Method and device for detecting tampering during communication between components of a system with requirements for its functional safety

Abstract

Disclosed are a system, a device, and a method for detecting tampering in communication between components of a system having functional safety requirements. The method comprises transmitting a request from an initiator to a bridge module of the system according to a first communication protocol and transmitting a response to the request from the bridge module to the initiator according to the first communication protocol to detect tampering in communication between the bridge module and the initiator; transmitting the request from the bridge module to a bus connection of the system according to a second communication protocol and transmitting a response to the request to the bridge module according to the second communication protocol.

Description

[0001] The present invention relates to a method and a device for detecting tampering during communication between components of a system with requirements for its functional safety, in particular for systems in the automotive, aviation, manufacturing and / or aerospace industries. State of the art

[0002] When manufacturing, modifying and / or improving components of a system that is subject to safety requirements, it is necessary to develop the system and its components in such a way that the functional safety requirements of the components and / or the system are met, even if a component is provided by a third party.

[0003] In conventional systems, a bus connection may be coupled between respective integrated circuits of the components to enable communication between a plurality of components of the system. An initiator of a component may be configured to request a read from and / or write to an addressed target of a component of the system via the bus connection. An addressed target may thus be configured to enable reading from and / or writing to a component of the system.

[0004] The bus connection can map the address provided by the initiator to the addressed target and / or forward the initiator's request to the addressed target. The bus connection can also forward a response back to the requesting initiator, e.g., from the addressed target via the bus connection.

[0005] In the exemplary case of communication between safety-relevant components of a system in the automotive, aerospace, manufacturing, and / or aerospace industries, it may be necessary for the communication to meet the functional safety requirements of the components and / or the system to prevent damage in the event of tampering with communication via the bus connection. This means that any tampering with a request from an initiator or a response from an addressed target must be prevented or at least detected if the tampering is relevant to the functional safety of the system.

[0006] In conventional bus connections, functional safety requirements can be met by adding redundancies to communicated data, for example, to detect bit flips. Redundancy can be implemented simply in the form of a parity bit. Alternatively or additionally, in more complex systems, a cyclic redundancy check (CRC) and / or an error correction code (ECC) can be implemented, as conceptually described, for example, in Moreira, J.C. and Farrell, P.G., "Essentials of Error Control Coding," John Wiley & Sons, 2006.

[0007] To protect against tampering, the communication between the initiator and the bus connection (interface protection on the initiator side), the communication within the bus connection (transport protection), and the communication between the bus connection and the target (interface protection on the target side) are regularly considered separately. The communication between components of a system is Fig. 1 using an example system. The solid and dotted lines indicate communication with interface and transport protection, while the dashed lines indicate communication without inherent protection.

[0008] End-to-end protection exists precisely when no communication occurs without inherent protection. For many use cases in the automotive, aviation, manufacturing, and / or aerospace industries, end-to-end protection is mandatory. For the purposes of this disclosure, it can be assumed that the components and the bus connection itself meet the functional safety requirements of the system. If this is not the case, two identical processor cores (central processing units, CPUs) can be used, for example, which operate in parallel and execute the same instructions simultaneously. This redundancy allows for tampering to be detected and, if necessary, responded to (dual core lock step, DCLS). Architectures with redundant memories are also possible.

[0009] While transport protection is regularly implemented in conventional systems, interface protection on the initiator and / or target side may be lacking in conventional systems because the components on the initiator and / or target side are regularly developed or have been developed without taking into account the functional safety requirements of the system in which they are used.

[0010] It would therefore be desirable to provide a method and a device for detecting errors when communicating between components of a system with requirements for its functional safety in order to enable simple end-to-end protection in the system with components from, for example, different manufacturers.

[0011] DE 10 2012 010 145 A1 discloses an input / output module (I / O module) for detecting input peripheral signals present at at least one signal peripheral connection and / or for outputting output peripheral signals at at least one signal peripheral connection, wherein the I / O module accommodates a microcontroller system with a first number of peripheral units, each with at least one signal peripheral connection, a second number of microprocessor units and at least one diagnostic unit. Disclosure of the invention

[0012] The invention provides a method and a device for detecting tampering during communication between components of a system with requirements for its functional safety with the features of the independent patent claims.

[0013] Preferred embodiments are the subject of the respective subclaims.

[0014] The disclosed methods and apparatus are particularly directed to improving interface protection on the initiator and / or target side to enable simple end-to-end protection with components from different manufacturers in a system.

[0015] Instead of adapting a component on the initiator and / or target side to the system's requirements, a bridge module can be inserted between the component and the bus connection. The bridge module ensures that an initiator's request is not corrupted and adds its own redundancy to the initiator's request to ensure that subsequent communication with the bus connection is not corrupted.

[0016] According to a first aspect, the invention relates to a method for detecting tampering during communication between components of a system with requirements for its functional safety. The method comprises transmitting a request from an initiator to a bridge module of the system according to a first communication protocol and transmitting a response to the request from the bridge module to the initiator according to the first communication protocol in order to detect tampering during communication between the bridge module and the initiator; transmitting the request from the bridge module to a bus connection of the system according to a second communication protocol and transmitting a response to the request to the bridge module according to the second communication protocol.

[0017] According to a further development, the method further comprises adding, by the bridge module, a redundancy to the request according to the second communication protocol.

[0018] According to a further development, the redundancy is configured to secure communication from the bridge module to the bus connection of the system.

[0019] According to a further development, transmitting the request from the initiator to the bridge module of the system according to the first communication protocol comprises sending, by the initiator, a first request to the bridge module, and sending, by the initiator, a second request to the bridge module, wherein the first request before sending and the second request before sending are identical; and transmitting the response to the request from the bridge module to the initiator according to the first communication protocol comprises sending, by the bridge module, a first response to the requests to the initiator, and sending, by the bridge module, a second response to the requests to the initiator, wherein the first response before sending and the second response before sending are identical.

[0020] According to a further development, the method comprises a comparison, by the bridge module, of the first request and the second request; and / or a comparison, by the initiator, of the first response and the second response.

[0021] According to a further development, the method comprises initiating an action in accordance with the functional safety requirements of the system in response to a determination that the first and second requirements do not match and / or the first and second responses do not match.

[0022] According to a further development, transmitting the request from the initiator to the bridge module of the system according to the first communication protocol comprises sending, by the initiator, a first checksum to the bridge module, and calculating, by the bridge module, a second checksum; and / or transmitting the response to the request from the bridge module to the initiator according to the first communication protocol comprises sending, by the bridge module, a third checksum to the initiator, and calculating, by the initiator, a fourth checksum.

[0023] According to a further development, the method comprises initiating a measure in accordance with the functional safety requirements of the system in response to a determination that the first and second checksums do not match; and / or initiating a measure in accordance with the functional safety requirements of the system (1000) in response to a determination that the third and fourth checksums do not match.

[0024] According to a second aspect, the invention relates to a device for detecting tampering during communication between components of a system with functional safety requirements. The device comprises a processor configured to perform the methods described above.

[0025] According to a third aspect, the invention relates to a system for detecting tampering during communication between components of the system with requirements for its functional safety. The system comprises a component with an initiator; a bus connection; and a device as described above, ie, a bridge module coupled between the initiator and the bus connection. Short description of the drawings

[0026] It shows: Fig. 1 is a schematic representation of an exemplary embodiment of a device for detecting errors in communication between components of a system with requirements for its functional safety; Fig. 2 is a schematic representation of an exemplary embodiment of a method for detecting errors in communication between components of a system with requirements for its functional safety using duplicated sequences; and Fig. 3 a schematic representation of an exemplary embodiment of a method for detecting errors in communication between components of a system with requirements for its functional safety using a checksum.

[0027] In all figures, identical or functionally equivalent elements and devices are provided with the same reference numerals. The numbering of process steps serves the purpose of clarity and is generally not intended to imply a specific chronological order. In particular, several process steps can be performed simultaneously. Description of the embodiments

[0028] Fig. 1 shows a schematic representation of an exemplary embodiment of a device 1200 for detecting errors during communication between components 1120 of a system 1000 with requirements for its functional safety. The system 1000 may include one or more components on an initiator side of the system 1000. The system 1000 may include one or more components on a target side of the system 1000. At least one component on the initiator and / or target side is coupled to a bus connection 1300 of the system 1000 via a bridge module 1200 of the system 1000.

[0029] In Fig. 1, on the initiator side, components 1110 and 1120 are coupled to bus connection 1300. Components 1110 and 1120 can each comprise an initiator 1111 or 1121. On the initiator side, only one component or more than two components can be coupled to bus connection 1300. Component 1120 can be the only component coupled to bus connection 1300 via bridge module 1200. Multiple components can also be coupled to bus connection 1300 via a single bridge module. Alternatively, each component can be coupled to bus connection 1300 via a separate bridge module.

[0030] In Fig. 1, on the target side, components 1410 to 1430 are coupled to bus connection 1300. Components 1410 to 1430 can each comprise a target 1411 to 1431. On the target side, only one component, or two or more than three components, can be coupled to bus connection 1300. As on the initiator side, on the target side, for example, only one, several, or every component can be coupled to bus connection 1300 via a single or separate bridge module. On the target side, each component can also be coupled directly to bus connection 1300. In other words, on the target side, no bridge module can be coupled between bus connection 1300 and the components on the target side.

[0031] Communication in the exemplary systems described above may follow a protocol that specifies which signals are set and read by the initiator or the target, and the order in which these signals occur to control communication. The signals may include an address signal that specifies which data is to be written and / or read according to a request from an initiator, and a data signal for transferring payload data between the initiator and the target, and vice versa. Furthermore, the signals may include control signals that, for example, define whether reading and / or writing is to take place, or that provide status regarding a request and / or a response to the request.

[0032] Fig. 2 shows a schematic representation of an exemplary embodiment of a method 2000 for detecting errors in communication between components of a system with requirements for its functional safety using duplicated sequences.

[0033] The method 2000 may include sending, by an initiator 2121, a first request to a bridge module 2200, and sending, by an initiator 2121, a second request to the bridge module 2200, wherein the first request before sending and the second request before sending are identical. The bridge module may be configured to receive the first request and to receive the second request.

[0034] In one step, the method 2000 may include comparing, by the bridge module, the first request and the second request, and determining whether or not the first request and the second request match.

[0035] In response to a determination that the first requirement and the second requirement do not match, the bridge module may be configured to detect tampering in order to satisfy the functional safety requirements of the system, e.g., by initiating an action to mitigate a risk that may be associated with the tampering.

[0036] In response to a determination that the first request and the second request match, the bridge module 2200 may be configured to send either only the first request or only the second request to a bus connection 2300. The bridge module 2200 may be further configured to add redundancy (Redundancy 1) to the first request or the second request.

[0037] In one step, the method 2000 may include transmitting the request to a bus connection 2300, and transmitting, through the bus connection 2300, a response to the request to the bridge module 2200, as in the Fig. 2. The request can be transmitted through bus connection 2300 to one or more targets 2411 through 24K1. The response to the request can be transmitted through bus connection 2300 from one or more targets 2411 through 24K1 to initiator 2121.

[0038] In one step, the method 2000 may include sending, by the bridge module 2200, a first response to the requests to the initiator 2121, and sending, by the bridge module 2200, a second response to the requests to the initiator 2121, wherein the first response before sending and the second response before sending are identical. The initiator 2121 may be configured to receive the first response and to receive the second response.

[0039] Redundancy (Redundancy 1) can be configured to protect an address (Address 1) and data (Data 1). For example, redundancy can protect communication from bridge module 2200 to bus connection 2300. Alternatively or additionally, redundancy can protect communication from bus connection 2300 to one or more destinations 2411 to 24K1.

[0040] Similarly, a redundancy (Redundancy 1') can be configured to secure a response (Response 1). For example, the redundancy can secure communication from one or more targets 2411 to 24K1 to bus connection 2300. Alternatively or additionally, the redundancy can secure communication from bus connection 2300 to bridge module 2200.

[0041] In one step, method 2000 may include comparing the received redundancy with a redundancy determined based on received data or based on the received response, and determining whether or not the received redundancy and the determined redundancy match. Only redundancies calculated based on the same data are compared.

[0042] In response to a determination that the received redundancy and the determined redundancy do not match, the receiving module, e.g., the bridge module 2200, may be configured to detect tampering to satisfy the functional safety requirements of the system, e.g., by initiating an action to mitigate a risk that may be associated with the tampering.

[0043] In response to a determination that the received redundancy and the determined redundancy match, the method 2000 may include sending, by the bridge module 2200, a first response to the requests to the initiator 2121, and sending, by the bridge module 2200, a second response to the requests to the initiator 2121, wherein the first response before sending and the second response before sending are identical. The initiator 2121 may be configured to receive the first response and to receive the second response to enable the initiator 2121 to compare the first response and the second response to initiate, if appropriate, a risk mitigation measure upon detection of tampering in accordance with the functional safety requirements of the system.

[0044] Fig. 3 shows a schematic representation of an exemplary embodiment of a method 3000 for detecting errors in communication between components of a system with requirements for its functional safety using a checksum.

[0045] The method 3000 may include, in one step, sending, by an initiator 3121, a request with a sequence of addresses and / or data and a first checksum calculated by the initiator 3121 to a bridge module 3200. A checksum may, for example, be a cyclic redundancy check. The configuration of the first checksum may be specified in a virtual address of the request. The first checksum calculated by the initiator 3121 may be transmitted as the last data word in the sequence. An address corresponding to the last data word may, for example, be a virtual address that enables the bridge module 3200 to recognize the end of the sequence and thus the first checksum.

[0046] In one step, the method 3000 may include calculating, by the bridge module 3200, a second checksum based on the request received from the initiator 3121 with the sequence of addresses and / or data to compare the first checksum and the second checksum.

[0047] In one step, the method 3000 may comprise transmitting the request with the sequence of addresses and / or data to a bus connection 3300, and transmitting, through the bus connection 3300, a response with a sequence of responses to the bridge module 3200, as in the Fig. 3 shown.

[0048] The bridge module 3200 may be further configured to add redundancies (redundancy 1 through redundancy N) to the sequence of addresses and / or data.

[0049] The bus connection 3300 may be configured to transmit to one or more destinations 3411 to 34K1 and / or to transmit from one or more destinations 3411 to 34K1.

[0050] In one step, the method 3000 may include sending, by the bridge module 3200, a response including the sequence of responses and a third checksum calculated by the bridge module 3200 to the initiator 3121. The initiator 3121 may be configured to receive the response including the sequence of responses and to receive the third checksum to enable comparing the third checksum calculated by the bridge module 3200 with a fourth checksum calculated by the initiator 3121.

[0051] In one step, method 3000 may include comparing the received redundancies with redundancies determined based on received addresses and / or data or based on the received responses, and determining whether or not the received redundancies and the determined redundancies match. Only redundancies calculated based on the same data will be compared.

[0052] In response to a determination that the received redundancies and the determined redundancies do not match, the receiving module, e.g., the bridge module, may be configured to detect tampering in order to meet the functional safety requirements of the system, e.g., by initiating an action to mitigate a risk that may be associated with the tampering.

[0053] In response to a determination that the received redundancies and the determined redundancies match, the method 3000 may include sending, by the bridge module 3200, a response comprising the sequence of responses and a third checksum calculated by the bridge module 3200 to the initiator 3121. The initiator 3121 may be configured to receive the response comprising the sequence of responses and to receive the third checksum to enable a comparison of the third checksum calculated by the bridge module 3200 with a fourth checksum calculated by the initiator 3121 to initiate a risk mitigation measure, if appropriate, upon detection of tampering in accordance with the functional safety requirements of the system.

[0054] The devices and methods can be advantageous because neither the bus connection nor the addressed targets need to be modified to support the specific access patterns of an initiator. It is also not necessary for all accesses in a sequence to address the same target. Furthermore, redundant accesses from an initiator can be handled locally in the bridge module rather than forwarded to the other bus participants, preventing loading and / or overloading of the bus connection.

[0055] It should be noted that different functional safety requirements may be applicable in different industries, countries, and regions, to which reference is made generally without clearly identifying each applicable requirement. The principles of the devices and methods disclosed herein are applicable in conjunction with each of these requirements. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2012 010 145 A1

[0011] Cited non-patent literature

[0000] Moreira, JC and Farrell, PG, Essentials of error control coding, John Wiley & Sons, 2006

[0006]

Claims

[1] Method (2000; 3000) for detecting corruption in communication between components of a system (1000) with requirements for its functional safety, the method (2000; 3000) comprising: Transmitting a request from an initiator (1121; 2121; 3121) to a bridge module (1200; 2200; 3200) of the system (1000) according to a first communication protocol and transmitting a response to the request from the bridge module (1200; 2200; 3200) to the initiator (1121; 2121; 3121) according to the first communication protocol in order to detect tampering in communication between the bridge module (1200; 2200; 3200) and the initiator (1121; 2121; 3121); Transmitting the request from the bridge module (1200; 2200; 3200) to a bus connection (2300; 3300) of the system (1000) according to a second communication protocol and transmitting a response to the request to the bridge module (1200; 2200; 3200) according to the second communication protocol. [2] The method (2000; 3000) of claim 1, wherein the method (2000; 3000) further comprises: Adding, by the bridge module (1200; 2200; 3200), redundancy to the request according to the second communication protocol. [3] The method (2000; 3000) of claim 2, wherein the redundancy is configured to secure communication from the bridge module (1200; 2200; 3200) to the bus connection (2300; 3300) of the system (1000). [4] Method (2000) according to any one of claims 1 to 3, wherein transmitting the request from the initiator (2121) to the bridge module (2200) of the system (1000) according to the first communication protocol comprises sending, by the initiator (2121), a first request to the bridge module (2200), and sending, by the initiator (2121), a second request to the bridge module (2200), wherein the first request before sending and the second request before sending are identical; and transmitting the response to the request from the bridge module (2200) to the initiator (2121) according to the first communication protocol comprises sending, by the bridge module (2200), a first response to the requests to the initiator (2121), and sending, by the bridge module (2200), a second response to the requests to the initiator (2121), wherein the first response before sending and the second response before sending are identical. [5] The method (2000) of claim 4, wherein the method (2000) comprises: Comparing, by the bridge module (1200; 2200; 3200), the first request and the second request; and / or Comparison, by the initiator (2121), of the first answer and the second answer. [6] The method (2000) of claim 5, wherein the method (2000) comprises: Initiating an action in accordance with the functional safety requirements of the system (1000) in response to a determination that the first and second requirements do not match and / or the first and second responses do not match. [7] Method (3000) according to any one of claims 1 to 3, wherein transmitting the request from the initiator (3121) to the bridge module (3200) of the system (1000) according to the first communication protocol comprises sending, by the initiator (3121), a first checksum to the bridge module (3200), and calculating, by the bridge module (3200), a second checksum; and / or transmitting the response to the request from the bridge module (3200) to the initiator (3121) according to the first communication protocol comprises sending, by the bridge module (3200), a third checksum to the initiator (2121), and calculating, by the initiator (2121), a fourth checksum. [8] The method (3000) of claim 7, wherein the method (3000) comprises: Initiating an action in accordance with the functional safety requirements of the system (1000) in response to a determination that the first and second checksums do not match; and or Initiating an action in accordance with the functional safety requirements of the system (1000) in response to a determination that the third and fourth checksums do not match. [9] Device (1200) for detecting tampering in communication between components of a system (1000) with requirements for its functional safety, the device (1200) comprising: a processor configured to perform the methods (2000; 3000) according to any one of claims 1 to 8. [10] System (1000) for detecting tampering when communicating between components of the system (1000) with requirements for its functional safety, the system (1000) comprising: a component (1120) with an initiator (1121); a bus connection (1300); and a device (1200) according to claim 9, coupled between the initiator (1121) and the bus connection (1300).

Images