Application program designed to create environment information

Abstract

The invention relates to an application program (A) designed to be executed in an execution environment, having: - a documentation unit, designed to create environment information, wherein the environment information describes the execution environment at a runtime of the application program (A), and - an attestation unit, designed to cryptographically protect the environment information, whereby a piece of attestation information is formed. In addition, the invention relates to an execution environment, a control unit (AC) and to an associated method.

Description

[0001] Description

[0002] Application program trained to create environmental information

[0003] BACKGROUND OF THE INVENTION

[0004] Field of the invention

[0005] The present invention relates to an application program. The invention also relates to an associated execution environment, a control device, and an associated method.

[0006] Description of the state of the art

[0007] Due to the increasing networking in industrial applications and the need to locally process larger amounts of data to optimize manufacturing processes, industrial devices are being designed with increasingly flexible functionality. This is made possible, in particular, by supporting downloadable applications, also known as apps, with which device functionality can be easily and quickly adapted even in the field.

[0008] The aim is to offer the customer the widest possible range of apps. Apps from different providers can be run on a single device. The environment in which an app is run can therefore vary greatly, particularly depending on the number of different apps, base operating system variants and / or hardware being run. The properties of an app’s execution environment can therefore be crucial for the trustworthiness of the data provided by an app. This is important in an industrial environment if an app is to be given access to critical data or if the results of an app are to be taken into account in a decision, particularly for adapting control logic.

[0009] Compliance checks and attestation mechanisms are generally known, particularly for obtaining information about the integrity of the software running on a compute platform. These are provided by the platform and are often complicated or inflexible to use, particularly because they involve proprietary solutions from hardware manufacturers and / or dependencies on the infrastructure of hardware manufacturers.

[0010] A technique known as "remote attestation" is known, particularly in connection with Measured Boot and a Trusted Platform Module (TPM). Starting from a "root of trust", a cryptographic checksum is calculated for each boot component by a "root of trust for measurement" component. The checksums can then be stored, for example, in a TPM in special registers called Platform Configuration Registers (PCRs), in which a PCR register is updated depending on the determined checksum. The list of PCR values ​​can also be signed with a non-extractable private key stored in the TPM and then passed on to another instance (e.g. a server) for verification together with the signature. The device's access to a service, or a network in general, can thus be controlled depending on the measured boot components.

[0011] Trusted Execution Environments (TEE) are well known. These represent a specially protected execution environment that is only accessible from the regular execution environment (normal world) via a well-defined interface. This can prevent, for example, a local system administrator or malware present in the regular execution environment from manipulating the program execution in the TEE execution environment. Examples of TEEs are Intel SGX, Intel TDX, AMD SEV, and ARM TrustZone. Some of these technologies, such as Intel SGX, Intel TDX, and AMD SEV, offer a hardware-supported way to attest to the state of the software loaded in a TEE. With an issued attestation, the integrity and authenticity of the loaded software can be checked by a user and then a secret (e.g.Keys for decrypting a file system of the software running in the TEE are transferred to the software in the TEE. In some implementations, such as Intel SGX, the attestation functionality is known to be implemented by a special launch program code provided by the hardware manufacturer, which is executed in a hardware-protected enclave (i.e., the Intel enclave provides the attestation for the user enclave).

[0012] AMD SEV and Intel TDX are known in principle for assigning randomly selected, different keys to different virtual machines or containers, which are used for memory encryption of the virtual machine's data. This allows for cryptographic isolation of a virtual machine from a compromised host, as well as from other virtual machines.

[0013] Various obfuscation methods are known to make program code difficult for humans to understand, thus preventing reverse engineering or modifications to the code that would be beneficial to an attacker. Numerous obfuscation tools are also available that largely automatically apply obfuscation transformations to a program. This is usually done either based on the source code or on the fully compiled and linked machine code of an application.

[0014] It is known as "verifiable computing," where computations are outsourced to potentially untrusted systems and produce a verifiable result as part of the computation. The verifiable result can be used to check whether the computation was performed correctly as intended. Examples of well-known implementations are based on homomorphic encryption or obfuscation, or on multiple computations on different systems.

[0015] The SafetyNet service is well-known from Android. The goal of SafetyNet is to enable critical apps (e.g., banking or payment apps) to check the device's status before use in order to minimize potential misuse. The device collects data about the device's status (e.g., whether Verified Boot is active or deactivated), which can be evaluated on the server side and provided to an app via an API. This allows an app to determine, for example, whether the device has been modified and, if necessary, restrict its functions or refuse to run.

[0016] The object of the invention is to provide an improved solution for application programs.

[0017] SUMMARY OF THE INVENTION

[0018] The invention is based on the features of the independent claims. Advantageous developments and refinements are the subject of the dependent claims. Embodiments, possible applications, and advantages of the invention will become apparent from the following description and the drawings.

[0019] The invention relates to an application program designed to be executed in an execution environment, the application program comprising:

[0020] - a documentation unit, designed to create environmental information, wherein the environmental information describes the execution environment at a runtime of the application program, and - an attestation unit, designed to cryptographically protect the environmental information, whereby attestation information is formed.

[0021] The application program can also be referred to as an application or an app.

[0022] For the purposes of the invention, the execution environment is understood as an environment of the application program. The application program is executed in this environment, i.e., it runs in this environment. The environment can thus also be referred to as a runtime environment or execution environment. The environment information includes information relating to this execution environment at a time when the application program is running or was running, i.e., at the runtime of the application program.

[0023] The attestation unit is configured to cryptographically protect the environment information, also referred to as App-RTE fingerprint information (where RTE = Run-Time Environment). This is done, in particular, by generating a digital signature, which creates cryptographically protected App-RTE fingerprint information, also referred to as cryptographically protected attestation information or attestation information.

[0024] One aspect of the invention is that an application program or app itself creates and provides a specially generated, cryptographically protected attestation about its execution environment. To do this, the app specifically performs fingerprinting of its execution environment, i.e., it processes the raw information of the execution environment in advance and then uses the attestation to confirm the type of execution environment in which it is running.

[0025] Thus, it is proposed that an application program creates a specially generated attestation information in which it confirms in which type of execution environment it is running and attests the result (as raw information or preprocessed as a fingerprint) in a cryptographically protected manner.

[0026] This has the advantage that an app can independently implement attestation functionality to validate its runtime environment. This, in turn, has the advantage that the runtime environment itself does not need to support such attestation functionality, and that a corresponding security infrastructure must be provided by the runtime environment provider and be accessible.

[0027] The present invention thus considers the case in which the environmental information and the attestation information must be implemented independently of an attestation functionality of the runtime environment. To address this problem, the environmental information can be generated and protected by an app itself. The invention is particularly advantageously used when the runtime environment is not configured to attest environmental information.

[0028] Another advantage of self-generated attestation is that an app developer can implement it independently, without the need for a controlled ecosystem, especially where there are strong dependencies on hardware and infrastructure. Such a solution can therefore be implemented specifically for apps with increased security requirements regarding the trustworthiness of an execution environment (particularly for an onboarding / provisioning app, for AI-based analysis of operational data, or when sensitive project planning data or recipes are transmitted within an app).

[0029] Another advantage is that the approach described is easier to implement in an industrial environment than attestation as supported by currently available solutions. An app developer can implement it independently, without the need for a controlled ecosystem with strong dependencies on hardware and infrastructure.

[0030] The invention thus offers a flexible mechanism that can provide a reliable statement about the environment in which the app is running.

[0031] Subsequently, the app RTE attestation / attestation information can be checked by the other entity, in particular the user, and an action can be carried out depending on the result of the check, in particular processing data of the app, providing data or services to the app.

[0032] The result of the attestation / attestation information can be used by a user, in particular as part of an assessment by a cloud service as to whether an app should be given access to critical data or whether the data received by an app can be considered trustworthy enough for certain operations.

[0033] The attestation information can thus be reviewed and used by the user to decide whether the app should be granted access to certain data or services, whether further app data can be considered trustworthy, and whether a connection to the app should be established or terminated. Furthermore, the app RTE attestation information can also be analyzed for monitoring purposes and, if necessary, persisted for audit purposes, especially in a production database.

[0034] Furthermore, it is possible for a user to check the attestation information generated by the app itself for consistency with an attestation generated by the runtime environment. This has the advantage for the user of achieving increased reliability regarding the type of execution environment.

[0035] In a further development of the invention, the application program also comprises:

[0036] - An output unit configured to output the attestation information.

[0037] The output unit is thus designed to provide the cryptographically protected attestation information to another entity, in particular an app management server, a device management system, a remote server, a shop floor monitoring server, a cloud-based backend service and / or another app, etc.

[0038] In a further development of the invention, the attestation information also includes additional information.

[0039] This has the advantage that the attestation issued by the app itself includes additional information that is not included in an attestation issued by the runtime environment. This is advantageous, in turn, if the attestation issued by the runtime environment only confirms a summary of rough information, in particular: "Runtime environment integer."

[0040] The additional information can be in particular formed as data that is processed by the app, data and / or services that the application program accesses and requests access to, connections that are established to the app.

[0041] In a further development of the invention, the environment information which describes the execution environment at the runtime of the application program relates to:

[0042] - A hardware execution environment and / or

[0043] - an execution environment infrastructure and / or

[0044] - other application programs of the execution environment and / or - an operating system of the execution environment and / or

[0045] - a device and / or a system on which the execution environment is implemented,

[0046] - an execution environment file and / or

[0047] - a property of the execution environment and / or data on processor registers of the execution environment or a system higher than the execution environment and / or

[0048] - Configuration data of the application program, in particular configuration files for an application program, which in particular contain privileges of the application program and / or

[0049] - Configuration data of a peripheral module of the execution environment or a system higher than the execution environment and / or

[0050] - Configuration data of an expansion module, in particular designed as a PCIe, of the execution environment or of a system higher than the execution environment and / or

[0051] Data from accesses of the application program to components of the execution environment or a system higher than the execution environment and / or

[0052] - a performance measurement of the execution environment and / or

[0053] - a cryptographic key accessible by the application program and / or

[0054] - a security token accessible by the application program and / or

[0055] - a digital certificate accessible by the application program.

[0056] Environmental information relating to the hardware of the execution environment particularly includes security-relevant information about the CPU, in particular the microcode version, existing CPU security features such as Intel CET and their configuration (in particular activated / deactivated), vulnerability to hardware-specific side-channel attacks such as Spectre / Meltdown. Environmental information relating to the infrastructure of the execution environment particularly includes a Linux container or a Trusted Execution Environment (TEE) such as an Intel SGX enclave or a virtual machine protected by AMD SEV. It also particularly concerns outputs from certain virtual files / kernel interfaces (proofs, sysfs, special system calls), which particularly provide information about whether the app is running in a virtual machine, in a TEE or in a container.

[0057] Environmental information relating to other application programs in the execution environment includes, in particular, existing software binaries, libraries, packages, configuration files (or their versions) including their configuration settings (in particular sysctl / kernel parameters).

[0058] Environmental information that includes an operating system of the execution environment includes, in particular, information about a Linux or Windows host operating system.

[0059] Environmental information relating to a property of the execution environment includes in particular:

[0060] Information on the rough classification (Normal World vs. TEE) as well as on the more detailed description (containers with reduced privileges) and / or information on running processes or system services (in particular whether certain security-critical processes such as a runtime integrity check, a logging service such as auditd, or similar are running) and / or information on open ports, network settings such as iptables rules, kernel routing tables.

[0061] Environmental information concerning a property of the execution environment can be obtained:

[0062] In particular, through data / resources that are only accessible in a TEE, such as a key protected when setting up the platform and / or in particular through data on the availability of special CPU instructions that can only be executed in a TEE such as Intel SGX.

[0063] Environmental information, which includes application program configuration data, particularly concerns the permissions of the app processes themselves, also referred to as app privilege configurations, such as permitted system calls (system call whitelisting rules), Linux capabilities, and SELinux domain / AppArmor profiles. The execution environment is responsible for assigning and / or configuring app privileges (here, the "data").

[0064] Environmental information, which includes data from accesses of the application program, concerns in particular data:

[0065] - from a test-based access (in particular system calls, network connections, access to peripheral components or other hardware components, through performance measurements, accessible cryptographic keys, security tokens and digital certificates) and / or

[0066] - from status information (hardware, software) from log messages (especially kernel log).

[0067] In a further development of the invention, the environment information is embodied as a fingerprint of the execution environment. The fingerprint can be described as a preprocessed version of the environment data. This has the advantage that, in particular, the data volume of the environment information is reduced and meaningful parts of the environment are selected from the data.

[0068] In another variant, all raw information about the type of execution environment, or parts of it, in particular the values ​​of certain configuration files, software, or microcode versions, is transmitted cryptographically. Alternatively, a fingerprint of the execution environment is created and transmitted, as in this variant.

[0069] In a further development of the invention, the fingerprint of the execution environment comprises:

[0070] - A cryptographic checksum and / or

[0071] - a cryptographic hash value and / or

[0072] - an aggregated hash value.

[0073] In this variant, the determined App-RTE information is designed as a digital fingerprint by calculating, in particular, one or more cryptographic hash values ​​of the information (in particular an aggregated hash value or a list of considered properties plus corresponding hash values ​​of the determined properties) in a preprocessing step.

[0074] In a further development of the invention, the application program also comprises:

[0075] - a testing unit designed to test the environmental information and / or the attestation information.

[0076] Alternatively, or in addition to a user check, the app itself checks the calculated app-RTE fingerprint information and generates a result (e.g., "App-RTE OK / NOK," "App-RTE is a TEE," etc.). This is done, in particular, by the app itself using reference information (which is considered to be true) about its own runtime environment.

[0077] In a further development of the invention, the attestation unit is designed to cryptographically protect the environmental information by a cryptographic signature, whereby the attestation information is formed.

[0078] In particular, the attestation unit is designed to cryptographically sign the environmental information, thereby creating cryptographic protection and forming attestation information. Alternatively, the signature can be created by another unit.

[0079] As an alternative to the signature, encryption, particularly with a symmetric key, can be used to create cryptographic confidentiality protection.

[0080] In a further development of the invention, the attestation unit is designed to protect the environmental information using an obfuscation-based cryptographic protection mechanism, thereby forming the attestation information. In particular, the attestation unit is designed to cryptographically protect the environmental information in obfuscated form, thereby creating cryptographic protection and forming attestation information. In particular, a routine and / or a function and / or cryptographic material, in particular a key and / or a signature function, which are used to form the attestation information, are obfuscated. Alternatively, the obfuscation can be performed by another unit.

[0081] In one variant, the fingerprint logic and / or the secret for cryptographic protection can be obfuscated for improved protection. This makes tampering more difficult. This can lead to improved protection of the mechanism, regardless of the execution environment.

[0082] In a further development of the invention, the attestation unit is designed to form the cryptographic signature by adding a secret, whereby the attestation information is formed, wherein the secret is designed in particular as a private key or a symmetric key.

[0083] For this purpose, a secret available to the app (in particular, a private key, a previously exchanged symmetric key) can be used to encrypt or generate a digital signature. If the secret is only available in a protected environment (TEE; e.g., Intel SGX enclave, Intel TDX or AMD SEV protected virtual machine, Secure World of an ARM TrustZone implementation), this can also be used as an indication / proof of the "TEE" property to describe the execution environment and as environmental information.

[0084] In a further development of the invention, the application program also comprises:

[0085] - a storage function designed to initiate storage of the attestation information.

[0086] In particular, the storage function gives a command for storing the attestation information in a storage unit.

[0087] Furthermore, it is possible for the app to store the determined app RTE information in a cryptographically protected manner, preferably using a platform key specific to the app instance. This has the advantage that potentially complex fingerprinting of the app RTE does not have to be performed repeatedly by the app, but rather only occurs during installation, upon initial launch, after an update, upon user request, or upon request by a server or other authorized communication partner. This is particularly possible when changes to the execution environment (or characteristics of the execution environment) by an attacker are very unlikely or difficult to implement.

[0088] In another variant, the App-RTE attestation information can be provided or stored directly or after preprocessing (in particular, encryption, anonymization / pseudonymization, conversion to a verifiable credential) in a distributed database for persistence or confirmation, in particular a distributed ledger database (blockchain). This has the advantage that the App-RTE attestation information is stored and saved in a protected form.

[0089] In a further development of the invention, the documentation unit is designed to provide environmental information:

[0090] - during the runtime of the application program and / or retrospectively to the runtime of the application program.

[0091] If the environment information is created retrospectively for the runtime of the application program, this particularly includes creating the environment information after the occurrence of certain events, while the environment information still contains and describes these events. Furthermore, the environment information particularly contains information about other application programs in the runtime environment that no longer exist at the time the environment information is created.

[0092] The invention also includes an execution environment comprising an application program according to the invention.

[0093] The execution environment, also referred to as App-RTE, is implemented in particular by one of the following or by a combination of the following elements:

[0094] - a native Linux host system,

[0095] - a container runtime environment (e.g. Docker or Podman),

[0096] - a virtual machine, e.g. Qemu-KVM with Linux guest system,

[0097] - a Trusted Execution Environment, e.g., Intel SGX, Intel TDX / MKTME, AMD SEV (cryptographic and logical isolation at the hardware level) with a Linux guest system, or an ARM TrustZone environment (logical isolation at the hardware level). The invention further includes a control device having an execution environment according to the invention.

[0098] The invention also includes a method for forming attestation information of an application program, wherein the application program is executed in an execution environment, comprising the steps:

[0099] - creating environment information, wherein the environment information describes the execution environment at runtime of the application program, and

[0100] - cryptographic protection of the environmental information, thereby creating attestation information.

[0101] BRIEF DESCRIPTION OF THE DRAWINGS

[0102] The special features and advantages of the invention will become apparent from the following explanations of several embodiments based on the schematic drawings.

[0103] It shows

[0104] Fig. 1 is a schematic representation of an application program according to the invention in an execution environment of a control unit and

[0105] Fig. 2 is a flow diagram of the method according to the invention.

[0106] DETAILED DESCRIPTION OF THE INVENTION

[0107] Fig. 1 shows a schematic representation of an application program A according to the invention in an execution environment of a control unit.

[0108] The application program A is designed to be executed in an execution environment, comprising: - a documentation unit, designed to create environment information, wherein the environment information describes the execution environment at a runtime of the application program A, wherein the environment information is designed in particular as a fingerprint of the execution environment, and

[0109] - an attestation unit designed to cryptographically protect the environmental information, thereby forming attestation information.

[0110] The application program A, also referred to as app A, consists of an app logic AL, also referred to as application logic, and in particular a fingerprinting component FP, also referred to as fingerprint logic FP. The fingerprinting component FP is designed, in particular, as part of the documentation unit.

[0111] The application program A is executed in an automation scenario on different control units AC and their runtime environments. In particular, the app A is executed on an automation component AC, also referred to as an automation component, with control tasks, such as an industrial PC connected to a remote IO component RI / O, or on virtual machines as part of a hyper-converged infrastructure system HCl, or on a

[0112] The control units AC are connected to the real world PS, also referred to as the physical world PS.

[0113] The application programs A are loaded from a cloud environment C via the Internet www and can therefore also be referred to as cloud applications CA or cloud application programs.

[0114] The application programs A are managed via a management server MS. The management server MS has a monitoring and analytics component M / A and an app management component AM. The device provides one or more execution environments, also referred to as app RTEs, in which an app A can be executed.

[0115] An app / application program A implements its own App-RTE fingerprinting logic (FP). The fingerprinting logic (FP) is used by App A at runtime to retrieve and process information and content from the App-RTE.

[0116] The processed information can be cryptographically protected by an attestation unit of the fingerprinting logic (FP) or the app logic (AL). The result, which characterizes the app RTE, is then transmitted. Information for both a rough classification (Normal World vs. TEE) and a more detailed description (container with reduced privileges) can be determined and processed.

[0117] Fig. 2 shows a flow diagram of the method according to the invention for forming attestation information of an application program, wherein the application program is executed in an execution environment, with the steps:

[0118] - Step S1: Creating an environment information, wherein the environment information describes the execution environment at a runtime of the application program, and

[0119] - Step S2 : Cryptographically protecting the environmental information, thereby forming attestation information .

[0120] Although the invention has been illustrated and described in detail by the embodiments, the invention is not limited by the disclosed examples and other variations can be derived therefrom by a person skilled in the art without departing from the scope of the invention.

Claims

Patent claims 1. Application program (A) designed to be executed in an execution environment, the application program comprising: - a documentation unit, designed to create environment information, wherein the environment information describes the execution environment at a runtime of the application program (A) describes, and - an attestation unit designed to cryptographically protect the environmental information, thereby forming attestation information.

2. Application program (A) according to claim 1, further comprising: - An output unit configured to output the attestation information.

3. Application program (A) according to one of the preceding claims, wherein the attestation information further comprises additional information.

4. Application program (A) according to one of the preceding claims, wherein the environment information describing the execution environment at the runtime of the application program (A) relates to: - A hardware execution environment and / or - an execution environment infrastructure and / or - other application programs (A) of the execution environment and / or - an operating system of the execution environment and / or - a device and / or a system on which the execution environment is implemented, - an execution environment file and / or - a property of the execution environment and / or Data on processor registers of the execution environment or a system higher than the execution environment and / or - Configuration data of the application program (A) and / or - Configuration data of a peripheral module of the execution environment or a system higher than the execution environment and / or - Configuration data of an extension module of the execution environment or a system higher than the execution environment and / or Data from accesses of the application program (A) to components of the execution environment or a system superior to the execution environment and / or - a performance measurement of the execution environment and / or - a cryptographic key accessible by the application program (A) and / or - a security token accessible by the application program (A) and / or - a digital certificate accessible by the application program (A).

5. Application program (A) according to one of the preceding claims, wherein the environment information is designed as a fingerprint of the execution environment.

6. Application program (A) according to claim 5, wherein the fingerprint (FP) of the execution environment comprises: - A cryptographic checksum and / or - a cryptographic hash value and / or - an aggregated hash value.

7. Application program (A) according to one of the preceding claims, further comprising: - a testing unit designed to test the environmental information and / or the attestation information.

8. Application program (A) according to one of the preceding claims, wherein the attestation unit is designed to cryptographically protect the environmental information by a cryptographic signature, whereby the attestation information is formed.

9. Application program (A) according to claim 8, wherein the attestation unit is designed to form the cryptographic signature by adding a secret, whereby the attestation information is formed, wherein the secret is designed in particular as a private key or a symmetric key.

10. Application program (A) according to one of the preceding claims, wherein the attestation unit is designed to protect the environmental information by an obfuscated cryptographic protection mechanism, whereby the attestation information is formed.

11. Application program (A) according to one of the preceding claims, further comprising: - a storage function designed to initiate storage of the attestation information.

12. Application program (A) according to one of the preceding claims, wherein the documentation unit is designed to provide the environment information: - during the runtime of the application program (A) and / or retrospectively to the runtime of the application program to create.

13. Execution environment comprising an application program (A) according to one of the preceding claims.

14. Control unit (AC, RI / O) comprising an execution environment according to claim 13.

15. A method for forming attestation information of an application program (A), wherein the application program (A) is executed in an execution environment, comprising the steps: - creating (Sl) an environment information, wherein the environment information describes the execution environment at a runtime of the application program, and - cryptographic protection (S2) of the environmental information, whereby attestation information is formed.

Images