Method for verifying first time recording unit of field device of automation technology

Abstract

The invention relates to a method for verifying a first time recording unit of a field device of automation technology. Wherein the first time recording unit supplies a first date and / or a first time to the field device, the method comprising: receiving, at the field device, a ticket, where the ticket comprises at least cryptographic protection information and a timestamp, where the timestamp is obtained from the second time recording unit, and where the timestamp comprises a second date and / or a second time; performing a trust evaluation of the timestamps contained in the bill, wherein the credibility of the second time recording unit is checked with respect to the first time recording unit during the trust evaluation; if the trust evaluation shows that the second time recording unit is more trusted than the first time recording unit: a) comparing the first date or time with the second date or time, b) creating a warning message if a deviation between the first date or time and the second date or time is determined to be greater than a predetermined factor.

Description

Technical Field

[0001] The invention relates to a method for verifying a first time entry unit of a field device in automation technology, wherein the time entry unit supplies a first date and / or a first time to the field device. Background Art

[0002] Field devices used in industrial facilities are already known from the prior art. Field devices are generally used in process automation engineering and manufacturing automation engineering. In principle, all devices that are process-oriented and supply or process process-related information are referred to as field devices. Therefore, field devices are used to detect and / or influence process variables. Measuring devices or sensors are used to detect process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, filling level measurement, etc., and detect corresponding process variables of pressure, temperature, conductivity, pH value, filling level, flow, etc. Actuators are used to influence process variables. These are, for example, pumps or valves, which can influence the flow of fluids in pipes or the filling level in tanks. In addition to the above-mentioned measuring devices and actuators, field devices are also understood to include remote I / O, radio adapters, or devices that are generally arranged at the field level.

[0003] A plurality of such field devices are produced and sold by the Endress+Hauser group.

[0004] In modern industrial plants, field devices are usually connected via a fieldbus ( , , The superordinate unit is connected to a superordinate unit via a communication network (such as a control system, a control unit, ...

[0005] Protocols such as the Internet Network Time Protocol (NTP, RFC 958) are known for the distribution of time information and synchronization of clocks, but they require a direct IP network connection between the device and the time server, which is usually not available in the case of field devices.

[0006] The mobile control unit can also be used to operate field devices that have implemented the FDT frame application. For example, there is a control unit connected to a fieldbus network. However, the control unit can also communicate with the field device via a wireless communication connection, in particular based on the Bluetooth standard. The applicant produces and sells a device that allows the control unit to be coupled to the field device as a so-called Bluetooth gateway. The field device is connected to the Bluetooth gateway via a wire, in particular using the HART or CDI communication standard. Alternatively, the field devices themselves have their own Bluetooth interface.

[0007] In contrast to field devices, operating units have at least temporary access to the network infrastructure and can synchronize their clocks using mechanisms such as those listed in RFC 958.

[0008] If a mobile device such as a smartphone or tablet is used as the control unit for wireless communication with the field device, applications (so-called apps) are available which make the operating functions of the field device available to the mobile device.

[0009] In industrial environments, most installed field devices have no or only very basic protection against unauthorized access. In these field devices, all device parameters can usually be accessed directly or, for example, after entering an unlock code. As a provision of the German Federal Security Act ( ), more and more field devices are entering the market with individual user accounts and role-based authorization. For access via a user interface or machine interface, authorization is required that is "permanent" in some sense, which is usually authorized by a previous authentication. Authorization must be chosen in such a way that the accessing users (permanently) have all the authorizations they need to perform their tasks.

[0010] In order to reduce the management effort for managing individual field devices to an acceptable level, there are isolated efforts for centralized management, as is common practice in the IT field for IT devices such as printers, workstations, etc. An example of such a concept is disclosed in DE 10 2018 102608 A1, wherein a transmission device is provided to which user data is transferred from a user database, wherein access to the field device is granted after checking the user data.

[0011] There is also the idea of ​​limiting the access permissions required by people to a minimum. For example, DE102019131860 A1 discloses providing a digital order ticket transmitted from a server to a mobile device, which order ticket contains access rights and authorization tasks for field devices. When a connection is established with a field device, the order ticket is sent. If authorization is available, the tasks contained in the order ticket, such as the execution of parameterized actions or functional tests, can be processed with the field device.

[0012] In particular, in the case of so-called "asynchronous communication", it is assumed that the order ticket is not sent directly to the field device from an issuing unit such as a ticket server or a user database, for example via a network connection, but to the above-mentioned transmission device (for example, a USB stick or a mobile device such as a smartphone or tablet). The transmission device then sends the order ticket to the field device. This can be achieved, for example, by the user plugging a USB stick with the order ticket into a corresponding interface on the field device and reading the data from the order ticket there.

[0013] Due to the transmission route of the transmission device, it cannot be guaranteed that the order tickets will arrive at the field device in the order in which they were created. For example, the first order ticket can be created by the ticket server with the information "Tablet with public key XYZ belongs to the industrial plant and is authorized to access plant part A - signed by the ticket server on July 13, 2023".

[0014] For example, a second order ticket may be created with the message "Tablet with public key XYZ was reported as stolen and is no longer authorized to access - signed by the ticket server on October 10, 2023."

[0015] As can be seen from the above examples, the time sequence of instructions for order tickets is a critical task, for example, because as a rule, order tickets issued later must be given priority over order tickets issued earlier.

[0016] Field devices have a system time. This is usually provided via an operating time counter (logical clock) that does not provide real time. However, as a rule, field devices have their own real-time clock, which can also be buffered in the event of a power failure, for example using a battery. However, in the event of an empty battery buffer or a power failure, situations may arise where the field device's own real-time clock cannot be trusted. Occasional or systematic timing deviations with continuous operating time may also lead to deviations between the time provided by the real-time clock and the actual correct time. Summary of the invention

[0017] Based on this problem, the invention is based on the object of specifying a method which makes it possible to state the correct temporal interpretation of an order ticket arriving at a field device.

[0018] The invention is achieved by a method for verifying a first time entry unit of a field device of automation technology, wherein the time entry unit supplies a first date and / or a first time to the field device, the method comprising:

[0019] - receiving a ticket at the field device, wherein the ticket comprises at least cryptographically protected information and a time stamp, wherein the time stamp is obtained from a second time recording unit, and wherein the time stamp contains a second date and / or a second time;

[0020] - performing a trust evaluation of the time stamp contained in the ticket, wherein during the trust evaluation the trustworthiness of the second time entry is checked against the first time entry;

[0021] - In the event that the trust evaluation indicates that the second time recording unit is more trustworthy than the first time recording unit:

[0022] a) comparing a first date or a first time with a second date or a second time,

[0023] b) Creating a warning message if a deviation greater than a predetermined factor is determined between the first date or first time and the second date or second time.

[0024] Therefore, the method according to the invention makes it possible to check the plausibility of the ticket arriving at the field device relative to the system time of the field device and / or the system time of the ticket server. The ticket is a digital tamper-proof data packet, which contains additional data in addition to the signature of the unit that issues the ticket, such as the ticket server. For example, if the ticket is an order ticket, the additional data is the authorization of the operating unit to perform a defined task on the field device. In addition to the authorization for the task, the ticket can also contain, for example, the valid value range of the field device parameter to be written. With the help of the signature, the recipient of the ticket is able to check the authenticity and integrity of the ticket. For this verification, the field device needs the encryption-related information of the ticket server. The encryption-related information is, for example, the public key of a key pair (where the key pair consists of a private key written to the field device and the corresponding corresponding public key). Alternatively, it is the information required for the so-called "challenge", with which the field device and the ticket server establish a trust relationship.

[0025] If the first date or first time differs from the second date or second time by a predetermined factor, so that a warning message is generated, there is a plausibility problem. This can be caused, for example, by the fact that the transport route of the bill is too long, so that the first date or first time is more than the predetermined factor before the second date or second time. Another reason can be the fact that the first time recording unit of the field device has a deviation, so that the first date or first time is more than the predetermined factor before or after the second date or second time.

[0026] The first time recording unit of the field device is in particular a real-time clock (RTC) or an operating time counter. The second time recording unit is in particular an accurate real-time clock.

[0027] The warning message may be sent back to the unit that issued the original ticket, for example in the form of a return ticket. It may also be provided that the warning message is displayed on a display of the field device, or by means of a visual indicator, such as a flashing display or LED of the field device. It may also be provided that the warning message is output via a local interface of the field device or a fieldbus interface.

[0028] The field devices cited in connection with the method according to the invention have already been listed as examples in the background part of the description.

[0029] One version of the method provides that a warning message is created only if the timestamp of the ticket is older than the timestamps of all tickets received so far by the field device. In this case, the transmission route of the ticket to the field device is taken into account. This assumes that the timestamps of the tickets received so far are correct. Tickets that have experienced long delays on the transmission route and contain outdated commands or information are thereby detected. In addition to the warning message, actions can also be performed, such as not allowing the execution of the command contained in the ticket in question.

[0030] According to one embodiment of the method, it is provided that the trust evaluation is only performed if the field device can successfully verify the cryptographically protected information. As a result, manipulation by third parties can be prevented.

[0031] According to a first variant of the method, the ticket is created by a ticket server, wherein the ticket server sends the ticket to the field device, wherein a second time recording unit is assigned to the ticket server, wherein the second time recording unit assigned to the ticket server has a higher trust evaluation than the first time recording unit of the field device. Therefore, it is assumed that the second time recording unit has more correct or more accurate information than the first time recording unit.

[0032] An embodiment of a first variant of the method provides that the sending of the ticket is performed via the operating unit by the ticket server sending the ticket to the operating unit and by the operating unit sending the ticket to the field device. Alternatively, the ticket can be sent via a storage medium such as a USB stick.

[0033] According to a second variant of the method, the ticket is created by the operating unit, wherein the operating unit sends the ticket to the field device, wherein a second time recording unit is assigned to the operating unit, and wherein the second time recording unit assigned to the operating unit only has a higher trust evaluation than the first time recording unit of the field device if the operating unit is known to the field device. As a result, manipulation by third parties is prevented. Advantageously, proof can be provided that the ticket server has sent a certificate as a trusted time source to the operating unit, wherein the operating unit incorporates the certificate into the ticket and sends it to the field device, wherein the field device only performs the steps after receiving the ticket if the field device FG can successfully verify the certificate.

[0034] A further development of the method provides that the first time recording unit is reset to the second date or second time if the second date or second time satisfies at least one plausibility condition. As a result, timing differences of the first time recording unit of the field device can not only be detected but also corrected.

[0035] In particular, it is provided that a third time recording unit is assigned to an operating unit, wherein the operating unit sends the ticket together with a third date and / or a third time obtained from the third time recording unit to the field device, wherein the rationality condition is met in the case where the third date and / or the third time substantially matches the second date or the second time. Here, the rationality check is performed by the field device. As a result, for the new time of the field device, inaccurate time information that may be caused by delays on the transmission route between the ticket server and the field device is not taken into account. "Substantially" depends on the specific requirements for the accuracy of the time or date of the field device. For example, if the first date of the field device needs to be corrected to the exact day, the second date and the third date must match. For example, if the first time of the field device is to be corrected, the second time and the third time must match to the minute.

[0036] According to one embodiment of the method, a mobile device, in particular a tablet or a smartphone, is used as operating unit.

[0037] In particular, it is provided that the operating unit sends the ticket to the field device via a wireless communication connection, in particular based on Bluetooth or WiFi. However, other suitable communication protocols or standards may also be used. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The present invention is explained in more detail with reference to the following drawings. In the drawings:

[0039] Figure 1 An exemplary embodiment of a system according to the invention is shown. DETAILED DESCRIPTION

[0040] Regarding security, the reliability of timestamps is also becoming increasingly important in the context of industrial control technology such as central offices and field devices. In this context, field devices FG are understood to mean various types of control technology such as central offices, controllers, sensors or actuators. Time is becoming increasingly important for various operations and authorization checks of field devices FG. These include in particular:

[0041] -Timestamp-based validity checks for cryptographic certificates, e.g., authentication checks for protocols such as TLS or IPSEC;

[0042] - Time-limited authorization of access to a human user or device (e.g. temporary employee access); and / or

[0043] - A locking instruction (eg for removing the access authorization stored in the field device FG after the tablet HMI interface has been reported as stolen).

[0044] For this purpose, the field device FG has a first time recording unit RTC1 which supplies the field device FG with a first time and / or a first date.

[0045] Particular challenges are posed by field devices FG which do not have a permanently available online connection and which receive asynchronous instructions from a central office via certificates or TI tickets or which have access to a network time synchronization protocol such as NTP (RFC 958). Within the meaning of this application, the term "central office" is understood to refer in particular to so-called certificate issuing authorities, as they are known in the context of the Internet under the terms "certificate authority" (CA) or the like. In this case, for example, a ticket server TS located in the system network forms such a central office.

[0046] For the use of a ticket-based system, it is important to establish a position of trust between the central office and the field device FG during commissioning of the field device FG so that the field device FG can be configured such that the certificates and tickets TI issued by the central office are trustworthy.

[0047] Within the meaning of the present application, certificates and tickets TI are understood to mean digitally encoded data blocks, which are characterized by the fact that they contain a data area on the one hand and a verifiable digital signature of a central authority on the content of this data area on the other hand. Within the meaning of the present application, signatures are understood to mean conventional cryptographic signatures based on asymmetric key pairs (elliptic curve, RSA, Kyber, MacElice, etc.) and so-called message authentication codes such as (HMAC, CMAC, CBC-MAC, etc.).

[0048] For example, if a data area contains information about a public key that is to be considered trustworthy, this is usually referred to as a so-called certificate, which confirms the validity of the key.

[0049] For example, if the data area contains the encoding of instructions to change the configuration parameters of a field device or to create a user account for an operator on the field device, it would be unusual to speak of a "certificate". This is why the term "ticket" is used in this context. (In many cases, the data area of ​​the ticket will also be additionally encrypted compared to the certificate).

[0050] Such a certificate or ticket TI enables the field device FG to check the authenticity of the instructions contained in the data block by checking the signature field to see whether it was actually created by a central office accepted as trustworthy.

[0051] The procedure for this asynchronous communication between field devices is that these certificates / tickets are initially created by the central office, then transferred to a "third party" (e.g. the user on a USB stick or stored on an operating unit BE such as a smartphone or tablet), and this third party then sends the certificate / ticket to the field device. This can be achieved, for example, by the user inserting a USB stick with the ticket into the field device and reading out the data of the ticket TI or the certificate there, or by connecting the operating unit to the field device FG and transferring the ticket TI or the certificate.

[0052] An essential factor of the present application is the recognition that the notes TI within the meaning of the present application do not necessarily arrive at the addressee (field device) in the order in which they were created and that the first time or first date provided by the first time recording unit RTC1 of the field device FG may be incorrect.

[0053] According to the invention, a method for measuring the difference between the time stamp of the ticket TI and the current time of the field device FG is implemented in the field device FG. Here, the time stamp is added to the ticket TI by the issuing authority, which in this case is the ticket server TS. For this purpose, the ticket server comprises a second time recording unit RTC2, which provides the ticket server TS with a second date and / or a second time.

[0054] After receiving the TI ticket, the field device FG performs a trust evaluation. For this purpose, initially limits are derived for the minimum and maximum possible validity times for the current time, which are based on the assigned trust relationships. For example, it may be useful to assign the following trust priorities:

[0055] 1. The timestamp contained in the certificate / ticket TI issued by the ticket server is given the highest level of trustworthiness. Based on this assumption, the actual time cannot be earlier than the issuance date of the last verified TI ticket.

[0056] 2. The subsequent subordinate authenticity is granted to the certificate of the time transmitter, in this case the operating unit BE, which has a valid certificate.

[0057] 3. The time information of the first time recording unit of the field device FG is assigned a subordinate credibility.

[0058] 4. Time information from a local operator interface or from an unauthenticated source (obtained via a trusted certificate) is assigned the lowest level of confidence.

[0059] If the credibility of the timestamp contained in the ticket TI is higher than the credibility of the system time of the field device FG, the system checks whether the second time or date contained in the timestamp differs from the first time or date. If this is the case and the deviation is greater than a predetermined factor, a warning message is created by the field device and output, for example, as a return ticket to the ticket server and / or via a display or fieldbus interface.

[0060] Trusted time transmitters within the meaning of the present invention are devices that have their own clock and to which a certificate is sent from a central office, with which they can identify themselves as a trusted time source. As a rule, trusted transmitters contain their own asymmetric key pair. Thus, the certificate identifying a trusted time transmitter as trustworthy contains, for example, the asymmetric public key of the transmitter and a signature issued by the central office.

[0061] Similar to a field device, a trusted transmitter may also have its own real-time clock, wherein the same restrictions on the reliability of the trusted transmitter as for the field device itself must apply in the event of eg power failure.

[0062] In this case, the operating unit is a trusted time source and has a third time recording unit RTC3 which outputs a third date and / or a third time.

[0063] The operating unit BE can add its own time stamp to the TI ticket. After the warning message has been created, the field device FG can perform a plausibility check and compare the two time stamps contained in the ticket, namely the second time or date and the third date or time. If these substantially match, the field device FG resets the first time or first date of the first time recording unit RTC1 to the second date or second time.

[0064] In the following, the method according to the present invention will be explained in more detail using three examples:

[0065] In a first example, the field device FG has a battery-buffered real-time clock as the first time recording unit RTC1. This is set to a first date: 01.01.24 via the local operating unit on the field device FG at 01.01.2024. The date therefore refers to the year 24 AD, so that the date is incorrect by about the year 2000.

[0066] The field device FG receives the ticket TI created by the ticket server TS. This has a time stamp containing a second date obtained from the second time recording unit RTC2 of the ticket server: 12.12.2024.

[0067] The field device FG checks the credibility of the time stamp. Since the time stamp originates from the ticket server TS and therefore from the unit with the highest credibility level, the time stamp is credible, whereas the manually set first date has a lower credibility.

[0068] The time deviation is very high (>2000), where the comparison factor is only one day. The field device FG creates a warning message for the first date.

[0069] In a second example, the field device FG has a battery-buffered real-time clock as the first time recording unit RTC1. This should have a maximum timing deviation of + / - 5 minutes per day. The current first date is 03.05.2023 and the current first time is 02:15.

[0070] The field device FG receives the ticket TI created by the ticket server TS. It has a time stamp containing a second date (05.03.2023) and a second time (02:24) obtained from the second time recording unit RTC2 of the ticket server.

[0071] The field device FG checks the credibility of the time stamp. Since the time stamp originates from the ticket server TS and thus from the unit with the highest credibility level, the time stamp is credible, whereas the credibility of the time of the first time recording unit is lower.

[0072] If the time deviation is greater than five minutes, the field device FG then generates a warning message regarding the first date.

[0073] For both examples, it is possible to provide that the operating unit BE serves as a transfer device for the ticket TI and adds an additional time stamp with a third date and / or a third time to the ticket. After creating the warning message, the field device FG performs a plausibility check and resets the clock if the remaining time stamp is within defined limits (first example: 1 day; second example: 1 minute).

[0074] In a third example, the field device FG has a battery-buffered real-time clock as the first time recording unit RTC1. This should have a maximum timing deviation of + / - 1 minute per day. The current first date is 03 / 08 / 2023 and the current first time is 9:17 am. The clock RTC1 was last set to 03 / 01 / 2023 based on the trusted time transmitter, and this event is recorded in the logbook of the field device FG.

[0075] A connection is established via Bluetooth to the field device FG using the operating unit BE. The operating unit is identified as a trusted time transmitter by a certificate from the central unit (TS Ticket Server).

[0076] During the creation of the credentials as a trusted time transmitter, for example based on cryptographic protection protocols of the NTP protocol family, the operating unit BE is informed of the presence of a trusted time synchronization server in the system.

[0077] The operating unit BE has a second time recording unit RTC2 in the form of a battery-buffered real-time clock with a maximum timing deviation of + / -10 seconds per day. The second time recording unit RTC2 is periodically synchronized once a day using information from an NTP time server specified by the central office, the last time being on 03 / 06 / 2023, 00:00. The current second time of the second time recording unit RTC2 is 9:12 and the current second date is 03 / 06 / 2023.

[0078] The operating unit sends its time together with information about the expected tolerance of the time RTC2 to the field device, together with a certificate for identification as a trusted time transmitter.

[0079] The field device FG checks the certificate identifying BE as a trusted time transmitter and, based on the information sent, determines that the second time has a higher degree of credibility and accuracy than its own first time. Furthermore, it is determined that the 5 minute deviation of the second time from the first time is reasonable within the range of timing deviations (1 minute per day, 7 days = + / - 7 minutes, expected tolerance) and there is no reason to generate a warning message. The first time recording unit RTC1 is reset to 9:12 without issuing a warning. The process of automatically resetting the clock performed is stored in the log book of the field device FG together with the identification of the time transmitter. Optionally, the internal first time recording unit RTC1 can be recalibrated according to the determined rate deviation (the first time recording unit RTC1 runs too fast, so that a 5 minute error occurs 7 days after the last setting of the clock).

[0080] List of reference numerals

[0081] BE operating unit

[0082] FG Field Equipment

[0083] RTC1 First time recording unit (of field devices)

[0084] RTC2 (Ticket Server's) First Time Recording Unit

[0085] RTC3 (operating unit) first time recording unit

[0086] TI Notes

[0087] TS Ticket Server.

Claims

1. A method for verifying a first time recording unit (RTC1) of a field device (FG) of automation technology, wherein: The first time recording unit (RTC1) supplies a first date and / or a first time to the field device (FG), comprising: - receiving a ticket (TI) at the field device (FG), wherein the ticket (TI) comprises at least cryptographically protected information and a time stamp, wherein the time stamp is obtained from a second time recording unit (RTC2), and wherein the time stamp contains a second date and / or a second time; - performing a trust evaluation of said time stamp contained in said ticket (TI), wherein during said trust evaluation the authenticity of said second time recording unit (RTC2) is checked with respect to said first time recording unit (RTC1); - in the case where the trust evaluation shows that the second time recording unit (RTC2) is more trustworthy than the first time recording unit (RTC1): a) comparing the first date or the first time with the second date or the second time, b) Creating a warning message if a deviation greater than a predetermined factor is determined between said first date or said first time and said second date or said second time.

2. The method according to claim 1, wherein: The warning message is only created if the time stamp of the ticket (TI) is older than the time stamps of all tickets (TI) received so far by the field device (FG).

3. The method according to claim 1 or 2, wherein: The trust evaluation is performed only if the field device (FG) can successfully verify the cryptographically protected information.

4. The method according to any one of claims 1 to 3, wherein: The ticket (TI) is created by a ticket server, wherein the ticket server sends the ticket (TI) to the field device (FG), wherein the second time recording unit (RTC2) is assigned to the ticket server, wherein the second time recording unit (RTC2) assigned to the ticket server has a higher trust evaluation than the first time recording unit (RTC1) of the field device (FG).

5. The method according to claim 4, wherein: The sending of the ticket (TI) is carried out via the operating unit (BE) by means of the ticket server sending the ticket (TI) to the operating unit and by means of the operating unit (BE) sending the ticket (TI) to the field device (FG).

6. The method according to any one of claims 1 to 3, wherein: The ticket (TI) is created by an operating unit (BE), wherein the operating unit (BE) sends the ticket (TI) to the field device (FG), wherein the second time recording unit (RTC2) is assigned to the operating unit (BE), and wherein the second time recording unit (RTC2) assigned to the operating unit (BE) only has a higher trust evaluation than the first time recording unit (RTC1) of the field device (FG) if the operating unit (BE) is already known to the field device (FG).

7. The method according to claim 6, wherein: The ticket server (TS) has sent a certificate as proof of a trusted time source to the operating unit (BE), wherein the operating unit (BE) incorporates the certificate into the ticket and sends it to the field device, wherein the field device (FG) only executes the steps after receiving the ticket (TI) if the field device (FG) can successfully verify the certificate.

8. The method according to one of the preceding claims, wherein: If the second date or the second time satisfies at least one plausibility condition, the first time recording unit (RTC1) is reset to the second date or the second time.

9. The method according to claims 6 and 8, wherein: A third time recording unit (RTC3) is assigned to the operating unit (BE), wherein the operating unit (BE) sends the ticket (TI) together with a third date and / or a third time obtained from the third time recording unit (RTC3) to the field device (FG), wherein the plausibility condition is satisfied if the third date and / or the third time substantially matches the second date or the second time.

10. The method according to claim 7, 8 or 9, wherein: A mobile device, in particular a tablet or a smartphone, is used as the operating unit (BE).

11. The method according to claim 10, wherein: The operating unit (BE) sends the ticket (TI) to the field device (FG) via a wireless communication link, in particular based on Bluetooth or WiFi.

12. Creation of a warning message if a deviation greater than a predetermined factor is determined between a first date or time and a second date or time.

Images