored in the component field 212 is selected in step 321 and the corresponding source or cloud is contacted, which is the same source that has also been contacted for software components 220 and 230, i.e. the cloud of the first OEM.

[0096] Analogously to the description above, in step 322, when the cloud cannot be reached, an error counter is incremented. Otherwise, a secure connection is reestablished in step 323 and the component-specific information of the component field 211 is transmitted to the cloud. The cloud checks in step 324 whether an update exists for this version of the software component 210. If this is the case, the update is performed in step 326, the component-specific information 211 is updated in step 327, and the secure connection is disconnected in step 328.

[0097] As soon as the time interval stored by the end user in the information 262 expires again, the above-mentioned steps of the second point in time 320 are executed again and a search is made for updates for the software components 210 , 220 , 230 , 240 , 250 .

Claims

1. A method for updating a software component (210, 220, 230, 240, 250) of a network participant (110, 120, 130, 140) of a network (150), - wherein the program code of the network participant (110, 120, 130, 140) has at least two manufacturer-specific blocks (201, 202, 203, 204), - wherein each of the manufacturer-specific blocks (201, 202, 203, 204) has at least one software component (210, 220, 230, 240, 250), wherein each manufacturer-specific block (201, 202, 203, 204) is assigned a block field (201a, 202a, 203a, 204a), - wherein a component field (211, 212, 221, 231, 241, 242, 251, 261, 262) is respectively assigned to the at least one software component (210, 220, 230, 240, 250) of each manufacturer-specific block (201, 202, 203, 204), - wherein in at least one of the block fields (201a, 202a, 203a, 204a) and / or in at least one of the component fields (211, 212, 221, 231, 241, 242, 251, 261, 262) an address of a source responsible for updating is respectively stored, wherein for each of the at least one software component (210, 220, 230, 240, 250) of the manufacturer-specific block (201, 202, 203, 204), a component field (211, 212, 221, 231, 241, 242, 251, 261, 262) assigned to the at least one software component (210, 220, 230, 240, 250) and a component field (211, 212, 221, 231, 241, 242, 251, 261, 262) assigned to the corresponding selecting (321) the address of a source responsible for updating the at least one software component (210, 220, 230, 240, 250) based on a block field (201a, 202a, 203a, 204a) of a manufacturer-specific block (201, 202, 203, 204) and performing (327) an update of the at least one software component (210, 220, 230, 240, 250) using the selected source, in, When an address is stored in a component field (211, 212, 221, 231, 241, 242, 251, 261, 262) of at least one software component (210, 220, 230, 240, 250) assigned to a respective manufacturer-specific block (201, 202, 203, 204), the address is selected (321) for updating the at least one software component (210, 220, 230, 240, 250), In this case, when no address is stored in the component field of at least one software component (210, 220, 230, 240, 250) assigned to the corresponding manufacturer-specific block (201, 202, 203, 204), for updating the at least one software component (210, 220, 230, 240, 250), an address stored in the block field (201a, 202a, 203a, 204a) assigned to the corresponding manufacturer-specific block (201, 202, 203, 204) is selected (321).

2. The method according to claim 1, wherein: In the course of a manufacturing process (310), before the program code is introduced into the network participant, the manufacturer stores (312) the address of a source responsible for updating in each of the block fields (201a, 202a, 203a, 204a) of his manufacturer-specific blocks (201, 202, 203, 204) and / or in at least one of the component fields (211, 212, 221, 231, 241, 242, 251, 261, 262) of his manufacturer-specific blocks (201, 202, 203, 204).

3. The method according to claim 2, wherein: During the course of the manufacturing process, the manufacturer stores (313) the address of the source responsible for the update in a block field (201a, 202a, 203a, 204a) of an external, manufacturer-specific block (201, 202, 203, 204).

4. The method according to any one of claims 1 to 3, wherein: Information about a current version of at least one software component (210, 220, 230, 240, 250) is stored in each of the component fields (211, 212, 221, 231, 241, 242, 251, 261, 262) assigned to the at least one software component (210, 220, 230, 240, 250).

5. The method according to claim 4, wherein: An updating of the at least one software component (210, 220, 230, 240, 250) is performed (326) with the aid of the selected source based on update-specific information stored in a component field (211, 212, 221, 231, 241, 242, 251, 261, 262) of the at least one software component (210, 220, 230, 240, 250).

6. The method according to any one of claims 1 to 3, wherein: For each software component (210, 220, 230, 240, 250), starting with the hierarchically highest software component (250) down to the hierarchically lowest software component (210), the address of a source responsible for updating the respective software component (210, 220, 230, 240, 250) is selected (321) based on the component field (211, 212, 221, 231, 241, 242, 251, 261, 262) assigned to the respective software component (210, 220, 230, 240, 250) and based on the block field (201a, 202a, 203a, 204a) assigned to the respective manufacturer-specific block (201, 202, 203, 204).

7. The method according to any one of claims 1 to 3, wherein: In the process of updating the at least one software component (210, 220, 230, 240, 250), the component fields assigned to the at least one software component (210, 220, 230, 240, 250) and / or the block fields (201a, 202a, 203a, 204a) assigned to the corresponding manufacturer-specific blocks (201, 202, 203, 204) are updated (327).

8. The method according to any one of claims 1 to 3, wherein: If the selected source cannot be reached, safety measures are executed (325), which include incrementing an error counter and / or placing the network participant (110, 120, 130, 140) in a safe state.

9. The method according to any one of claims 1 to 3, wherein: The program code (200) is executed on a network participant (110, 120, 130, 140) designed as an Internet of Things device.

10. A computing unit (110, 120, 130, 140) comprising a memory and a processor, wherein a computer program is stored on the memory, and the computer program is configured to perform the method according to one of claims 1 to 9 when being executed on the processor.

11. A computer program product comprising a computer program which, when executed on a computing unit (110, 120, 130, 140), causes the computing unit (110, 120, 130, 140) to carry out the method according to one of claims 1 to 9.

12. A machine-readable storage medium having a computer program stored thereon, which, when executed on a computing unit (110, 120, 130, 140), causes the computing unit (110, 120, 130, 140) to perform the method according to one of claims 1 to 9.

Images