METHOD AND ASSOCIATED COMPUTER SYSTEMS FOR SAVING DATA INTEGRITY

Description

Technical area

[0001] The present invention relates generally to a method and corresponding computer-based devices for ensuring the integrity of data for operating a service. The invention relates in particular to a method for generating an intended state of data that can be stored or secured in a medium or system, for transmitting the intended state of the data to another system, for checking and ensuring the integrity of the data on the other system, and for enabling later analysis following unwanted manipulation of the data. The invention further relates to computer-readable media with computer-executable program products, to computer systems containing these media and program products, and to a computer network of computer systems, wherein these carry out the method or the individual method steps at least partially or completely. State of the art

[0002] The present invention relates to the technical field of data processing, in particular, it is an invention from the field of IT security. Various techniques are known from the prior art in this technical field of data processing.

[0003] In particular, IT security must be understood less as a state and much more as a process, since new developments are constantly emerging, both on the part of attackers and on the part of users who want to protect their systems, and these developments are spreading rapidly via the Internet.

[0004] Various methods have been established to secure computer communication over networks.

[0005] A computer is a physical representation of a universal Turing machine. It runs a computer program that provides basic functions such as file access, (visual) user interfaces (GUIs), and networking functionality (operating system / OS). The operating system, in turn, allows the execution of additional software that can be written at a different level of abstraction.

[0006] A computer usually consists of at least one central processing unit (CPU), a main memory (RAM) and a permanent memory.

[0007] So-called smartphones or IoT (Internet of Things) devices, such as webcams, smart light bulbs, thermostats, but also washing machines, dishwashers, etc. can also be computers according to this definition.

[0008] A network is a group of logically separate computer systems that can communicate with each other. If multiple computer systems are running on a single physical computer and these computer systems can communicate with each other, this is also referred to as a network.

[0009] If one wants to distinguish between a network of computers and a network of computer systems within a computer, the former is referred to as a physical network and the latter as a virtual network. A virtual network (virtual local area network, VLAN) can also be established over a physical network between computer systems distributed across multiple computers.

[0010] Networks are primarily used to exchange information between computers. This information exchange takes place through various (web) services.

[0011] A (web) service consists of at least one computer program that provides at least one functionality over a network. This can also be a virtual network within a host computer. Web services typically disclose information. The terms "service," "web service," or "internet service" are used synonymously with "web services." Web services are typically characterized by the fact that they can be accessed via certain predefined protocols, such as the Hypertext Transfer Protocol (HTTP).

[0012] In principle, there are various ways to operate and scale a web service. The obvious approach would probably be to run a computer on a network with an operating system and run a web service on that computer.

[0013] To scale, you could then first upgrade the computer until it reaches the maximum performance of the current hardware generation.

[0014] For various reasons, different means of virtualization, especially virtual machines and so-called containers (also called jails), have become established.

[0015] A computer system, therefore, refers to any configuration (computer with operating system, virtual machine, container, etc.) that meets the necessary requirements for operating a web service (usually providing a file system, network functionality, and running software). To provide software functionality, a computer system includes, in particular, media (hardware) with computer program products (computer-readable software) stored on it.

[0016] A software agent, hereinafter also referred to as agent, refers to a computer program product which has a precisely specified, independent behavior, i.e. which carries out its specific task without external request.

[0017] A computer system that provides a web service on a network is called a server or web server.

[0018] A network where one must assume that a potential attacker has access to another computer within that network, allowing the attacker to send any data over the network and potentially attack one's own computer system, is insecure. The internet is a particularly insecure network.

[0019] A variety of techniques are available to secure communication over a potentially insecure network.

[0020] For example, a technique known from the state of the art involves calculating a hash value (also known as a hash value or checksum) from data. A hash function is often used for this purpose. Such a hash function is provided, for example, by the secure hash algorithm (SHA). A hash function can often map a data block, not necessarily limited in size, to a data block of fixed size, the hash value. A typical hash length, for example, is 256 bits. A desirable property of a good cryptographic hash function is approximate injectivity and the resulting approximate collision resistance. The "ideal hash function" is therefore completely left-unique and collision-free, always mapping different input data to different hashes.

[0021] The Transmission Control Protocol (TCP) is a typical use case for a hash function, where a hash value is calculated for a large amount of data. For example, a large amount of data is to be transmitted over a potentially insecure transmission medium, such as the internet. For example, a technical error could cause some of the data to be transmitted incorrectly, or a third party (attacker) could tamper with the data.

[0022] If the sender of the data calculates its hash value and makes this hash value available to the receiver, the receiver can verify the authenticity and integrity of the data, provided the hash value itself is genuine and reliable.

[0023] Beyond the use of checksums, the use of encryption, especially asymmetric encryption, has become established. This offers the advantage that the key exchange can take place over an insecure network. A private and a public key are generated. Data encrypted with the public key can only be decrypted using the private key.

[0024] In addition to verifying integrity after a transmission using checksums, there is also the option of securing integrity through the use of certificates. This is typically based on the use of asymmetric encryption, in which a web service provides a certificate in which a trusted authority guarantees the identity of the web service (by signing it with a certificate). A certificate then usually contains a public key that can be used to encrypt the initial communication with the web service.

[0025] However, the hashing method has the disadvantage that the method is completely invalidated if the hash value itself is tampered with during a man-in-the-middle attack. In one example, a user A (e.g., Alice) transfers a file to a user B (e.g., Bob), along with the file's hash value. An attacker E (e.g., Eve) intercepts this communication and replaces the file with a fake one. The fake file contains fake data. E also replaces the file's hash value with the hash value of the fake file. When B now receives the data and verifies it by calculating the hash function of the file itself and comparing it with the hash value, it concludes that the data has not been tampered with. Thus, E has successfully tampered with the data without B being aware of it.This cannot necessarily be determined even by common encryption methods such as SSL, since the certificates used for encryption can also be replaced by E, so that both parties communicate encrypted with E and assume that the connection is secure.

[0026] Man-in-the-middle attacks can be largely avoided by exchanging the certificates they expect from each other during communication between A and B, thus preventing an attacker from manipulating the communication. This process is called certificate pinning.

[0027] Once communication between two computers is sufficiently protected, it becomes easier and therefore less expensive for a potential attacker to directly attack one of the communicating parties in order to intercept or manipulate the communication. Therefore, it is essential to adequately secure individual computer systems as well.

[0028] Attacks on web services are particularly attractive to potential attackers because a successful attack can sometimes give them access to communications with dozens, hundreds, or even thousands of the victim's customers, who in turn believe the loaded data to be legitimate and trust it.

[0029] This results in a particular need for protection for operators of web services, especially since the operator's competitors and other interest groups such as hackers with a profit intention, but also groups such as Anonymous, which attack targets purely on the basis of ideological motivation.

[0030] In addition, with the introduction of data protection regulations such as the General Data Protection Regulation (GDPR), but also previously in the handling of payment data such as credit card data, a considerable risk of economic damage is associated with the operation of a web service.

[0031] In general, it can be said that securing computer systems requires an approach with as many layers of protection as possible, since almost any protection system can be overcome. However, economically motivated attackers, in particular, usually attack the easiest targets first, as they, too, are subject to the intention of maximizing profits. Many simple and successful attacks are generally more profitable than an attack on a complexly secured system. Therefore, the benefits of additional security measures usually outweigh the costs incurred for the security measures.

[0032] The first layer of protection against an attacker is usually a firewall, which monitors both incoming and outgoing communication on a computer and allows the assignment of processes on the computer to specific protocols, ports, URLs and IP addresses.

[0033] This can involve blacklisting, i.e. a negative determination of access rights, or whitelisting, a positive determination of access rights.

[0034] Antivirus programs regularly check a computer's permanent storage for known malware. To do this, the antivirus provider collects signatures of known malware and often also certain behavioral patterns. The disadvantage of this method is that scanning the storage medium in this way is relatively computationally intensive and therefore time-consuming. Furthermore, it requires that the malware is already known.

[0035] Another protective measure for securing IT systems is authorization management, which regulates the sensible administration of access authorizations. According to the "principle of least privilege," applications and processes should only be started with the minimum necessary authorizations. Furthermore, file system structures should only be changeable to the extent necessary for the respective technical user (e.g., a user running a web server). This user could, for example, have read permissions for the corresponding configuration without being able to write to it.

[0036] In practice, this measure is very time-consuming and often leads to misconfigurations because the correct configuration of authorization management is very complex and confusing.

[0037] Sandboxing is a process, usually carried out by the operating system, that ensures that an application can only access a section of the file system assigned to it, preventing that application from manipulating other applications' data, especially other applications. It is therefore essentially a specialized, automated application of permission management.

[0038] DE 601 32 833 T2 discloses a method in which data entering a computer system that could potentially lead to manipulation is transferred to an isolated sandbox area, where it can be analyzed. To ensure secure transmission of potentially malicious data, cryptographic encryption is used, which is only removed in the sandbox area. The method is specifically aimed at a computer system that regularly receives data and therefore requires intelligent screening to classify incoming data as potentially malicious. The method examines the entire file as soon as it is transferred to the computer system, eliminating the need to monitor or distinguish between data changes.

[0039] Another option is to isolate different services into separate computer systems. Instead of providing multiple services such as webmail, database, and website on one computer within a single operating system, these services are distributed across different virtual machines or containers, for example, so that a compromised mail server, for example, does not automatically lead to a compromised database.

[0040] In addition to the solution using antivirus software, which maintains a negative permission list (programs that are not allowed to run), there is also the option of allowing only certain applications, whose integrity is often ensured by checksums. This option is called whitelisting.

[0041] US 2020 / 366696 A1 and US 2001 / 044820 A1 disclose methods in which the integrity of web services is specifically monitored to address the demanding threat landscape on the World Wide Web. However, in these methods, in response to identified manipulation of the web service, only a pre-specified warning is issued to another system, or the web service is partially shut down, or the manipulated code is removed. Thus, the entire web service is not restored. Especially if it was unclear which part of the web service was compromised and in what way, a subsequent analysis of the attack target and type of attack while simultaneously restoring the web service is not possible.

[0042] DE 20 2014 010 889 U1 discloses a method for verifying the trustworthiness of at least one web service on a server exposed to the Internet. Web applications hosted there, or changes to these web applications, are examined for their trustworthiness using a combination of the methods described above, including blacklisting and whitelisting, checking for known virus and malware code, and checking for changes to cryptographic hash values, as well as listing and evaluating various data sources with regard to their confidence. Unknown attack methods could nevertheless initially overcome the automated verification procedures, allowing malicious code to be hosted on the server.However, the described server simultaneously contains the verified and unverified web applications as well as the verification criteria for verified web applications, so that successful external access to this server (compare: man-in-the-middle attack) could manipulate the intended state of the hosted web applications, as well as possibly manipulate future verification criteria unnoticed, since it is not a distributed or separate computer system.

[0043] A computer system that is particularly protected by applying other, in particular several complementary, state-of-the-art methods and, in particular, is only accessible to a limited extent from an insecure network such as the Internet, is a protected computer system within the meaning of this document.

[0044] The so-called zero-trust approach sets a particularly high standard of protection in the area of ​​IT security. Zero-trust implies that no participant or user, for example, of a network, is fundamentally trusted. For example, the zero-trust approach involves always reviewing requested changes to certain data in a web service before implementing the change.

[0045] In addition to securing a web service, efficiency is also a priority. Long loading times, in particular, quickly lead to users abandoning the service and accessing the website of an alternative provider out of impatience. Cost-effective scaling also plays a role in the economic operation of web services.

[0046] Often, the data provided by a web service is partially or completely recalculated at the time of the request. Caching is the process by which the generated data, such as HTML documents, is stored for a limited period of time and then delivered again when an identical request is made within that period, without the entire calculation having to be repeated. This saves computing power and minimizes data loading time. Caching for web services is known from US 2005 / 0193096 A1 and US 2008 / 0098301 A1. .

[0047] As already described, when operating a web service, there is sometimes a need to handle the load more efficiently, for example, to satisfy more users. A key factor in the success of a web service is the loading time before the server provides a response to the user (response time).

[0048] In order to keep this loading time as short as possible, additional computer systems are usually provided as servers that process requests in parallel and can thus significantly reduce the waiting time when there are a large number of requests.

[0049] Furthermore, operators of an international web service may also decide to operate computer systems in other data centers to reduce the distance to their customers, so that loading times for the customer are not affected by imponderables such as physical limitations of the transmission lines, peering agreements between different Internet service providers (ISPs), or similar.

[0050] Furthermore, these procedures are usually also suitable for increasing the reliability of a web service.

[0051] Procedures of the type described here are called "load balancing".

[0052] In addition to the methods already described, for the sake of completeness, other technologies that can play a role in operating a web service should be mentioned: BitTorrent is a protocol for exchanging files on the Internet. Files are exchanged directly between computers over a network, without the need for a central instance for coordination. The protocol also uses checksums to verify that parts of files have been transferred correctly. Some providers offer data synchronization based on this protocol. This is also suitable, for example, for synchronizing the data required to operate a web service between different computer systems that jointly implement load balancing.

[0053] Many networks, especially corporate networks, also have a proxy server that receives internet requests from computers on the network and forwards them to the appropriate servers. This is usually done for security reasons or to prohibit certain activities within the network. Using a proxy server can also conceal a computer's IP address, as the computer being addressed only receives the proxy's IP address.

[0054] A reverse proxy is the opposite. It is typically placed in front of the actual web service when operating a web service to secure the web service, conceal certain web service functions from the internet, or implement load balancing. Task

[0055] The object of the present invention is to ensure the integrity of data, such as files or data stored in databases, on servers that provide a web service and are exposed in a network. Furthermore, the object of the present invention is to ensure the immediate isolation of compromised data in the event of tampering, particularly on a server or on a computer-readable medium. The isolated data should not be able to cause damage to the computer system, but should simultaneously be analyzable. Furthermore, the data and the web service should be restored to a state prior to tampering. Solution

[0056] According to the invention, the object is achieved by a method for protecting the integrity of data with the following steps: a) Creating (S01) an intended state (3) of data of a web service (2) on a first / primary, secure computer system (also referred to herein as primary system or primary computer system) (1); b) Transferring (S02) the data through a secure connection to one or more servers (also referred to herein as secondary computer systems) (7) in a potentially insecure network for providing a web service (8); c) Checking (S03) (20) the integrity of the data, preferably by an agent in the secondary computer system (11), in such a way that any manipulation of the data, in particular the files and data, by an attacker is detected; d) Restoring (S04) (21), in particular immediately restoring, the intended state of the data (19) at the time before the manipulation, in particular the unintentional manipulation; wherein preferably between steps S03 and S04, ie between the step of checking (S03) and the step of restoring (S04) after a manipulation (17), the data are quarantined so that they can be analyzed subsequently but are no longer executed and thus cannot cause any damage.

[0057] Further advantageous embodiments can be found in the subclaims and the description. General benefits

[0058] The method according to the invention significantly increases security when operating a web service, while significantly reducing the technical effort required for security and thus the operating costs. The software architecture principles reduce or eliminate the generally known technical risks when operating a web service without in-depth, specific knowledge of the program used. The tamper protection, in its inventive design, corresponds to the zero-trust principle based on the principle of "don't trust, always verify," but at the same time allows for a subsequent analysis of potential attacks. Furthermore, the method according to the invention enormously increases the technical effort and thus the costs for a potential attacker, since this a) must know that the web service is protected by this procedure, b) cannot attack the agent (11) because the agent in the secondary system itself is protected by the procedure, c) it cannot use the web service (8) to attack other users without being discovered, d) cannot attack the primary system (1) either because the primary system communicates exclusively with the agent via a secure connection and is otherwise not connected to the insecure network.

[0059] Due to the significantly increased costs for the attacker, it cannot be assumed that such a protected secondary system (7) would be further attacked, since attackers are also subject to economic constraints and thus have to maximize the profit per effort. Detailed description of the invention

[0060] According to the method according to the invention, an intended state of data is created (S01) on a primary computer system in a protected network. This data includes, in particular, files for providing a web service as well as data from databases. By storing the data in the protected network, the intended state of the data cannot be directly attacked or manipulated.

[0061] The data is transferred to a secondary computer system running the web service (S02). This secondary computer system is exposed in an insecure network, such as the Internet, and is therefore vulnerable.

[0062] According to a preferred embodiment of the present invention, between steps S03 and S04, ie between the step of checking (S03) and the step of restoring (S04), the data are quarantined after a detected unintentional manipulation, so that the data can be analyzed subsequently but can no longer be executed, thereby advantageously preventing further damage after the check.

[0063] The integrity of at least the secondary computer system in the insecure network is therefore advantageously checked by a computer program product (hereinafter: agent) (S03). Manipulated data is quarantined, preferably by the agent, after an unintentional manipulation has been detected, so that the data can be analyzed afterwards but can no longer be executed, which advantageously prevents further damage after the check. This manipulation can be designed according to the invention in such a way that manipulations are always quarantined, even if it is not clear whether the manipulation is of a hostile nature. A system protected in this way is advantageously secured according to the zero-trust approach and is ideal for security-critical web services in exposed networks. Placing the data in quarantine serves to protect the computer system. For this purpose, conspicuous (manipulated) data, e.g.A corrupted file is moved to a directory, preferably on a server, from which a program contained in this file cannot be launched (isolation). This directory is preferably located on another, separate system, where this system has no access rights to other systems and does not allow the execution of external programs. Alternatively, isolation is preferably achieved through sandboxing on the secondary system. Alternatively, isolation is preferably achieved through restrictive permission management of a directory on the secondary system.

[0064] Following a manipulation, the agent restores the intended state from S01 (S04). The restoration of the state is preferably initiated immediately at the time the manipulation is detected, in order to be able to offer the web service again as quickly as technically possible.

[0065] In a preferred embodiment, changes to the data, as an example of manipulation (17) of data, are detected on the basis of cryptographic methods.

[0066] Signatures using certificates are a suitable cryptographic method, for example. This method is standardized and error-free, so false positives should not occur.

[0067] Alternatively, it is preferable to use hash values ​​such as SHA256, SHA512, MD5 with the lowest possible collision probability to ensure that the file is not modified at all. This may be slightly more error-prone but also more secure.

[0068] In a further preferred embodiment of the invention, the checking (S03) (20) of the integrity of the data (also referred to as checking), in particular of the files or parts of files, takes place immediately after the manipulation of the data, in particular of the files or parts of files.

[0069] This can be done, for example, by regularly checking the integrity, in particular more frequently than once per hour, furthermore in particular more frequently than once every 30 minutes, furthermore in particular more frequently than once every 10 minutes, furthermore in particular more frequently than once every 5 minutes, furthermore in particular more frequently than once per minute, furthermore in particular more frequently than once per second, furthermore in particular more frequently than once per 500 milliseconds, furthermore in particular more frequently than once per 100 milliseconds, furthermore in particular more frequently than once per 10 milliseconds, furthermore in particular more frequently than once per millisecond, furthermore in particular more frequently than once per 500 microseconds, furthermore in particular more frequently than once per 100 microseconds, furthermore in particular more frequently than once per 100 microseconds, furthermore in particular more frequently than once per 10 microseconds, furthermore in particular more frequently than once per microsecond,furthermore, in particular, more frequently than once per 500 nanoseconds, furthermore, in particular, more frequently than once per 100 nanoseconds, furthermore, in particular, more frequently than once per 10 nanoseconds, furthermore, in particular, more frequently than once per nanosecond, furthermore, in particular, more frequently than once per 500 picoseconds, furthermore, in particular, more frequently than once per 100 picoseconds, furthermore, in particular, more frequently than once per 10 picoseconds, furthermore, in particular, more frequently than once per picosecond, furthermore, in particular, more frequently than once per 500 femtoseconds, furthermore, in particular, more frequently than once per 100 femtoseconds, furthermore, in particular, more frequently than once per 10 femtoseconds, furthermore, in particular, more frequently than once per femtosecond.

[0070] In the case of regular file checking, the check interval should preferably be in the order of magnitude of the execution time of the necessary clock cycles of the CPU, depending on the check algorithm used.

[0071] Regular testing at extremely short intervals significantly shortens the time an attacker has to achieve their goals, ideally preventing them from causing any damage. Since many attacks require manual analysis by the attacker after a (semi-)automatic infection of the attacked system, a significantly higher level of security can be achieved by performing tests at intervals of just a few minutes. By further shortening the testing interval, even highly automated attacks can be detected and blocked before any damage can occur.

[0072] Alternatively, the immediacy of the check can be ensured by using watchdogs. Modern operating systems allow the registration of a so-called watchdog. This tells the operating system that a specific process should be launched if a file or the contents of a directory are tampered with. This process is called a watchdog.

[0073] In one embodiment of the method according to the invention, the use of a watchdog allows for immediate response to data manipulation without tying up many resources through constant checking. This represents a resource-saving implementation for ensuring immediate checking of manipulated data.

[0074] It can be provided in the method that data defined by a user (e.g. files, file parts and / or other data) are registered for checking (S03) for manipulation or that data defined by a user (e.g. files, file parts and / or other data) are excluded from the checking (S03) for manipulation. In a further embodiment of the invention, the user of the method according to the invention can therefore specify that data, files or parts of files (file parts) of the web service are checked in step S03, ie in the step of checking (S03), and in the event of manipulation, are isolated (blacklisting). In a preferred further embodiment of the invention, the user of the method according to the invention can specify that data, files or parts of files of the web service are checked in step S03, ie in the step of

[0075] Checking (S03), not being checked (whitelisting). Both embodiments of the method represent options for deviating from the intended principle of quarantining all manipulated files according to the zero-trust approach. The whitelisting approach is the preferred embodiment of the invention, as it allows the user to accept known changes to prevent false positive manipulation cases—i.e., those that were not hostile. At the same time, the zero-trust approach remains in place for all unlisted manipulation cases, including potentially unknown cases.

[0076] In a further preferred embodiment, in step S01 of the method, i.e., in the step of generating the intended state (S01), supposedly dynamic data of the web service, in particular files such as HTML pages rendered by PHP, are transferred to the secondary system as static files such as HTML, JSON, or XML files, as far as the service being operated permits. This is helpful for executing potential security vulnerabilities in the executable program code, as far as possible, exclusively on the primary, secure system, and advantageously improves loading times and the reliability of the service.

[0077] It can be provided that the triggering of the transfer of the data from the primary computer system (1) to a secondary computer system (7) a) is triggered manually, or b) is triggered automatically based on a timer, or c) is triggered automatically after the intended state of the data has changed.

[0078] In one possible embodiment of the method according to the invention, the transfer of data from a primary to a secondary system takes place manually. This gives the website operator full control over when and which data is transferred.

[0079] In a preferred embodiment, the data transfer is performed automatically on a time-controlled basis, ensuring that the web service, in its publicly accessible form, is regularly updated to the current, intended state of the data. The timing, in turn, can correspond to a random pattern, so that a potential attacker cannot predict when the next transfer will occur.

[0080] In a particularly preferred embodiment of the method, the data transfer takes place automatically after the intended state of the data has changed. This has the advantage that the publicly accessible version of the data always corresponds to the most recently updated state.

[0081] The transmission of the data can optionally comprise a) the entire intended state, but preferably b) only the difference to the previous intended state of the data from the primary to the secondary system. According to a), the possibility of errors due to an incorrect delta calculation is more limited, but b) offers bandwidth savings, which is particularly advantageous with large amounts of data. Furthermore, the option of incremental updates offers the advantage that even compromised communication between the primary and secondary systems does not allow any conclusions to be drawn about all of the data for operating the web service. According to a preferred embodiment of the invention, according to b), in the step of transmitting the data (S02), only the difference between the intended state and the temporally preceding intended state of the data is transmitted from the primary computer system (1) to the secondary computer system (7).In a further preferred embodiment of the invention, according to a), each change of an intended state (3) and each transmission to the secondary computer system in the step of transmitting the data (S02) is stored in an audit-proof manner, thereby enabling subsequent auditing.

[0082] In a further development of the procedure, the change of the intended states and their transmission are stored in an audit-proof manner, which enables later auditing.

[0083] Change auditing is a practice that allows for retrospective tracking of when and by whom changes were made. To achieve this, the data must be stored in an audit-proof, immutable manner.

[0084] This is preferably done using a blockchain, as it allows information to be stored and transmitted in a decentralized, audit-proof manner, which also allows S02 to be implemented at least in part.

[0085] Blockchain is a technology that stores information similar to a database. Instead of being stored centrally in one computer system, the information resides on many systems simultaneously. All instances of the database contain all the information, and the entire history is accessible at any time. As long as consensus is not reached across the network of all instances, historical entries cannot be deleted.

[0086] The method according to the invention also protects data in a database. The integrity of the data in the database is ensured by a) either after each desired manipulation of the data by the web service, the corresponding query is first checked for malicious inputs (e.g. SQL injections, or changes to prohibited data records, such as database users or rights), then securely transferred to the primary system and subsequently the changes to the data are mirrored to the secondary systems, or b) after each desired manipulation of the data by the web service, the query is first checked for malicious inputs (e.g. SQL injections, or changes to prohibited data records, such as database users or-rights) is checked and then securely transferred to the primary system, and read accesses to the database are also checked by the agent and transferred to the primary system, so that no database is necessary in the secondary system, or c) the database on the secondary system is regularly checked for unintentional changes to prohibited data records such as database users or other data that does not need to be processed by the service.

[0087] According to a preferred embodiment of the invention, the data for generating the web service are selected from data in a database, and the integrity of the data in the database (4) is ensured by a) either each query to the database (13) is first checked, in particular by the agent (11), for malicious inputs (e.g.SQL injections, or changes to forbidden data records, such as database users) are checked, then securely transferred to the primary database (4) of the primary computer system (1) (14) and subsequently the changes made are mirrored to the secondary database (9) in the secondary computer system (7), or b) each query to the database (13) is first checked, in particular by the agent (11), for malicious inputs and then securely transferred to the primary computer system (1) (14) and read accesses (15) to the database are also checked, in particular by the agent (11), and transferred to the primary computer system (16), so that no database is necessary in the secondary system (7), or c) the database on the secondary system (9) is regularly checked, in particular by the agent (11), for changes to forbidden data records that are not to be processed by the web service (8).

[0088] Protecting data in databases is particularly important because it can prevent well-known problems such as SQL injections. SQL injections are a major security problem that allows an attacker to gain access to arbitrary data in a database if the software accessing the database is not adequately secured. No current method protects all third-party software from such attacks.

[0089] This is particularly relevant because small and medium-sized companies in particular often use software, for example to operate an online shop, that they did not develop themselves, meaning they have no information about possible security vulnerabilities.

[0090] In a preferred embodiment, several secondary systems are operated in parallel to distribute the load by means of load balancing, thus minimizing loading times of the operated service and further advantageously increasing reliability. Consequently, several secondary systems (7) can be operated in parallel to advantageously enable load balancing, particularly of the web application.

[0091] In a further preferred implementation of the method with multiple secondary systems, after a breach of the integrity of a piece of data, the entire secondary server or system (7) on which the integrity was compromised is isolated to enable subsequent analysis of the entire attack. In this case, isolation also includes shutting down the entire system to prevent any malware running from erasing its traces. This advantageously facilitates attribution of the attack.

[0092] In a further preferred implementation of the method, in the case of isolation of the entire secondary system, the system is not stopped in order to analyze the further functioning of any running malware. This means that the isolated secondary system is preferably not shut down, but rather continues to operate in isolation for the purpose of analyzing the malware. This method can also be advantageously applied if it can be suspected that the malware is removing its traces when the program is shut down.

[0093] Furthermore, in the case of isolating a secondary system, a replacement system is preferably started in order to maintain the load balancing function.

[0094] In a further embodiment of the method, a reverse proxy is also introduced to prevent so-called (D)DoS attacks. This can be done in an embodiment with one or more secondary systems. For example, a reverse proxy can be used on the secondary system (7) to advantageously protect the web service (8) from (D)DoS attacks.

[0095] In a preferred embodiment, in addition to load balancing, protection against (D)DoS is also implemented.

[0096] Denial of Service (DoS) is an attack strategy on web services in which attackers try to send as many requests as possible to the server at the same time, which the server cannot answer all of at the same time.

[0097] This overloads the service, and customers may receive no response at all, receive an error, or take a very long time to respond. This can cause significant damage to the provider, especially if the attack lasts for a long time, as revenue is typically lost during this time because potential customers cannot access the web service. If the attack occurs across multiple distributed computer systems, it is referred to as a Distributed Denial of Service (DDoS).

[0098] Especially in recent years, Internet of Things (IoT) devices, such as smart lightbulbs or webcams, have been used for such DDoS attacks. This is particularly possible because their software is only rarely provided with security updates. By applying the method according to the invention in such IoT devices, these devices would also be protected, making the use of such devices for such attacks significantly more difficult.

[0099] Furthermore, the method according to the invention implements a reverse proxy which, among other things, serves to protect against (D)DoS attacks in order to advantageously contribute to shorter loading times and to avoid a service failure with associated revenue losses.

[0100] In particular, several secondary systems can be used for the purpose of load balancing and reducing loading times through clever spatial distribution.

[0101] In a preferred embodiment of the method, after manipulation has occurred, the manipulated data is analyzed within the isolation. The data analysis can serve several possible objectives. In one embodiment of the method, the objective of the analysis is to determine the target of the attack within the web service. This is advantageous if the manipulated data was isolated without a more detailed threat analysis, for example, to ensure a particularly rapid restoration of a secure state. In this case, a target analysis can be performed subsequently. The analysis can advantageously identify potential vulnerabilities in the system that an attacker intended to exploit.

[0102] In a further embodiment of the method, the objective of the analysis is to obtain data on attack patterns from the manipulation. This advantageously allows knowledge databases of attack patterns to be compared and expanded to include new threats or identify potential attackers. Furthermore, the database can be advantageously expanded for other security systems that do not categorically isolate all manipulation, but rather attempt to distinguish between malicious and benign manipulation (see blacklisting, antivirus programs in the prior art). Collecting or selling such data results in an economic advantage according to the invention.

[0103] In one version of the method, the analysis of the manipulated data is performed manually. The involvement of security experts can advantageously produce a data set of particularly high quality, particularly with regard to identifying the attack target and classifying a manipulation as malicious or non-malicious.

[0104] In a particularly preferred embodiment of the method, the analysis of the manipulated data is carried out automatically. Statistical analysis methods can be used for this purpose, in particular the clustering of manipulation types, or statistical similarity analyses with known attack types from knowledge databases. In a particularly preferred embodiment, machine learning methods are used for data analysis, in particular for the clustering of manipulation types and the classification of the degree of maliciousness of attacks. In the case of semantic manipulation (e.g. SQL injection), in a particularly preferred embodiment of the method, deep learning methods for language processing are used to recognize patterns within the manipulation or to classify the maliciousness. Through any automated data analysis, the efficiency of data usage can be advantageously significantly increased.In particular, by collecting and using large amounts of manipulation data, automated data analysis methods also offer increasing precision, resulting in an economy of scale.

[0105] The method according to the invention is implemented on various computer systems of a primary and at least one secondary system by one or more computer program products.

[0106] The invention also relates to a system for protecting the integrity of data, in particular a distributed computer system, for example a distributed fractional computer system, comprising means for executing the steps of the method according to the invention as defined herein, wherein the individual steps are preferably implemented jointly or individually in a distributed computer environment. Examples of such a system are a networked client-server system with a smartphone as the client that has access to storage or processing resources in a computer cloud, file sharing by devices in a peer-to-peer network, an augmented reality environment with head-mounted displays, and autonomous vehicles that interact via an ad hoc network or are networked in a distributed ledger system using blockchain.Nevertheless, a computer program product for protecting the integrity of data can also be provided, which comprises instructions which, when executed by a computer, cause the computer to carry out the method according to the invention, in particular the steps of the method, each as defined herein. The invention also encompasses a computer-readable medium which comprises instructions which, when executed by a computer, cause the computer to carry out the method according to the invention, in particular the steps of the method, each as defined herein.

[0107] In a preferred embodiment of the invention, such a computer program product is also provided, also referred to herein as the first computer program product, which comprises instructions which, when the program is executed by a computer, cause the computer to executably carry out the step of generating (S01) an intended state (3) of data, wherein preferably also supposedly dynamic data is converted into static data. In addition, it controls the transmission of the intended state to the server in the insecure network either manually, time-controlled or automatically after the intended state of the data has changed. In addition, it is suitable for transmitting the intended state either completely or as a differential update. Preferably, the first computer program product is within a system, particularly preferably within a distributed computer system, e.g.provided or arranged within a distributed fractional computer system as defined herein.

[0108] Preferably, in the step of generating the intended state (S01), the first computer program product transmits supposedly dynamic data of the web service, such as HTML pages rendered by PHP, as far as the operated service allows, to the secondary computer system as static files, such as HTML, JSON, or XML files. Independently of this, it can be provided that the triggering of the transmission of the data from the primary computer system (1) to a secondary computer system (7) a) is triggered manually, or b) is triggered automatically on a time-controlled basis, or c) is triggered automatically after a change in the intended state of the data is triggered.

[0109] In one embodiment of the invention, it can be provided that in the step of transmitting the data (S02), only the difference between the intended state and the temporally preceding intended state of the data is transmitted from the primary computer system (1) to the secondary computer system (7) by the first computer program product.

[0110] In one embodiment of the invention, it can be provided that each change of an intended state (3) and each transmission to the secondary computer system in the step of transmitting the data (S02) is stored in an audit-proof manner by the first computer program product, thereby enabling subsequent auditing.

[0111] According to a particularly preferred embodiment, the first

[0112] The computer program product may be configured such that it comprises instructions which, when the program is executed by a computer, cause the computer to carry out the method according to the invention as defined herein.

[0113] The invention further also comprises a computer-readable medium (data carrier) comprising the first computer program product as defined herein, in particular for defining the intended state in S01.

[0114] Preferably, the primary computer system (primary system) comprises the first computer program product and / or the computer-readable medium with the first computer program product, which is configured to generate (S01) the intended status of the data, in particular according to the method defined herein. Preferably, the primary computer program product is provided or arranged within a system, particularly preferably within a distributed computer system, for example, within a distributed fractional computer system, in each case as defined herein.

[0115] The invention also relates to such a computer program product, also referred to herein as a secondary computer program product, which comprises instructions which, when the program is executed by a computer, cause the computer to implement steps S03 and S04, i.e. the steps of checking (S03) and restoring (S04) of claim 1. Preferably, the placing of the manipulated data in quarantine is implemented, wherein the checking of the data by means of cryptographic methods takes place immediately after its manipulation and the database is secured by one of the options mentioned above. Should the secondary computer program product be terminated, it is automatically restarted by the secondary computer system. Preferably, the first computer program product is provided or arranged within a system, particularly preferably within a distributed computer system, for example within a distributed fractional computer system, as defined herein.

[0116] According to a preferred embodiment of the invention, changes to the data, as an example of a manipulation (17) of data, are detected by the secondary computer program product on the basis of cryptographic methods.

[0117] It can be provided that the secondary computer program product is set up so that the checking (S03) (20) of the integrity of the data (also referred to as checking), in particular of the files and / or parts of files, takes place immediately after the manipulation (17) of the data, in particular of the files and / or parts of files.

[0118] In one embodiment of the invention, it can be provided that the secondary computer program product is configured in such a way that data defined by a user (e.g. files, file parts and / or other data) are registered for checking (S03) for manipulation or data defined by a user (e.g. files, file parts and / or other data) are excluded from checking (S03) for manipulation.

[0119] According to a preferred embodiment of the invention, the secondary computer program product is designed in such a way that it comprises instructions that the data for generating the web service are selected from data in a database, and wherein the integrity of the data in the database (4) is secured by a) either each query to the database (13) is first checked, in particular by the agent (11), for malicious inputs (e.g.SQL injections, or changes to forbidden data records, such as database users) are checked, then securely transferred to the primary database (4) of the primary computer system (1) (14) and subsequently the changes made are mirrored to the secondary database (9) in the secondary computer system (7), or b) each query to the database (13) is first checked, in particular by the agent (11), for malicious inputs and then securely transferred to the primary computer system (1) (14) and read accesses (15) to the database are also checked, in particular by the agent (11), and transferred to the primary computer system (16), so that no database is necessary in the secondary system (7), or c) the database on the secondary system (9) is regularly checked, in particular by the agent (11), for changes to forbidden data records that are not to be processed by the web service (8). is checked.

[0120] According to a preferred embodiment of the invention, the secondary computer program product is designed in such a way that it comprises instructions which allow the manipulated data to be analyzed by means of manual and automated data processing methods after manipulation has taken place.

[0121] Preferably, the secondary computer program product is provided or arranged within a system, particularly preferably within a distributed computer system, for example within a distributed fractional computer system, as defined herein.

[0122] According to a particularly preferred embodiment of the invention, all features of the method according to the invention, as defined herein, can be implemented by the secondary computer program product - in accordance with the concept.

[0123] The secondary computer program product is preferably contained on a secondary computer-readable medium (data carrier).

[0124] The secondary computer program product preferably protects a tertiary computer-readable medium (data carrier).

[0125] A secondary computer system preferably comprises a secondary and / or a tertiary medium. A medium can combine the properties of the secondary and tertiary medium. Preferably, the computer program products of this application are also protected by a secondary computer program product, so that they themselves are advantageously protected against manipulation.

[0126] A tertiary computer program product preferably implements the transfer of the intended state from the primary to the secondary system. It is part of a computer-readable medium and is executed either on the primary or a secondary or another tertiary system. Preferably, the tertiary system is at least partially, in particular completely, protected by the primary and / or secondary, in particular by the secondary, computer program product, as defined herein. The invention therefore preferably also encompasses a tertiary computer program product that comprises instructions that, when the program is executed by a computer, cause the computer to implement the step of transferring (S02) according to the method according to the invention.

[0127] According to a particularly preferred embodiment of the invention, all features of the method according to the invention, as defined herein, can be implemented by the tertiary computer program product - in accordance with the concept.

[0128] According to a preferred embodiment of the invention, the tertiary computer program product is designed in such a way that it comprises instructions that the data for generating the web service are selected from data in a database, and wherein the integrity of the data in the database (4) is ensured by a) either each query to the database (13) is first checked, in particular by the agent (11), for malicious inputs (e.g.SQL injections, or changes to forbidden data records, such as database users) are checked, then securely transferred to the primary database (4) of the primary computer system (1) (14) and subsequently the changes made are mirrored to the secondary database (9) in the secondary computer system (7), or b) each query to the database (13) is first checked, in particular by the agent (11), for malicious inputs and then securely transferred to the primary computer system (1) (14) and read accesses (15) to the database are also checked, in particular by the agent (11), and transferred to the primary computer system (16), so that no database is necessary in the secondary system (7), or c) the database on the secondary system (9) is regularly checked, in particular by the agent (11), for changes to forbidden data records that are not to be processed by the web service (8). is checked.

[0129] According to a preferred embodiment, the tertiary computer program product is designed such that several secondary systems are operated in parallel to advantageously enable load balancing of the web application. In this case, it can be provided that, in addition to load balancing, protection against (D)DoS is also advantageously implemented.

[0130] According to a preferred embodiment, the tertiary computer program product is designed such that it comprises instructions whereby, after a violation of the integrity of a data item, the entire secondary system or the plurality of secondary systems on which the integrity was damaged is / are isolated.

[0131] According to a preferred embodiment, the tertiary computer program product is designed such that it comprises instructions whereby the isolated secondary system or the plurality of isolated secondary systems is / are not terminated, but continues to operate in isolation for the purpose of analyzing the malware.

[0132] It may be provided that the tertiary computer program product is designed in such a way that it comprises instructions whereby, after isolating the (compromised) system whose integrity has been damaged, another secondary system is started as a replacement system.

[0133] According to a preferred embodiment, the tertiary computer program product is designed such that a reverse proxy is used on the secondary system in order to advantageously protect the web service (8) from (D)DoS attacks.

[0134] The tertiary computer program product is preferably contained on a tertiary computer-readable medium (data carrier).

[0135] Preferably, a tertiary computer system (primary system) comprises the tertiary computer program product and / or the tertiary computer-readable medium with the tertiary computer program product, which is configured for transmission (S02) within the method according to the invention. Preferably, the tertiary computer system is provided or arranged within a system, particularly preferably within a distributed computer system, for example within a distributed fractional computer system, as defined herein.

[0136] The computer program products can also be extended with additional functionalities for operating and improving a web service through plug-ins. For example, a plug-in for processing and analyzing generated data traffic could be added, which advantageously eliminates the need for this service to be performed by a third party, and other aspects of data economy and data protection can be maintained by keeping the information with the web service provider.

[0137] The invention also encompasses a network comprising a computer system, in particular a system for protecting the integrity of data, in particular a distributed computer system, e.g. distributed fractional computer system, as defined herein, and / or a primary computer system, a secondary computer system and / or a tertiary computer system, each as defined herein.

[0138] To ensure that the computer program product(s) themselves are not tampered with, which would invalidate the protection, several methods are available. These methods make it more difficult to change the functionality of the computer program product, thus further increasing the protection.

[0139] On the one hand, the computer program product implementing the method can monitor the folder structure or the medium in which it is stored. While it is stored in the computer's RAM, it is highly protected against tampering. If the program itself is modified on the medium, it can detect the change and restore itself.

[0140] Furthermore, the program can be stored on a medium that cannot be rewritten, e.g. an EPROM or an SD card with write protection.

[0141] Furthermore, many operating systems already protect parts of their directory structure by ensuring that they can only be written to in Safe Mode and cannot otherwise be modified, even by the system itself. The computer program product could be stored in such a part of the directory structure while using Safe Mode to further protect it.

[0142] Manipulation of the computer program product in the RAM is also possible. A specialist could identify the program structure in the RAM, allowing them to search for the program in memory and manipulate it by exploiting other vulnerabilities, such as buffer overflows. Through targeted measures, the computer program product can positively hamper such attacks. To this end, it fills random memory areas with random content to make analysis and manipulation of the instructions contained in the program more difficult by changing their position with each execution and over time.

[0143] Further advantageous embodiments and developments emerge from the subclaims and from the description with reference to the figures. Examples of implementation

[0144] The present invention is explained in more detail with reference to the following figures and exemplary embodiments, without limiting the invention to these.

[0145] This shows Fig. 1:A schematic representation of the primary computer system CS1 (1). It depicts a web service (2) running on CS1 with dynamic content ("index.php" and "shop.php"), as well as a static image file (image.png). Both dynamic files use the database (4), however, the file "index.php" reads (5) data from the database (4), which does not change in this example. Therefore, the file "index.php" can be converted (S01) into a static file (index.html) by a computer program product according to claim 17. The file "shop.php" reads (6) and writes data from and to the database (4). Therefore, it cannot be converted into a static file. The already static file also remains unchanged. This results in the intended state of the files of the web service (3). Furthermore, in step S01, the hashes, indicated by alphanumeric character strings next to the file names, are calculated and stored.The shield is intended to clarify the appropriate backup of the files. Fig. 2: A schematic representation of the CS1 (1) from Fig. 1together with a second, secondary system CS2 (7) in an insecure network. S02 transfers the intended state (3) of the database (4) and the files of the web service (2) to the secondary system (7). An agent (11) is activated when data changes occur at the file system level (reported by the operating system (10)) or at regular intervals to check the integrity of the data of the web service (2). Changes to the database (4) (in the example, the file "shop.php") are checked (13) by the agent (11) before it transfers these changes to the database (4) in the primary system (1) (14), which are then imported into the secondary database (9) of the secondary system (7) by S02. The dynamic files (in the example, the file "shop.php") read (12) the necessary data from the database in the secondary system (9).Step S03, the checking of the files of the secondary web service (8) by the agent (11) after the manipulation, is triggered either by a timer or by a watchdog. Fig. 3: A schematic representation of the primary computer system (1) and the secondary computer system (7). In this case, there is no database in the secondary system (7). S02 transfers the intended state (3) of the web service files (2) to the secondary system CS2 (7). Again, the operating system (10) triggers step S03 either upon data change (via a watchdog) or at a timed interval, whereupon the agent (11) compares the web service files (8) in the secondary system (7) with the intended data (3) of the primary system (1). Since the secondary database is omitted, read access (15) of files such as "shop.php" to the database (4) of the primary system (1) is performed by the agent (11) (16). Write access (13) is performed analogously to Fig. 2checked by the agent (11) and then transferred (14) to the primary database (4). Fig. 4:Schematic representation of the agent's (11) actions in the event of unwanted manipulation (17 of the files (S04)). A) The process using a watchdog: In this case, the operating system (10) reacts (23) to the change in the web service's (8) files and informs (22) the agent (11). The agent checks (20) all files of the web service in a possibly manipulated state (18). After detecting a change using a cryptographic method, in this case using a hash value, it restores (21) the desired file states (19) and quarantines the manipulated files (18) for later analysis.B) In this case, the operating system (10) regularly reports (22) the system time or the exceeding of a certain time interval to the agent (11), which checks (20) the current state of the files of the web service (18) and, after an undesired manipulation (17), concludes that they have been manipulated, whereupon it restores the desired state of the files (21) and, if necessary, quarantines the manipulated files (18) for later analysis. All embodiments have in common the fact that the primary computer system CS1 (1) can only be reached via a secure connection by the agent (11). The web service (2) of the primary system (1) is solely necessary to establish the intended state (3) and to convert supposedly dynamic files into static files (e.g., by rendering HTML using a PHP file).Determining the intended state in step S01 can be done using various cryptographic methods. Figure 2 and 3 differ only in the use of the database, particularly in how the integrity of the data in the database is ensured. In principle, there can be any number of secondary systems (7), even if this is not shown graphically. In the configuration with a secondary system (7), the agent (11) also serves as a reverse proxy to protect against DDoS attacks, so that even the secondary systems (7) do not have direct access to the web services (8) of the secondary system (7). List of reference symbols

[0146] 1Computer system 1 (primary system) 2Web service on the primary system 3Intended state of the web service files after reduction to static files (S01) by the primary computer program product 4Database of the web service on the primary system 5Read access of the file "index.php" to the database 6Read / write access of shop.php to the database 7Computer system 2 (secondary system) 8Web service with the intended state of the files after step S02 9Database on the secondary system, with the desired state synchronized by S02 10Operating system mechanism for starting the check (S03) (watchdog or timer) 11Agent running on computer system 2 (secondary computer program product) 12Read access of the file "shop.php" from the database of the secondary system 13Write access of the file "shop.php" sent to the agent (14) 14Write access of the file "shop.php" after verification to the agent to update the desired state of the primary system's database 15Read access of the file "shop.php", where the agent reads directly from the primary system's database (16) without first mirroring it in a secondary database 16Read access of the agent triggered by the read access of the file "shop.php" (15) checked by the agent (11) 17Manipulation of the web service files 18Manipulated web service 19Web service in the restored intended state 20Determination of the manipulated state of the files by the agent 21Restoration of the intended state by the agent with deletion of the manipulated files or preferably placing the files in "quarantine" in the manipulated state 22Signal from the system to the agent that a file has been changed (watchdog) or a time interval has elapsed (timer) 23Registration of the file change with the system.

Claims

1. Method of protecting the integrity of data comprising the following steps: a) Generating (S01) an intended state (3) of data of a web service (2) on a primary, secure computer system (1); b) Transferring (S02) of data through a secure connection to one or more secondary computer systems (7) in a potentially insecure network to provide a web service (8); c) Checking (S03) (20) the integrity of the data in such a way that manipulation of the files and data by an attacker is detected, wherein after a manipulation (17), the data is placed in quarantine so that it can be analyzed afterwards but no longer executed and thus cannot cause any damage; d) Restoring (S04) (21) the intended state of the data (19) at the time before the manipulation.

2. Method according to claim 1, wherein checking (S03) (20) the integrity of the data is performed immediately after manipulating (17) the data.

3. Method according to any one of claims 1 or 2, wherein data defined by a user is registered for checking (S03) for manipulations or data defined by a user is excluded from checking (S03) for manipulations.

4. Method according to any one of claims 1 to 3, wherein, in the step of generating the intended state (S01), supposedly dynamic data of the web service, such as e.g. HTML pages rendered by PHP, are transmitted to the secondary computer system as static files, such as HTML, JSON or XML files, insofar as the operated service permits.

5. Method according to any one of claims 1 to 4, wherein triggering the transferring of data from the primary computer system (1) to a secondary computer system (7) a) is triggered manually, or b) is triggered automatically on a time-controlled basis, or c) is triggered automatically after changing the intended state of the data.

6. Method according to any one of claims 1 to 5, wherein in the step transferring of data (S02) only the difference of the intended state to the temporally preceding intended state of the data is transferred from the primary computer system (1) to the secondary computer system (7).

7. Method according to any one of claims 1 to 6, wherein the data for generating the web service is selected from data of a database, and wherein the integrity of the data in the database (4) is secured, in that a) either each query to the database (13) is first checked for corrupt entries, then transmitted (14) in a secured manner to the primary database (4) of the primary computer system (1) and subsequently the changes made are mirrored to the secondary database (9) in the secondary computer system (7), or b) each request to the database (13) is first checked for malicious entries and then transmitted (14) in a secured manner to the primary computer system (1), and read accesses (15) to the database, in particular by the agent (11), are also checked and transmitted (16) to the primary computer system, so that no database is required in the secondary system (7), or c) the database on the secondary system (9) is checked regularly for changes to prohibited data records that should not be edited by the web service (8).

8. Method according to any one of claims 1 to 7, wherein several secondary systems (7) are operated in parallel in order to advantageously enable load balancing, in particular of the web application.

9. Method according to claim 8, wherein upon violation of the integrity of a datum, the entire secondary system (7) on which the integrity has been damaged is isolated.

10. Method according to claim 9, wherein the isolated secondary system is not terminated but continues to operate in isolation for the purpose of analyzing the malware.

11. Method according to claim 10, wherein after isolating the system whose integrity has been damaged, another secondary system is started as a replacement system.

12. Method according to any one of claims 1 to 7, wherein a reverse proxy is used on the secondary system (7) to advantageously protect the web service (8) from (D)DoS attacks.

13. Method according to any one of any one of claims 1 to 12, wherein after a manipulation has been performed, the manipulated data is analyzed by manual and automated data processing methods.

14. A system for protecting the integrity of data, comprising means for carrying out the steps of the method according to claim 1 to 13.

15. Computer system for protecting the integrity of data, comprising means for carrying out the steps of the method according to any claims 1 to 13, comprising a) a primary computer program product, comprising instructions which, when the program is executed by a computer, cause the computer to realize the step of generating (S01) an intended state (3) of data according to any claims 1 to 13, and b) a primary computer system comprising a computer-readable medium comprising the primary computer program product, set up to generate (S01) the intended status of the data, and c) a secondary computer program product comprising instructions which, when the program is executed by a computer, cause the computer to implement the checking (S03) and Restoring (S04) steps of claim 1, and d) a secondary computer system comprising a computer-readable medium comprising the secondary computer program product, and e) a tertiary computer program product comprising instructions which, when the program is executed by a computer, cause the computer to implement the step of transmitting (S02) according to claim 1, and f) a tertiary computer system comprising a computer-readable medium comprising a tertiary computer program product.

16. Computer system according to claim 15, wherein the computer-readable medium at least partially protected by the secondary computer program product.