Method for determining security integrity of function of distributed system

Abstract

The invention relates to a method (100) for determining the security integrity of a function (2) of a distributed system (1), comprising the following steps: providing (101) at least one specification of at least one characteristic of a component (9) of the distributed system (1) in order to provide the at least one specification of the at least one characteristic as meta-information of the component (9), wherein the component (9) participates in performing the function (2) of the distributed system (1); analyzing (102) the meta-information of at least one other component (9 ') in view of the meta-information of the component (9) in order to determine an influence between the component (9) and the at least one other component (9') on the basis of the analysis; wherein the influence is determined at least on the basis of a similarity of the at least one description of the component (9) to the at least one description of the at least one other component (9 '), and wherein the at least one other component (9') participates in executing a function (2) of the distributed system (1); -classifying (103) the function (2) of the distributed system (1) on the basis of the determined impact, at least one category being specific for independence of the function (2) of the distributed system (1), in order to determine a security integrity of the function (2) of the distributed system (1) on the basis of the classification. The invention further relates to a computer program, a device and a storage medium for this purpose.

Description

Technical Field

[0001] This invention relates to a method for determining the security integrity of the functions of a distributed system. Furthermore, the invention also relates to a computer program, apparatus, and storage medium for this purpose. Background Technology

[0002] Vehicles have a variety of applications. These applications are, in particular, partially connected to external systems, such as the cloud or edge. This connectivity can be so extensive that safety-critical functions and computing may also be moved from the vehicle to the cloud or edge.

[0003] To achieve safety integrity in safety-critical systems through functional redundancy, it may be necessary to demonstrate that all paths of the functions performed by a vehicle application are sufficiently independent. One approach for this purpose could be dependency fault analysis (DFA), such as fault tree analysis (FTA). For statically redundant architectures, the application of DFA is particularly well-established and can be performed during the design phase using available tools. Conversely, in distributed systems where configuration may only occur during runtime, this approach can be limited because, for example, it is impossible to predetermine and analyze all possible combinations of redundant functional execution and / or computation. Furthermore, in distributed systems, individual elements may change over time, such as through software updates, potentially requiring re-performance of the corresponding analyses before classifying the system as safe or before system release. Summary of the Invention

[0004] The subject of this invention is a method having the features of claim 1, a computer program having the features of claim 8, an apparatus having the features of claim 9, and a computer-readable storage medium having the features of claim 10. Other features and details of the invention are derived from the corresponding dependent claims, the description, and the drawings. Herein, the features and details described in association with the method according to the invention naturally also apply to the computer program according to the invention, the apparatus according to the invention, and the computer-readable storage medium according to the invention, and vice versa, so that the disclosure of various aspects of the invention is always mutually referenced or can be mutually referenced.

[0005] The subject of this invention is, in particular, a method for determining the security integrity of the functionality of a distributed system, the method comprising the following steps: - Provide at least one description of at least one characteristic of a component of a distributed system, so as to provide the at least one description of the at least one characteristic as meta-information of the component, wherein the component participates in performing the functions of the distributed system; - Analyze the metadata of at least one other component based on the metadata of the component, in order to determine the influence between the component and the at least one other component based on the analysis, wherein the influence is determined based at least on the similarity between the at least one description of the component and the at least one description of the at least one other component, wherein the at least one other component participates in performing the functions of the distributed system; - Classify the functions of the distributed system based on the identified impacts, wherein at least one category is specific to the independence of the functions of the distributed system, so as to determine the security integrity of the functions of the distributed system based on the classification.

[0006] Security integrity can generally be understood as the effectiveness of a distributed system's functionality under compliant conditions. Security integrity can also represent the reliability of a distributed system's functionality. Distributed systems can be, for example, mobile robots, vehicles with cloud connectivity, or cyber-physical systems. Distributed systems can include various components, such as in the hardware, software, or data domains. Furthermore, a distributed system may have at least one coordinator that utilizes, for example, software and / or hardware components and corresponding data to perform the functions of the distributed system. The coordinator typically provides automated configuration, management, and coordination of the distributed system's functionality. The coordinator can be designed as a software module and generates at least one copy as a component to perform the functions, utilizing the software and / or hardware components and corresponding data in a redundant manner through the corresponding copy. The characteristics, for example, can be a software library for a software component, and the description of this can be the specific software library used by the software component. Therefore, similarity is particularly present when, for example, this component and the at least one other component use the same software library. Other categories within the scope of classification can be categories in the sense of "sufficiently independent," "not sufficiently independent," and / or "independent but optimizable." Meta-information is typically structured data that contains information about the characteristics of other data. Examples of metadata for books could include author name, edition, publication year, publisher, and ISBN, while metadata for computer files could include filename, access permissions, and last modified date. The metadata of the corresponding components of a distributed system can be advantageously used during the runtime of the distributed system and forwarded along paths between distributed system components. Therefore, this method offers the advantage of allowing for the evaluation of the dynamic configuration of the distributed system for executing functions during runtime with sufficient independence. Furthermore, it allows for the advantageous early identification of impacts.

[0007] Furthermore, within the scope of this invention, the distributed system can also be defined as a cyber-physical system having a hierarchical structure with at least two levels, wherein the component and the at least one other component reside in one of the at least two levels. Preferably, the component and the at least one other component reside in the same level of the at least two levels. A cyber-physical system specifically refers to a network through which information technology, software technology components, and mechanical and electronic parts communicate via a data infrastructure, such as the Internet. The highest level may, for example, represent the entire distributed system, while other levels may, for example, represent the functions or services of the distributed system. It is also conceivable that security integrity determination based on meta-information is performed at each level, wherein preferably, the component and at least one other component reside in the same level. Advantageously, security integrity can be determined level by level, and the corresponding results can be forwarded to a higher level.

[0008] The method may optionally further include the following steps: - Protect metadata through certificates and / or public key infrastructure and / or distributed ledger technology and / or checksums.

[0009] By protecting metadata, its integrity can be advantageously demonstrated. Compressed and / or selected metadata can also be protected as described above.

[0010] Optionally, it can be specified that the impact is determined by the dependencies and / or correlations between the component and the at least one other component in the distributed system, and the method further includes the following steps: - To assess the criticality of the dependency and / or correlation between the component and the at least one other component, taking into account at least one boundary condition of the component and / or the at least one other component.

[0011] Criticality is understood in particular as a relativism, expressing the degree to which dependencies and / or correlations are critical with respect to the independence of the distributed system's functionality. For this purpose, ranges can be defined that express, for example, whether the dependencies and / or correlations are critical or non-critical. Dependencies can exist, for example, when two components have the same hardware. Correlation can exist when there is related data or models that may contain the same defects. Boundary conditions can be determined, for example, by another characteristic of the component or considered separately. For example, the spatial arrangement of the components can be considered as a boundary condition. By assessing criticality, differentiated analysis of metadata can be advantageously performed.

[0012] Alternatively, the method may be further envisioned to include the following steps: - Transmit the metadata of the component and at least one other component to a central data processing unit so that the central data processing unit can determine the security integrity of the distributed system's functions.

[0013] The central data processing unit can be part of a distributed system. Centralized determination of the security and integrity of the distributed system's functions can be advantageous because it allows for a centralized analysis of all components currently used for that function in terms of impact.

[0014] According to an advantageous extension of the invention, the method may further include the following steps: - Initiate measures based on the classification of the functions of the distributed system.

[0015] The measure could be to reconfigure at least a portion of the distributed system, for example, by using other components of the distributed system. Alternatively, the measure could be to refrain from taking any action, particularly in cases where there are specific categories of independence regarding the functionality of the distributed system.

[0016] Furthermore, within the scope of this invention, it is conceivable that the method may further include the following steps: - Compression and / or selection of meta-information, wherein compression and / or selection of meta-information is performed based on checking the functional data of the component and / or at least one other component in view of the integrity of the functional data.

[0017] Compression and / or selection of metadata can be understood as: removing portions of metadata or replacing these portions with compressed alternatives to shorten them. For example, if sufficient integrity of the functional data is determined when examining the functional data of a corresponding component, at least one description of the characteristics of that component can be removed. This can advantageously reduce the transmission time between components with less data load. The integrity of functional data can be determined, for example, by common defects, such as identical hardware models or the same sensors used.

[0018] Advantageously, within the scope of this invention, the analysis of metadata includes the following steps: - Dynamic reconfiguration of the currently used paths for performing distributed system functions and / or the redundant architecture of the distributed system, wherein preferably at least one fault tree and / or at least one fault probability and impact analysis network and / or at least one causal graph are also created based on the dynamic reconfiguration and / or redundant architecture.

[0019] Dynamic reconfiguration allows for a more precise and flexible determination of the security and integrity of distributed system functions.

[0020] It is possible that the method according to the invention can be applied to vehicles. For example, the distributed system could be a vehicle with cloud connectivity. The vehicle could be designed, for example, as a motor vehicle and / or a passenger-carrying motor vehicle and / or an autonomous vehicle. The vehicle could have, for example, vehicle equipment and / or driver assistance systems for providing autonomous driving functions. The vehicle equipment could be implemented to at least partially automatically control the vehicle and / or accelerate and / or brake and / or steer it.

[0021] The subject of this invention is also a computer program, and more particularly a computer program product, comprising instructions that, when executed by a computer, cause the computer to perform the method according to the invention. Therefore, the computer program according to the invention has the same advantages as the method according to the invention already described in detail.

[0022] The subject of this invention is also an apparatus for data processing configured to perform the method according to the invention. For example, this apparatus may include a computer executing a computer program according to the invention. The computer may have at least one processor for executing the computer program. A non-volatile data memory may also be provided, in which the computer program is stored, and the processor may read the computer program from the non-volatile data memory to execute it.

[0023] The subject of this invention can also be a computer-readable storage medium having a computer program according to the invention and / or including instructions that, when executed by a computer, cause the computer to perform the method according to the invention. For example, the storage medium is designed as a data storage device, such as a hard disk and / or non-volatile memory and / or a memory card. The storage medium can, for example, be integrated into a computer.

[0024] Furthermore, the method according to the invention can also be implemented as a computer-based method. Attached Figure Description

[0025] Other advantages, features, and details of the invention will become apparent from the following description, in which embodiments of the invention are described in detail with reference to the accompanying drawings. Herein, the features mentioned in the claims and specification may be essential to the invention individually or in any combination. Wherein: Figure 1 shows a schematic visualization of the method, central data processing apparatus, device, storage medium, and computer program according to an embodiment of the present invention.

[0026] Figure 2 shows a schematic diagram of a distributed system according to an embodiment of the present invention.

[0027] Figure 3 shows a schematic diagram of a method for determining measures according to an embodiment of the present invention. Detailed Implementation

[0028] Figure 1 schematically illustrates a method 100, a central data processing device 30, a device 10, a storage medium 15, and a computer program 20 according to an embodiment of the present invention.

[0029] according to Figure 1 The illustrated embodiment of the method 100 for determining the security integrity of a function 2 of a distributed system 1 includes the following steps. In a first step 101, at least one description of at least one characteristic of a component 9 of the distributed system 1 is provided to provide at least one description of said at least one characteristic as meta-information of said component 9. Component 9 participates in the execution of function 2 of the distributed system 1. In a second step 102, preferably, the meta-information of at least one other component 9' is analyzed based on the meta-information of component 9 to determine the influence between component 9 and said at least one other component 9' based on the analysis. At least one other component 9' also preferably participates in the execution of function 2 of the distributed system 1. The influence is determined here based at least on the similarity between at least one description of component 9 and at least one description of at least one other component 9'. In a third step 103, function 2 of the distributed system 1 can be classified based on the determined influence to determine the security integrity of function 2 of the distributed system 1 based on the classification. Preferably, at least one category is specific to the independence of function 2 of the distributed system 1.

[0030] Figure 2 illustrates, in particular, one possible implementation of the distributed system 1. This distributed system provides various functions 2, which in turn access different coordinators 3. The coordinator 3 can create replicas 4 to perform specific functions 2, for example, by determining which software 5, hardware 6, or data 7 to use to perform that function 2. Each replica 4 can perform the same function 2 to provide redundancy. It is conceivable that security integrity is determined at the level of replicas 4, where corresponding components 9 represent, for example, different hardware modules 6. Furthermore, security integrity can also be determined at the level of the entire distributed system 1. Advantageously, security integrity can be determined level by level, and the corresponding results can be forwarded to higher levels.

[0031] Figure 3 illustrates a schematic diagram of a method 200 for determining measures according to an embodiment of the present invention. In a first step 201, function 2 is selected, which should be executed with defined redundancy. Now, for each redundancy, a copy 4 can be generated in a second step 202, which utilizes various components 9, such as hardware 6 and software 5. In a third step 203, the calculation results of copy 4, including the corresponding metadata of the components 9 of copy 4, can be received, for example, by a central data processing device. Subsequently, in a fourth step 204, preferably, the metadata of the corresponding components 9 of copy 4 is checked in terms of critical dependencies and / or correlations. If no critical dependencies and / or correlations exist (path "N", representing "No"), the calculation results can then be returned in step 206. If critical dependencies and / or correlations are determined in step 204, a new copy 4 (path "Y1", representing "Yes 1") can be generated according to a first alternative, which, for example, uses other components 9. According to a second alternative (path "Y2", representing "Yes 2"), a fault message can be output within the scope of step 205.

[0032] One aspect of the invention may be to determine or provide metadata regarding potential key influences, particularly dependencies or correlations, between components 9, especially redundant components 9, in a distributed system 1 with a dynamically networked function 2.

[0033] Critical dependencies could be, for example, the same software 5, the same hardware 6, or the same data 7, which may contain, for example, the same systematic or random failures according to the ISO 26262 standard.

[0034] Relevance, for example, may include related data or models that contain, for example, the same defects according to the ISO 21448 standard.

[0035] This metadata can be used during runtime, for example by the coordinator 3 or the security monitor, to identify dependencies or relevances critical to the security integrity of the functions 2 to be performed by the distributed system 1, and may initiate measures, especially mitigation measures, upon identification. Simultaneously, independence checks 8 are preferably performed hierarchically (see...). Figure 2 That is, if a part of the functional chain is sufficiently independent, the identified metadata can be explicitly transmitted, for example, via a protected certificate, without requiring re-examination in the receiving system. If the details of component 9 require re-examination at a higher level, they can be encrypted, for example, via a hash value.

[0036] The advantages of this invention can be particularly seen in the following aspects: by applying this invention, dynamic configurations (e.g., dynamic configurations present in distributed system 1) can be evaluated during operation with sufficient independence, thereby advantageously making them more secure. Furthermore, enhanced security can be provided through mitigation. Due to early identification of dependencies, measures, particularly mitigation measures, can be initiated either at a lower functional level to still achieve the required independence, or at a safety-critical system level where computation has been requested, particularly mitigation measures, by responding securely (e.g., transitioning to a safe state). Furthermore, particularly by passing the inspection results cascading down levels, details of component 9 are not leaked to lower levels. Moreover, this reduces the amount of data that must be exchanged between component 9 or levels. Thus, simple and efficient (vertical and horizontal) extensions to the method can be achieved.

[0037] The following discusses possible triggering factors for dependencies and correlations, which can be encompassed in the exchanged metadata. For network nodes, the same cloud, hyperscale operator, or software stack may be triggering factors. For software, the same software modules or libraries, manufacturer, version, configuration, or hyperparameters may be triggering factors. Regarding hardware, the same hardware type (e.g., memory), manufacturer, version, or spatial location (e.g., server) may be triggering factors. Furthermore, for the spatial location of hardware, electromagnetic interference, humidity, and heating may be specific. Another factor in hardware may be the power supply. Regarding data, triggering factors can be the same database, sensor modalities, the same sensors, the same input signals, the same version, spatial location, or field of view. Regarding the applied machine learning model, triggering factors can be the same database, the existence of a digital twin, the same manufacturer, the same (probabilistic) algorithm, or the same artificial intelligence module (which may also be different versions).

[0038] The format used to provide metadata can be, for example, explicit information in messages, especially data exchanged between components 9, or metadata can be provided in an encoded manner, such as by hash or MAC.

[0039] The aggregation of metadata (potentially hierarchically) is described in more detail below. In order to also be able to track the existence of relevant dependencies in a multi-level networked system consisting of branch trees of data processing functions and / or data processing systems, metadata can be passed along the component chain in an appropriate form.

[0040] Depending on latency requirements, communication resources, and the data protection sought, metadata can be transmitted in the following example manner. Participant metadata can be stored in a specially protected central data processing unit 30, where its relevance is examined, preferably as a backend service. Methods known in the art, particularly those for PSI (Private Set Intersection), MPC-based methods, or cleanroom methods based on Trusted Execution Environments (TEEs), can be used here. Each element then preferably receives feedback from the central data processing unit 30, if necessary, regarding whether any impact to be considered exists in the desired combination, particularly in a secure combination.

[0041] Alternatively, metadata can be passed simply as a hash value and evaluated. For example, a hash function can be assigned to a software library so that the parent component 9 can check whether the redundant component 9 provides the same hash function and thus identify the impact.

[0042] Decentralized execution can exchange meta-information among participants, or components, using secure methods such as "private set intersection" to identify common effects without directly exposing all internal system details, which may include confidential information if necessary.

[0043] To minimize latency, metadata can be compressed or selected by checking which functional data has already been examined through previous data processing with high diagnostic coverage and thus enjoys correspondingly high integrity, and preferably does not require further examination. Functional data that has been primarily "delivered" previously and whose final integrity checks have not yet been completed is preferably associated with metadata related to said functional data, and more preferably only this metadata is passed in the chain.

[0044] Metadata can be protected, for example, through certificates, PKI, ledgers, or checksums.

[0045] For example, the metadata can be evaluated by simply examining the metadata provided by the "redundant" function 2 based on aspects of (critical) identical parts. More detailed examination may include dynamically refactoring the currently used functional paths or redundant architecture, for example, by using a standard system model for modular representation (MBSE system model) or by evaluating additional metadata regarding functional relationships. Furthermore, more detailed examination may also include dynamically creating a fault tree based on this architecture and examining critical identical parts, for example, through cut sets. Additionally or alternatively, a portion of the more detailed examination may also include dynamically creating an FMEA network based on this architecture and examining critical identical parts, for example, through string comparison. Additionally or alternatively, a portion of the more detailed examination may also include dynamically creating a causal graph based on this architecture and examining critical paths.

[0046] The evaluation may aim to identify identical elements (meaning "identical") and / or identical parts (homogeneous redundancy, such as the same hardware type or the same software library). Furthermore, the criticality of the similarity can be evaluated downstream, depending particularly on current boundary conditions, such as when identical hardware 6 exists but is spatially separated, or depending on the current context, such as whether it will cause simultaneous failures or only similar distortions. For this purpose, relevant boundary conditions and contextual information about the component 9 to be inspected can be provided, for example, by the requesting system. Alternatively, the objective may be to identify relevant factors, such as relevant data or sensors. Furthermore, the criticality of the correlation can be evaluated, particularly depending on current boundary conditions or the current context. This evaluation can also be performed over a defined time period or continuously during operation.

[0047] The output can be categorized into various classes, such as "sufficiently independent," "not sufficiently independent," or "independent but optimizable." Measures, particularly mitigation measures, could be reconfiguration, for example, requesting other or additional replicas 4, in the case of a lower-level coordinator 3. At the system level, fault responses could be triggered, such as transitioning to a safe state. For the "independent but optimizable" category, measures, particularly mitigation measures, could be reconfiguration by selecting paths that are less correlated, have no correlation, or even have a negative correlation due to the components 9 present in the path.

[0048] The evaluation of the results can be performed using lookup tables, machine learning models, or probabilistic models (such as Bayesian networks), and can be performed locally, such as in a vehicle, or centrally, such as in the cloud or a central "security node".

[0049] Possible extensions could include applications not only for homogeneous redundancy computation but also for heterogeneous redundancy computation, for example, when a node or function 2, or service, is to be used to simultaneously compute multiple hypotheses (each with different parameters, data, and model assumptions). Furthermore, it is conceivable to combine this with component criticality analysis, or to additionally use Bayesian networks, to evaluate the entire software stack.

[0050] The above description of the embodiments is merely an example of the invention. Of course, the various features of the embodiments can be freely combined with each other without departing from the scope of the invention, as long as it is technically meaningful.

Claims

1. A method (100) for determining the security integrity of the functionality (2) of a distributed system (1), the method comprising the following steps: - Provide (101) at least one description of at least one characteristic of a component (9) of the distributed system (1) in order to provide at least one description of the at least one characteristic as meta-information of the component (9), wherein the component (9) participates in performing the function (2) of the distributed system (1). - Analyze (102) the meta-information of at least one other component (9') based on the meta-information of the component (9) in order to determine the influence between the component (9) and the at least one other component (9') based on the analysis, wherein the influence is determined at least based on the similarity between the at least one description of the component (9) and the at least one description of the at least one other component (9'), wherein the at least one other component (9') participates in performing the function (2) of the distributed system (1); - Classify (103) the function (2) of the distributed system (1) based on the determined impact, wherein at least one category is specific to the independence of the function (2) of the distributed system (1) in order to determine the security integrity of the function (2) of the distributed system (1) based on the classification.

2. The method (100) according to claim 1. Its features are, The distributed system (1) is a cyber-physical system and has a hierarchical structure with at least two levels, wherein the component (9) and the at least one other component (9') reside in one of the at least two levels, and wherein the method (100) optionally further includes the following steps: - Protect the metadata through certificates and / or public key infrastructure and / or distributed ledger technology and / or checksums.

3. The method (100) according to any one of the preceding claims. Its features are, The impact is determined by the dependencies and / or correlations between the components (9) and the at least one other component (9') of the distributed system (1), and the method (100) further includes the following steps: - The criticality of assessing the dependency and / or correlation between the component (9) and the at least one other component (9') in consideration of at least one boundary condition of the component (9) and / or the at least one other component (9').

4. The method (100) according to any one of the preceding claims. Its features are, The method (100) further includes the following steps: - Transmit the metadata of the component (9) and the at least one other component (9') to the central data processing device (30) so as to determine the security integrity of the function (2) of the distributed system (1) by the central data processing device (30).

5. The method (100) according to any one of the preceding claims. Its features are, The method (100) further includes the following steps: - Initiate measures based on the classification (103) of the functions (2) of the distributed system (1).

6. The method (100) according to any one of the preceding claims. Its features are, The method (100) further includes the following steps: - Compress and / or select the meta-information, wherein the compression and / or selection of the meta-information is performed based on checking the functional data of the component (9) and the at least one other component (9') in view of the integrity of the functional data.

7. The method (100) according to any one of the preceding claims. Its features are, The analysis of the metadata (102) includes the following steps: - The currently used path for performing the function (2) of the distributed system (1) and / or the dynamic reconfiguration of the redundant architecture of the distributed system (1), wherein preferably at least one fault tree and / or at least one fault probability and impact analysis network and / or at least one causal graph are also created based on the dynamic reconfiguration and / or the redundant architecture.

8. A computer program (20) comprising instructions that, when a computer (10) executes the computer program (20), cause the computer to perform the method (100) according to any one of the preceding claims.

9. An apparatus (10) for data processing, the apparatus being configured to perform the method (100) according to any one of claims 1 to 7.

10. A computer-readable storage medium (15) comprising instructions that, when executed by a computer (10), cause the computer to perform the steps of the method (100) according to any one of claims 1 to 7.

Images