Method and apparatus for protecting access to coded variables in a computer program

Abstract

The present invention relates to a method for protecting at least one coding variable (x) in a computer program having a plurality of coding variables. c ), wherein each encoding variable (x c ) has its own dynamic signature (D x Here, when accessing the encoding variable (x c ), the dynamic signature (D x ), where in the encoding trace variable (Tracer c ) carries all other coded variables (x c ) of all dynamic signatures (D x ) x ), where in the encoding variable (x c ) is one of the dynamic signatures (D x ) changes, similarly adapting to the trace variable (Tracer c ) carries the sum value (∑D x ), and where the encoding variable (x c )'s dynamic signature (D x ) and the sum of the values ​​stored in the encoding trace variable (Tracer c ) in the sum value (∑D x ) are compared, wherein in the event of a difference an error handling is triggered. This enables high-performance management of all signatures in an arithmetic coding program, regardless of their complexity.

Description

Technical Field

[0001] The invention relates to a method for protecting access to coding variables in a computer program, a device for protecting access to coding variables in a computer program, and a computer program product for protecting access to coding variables in a computer program. Background Art

[0002] In safety-oriented programs for industrial applications, which typically run on embedded hardware such as a programmable logic controller (PLC) or other industrial automation components, it must be ensured that bit errors in variables are detected and that program parts set up for execution in one cycle are actually run through completely.

[0003] When processing functional safety data, internal errors in the safety function must be detected and a safe reaction must be initiated (e.g. output of a safe substitute value or a warning message). This is traditionally done by duplicating the hardware and comparing the results. An alternative is to encode the safety function with the aid of arithmetic codes. Simple arithmetic codes cannot detect all errors and must be supplemented appropriately. This often results in considerable effort and / or limits the use.

[0004] More advanced safety-oriented solutions use hardware-independent variants of the coding process. In the coding process, error information is detected and propagated in every variable. This has previously often resulted in complex applications being unable to be properly mapped.

[0005] Therefore, a method with linear complexity is needed to detect and propagate errors in complex software systems for safety-oriented programming with the help of arithmetic codes.

[0006] Examples of complex applications:

[0007] Asynchronous changes of data (e.g. via HMI-human-machine interface)

[0008] Remaining data

[0009] Nested procedures (IF-THEN-ELSE, LOOP, ...)

[0010] Global data

[0011] CIR (Change in Operation - a change in a program or process during operation)

[0012] Cloud-based secure applications

[0013] According to the current prior art, there are the following solutions:

[0014] Redundancy / diversity: The safety program is executed multiple times independently, so that "common causes" (same error causes) can be eliminated. Depending on the complexity of the application, this approach requires considerable effort for synchronizing the processes and reliably detecting errors.

[0015] In "distributed safety", the actual expected error rate is estimated based on the HW model of the CPU running the safety program. The determination and estimation of the model must be done separately for each HW.

[0016] Dynamic signatures for each variable: Each variable gets a dynamic signature. Every time the variable changes, the signature changes. The cost of managing dynamic signatures increases with the complexity of the application. In each application, the management cost doubles due to checking for small changes in the structure.

[0017] The documents "ANB-and ANBDmem-Encoding:Detecting Hardware Errorsin Software" (SAFECOMP 2010, LNCS 6351, pp.169-182) and DE102010037457A1 by Schiffel et al., and also "Data processing method for providing a value for determining whether an error has occurred in the execution of a program […]" by Schiffel et al. disclose summing the signatures of the program parts that are to be run in the accumulator values, and checking the program execution based on the accumulator values ​​through a check loop.

[0018] In summary, it can be concluded that with the greatly increasing complexity of current requirements, solutions according to the prior art are increasingly unsuitable as the only solution for new solutions. These solutions must be supplemented with measures for managing complexity, which make it possible to make the complexity of safety programs differ only slightly from the complexity of corresponding standard programs.

[0019] The present invention is particularly suitable for encoding processes.

[0020] In the encoding process, the variables are encoded. To this end, the values ​​(xf) in the variables are encoded with the help of AN encoding, ANB (AN+B) encoding, and encoding or by homogeneous encoding (hybrid method), that is, mapped to the encoding value. In the example of ANBD encoding, all numeric variables are encoded according to the following form of rules:

[0021] xc :=x f *A+B x +D x

[0022] And adapt arithmetic operations (+, -, *, / , etc.) so that processing in the encoded region (xc) provides results consistent with the original range (xf).

[0023] Here:

[0024] A is a system constant that is the same for all encoding values.

[0025] ·B x is the static signature of x. This means that every x has its own B x , and B x is a constant.

[0026] ·D x is the dynamic signature of x. x Changing at regular or irregular intervals, for example in each cycle of a program or in a time-controlled manner.

[0027] With the aid of the coding variables, it is possible to determine errors that are caused, for example, by random changes or falsification of individual bits. This means that the value to be coded is mapped onto the coding value so that deviations of individual bits can be detected, for example, by errors in individual bits resulting from the Hamming distance of the permissible coding values ​​forming invalid values ​​in the coding space.

[0028] The complexity of the security program depends in particular on the D x Management type. x is preserved, the complexity remains manageable. This requires c A similar approach protects D x .

[0029] However, each D x Safe storage in secure variables can significantly increase the complexity and resource requirements of a secure software system. Summary of the invention

[0030] Therefore, one object of the present invention is to simplify the management of dynamic signatures in the encoding process so that this is feasible with less complexity without sacrificing security. Another object of the present invention is to ensure or determine by simple means whether a program part set for execution (e.g. a "basic block") has actually been executed.

[0031] The basic idea of ​​the solution to the problem is to calculate the signatures of the coding variables in the two channels independently. Here, the sum of all dynamic signatures is combined with the various calculations of other signatures in a single coding variable, the so-called tracking variable.

[0032] A method for protecting access to at least one coding variable in a computer program having a plurality of coding variables is proposed, wherein each coding variable preferably has its own dynamic signature. When such a coding variable is accessed, the dynamic signature of the coding variable is changed in a predetermined manner. The sum value of all dynamic signatures of all other coding variables is carried in a coding tracking variable, wherein the sum value carried in the tracking variable is similarly adapted when the dynamic signature of one of the coding variables changes, and wherein the sum of the dynamic signatures of the coding variables is compared with the sum value stored in the coding tracking variable for checking, wherein an error handling is triggered in the event of a difference. This enables efficient management of all signatures in an arithmetic coding program, regardless of their complexity.

[0033] The object is also achieved by a device for protecting access to at least one coding variable in a computer program having a plurality of coding variables, the computer program being in particular a safety-oriented automation application, wherein the computer program runs on the device, in particular on a computer or on an industrial automation component, and wherein a plurality of or each coding variable has its own dynamic signature. The device is provided for carrying out the method according to the invention. The advantages already discussed with respect to the method can be achieved by the device.

[0034] The object is also achieved by a computer program product for securing access to at least one coding variable in a computer program, in particular a safety-oriented automation application, having a plurality of coding variables, wherein the computer program product is designed to execute the method according to the invention when it is run on a device, in particular on a computer or on an industrial automation component. The advantages already discussed with respect to the method can be achieved by means of the computer program.

[0035] According to the invention, during the check, the sum of all dynamic signatures is formed, wherein, in a variant, it is assumed that for each coded variable there is a variable or register or the like associated with the coded variable (preferably uncoded) carrying a corresponding valid (i.e. last changed and currently used in the associated coded variable) value of the dynamic signature. In a variant, the dynamic signature values ​​are stored in an array. This simplifies the summation in the control step. However, it is also possible as an alternative to take out the values ​​of the dynamic signatures from the coded variables in each case by subtracting the static signature from the value of the coded variable and associating the result with the system constant "A" in a modular operation. The implementation of this alternative is expensive (computation time), but it is sufficient without storing the dynamic signatures separately.

[0036] According to the invention, before the comparison, a modular operation with a system constant ("A") for encoding all encoding variables and for encoding the encoding tracking variable is used for the sum of the dynamic signature and for the sum value carried in the tracking variable, respectively and if necessary also multiple times, so as to avoid possible overflow in the case of very large deviation values ​​of the change determined by the access to the dynamic signature.

[0037] Advantageous variants of the method according to the invention are described in the individual exemplary embodiments, the features and advantages of which also apply to the device and computer program product according to the invention.

[0038] In an advantageous variant of the method according to the invention, the coding variable is coded using an AN coding, an ANB coding or an ANBD coding which is successfully incorporated into safety-oriented computer programs, in particular such computer programs in automation technology.

[0039] Advantageously, at each write access to the coded variable, a new or changed dynamic signature is determined for the variable, making it possible to track the number of particularly critical write accesses based on the signature and. Particularly advantageously, at each read access to the coded variable, a new or changed dynamic signature is also determined for the variable.

[0040] Since each encoded variable has its own dynamic signature, when the signature changes, i.e. at each access, only the signature of the variable must be adjusted and the value of the tracking variable changed analogously, whereas in the case of a common dynamic signature of multiple or all variables, which is often common in the prior art, each encoded variable would also have to be changed.

[0041] Advantageously, the change of the dynamic signature is defined in such a way that a certain value, a so-called offset, is always added to or subtracted from the previous dynamic signature of the corresponding coding variable, instead of zero. Thus, successive changes do not undesirably compensate for one another.

[0042] Advantageously, the sum of all signatures, ie the sum of all static signatures and the sum of all dynamic signatures, respectively obtains a correctly encoded value according to the selected encoding. This simplifies the calculation of the sum value and also enables further checks on bit errors in the signatures, etc.

[0043] The advantages of the method are particularly prominent when the computer program is an automation program of an industrial automation component and when at least one check is performed during a cycle of the automation program, preferably at the end of the cycle. On the one hand, cyclical automation programs are often used in safety-critical areas, but on the other hand, due to their cyclical execution structure, they are also well suited to: in their implementation, checks are performed with the help of signatures of coded variables. Advantageously, the complete execution of all program parts that are provided for processing in a corresponding cycle of the computer program is determined as protection against access changes with the help of signature changes. This can be achieved in that the sum of the dynamic signatures encoded in the tracking variables is compared with an expected value, wherein the expected value corresponds to the product of the deviation and the number of expected accesses to the coded variables. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] An embodiment of the method according to the present invention is explained below with reference to the accompanying drawings. At the same time, it is used to explain an embodiment of the device and such a computer program product according to the present invention.

[0045] Figure 1 : Shows protection for the addition of coded variables. DETAILED DESCRIPTION

[0046] In order to control the program execution, in the prior art, run variables are used, so-called trace variables or "tracers" for short, by means of which the program path traversed can be recorded and thus checked. c A dynamic signature for checking all coded variables of a computer program and access to all coded variables of a computer program. This example shows a coded variable x c .

[0047] In the current example, without loss of generality, the variable x c Encoding is done according to the ANBD encoding rules in the following form:

[0048] x c :=x f *A+B x +D x

[0049] Here, D x is the dynamic signature of x. x At regular or irregular intervals, for example in each cycle of a program or in a time-controlled manner. x The change of the dynamic signature is regularly preset from the outside, which means that in the prior art, the change of the dynamic signature is carried out asynchronously with the operation of the computer program, in particular the automation program. xIt is usually constant during a cycle. However, in the present embodiment, Dx changes at each (read or write) access to the coded variable xc; in other variants, Dx can, for example, change only at write accesses. This means that, based on the start value of Dx (initialization value, etc.) and the change value for change at each access, the number of accesses in the basic blocks, i.e. the basic blocks of the program fragment to be linearly traversed of the computer program, is calculated from the current Dx and can be compared with the expected value, so that the complete execution of the program steps can be checked.

[0050] According to the present invention, the D signature is now distributed so that all signatures (B x ;D x ) always results in the correctly encoded ANBD encoded value.

[0051] So it applies that:

[0052] (Σ x B x )mod A=B sum

[0053] (Σ x D x )mod A=D sum

[0054] It is assumed that for each encoding variable the respectively currently valid value of the signature constants Bx and Dx is stored in a separate variable, memory, register or in a bit area of ​​the encoding variable reserved for this purpose.

[0055] B signature is constant. So the sum B Summe The value of the sum is not important here.

[0056] Dynamic signature D Summe The sum is compared with an encoded value Tracerc, the signature of which differs from the signature of the sum by only a fixed value, or the signature is stored correctly in encoded form; the variable thus has the following form:

[0057] Tracer c =A*X+B tracer +D sum

[0058] or

[0059] Tracer c =A*D sum +A 2 *X+B tracer +D tracer

[0060] In these two variants, the value of X is not meaningful to the present invention. Usually, it is used to simplify the Tracer c It can also be used to meet additional safety requirements.

[0061] According to the invention, the sum D of the D signatures of all the encoded variables is calculated at a control point of the computer program, for example at the end of a cycle of the automation program. Summe Additionally, D Summe Also from the encoding trace variable Tracer c The calculations are performed in a variety of ways in the context of the content of , wherein the value of the tracking variable is changed in a similar manner for each access to xc in which the associated Dx is changed.

[0062] The basic block considered here consists of a series of linear calculation steps; in the present example in the figure, a basic block is shown on the right hand side which adds the number “1” to the coding variable xc in the coding arithmetic.

[0063] Each computation step of a basic block makes a fixed number of accesses to the encoded value. Therefore, D Summe Change a constant value. Therefore, D Summe The change of A is constant for the entire basic block (also called "basic block" in the literature). The change (possibly multiplied by A) must also be added to the tracer, i.e. the trace variable Tracer c . Therefore, the tracker is encoded so that it can be checked for correctness.

[0064] In the absence of errors, the following applies: Depending on the selected structure of the trace variable:

[0065] Tracer c =A*X+B tracer +D sum

[0066] or

[0067] Tracer c =A*D sum +A 2 *X+B tracer +D tracer

[0068] The method described above is used to achieve: only return Tracer c The data must be protected using the methods commonly used so far, i.e., they must be stored and processed in coded form, for example; in the case of lower security requirements, Tracer c Therefore, fixed command sequences must be used to supplement actions that change program execution or data to provide only tracers. cProvide protection so that the number of accesses remains consistent with the expected value. So far, the supplement for each relevant coding variable has been carried out separately.

[0069] In a favorable variant, the D signature is corrected such that at a clearly defined location in the basic block (e.g., at the end of the basic block) D Summe corresponds to the ID of the basic block. This results in a simple check feasibility. Since D Summe is cyclically repeated, all of the above checks are not suitable for higher SIL (Safety Integrity Level).

[0070] At the end of the cycle or program, then two criteria are used for the consistency check:

[0071] 1. Tracer c Correct coding

[0072] And

[0073] 2. ((Tracer c - B tracerload – D cyc / A) MOD A = (ΣD x ) MOD A

[0074] Here, it is assumed that the B signature can change; the last valid value of B, i.e., B TracerLast ("the last valid B of the trace variable"), must be used during the consistency check. Similarly, in this example, since the D signature is constant during a cycle, D is used here as D zyk (from D in the current cycle).

[0075] To avoid / control overflow, the value of the trace variable can be limited, for example, by the following operation

[0076] When

[0077] B tracerload – D cyc < A. If applicable,

[0078] Tracer c := Tracer MOD A 2 .

[0079] Tip: A common method to keep the coding variable signature constant is to add constants in the empty paths of branches or loops. If this is only done for Tracer c execution, the complexity of the coding process remains linear with the standard.

[0080] Here, protecting the calculation of Tracer c is secondary. For low safety levels, protection can be dispensed with.

[0081] In this view, x is shown f :=x f +1 for the flow of the encoding operation.

[0082] Here, the left part of the figure shows the addition operation on the tracking variable Tracer c The right part of the figure shows the effect of the variable x in the encoding space c Add 1.

[0083] variable x c is limited to coded variables, where the uncoded variable x f1 or its value multiplied by the system variable A. Additionally, the signature B x and D x Add to the encoded variable x c The value of .

[0084] Setting the value 1 for addition also uses the encoding operation + c Processed in coded form; coded value l c Similarly, the system constant A is multiplied by 1, and the signature B ADD (static signature) and dynamic signature D x constitute.

[0085] In this example, the new dynamic signature D x Dynamic signature D from here x Add B ADD The new dynamic signature D x With variable X c In an alternative (but less secure) implementation, all encoded variables in the system can have the same dynamic signature D x .

[0086] Encoding tracing variables Tracer c The processing is similar to the addition process shown on the right (incrementing by 1) shown on the left side of the figure. c Contains all the dynamic signatures so far in encoded form D x The sum of , where the modulo A operation ensures that no overflow occurs due to the sum. c It also includes its own static signature B Tracer1 and dynamic signature D Zykius (Abbreviated as D zyk ), where it is assumed that the system variable D Zyklus Always keep tracking variables in Tracer c The current dynamic signature.

[0087] Now, the second row of the figure shows the addition process of the tracer variable Tracer c Extensions. In addition to Tracer c In addition to the value so far, first add A multiplied by B ADD , because in the encoding trace variable Tracer c "Useful Content" (D x The sum of the values ​​is multiplied by the system variable A to maintain the value. The tracking variable Tracer is also subtracted. c Static signature B Tracer1 , and the new current static signature B Tracer2 Add to the trace variable Tracer c It can be seen that in this example, instead of the "conventional" static signature B, the tracking variable Tracer c A "quasi-static" signature B with the same changes Tracer1 or B Tracer2 This is advantageous because, although the remaining coded variables in the system now have a dynamic signature D according to the invention x , but just keeps track of the dynamic signature of the variable D Zykius For this reason, it is advantageous here to use the hitherto absolutely static signature B Tracer1 In other embodiments, especially in embodiments requiring a lower SIL (safety integrity level), the tracking variable Tracer can also be abandoned. c This dynamicization of the static signature.

[0088] The trace variable Tracer is shown in the third row from the bottom of the figure. c Checking steps in the evaluation. Here, in the upper row of the comparison operation (“modulo comparison”): Tracking variable Tracer c how the value of is decoded; this corresponds to the method of the prior art. The result must be identical "modulo" to the result of the calculation operation shown in the second row. In this case, a so-called modular comparison of the sum of the dynamic signatures of all coded variables in the system is performed, wherein the sum result is first processed by means of a modular A operation in order to eliminate the influence of a possible overflow of the value exceeding the system constant A. In the case that the comparison operation is not satisfied, it can be assumed that there is an error. In this case, various measures can be provided, such as the output of an error message or the use of safe substitute values ​​for system parameters, etc.

[0089] Dynamic Signature D x The trace variable Tracer cThe sum in is also a measure of the number of accesses to the coding variables. At least for basic blocks (i.e. linear program structures), the number of accesses to the coding variables in each program cycle is fixed. This number can be used as an expected value, which is related to the coding trace variable Tracer c A comparison of the contents of provides information as to whether the program code is being processed in the prescribed manner. Of course, the value of the tracking variable must be decoded for this purpose (line 1) and the result divided by B ADD or another rule offset; alternatively, the expected value can include not the expected number of accesses, but the expected and signature value ∑D x or (ΣD x )MOD A. As already discussed for the case where a difference should exist in the dynamic signature itself, error handling is likewise possible in the event of a difference.

Claims

1. A method for protecting access to at least one coding variable in a computer program having a plurality of coding variables, in, A plurality of or each of said encoding variables has its own dynamic signature, It is characterized in that When accessing the encoding variable, the dynamic signature of the encoding variable is respectively changed in a prescribed manner, carrying in a coded tracking variable the sum of all dynamic signatures of all other coded variables, wherein when the dynamic signature of one of the coded variables changes, the sum carried in the tracking variable is similarly adjusted, and For checking, the sum of the dynamic signature of the coding variable is compared with the sum value stored in the coding tracking variable, wherein an error handling is triggered in the event of a discrepancy, wherein, during the check, said sum value is formed with respect to all dynamic signatures, Therein, before the comparison, a modular operation with a system constant is used for the sum of the dynamic signatures and for the sum value carried in the encoded tracking variable, respectively, wherein the system constant is used for encoding all the encoded variables and for encoding the encoded tracking variable.

2. The method according to claim 1, characterized in that The coding variable is encoded using AN coding, ANB coding or ANBD coding.

3. The method according to claim 1 or 2, characterized in that: During each write access to a coded variable, a new or changed dynamic signature is determined for this variable.

4. The method according to claim 3, characterized in that During each read access to a coded variable, a new or changed dynamic signature is determined for this variable.

5. The method according to claim 1 or 2, characterized in that: The defined manner is implemented by always adding a determined value not equal to zero to the dynamic signature of the corresponding coding variable up to that point, or by always subtracting a determined value not equal to zero from the dynamic signature of the corresponding coding variable up to that point.

6. The method according to claim 1 or 2, characterized in that: The sum of all signatures respectively gives the value correctly encoded according to the chosen encoding.

7. The method according to claim 1 or 2, characterized in that: The computer program is an automation program of the industrial automation component and the check is performed at least once in a cycle of the automation program.

8. The method according to claim 7, characterized in that The checking is performed at least once at the end of the period.

9. The method according to claim 1 or 2, characterized in that: The complete execution of all program parts provided for execution in a respective cycle of the computer program is defined as a change in access protection by means of the signature.

10. A device for protecting access to at least one coding variable in a computer program having a plurality of coding variables, in, The computer program runs on the device or on the industrial automation component, where multiple or each encoded variable has its own dynamic signature, It is characterized in that The device is designed to carry out the method according to claim 1 .

11. The device according to claim 10, characterized in that The computer program runs on a computer.

12. A computer program product for protecting access to at least one coding variable in a computer program having a plurality of coding variables, in, The computer program product is designed to carry out the method according to claim 1 when executed on a device or on an industrial automation component.

13. The computer program product according to claim 12, characterized in that The computer program product is configured to be executed on a computer.

14. The computer program product according to claim 12, characterized in that The computer program product is provided as a part or extension of the firmware or is designed as a part or extension of the operating system of the computer.

15. The computer program product according to claim 14, characterized in that The computer program product is designed as a part or extension of an operating system of a computer of the industrial automation component.

Images