Computer-assisted industrial plant and method for operating computer-assisted industrial plant

Abstract

The invention relates to a computer-assisted industrial device (1), comprising: a plurality of integrity measuring units (2) for each providing an integrity measurement value (IM); the invention relates to an industrial device (1), comprising a verification unit (3) for providing an integrity proof (IA) secured by means of a first cryptographic protection (DS1) for specifying the integrity of the industrial device (1) or of a part of the industrial device (1), the integrity proof (IA) having at least a plurality of provided integrity measurement values (IM), and a confirmation unit (5) connected to the verification unit (3) via a physically secured transmission path (4), the verification unit comprises a verification unit (6) for providing verification information (PI) by means of verifying the verification unit (5) and / or at least one state of the industrial plant (1), and an issuing unit (7) for issuing a verification proof (BA) protected by the second cryptographic protection (DS2) depending on the provided verification information (PI), wherein the confirmation proof (BA) comprises at least a plurality of integrity measurements (IM) of the integrity proof (IA) and information that can be derived from a first cryptographic protection (DS1) of the integrity proof (IA).

Description

Technical Field

[0001] The invention relates to a computer-aided industrial device and a system having a computer-aided industrial device and a backend system coupled to the industrial device via a network. In addition, the invention relates to a method and a computer program product for operating a computer-aided industrial device. Background Art

[0002] The computer-aided industrial device comprises a certification unit for providing a certificate protected by a first cryptographic protection for stating the integrity of the industrial device. The certificate or integrity certificate is a cryptographically protected data structure in order to confirm integrity information of, for example, an execution environment of the industrial device with respect to a communication partner. For example, the communication partner can take this information into account in the case of provisioning / credential management or in the case of critical application functionality (such as online banking).

[0003] In practice, the proof is often formed by a hardware element, in particular by a tamper-proof computing device, for example by a TPM chip (TPM; Trusted Platform Module) or by a secure element integrated in a processor or ASIC. Such hardware-based signatures are usually not updateable. Therefore, RSA signatures, DSA signatures or EC-DSA signatures are usually used. The key lengths supported are usually relatively short, for example 2048 bits in the case of RSA.

[0004] Generally speaking, in industrial application environments, there is often a requirement to use devices securely over a long period of use (e.g., 10 to 30 years). Over such a long period of time, the encryption algorithm used itself may also be weakened due to new attacks, such as by quantum computers, or the implementation of the hardware implementation may have weaknesses.

[0005] If the proof is formed by a hardware element as described above, then in practice the proof often cannot be updated or can only be updated in a costly manner. On the other hand, hardware elements have the advantage, specifically for the proof of integrity information, that they can reliably provide integrity information for characterizing the runtime environment, for example because the information once detected can only be updated but cannot be arbitrarily overwritten or reset. In particular, it is possible that the signature device of the hardware element or the key used by the signature device cannot be updated or at least cannot be updated by the manufacturer or operator of the industrial device. Therefore, it cannot be reliably guaranteed that the integrity proof function provides the long-term applicability and update capability required for industrial devices.

[0006] It is known from document EP 3695377 B1 to pre-process a certificate in terms of content by a validation device and to provide the processed certificate information by the validation device. Summary of the invention

[0007] Against this background, the object of the present invention is to improve the operation of computer-protected industrial systems, in particular with regard to a permanently valid, updateable authentication functionality.

[0008] According to a first aspect, a computer-aided industrial device is proposed, which has a plurality of integrity measurement units for respectively providing integrity measurement values; a proof unit for providing an integrity proof protected by a first cryptographic protection for indicating the integrity of the industrial device or a part of the industrial device, wherein the integrity proof has at least a plurality of provided integrity measurement values; and a confirmation unit connected to the proof unit via a physically protected transmission path. The confirmation unit includes a verification unit and an issuance unit. The verification unit is configured to provide verification information by means of verifying at least one state of the verification unit and / or the industrial device. The issuance unit is configured to issue a confirmation proof protected by a second cryptographic protection based on the provided verification information, wherein the confirmation proof includes at least a plurality of integrity measurement values ​​of the integrity proof and information that can be derived from the first cryptographic protection (DS1) of the integrity proof.

[0009] The attestation unit is in particular a tamper-proof computing device, such as a trusted platform module (TPM), and can in particular also be referred to as a security element, a hardware element or a hardware security component. In particular, the attestation unit cannot be updated or can only be updated with great effort. The confirmation unit is coupled to the attestation unit via a physically protected transmission path. The confirmation unit is in particular implemented as a separate hardware module in the industrial device.

[0010] Due to the confirmation unit, the computer-aided industrial device can form a cryptographically protected confirmation certificate of the cryptographically protected integrity certificate formed by the proof unit. The formed confirmation certificate includes at least the integrity measurement value of the integrity certificate and information derivable from the first cryptographic protection of the integrity certificate.

[0011] This makes it possible to provide permanently valid proofs on industrial systems, wherein the hardware components as proof units are only capable of forming conventional, classical proofs without PQ capabilities (PQ; post-quantum cryptography) at the present time and also in the future.

[0012] Industrial equipment may also be referred to as industrialized equipment. Industrial equipment is especially a real physical device, such as an embedded device or an industrial IoT device. In an embodiment, the industrial equipment may also be a virtual industrial device, such as a virtual machine, application or container on a general computing platform.

[0013] Currently, it is thus possible to protect conventional certificates, i.e. integrity certificates, which are usually standardized and fixedly implemented in hardware and thus cannot be updated, by additional cryptographic protection, currently by using a validation unit. The additional protection by the validation unit is especially updateable, so that the integrity certificate can be reliably evaluated even if the cryptographic method used here should have been weakened. The additional protection here makes it possible to evaluate whether the additional protection carried out is actually permissible in order to protect a specific integrity certificate. Abuse of the additional protection is prevented here.

[0014] The cryptographically protected confirmation certificate can be transmitted to a communication partner of the industrial device, such as a backend system. In particular, the communication partner performs device management / provisioning services for managing and provisioning the industrial device. Before provisioning, such as providing credentials, keys, certificates or security tokens of the industrial device, is released or performed, or before critical device management operations, such as firmware updates, configuration data updates and / or provision of sensitive production data, are performed, the communication partner can verify the cryptographic validity and content permissibility of the integrity certificate and the attached cryptographically protected confirmation certificate.

[0015] In an embodiment, information derived from the first cryptographic protection of the integrity proof corresponds to the first cryptographic protection.For embodiments in which the first cryptographic protection corresponds to the first digital signature, the information may be derived from or correspond to the first digital signature.

[0016] The corresponding integrity measurement value relates in particular to a component of the industrial device, for example to one of the firmware, software, configuration or hardware components of the industrial device. In an embodiment, the industrial device includes a plurality of integrity measurement units, which respectively determine the integrity measurement value and provide it to the certification unit. The integrity measurement can in particular also be a cryptographic hash value of the loaded firmware component or software component and the configuration data. In addition, the result of an integrated self-test function (Built-In Self-Test) can be detected as an integrity measurement. In addition, the hardware fingerprint of the hardware component of the industrial device can also be detected as an integrity measurement.

[0017] Currently, cryptographic protection includes, in particular, integrity protection, authenticity and / or confidentiality.

[0018] According to one specific embodiment, the first cryptographic protection is designed as a first digital signature.

[0019] According to a further embodiment, the second cryptographic protection is designed as a second digital signature.

[0020] According to a further specific embodiment, the attestation unit is designed to provide a cryptographically protected integrity certificate, such that the integrity certificate contains a plurality of integrity measurement values ​​and the first digital signature.

[0021] The integrity proof may also include other information, such as identification information of the industrial device, identification information of the proof unit, and / or reality information such as a timestamp or a counter value.

[0022] According to a further embodiment, the validation unit is designed to provide a cryptographically protected validation certificate, such that the validation certificate comprises at least a plurality of integrity measurement values ​​and a first digital signature of the integrity certificate and a second digital signature of the validation certificate.

[0023] According to another embodiment, the confirmation unit is configured to provide a cryptographically protected confirmation certificate, such that the confirmation certificate includes a plurality of integrity measurement values ​​and a first digital signature of the integrity certificate, a second digital signature of the confirmation certificate and verification information and / or information derivable from the verification information, which indicates the formation of the confirmation certificate in the confirmation unit.

[0024] The verification information itself and the information that can be derived from the verification information have, in particular, the qualifications for describing the formation of a confirmation certificate in the confirmation unit. The verification information or the information that can be derived from the verification information, in particular, forms part of the confirmation certificate information or forms confirmation certificate forming information. The confirmation certificate forming information in particular characterizes the manner in which the confirmation certificate is formed. In an embodiment, the confirmation certificate forming information is a part of the confirmation certificate. Indirectly, the confirmation certificate forming information therefore preferably also allows inference as to the manner in which the integrity confirmation is formed. This additional information enables the recipient of the confirmation certificate to determine whether the manner in which it is formed is considered to be permitted according to pre-given guidelines or policies. Based on this, the recipient accepts or does not accept the integrity certificate confirmed by the confirmation certificate.

[0025] The confirmation certificate formation information may include, in particular, the following partial information for characterizing the formation method of the confirmation certificate:

[0026] - Device identifiers of industrial equipment, such as serial numbers and / or software versions;

[0027] Confirmation of the unit's own system integrity by means of a PQ signature (PQ; post-quantum cryptography), for example by means of a PQ-TPM, or by a certificate transmitted via a PQ secure transmission path;

[0028] - the currently existing operating mode of the industrial device on which the validation evidence is formed, e.g. service, operation, startup, firmware update, fault;

[0029] - The type of execution environment, e.g., SGX enclave, Trusted Execution Environment (TEE), cryptographic controller, hardware security module (HSM) in which the validation proof is formed;

[0030] - current environment information of the execution environment in which the proof of verification is formed, such as time information or position information, which is determined, for example, by a positioning system or with the aid of a satellite-aided navigation system, such as GPS, GALILEO, BEIDOU, GLONASS;

[0031] - Verifying the provided integrity proof, for example verifying a digital signature of the integrity proof, evaluating or plausibility checking the integrity information certified by the integrity proof on content, and / or verifying the interface via which the integrity proof was received.

[0032] According to another embodiment, the confirmation certificate includes an integrity certificate in encrypted form. For this purpose, when the confirmation certificate is formed by the confirmation unit, the current integrity certificate is encrypted in a cryptographic manner.

[0033] According to a further embodiment, the authentication unit comprises a first storage unit protected from external access for storing first cryptographic credentials assigned to the first cryptographic protection.

[0034] According to another embodiment, the confirmation unit comprises an updateable second storage unit for storing second cryptographic credentials assigned to the second cryptographic protection. In an embodiment, the implementation, for example firmware and / or software, for forming the second cryptographic protection is also updateable.

[0035] According to a further specific embodiment, the first cryptographic protection is designed as a first digital signature and the first cryptographic credential is designed as a private key assigned to the first digital signature.

[0036] According to a further specific embodiment, the second cryptographic protection is designed as a second digital signature and the second cryptographic credential is designed as a private key assigned to the second digital signature.

[0037] According to a further embodiment, the checking unit is connected to a plurality of physical sensors installed in or at the industrial device for providing sensor signals indicative of a status of the validation unit and / or the industrial device.

[0038] The physical sensors are designed, in particular, to determine temperature, air pressure, air humidity, vibrations, acceleration and / or to detect physical manipulations.

[0039] According to another embodiment, the inspection unit is configured to provide inspection information for inspecting the firmware status of the confirmation unit, for inspecting the output signal of a housing protection switch of the industrial device, for inspecting the output signal of an anti-tampering sensor of the industrial device, for inspecting the output signal of a voltage sensor for monitoring the voltage supply of the industrial device, and / or for inspecting whether the current temperature provided by a temperature sensor installed in or at the industrial device is within a predetermined temperature range.

[0040] According to another embodiment, the validation unit comprises an integrity checking unit, which is in particular connected upstream of the issuing unit. The integrity checking unit is configured to locally check the validity of the integrity certificate provided by the certification unit. In this case, the integrity checking unit in particular checks the digital signature of the integrity certificate. Additionally or alternatively, the integrity checking unit can also evaluate the integrity measurement value that is part of the integrity certificate in terms of content and in particular check the integrity measurement value with regard to reality and / or plausibility.

[0041] According to a further embodiment, the attestation unit is designed as a tamper-proof computing device. The tamper-proof computing device is in particular a Trusted Platform Module (TPM).

[0042] According to a further embodiment, the industrial plant has a single housing in which the identification unit, the validation unit and a physically protected transmission path connecting the identification unit and the validation unit are arranged.

[0043] According to a further embodiment, the industrial device has a housing in which the authentication unit is arranged, wherein the authentication unit is designed as a plug-in module for plugging onto a bus of the industrial device.

[0044] According to a further embodiment, the industrial device has a push-in housing, wherein the validation unit or the validation unit and the identification unit are designed as corresponding push-in modules for insertion into the push-in housing.

[0045] The corresponding units, such as the certification unit, the checking unit or the issuing unit, can be implemented in hardware and / or in software. In the case of hardware implementation, the corresponding unit can be designed as a device or a part of a device, for example as a computer or a microprocessor or an integrated circuit. In the case of software implementation, the corresponding unit can be designed as a computer program product, a function, a routine, a part of a program code or an executable object.

[0046] According to a second aspect, a system is proposed, which includes a computer-assisted industrial device according to the first aspect or one of the embodiments of the first aspect and a back-end system coupled to the industrial device via a network, and the back-end system is configured to verify a confirmation certificate issued by the industrial device for determining the integrity of the industrial device.

[0047] The confirmation certificate issued by the industrial device is provided to the system via the network for verification. Based on the verification of the confirmation certificate and the integrity certificate confirmed thereby, a security-related action can be released or initiated by the system. This can be in particular the provision or verification of cryptographic keys to the industrial device or to the verification unit. In this case, the confirmation certificate can be protected in particular by a PQ signature or by transmission via a PQ secure transmission path, for example using a key encapsulation method (KEM method, KEM: Key Encapsulation Mechanism) such as KEMTLS.

[0048] The backend system is, for example, a cloud system, an edge cloud system or a production monitoring system. Here, the backend system can also be a system located locally in a factory with industrial equipment.

[0049] According to a third aspect, a computer-implemented method for operating a computer-aided industrial device is provided. The method comprises the steps of:

[0050] providing a plurality of integrity measurement values ​​by means of at least one integrity measurement unit of the industrial device,

[0051] Providing an integrity certificate protected by a first cryptographic protection for stating the integrity of the industrial device or a part of the industrial device, wherein the integrity certificate has at least a plurality of provided integrity measurement values, and

[0052] By means of checking at least one state of the verification unit and / or the industrial device, verification information is provided and a verification certificate protected by a second cryptographic protection is issued based on the provided verification information, wherein the verification certificate includes at least a plurality of integrity measurement values ​​of the integrity certificate and information derivable from the first cryptographic protection of the integrity certificate.

[0053] The embodiments and features described for the proposed industrial plant apply correspondingly to the proposed method.

[0054] According to a fourth aspect, a computer program product is proposed which, on a program-controlled device, causes the execution of the method explained above according to the third aspect or one of the embodiments of the third aspect.

[0055] The computer program product, such as a computer program device, can be provided or supplied, for example, as a storage medium, such as a memory card, USB stick, CD-ROM, DVD or also in the form of a file downloadable from a server in a network. This can be done, for example, in a wireless communication network by transmitting a corresponding file with the computer program product or computer program device.

[0056] Other possible implementations of the present invention also include combinations not explicitly mentioned of features or embodiments described above or below with respect to the embodiments. Here, those skilled in the art will also add individual aspects as improvements or supplements to the corresponding basic forms of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Further advantageous embodiments and aspects of the invention are the subject matter of the dependent claims of the invention and of the exemplary embodiments described below. The invention is explained in more detail with reference to the drawings based on preferred embodiments.

[0058] Figure 1 A schematic block diagram of a first exemplary embodiment of a computer-aided industrial device is shown.

[0059] Figure 2 A schematic diagram showing an embodiment of integrity proof;

[0060] Figure 3 A schematic diagram showing an embodiment of a confirmation certificate;

[0061] Figure 4 A schematic block diagram of a second exemplary embodiment of a computer-aided industrial device is shown.

[0062] Figure 5 A schematic block diagram illustrating one embodiment of a system having a computer-aided industrial device; and

[0063] Figure 6 A schematic flow chart of an exemplary embodiment of a method for operating a computer-aided industrial system is shown. DETAILED DESCRIPTION

[0064] In the figures, identical or functionally identical elements are provided with the same reference symbols unless otherwise indicated.

[0065] Figure 1 A schematic block diagram of a first embodiment of a computer-aided industrial device 1 is shown. The industrial device 1 is computer-aided and therefore comprises computing and storage capabilities, in particular a computer or a microprocessor and at least one memory, such as a RAM memory and / or a ROM memory.

[0066] Reference Figure 2 and 3 Explanation Figure 1 Embodiment of the invention. Figure 1The industrial device 1 comprises an integrity measurement unit 2, a proof unit 3 and a confirmation unit 5 connected to the proof unit 3 via a physically protected transmission path 4. The confirmation unit 5 comprises a verification unit 6 and an issuance unit 7. The proof unit 3 is in particular designed as a tamper-proof computing device. The tamper-proof computing device is, for example, a trusted platform module (TPM). The integrity measurement unit 2 is, for example, a measurement trust root unit (RTM).

[0067] The integrity measurement unit 2 is designed to provide an integrity measurement value IM. The integrity measurement value IM relates in particular to a component of the industrial device 1 , for example to a firmware, software, configuration or hardware component of the industrial device 1 .

[0068] The certification unit 3 receives the integrity measurement value IM and provides at the output a data record for indicating the integrity of the industrial device 1 or a part of the industrial device 1 protected by a first cryptographic security DS1 (see Figure 2 ) protected integrity certificate IA. The first cryptographic protection DS1 is in particular constructed as a first digital signature. The integrity certificate IA is, for example - as in Figure 2 , as shown in , including the provided integrity measurement value IM and the first digital signature DS1. It is also possible that the proving unit 3 confirms the integrity measurement value in the integrity proof IA formed by it, which is formed from the integrity measurement value IM received from the integrity measurement unit 2. The proving unit 3 can, for example, determine a cryptographic hash value from the integrity measurement value IM received from the integrity measurement unit 2 and confirm the cryptographic hash value as the integrity measurement value in the integrity proof IA.

[0069] The checking unit 6 is designed to provide a check information item PI by means of checking the verification unit 5 and / or at least one state of the industrial device 1 .

[0070] The issuing unit 7 is configured to issue a confirmation certificate BA protected by a second cryptographic protection DS2 based on the provided verification information PI and to make the confirmation certificate available at the output. Figure 3 In an embodiment of the present invention, the confirmation certificate BA comprises a first digital signature DS1 of the provided integrity measurement value IM and integrity certificate IA, a second digital signature DS2 of the confirmation certificate BA and verification information PI or information derivable from the verification information PI, which indicates that the confirmation certificate BA was formed in the confirmation unit 5. Figure 3 In an alternative illustration of , the second digital signature DS2 could also be displayed on the far right, since the second digital signature preferably also protects the verification information PI.

[0071] The second digital signature DS2 can preferably protect the integrity of the integrity measurement value IM, the first digital signature DS1 and the verification information PI. It should be emphasized that not only the verification information PI itself but also the information that can be derived from the verification information PI has the following qualification: it indicates that the confirmation certificate BA is formed in the confirmation unit 5 or the confirmation certificate BA is formed in the non-manipulation confirmation unit 5. In addition, the verification information PI itself and the information that can be derived from the verification information PI can have the following qualification: it indicates that the detection of the integrity measurement value IM by the integrity measurement unit 2, the transmission of the integrity measurement value IM from the integrity measurement unit 2 to the proof unit 3, the formation of the integrity certificate IA by the proof unit 3 and / or the transmission of the integrity certificate IA from the proof unit 3 to the confirmation unit 5 via the physically protected transmission path 4 is carried out in a non-manipulation manner.

[0072] The industrial device 1 comprises, for example, a single housing in which the authentication unit 3 , the validation unit 5 and a physically protected transmission path 4 connecting the authentication unit 3 and the validation unit 5 are arranged.

[0073] In an alternative embodiment, the industrial device 1 comprises a housing in which the authentication unit 3 is arranged, wherein the confirmation unit 5 is designed as a plug-in module for plugging onto a bus (not shown) of the industrial device 1 .

[0074] In an alternative embodiment, the industrial device 1 comprises a push-in housing, wherein the validation unit 5 or the validation unit 5 and the identification unit 3 are designed as respective push-in modules for insertion into the push-in housing.

[0075] Figure 4 A schematic block diagram of a second exemplary embodiment of a computer-aided industrial device 1 is shown. Figure 4 A second embodiment comprises according to Figures 1 to 3 The invention also has all the features of the first exemplary embodiment of the present invention and further comprises an integrity unit 8 arranged in the certification unit 3 with a storage unit 9 and a signature unit 10 as well as a register 11 . Figure 4 The confirmation unit 5 comprises a verification unit 6 , an issuance unit 7 having a storage unit 14 and a signature unit 15 , and an integrity verification unit 12 . Figure 4 The inspection unit 6 is coupled to a plurality of sensors 13. Without limiting the generality, Figure 4 Two sensors 13 are shown.

[0076] also, Figure 4 The industrial device 1 has a CPU 16, a RAM memory 17, an SSD memory 18, a boot loader 19, an operating system 20, an execution environment 21, and a plurality of application programs 22. Figure 4In the embodiment of the present invention, the integrity measurement unit 2 is arranged in the execution environment 21. The execution environment 21 is, for example, a real-time environment. In addition, other integrity measurement units 2 may be arranged, for example, in the boot loader 19 and in the operating system 20. The integrity measurement value IM provided by the integrity measurement unit 2 is stored in the register 11 of the proof unit 3.

[0077] The memory unit 9 of the authentication unit 3 is in particular a memory unit which is protected from external access and stores a first cryptographic certificate K1 which is associated with the first cryptographic protection DS1. The cryptographic certificate K1 is, for example, a private key of the authentication unit 3.

[0078] In contrast, the memory unit 14 of the confirmation unit 5 is designed as an updateable memory unit and stores a second cryptographic certificate K2 which is assigned to the second cryptographic protection DS2. The second cryptographic certificate K2 is, for example, a private key of the confirmation unit 5.

[0079] The sensor 13 already mentioned above is installed in or at the housing of the industrial device 1 and has the qualification of providing a sensor signal SS which indicates the state of the confirmation unit 5 and / or the state of the industrial device 1 .

[0080] In this case, the inspection unit 6 is particularly configured to inspect the firmware status of the confirmation unit 5, to inspect the output signal of the housing protection switch of the industrial device 1, to inspect the output signal of the anti-tampering sensor of the industrial device 1, to inspect the output signal of a voltage sensor for monitoring the voltage supply of the industrial device 1, and / or to inspect whether the current temperature provided by a temperature sensor installed in or at the industrial device 1 is within a predetermined temperature range in order to provide the inspection information PI.

[0081] As mentioned above, the validation unit 5 comprises an integrity checking unit 12, which is connected in particular upstream of the issuing unit 7. The integrity checking unit 12 is configured to locally check the validity of the integrity certificate IA provided by the certification unit 3. In this case, the integrity checking unit 12 in particular checks the digital signature DS1 of the integrity certificate IS. Additionally or alternatively, the integrity checking unit 12 can also evaluate the integrity measurement value IM which is part of the integrity certificate IS in terms of content and in particular check the integrity measurement value with regard to reality and / or plausibility.

[0082] exist Figure 5 2 shows a schematic block diagram of an embodiment of a system having a computer-aided industrial device 1, a network 23 and a backend system 24. Figure 5 Industrial equipment 1 based on Figure 4Implementation of industrial device 1. Network 23 couples industrial device 1 and backend system 24. Network 23 may include IP, WLAN and / or other systems and subnets. Industrial device 1 - as described above Figure 4 As explained in detail, the confirmation certificate BA is provided on the output side. The confirmation certificate BA is transmitted via the network 23 to a backend system 24. The backend system 24 is configured to check the confirmation certificate BA issued by the industrial device 1 in order to determine the integrity of the industrial device 1.

[0083] The backend system 24 is, for example, a cloud system, an edge cloud system, or a production monitoring system. As shown in the example of the production monitoring system, the backend system 24 can also be a system located locally in a factory including the industrial device 1 .

[0084] exist Figure 6 Detailed description of the invention A schematic flow chart of an exemplary embodiment of a method for operating a computer-aided industrial system 1 is shown in FIG. Figures 1 to 5 An embodiment of an industrial plant 1 is shown. Figure 6 The method comprises steps S1, S2 and S3:

[0085] In step S1 , at least one integrity measurement value IM is provided by means of the integrity measurement unit 2 of the industrial device 1 .

[0086] In step S2, an integrity certificate IA is provided, which is protected by a first cryptographic security DS1 and serves to indicate the integrity of the industrial installation 1 or a part of the industrial installation 1. In this case, the integrity certificate IA comprises at least the provided at least one integrity measurement value IM.

[0087] In step S3, verification information PI is provided by means of at least one state of the verification verification unit 5 and / or the industrial device 1, and based on this, a verification certificate BA protected by a second cryptographic protection DS2 is provided according to the provided verification information PI. In this case, the verification certificate BA comprises at least a plurality of integrity measurement values ​​IM of the integrity certificate IA and information derivable from the first cryptographic protection DS1 of the integrity certificate IA.

[0088] Although the present invention has been described based on the embodiments, the present invention can be modified in various ways.

Claims

1. A computer-aided industrial device (1) comprising: A plurality of integrity measurement units (2) are used to respectively provide integrity measurement values ​​(IM), A proof unit (3) for providing an integrity proof (IA) protected by a first cryptographic protection (DS1) for stating the integrity of the industrial device (1) or a part of the industrial device (1), wherein the integrity proof (IA) has at least a plurality of provided integrity measurement values ​​(IM), and A confirmation unit (5) connected to the certification unit (3) via a physically protected transmission path (4), the confirmation unit comprising: a checking unit (6) for providing checking information (PI) by means of checking at least one state of the verification unit (5) and / or of the industrial device (1), and An issuing unit (7) for issuing a confirmation certificate (BA) protected by a second cryptographic protection (DS2) based on provided verification information (PI), wherein the confirmation certificate (BA) comprises at least a plurality of integrity measurement values ​​(IM) of the integrity certificate (IA) and information that can be derived from the first cryptographic protection (DS1) of the integrity certificate (IA).

2. The industrial equipment according to claim 1, characterized in that The first cryptographic protection (DS1) is designed as a first digital signature (DS1), and / or The second cryptographic protection (DS2) is designed as a second digital signature (DS2).

3. The industrial equipment according to claim 2, characterized in that The attestation unit (3) is configured to provide a cryptographically protected integrity attestation (IA), such that the integrity attestation (IA) comprises a plurality of integrity measurement values ​​(IM) and a first digital signature (DS1), and / or The validation unit (5) is configured to provide a cryptographically protected validation certificate (BA), such that the validation certificate (BA) comprises at least a plurality of integrity measurement values ​​(IM) and a first digital signature (DS1) of the integrity certificate (IA) and a second digital signature (DS2) of the validation certificate (BA).

4. The industrial equipment according to claim 3, characterized in that The confirmation unit (5) is configured to provide a cryptographically protected confirmation certificate (BA), such that the confirmation certificate (BA) includes a plurality of integrity measurement values ​​(IM) and a first digital signature (DS1) of the integrity certificate (IA), a second digital signature (DS2) of the confirmation certificate (BA) and verification information (PI) and / or information that can be derived from the verification information (PI), wherein the information indicates the formation of the confirmation certificate (BA) in the confirmation unit (5).

5. The industrial plant according to any one of claims 1 to 4, characterized in that The certification unit (3) has a first storage unit (9) for storing a first cryptographic credential (K1) assigned to the first cryptographic protection (DS1) and protected from external access, and / or the confirmation unit (5) has an updateable second storage unit (14) for storing a second cryptographic credential (K2) assigned to the second cryptographic protection (DS2).

6. The industrial equipment according to claim 5, characterized in that The first cryptographic protection (DS1) is designed as a first digital signature (DS1), and the first cryptographic certificate (K1) is designed as a private key (K1) assigned to the first digital signature (DS1), and / or The second cryptographic protection (DS2) is designed as a second digital signature (DS2), and the second cryptographic certificate (K2) is designed as a private key (K2) assigned to the second digital signature (DS2).

7. The industrial plant according to any one of claims 1 to 6, characterized in that The verification unit (6) is connected to a plurality of physical sensors (13) installed in or at the industrial device (1) for providing sensor signals (SS) indicating the status of the confirmation unit (5) and / or the industrial device (1).

8. The industrial plant according to any one of claims 1 to 7, characterized in that In order to provide the verification information (PI), the verification unit (6) is configured to verify the firmware status of the confirmation unit (5), to verify the output signal of the housing protection switch of the industrial device (1), to verify the output signal of the anti-tampering sensor of the industrial device (1), to verify the output signal of the voltage sensor for monitoring the voltage supply of the industrial device (1), and / or to verify whether the current temperature provided by a temperature sensor installed in or at the industrial device (1) is within a predetermined temperature range.

9. The industrial plant according to any one of claims 1 to 8, characterized in that The attestation unit (3) is designed as a tamper-proof computing device, in particular as a trusted platform module (TPM).

10. The industrial plant according to any one of claims 1 to 9, characterized in that The industrial device (1) has a single housing in which the authentication unit (3), the verification unit (5) and a physically protected transmission path (4) connecting the authentication unit (3) and the verification unit (5) are arranged.

11. The industrial plant according to any one of claims 1 to 9, characterized in that The industrial device (1) has a housing in which the authentication unit (3) is arranged, wherein the confirmation unit (5) is designed as a plug-in module for plugging into a bus of the industrial device (1).

12. The industrial plant according to any one of claims 1 to 9, characterized in that The industrial device (1) has a push-in housing, wherein the confirmation unit (5) or the confirmation unit (5) and the identification unit (3) are designed as corresponding push-in modules for insertion into the push-in housing.

13. A system having A computer-aided industrial device (1) according to any one of claims 1 to 12, and A backend system (24) is coupled to the industrial device (1) via a network (23), and is configured to verify a validation certificate (BA) issued by the industrial device (1) in order to determine the integrity of the industrial device (1).

14. A computer-implemented method for operating a computer-aided industrial device (1), comprising: Providing (S1) an integrity measurement value (IM) by means of an integrity measurement unit (2) of an industrial device (1), Providing (S2) an integrity certificate (IA) protected by a first cryptographic protection (DS1) for stating the integrity of the industrial device (1) or a part of the industrial device (1), wherein the integrity certificate (IA) has at least a plurality of provided integrity measurements (IM), and By means of a verification confirmation unit (5) and / or at least one state of the industrial device (1), verification information (PI) is provided (S3) and a verification certificate (BA) protected by a second cryptographic protection (DS2) is issued based on the provided verification information (PI), wherein the verification certificate (BA) includes at least a plurality of integrity measurement values ​​(IM) of the integrity certificate (IA) and information that can be derived from the first cryptographic protection (DS1) of the integrity certificate (IA).

15. A computer program product which causes the method according to claim 14 to be performed on a program-controlled device.

Images