Method and computing environment for creating and applying a checking algorithm for a computing process

Abstract

The invention relates to a method for computer-aided creation of a checking algorithm for processing an application in a computing environment (RU) for executing a plurality of applications, taking into account configuration data (KD) for the application. For each application a data segment (DA) is formed and the configuration data (KD) relating to the associated application is incorporated into the data segment (DA). The data segments are incorporated in a data item (DS). The data item is assigned a global ID code. The participating components of the computing environment (RU) are identified and assigned an ID code. A hash function is applied to each data segment contained in the data item. A calculation function is applied to each data segment in such a way that the ID code, the hash value of the associated data segment and the global ID code are interrelated by means of calculation operators. Thereby, for each data segment a checking function is created which can be used for monitoring in the method for computer-aided processing of an application in a computing environment. The invention also relates to a security-relevant computing environment (RU), a computer program product and a device for providing the same.

Description

Technical Field

[0001] This invention relates to a method for creating a computer-aided inspection algorithm for processing applications in a computing environment having at least one host for the execution of multiple applications installed on said at least one host, taking into account configuration data for the applications. Furthermore, this invention relates to a method for computer-aided processing applications in a computing environment having at least one host, through the execution of multiple applications installed on said at least one host, taking into account configuration data for the applications. Additionally, this invention relates to a security-related computing environment having one or more hosts. Finally, this invention relates to a computer program product and a means of providing said computer program product, wherein said computer program product is equipped with program instructions for performing the method. Background Technology

[0002] Essentially, a safety-related system operating in a safety-related computing environment with computer assistance must ensure the use of correct software configured with the correct configuration data. Here, the use of other software, other configuration data, or devices different from the prescribed hardware components (host) is not permitted. Within the scope of this invention, "safety-related" is understood as related to the operational safety of the system (also referred to as Safety). For example, railway applications are safety-related systems within the scope of the above terminology.

[0003] To protect security-related computing environments, it is known that only components necessary for processing the relevant applications should be reliably installed on a computer. This further means that older versions of software must be completely removed from the computing environment after an update. This can be achieved, for example, if the available storage space does not allow for the parallel storage of two versions of the software. Therefore, the hardware must be precisely matched, at least in terms of storage capacity, to the software running in the computing environment.

[0004] A method and a computer are known according to patent document WO 2014 / 00924382, which have a checking algorithm for processing applications in a computing environment formed by a computer. The computer has redundantly executed applications installed, so the checking algorithm can detect errors by comparing computation results (generally referred to as voting). However, this checking only includes the computation results. For example, a hardware error can only be detected if a hardware fault affects the computation result, causing a different computation result. However, if a hardware problem causes the same error in parallel in parallel computations, this error will not be detected. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a method for computer-aided creation of a checking algorithm for processing applications in a computing environment (or computing environment system, computing environment device), and a method for processing applications in a computing environment, by which the error-free processing of applications can be checked as comprehensively as possible at a reasonable computing cost. Furthermore, the technical problem to be solved by this invention is to provide a security-related computing environment having one or more hosts, in which the error-free processing of applications can be checked as comprehensively as possible at a reasonable computing cost. Additionally, the technical problem to be solved by this invention is to provide a computer program product and a providing device for the computer program product, by which the above-described method can be executed.

[0006] The aforementioned technical problem is solved according to the present invention by the following method: For each application, data describing the application is combined (or merged, summarized) into data segments, and configuration data related to the relevant application is combined into data segments. Then, multiple application data segments and related configuration data (i.e., configuration data related to each determined application, respectively, are combined as data segments) into a data item. Steps are performed when creating the inspection algorithm to identify data items (multiple data items if necessary) and assign them global ID codes, and to identify the components of the computing environment involved in executing the application of the data item. Here, a host ID code is assigned to each host identified as a component, or the assigned host ID code is read, and a program ID code is assigned to the application identified as a component, or the assigned program ID code is read. A hash function is applied to each data segment contained in the data item to generate a hash value. A computation function is then created for each data segment by associating the host ID code of the participating host, the program ID code of the participating application, the hash value of the relevant data segment, and the global ID code through computation operators, and then the complementary code is calculated as the result of the computation function and stored. This creates a check function applicable to each data segment by associating the host ID of the participating host, the application ID of the participating application, the hash value of the relevant data segment, and the complementary code calculated relative to the data segment through computation operators, where a global ID code can be calculated as the result.

[0007] The assigned ID code must be explicit or unique to ensure reliable identification of the identified component, i.e., a hardware component (host, storage device) or a software component (program complex, program, subroutine, configuration data). This can be achieved, for example, by distributing a numeric code once, with the distribution monitored to prevent re-distribution. Program routines capable of this are well known. Another possibility is to distribute a sufficiently large random number (described further below).

[0008] The ID code used in conjunction with this invention refers to the global ID code, host ID code, program ID code, subroutine ID code, and program complex ID code. The term ID code is used overarchingly in descriptions applicable to all of these codes.

[0009] Advantageously, the method according to the invention can be executed distributed across multiple computers. Therefore, not only a single host, but multiple hosts can be used to process tasks defined by data items. Here, one or more participating hosts are part of a computing environment. The method for creating the inspection algorithm constitutes a prerequisite for this, allowing the algorithm to be used when processing tasks defined by data items. This is guaranteed by a method, also according to the invention, for computer-aided processing of applications in a computing environment (described further below). Advantageously, commercial computers, i.e., so-called COTS components (COTS stands for Commercial of the Shelf), can be used here.

[0010] An application is a program that performs a specific task (application). Applications can be broadly categorized into two types. Some applications are designed to solve tasks that are addressed externally (i.e., outside the computing environment), in conjunction with the computing environment itself. This could be, for example, a control component in a railway application. Such applications are also called user programs. This refers to applications for which the computing environment is intended to handle external tasks.

[0011] The second category of applications involves applications required for the functionality of an organizational computing environment. These could be service programs necessary for the computing environment to function. For example, they could be programs that enable communication between various hosts.

[0012] Data used to configure applications to meet the unique requirements of the current application scenario should be understood as configuration data. Configuration includes the interoperability of different applications and the functionality of the applications on the installed hardware components. Furthermore, configuration also includes adaptations for the current application scenario, with relevant applications envisioned for these scenarios (e.g., different parameters may be used in different application scenarios).

[0013] Within the scope of this application, a data item should be understood as a collection of data, the scope of which is well-defined. In particular, a data item can be explicitly read from or written to a data carrier by addressing. A data item consists of multiple data segments that together form the data item. Data segments are also addressed in such a way that they can be explicitly read from or written to the data carrier. According to the present invention, program and configuration data can be described and stored on a data carrier by one (meaning at least one) data segment.

[0014] Therefore, through addressing, the start and end of a data segment are explicitly defined. Since a data item consists of multiple data segments, the start and end of the data item are also explicitly defined. This means that data items, and even individual data segments, can be read from the data carrier and always have the same content. The feasibility of this is achieved by identifying unexpected errors in data items (e.g., Bitkipper). For example, a hash function can be applied to a data segment, ensuring that the data segment always yields the same hash value assuming no errors occur. Therefore, it can be concluded that if the hash value changes, an error exists within the data segment.

[0015] In other words, by using a hash function, the integrity of the stored data can be ensured, in principle, that it should not be changed. This is because it means that the hash value determined by the hash function must not be altered.

[0016] Additionally, errors can occur, for example, if the wrong application, a specific version of the application, or incorrect configuration data is used. This also applies to application subroutines or application complexes that represent combinations of different applications. Subroutines and application complexes can also be associated with configuration data that themselves are not allowed to be changed.

[0017] Not only must the data segments be monitored, but it is also necessary to monitor the use of the correct hardware and software components. According to this invention, a defined number of hardware and software components participate in processing an application implementation predetermined by corresponding data items, and each hardware and software component is assigned an ID code. Then, during task processing, the ID code can be checked via the data item. If the ID code is incorrect, an error can be output.

[0018] According to the present invention, the error-free processing check of a task (application) should be implemented by a check algorithm, which has a check function for this purpose (the application of the check algorithm is further described below). To create the check function, the method according to the present invention uses a computation function to create a computer-aided check algorithm. In this computation function, the ID codes of all participating hardware and software components are correlated with each data segment used in a data item and the hash value belonging to the corresponding data segment through a computation operator. A global ID code is associated with another computation operator, corresponding to a data item formed from the data segment to be checked. Therefore, the result can be calculated by executing the computation function determined therein, which, in this invention, is called a complementary code.

[0019] Complementary codes are used to establish check functions. In these check functions, the ID codes of all involved hardware and software components are correlated using the aforementioned calculation operators. Unlike calculation functions, however, these ID codes are not global ID codes, but rather complementary codes of the relevant data segments. This means that, assuming no errors in the application's processing, the global ID code must be constructed by applying the check function for all checked data segments of a data item. The global ID code of the corresponding data item can always be determined as a result of all check functions, ensured by the complementary codes generated separately through the calculation functions.

[0020] Therefore, the checking function according to the invention achieves a reliable possibility of checking the error-free configuration of the computing environment (correct and tamper-proof software on the correct hardware specified for this purpose) for the processing application with relatively low computational cost. Here, the check includes hardware components and software components whose data remains unchanged during application processing. However, since this data can change randomly, this is ensured by applying a hash function that detects unexpected data changes. The correct use of hardware and software components is further guaranteed by ID codes that guarantee explicit identification of the hardware and software components used.

[0021] Data that should only be changed by the application of the computing environment (calculation results, digitized measurements, inputs, and variable requirements of the application) cannot be checked by the checking function according to the invention. However, this data can be protected by establishing redundancy in a known manner. For example, this data can be calculated in multiple, preferably three, parallel process flows, and the results can then be compared in a voting manner. The results are considered reliable only if at least a majority of the compared results are consistent. Here, parallel processing of the application by the computing environment can be performed, in particular, by executing three parallel processing data items in the computing environment. This advantageously ensures that the processing of one data item can be performed independently and without feedback relative to the other processing. This advantageously minimizes the possibility that an error in processing one data item will also affect the processing of other data items.

[0022] Of course, the possibility of mutual interference cannot be completely ruled out, because, for example, a hardware error involving the processing of multiple data items on a single host can also affect multiple processing steps in parallel. Therefore, the potential for improvement lies only in transferring the error from the processing of one data item to other data items. However, if each data item is processed on a different host, the possibility of a hardware error affecting the processing of multiple data items can be advantageously further reduced.

[0023] The terms “computer-aided” or “computer implementation” are understood in connection with this invention as the implementation of a method, wherein at least one computer or processor performs at least one method step of the method.

[0024] The term "computing environment" is understood in conjunction with this invention as a facility consisting of a computer, programs, and stored data used to process applications that must perform tasks.

[0025] The term "host" or "computer" (in this invention, "computer" is a synonym for host) includes all electronic devices with data processing capabilities. A computer can be, for example, a personal computer, server, handheld computer, mobile wireless device, and other computer-aided communication device for processing data, a processor, and other electronic devices for data processing, which may preferably also be connected in a network constituting a computing environment.

[0026] The term "processor" in this invention can be understood, for example, as a converter, sensor, or electronic circuit for generating measurement signals. A processor can be, in particular, a central processing unit (CPU), a microprocessor, a microcontroller, or a digital signal processor, and may be combined with a storage unit for storing program instructions, etc. A processor can also be understood as a virtualized processor or a soft-CPU.

[0027] The term "storage unit" is understood in connection with this invention, for example, as a computer-readable memory, in the form of working memory (Random-Access Memory, RAM) or data storage (hard disk or data carrier).

[0028] The term "interface" can be implemented through hardware technology, such as wired or wireless connections, and / or through software technology, such as the interaction between individual program modules or parts of one or more computer programs.

[0029] The term "cloud" is understood as the environment used for "cloud computing." It refers to an IT facility implemented via a network interface, such as the internet. It typically includes storage space, computing power, or software as a service that does not need to be installed on a local computer using the cloud. Services provided within the scope of cloud computing encompass the entire range of information technology and also include facilities, platforms, and software.

[0030] The term "program module" should be understood as a single functional unit whose implementation method steps are described in the program flow according to the invention. This functional unit can be implemented in a single computer program or in multiple communicating computer programs. The interface implemented herein can be implemented using software technology in a single processor or, when using multiple processors, using hardware technology.

[0031] Unless otherwise indicated below, the terms "create," "determine," "calculate," "generate," "configure," "edit," etc., preferably refer to the process of generating and / or changing data and / or transforming data into other data. Here, the data exists, in particular, as a physical quantity, such as an electrical pulse or as a measured value. The necessary instruction programs are combined into software within a computer program. Furthermore, the terms "send," "receive," "read in," "read out," "transmit," etc., refer to the cooperation of various hardware and / or software components through interfaces.

[0032] According to one design scheme of the present invention, at least one application has multiple subroutines, wherein, for each subroutine, the data describing the subroutine is combined into a data segment, and the configuration data related to the relevant subroutine is combined into a data segment, a subroutine ID code is assigned to the subroutine identified as a component or the assigned subroutine ID code is read, and when creating calculation functions and checking functions, the subroutine ID codes of the participating subroutines are additionally associated through calculation operators.

[0033] Within the scope of this invention, a subroutine is understood as a smaller unit, such as a program module, which together constitute the application. Therefore, it is advantageous to build applications modularly, i.e., to define program modules used in multiple applications. Here, these subroutines can have different configuration data depending on their usage configuration. Subroutines thus make it easier to create applications and thereby make the computing environment more adaptable to the application scenario.

[0034] According to one design scheme of the present invention, multiple applications are combined into a program complex, wherein, for each program complex, the data of the program complex is combined into a data segment, and the configuration data related to the relevant program complex is combined into a data segment, a complex ID code is assigned to the program complex identified as a component or the assigned complex ID code is read, and when creating calculation functions and checking functions, the complex ID codes of the participating program complexes are additionally associated through calculation operators.

[0035] Therefore, a program complex combines multiple applications whose common processing can be combined with respect to the overall application. Specifically, it can be specified that all applications contained within a data item are combined into a program complex. This takes into account the situation where a data item causes the combination of data segments in terms of the data to be applied, and in parallel, the program complex aggregates the corresponding applications, with data segments assigned to said applications.

[0036] Applications can also be structured into program modules, in which case a program complex is formed by the aggregation of these program modules. In other words, program modules can be used at multiple layers.

[0037] When creating program complexes, applications, and subroutines, it's important to note that configuration data can be assigned separately to each. This can lead to the same data being stored multiple times, forming separate data segments that can be explicitly assigned to program complexes, applications, or subroutines. The key is the feasibility of explicit allocation so that there are explicitly addressable data segments available for creating check functions. Since the data segments themselves consist of immutable data, subroutines, applications, and program complexes can access different addresses to retrieve the same data as needed, which is harmless to the application's processing flow. If all check functions yield the expected global ID code, the application's configuration can be considered error-free (i.e., due to corrupted stored data, incorrect loading, incorrect allocation relative to hardware, etc.).

[0038] According to one design scheme of the present invention, UUID is used as the host ID code and / or program ID code and / or subroutine ID code and / or system ID code.

[0039] A Universally Unique Identifier (UUID) is a 128-bit number used to identify information in a computer system. The term Globally Unique Identifier (GUID) is also used and is included in the term UUID within the scope of this invention. When generated according to standard methods, UUIDs can be advantageously considered globally unique for practical purposes. Although the probability of a UUID being duplicated is not zero, it is so small that the probability of a collision is negligible. Therefore, UUIDs can also be used in security-related applications, such as in railway technology, where different SILs (Safety Integrity Levels) are defined to be followed.

[0040] Another advantage of UUIDs is their independence from centralized registration locations or coordination between components such as one or more hosts or computers, systems, programs, and subroutines (unlike most other numbering methods). This is achieved through (pseudo)randomly generated UUIDs. All bits not set to fixed values ​​by the UUID format are occupied by (pseudo)random values. Although uniqueness is not guaranteed for UUIDs generated in this way, the total number of randomly generated UUIDs is so large that the probability of generating two identical UUIDs is negligible if the random number algorithm used provides uniformly distributed random numbers. Therefore, UUIDs can be arbitrarily generated and used for identification without a central control authority, eliminating the risk of the same UUID being used in other locations.

[0041] According to one design scheme of the present invention, the MD5 algorithm is used as the hash function.

[0042] The Message Digest Algorithm 5 (MD5) is a widely used cryptographic hash function that produces a 128-bit hash value from any message (formed from a data segment within the scope of this invention). This, for example, allows for easy verification of the correctness of data calls. It is representative of a family of cryptographic hash functions developed in 1991 by Ronald L. Rivest of MIT, at a time when analysis showed its predecessor, MD4, might be insecure. MD5 is no longer considered secure (in a security sense) either, as it is essentially possible to generate different messages with the same MD5 hash value.

[0043] However, the probability of two messages accidentally generating the same hash value is extremely low. Therefore, this method is advantageously suited for generating a different hash value for each message, i.e., each data segment, with sufficient probability, making it suitable for security-related applications such as railway operations, especially if the railway application is additionally protected against unauthorized third-party access. This eliminates the possibility of randomly generating the same hash value.

[0044] The high security of generating the same hash value from different messages is a common characteristic of all cryptographic hash functions. This is motivated by the requirement for high security against malicious attacks related to encryption. However, this characteristic is not the focus for the use of this invention. The computing environment is only externally protected against malicious attacks. Within the computing environment, it is only necessary to generate explicit hash values ​​for data segments, which is guaranteed, for example, by the MD5 algorithm.

[0045] According to one design scheme of the present invention, the ID code corresponding to the component and the generated hash value have the same bit length, wherein a check function is constructed for each bit of the ID code and the hash value, complementary bits are calculated respectively, and a complementary code with the same bit length is calculated from the total complementary bits and stored.

[0046] In particular, if the MD5 algorithm is used as the hash function and UUID is used as the ID code, the complementary code can have a length of 128 bits. The advantage of applying the check function bitwise (preferably creating the check function bitwise when applying the computation function bitwise) is that a simple check equation system can be used as the check function, resulting in shorter computation time. Therefore, computation can be performed quickly and resource-efficiently.

[0047] According to one design scheme of the present invention, the ID code, hash value and complementary code are correlated with each other through the XOR operator.

[0048] The XOR operator is also known as "exclusive OR". In information technology terms, this means that if the inputs to the XOR operator are both configured as 0 and 1, the output of the operator is 1. If the inputs to the operator are both configured as 0 or 1, the output is 0.

[0049] The XOR operator is advantageously suited, particularly for comparing hash values ​​and ID codes bitwise. This association results in a 1 if the associated bits differ and a 0 if they are the same. The determined results are then compared with the next operand in the association. Particularly advantageous here is that after calculating the complementary code from the computation equation, the check equation is calculated bitwise from the computation function; these check equations together constitute the check function. The check equation is thus used for bitwise checking of the relevant data segments.

[0050] Based on the ID code under consideration, a calculation function can be created, for example.

[0051] HID x KID x PID x TID x HASH x GID = KC

[0052] Among them, the checking function is as follows:

[0053] HID x KID x PID x TID x HASH x KC = GID

[0054] in,

[0055] HID (Host ID) code, for example, as a UUID.

[0056] KID (Knowledge ID) is a composite ID code, such as a UUID.

[0057] PID (Program ID Code), for example, as a UUID

[0058] TID subroutine ID code, for example, as a UUID.

[0059] HASH hash value, for example, determined by the MD5 algorithm.

[0060] KC complementary code, for example, a 128-bit length

[0061] Global ID (GID), for example, as a UUID.

[0062] x is a computational operator, such as the XOR- operator.

[0063] In the presence of multiple host ID codes, composite ID codes, program ID codes, or program ID codes, multiple associations of ID codes of relevant types are implemented.

[0064] The basic functionality is derived from the calculation function's conversion between the complementary code and the global ID code after calculating the complementary code. This allows the function to be applied, specifically checking whether the global ID code of the relevant data segment can be obtained by inserting the relevant ID code, hash value, and complementary code.

[0065] Specifically, the computation function and the check function are applied as computation equations and check equations for each bit.

[0066] If the composite ID code and / or subroutine ID code are not used, the calculation function and the checking function are simplified accordingly.

[0067] The aforementioned technical problem is alternatively solved according to the present invention by means of the content (method) described at the beginning, wherein for each application, the application data and the configuration data related to the application are respectively combined into a data segment, and the data segments of multiple applications and configuration data are combined into a data item.

[0068] Specifically, the inspection algorithm created according to the above method is used to calculate the result of the relevant inspection function for the data segment, and the result is output or compared with the global ID code and the comparison result is output.

[0069] Therefore, the latter method involves the application of a checking algorithm, where the checking function generated in the former method is used to check the method used for computer-aided processing applications. This achieves the advantages described above, which will not be repeated here. It is feasible to check the process for errors during method execution. This is achieved by applying a checking algorithm that, if the use of data segments is error-free and the selection of hardware and software components is correct, must generate a global ID code as the result. Conversely, if the result of applying the checking function is not a global ID code, an error is considered to exist.

[0070] Therefore, to identify errors, the result of the checking function is output. However, different measures exist to identify errors when processing applications with computer assistance.

[0071] It is feasible to compare all the results produced by the check functions for the data segments of the data items. For each data segment of a data item, this must always yield the same global ID code. Since the check function is applied to each data segment, multiple results are provided, so that if all the results from different check functions are the same, it can be indirectly concluded that the computing environment is configured correctly, even without knowing the global ID code.

[0072] If some results are discrepancies, but most checking functions yield the same result, then erroneous data segments can be identified. Appropriate measures can then be introduced (described further below). For the majority of results, the relevant data segments can be considered error-free and associated with the correct hardware and software components. A discrepancy in the calculated global ID code is sufficient to indicate an error in the entire configuration.

[0073] Another feasible approach is to compare the result of the check function with a previously determined global ID code. However, this comparison must be callable. Therefore, the global ID code is known when such a comparison result is generated. To prevent its misuse during the processing of the check function in computer-aided processing applications, it can be stored in a hardware- or software-protected area of ​​the computing environment, where the comparison with the result generated by the check function can preferably also be performed.

[0074] According to one design scheme of the present invention, at least one application has multiple subroutines, wherein, for each subroutine, the data describing the subroutine is combined into a data segment, and the configuration data related to the relevant subroutine is combined into a data segment, a subroutine ID code is assigned to the subroutine identified as a component or the assigned subroutine ID code is read, and in the calculation of the check function, the subroutine ID codes of the participating subroutines are additionally associated through calculation operators.

[0075] According to one design scheme of the present invention, multiple applications are combined into a program complex, wherein, for each program complex, the data of the program complex is combined into a data segment, and the configuration data related to the relevant program complex is combined into a data segment. In the calculation of the check function, the complex ID code of the participating program complex is additionally associated through the calculation operator.

[0076] The advantages of defining and using subroutines and program complexes have already been explained above, and will not be repeated here.

[0077] According to one design of the present invention, data is transmitted from a first application and / or subroutine and / or program complex to a second application and / or subroutine and / or program complex, wherein the data is transmitted together with the result of a related check function, and the data is only processed by the second application and / or subroutine and / or program complex if the result of the check function of the first application and / or subroutine and / or program complex with which the data is transmitted is consistent with the result of the check function of the second application and / or subroutine and / or program complex, or only processed for applications starting from a predetermined security level.

[0078] Strictly speaking, the checking function is applicable to data segments describing an application. However, since a data segment is also associated with an application whose execution produces variable data that must be exchanged with other applications, it is necessary for the receiving application to check whether the transmitted data can be considered error-free. Because the receiving application can apply the checking function associated with its data segment, the result can be compared with the result from the receiving application (data segment). If they are consistent, the probability of errors occurring in the executing application (data segment) is low. Therefore, the checking can be performed in parallel during transmission or at least immediately after transmission.

[0079] When the results of the aforementioned checking function deviate, alternatively, further processing of the data can be disallowed or at least interrupted, or interrupted only for applications that reach or exceed a predetermined security level. The advantage of this is that the computational power of the relevant application can continue to be used for security-independent applications. In other words, this means that if the error that occurs (such as a program crash) does not involve a security-related risk (in the case of railway applications, security-related risks are, for example, train collisions or other accidents), the application can be executed.

[0080] According to one design scheme of the present invention, if the result of the check function of the first application and / or subroutine and / or program complex that transmits data is inconsistent with the result of the check function of the second application and / or subroutine and / or program complex, then the first and second application and / or subroutine and / or program complex shall be stopped, or the host identified for the application and / or subroutine and / or program complex shall be shut down.

[0081] By stopping the program or shutting down the identified host, it is advantageous to effectively prevent the application's error handling from continuing. The relevant application (including subroutines and program complexes) can then be restarted, or the relevant host can be rebooted. Especially if the application is redundantly executed to allow for subsequent voting on the generated variable data, then the operation of an individual application or host, such as a railway application, can continue during restarts. Once it is operational again, it will be rejoined in the redundant operation. Based on the results, it can be immediately checked, using a check function, whether the measure has eliminated the error. If not, further measures must be introduced. For example, maintenance technicians can be requested to take maintenance measures.

[0082] According to one design scheme of the present invention, before the start of a process involving interaction between multiple applications and / or subroutines and / or program complexes, the results of the check functions of the multiple applications and / or subroutines and / or program complexes are compared with each other, and data transmission between applications and / or subroutines and / or program complexes is only permitted if all the results of the check functions are consistent, or only from a predetermined security level, or only between applications and / or subroutines and / or program complexes whose check function results correspond to the majority of the check function results.

[0083] The processing itself is preferably controlled by the responsible application. This application therefore involves the interaction of multiple applications participating in the processing. Here, data is transferred between the relevant applications, as described above. The application responsible for controlling the processing may also contain routines that perform checks on the consistency of the results of the check functions of the relevant applications.

[0084] Advantageously, the application performs checks via check functions before the application generates and exchanges variable data (within the scope of the data needed for processing). This prevents processing from potentially generating erroneous data from the outset. However, the processing of the service program that implements the check functions and the associated data exchange naturally occurs is irrelevant to the actual processing of applications, such as those used to control railway operations. It even runs in the background after the processing has begun.

[0085] According to one design scheme of the present invention, if not all the results of the check functions are consistent, then at least one application and / or subroutine and / or at least one program complex whose check function results deviate from the results of most check functions is prevented from being executed, or the host identified for the at least one application and / or subroutine and / or at least one program complex (PK1 ... PK4) is prevented from being executed.

[0086] According to one design scheme of the present invention, the ID code corresponding to the component and the generated hash value have the same bit length, wherein a check function is constructed for each bit of the ID code, the hash value and the complementary code, the result bit is calculated respectively, and the check function result with the same bit length is calculated from the total result bits and stored.

[0087] The aforementioned technical problem is alternatively solved according to the present invention by starting with the content (security-related computing environment), i.e., setting one or all hosts to perform the method according to the present invention.

[0088] Using the method according to the invention described above in a safety-related computing environment, particularly for railway applications, yields the advantages already explained within the scope of the method according to the invention. The content already described regarding the method according to the invention also applies accordingly to the computing environment according to the invention.

[0089] Furthermore, protection is also claimed for a computer program product having program instructions for performing the method and / or embodiments thereof according to the invention, wherein the method and / or embodiments thereof according to the invention can be performed respectively by the computer program product.

[0090] Furthermore, protection is also claimed for a provisioning device for storing and / or providing computer program products. The provisioning device is, for example, a storage unit for storing and / or providing computer program products. Alternatively or additionally, the provisioning device is, for example, a network service, a computer system, a server system, especially a distributed, such as cloud-based, computer system and / or virtual computer system, which preferably stores and / or provides computer program products in the form of data streams.

[0091] The provision is implemented as a file, particularly a download file, or as a data stream, particularly a download data stream, in the form of program data blocks of a computer program product. However, such provision can also be implemented, for example, as a partial download consisting of multiple parts. This computer program product is read into the system, for example, using the provisioning device, so that the method according to the invention is executed on the computer. Attached Figure Description

[0092] Further details of the invention are described below with reference to the accompanying drawings. Identical or corresponding elements in the drawings are given the same reference numerals and are repeated only to illustrate differences between individual drawings.

[0093] The embodiments described below are preferred embodiments of the present invention. In these embodiments, the components of the embodiments are individual, unrelated features of the present invention, which also independently improve the present invention and thus constitute components of the present invention individually or in a manner different from the combinations shown. Furthermore, these components can also be combined with the previously described features of the present invention.

[0094] in:

[0095] Figure 1 An embodiment of a computing environment according to the invention, along with its associated railway applications, is illustrated schematically.

[0096] Figure 2 As shown in the block diagram, according to Figure 1An embodiment of a computing environment with two hosts in railway applications, wherein each functional unit comprises a program module, which can run on one or more processors respectively and the interface can be designed accordingly using software or hardware technology.

[0097] Figure 3 The flowchart illustrates an embodiment of the method according to the present invention, wherein each method step can be implemented individually or in groups by program modules, and wherein, according to Figure 2 The functional units and interfaces are illustrated in the example. Detailed Implementation

[0098] Figure 1 This diagram schematically illustrates a railway application controlled by a computing environment RU. The application features a track GL, on which different components of interlocking technology (Stellwerkstechnik, or signal tower technology) are exemplarily shown. Here, it is the turnout drive WA, which adjusts the turnout WH. Additionally, a transponder BL is installed on one of the tracks, allowing information exchange with passing trains. Finally, an optical signaling device LS is shown, controlled by a controller CL.

[0099] The computer environment RU can have different hosts HR1, HR2, and HR3, and the applications controlling the railway applications are distributed on the hosts in the form of applications (this will be further explained below). The first host HR1 is provided by the computing center RZ and is connected to the first storage device SE1 through the first interface S1. The computing center RZ can be operated by, for example, a service provider of the railway operator or the railway operator itself. The first host HR1 is connected to the cloud CLD through the second interface S2, so that the first host is not locally bound to the railway application.

[0100] The railway operator's control center LZ includes a second host HR2, which is also connected to the cloud CLD via a third interface S3. Furthermore, the second host HR2 is connected to a second storage device SE2 via a fourth interface S4.

[0101] Furthermore, the computer environment RU, for example, includes an interlocking device STW, which comprises a third host HR3, connected to a third storage device SE3 via a sixth interface S6. Additionally, the third host HR3 has a fifth interface S5 for the second host HR2. The host HR3 can also be connected to the cloud CLD in a manner not shown. The third host HR3 also has a seventh interface S7 for the turnout drive device WA, an eighth interface S8 for the controller CL, and a ninth interface S9 for the transponder BL.

[0102] according to Figure 1All interfaces S1...S9 are essentially wired or even implemented via wireless transmission technologies such as radio. The layout of hosts HR1...HR3 is merely exemplary and can be arbitrarily expanded in more complex railway facilities. The computing environment is defined thus as follows: the participating hosts HR1...HR3 can communicate with each other and thereby distribute the application across hosts HR1...HR3, taking into account the available computing power.

[0103] Figure 2 An example is shown according to Figure 1 The configuration of the first host HR1 and the second host HR2 is described. Access to other hosts can be similarly implemented. The hosts are organized such that the task complexes used to solve the problem are organized on the hosts as program complexes PK1, PK2, PK3, and PK4, each program complex consisting of a single application AP1...AP5. Furthermore, according to the fifth application AP5, it can be implemented through a single subroutine. The subroutines of the fifth application AP5 are the gateway GW, the voter VT, the clock generator TG, and the message broker MB (described further below). However, this is only for illustrative purposes. Alternatively, the clock generator can run in other (insecure) applications, while the remaining subroutines run in (secure) applications.

[0104] The fifth application, AP5, is organized in the same way across all application complexes PK1...PK4. It can exchange messages with the cloud CLD via the gateway GW. Therefore, the gateway GW... Figure 1 Interfaces S2 and S3 are formed. Messages are distributed within the program complex PK1...PK4 via message broker MB, preferably according to a publish-subscribe method. For example, gateway GW uses interface S14 to provide received messages to replicas RP1...RP8 via message broker MB. These are then invoked by replicas RP1...RP8. This is represented by node KN, which is represented in interface S14 (and similarly in the other interfaces S10...S13 described below).

[0105] exist Figure 2 For clarity, program complexes PK1...PK4 are implemented entirely in hosts HR1...HR2, respectively. In reality, program complexes with application programs and subroutines can also run distributed across multiple hosts (not shown). This advantageously allows the use of multiple hosts when the capacity of a host is insufficient to support the configuration of the entire program complex, in a way that the capacity of multiple hosts is shared by the relevant program complexes.

[0106] Program complexes can, for example, define specific task complexes. Program complexes can be used to control specific railway components (signals, interlocking, switches, axle counters, etc.). Controlling these railway components generally requires multiple applications. In particular, the application AP5, already explained above, is needed to ensure secure application execution and communication with other hosts.

[0107] Within the scope of this invention, the replica is understood as a software implementation on hosts HR1 ... HR3 that allows parallel processing of applications AP1 ... AP4, preferably within the program complex PK1 ... PK4. Figure 2 The diagram shows program complexes with two copies, but three copies are preferred, and more copies are also conceivable. In the following explanation, the method for processing the application is described based on the first program complex PK1, which is used for processing the first application AP1 with its first copy RP1 and second copy RP2. However, for program complexes PK2...PK4, the processing is performed accordingly and therefore does not need to be explained separately.

[0108] In the first replica RP1 and the second replica RP2, the first application AP1 is processed in parallel. It is an application, which is based on... Figure 1 It undertakes tasks for railway applications. Furthermore, first configuration data KD1 is provided in the first replica RP1 and the second replica RP2. This first configuration data is necessary for executing the first application AP1 to handle the unique tasks of the railway application. For example, the first application AP1 can generally be used to control optical signaling devices, wherein the first configuration data KD1 ensures that the first application AP1 is applied according to... Figure 1 On the optical signal device LS. Here, for example, it is necessary to ensure that it is in accordance with... Figure 1 Communication with the controller CL.

[0109] Configuration data KD1...KD13 can also be used for all other program complexes PK1...PK4, applications AP1...AP4, and subroutines MB, TG, VT, GW. Accordingly, configuration data KD1...KD13 contains the data required for each program complex, application, and subroutine respectively, so that they can perform the tasks assigned to them in the relevant application context. This configuration data is immutable and therefore can be stored in data segments with known start and known end. Similarly, all program complexes PK1...PK4, applications AP1...AP4, and subroutines TG, VT, GW, MB are stored as data segments with known start and known end. For this purpose, for example, it is provided according to... Figure 1The first storage device SE1, the second storage device SE2, and the third storage device SE3.

[0110] Data that changes during processing is exchanged as messages between the participating parts. An information broker (MB) is provided for this purpose, as described above. Furthermore, the individual hosts HR1 and HR2 communicate with each other via external interfaces S2 and S3, for example, through a cloud CLD, enabling data exchange between different program complexes PK1...PK4 on different hosts.

[0111] according to Figure 1 In railway applications, the process is safety-related to the operation of the railway application. This is why the first application AP1 is processed in parallel, i.e., redundantly, in the first replica RP1 and the second replica RP2. When processing the application, the first replica RP1 and the second replica RP2 send the results to the message broker MB, specifically, the first replica RP1 via interface eleven S11 and the second replica via interface S12. These results are invoked by the voter VT, which performs the voting, through these interfaces. Only when a majority of the results are consistent (i.e., two results are consistent in the case of two replicas, at least two results are consistent in the case of three replicas, at least three results are consistent in the case of four replicas, etc.), is the result provided to the message broker via interface thirteen S13 and can be invoked by the gateway GW via interface thirteen S13 for transmission to other units via interface second S2.

[0112] To simultaneously provide the calculation results to the votes via the voter VT, the processes in the first replica RP1 and the second replica RP2 control the clock cycle via the clock generator TG. The clock generator provides the clock signal through the tenth interface S10, and the clock signal can also be invoked from the first replica RP1 and the second replica RP2 via the message broker MB.

[0113] The method by which tasks are processed through the first application AP1 and the second application AP2 is guaranteed by the fifth application AP5. The fifth application AP5 is an internal application that assists the operation of hosts HR1...HR3. This clearly demonstrates that not only must it be based on... Figure 1 The application provider for the railway application must also provide applications (user programs) for application processing in the host HR1...HR3.

[0114] Combining applications into program complexes and dividing them into subroutines makes it easier to summarize applications and check for errors in task processing. To this end, data is combined into data segments (by defining the start and end points of data segments) that can be explicitly identified and addressed. As described above, subroutines, applications, program complexes, and their corresponding configuration data are defined as data segments. Where necessary, the required data is preferably stored multiple times so that data segments and configuration files can be explicitly assigned to the functional equations (computation functions). In other words, what does not happen in this case is that if different applications use the same configuration data, they do not access the same storage location for the data, but always access the data segments allocated to them, where the data is provided.

[0115] Figure 3 The method for creating the computer-aided inspection algorithm and its subsequent use in methods for computer-aided processing are shown in a very simplified manner, along with the data segments used for inspection via the inspection function. This simplification is particularly evident in the summary of the recursive loop, which is for clarity.

[0116] The method for creating the check function begins in a routine that includes steps for determining data segments DF_DA and data items DF_DS. Each data item is composed of a consistent group of data segments, meaning that the processing of these data segments is used to resolve the task TSK. The steps for determining data segments DF_DA and DF_DS are repeated until all data segments for the intended task TSK are determined and appropriately combined into data items, and data segments DA and data items DS are stored. A query step CPL? is then performed to determine whether these steps have been fully executed.

[0117] The determination of data segments (DA) and data items (DS) is achieved by making data segments explicitly identifiable through their known start and known end. Different data segments (DA) are aggregated into data items (DS), which are correspondingly explicitly identifiable. This means that data segments and data items are precisely defined and therefore addressable, and in particular, hash functions can be applied to data segments to generate hash values ​​(this is further explained below).

[0118] By defining the Data Segment (DA), all immutable data required to process the Task TSK is explicitly collected. This includes data describing subroutines, application programs, and program complexes (in this case, program code executable by the host) and configuration data for the relevant programs within the Computing Environment RU, tailored to the specific application context.

[0119] In another routine, the hardware and software components involved in the task are now identified. This data item is organized such that it contains all the data segments for resolving the scheduled task TSK, thus forming the constraints for identification within this routine. Specifically, identification steps are performed for the program complex ID_PK, the application ID_AP, and the subroutine ID_TP. These steps are repeated until all hardware and software components have been identified. This is checked by the query step CPL? to confirm that all steps have been performed. The identification of hardware and software components is achieved, in particular, by evaluating data segments containing configuration data, as these also contain addresses for the hardware and software components to be used.

[0120] Then, the routine is executed, where the process parameters for the process function PF are determined. This consists of an allocation step for the global ID code DA > GID, where the corresponding data segment DA is preferably assigned a UUID as the global ID code. Furthermore, all identified hardware and software components are assigned ID codes, preferably also UUIDs. The host HR obtains the host ID code, the program complex PK obtains the complex ID code, the application program AP obtains the program ID code, and the subroutine TP obtains the subroutine ID code. Additionally, in the step of calculating the hash value CLC_HW, a hash value is assigned to each data segment DA by applying a hash function, preferably the MD5 algorithm. The above steps are repeated until the query step CPL? shows that the steps for all data segments, hardware components, and software components have been executed.

[0121] In subsequent routines, the computation function BF is now created and computed for all data. In the creation step for the computation function DA>BF, the hardware and software components associated with the corresponding data segment, along with their corresponding ID codes, are considered in such a way that they are interconnected through operators, particularly the XOR operator. Furthermore, the global ID code of the relevant data segment DA is associated.

[0122] In the subsequent calculation step for the complementary code CL_KC, the complementary code is calculated as the result of the calculation function. This is preferably achieved by an equation for each bit of the ID code and hash value, all of which in this case have the same bit length. Once the complementary code KC is calculated, a related check function can be created in the calculation step for the check function CLC_PF with its help (again preferably created bit by bit through an equation, see above), where the determined ID code and the hash value of the associated data segment are associated with the complementary code, and the result of this check function is the global ID code of the associated data segment.

[0123] Check if all procedure functions have been created by querying CLP?. Then, the procedure functions are output by the output step OT_PF and stored before the method ends.

[0124] The method for computer-aided processing applications begins with selecting a task TSK, where a suitable stored data item DS is used for that task. Specifically, the data segments required for the task for that data item are loaded (these data segments may, but are not necessarily, all data segments for that data item, but all loaded data segments belong to the selected data item), wherein the data segment is appropriately selected in the selection step for the data segment SLC_DA. In a further selection step for the process function SLC_PF, check functions PF (hash value, ID code, complementary code, and, if necessary, global ID code) are downloaded and calculated for the loaded data segment DA. For these check functions, the results are calculated with parameters in the calculation step CLC_RST, and optionally, a query is initiated to check whether the result RST matches the global ID code GID. If they match, the routine used to calculate the results of all check functions PF is repeated until a query CLP indicates that all check functions have been calculated.

[0125] The optional query step RST=GID presupposes that a global ID code GID is provided for the method. This must then be stored appropriately in the computing environment. It is advantageous to restrict access to the global ID code so that it cannot be used outside of this optional step due to errors in the method. Only in this way can it be ensured that the method works only with the result RST obtained by the application of the check function PF, and that its correctness is compared with the results RST of other computations in the absence of an actual existing global ID code (this is further explained below).

[0126] If the query RST=GID shows that the calculated result RST is inconsistent with the global ID code, then in the next step, the application AP belonging to the calculated check function PF is stopped, preferably restarted by restarting STR_AP. Then RST=GID is queried again. If the result is now correct, the next check function is calculated. If the result is incorrect, the host is shut down and the host HR is restarted in step STR_HR. Then a new query RST=GID is made. If the result is now correct, the next process function is calculated; if the result is still incorrect, the method is stopped at least for the relevant host. Further maintenance measures are then required and performed, such as maintenance by a maintenance technician (not shown).

[0127] If the above query CPL? shows that all process functions have been calculated, then the query step RST= is performed, where it checks if all calculated results RST have the same value. If so, the processing of task TSK can begin in the calculation step CLC_TSK. This requires a single calculation operation, and also a data transfer step TRS between a single host, program complex, application, or subroutine. If data is transferred between these components, the data is transmitted along with the result RST of the corresponding check function of the sending component. For the receiving component, it is then checked whether the result RST received by the receiving component from the sending component matches the result RST that the receiving component has. This is feasible because, through the already completed identification, the component is associated with the relevant data segment DA.

[0128] If the results are the same, the query step CPL? checks whether the sub-steps of the processing task TSK have been fully implemented. If yes, the method ends and can begin with a new TSK. If not, the next computation step CLC_TSK and other necessary transfer steps TRS are executed recursively.

[0129] If the query for RST= yields a negative result, a repair routine is initiated, which runs similarly to the options given above. In the STR_AP step, the application AP is stopped, and preferably restarted. The query for RST= is then repeated. If the result RST matches the majority of the results for the data segment DA used, the calculation step CLC_TSK or the transfer step TRS can be repeated. If the result does not match the majority of the results for other data segments, the host HR can be shut down and restarted in the STR_HR step. A query step is performed to determine if the result RST matches the majority of the results for data segment DA. If yes, the calculation step CLC_TSK or the transfer step TRS can be repeated. If not, the method is stopped. Maintenance tasks need to be performed, for example, by a maintenance technician (not shown).

[0130] List of reference numerals in the attached diagram:

[0131] LZ Control Center

[0132] STW interlocking equipment

[0133] RZ Computing Center

[0134] GL orbit

[0135] WH turnout

[0136] WA turnout drive unit

[0137] LS optical signal device

[0138] CL optical signal device controller

[0139] BL transponder

[0140] RU computing environment

[0141] HR1 ... HR3 mainframe

[0142] SE1 ... SE3 storage devices

[0143] S1 ... S14 interface

[0144] CLD Cloud

[0145] RP1 ... RP8 clones

[0146] AP1 ... AP5 applications

[0147] PK1 ... PK4 program complex

[0148] KD1 ... KD13 configuration data

[0149] MB Messaging Agent

[0150] TG clock generator

[0151] VT Elector

[0152] GW gateway

[0153] KN node

[0154] DF_DA steps for determining data segments

[0155] DA data segment

[0156] DF_DS steps for determining data items

[0157] DS data items

[0158] CPL? Query steps completed?

[0159] ID_HR is the host identification step.

[0160] ID_PK is used for the identification steps of program complexes.

[0161] ID_AP is the identification step for applications.

[0162] ID_TP is the identification step for subroutines.

[0163] DA>GID allocation steps for global ID codes

[0164] HR, PK, AP, TP > ID: Steps for assigning ID codes to hosts / complexes / programs / subroutines

[0165] HID host ID code

[0166] KID composite ID code

[0167] PID program ID code

[0168] TIP Subroutine ID Code

[0169] CLC_HW steps for hash values

[0170] Steps for creating a computation function (DA>BF)

[0171] BF calculation function

[0172] CLC_KC Calculation Steps for Complementary Codes

[0173] CLC_PF calculation steps for the check function

[0174] PF checking function

[0175] OT_PF outputs the process equations.

[0176] TSK Mission

[0177] SLC_DA selection steps for data segments

[0178] SLC_PF Selection Steps for Procedure Functions

[0179] CLC_RST calculation steps, results, process equations

[0180] RST results

[0181] RST=GID query result=Global ID code

[0182] GID Global ID Code

[0183] RST = Are all the results of the query steps the same?

[0184] CLC_TSK calculation steps for the task

[0185] TRS for data transmission steps

[0186] The result of the RST query step is the same as the result of the transmission partner.

[0187] STR_AP restarts the application

[0188] STR_HR restarts the host

Claims

1. A method for creating a computer-aided inspection algorithm for processing applications in a computing environment. This computing environment has at least one host. This host is used for the execution of multiple applications installed on the at least one host. The method is performed while taking into account the configuration data used for the application. Its features are, For each application, the data describing the application will be combined into at least one data segment. The configuration data related to the relevant applications are combined into at least one data segment. Combine data segments and configuration data from multiple applications into a single data item. Execute steps when creating the inspection algorithm. Identify data items and assign global ID codes to them. Identify the components of the computing environment that participate in the execution of the application executing the data items, wherein, Assign host ID codes to one or more hosts identified as components, or read the assigned host ID codes. Assign an application ID code to an application that is identified as a component, or read the assigned application ID code. Apply a hash function to each data segment contained in the data item and generate a hash value respectively. Create a computation function applied to each data segment in the following way: The host IDs of participating hosts, application IDs of participating applications, hash values ​​of relevant data segments, and global IDs are correlated through computational operators. Complementary codes are computed and stored as the result of a computation function. Create a check function that can be applied to each data segment, in the following way: The host IDs of the participating hosts, the application IDs of the participating applications, the hash values ​​of the relevant data segments, and the complementary codes calculated relative to the data segments are correlated through computational operators. It can calculate the global ID code as the result.

2. The method according to claim 1 Its features are, At least one application has multiple subroutines, where, For each subroutine, specify that the data of that subroutine is combined into at least one data segment, and The configuration data related to the relevant subroutines are combined into at least one data segment. Assign a subroutine ID code to each subroutine identified as a component, or read the assigned subroutine ID code. When creating calculation and checking functions, the subroutine ID codes of the participating subroutines are additionally associated using calculation operators.

3. The method according to claim 2, Its features are, Multiple applications are combined into a program complex, in which, For each program complex, it is specified that the data of the program complex is combined into at least one data segment, and The configuration data related to the relevant program complex is combined into at least one data segment. Assign a complex ID code to a program complex identified as a component, or read the assigned complex ID code. When creating compute and check functions, the composite ID codes of the participating program composites are additionally associated through compute operators.

4. The method according to claim 2, Its features are, Use UUID as the host ID and / or program ID and / or subroutine ID and / or system ID.

5. The method according to claim 1, Its features are, Use the MD5 algorithm as the hash function.

6. The method according to claim 1, Its features are, The ID code assigned to the component and the generated hash value have the same bit length, where, A check function is constructed for each bit of the ID code and the hash value. Calculate the complementary bits separately. Complementary codes with the same bit length are calculated from the total complementary bits and stored.

7. The method according to claim 6, Its features are, ID code, hash value, and complementary code are correlated with each other using the XOR operator.

8. A method for computer-aided processing applications in a computing environment. This computing environment has at least one host. The host executes multiple applications installed on the at least one host. The method is performed while taking into account the configuration data used for the application. Its features are, For each application, the data describing the application and the configuration data related to the application are combined into at least one data segment. Multiple application and configuration data segments are combined in a data item. The inspection algorithm created according to any one of claims 1 to 7 is used, so that... Calculate the result of the check function corresponding to the data segment. Output the result or compare it with the global ID code and output the comparison result.

9. The method according to claim 8, Its features are, At least one application has multiple subroutines, where, For each subroutine, it is specified that the data of that subroutine is combined into at least one data segment, and Configuration data related to the relevant subroutines are combined into at least one data segment. Subroutines identified as components are assigned subroutine ID codes or their assigned subroutine ID codes are read. When evaluating the check function, the subroutine ID codes of the participating subroutines are additionally associated with the evaluation operators.

10. The method according to claim 8 or 9, Its features are, Multiple applications are combined into a program complex, in which, For each program complex, it is specified that the data of the program complex is combined into at least one data segment, and Configuration data related to the relevant program complex is combined into at least one data segment. When checking the evaluation of a function, the composite ID code of the participating program composite is additionally associated with the evaluation operator.

11. The method according to claim 10, Its features are, Data is transferred from the first application and / or subroutine and / or program complex to the second application and / or subroutine and / or program complex, wherein, The data is transmitted along with the result of the corresponding check function. Data is only processed by the second application and / or subroutine and / or program complex if the result of the check function of the first application and / or subroutine and / or program complex that transmits data matches the result of the check function of the second application and / or subroutine and / or program complex, or only for applications starting from a predetermined security level.

12. The method according to claim 11, Its features are, If the result of the check function of the first application and / or subroutine and / or program complex that transmits data is inconsistent with the result of the check function of the second application and / or subroutine and / or program complex, then the first and second application and / or subroutine and / or program complex shall be stopped, or the host identified for the application and / or subroutine and / or program complex shall be shut down.

13. The method according to claim 10, Its features are, Before the processing involving interactions between multiple applications and / or subroutines and / or program complexes begins, the results of the check functions of these multiple applications and / or subroutines and / or program complexes are compared with each other, and Data transfer between applications and / or subroutines and / or program complexes is permitted only if all results of the check function are consistent, or only from a predetermined security level.

14. The method according to claim 13, Its features are, If not all results of the check functions are consistent, then prevent at least one application and / or at least one subroutine and / or at least one program complex whose check function results deviate from the results of most check functions, or prevent the execution of the at least one application and / or at least one subroutine and / or at least one program complex by a host identified against the at least one application and / or at least one subroutine and / or at least one program complex.

15. The method according to claim 9, Its features are, The ID code corresponding to the component and the generated hash value have the same bit length, where, A check function is constructed for each bit of the ID code, the hash value, and the complementary code. Calculate the result bits separately. The results of the check function with the same bit length are calculated from the total number of result bits and stored.

16. A security-related computing environment apparatus having one or more hosts, Its features are, One or all hosts are configured to perform the method according to any one of claims 1 to 15.

17. A computer program product having the ability to perform the method according to any one of claims 1 to 15.

18. An apparatus for providing a computer program product according to claim 17, wherein, Provide a device for storing and / or providing the computer program product.

Images