Device and system-on-a-chip for monitoring cyber-physical systems

Abstract

A device (10) for monitoring an information-physical system (20), characterized by the following features: the device (10) includes a first filter (21), a first simulator (31) and a first comparator (41), wherein the first filter (21) is configured to clean the input value of a first component (11) of the system (20) for confidential or untrusted instructions and transmit it to the first simulator (31), the first simulator (31) is configured to simulate an output corresponding to the first component (11) based on the cleaned input value, and the first comparator (41) is configured to compare the output with the output value of the first component (11) and output a message if the comparison fails.

Description

Technical Field

[0001] The invention relates to a device for monitoring a cyber-physical system, a corresponding system on a chip and a corresponding cyber-physical system. Background Art

[0002] In computer technology, any system that simulates another system in certain sub-aspects is called a simulator. The simulated system is fed with the same data, executes similar programs, and obtains results as close to the same problem as the system being simulated.

[0003] In this context, the technical term "emulator" is always used in a broad sense, which similarly includes software emulators and hardware emulators that are able to simulate electronic components functionally, electrically or mechanically. Hardware emulators that establish a connection to a processor module by means of a socket and a matching plug are sometimes technically referred to as in-circuit emulators (ICE).

[0004] DE102013217793A1 provides a method for animating and debugging at least one vehicle system having at least one target processor, wherein the method is based on a visualizer and analyzer element for displaying an analysis to a user and a target data detection element for detecting data from an application running on the target processor, and wherein the data detection is performed without changing the source code of the at least one vehicle system and the data is collected by using a debugger interface of the at least one target processor. In this document, the target data detection element can be in particular an ICE. Summary of the invention

[0005] The invention provides a device for monitoring a cyber-physical system, a corresponding system-on-a-chip and a cyber-physical system equipped with such a device according to the independent claims.

[0006] The method according to the invention is based on the knowledge that safety-critical systems increasingly consist of components and subsystems developed by different manufacturers. At the same time, multiple discrete functions are provided by a single component, and the correct functioning of the components and subsystems depends on functions provided by components from third-party suppliers. Therefore, each component increasingly processes information at different confidentiality or trust levels. Components accept both trusted (public or confidential) inputs and untrusted (public or confidential) inputs and process these to provide outputs. When doing this processing, care is taken to ensure that safety-critical outputs are not influenced by untrusted inputs. Outputs that should be provided as public information should also not be influenced by confidential inputs. Systems that ensure this behavior have a secure information flow.

[0007] The device described below also takes into account the fact that the evaluation of the secure information flow in the above sense of a component or subsystem using the most modern verification techniques is inherently difficult and cannot be performed for critical components or subsystems. Therefore, an arrangement is proposed that enables the monitoring of components and subsystems with respect to undesired information flows during the verification phase and during the use of the product. By carrying out such monitoring during the verification of the product, implementation errors and design errors with respect to the secure information flow can be identified - sometimes even without additional test cases. Monitoring by the customer during the use of the product ("in the field") makes it possible, on the one hand, to identify unsecure information flows due to the design or implementation of the system and, on the other hand, to improve future versions of the system. Many information attacks on components also manifest themselves as unsecure information flows. In this case, the monitoring according to the invention can be used for security-critical systems within the scope of an attack identification system (intrusion detection system, intrusion detection system, IDS). If an unsecure information flow is identified using the device according to the invention, which is also referred to below as an "information flow monitoring device", the reaction to the identification can be taken into account in the identification information and operational security concept, which in turn can lead to the system being protected against information attacks.

[0008] An IDS according to the prior art for embedded systems typically observes the behavior of the system. Based on a model of the behavior, which is considered to be the "normal" behavior of the monitored system, the observed behavior is compared with the expected behavior, for example using a classifier trained using artificial intelligence. Here, it is usually not known which false alarms will be triggered and what type of attack the IDS will recognize. In addition, depending on the way the classifier is trained, it is difficult to find a representative random sample for rare events such as accidents in order to represent these conditions well in the classifier. In particular, a conventional IDS does not use a copy of the monitored system with altered inputs to compare the observed behavior with the intended behavior. The system also usually does not use filter components and comparison components.

[0009] In this context, the solution according to the invention is advantageous in that the use of the information flow monitoring device makes it possible to identify unexpected information flows in embedded, safety-critical systems, to identify attempts at information attacks on such systems and to monitor the behavior of components of third-party suppliers according to specifications, without having to directly change the behavior of the monitored system. Similar arrangements have been proposed in academic research in the field of web browser technology to ensure the privacy of users when executing programs downloaded from the Internet (e.g. JavaScript) or programs written in functional programming languages ​​(such as HASKELL). These approaches have in common that a secure information flow is ensured by replacing the output of the monitored system with the output of the monitoring device. In contrast, in safety-critical environments, it is sometimes unacceptable to replace the output of a component and thereby ultimately change the observed behavior of said component.

[0010] The measures described in the dependent claims can advantageously expand and improve the basic idea described in the independent claim. It can thus be provided that the device receives input values ​​and output values ​​of the device from the system to be monitored via an interface. In this way, the information flow monitoring device is decoupled from the safety-critical communication infrastructure and does not constitute an additional security risk. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Exemplary embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description.

[0012] Figure 1 The logical structure of the information flow monitoring device according to the present invention is shown.

[0013] Figure 2 A combined information flow monitoring device according to the first option is shown.

[0014] Figure 3 A combined information flow monitoring device according to the second option is shown.

[0015] Figure 4 An information flow monitoring device with different filter combinations is shown.

[0016] Figure 5 Information flow monitoring devices with different combinations of comparators are shown.

[0017] Figure 6 A configurable information flow monitoring device according to the present invention is shown. DETAILED DESCRIPTION

[0018] Figure 1A block diagram of a monitoring system is shown. The device 10 shown consists of an emulator 31 of a monitored component 11, a filter 21 and a comparator 41. The filter 21 receives the same input value as the monitored component 11 and replaces confidential or untrusted information in the input value with a constant value. The filter 21 can also replace only part of the input value. However, the replacement of a bit here does not only depend on the value of the bit itself; instead, for example, the last bit can also be replaced if the first bit is 1.

[0019] The input values ​​filtered in this way are forwarded to the simulator 31. By removing confidential or untrusted information from the input values, the execution of the simulator 31 is independent of confidential and untrusted inputs.

[0020] The comparator 41 reads the output value of the monitored component 11 and checks whether the output of the simulator 31 is consistent with the output value except for possible confidential or untrusted instructions. If the output is not the same as the output value, the output value is obviously affected by the confidential or untrusted input value and the component 11 generates an undesired information flow. In this case, the comparator 41 outputs a fault message indicating the undesired information flow.

[0021] Given a set of input values and a set of output values And the filter function and a specification for each input and output whether the input and output, or a portion thereof, is high or low. (If the input and output, or a portion thereof, is public or trusted, then they should be considered "low" in this sense; if it is confidential or untrusted, then they should be considered "high" in this sense.) The filter function has the following properties:

[0022] ,if l For low,

[0023] ,if h Contains high description,

[0024] ， if x,y Differ only in the high description, then .

[0025] Then, the comparator 41 generates a signal according to the output signal provided by the simulator 31. and the output provided by component 11 exist In the case of a fault, the following selection possibilities are available: If the comparator 41 outputs a corresponding message, the improper behavior can be detected in a log, which can then be read from the cyber-physical system 20 during the inspection interval. If the comparator 41 outputs a warning, the cyber-physical system 20 can forward the warning to the driver or operator of the system 20, or report it to the system supplier. If the comparator 41 is forcibly locked, the driver or operator of the system 20 can be requested to stop the operation of the system 20 in a safe manner and contact customer service or take measures suitable for eliminating the fault or fault protection. The component 11 monitored in this way or its simulator 31 can itself include other components or more complex systems.

[0026] If multiple components 11, 12 or components 11, 12 with different specifications are to be monitored in the system 20, it may be too complicated to provide each component 11, 12 with its own device (10). Therefore, multiple simulators can receive their input from a single filter 21, 22, which provides different inputs (10) for each simulator 31, 32 depending on the specifications of the component 11, 12 to be simulated. Figure 2 ).

[0027] The multiple components 11, 12 may be implemented by a single software or hardware and may receive their input from a single filter 21, 22 which provides input to a combined simulator 31, 32 ( Figure 3 If the simulators 31 , 32 are implemented in software in order to save hardware components of the components 11 , 12 , which can be realized in a simple manner, the simulators 31 , 32 can simulate the two components 11 , 12 sequentially or in parallel.

[0028] Similarly, the multiple components 11, 12 can be implemented by unique software or hardware, while the filters 21, 22 are separate and retain their respective specificities ( Figure 4 ).

[0029] Finally, the multiple components 11, 12 can be implemented by a single software or hardware and receive their input from a single filter 21, 22, which provides input to the combined simulator 31, 32, while the comparators 41, 42 are separate and retain their respective specificities ( Figure 5 ).

[0030] Connecting the device 10 directly to the same communication environment as the components 11, 12 to be monitored may lead to additional information or operational security issues, especially when the communication environment is used for security-critical messages. Therefore, the device 10 can also use a different communication interface than the components 11, 12, and the input values ​​and output values ​​of the components are forwarded to the device 10 via a gateway component.

[0031] The device 10 and the components 11, 12 monitored thereby can be implemented on a single piece of hardware, for example as a so-called system on a chip (SoC). ， SoC).

[0032] The proposed device 10 may also record its internal information, such as information from filters 21, 22, emulators 31, 32 or comparators 41, 42. Such recording may be implemented such that the recorded information is processed inside or outside the device 10. In addition, the recording may be decentralized with each component of the device 10 recording its own data, or may be performed centrally.

[0033] like Figure 6 As shown in , the device 10 can also be configured. The corresponding configuration c It may contain data for the filters 21, 22, the emulators 31, 32 or the comparators 41, 42. In an efficient implementation, the filters 21, 22 and the comparators 41, 42 may use the same configuration data.

[0034] The device 10 may be integrated in, for example, a cyber-physical system 20 in the form of software or hardware or in the form of a mixture of software and hardware.

Claims

1. A device (10) for monitoring a cyber-physical system (20), characterized by the following features: The device (10) comprises a first filter (21), a first simulator (31) and a first comparator (41), The first filter (21) is configured to clean input values ​​of a first component (11) of the system (20) for confidential or untrusted information and transmit the input values ​​to the first simulator (31), wherein the first filter (21) replaces confidential or untrusted information in the input values ​​with a constant value. The first simulator (31) is arranged to simulate an output corresponding to the first component (11) based on the cleaned input values, and The first comparator (41) is arranged to compare the output with an output value of the first component (11) and to output a message if the output is not identical to the output value.

2. The device (10) according to claim 1, characterized by the following features: The device (10) further comprises a second simulator (32), The first filter (21) is arranged to also feed the cleaned input value to the second simulator (32), The second simulator (32) is configured to simulate an output corresponding to the second component (12) based on the cleaned input values, The first comparator (41) is arranged to introduce the output value of the second component (12) into the comparison.

3. The device (10) according to claim 2, characterized by the following features: The first simulator (31) and the second simulator (32) are integrally constructed.

4. The device (10) according to claim 2 or 3, characterized by the following features: The device (10) further comprises a second filter (22), and The second filter (22) is also arranged to deliver cleaned input values ​​to the first simulator (31) and the second simulator (32).

5. The device (10) according to claim 1, characterized by the following features: The device (10) further comprises a second comparator (42), and The second comparator (42) is arranged to compare the output with an output value of a second component (12) and to output the message if the output is not identical to the output value of the second component (12).

6. The device (10) according to any one of claims 1 to 3, characterized by the following features: The device (10) is arranged to receive the input value and the output value from the system (20) via an interface.

7. The device (10) according to any one of claims 1 to 3, characterized by the following features: The device (10) is arranged to record internal information.

8. The device (10) according to any one of claims 1 to 3, characterized by the following features: The device (10) is arranged to perform the cleaning, the simulation or the comparison according to a predetermined configuration.

9. The device (10) according to any one of claims 1 to 3, characterized by the following features: The device also includes a component for processing the message, and The device is arranged to selectively record the message or forward the message to a user or manufacturer of the device (10).

10. A single-chip system comprising at least a first component (11) and a device (10) according to one of claims 1 to 9.

11. A cyber-physical system (20) comprising the single-chip system according to claim 10.

Images