Method and apparatus for identifying harmful services in a network

Abstract

The invention relates to a computer-aided method and a computer system with an implementation environment for at least one service (CApp, PApp) of a consumer and / or provider, thus integrated as an authenticated participant in a distributed service network, so that the computer system is able to communicate with at least one other computer system and is able to access at least one memory unit with a contract library (CR) in which contracts (C) with a comparative interaction pattern are provided, wherein the computer system has at least one data connection to an observer (O) which is designed to record observation data of the interaction pattern during the communication (req, res) with the other computer system, wherein the computer system has at least one direct data connection to an interface (cl) and / or an indirect data connection to the interface (cl) via the observer (O) and has a direct data connection to a gate (G) via a forwarder (F) of the gate (G) and an indirect data connection to the gate (G) via the observer (O) and a matcher (M) or via the observer (O), the matcher (M) and the interface (cl), wherein the matcher (M) is designed to request keys (key) required for the comparison from an authenticated authority (CA), so as to access signed and / or cryptographically protected contracts (C) in the contract library (CR) and to select from them a contract (C) which matches the observed interaction pattern of the communication (req, res).

Description

Technical Field

[0001] This invention relates to a computer-aided method for identifying non-compliant services in a distributed service network, a suitable computer system, and a network. Background Technology

[0002] Increasingly, tasks are being performed by distributed service networks. Examples of such networks are the so-called Internet of Things (IoT) environments. These networks perform a wide variety of tasks: storing and processing user data (e.g., Google Analytics), storing and processing health data (e.g., HIS, RIS, PACS), controlling (public) infrastructure (e.g., urban traffic control, energy distribution), protecting passenger health (e.g., flight safety, train safety), controlling industrial equipment (e.g., discrete manufacturing, process technology), and controlling energy-generating equipment (e.g., conventional power plants, nuclear power plants, hybrid power plants).

[0003] Each participant in such a network can provide one or more services and use services provided by other participants. Participants can be, for example, computer systems, components of computer systems, software or software components in the sense of services.

[0004] Typically, these networks are distributed, meaning participants can be located anywhere. Communication between participants usually takes place via physical or digital communication paths. Many of these networks are open, meaning new services or participants can join at any time. Furthermore, some of these networks are decentralized, meaning there is no centralized management of services or participants. So-called malicious (behavioral) services, or harmful services, can be introduced into such networks relatively easily. These harmful services are intruders and may appear in various forms, such as by using worms, Trojans, or human intervention to modify the service's software, thereby making the service itself an intruder. Alternatively, intruders may simply join the network as a service by exploiting its openness. Additionally, untrusted services may already be installed at the time the network is formed.

[0005] Intruders do not necessarily impair the functionality of a service or the entire network through their actions, but typically primarily degrade quality, causing changes to go unnoticed or only become apparent with a delay. The fundamental quality of a network lies, for example, in its (information) security, integrity, safety, and availability; in its reliability and usability. If a network no longer meets or no longer meets its tasks in a suitable manner and with appropriate quality, users of that network will suffer direct harm, such as time loss due to service unavailability, data loss due to unsaved data lost when the service crashes, and third-party access to sensitive personal data (such as passwords or medical data). For example, if security mechanisms are disabled or sensitive system settings are altered, it could lead to injury or even death. Therefore, network operators may suffer direct harm due to penalties, increased costs, reputational damage, and / or sanctions. Manufacturers of networks and / or network components will therefore suffer indirect harm, for example, through recourse claims, such as costs for repairs, reputational damage, loss of customers and / or market share, and / or sanctions.

[0006] To date, access to a network has been denied to malicious services through access rules such as certificates, authentication, and authorization. Common approaches for this include using cryptography, symmetric authentication with and without cryptography, cryptographic methods, or, for example, IP / MAC whitelists. These methods require high administrative overhead and significant computational time during operation (i.e., at each communication). Furthermore, there is a risk that secrets (privacy) can be compromised, allowing unauthorized services to gain access. Once an intruder obtains access data, they can access all services on the network. Summary of the Invention

[0007] Therefore, the technical problem to be solved by the present invention is to provide improved technical means or improved technical methods that can block harmful services from the network.

[0008] The aforementioned technical problems are solved by the method and apparatus according to the invention. Advantageous designs of the invention are given in the specification.

[0009] The computer-aided method according to the present invention includes identifying unqualified services in a distributed service network, including negotiating a comparative interaction pattern between at least two services in a contract, observing the interaction pattern during communication between the services, and comparing the observed interaction pattern with the comparative interaction pattern.

[0010] Therefore, non-compliant behavior of malicious services can be identified by comparing expected and actually observed interaction patterns. Thus, to identify intruders or so-called malicious services, the additional mechanisms for authentication and authorization, along with all their drawbacks, are no longer needed.

[0011] In conjunction with this patent application, a distributed service network is understood as a net, network, or general communication system in which at least two participants, services, or communication partners cooperate or communicate. The service is implemented via software. The service is a computer-aided method. The service can run on multiple participants. Multiple services can also be implemented on a single participant. In conjunction with this patent application, an interaction pattern is understood as a measurable characteristic of the interaction, cooperation, or general communication between two participants, services, or communication partners in the network. In conjunction with this patent application, a contract can be understood as a contract, agreement, comparison template, contract specification, etc. The contract library can be designed centrally or distributedly. As an alternative to contract specifications, any document in which negotiated and / or observed interaction patterns are reliably and generally recorded can be used. The comparison of observed interaction patterns with contracts can also be performed stepwise, for example, first comparing requests, then comparing responses.

[0012] In connection with this patent application, "qualified" means "to act in accordance with the contract".

[0013] In a particularly advantageous variant of the computer-aided method according to the invention, the comparison interaction mode is derived from tests required during the development period.

[0014] In conjunction with this patent application, development time is the time from the start of initial work on the service to its completion. It is assumed here that there is no overlap between development time and runtime. Runtime begins at the point in time when the service is first used on the network.

[0015] This has the advantage of very low management overhead because services do not need to be managed separately. Contract specifications similarly arise as a byproduct of development. Contracts between two services can be negotiated separately. However, contracts between two services can be generated very efficiently and automatically during the development of the service software in a favorable manner. For example, contracts can be generated through contract testing. Completed contracts are preferably encrypted and stored in a contract repository after network development is completed. This has a further advantage that the introduction of new contracts can be done, either through or via a unified mechanism.

[0016] In another advantageous variation of the computer-aided method according to the invention, services identified as unqualified are reported to the administrator and / or services identified as unqualified are excluded from the distributed service network.

[0017] In another advantageous variation of the computer-aided method according to the invention, a service observes its communication with another service. Communication is understood here as requests (so-called Requests) and responses (Responses). Observation itself is performed by an observer. The observer is, in particular, located upstream of the service. Observation is initiated through the service's communication. The observer software component is, in particular, part of a verification subsystem.

[0018] In another advantageous variation of the computer-aided method according to the invention, the method includes comparing observed communications from another service with a contract.

[0019] If no contract matching the observed communication is found through syntactic comparison, then the other service must exhibit a certain behavior; thus, the other service can be reliably identified as an intruder. If at least one matching contract is found, it means that the other service behaves in accordance with the contract in the observed communication; this does not prove whether the other service is an intruder or not. The only certainty is that the service happens to be in accordance with the contract in every compared communication and therefore behaves syntactically correctly.

[0020] In another advantageous variation of the computer-aided method according to the invention, in order to add an additional service to an existing distributed service network, the contract associated with said additional service is signed and / or cryptographically protected, and the contract is made accessible to all authentication subsystems of the network. The service manufacturer or operator is particularly responsible for the signing.

[0021] Therefore, before adding new services to the network, contracts are first generated according to the above process, followed by encryption and distribution.

[0022] In conjunction with this patent application, the verification subsystem is understood as a whole of software components, namely, observers, matchers, gates, contract libraries, and encoders. Related methodological steps are then combined accordingly during the verification phase.

[0023] Signatures and / or cryptographic protection, such as using a private key, can be employed. Alternatively, any security method that can guarantee the authenticity and integrity of the contract can be used.

[0024] In addition, the integrity of the contract library must always be ensured.

[0025] Therefore, privacy (Secret) is stored, for example, in a secure development environment and is not available in an open runtime environment.

[0026] The method according to the invention also has the advantage of being able to identify harmful services in unprotected networks (e.g., free-to-join environments).

[0027] According to the present invention, a computer system is provided, wherein the computer system has an implementation environment for at least one service for consumers and / or providers, and is thus integrated as an authorized participant in a distributed service network, such that the computer system can communicate with at least one other computer system and can access at least one memory unit having a contract library in which contracts with comparison interaction patterns are provided, wherein the computer system has at least one data connection with an observer designed to record observation data of the interaction patterns during communication with other computer systems, wherein the computer system has at least one direct data connection with an interface and / or an indirect data connection with the interface through the observer, and has a direct data connection with a gate through a gate repeater and an indirect data connection with a gate through an observer and a matcher or through an observer, a matcher and an interface, wherein the matcher is designed to request a key required for comparison from an authorized authority, thereby accessing signed and / or cryptographically protected contracts in the contract library and selecting contracts that match the observed interaction patterns of the communication.

[0028] Doors include, for example, the automatic extension tool Escalater, which is designed to generate warning notifications and / or exclude harmful services.

[0029] Therefore, computer systems, especially network participants, are considered. A matcher is understood as a software component, such as a comparison function, that makes comparisons, particularly of interaction patterns. Gates, request gates, or response gates represent software components that make decisions based on pre-defined criteria. Contract libraries can be designed centrally or decentralized. Crucially, each participant and / or service must have access to the contract library.

[0030] In one embodiment of the invention, a computer system is provided as described above, wherein components, namely observers, matchers, gates, contract libraries, and encoders, are implemented in a verification subsystem between at least one service and interface, the verification subsystem having the same application programming interface as the interface.

[0031] Each interface requires only one authentication subsystem. The authentication subsystem can be formed as a layer or contained within a layer. This can be provided on the provider service side or the consumer service side. However, it is also possible that both services have authentication subsystems on their respective interface sides. This variation could, for example, have an authentication subsystem as described above between each network participant and the interface.

[0032] Alternatively, the verification subsystem components, namely the observer, matcher, gate, contract library, and encoder, can also be implemented in the software components of the corresponding service or participant (e.g., different computer systems in a network).

[0033] Therefore, this method is completely transparent to the application (App). It works for all applications from all sources. In solutions known in the prior art to date, applications must be specifically prepared, for example, through password verification, token verification, or certificate verification; applications without these cannot participate.

[0034] According to the present invention, a distributed network is provided, comprising at least one first certified participant or participant, consumer, and / or provider's first certified service, and further comprising at least one second certified participant and / or second certified service communicating with the first service, and having at least one memory unit having a contract library providing contract specifications with comparison interaction patterns. Furthermore, the network has at least one data connection between the first service and an observer, the observer being designed to record observation data of interaction patterns during communication with the second service. The network also has at least one direct data connection between the first service and an interface and / or an indirect data connection between the first service and the interface through an observer, and has a direct data connection between the first service and a gate through a gate repeater and an indirect data connection between the first service and a gate through an observer and a matcher or through an observer, a matcher, and an interface, wherein the matcher is designed to request a key required for comparison from an certified authority, thereby accessing signed and / or cryptographically protected contracts in the contract library and selecting contracts that match the observed interaction patterns of the communication.

[0035] For example, the described distributed network is open to the addition of new participants and / or services.

[0036] Distributed networks are designed in a decentralized manner, particularly according to one of the above descriptions.

[0037] The computer program product according to the invention can be directly loaded into the memory of the programmable computing unit of the aforementioned computer system and has program code means for implementing the method according to the invention when the computer program product is implemented in the computing unit of the computer system. The computer program product may be a computer program or may include a computer program. Thus, the method according to the invention can be implemented quickly, reproducibly, and robustly. The computer program product is configured such that it can implement the method steps according to the invention by means of a computing unit. The computing unit must have prerequisites such as a corresponding main memory, a corresponding graphics card, or a corresponding logic unit to efficiently implement the corresponding method steps. The computer program product is stored, for example, on a computer-readable medium or on a network or server, from which it can be loaded into the processor of a local computing unit, which may be directly connected to or formed as part of the computer system. Furthermore, the control information of the computer program product can be stored on an electronically readable data carrier. The control information of the electronically readable data carrier can be designed such that when the data carrier is used in the computing unit of the computer system, the control information implements the method according to the invention. Therefore, the computer program product can also represent an electronically readable data carrier. Examples of electronically readable data carriers are DVDs, magnetic tapes, hard disks, or USB sticks, on which electronically readable control information, particularly software (see above), is stored. When this control information (software) is read from the data carrier and stored in the control device and / or computing unit of a computer system, all embodiments of the methods described above according to the invention can be performed. Therefore, the invention can also be derived from the computer-readable medium and / or the electronically readable data carrier.

[0038] Furthermore, protection is claimed for a provisioning device for storing and / or providing computer program products. The provisioning device is, for example, a data carrier for storing and / or providing computer program products. Alternatively and / or additionally, the provisioning device is, for example, a network service, a computer system, a server system, especially a distributed computer system, a cloud-based calculator system, and / or a virtual calculator system, which preferably stores and / or provides computer program products in the form of a data stream.

[0039] The provision is, for example, as a complete computer program product, in the form of program data blocks and / or instruction data blocks, preferably as a file (especially as a download file) or as a data stream (especially as a download data stream). However, the provision can also be, for example, as a partial download consisting of multiple parts and especially through a peer-to-peer network or as a data stream. For example, a provisioning device in the form of a data carrier can be used to read such a computer program product into a system and execute program instructions, thereby implementing the method according to the invention on a computer, or a creation device can be configured to create a security module and / or configure devices and / or components and / or authentication systems.

[0040] This invention offers significant advantages in combining cloud-to-edge and IoT applications: communication protection does not create a memory footprint on edge devices and can be applied in systems with hundreds or thousands of edge devices. There is no management overhead. Furthermore, it increases acceptance of digital pricing (Angebot) because there is no additional overhead on the customer side for protecting a network open to the internet, and the network remains protected despite its openness.

[0041] Legal definition:

[0042] Computer-aided design, computer systems, etc.

[0043] Unless otherwise stated in the following description, the terms “execute,” “calculate,” “provide,” “calculator-aided,” “computer-aided,” “obtain,” “determine,” “generate,” “configure,” “reconstruct,” and similar terms preferably refer to operations and / or processes and / or steps of changing and / or generating data or data packets and / or converting data into other data, wherein the data is in particular represented or presented as physical quantities, such as electrical pulses.

[0044] The term "computer system" should be interpreted as broadly as possible to encompass all electronic devices with data processing capabilities. A computer system can be called a computer, calculator, or calculator system. Therefore, a computer system can include, for example, personal computers, servers, handheld computer systems, pocket personal computer devices, mobile wireless devices and other communication devices capable of calculator-assisted data processing, processors, and other electronic devices for data processing. Thus, a computer system can also be, for example, a cluster, a virtual computer (e.g., a cloud), a general-purpose data processing system or general-purpose data processing module, even a mini-board calculator or embedded system (so-called embedded system or device), as well as edge devices or control devices with software implementation environments.

[0045] In connection with this patent application, "computer-aided" is understood, for example, as the implementation of the method, in which, in particular, a processor performs at least one method step of the method.

[0046] Components:

[0047] In conjunction with this invention, a component is understood, for example, as a part of a device, a software component or a hardware component, particularly a BIOS controller of a motherboard, a sensor, a data storage device, or a network interface card (NIC). In conjunction with the description, a component may also be understood, for example, as a device of a system, such as a generator, a field device, or a control device. Components particularly relate to spatially separated components, such as a network interface card, a BIOS controller of a motherboard, or the main memory of a computer.

[0048] Equipment or system:

[0049] (Technical) equipment, such as the equipment or units in Fabrik (Fabric) 82-86, can be understood as measuring equipment for high-frequency technology, measuring devices, receiving equipment for satellite communication stations, and field equipment for power plants.

[0050] (Technical) systems, such as computer system 100, data storage 12, and implementation environment 14, can also be understood, in particular, as embedded systems. One or more parts of a device or system (e.g., computer system 100) may also include, for example, processors and / or memory units. One or more parts of a device or system may also involve a processor. (Technical) devices or (technical) systems can also be understood, for example, as ICs (integrated circuits), FPGAs (field-programmable gate arrays), ASICs (application-specific integrated circuits), or DSPs (digital signal processors).

[0051] Memory unit:

[0052] In conjunction with this invention, a memory unit can be understood, for example, as a memory or hard disk in the form of main memory (random-access memory, RAM).

[0053] (Network) participants and communication partners:

[0054] In connection with this patent application, network participants, participants in network communications, or communication partners are particularly understood as services, applications, software, or software components capable of communicating within a network. Network participants or participants in network communications can also be understood as computer systems, workstations, field devices or measuring devices, servers, or clients. Network participants or participants can, for example, use network communications to communicate with other network participants and, particularly, exchange data or data packets. For example, a first communication partner can authenticate itself to a second communication partner using a certificate.

[0055] Data connection:

[0056] In conjunction with this patent application, the connection type can be understood, for example, as a direct physical connection or a virtual network connection via a LAN (Local Area Network).

[0057] Network communication:

[0058] In conjunction with this patent application, network communication can be understood as communication between participants in a computer network. Network communication can be particularly understood as connection-oriented network communication, especially based on TCP / IP, or connectionless communication, especially based on UDP.

[0059] interface:

[0060] In conjunction with this patent application, the interface can be understood as an IoT communication layer or a network communication layer.

[0061] layer:

[0062] In conjunction with this patent application, one or more layers of network communication can be understood as layers based on the OSI model, TCP / IP model, or other communication models.

[0063] protocol:

[0064] Within the scope of this patent application, a protocol or communication protocol can be understood as a network protocol that can be used for communication between network participants. Examples of this are the TCP / IP protocol or the IPX / SPX protocol.

[0065] Data diodes:

[0066] Within the scope of this patent application, a data diode can be understood as a unidirectional security gateway or a unidirectional network or unidirectional network communication. A data diode, for example, can ensure that data is thus transmitted in only one direction. For instance, this might mean that data (packets) are sent, for example, from a sender to a specific network participant, but specifically, the data diode prevents data from being sent from the network participant back to the sender.

[0067] Data flow:

[0068] In conjunction with this patent application, a data stream can be understood, for example, as the transmission of information via multiple data elements. A data stream can be, for example, a video stream transmitted from a streaming media server to one or more streaming media clients via the UDP protocol. In this case, each UDP packet is specifically a data element according to the method of the invention. A data stream can typically be given by a series of data elements. For example, multiple or all data elements of the data stream may contain authentication and verification information associated with the respective data element, which is associated with authentication information of previously transmitted data elements and can be used to verify that authentication information. The message protection according to the invention can be applied, in particular, to all data elements of the data stream or a pre-given subset of the data elements of the data stream.

[0069] Data packets:

[0070] In conjunction with this patent application, data packets can be understood, for example, as Ethernet frames, token ring frames, IP packets, or TCP segments. Data packets may include valid data (payload), which is preferably encrypted.

[0071] Privacy, Keys:

[0072] In conjunction with this invention, "Secret" or "privacy" or "secret" (especially also referred to as "secret in string form" or "string") can be understood as, for example, license information, a cryptographic key, especially a symmetric key or asymmetric key pair's private key. In conjunction with this invention, a key can also be understood, for example, as a cipher used to access license information or a cipher used to access a cryptographic key. For example, keys can be generated according to additional security strategies, such as indicating the key length or the algorithm used to compute the key. In conjunction with this invention, the terms "reconstructed secret" and "reconstructed string" can be used synonymously.

[0073] Checksum / Check value:

[0074] Checksum calculation functions, checksum functions, or check value functions used to calculate checksums or check values ​​can be implemented using cryptographic functions, for example. Cryptographic functions can be, for example, one-way functions, particularly CRC16 (Cyclic Redundancy Check 16) or CRC32 (Cyclic Redundancy Check 32) functions. Checksum calculation can be performed, for example, using a processor and / or memory.

[0075] Strategy:

[0076] In conjunction with this patent application, a security strategy or policy can be understood, for example, as a security policy. A security policy may, for example, instruct whether network communication should occur in encrypted form and / or at which protocol levels of the network protocol used, and / or predefine a specific network protocol for the communication. A security policy may also, for example, predefine a specific sending address and / or a specific range of sending addresses and / or a receiving address and / or a range of receiving addresses.

[0077] application:

[0078] In connection with this patent application, "application" can be understood as an implementable document or a program library.

[0079] Implementation environment:

[0080] In conjunction with this patent application, "implementation environment" can be understood as a virtual machine, such as a Java Virtual Machine, a processor, or a runtime environment. The implementation environment can be implemented on a physical computing unit (processor, microcontroller, CPU, CPU core). Here, the application can be implemented on the same physical computing unit in both learning and implementation modes. For example, it is also possible that the application is implemented in a learning mode in a separate physical computing unit. Therefore, training can be performed, for example, in a specific training computing unit. Implementation in implementation mode is performed, for example, in a second computing unit, where validity information determined during training is used when implementation is performed in the implementation computing unit. For example, the validity information determined by the training computing unit is preferably provided in a tamper-proof manner.

[0081] Program instructions:

[0082] In conjunction with this patent application, program instructions can be understood as including program instructions that apply as a whole (preferably including the libraries used).

[0083] Program components:

[0084] In conjunction with this patent application, a program component can be understood as a software component having program instructions that implement the method according to the invention.

[0085] Signature function:

[0086] For example, signature calculation functions or signature functions for calculating digital signatures can be implemented using DAS (Digital Signature Algorithm) or ECDSA (Elliptic Curve Digital Signature Algorithm). The calculation of digital signatures can be performed, for example, using a processor and / or memory.

[0087] Consistency:

[0088] For example, if Contract A and Contract B are identical in content, then the two contracts should be considered "substantially identical." In conjunction with this patent application, insufficient consistency can be understood as, for example, the data bits of encrypted data in a network communication data packet not satisfying statistical properties, particularly expected or pre-given statistical properties, in statistical analysis. These statistical properties can be pre-given, for example, by the encryption algorithm required by the security strategy of the network communication. This may mean that the data bits of the valid data in the data packet should, for example, have a random statistical distribution to confirm that the data bits are encrypted. Conversely, if the data bits have a non-random statistical distribution, then the data bits are particularly insufficiently consistent with the pre-given statistical properties. However, insufficient consistency can also be understood as one or more requirements of the security strategy of the network communication not being met.

[0089] Implementation path:

[0090] In conjunction with this patent application, an implementation path can be understood as a sub-region of an application, comprising multiple program instructions that are executed directly and sequentially, and which is particularly associated with a specific functionality of the application. An implementation path can also be a sub-region implemented based on conditions, such as If-Else conditions.

[0091] random bits

[0092] In conjunction with this patent application, a random bit, a random bit sequence, or a pseudo-random permutation can be understood as a bit sequence that is randomly or pseudo-randomly distributed.

[0093] On-the-fly:

[0094] In conjunction with this patent application, the term "immediate effect" can be understood, for example, as the direct analysis of data packets within a network component during processing. The network component could be, for example, a switch that directs data packets to a port to which the packet receiver is connected. Preferably, no additional latency is added during data packet transmission.

[0095] real time:

[0096] In conjunction with this patent application, real-time can be understood as reliably performing analysis and / or provisioning within a predetermined time period, such as within a fixed time grating. For network communications, this might mean that analysis and / or provisioning occurs during a time period before data packets are transmitted to their destination, or even when the duration of data packet transmission does not increase significantly.

[0097] No validity information found.

[0098] In conjunction with this patent application, the term "no validity information" can be understood as program instructions and / or subroutines / functions and / or libraries not being associated with validity information. For example, if each program instruction is associated with a specific storage area where validity information can be stored, then for a program instruction without validity information, that storage area may, for example, be occupied by zero or another value indicating that no validity information is available for that program instruction. The term "no validity information" can also be understood as program instructions being associated with invalid information. Attached Figure Description

[0099] Also refer to the attached diagram. Figures 1 to 5 Examples and embodiments of the present invention are described in an exemplary manner. Detailed Implementation

[0100] Figure 1 This shows new participants joining the network.

[0101] For example, if a service (application, App) is added to an existing network, such as an IoT network (Internet of Things), the service's manufacturer (vendor, V) must use its private key (priv) to sign all contracts (C) and then send them to all verification subsystems (Ver) of the network participants, i.e., the so-called trusted infrastructure, or make the trusted infrastructure accessible to the contracts. The necessary public keys (pub1 + pub2) are requested (req) from a certified authority (CA).

[0102] Participants are, for example, computer systems that exchange data with other participants via a network. A service is a computer-aided method. The service can run on multiple participants, or multiple services can be implemented on a single participant. In conjunction with this patent application, computer systems and services can be understood as network participants.

[0103] Figure 2The consumer-side verification is shown.

[0104] Network participants include, for example, consumers (con) and providers (pro). A consumer (con) seeks to protect itself by identifying harmful provider services (PApp) within the network. In the first step (2.1), the consumer's service (CApp) sends a request (req) to an observer (O). As a second step (2.2), the observer (O) passes the request (req) to an interface (cl). Simultaneously, the request (req) is sent (2.3) to a matcher (m). This represents a core component of the system. The matcher (m) also stores the request (req) for further comparisons (checks, see steps 2.7, 2.8, and 2.9). Furthermore, the request (req) is sent (2.4) from the interface, i.e., the network communication layer (cl), to the provider (pro), and the provider (pro) returns a response (res) (2.5) to the interface (cl). Then, the response (res) is passed from the interface (cl) (2.6) to the observer (O). The observer (O) then passes the response (res) (2.7) to the matcher (m). The matcher (m) requests (req, step 8) all the necessary public keys (pub) from the Authenticated Authority (CA). The public keys (pub) are required to access (2.9) the contracts (C) stored in cryptographic mode in the Contract Repository (CR). The matcher (M) selects the contracts (C) that match the request (req) and the response (res). In step 2.10, the response (res) and the selected contracts (C) (if a matching contract is found) are passed (2.10) to the response gate. If at least one matching contract (C) is found, the response (res) is sent to the forwarder (F), which passes the response (2.12a) to the consumer service (CApp). If no matching contract (C) is found, this is a sign of a harmful provider service (PApp). The response (res) is then sent (2.11b) to the Escalator (E), which, for example, generates a warning notification (2.12b) or silently excludes the harmful service from future communications.

[0105] The software components, namely observers (O), matchers (M), gates (G) (which may include request gates and / or response gates), contract libraries (CR), and encoders (E), are interconnected to form a verification subsystem. Relevant methodological steps are then combined accordingly during the verification phase or verification service.

[0106] Figure 3 The provider-side verification is shown.

[0107] Similarly, harmful consumer services (CApps) can be identified. First, the interface (cl) receives a request (req, 1) from the consumer service (CApp). Then, the request (req) is passed (3.2) to the observer (O). The observer (O) passes the request (req) (3.3) to the matcher (M). The matcher (M) requests (3.4) all the necessary public keys (pub) from the certified authority (CA). The matcher (M) then selects a contract (C) from the contract repository (CR) that matches the request (req), requiring the public key (pub) to decrypt the contract (C) stored in the contract repository (CR) (3.5). The request (req) and the selected contract (C) (if a matching contract is found) are sent (3.6) to the request gate. If no matching contract (C) is found, this is a sign of a harmful consumer service (CApp). The request (req) is then sent (3.7b) to the Escalator (E), which generates a warning notification (3.8b) or silently excludes the harmful service from future communications. If at least one matching contract (C) is found, the request (req) is sent (3.7a) to the forwarder (F), which forwards the request (3.8a) to the provider service (PApp). When the provider service (PApp) receives the request (req) from the forwarder (F), it sends its response (res) (3.9) to the interface (cl), which forwards the response (res) (3.10) to the consumer service (CApp).

[0108] Figure 4 The secure distribution and storage of the contract are shown.

[0109] The contract (C) between the provider (pro) and the consumer (con) can be negotiated separately, but it can also be generated very efficiently and automatically during the development time (t_b) of the service software, for example, through contract testing. The completed contract (C) is encrypted and stored in the contract repository (CR) after the network development is completed.

[0110] This results in low management overhead because new contracts are introduced through a unified mechanism, as described below. There is no need to manage services separately.

[0111] exist Figure 4 The left side of the image shows the different processes and measures during the development time (t_b), while the right side of the image shows the storage of contracts (C) in the contract library (CR).

[0112] During the development period (t_b), the manufacturer (V) of the consumer service (CApp) initiates contract testing (T): the provider service (PApp) should be able to respond to every possible request (req, 4.1). To this end, the manufacturer (V) defines the contract (C) and creates contract validation on the consumer side. The manufacturer (V) can also be, for example, a third-party manufacturer or an external supplier of the network infrastructure.

[0113] Next, contract testing (T) is performed. In contract testing, each request (req) is sent (4.2) to the responsible provider service (PApp), and the contract (C) is tested on the provider side. The result of each contract verification is sent (4.3) back to the manufacturer (V) of the consumer service (CApp) through the provider (pro). Then, it is verified whether the contract test (T) was successful on the consumer (con) side and whether the contract tests on all provider sides were successful, and the corresponding results are added (4.4a and 4.4b) to the contract (C).

[0114] If all tests (T) succeed, the contract (C) initially created by the consumer is passed (4.5) to the encoder. The encoder encrypts and signs the contract (C) using the private key (priv) of the consumer service (CApp) manufacturer (V). The corresponding public keys (pub, 4.6) are stored in an Authorized Authority (CA). The contract (C) created in this way is then stored (4.7) in all contract repositories (CR) across the network.

[0115] Figure 5 The new manufacturer's security features have been demonstrated.

[0116] The network operator (N) verifies (5.1) the trustworthiness of the new manufacturer (V). To this end, the manufacturer (V) generates a key pair consisting of a private key (priv) and a public key (pub). The private key (priv) is stored internally by the manufacturer (V). The public key (pub) is sent (5.2) to the network operator (N). Once the manufacturer (V) has successfully verified the information in step 5.1, the network operator (N) forwards the public key (pub) to a certified authority (CA).

[0117] List of reference numerals

[0118] consumer

[0119] pro Provider

[0120] PApp Provider Services

[0121] CApp consumer services

[0122] req request

[0123] O Observer / Observation

[0124] CL Interface (Interface), IoT Communication Layer / Network Communication Layer

[0125] M Matcher / Comparison, Comparison Function

[0126] ch comparison (checks)

[0127] res response

[0128] key

[0129] pub public key

[0130] private key

[0131] CA Accredited Organization

[0132] Contract C

[0133] CR Contract Repository

[0134] Response-Gate / Request-Gate / Logic Gate

[0135] F-transponder

[0136] E-automatic expansion tool Escalator

[0137] t_b development time (build time)

[0138] t_r runtime

[0139] N-networks, such as IoT

[0140] Verification Subsystem

Claims

1. A computer-aided method comprising identifying or recognizing unqualified services in a distributed service network, including negotiating a comparison interaction pattern between at least two services in a contract (C), observing (O) the interaction pattern during communication of said services, and comparing (M) the observed interaction pattern with the comparison interaction pattern, wherein, The key required for comparison (M) is stored in a secure development-time environment and is not available in the open runtime environment. The contract includes at least one of the following: contract, agreement, comparison template, and contract specification. The comparison interaction mode is taken from the tests (T) required during the development time (t_b).

2. The computer-aided method according to claim 1, comprising reporting services identified as non-compliant (2.12b, 3.8b) to an administrator and / or excluding services identified as non-compliant from the distributed service network.

3. The computer-aided method according to claim 1 or 2, wherein, First Service Observation (O): Communication maintained between the first service and the second service.

4. The computer-aided method of claim 3, comprising comparing observed communications from a second service with a contract (C) or contract specification (M).

5. The computer-aided method according to claim 1 or 2, wherein, In order to add another service to the existing distributed service network, the contract (C) associated with the other service is signed and / or cryptographically protected and the contract is made accessible to all authentication subsystems of the network.

6. The computer-aided method according to claim 5, wherein, The signing and / or cryptographic protection are performed using a private key (priv).

7. A computer system having an implementation environment for at least one service for consumers and / or providers, and thus integrated as an authorized participant in a distributed service network, enabling the computer system to communicate with at least one other computer system and to access at least one memory unit having a contract library (CR) in which contracts (C) with comparative interaction modes are provided, wherein, The computer system has at least one data connection with an observer (O), the observer being designed to record observation data of interaction patterns during communication with the other computer system, wherein the computer system has at least one direct data connection with an interface (cl) and / or an indirect data connection with the interface (cl) through the observer (O), the computer system has a direct data connection with a gate (G) through a repeater (F) of the gate (G), and the computer system has an indirect data connection with the gate (G) through the observer (O) and a matcher (M). According to the connection or having an indirect data connection with the gate (G) through the observer (O), the matcher (M) and the interface (cl), wherein the matcher (M) is designed to request the key required for comparison from an Authenticated Authority (CA), thereby accessing signed and / or cryptographically protected contracts (C) in the contract library (CR) and selecting the contract (C) that matches the interaction pattern of the observed communication, wherein the key required for comparison (M) is stored in a secure development-time environment and is not available in the open runtime environment.

8. The computer system according to claim 7, wherein, The components, namely the observer (O), matcher (M), gate (G), contract library (CR), and encoder (E), are implemented in a verification subsystem between the service and the interface (cl), wherein the verification subsystem has the same application programming interface as the interface (cl).

9. A distributed network comprising at least one first certified participant or a first certified service of a participant, said participant being a consumer and / or a provider; It includes at least one second certified participant and / or a second certified service, the second certified service communicating with the first service; The network includes at least one memory unit having a contract library (CR) providing contract specifications with comparative interaction modes. The network has at least one direct data connection between a first service and an observer (O), the observer being designed to record observation data of the interaction modes during communication with a second service. The network also has at least one direct data connection between the first service and an interface (cl) and / or an indirect data connection between the first service and the interface (cl) through the observer (O). Furthermore, the network has a direct data connection between the first service and a gate (G) through a repeater (F) of the gate (G). A service has an indirect data connection with the gate (G) via the observer (O) and the matcher (M) or has an indirect data connection with the gate (G) via the observer (O), the matcher (M) and the interface (cl), wherein the matcher (M) is designed to request a key required for comparison from an Authenticated Authority (CA), thereby accessing signed and / or cryptographically protected contracts (C) in the contract library (CR) and selecting from them contracts (C) that match the interaction pattern of the observed communication, wherein the key required for comparison (M) is stored in a secure development-time environment and is not available in an open runtime environment.

10. The distributed network of claim 9, wherein the distributed network is open to the addition of new participants and / or services.

11. The distributed network according to claim 9 or 10, wherein the distributed network is designed in a decentralized manner.

12. A computer program product capable of being directly loaded into the memory of a programmable computing unit of a computer system, and having program code means for implementing the method according to any one of claims 1 to 6 when the computer program product is implemented in the computing unit of the computer system.

13. An apparatus for providing a computer program product according to claim 12, wherein, The device provides storage and / or provides the computer program product.

Images