Technical system device for Linux security remediation

Abstract

Technical system device for the continuous correction of Linux security vulnerabilities, comprehensive - at least one computing unit with an installed Linux operating system, - a patch control unit, - a storage system for recording information about known security vulnerabilities, - and an execution control unit, wherein the system device is configured to classify security vulnerabilities according to an assigned severity level and to provide patch operations via a severity-weighted patch pipeline, characterized in that that the execution of patch operations is exclusively enabled, restricted, or blocked by the execution control unit, taking into account predefined compliance requirements at the hardware or firmware level.

Description

Technical field

[0001] The invention relates to the field of technical IT security systems. In particular, the invention relates to a technical system device for the automated correction of security vulnerabilities in Linux-based computer systems, in which patch deployment and patch execution are controlled by hardware- or firmware-based control units. State of the art

[0002] Linux-based computer systems are used in servers, cloud infrastructures, embedded systems, and security-critical IT environments. Such systems are regularly affected by newly discovered security vulnerabilities that must be addressed promptly to ensure system integrity and operational reliability.

[0003] Known solutions for addressing security vulnerabilities are predominantly based on user-side software tools, scheduled update mechanisms, or administrative intervention. These established systems have several drawbacks. In particular, they lack a consistent technical prioritization of vulnerabilities according to severity, as well as system-level control of patch execution that takes regulatory or operational requirements into account.

[0004] Furthermore, known systems are highly dependent on user processes, application software, or operating system services, which can cause patch execution to be bypassed, delayed, or executed incorrectly. Object of the invention

[0005] The object of the present invention is to provide a technical system device which: • enables continuous patching of Linux security vulnerabilities, • Security vulnerabilities are technically prioritized according to severity, • Provides patch operations via a structured patch pipeline, • the execution of patch operations is controlled system-side, taking into account compliance requirements, and • works independently of user or application processes. Summary of the invention

[0006] The task is solved by a technical system device with at least one Linux-based computing unit, a patch control unit, a memory for vulnerability information, and an execution control unit.

[0007] The system device is designed to classify known security vulnerabilities based on an assigned severity level and to assign different levels within a severity-weighted patch pipeline to the respective patch operations.

[0008] Patch operations are made available independently of their execution. Actual execution is solely controlled by a hardware or firmware-based execution control unit, which allows, restricts, or blocks them. This process adheres to predefined compliance requirements that define the technical parameters for patch execution. Detailed description of the invention

[0009] The technical system device comprises at least one computing unit with an installed Linux operating system. The computing unit is coupled with a patch control unit, which is designed for managing security-relevant information and patch resources.

[0010] A memory serves to store information about known security vulnerabilities, in particular identification data and severity information. Based on this information, the patch control unit assigns patch operations to a multi-stage patch pipeline.

[0011] The system device also includes an execution control unit, which is designed as a separate hardware or firmware component. This execution control unit operates functionally independently of user processes, application software, or Linux services.

[0012] Patch operations are only executed after approval by the execution control unit. Approval is granted subject to predefined compliance requirements, which define technical system conditions such as system state, time window, authorization level, and target components.

[0013] Optionally, a logging unit can be provided which stores system-side tamper-proof status information about approved, restricted or blocked patch operations.

[0014] The invention is not limited to a specific patch source, security database or compliance standard and is suitable for servers, cloud systems, edge devices and other Linux-based IT infrastructures.

Claims

[1] Technical system device for the continuous correction of Linux security vulnerabilities, comprising - at least one computing unit with an installed Linux operating system, - a patch control unit, - a storage system for recording information about known security vulnerabilities, - and an execution control unit, wherein the system device is configured to classify security vulnerabilities according to an assigned severity level and to provide patch operations via a severity-weighted patch pipeline, characterized by , that the execution of patch operations is exclusively enabled, restricted, or blocked by the execution control unit, taking into account predefined compliance requirements at the hardware or firmware level. [2] System device according to claim 1, characterized bythat the execution control unit is designed to be functionally independent of user processes, application software, or operating system services of the Linux operating system. [3] System device according to claim 1, characterized by , that a system-side logging unit is provided which stores tamper-proof status information about approved, restricted or blocked patch operations.