Data processing device, system and method for verifying or checking the security of a data processing device

Abstract

A data processing device, system and method for proving or checking the security of a data processing device. The purpose of the present invention is to simplify security enhancement based on trusted computing. To this end, a first data processing device is provided, which is adapted to operate according to one or more platform configurations. The first data processing device includes a verification processor, a network interface and a data storage device for storing verification data. The verification processor is adapted to establish verification data, which indicates the current platform configuration. The verification data facilitates the validity check of integrity data including the verification data. The first data processing device is adapted to provide integrity and verification data.

Description

Technical Field

[0001] The present invention relates to a trusted or secure computing domain in a network environment, and more particularly to a method for proving the security of a first processing device, a method for checking the security of a first data processing device, a first data processing device, a second data processing device, and a system comprising the data devices and / or adapted to perform the method. Background Art

[0002] Traditionally, data processing devices, in particular computing devices, i.e. personal computers or servers, have been designed with a focus on openness and interoperability. With the increasing use of data processing devices in network environments in which several data processing devices are connected to each other via network interfaces and / or in multi-user scenarios, the security of data processing devices has become increasingly important. Therefore, in particular, various means are provided for protecting data processing devices from attacks, such as attempts by an attacker to access and / or modify such data processing devices or their software, or to impersonate communications between two data processing devices.

[0003] In addition, in recent years, there has been a growing interest in exchanging data, running applications, and providing services between data devices, particularly network environments. In addition, although some of these have been provided in a closed network of a data processing device, there is a trend to provide and / or use data exchange, applications, and / or services through the Internet, which makes security even more important. In particular, such data exchange, applications, or services can be used for industrial applications, and use design data, simulation data, technical or medical diagnostic data, control data or signals, financial data, and / or monitor or control supply chains or logistics. In particular, for such use scenarios, it is important to protect data processing devices connected to each other via a computer network (especially the Internet) from attack and / or manipulation, and / or provide means to enable a data processing device to trust another data processing device communicating with it.

[0004] There are various commercial, closed or public platforms, systems and implementations that involve secure data exchange between data processing devices, in particular distributed industrial sites. They usually provide so-called "managed file transfers" that provide a high degree of security for the transferred data, in particular sensitive data, such as medical data or financial data or the control of industrial sites. Such secure transmission is particularly important in automation environments, where manufacturing processes are automated and controlled by such control data.

[0005] To enhance the security of a data processing device, the data processing device may use and / or implement various trusted computing aspects.

[0006] A characteristic of trusted computing is secure boot or trusted boot, which allows a data processing device implementing this feature to boot into a defined and trusted configuration so that its current hardware configuration and / or the software running on it (i.e., its platform configuration) is in a defined and, in particular, authorized state.

[0007] Furthermore, one of the features of trusted computing is integrity measurement, which allows determining hash values ​​of hardware and / or software configurations and other information, which at least partially defines the current platform configuration, i.e. (loadable / loaded) executable code, configuration data or files, parameters (such as the ambient temperature of the data processing device) or active users or processes. This may allow determining integrity data or attestation data indicating the current platform configuration. In particular, the determination may be performed at runtime, e.g. within a secure boot or at a subsequent operation phase of the data processing device, and may therefore in particular provide data that does not (only) indicate a static platform configuration (i.e. a shut-down data processing device), but rather indicates (and also indicates) an operating / running data processing device.

[0008] Another feature of trusted computing is so-called remote attestation. Remote attestation involves providing information about the platform configuration on which the remote data processing device is currently operating to another data processing device so that the other data processing device can trust the remote data processing device depending on the provided platform configuration. In this way, the security of the other data processing device exchanging data with the remote data processing device, running applications on the remote data processing device and / or using the services of the remote data processing device can be improved.

[0009] A known platform for secure data exchange, in particular for industrial applications, is the "Industrial Data Space" (IDS), which was developed by several partners including the Fraunhofer Gesellschaft. Sometimes, it is also called the "International Data Space". In order to approve the security of data exchange within the Industrial Data Space platform, the platform is designed to use so-called security gateways for data exchange, wherein the number of security gateways is limited and each security gateway is authenticated and / or each operator of one or more security gateways is authenticated or technically approved, thereby allowing other security gateways or other data processing devices of the platform to trust those authenticated / approved security gateways.

[0010] In addition, the following documents are known: US 8,531,247 B2, US 8,892,616 B2, US 8,300,811 B2, US9,147,088 B2, US 9584311 B2, EP 2976707 B1, EP 2605445 B1, EP 2870565 A1, EP2891102A1, WO 2017137256A1, EP 2870565B1, EP 3028140 B1, EP 17175275, US8843761B2. Summary of the invention

[0011] The object of the invention is to improve the security of a data processing device and a system having a data processing device, which data processing devices can communicate with each other in particular via a network interface, and more particularly to simplify improved security enhancements based on trusted computing and / or based on information indicating a platform configuration on which the data processing device can operate.

[0012] A solution to this problem is provided by the first data processing device, the second data processing device, the system, the method for proving the security of the first data processing device, and the method for checking the security of the first processing device disclosed in the present invention. In addition, the present invention also provides various embodiments, advantageous modifications and further improvements.

[0013] A first aspect of the invention relates to a first data processing device adapted to operate according to one or more platform configurations. The first data processing device comprises a confirmation processor, a network interface and a data storage device for storing verification data. The confirmation processor is adapted to establish confirmation data indicating a current platform configuration in the one or more platform configurations. In addition, the verification data facilitates a validity check of integrity data, wherein the integrity data at least comprises the confirmation data. In addition, the first data processing device is further adapted to provide the integrity data and the verification data to a second processing device via the network interface.

[0014] In the sense of the present disclosure, a "data storage device" is an apparatus adapted to store data and / or retrieve data previously stored thereon. In particular, the data storage device may retrieve data from a data storage medium, wherein the data may have been stored on the data storage medium by another device. Moreover, in particular, the data storage device may store data on a data storage medium such as a magnetic disk, an optical disk, an electronic circuit, which data storage medium may include a current storage device and / or a capacitor and / or a phase change material. In particular, a hard disk, a flash memory, a random access memory, a solid state disk or an optical disk with a writing or reading device therefor are data storage devices in the sense of the present invention.

[0015] Within the meaning of the present disclosure, "platform configuration" may refer to a state with which a data processing device can operate. In particular, such a state may include the hardware configuration of the data processing device, the state of the hardware, the software configuration of the data processing device, the state of the software configuration (specifically, the software is its application, module or component running on the data processing device), or a combination thereof. "Current platform configuration" may refer to the platform configuration with which the data processing device currently operates. In particular, this may include the hardware of the data processing device (including the presence and operating state of some or all of its components, such as expansion cards, network interfaces, processors, storage devices, user interfaces or shells), software installed on the data processing device, and / or whether the software is currently loaded (i.e., operating system, application, hypervisor, software state, etc.), its operating state (i.e., whether it is currently running), and / or a specific version of the software. In particular, a checksum (such as a hash value) of the software (i.e., application, operating system, etc.) may be calculated when the software is loaded and / or during runtime to provide a platform configuration or at least a portion thereof. Moreover, a tamper sensor may be used to verify the physical integrity of one or more components, and a checksum may be determined based on the measurement of the tamper sensor.

[0016] The advantage of providing the integrity data may be, in particular, that based on the integrity data and its confirmation data, the current platform configuration of the first data processing device can be checked, thereby facilitating, in particular, checking whether the first data processing device is safe, i.e., whether it is currently operating with a safe platform configuration. Furthermore, the verification data advantageously allows a validity check of the integrity data to be performed, thereby in particular allowing a check whether the current platform configuration indicated by the integrity data is a safe configuration. In this way, security may be improved, since not only the current platform configuration may be determined, but also whether it is safe based on the validity data.

[0017] Another advantage may be that both integrity data and verification data are provided by the first data processing device, thereby reducing complexity compared to other trusted or secure computing implementations in which integrity data and verification data are managed, distributed or generated in another, in particular separate, manner.

[0018] For example, for a system in which integrity and verification data are separated, comprising M first data processing devices and N second data processing devices, wherein each first data processing device provides its integrity data but does not provide its verification data, and wherein each second data processing device therefore needs to store and / or manage all M verification data, the complexity is M×N.

[0019] In contrast, by providing both verification data and integrity data by one data processing device (i.e., the first data processing device), the complexity can be reduced, and in some advantageous implementations, the complexity can be M + 1. In this advantageous manner, improving security based on information indicating the current platform configuration (i.e., integrity data or confirmation data) is less complex and / or convenient.

[0020] According to some embodiments, the first data processing device may be adapted to run at least one software component. The at least one software component is selected from the group comprising: an application that provides stored and / or calculated application data to the second data processing device and / or requests application data from the second data processing device; a hypervisor; a virtual machine; an operating system; and / or a data space runtime environment. Furthermore, the first data processing device is adapted to provide integrity data and verification data such that the integrity data and verification data are specific to the at least one software component. Thereby, in addition to or as an alternative to proving the general / overall security of the first data processing device by providing generic integrity and verification data, the security of the first data processing device may be proven specific to the at least one software component. Furthermore, in some advantageous modifications, a security proof chain can be established by providing integrity and verification data about the security of the first data processing device for each part of the chain, i.e., in particular, the general security of the first data processing device relative to its hardware, firmware and / or operating state, the security of the hypervisor running on the hardware, the security of the virtual machine running on the first data processing device and managed by the hypervisor, the security of the operating system running in the virtual machine (specifically, the current platform configuration and / or part thereof related to the operating system), and the security of the application running in the operating system. In such an advantageous manner, it can be checked whether all links in the chain about the security of the first data processing device are actually secure. Furthermore, it can advantageously allow running different software components in different security states, i.e., one application is secure, while another application is preferably isolated in another virtual machine, which is insecure and makes it possible for no integrity or verification data to be provided for the insecure application, while specific integrity and verification data are provided for the secure application.

[0021] In some embodiments in which the verification data is specific to the at least one software component, the at least one software component and the verification data specific to the at least one software component are bundled into a bundled component image. In addition, the first data processing device is adapted to receive the bundled component image, store the bundled component image on a data storage device, and retrieve the software components in the bundled component image from the data storage device to run the at least one software component. According to some advantageous modifications, the first data processing device can be adapted to receive the bundled component image from a server for component images. Thereby, the at least one software component and its specific verification data can be handled as one entity, which can facilitate improved security.

[0022] In some embodiments in which the at least one software component and verification data specific to the at least one software component are bundled into a bundled component image, the bundled component image can be digitally signed by a first digital signature. In addition, the first data processing device can be adapted to verify the bundled component image based on the first digital signature, and selectively run software components in the bundled component image depending on the verification of the bundled component image. Thereby, the security of the first data processing device and / or the security of a second data processing device that communicates with the first data processing device can be improved. In particular, the first digital signature and the verification of the bundled component image based on the first digital signature can provide protection against attackers who attempt to infiltrate the first data processing device through modified software components.

[0023] According to some embodiments of signing by digital signature, verification based on digital signature and / or digital signature can be implemented by asymmetric encryption, in particular by private key and public key. In such an implementation, the private key can be used to digitally sign some data, and the public key can be used to verify the digital signature of the data signed by the private key. Therefore, the private key should be kept private and / or secret, while the public key can be distributed to other data processing devices to facilitate the verification.

[0024] Additionally or alternatively, in some embodiments, digital signature may be implemented via a one time key.

[0025] Furthermore, in some embodiments, the digital signature may also be implemented by another digital signature method.

[0026] According to some embodiments, the first data processing means is adapted to provide said verification data by retrieving verification data specific to the at least one software component from a data storage device.Thereby, the computational effort may be reduced.

[0027] In some embodiments, in which the first data processing device is adapted to provide at least one of integrity data and verification data specific to the at least one software component, the first data processing device is adapted to run an integrity module and / or a validity module of the at least one software component. In some advantageous modifications, the integrity module is adapted to establish specific integrity data by means of a certification processor, so that the first data processing device can provide the specific integrity data. In some advantageous modifications, the validity module is adapted to establish specific verification data by selecting and retrieving specific verification data from a data storage device, so that the first data processing device can provide the specific verification data. Providing integrity data by running an integrity module or providing verification data by running a validity module can advantageously allow modularization of establishing integrity data or validity data, so that complexity can be reduced and specific requirements for the at least one software component can be implemented as part of a software component or at least in connection with a software component, in particular as a module of the at least one software component.

[0028] According to some embodiments, the authentication processor includes at least one of the following group: a trusted platform module (TPM), a cryptographic processor, a processor, and / or a data interface.

[0029] The cryptographic processor is adapted to determine a current platform configuration and to generate attestation data based on the current platform configuration.

[0030] The processor is adapted to run a firmware or software module of the first data processing device, which is adapted to determine information indicative of a current platform configuration and to generate attestation data based on the information. Such a processor may advantageously allow the attestation method to be modified via the firmware or software module (i.e., to be updated), thereby facilitating supervision and / or operation of the first data processing device including such a processor. The data processor may include a trusted execution environment, such as ARM's TrustZone or Intel's SGX, in which the firmware or software module is executed.

[0031] The data interface is adapted to receive confirmation data from a hardware security module, wherein the hardware security module is adapted to detect information indicating the current platform configuration and to generate confirmation data based on the information. By receiving the confirmation data via the data interface, the data processing device can be advantageously used as a first data processing device that does not support a cryptographic processor or a trusted platform. This may be the case in particular for embedded systems. Furthermore, receiving the confirmation data via the data interface may also be combined with other means in the group, so that security may be further improved.

[0032] In some advantageous implementations, the Trusted Platform Module may be implemented according to standard ISO / IEC 11889 or a later standard of the Trusted Computing Group, wherein the first data processing apparatus may be adapted to use and comply with the Trusted Platform Module according to the standard.

[0033] In some advantageous modifications, the hardware security module may be comprised by the first data processing device or may be external thereto. In some advantageous modifications, the hardware security module may comprise one or more sensor devices to detect information indicative of the physical integrity of the first data processing device, such as the state of a housing of the first data processing device, or one or more images, in particular videos, of the physical environment of the first data processing device or the state of a physical tamper-proof encapsulation (wire mesh) or a protective coating or a tamper-proof physical housing.

[0034] Within the meaning of the present disclosure, the term "comprising" may mean that a first component comprises a second component, i.e., the second component is a part of the first component. "Comprising" may also mean that a first component is at least substantially composed of a second component. Furthermore, "comprising" may also mean that a first component is implemented by a second component. Furthermore, a first component comprising a second component and an additional component may consist of or depend on the second component and the additional component.

[0035] A second aspect of the invention relates to a second data processing device, which includes a network interface. In addition, the second data processing device is adapted to receive integrity data from the first data processing device via the network interface. In addition, the second data processing device is also adapted to receive verification data from the first data processing device via the network interface. Finally, the second data processing device is adapted to perform a security check on the first data processing device, wherein the security check at least includes a validity check on the integrity data based on the verification data.

[0036] The embodiments, advantageous modifications and further improvements as well as potential benefits and advantages as have been described in detail above in conjunction with the first aspect of the present invention also apply accordingly to the second data processing apparatus according to the present invention.

[0037] Furthermore, receiving both integrity data and verification data from the first data processing device may advantageously allow for a reduction in complexity for implementing secure or trusted computing, and in particular for remote attestation. Another advantage of in particular performing a security check including and depending on a validity check may be that the verification data specifically facilitates a validity check on the integrity data. In some advantageous embodiments, the verification data may provide / include information about a secure platform configuration according to which the first data processing device may operate. Thereby, discrimination between secure and insecure platform configurations based on local data (i.e. the verification data) may advantageously be facilitated.

[0038] A third aspect of the invention relates to a system comprising first data processing means and second data processing means, the first data processing means being according to the first aspect of the invention and the second data processing means being according to the second aspect of the invention.

[0039] The embodiments, advantageous modifications and further improvements as well as potential benefits and advantages as have been described in detail above in conjunction with the aforementioned aspects of the invention also apply correspondingly to the system according to the invention.

[0040] According to some embodiments, the first data processing device is adapted to provide application data, which is stored on a data storage device or another data storage device of the first processing device, or is calculated by running at least one software component. In addition, the first data processing device can be adapted to provide application data to the second data processing device via its network interface.

[0041] According to some embodiments, the second data processing apparatus may be adapted to selectively receive and / or process the application data from the first data processing apparatus depending on the security check.

[0042] In particular, the first and the second data processing device, or respectively a system comprising both, may form a data exchange network or part of a data exchange network by providing application data to the second data processing device.

[0043] Furthermore, the security of the system can be advantageously improved by receiving and / or processing application data from the first data processing device depending on the security check. Thus, in particular, receiving or processing application data from an insecure source, in particular from the first data processing device configured with an insecure platform, can be avoided.

[0044] According to some embodiments, the first data processing device and / or the second data processing device may include or may be designed as a gateway server for a data exchange network. According to some advantageous modifications, the first and / or the second data processing device may be formed as a gateway server for an industrial data space.

[0045] Some embodiments of the gateway server may be adapted to establish a data connection to the first or second data processing device via a network interface. In addition, such a gateway server may be adapted to establish a data connection to other computing devices via the same network interface or via another network interface. According to some advantageous modifications, the gateway server may be adapted to receive and / or provide data to such other computing devices, and serve as a gateway to a data exchange network, in particular for forwarding data from such a computing device to the second or first data processing device, or vice versa. Thereby, the other computing device and / or the first or second data processing device, the gateway server serves as a gateway between them, and in particular by forwarding data from or to the first or second data processing device depending on a security check can improve their security.

[0046] According to some embodiments, the first data processing device is adapted to receive application data from the second processing device via its network interface.

[0047] According to some embodiments, the second data processing apparatus comprises a data storage device for application data and / or is adapted to run one or more applications providing stored and / or calculated application data.

[0048] In some embodiments of the second data processing apparatus wherein the second data processing apparatus comprises a data storage device for application data, the second data processing apparatus is adapted to selectively provide the application data to the first data processing apparatus dependent on the security check.

[0049] In some embodiments, wherein the second data processing apparatus is adapted to run one or more applications, the applications are adapted to selectively provide application data to the first data processing apparatus dependent on the security check.

[0050] Thereby, it is possible to avoid providing application data to the first data processing device when the first data processing device fails the security check.

[0051] According to some embodiments, the validation data comprises information indicative of at least one predefined valid platform configuration of the one or more platform configurations of the first data processing apparatus.

[0052] In some embodiments, in which the verification data may include information indicating at least one predefined valid platform configuration of the one or more platform configurations of the first data processing device, the second data processing device may be adapted to perform a validity check by determining whether the confirmation data matches the at least one predefined valid platform configuration. Thereby, information about a valid platform configuration may be provided, which is a safe platform configuration, i.e. a predefined platform configuration.

[0053] According to some embodiments, the first data processing device may be adapted to generate measurement data based on the type and extent of measuring the current platform configuration in order to establish the verification data. Thereby, not only the current platform configuration of the first data processing device is indicated via the verification data, but also how the verification data is established can be reconstructed.

[0054] According to some advantageous modifications, the first data processing device may also be adapted to provide integrity data, wherein the integrity data also comprises the measurement data.

[0055] Providing measurement data may advantageously allow tracking through which platform configurations the current platform configuration was reached and what the expected confirmation data for this path will be. In particular, confirmation data arrived via one path may differ from confirmation data arrived via another path, i.e. by loading applications or software in a different order, whereas both confirmation data may indicate valid platform configurations, in particular equal or identical platform configurations. Thus, in particular, complexity may be reduced by summing up different confirmation data and classifying them as indicating one platform configuration, in particular the at least one predefined configuration.

[0056] According to some embodiments wherein measurement data is provided and / or wherein the integrity data comprises measurement data, the second data processing device may be adapted to perform an integrity check by determining whether the confirmation data matches the measurement data. Furthermore, the security check may comprise an integrity check, such that the security check depends on both the validity check and the integrity check.

[0057] According to some embodiments, the verification data is digitally signed by a second digital signature.

[0058] According to some embodiments, the first data processing device is adapted to verify the verification data based on the second digital signature.Furthermore, the first data processing device is adapted to selectively provide integrity data and / or verification data and / or application data and / or request application data depending on verification of the verification data.

[0059] In some embodiments, wherein the verification data is digitally signed, the second data processing means is adapted to verify the verification data based on the second digital signature.Furthermore, the security check comprises and depends on the verification of the verification data.

[0060] Thereby, it is possible to make counterfeit attacks on the verification data more difficult, and preferably avoid such attacks. In some advantageous modifications, the digital signature, in particular the public key of the second digital signature or for the second digital signature can be provided by a trusted entity or organization. Although the second digital signature still has to be distributed to the second data processing device or M second data processing devices, it is still the same second digital signature for all second data processing devices, so that the process of distributing the digital signature is less complicated and requires less work than distributing each verification data to each of the M second data processing devices. Therefore, the second digital signature can be used to sign several verification data.

[0061] According to some embodiments where the first and second digital signatures are used, the first and second digital signatures are identical.Thereby, a trusted entity or organization can sign and / or distribute both the image of a software component and the corresponding verification data.

[0062] According to some embodiments, the authentication processor, in particular the authentication processor of the first data processing arrangement, is adapted to digitally sign the integrity data by a third digital signature.

[0063] In some embodiments in which the integrity data is signed by a third digital signature, the first data processing device is adapted to verify the integrity data based on the third digital signature. In addition, the first data processing device is adapted to selectively provide integrity data and / or verification data and / or application data and / or request application data depending on the verification of the integrity data. Thereby, the security of the system can be enhanced and / or errors caused by a missing or invalid third digital signature can be avoided, i.e., resulting in a failure in the verification of the integrity data based on the third digital signature. Therefore, in some advantageous modifications, when the verification of the integrity data fails and thus the interaction (especially communication) between the first and second data processing devices that requires a security check will fail prematurely, the first data processing device will not provide data, i.e., integrity data, etc. to the second data processing device.

[0064] In some embodiments, wherein the integrity data is signed by a third digital signature, the second data processing apparatus is adapted to verify the integrity data based on the third digital signature.Furthermore, the security check comprises and depends on the verification of the integrity data.

[0065] By verifying the integrity data, in particular by means of the third digital signature, it may be made more difficult to counterfeit the integrity data, or more particularly the authentication data, or preferably such counterfeiting may be avoided. In an advantageous modification, the authentication processor of the first data processing device may thus be used to ensure a certain level of trust in the first data processing device. In particular, the authentication processor may be provided by a trusted entity or organization and / or may be cryptographically and / or physically protected.

[0066] According to some embodiments, the first, second and / or third digital signatures may be equal.

[0067] According to some embodiments, a server for component images may be provided.

[0068] The server for component images is adapted to provide one or more images of software components that can be run on the first data processing device, wherein one or more of the software components are each bundled with verification data into a bundled component image, and the respective verification data is specific to the respective software component.

[0069] According to some embodiments, the system may include such a server component image.

[0070] Thereby, the image of software component and the bundled component image can be provided to the data processing device of the system, which can facilitate improving the security of the system by utilizing trusted computing. In addition, the corresponding verification data can also be advantageously provided by the server for the component image.

[0071] According to some embodiments, the server for component images may be adapted to verify at least one of the bundled component images based on a digital signature, in particular the first digital signature.

[0072] A fourth aspect of the invention relates to a method for attesting the security of a first data processing device. The method comprises establishing attestation data by means of an attestation component of the first data processing device, wherein the attestation data indicates a current platform configuration of one or more platform configurations according to which the first data processing device is adapted to operate. The method further comprises providing integrity data to a second data processing device, wherein the integrity data comprises at least the attestation data. The method further comprises providing verification data to the second data processing device, wherein the verification data facilitates a validity check of the integrity data.

[0073] The embodiments, advantageous modifications and further improvements as well as potential benefits and advantages which have been described in detail above in conjunction with the aforementioned aspects of the invention also apply correspondingly to the method according to the invention for proving the security of a first data processing device.

[0074] A fifth aspect of the invention relates to a method for checking the security of a first data processing device. The method comprises receiving integrity data from the first data processing device. The method also comprises receiving verification data also from the first data processing device. Finally, the method comprises performing a security check of the first data processing device. The security check comprises at least a validity check of the integrity data based on the verification data.

[0075] The embodiments, advantageous modifications and further improvements as well as potential benefits and advantages which have been described in detail above in conjunction with the aforementioned aspects of the invention also apply correspondingly to the method according to the invention for checking the security of a first data processing device.

[0076] The above summary is intended only to give a brief overview of some features of some embodiments and implementations and should not be construed as limiting. Other embodiments may include other features in addition to those described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] The above and other embodiments, advantageous modifications, further improvements, elements, features, steps and characteristics of the present disclosure will become more apparent from the following detailed description of the exemplary embodiments and the accompanying drawings. When not otherwise specified or otherwise indicated from the context, the same reference numerals refer to corresponding devices, elements or features in the exemplary embodiments and the entire accompanying drawings.

[0078] Figure 1 A first data processing apparatus according to an embodiment is schematically illustrated.

[0079] Figure 2 A second data processing apparatus according to an embodiment is schematically shown.

[0080] Figure 3 A system according to an embodiment is schematically shown, the system comprising a first data processing device, a second data processing device and a server for component imaging.

[0081] Figure 4 A flow chart showing a method for providing security of a first data processing apparatus according to an embodiment.

[0082] Figure 5 A flow chart showing a method for checking the security of a first data processing device according to an embodiment. DETAILED DESCRIPTION

[0083] Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be understood that the description of the following embodiments should not be viewed in a limiting sense. The scope of the present invention is not intended to be limited by the embodiments or drawings described below, which are merely considered to be illustrative.

[0084] Each figure should be considered as the schematic representation and element illustrated in the figure, which is not necessarily shown to scale. On the contrary, various elements are represented so that their functions and general purposes are obvious to those skilled in the art. Any connectivity coupling between the functional blocks, devices, components or other physical functional units shown in each figure or described herein can also be achieved by indirect connectivity coupling. Coupling between components can be established by wireless connection. Functional blocks can be implemented in hardware, firmware, software or a combination thereof.

[0085] Figure 1 Schematically shows a first data processing device 100 according to an embodiment of the present invention.

[0086] According to an exemplary embodiment, the first data processing device 100 is adapted to operate according to one or more platform configurations. The first data processing device 100 includes a confirmation processor 110, which is adapted to establish confirmation data, wherein the confirmation data indicates a current platform configuration in the one or more platform configurations. In addition, the first data processing device includes a network interface 120 and a data storage device 130 for storing verification data. The verification data facilitates a validity check of the integrity data, wherein the integrity data at least includes the confirmation data. In addition, the first data processing device is adapted to provide the integrity data and the verification data to the second data processing device via the network interface 120.

[0087] According to some advantageous modifications, in particular for providing integrity and verification data, the first data processing device 100 may also include a central processing unit 160 and a working memory 170. According to some advantageous modifications, the first data processing device 100 may be implemented as a personal computer or a server computer, such as a computer based on an Intel Xeon platform, an IBM-Power-9 system or an ARM CortexA processor.

[0088] According to some advantageous modifications, the authentication processor 110 may be implemented as a Trusted Platform Module (TPM).

[0089] According to an exemplary embodiment, the first data processing device 100 can furthermore be adapted to run at least one software component, in particular an application, which provides stored and / or calculated application data to the second data processing device and / or requests application data from the second data processing device. Furthermore, the first data processing device is adapted to provide integrity data and verification data, such that the integrity data and verification data are specific to the at least one software component, i.e. the application. In particular for this purpose, the first data processing device 100 can run the application on the central processing unit 160 and using the working memory 170.

[0090] Furthermore, according to some advantageous modifications, in particular when the first data processing device is in an operating state, the data storage device 130 may include: Figure 1 The physical representation of the bundled component image 134 is depicted, wherein the bundled component image 134 is a bundle of the at least one software component 136 (i.e. the application 136) and the verification data specific to the at least one software component (i.e. its physical representation 135). Thus, the first data processing apparatus 100 can be adapted to load the at least one software component 136 from the data storage device 130 to the working memory 170 and run it by means of the central processing unit 160.

[0091] Furthermore, the first data processing device 100 may be adapted to provide the second data processing device via the network interface 120 with authentication data 135 specific to the at least one software component 136 .

[0092] Furthermore, according to some advantageous modifications, the bundled component image 134 may be digitally signed by a first digital signature. Furthermore, in some implementations, the first data processing apparatus 100 may advantageously be adapted to verify the bundled component image 134 based on the first digital signature, in particular by means of its central processing unit 160 and its working memory 170. Furthermore, in some implementations, the first data processing apparatus 100 may advantageously be adapted to selectively run the software component 136 in the bundled component image 134 depending on the verification of the bundled component image.

[0093] Figure 2 A second data processing device 200 according to an embodiment of the present invention is schematically shown.

[0094] According to an exemplary embodiment, the second data processing device 200 comprises a network interface 210. Furthermore, the second data processing device 200 is adapted to receive integrity data from the first data processing device via the network interface 210. In some advantageous modifications, the first data processing device is according to an embodiment of the present invention, and in particular may be according to reference Figure 1 An exemplary embodiment of the first data processing device 100 is given. The second data processing device 200 is further adapted to also receive verification data from the first data processing device via the network interface 210. In addition, the second data processing device 200 is further adapted to perform a security check on the first data processing device, wherein the security check at least includes a validity check on the integrity data based on the verification data.

[0095] According to some advantageous modifications, in particular for carrying out security checks, the second data processing device 200 can comprise a central processing unit 260 and a working memory 270 .

[0096] According to some advantageous modifications, the second data processing device 200 can be implemented as a personal computer or a server computer, which can be based on Intel's Xeon platform, IBM's Power-9 platform or an ARM CortexA processor.

[0097] In an exemplary embodiment, the second data processing device 200 may also be adapted to run one or more applications, which provide application data (i.e., data calculated by or stored for / by the corresponding application) to the first data processing device and / or receive application data (data calculated by or stored for the application running on the first data processing device) from the first data processing device. In addition, the second data processing device is adapted to selectively provide or receive application data depending on a security check of the first data processing device. For this purpose, in particular, according to some advantageous modifications, the second data processing device 200 may include a data storage device 230 and / or may be adapted to run applications with the aid of a central processing unit 260 and a working memory 270. In addition, in some advantageous modifications, in particular when the second data processing device is in an operating state, one or more applications may be easily stored on the data storage device 230, and therefore, the data storage device 230 may include a physical representation of the applications 236, 238, i.e., a specific magnetic domain in the case of a magnetic storage device such as a hard disk.

[0098] According to an advantageous modification, the second data processing device 200 may be adapted to provide and / or receive application data via the network interface 210 .

[0099] In some embodiments, the second data processing apparatus 200 may further be adapted to also function as the first data processing apparatus according to embodiments of the present disclosure, and may thus in particular be adapted to run and / or may store a corresponding application.

[0100] Figure 3 A system 1 is schematically shown which includes a first data processing apparatus 100 and a second data processing apparatus 200 each according to an embodiment of the present invention.

[0101] According to an exemplary embodiment, the system 1 further comprises a server 30 for component images. The server for component images is according to an embodiment of the present disclosure. In addition, the first data processing device 100 may in particular be according to the reference Figure 1 The exemplary embodiments of the first data processing device 100 and / or the second data processing device 200 given may in particular be based on reference Figure 2 An exemplary embodiment of a second data processing apparatus 200 is given.

[0102] According to some advantageous modifications, the server 30 for component images may include a data storage device 32 and a network interface 43. In some advantageous implementations, the server 30 may be implemented as a personal computer or a server computer. Furthermore, in some modifications, in particular when the server 30 is in operation, the data storage device 32 may include a physical representation of the images 36, 38 of the software components and at least one bundled software component image 34 including the software components, wherein the software components in the images 36, 38 or the at least one bundled component image 34 may be run on the first data processing device 100.

[0103] In an exemplary embodiment, the second data processing apparatus 200 may also be implemented as a gateway server and / or further include another network interface 250. In addition, the system 1 may include one or more computing devices 52, 54, and 56. Some of the computing devices 52, 54, 56 may be implemented as automation devices and / or adapted to monitor, control, regulate, and / or execute physical processes. The second data processing device 200 and the computing devices 52, 54, 56 can be connected to each other via a data connection and / or be adapted to establish such a data connection via another network interface 250 and / or via the corresponding network interfaces of the computing devices 52, 54, 56, so that in some advantageous modifications, they can be connected via the automation network 50 and / or realize the automation network 50, wherein the second data processing device 200 is adapted to serve as a data gateway for the computing devices 52, 54, 56 and receives data from the computing devices via its network interface 250 and forwards it to the first data processing device 100 via its network interface 210 and / or receives data from the first data processing device 100 via the network interface 210 and forwards it to the computing devices 52, 54, 56 via its another network interface 250.

[0104] According to some advantageous modifications, the first and / or second data processing apparatus 100, 200 may be adapted to establish a data connection between each other by means of their network interfaces 120, 210. In some advantageous implementations, the first and second data processing apparatus 100, 200 may be connected to each other via a data exchange network 40, i.e. the data connection between them uses the data exchange network 40 and / or the first and second data processing apparatus 100, 200 together with further devices (in particular network devices) may form the data exchange network 40. As an alternative to forming the data exchange network 40 or as an additional implementation, the data exchange network 40 may be implemented by means of the Internet 42 or as part of the Internet 42, which is not part of the system 1.

[0105] According to some advantageous modifications, the server 30 for component images can be adapted to establish a data connection to the first data processing device 100 by means of a network interface 43, and in particular via the Internet 42. Correspondingly, in some advantageous modifications, the first data processing device 100 can be adapted to establish a data connection with the server 30 by means of a network interface 120, and in particular via the Internet 42.

[0106] Figure 4 A flow chart showing a method 300 for proving the security of a first data processing device, the method 300 according to an embodiment of the present invention.

[0107] In the exemplary embodiment, the method 300 includes method steps 320, 322 and 324. The method 300 starts at method start 302 and ends at method end 304. In addition, one or more of the method steps, in particular a sequence of method steps or the entire method may be repeatedly performed. In addition, the first data processing device is according to an embodiment of the present disclosure, and in particular may be according to the reference Figure 1 An exemplary embodiment of a first data processing apparatus 100 is given.

[0108] At step 320, by means of a validation component of the first data processing apparatus, validation data are established, wherein the validation data indicates a current platform configuration of one or more platform configurations according to which the first data processing apparatus is adapted to operate. According to some advantageous modifications, the validation component can be implemented as a validation processor 110 of the first data processing apparatus 100.

[0109] At step 322, integrity data is provided to the second data processing device. The integrity data comprises at least verification data established by means of the verification component. According to some advantageous modifications, the second data processing device is according to an embodiment of the present invention, and in particular can be according to reference Figure 2 An exemplary embodiment of a second data processing apparatus 200 is given.

[0110] At step 324, verification data is provided to the second data processing apparatus, wherein the verification data facilitates a validity check on the integrity data.

[0111] Figure 5 4 shows a flow chart of a method 400 for checking the security of a first data processing device, the method 400 being according to an embodiment of the present invention.

[0112] According to an exemplary embodiment, method 400 comprises method steps 420, 422, 424 and 426. In some advantageous modifications, method 400 further comprises method step 428 and method condition 410. Method 400 starts at method start 402 and ends at method end 404. In addition, one or more of the method steps, in particular a sequence of method steps and preferably the entire method may be repeatedly performed. In addition, the data processing device is according to an embodiment of the present disclosure and may in particular be according to reference 404. Figure 1 In addition, the method 400 can be performed by means of a second data processing device adapted to perform the method 400, and the second data processing device is in particular according to an embodiment of the present disclosure, and more particularly can be according to the reference Figure 2 An exemplary embodiment of method 200 is presented.

[0113] At step 420, integrity data is received from a first data processing device.

[0114] At step 422, verification data is received from the first data processing device.

[0115] At step 424, a security check of the first data processing device is performed. The security check comprises at least method step 426. Figure 5 In some advantageous modifications of the depiction, the safety check may also include method condition 410 and / or method step 428 .

[0116] At method step 426 , a validity check of the integrity data is performed based on the verification data.

[0117] At an optional but advantageous step 428, the verification data is verified based on the second digital signature, with which the verification data has been signed. This step may be performed dependent on the result of step 426, such that when the validity check of step 426 yields a positive result (i.e., the integrity data is valid) according to condition 410 (by Figure 5 ), execute step 428; and when step 426 produces a negative result (indicated by Figure 5 ), step 428 is not executed.

[0118] According to some advantageous modifications, additional method steps can be performed as a function of the security check and thus in particular as a function of whether the integrity data are valid and / or whether the verification data have a valid second digital signature.

Claims

1. A first data processing device adapted to operate according to one or more platform configurations, wherein: The first data processing device comprises: a validation processor adapted to establish validation data indicating a current platform configuration of the one or more platform configurations; Network interfaces; and a data storage device for storing verification data, the verification data facilitating a validity check of the integrity data by the second data processing apparatus, wherein the integrity data comprises the confirmation data; and Wherein, the first data processing device is further adapted to: retrieving authentication data from the data storage device, wherein the authentication data comprises information about at least one predefined valid platform configuration according to which the first data processing apparatus is configured to operate securely; and Running at least one software component, wherein the at least one software component is selected from the group consisting of: an application which provides stored and / or calculated application data to the second data processing device and / or which requests application data from the second data processing device, - Hypervisor, - Virtual machines, - operating system, and / or -Dataspace runtime environment; providing the integrity data and the verification data to a second data processing device via a network interface so as to perform a validity check on the integrity data based on the verification data by determining whether confirmation data of the integrity data matches at least one predefined valid platform configuration of the verification data, wherein the integrity data and the verification data are specific to the at least one software component, and wherein the at least one software component and the verification data specific to the at least one software component are bundled into a bundled component image, - receiving the bundled component image from a server for component images; - storing the bundled component images on a data storage device; and - retrieving the software component in the bundled component image from the data storage device to run the at least one software component.

2. The first data processing device according to claim 1, wherein: The bundled component image is digitally signed by a first digital signature, and wherein the first data processing apparatus is adapted to: - verifying the bundled component image based on the first digital signature, and - Selectively running software components in the bundled component image depending on verification of the bundled component image.

3. The first data processing device according to claim 1 , wherein the first data processing device is further adapted to provide at least one of integrity data and verification data specific to the at least one software component by running the integrity module and / or the validity module of the at least one software component, and in: The integrity module is adapted to establish specific integrity data by means of the certification processor; and / or The validity module is adapted to establish specific authentication data by selecting and retrieving the specific authentication data from the data storage device.

4. The first data processing device according to claim 1, wherein: The verification processor includes at least one of the group consisting of: -Trusted Platform Module; - a cryptographic processor adapted to determine a current platform configuration and to generate attestation data based on the current platform configuration; - a processor adapted to execute a firmware or software module of the first data processing means adapted to determine information indicative of a current platform configuration and to generate confirmation data based on the information; and / or - a data interface adapted to receive attestation data from a hardware security module, wherein the hardware security module is adapted to detect information indicative of a current platform configuration and to generate the attestation data based on the information.

5. A system comprising a first data processing device according to any one of claims 1 to 4 and a second data processing device, the second data processing device comprising a network interface and being adapted to: - receiving said integrity data from a first data processing device via a network interface; - receiving said verification data from the first data processing device via a network interface; as well as - performing a security check on the first data processing device, wherein the security check comprises at least a validity check on the integrity data based on the verification data.

6. The system according to claim 5, in, The first data processing apparatus is adapted to provide application data to the second data processing apparatus via the network interface, the application data being stored on a data storage device of the first data processing apparatus or on another data storage device, or being computed by executing at least one software component; as well as Therein, the second data processing device is adapted to selectively receive and / or process the application data from the first data processing device depending on the security check.

7. The system according to claim 5 or 6, in, The first data processing device is adapted to receive application data from the second data processing device via the network interface; wherein the second data processing apparatus comprises a data storage device for application data and / or is adapted to run one or more applications providing stored and / or calculated application data; and Therein, the second data processing device is further adapted and / or wherein the application is adapted to selectively provide the application data to the first data processing device depending on the security check.

8. A system according to any one of claims 5 to 6, wherein: The integrity data includes measurement data based on how the current platform configuration is measured in order to establish the attestation data; and Wherein the second data processing means is adapted to perform an integrity check by determining whether the confirmation data matches the measurement data, wherein the security check comprises the integrity check such that the security check is dependent on both the validity check and the integrity check.

9. The system according to any one of claims 5 to 6, in, digitally signing the verification data with a second digital signature; and in: The first data processing device is adapted to: - verifying the authentication data based on the second digital signature, and - selectively providing integrity data and / or authentication data and / or application data and / or requesting application data, or a combination thereof, depending on verification of the authentication data; and / or the second data processing device is adapted to: - verifying the verification data based on the second digital signature, wherein the security check includes and depends on the verification of the verification data.

10. The system according to any one of claims 5 to 6, in, The certification processor of the first data processing apparatus is adapted to digitally sign the integrity data by a third digital signature; and The first data processing device is adapted to: - verifying the integrity data based on a third digital signature, and - selectively providing integrity data and / or authentication data and / or application data and / or requesting application data, or a combination thereof, depending on verification of the integrity data; and / or the second data processing device is adapted to: The integrity data is verified based on the third digital signature, wherein the security check includes and depends on the verification of the integrity data.

11. A system according to any one of claims 5 to 6, Includes servers for component imaging.

12. A method for proving the security of a first data processing device, the method comprising: - receiving a bundled component image from a server for component images, wherein at least one software component and verification data specific to the at least one software component are bundled into the bundled component image, wherein the verification data comprises information about at least one predefined valid platform configuration according to which the first data processing device is configured to operate securely; - storing the bundled component image on a data storage device of the first data processing apparatus; and - retrieving the software components in the bundled component image from the data storage device to run the at least one software component; - establishing, by means of the authentication means of the first data processing apparatus, authentication data, the authentication data being indicative of a current platform configuration of one or more platform configurations according to which the first data processing apparatus is adapted to operate; - providing integrity data to the second data processing device, the integrity data comprising at least the verification data; and - providing verification data to the second data processing device, wherein the verification data facilitates a validity check of the integrity data by determining whether confirmation data of the integrity data matches at least one predefined valid platform configuration of the verification data.

Images