Operating system transparent encryption method based on kernel space mapping technology

Abstract

The invention discloses an operating system transparent encryption method based on a kernel space mapping technology, and the method specifically comprises a file behavior capturing module which is used for carrying out the callback processing of a file with an open authority through the FUSE technology; the user authentication and file permission module is configured to be used for legality authorization authentication judgment of an access file; the file redirection module is configured to be used for carrying out redirection operation according to a feedback result of the user authentication and file permission module; the file transparent encryption and decryption driving module is configured to set an encryption rule according to an application layer strategy, is positioned between a virtual file system and a traditional file system by adopting a stacked design, intercepts and processes read-write operation of a user application program, and uses a unique file encryption key for each file; and protection is carried out through a user password, an asymmetric key algorithm or a TPM public key.

Description

Technical Field

[0001] The present application relates to the field of transparent encryption technology, to transparent encryption and decryption technology common to multiple domestic platforms, and mainly to an operating system transparent encryption method based on kernel space mapping technology. Background Art

[0003] The current domestic platforms cover a variety of operating systems, with features including support for multiple chip architectures and suitability for servers and desktops. When developing software applications, you may encounter the following development difficulties for these different domestic platforms:

[0004] Need to support chip architecture for different platforms.

[0005] Targeting development needs for server and desktop platforms.

[0006] The operating systems of different domestic platforms may have certain differences in underlying implementation and system architecture.

[0007] Different domestic platforms may require the use of specific tool chains and development environments for software development.

[0008] For the currently commonly used encryption implementation technologies:

[0009] 1) Self-encrypting hard disks are generally provided by storage device manufacturers and security manufacturers. However, their implementation is inflexible, the entire disk is encrypted, and all unnecessary files are also encrypted. They are difficult to use and have poor versatility.

[0010] 2) FUSE-based implementations, such as gocryptfs, EncFS, CryFS, securefs, etc. However, the multiple system calls and copying overhead introduced by FUSE also lead to poor performance of FUSE-based FBE solutions. The gocryptfs project has a comparative analysis of various stackable FBE solutions, and the analysis data also verifies and explains the advantages and disadvantages of the FUSE FBE solution.

[0011] 3) The VFS-based eCryptfs FBE solution belongs to the stackable FBE type, so it does not depend on the underlying OS file system type and can be stacked on top of various file systems. It has good flexibility, but it cannot flexibly control the file format and policy controls such as file encryption, non-encryption, and authorization process. Summary of the invention

[0012] According to the defects existing in the prior art, the present invention proposes an operating system transparent encryption method based on kernel space mapping technology.

[0013] According to one aspect of the present invention, an operating system transparent encryption method based on kernel space mapping technology is proposed, including a user file system, a file redirection module and a file transparent encryption and decryption driver module, wherein the user file system includes a file behavior capture module and a user authentication and file permission module, specifically including:

[0014] The file behavior capture module is configured to use FUSE technology to perform callback processing only on files with open permissions;

[0015] The user authentication and file permission module is configured to determine the legality of access to the file, including determining whether the process, user permissions, and file content of the file are legal. The authorization level is expressed as the permissions of the file given in advance, including file reading, file writing, or file execution permissions;

[0016] The file redirection module is configured to perform a redirection operation according to the feedback result of the user authentication and file permission module. If the feedback result is a legal access, it will be redirected to the file transparent encryption and decryption driver module for encryption and decryption processing; if the feedback result is an illegal access, it will be redirected to the native file system;

[0017] The file transparent encryption and decryption driver module is configured to set encryption rules according to application layer policies, adopts a stacked design and is located between the virtual file system and the traditional file system, intercepts and processes the read and write operations of the user application, uses a unique file encryption key for each file, and is protected by a user password, an asymmetric key algorithm or a TPM public key.

[0018] Furthermore, the file behavior capture module specifically includes the following steps:

[0019] Use Fuse's mount function to mount the specified fuse_path to the / dev / fuse device;

[0020] Using the kernel module sys_open to call the open method of the inode node in the Fuse, a request message is generated and sent to the libfuse in the user space through the / dev / fuse device;

[0021] The libfuse daemon process in the user space is used to poll the miscellaneous device / dev / fuse through the function fuse_session_loop. If there is a request in the request queue, it is received through fuse_kern_chan_receive and called into the pre-defined open callback function for policy processing;

[0022] The corresponding operation is performed according to the operation code in the request, and the execution result is further returned to the / dev / fuse device. At the same time, the virtual file system wakes up the call that is blocked due to waiting for the execution result, and the virtual file system returns the execution result to the application that initiated the request.

[0023] The user layer adopts FUSE technology and abandons the traditional commonly used HOOK solution, and only performs callback processing for file opening operations such as open. First, its main implementation code is located in the user space, and there is no need to recompile the kernel, which can more flexibly meet customized management and control strategies. Secondly, abandoning the processing of read / write processes can also reduce the performance problems caused by the interaction between the kernel and the user layer and data copying.

[0024] When the user performs the corresponding file system opening operation, all file operations through fuse will be captured. We only process the file opening related operations and abandon the read / write process.

[0025] Furthermore, the user authentication and file permission module specifically includes the following steps:

[0026] Initialize the user authentication and file permission center using the offline policy sent by the server or read locally;

[0027] Document format authentication: determines whether to perform control based on the format of the opened document. If control is required, the next authentication operation is performed; if not, the authentication ends.

[0028] Process authentication: Based on the process that opens the document, authorization authentication of the process name, process summary, and process signature is performed to determine whether it is a legitimate process. This can prevent someone from tampering with the process name to obtain plaintext data.

[0029] Identify user permissions and document confidentiality levels, control directory and file-level access control permissions for opening documents, and control documents to be read-only, writable, or not openable for more precise control;

[0030] The document content recognition module is used to further control the fine-grainedness of opening documents.

[0031] Furthermore, the file redirection module specifically includes the following steps:

[0032] Extract the return parameter using the result returned by the user authentication and file permission module, and use the return parameter to read the node information of the file to obtain the metadata and attributes of the file, wherein the node information includes file size, permission, timestamp or process information, etc.;

[0033] The returned parameter is used again to extract the file operation information and pass it to the user authentication and file permission module as a basis for redirection. If the file does not need to be redirected, the module execution ends;

[0034] If the file needs to be redirected, the FUSE application layer distributes the authorized file operation request to the file transparent encryption and decryption driver module, and the unauthorized file is handled by the native system;

[0035] The file transparent encryption and decryption driver module will process the encryption and decryption operations of authorized files, and the native system is responsible for the ciphertext data of unauthorized files.

[0036] The main function of the file redirection module is to perform redirection operations based on the feedback results of the user authentication module. Legal access will be redirected to the encryption and decryption transparent driver for encryption and decryption processing, while illegal access will be redirected to the native file system. In this way, ciphertext and plaintext can exist at the same time, and there will be no plaintext and ciphertext caches that need to be maintained and cleaned by yourself. It is left to the system to maintain itself, which can greatly reduce the problems caused by cache switching and the difficulty of development.

[0037] Furthermore, the file transparent encryption and decryption driver module specifically includes:

[0038] Initialize the file system, and the file transparent encryption and decryption driver module sets transparent encryption and decryption driver rules according to the application layer strategy, including mount points or encryption strategies;

[0039] It adopts a stacked design and is located between the virtual file system and the traditional file system. The user application's read and write operations on the traditional file system are intercepted by the transparent encryption and decryption driver through the virtual file system through system calls;

[0040] Each file uses a different encryption key (File Encryption Key, FEK), which comes from a password provided by the user, an asymmetric key algorithm or a public key of a trusted platform module TPM, and the encryption key (File Encryption Key, FEK) is unique;

[0041] According to the setting of the mount point inode during mounting, the create function in the setting is called to generate an incode node for a new file, and the encryption and decryption information is stored in the first 8K space of the new file, and the new file is initialized;

[0042] When encrypting a file, a random number FEK is generated, the file content is encrypted and stored in blocks, the corresponding FEKEK key is found from the keyring according to the key_sig parameter passed by the user, the FEK is encrypted with the FEKEK key, and the EFEK is generated and saved in the file header

[0043] Encryption is performed in units of pages, a page is allocated for encryption, and the encrypted file is written to the underlying file, while relying on the inode node of the virtual file system, and the underlying inode node is found through the inode node of the virtual file system for final writing;

[0044] During decryption, the FEKEK key is found according to the key_sig parameter, and FEK is used to decrypt EFEK to obtain FEK, and FEK is used to decrypt the file content. The decryption operation is performed in pages, and the content is decrypted by the corresponding decryption algorithm and returned to the user application to ensure that the read data is the decrypted plaintext content.

[0045] According to a second aspect of the present invention, a computer-readable storage medium is provided, on which one or more computer programs are stored. When the one or more computer programs are executed by a computer processor, the above method is implemented.

[0046] The above one or more technical solutions in the embodiments of the present application have at least one of the following technical effects:

[0047] 1) The present invention uses the user layer solution of FUSE to perform file redirection judgment, which greatly reduces the development difficulty, and can be developed in multiple languages ​​(GO, C, C++, etc.), and the API corresponding to the application layer is also richer and the function realization is richer;

[0048] 2) The driver adopts the eCryptfs technical solution, which has long-term stable use, high stability, source code reference, and low development difficulty.

[0049] 3) The driver does not involve FUSE file kernel operations, reducing the overhead of kernel-to-user layer system calls and copies, and has high performance;

[0050] 4) Since FUSE is used for redirection instead of directly encrypting the driver for policy judgment, the paths accessed by authorized processes and unauthorized processes are inconsistent, so there will be no conflict between the ciphertext cache and the plaintext cache, and there is no need to pay attention to the switching of the ciphertext and plaintext caches, which greatly reduces the difficulty of driver logic. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the present invention. It will be easy to recognize other embodiments and many expected advantages of the embodiments because they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with each other. The same reference numerals refer to corresponding similar parts.

[0052] Figure 1 A schematic diagram of the operating system transparent encryption principle based on kernel space mapping technology according to an embodiment of the present invention is shown;

[0053] Figure 2 A user file system technical principle schematic diagram according to a specific embodiment of the present invention is shown;

[0054] Figure 3 A schematic diagram of a user authentication and file authorization module flow according to a specific embodiment of the present invention is shown;

[0055] Figure 4 A schematic diagram of the structure of a file redirection module according to a specific embodiment of the present invention is shown;

[0056] Figure 5 A schematic diagram of encryption and decryption principles according to a specific embodiment of the present invention is shown. DETAILED DESCRIPTION

[0057] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0058] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0059] The present invention proposes an operating system transparent encryption method based on kernel space mapping technology. The specific principle diagram is as follows: Figure 1 As shown, each step is encapsulated by different modules, including a user file system, a file redirection module, and a file transparent encryption and decryption driver module, wherein the user file system includes a file behavior capture module and a user authentication and file permission module, specifically including:

[0060] The file behavior capture module is as follows Figure 2 As shown in the figure, the configuration is used to use FUSE technology to perform callback processing only for files with open permissions, including:

[0061] Use Fuse's mount function to mount the specified fuse_path to the / dev / fuse device;

[0062] The mount function mounts the specified fuse_path to the / dev / fuse device, allowing the user space file system to be accessed like a traditional file system. Developers can implement complex file system logic in user space without deep kernel programming.

[0063] Using the kernel module sys_open to call the open method of the inode node in the Fuse, a request message is generated and sent to the libfuse in the user space through the / dev / fuse device;

[0064] The libfuse daemon process in the user space is used to poll the miscellaneous device / dev / fuse through the function fuse_session_loop. If there is a request in the request queue, it is received through fuse_kern_chan_receive and called into the pre-defined open callback function for policy processing;

[0065] The corresponding operation is performed according to the operation code in the request, and the execution result is further returned to the / dev / fuse device. At the same time, the virtual file system wakes up the call that is blocked due to waiting for the execution result, and the virtual file system returns the execution result to the application that initiated the request.

[0066] FUSE provides great flexibility, security, and portability by moving the file system implementation from the kernel to the user space. It allows developers to easily implement complex file system logic in the user space while maintaining consistency with the kernel file system interface. This not only simplifies the development process, but also improves the stability and security of the system.

[0067] The user authentication and file permission module is as follows Figure 3 As shown, the configuration is used to determine the legality of accessing files, including determining whether the process, user permissions, and file content of opening the file are legal. The authorization level is expressed as the permissions of the pre-given file, including file reading, file writing, or file execution permissions, and specifically also includes:

[0068] Initialize user authentication and file permission center using offline policies sent from the server or read locally; ensure that the system's security policies are up to date and can work properly without a network connection.

[0069] Document format authentication determines whether to implement control based on the format of the opened document. If control is required, the next authentication operation is performed. If not, the authentication ends. This prevents documents in certain specific formats from being accessed at will.

[0070] Process authentication, based on the process that opens the document, includes authorization authentication of the process name, process summary, and process signature; ensuring that only legitimate processes can access protected documents, and preventing the acquisition of plaintext data by bypassing security controls by tampering with the process name, etc.

[0071] Identify user permissions and document classification, and control the directory and file-level access control permissions for opening documents; based on user permissions and document classification, implement directory and file-level access control permissions. For example, you can control more detailed permission settings such as read-only, writable, or non-openable files.

[0072] The document content recognition module can be used to further control the fine-grainedness of opening documents. For example, the copying, printing or editing of certain special contents can be restricted to ensure that the special information in the document is properly protected.

[0073] The file redirection module is as follows Figure 4 As shown, the configuration is used to perform a redirection operation according to the feedback result of the user authentication and file permission module. If the feedback result is a legal access, it will be redirected to the file transparent encryption and decryption driver module for encryption and decryption processing. If the feedback result is an illegal access, it will be redirected to the native file system, which specifically includes:

[0074] The result returned by the user authentication and file permission module is used to extract the return parameter, and the node information of the file is read using the return parameter to obtain the metadata and attributes of the file; through user authentication, file permission control and transparent encryption and decryption mechanism, multi-level security protection is provided.

[0075] The returned parameter is used again to extract the file operation information and pass it to the user authentication and file permission module as a basis for redirection. If the file does not need to be redirected, the module execution ends;

[0076] If the file needs to be redirected, the FUSE application layer distributes the authorized file operation request to the file transparent encryption and decryption driver module, and the unauthorized files are handled by the native system; it supports fine-grained file permission control to ensure that only authorized users can access specific files. The transparent encryption and decryption mechanism ensures that the file is always encrypted during transmission and storage, improving data security.

[0077] The native system is responsible for the ciphertext data of unauthorized processes. The data in the cache is not decrypted to ensure the control of ciphertext usage of normal files and encrypted files. This has the advantage of not having to consider the switching and refreshing of plaintext and ciphertext caches, greatly reducing the difficulty of implementation and uncontrollable factors of the system.

[0078] The file transparent encryption and decryption driver module is as follows Figure 5As shown, the encryption and decryption operations of the authorized files will be processed, and the native system is responsible for the ciphertext data of the unauthorized files.

[0079] Through the collaboration between the FUSE application layer and the native system, the operation requests of authorized and unauthorized files are efficiently processed. The ciphertext data of unauthorized files is processed by the native system to ensure that special data is not illegally accessed.

[0080] The file transparent encryption and decryption driver module is configured to set encryption rules according to application layer policies, adopts a stacked design and is located between the virtual file system and the traditional file system, intercepts and processes the read and write operations of the user application, uses a unique file encryption key for each file, and is protected by a user password, an asymmetric key algorithm or a TPM public key, and specifically includes:

[0081] Initialize the file system, and the file transparent encryption and decryption driver module sets transparent encryption and decryption driver rules according to the application layer strategy, including mount points or encryption strategies;

[0082] It adopts a stacked design located between the virtual file system and the traditional file system. The read and write operations of the user application on the traditional file system are intercepted by the transparent encryption and decryption driver through the virtual file system through system calls. The stacked design can be seamlessly integrated with the existing file system without modifying the code of the existing file system.

[0083] Each file uses a different encryption key, which is derived from a user-provided password, an asymmetric key algorithm, or a public key of a Trusted Platform Module (TPM);

[0084] According to the setting of the incode node during mounting, the create function in the setting is called to generate the incode node of the new file, and the encryption and decryption information is stored in the first 8K space of the new file, and the new file is initialized;

[0085] When encrypting a file, a random number FEK is generated, the file content is encrypted and stored in blocks, the corresponding FEKEK key is found from the keyring according to the key_sig parameter passed by the user, the FEK is encrypted with the FEKEK key, and the EFEK is generated and saved in the file header

[0086] Encryption processing is performed in page units, a page is allocated for encryption, and the encrypted file is written to the underlying file. At the same time, the inode node of the virtual file system is relied on, and the underlying inode node is found through the inode node of the virtual file system for final writing; encryption and decryption are performed in page units, which improves the efficiency of encryption and decryption.

[0087] During decryption, the FEKEK key is found according to the key_sig parameter, and FEK is used to decrypt EFEK to obtain FEK, and FEK is used to decrypt the file content. The decryption operation is performed in units of pages, and the content is decrypted by the corresponding decryption algorithm and returned to the user application to ensure that the read data is the decrypted plaintext content. The file encryption and decryption process is transparent to the user application and does not affect the user experience.

[0088] Through multi-level encryption and permission control, it provides strong data protection. At the same time, each file uses a different encryption key to enhance data security and isolation. It supports multiple key sources (such as user passwords, asymmetric key algorithms, and TPM) and provides flexible key management methods. The file transparent encryption and decryption driver module ensures the security of files during storage and transmission, while maintaining the ease of use and performance of the file system.

[0089] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0090] The modules involved in the embodiments of the present application may be implemented by software or by hardware.

[0091] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. An operating system transparent encryption method based on kernel space mapping technology, characterized in that: It includes a user file system, a file redirection module and a file transparent encryption and decryption driver module, wherein the user file system includes a file behavior capture module and a user authentication and file permission module, specifically including: The file behavior capture module is configured to use FUSE technology to perform callback processing only on files with open permissions; The user authentication and file permission module is configured to determine the legality of access to the file, including determining whether the process, user permissions, and file content of the file are legal. The authorization level is expressed as the permissions of the file given in advance, including file reading, file writing, or file execution permissions; The file redirection module is configured to perform a redirection operation according to the feedback result of the user authentication and file permission module. If the feedback result is a legal access, it will be redirected to the file transparent encryption and decryption driver module for encryption and decryption processing; if the feedback result is an illegal access, it will be redirected to the native file system; The file transparent encryption and decryption driver module is configured to set encryption rules according to application layer policies, adopts a stacked design and is located between the virtual file system and the traditional file system, intercepts and processes the read and write operations of the user application, uses a unique file encryption key for each file, and is protected by a user password, an asymmetric key algorithm or a TPM public key.

2. The operating system transparent encryption method according to claim 1, characterized in that: The file behavior capture module specifically includes the following steps: Use Fuse's mount function to mount the specified fuse_path to the / dev / fuse device; Using the kernel module sys_open to call the open method of the inode node in the Fuse, a request message is generated and sent to the libfuse in the user space through the / dev / fuse device; The libfuse daemon process in the user space is used to poll the miscellaneous device / dev / fuse through the function fuse_session_loop. If there is a request in the request queue, it is received through fuse_kern_chan_receive and called into the pre-defined open callback function for policy processing; The corresponding operation is performed according to the operation code in the request, and the execution result is further returned to the / dev / fuse device. At the same time, the virtual file system wakes up the call that is blocked due to waiting for the execution result, and the virtual file system returns the execution result to the application that initiated the request.

3. The operating system transparent encryption method according to claim 1, characterized in that: The user authentication and file permission module specifically includes the following steps: Initialize the user authentication and file permission center using the offline policy sent by the server or read locally; Document format authentication: determines whether to perform control based on the format of the opened document. If control is required, the next authentication operation is performed; if not, the authentication ends. Process authentication, based on the process that opens the document, including authorization authentication of the process name, process summary, and process signature; Identify user permissions and document confidentiality, and control directory and file-level access permissions for opening documents; The document content recognition module is used to further control the fine-grainedness of opening documents.

4. The operating system transparent encryption method according to claim 1, characterized in that: The file redirection module specifically further includes the following steps: Extract the return parameter using the result returned by the user authentication and file permission module, and use the return parameter to read the node information of the file to obtain the metadata and attributes of the file; The returned parameter is used again to extract the file operation information and pass it to the user authentication and file permission module as a basis for redirection. If the file does not need to be redirected, the module execution ends; If the file needs to be redirected, the FUSE application layer distributes the authorized file operation request to the file transparent encryption and decryption driver module, and the unauthorized file is handled by the native system; The file transparent encryption and decryption driver module will process the encryption and decryption operations of authorized files, and the native system is responsible for the ciphertext data of unauthorized files.

5. The operating system transparent encryption method according to claim 1, characterized in that: The file transparent encryption and decryption driver module specifically includes: Initialize the file system, and the file transparent encryption and decryption driver module sets transparent encryption and decryption driver rules according to the application layer strategy, including mount points or encryption strategies; It adopts a stacked design and is located between the virtual file system and the traditional file system. The user application's read and write operations on the traditional file system are intercepted by the transparent encryption and decryption driver through the virtual file system through system calls; Each file uses a different encryption key, which is derived from a user-provided password, an asymmetric key algorithm, or a public key of a Trusted Platform Module (TPM); According to the setting of the incode node during mounting, the create function in the setting is called to generate the incode node of the new file, and the encryption and decryption information is stored in the first 8K space of the new file, and the new file is initialized; When encrypting a file, a random number FEK is generated, the file content is encrypted in blocks, and FEK is encrypted using FEKEK; The encryption process is performed in units of pages; during decryption, the EFEK is decrypted by the FEKEK, and the file content is further decrypted by using the FEK.

6. The operating system transparent encryption method according to claim 5, characterized in that: The method of using FEKEK to encrypt FEK also includes: when encrypting a file, generating a random number FEK, encrypting and storing the file content in blocks, finding the corresponding FEKEK key from the keyring according to the key_sig parameter passed by the user, encrypting FEK with the FEKEK key, generating EFEK and saving it in the file header.

7. The operating system transparent encryption method according to claim 5, characterized in that: The encryption process in units of pages specifically includes: allocating a page for encryption, writing the encrypted file into the underlying file, relying on the inode node of the virtual file system, and finally writing after finding the underlying inode node through the inode node of the virtual file system.

8. The operating system transparent encryption method according to claim 5, characterized in that: The decrypting of EFEK by the FEKEK and further using the FEK to decrypt the file content specifically also includes: finding the FEKEK key according to the key_sig parameter, decrypting EFEK with FEKEK to obtain FEK, and using FEK to decrypt the file content, performing decryption operations in pages, decrypting the content through a corresponding decryption algorithm, and returning it to the user application to ensure that the read data is the decrypted plaintext content.

9. A computer program product, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

10. A computing system, characterized in that: The method comprises a processor and a memory, wherein the processor is configured to execute the method according to any one of claims 1 to 8.

Images