Method for determining a security integrity of a function of a distributed system

Abstract

The invention relates to a method (100) for determining a security integrity of a function (2) of a distributed system (1), comprising the following steps: - providing (101) at least one specification relating to at least one characteristic of a component (9) of the distributed system (1) in order to provide the at least one specification relating to the at least one characteristic as meta information relating to the component (9), with the component (9) being involved in carrying out the function (2) of the distributed system (1), - analyzing (102) the meta information relating to at least one further component (9') in terms of the meta information relating to the component (9) in order to determine, on the basis of the analysis, an influence between the component (9) and the at least one further component (9'), with the influence being determined at least on the basis of a similarity between the at least one specification relating to the component (9) and the at least one specification relating to the at least one further component (9'), and with the at least one further component (9') being involved in carrying out the function (2) of the distributed system (1), and - classifying (103) the function (2) of the distributed system (1) on the basis of the determined influence, with at least one class being specific to an independence of the function (2) of the distributed system (1), in order to determine the security integrity of the function (2) of the distributed system (1) on the basis of the classification. The invention also relates to a computer program, to an apparatus, and to a storage medium for this purpose.

Description

[0001] title

[0002] Method for determining a safety integrity of a function of a distributed system

[0003] The invention relates to a method for determining the safety integrity of a function of a distributed system. Furthermore, the invention relates to a computer program, a device, and a storage medium for this purpose.

[0004] State of the art

[0005] Vehicles have a variety of applications. These are often connected to external systems, such as cloud or edge systems. This connectivity can extend to the point where safety-critical functions and calculations are shifted from the vehicle to the cloud or edge.

[0006] It may be necessary to demonstrate sufficient independence of all paths of executed functions of a vehicle application in order to achieve safety integrity in safety-critical systems through functional redundancy. One method for this could be, for example, a Dependent Failure Analysis (DFA), e.g., based on a Fault Tree Analysis (FTA). For static redundancy architectures, the application of a DFA is particularly state of the art and can be carried out using available tools during a design phase. In distributed systems, however, which may only be configured during operation, this method can be limited, as, for example, not all possible combinations of redundant function execution or calculation can be determined and analyzed in advance. Furthermore, it is possible that individual elements in distributed systems change over time, e.g.,through software updates, so that a corresponding analysis might have to be performed again before the system can be classified as secure or released. Disclosure of the invention.

[0007] The subject matter of the invention is a method having the features of claim 1, a computer program having the features of claim 8, a device having the features of claim 9 and a computer-readable storage medium having the features of claim 10. Further features and details of the invention emerge from the respective subclaims, the description and the drawings. Features and details described in connection with the method according to the invention naturally also apply in connection with the computer program according to the invention, the device according to the invention and the computer-readable storage medium according to the invention, and vice versa, so that with regard to the disclosure of the individual aspects of the invention, reference is or can always be made to each other.

[0008] The invention particularly relates to a method for determining a safety integrity of a function of a distributed system, comprising the following steps:

[0009] Providing at least one piece of information about at least one characteristic of a component of the distributed system in order to provide the at least one piece of information about the at least one characteristic as metainformation of the component, wherein the component is involved in executing the function of the distributed system, analyzing the metainformation of at least one further component with regard to the metainformation of the component in order to determine, based on the analysis, an influence between the component and the at least one further component, wherein the influence is determined at least based on a similarity of the at least one piece of information about the component and the at least one piece of information about the at least one further component, wherein the at least one further component is involved in executing the function of the distributed system, classifying the function of the distributed system based on the determined influence,wherein at least one class is specific for an independence of the function of the distributed system in order to determine the safety integrity of the function of the distributed system based on the classification.

[0010] Safety integrity can generally be understood as the effectiveness of the functions of the distributed system under required conditions. Safety integrity can also express the reliability of the function of the distributed system. The distributed system can be, for example, a mobile robot, a vehicle with cloud connectivity, or a cyber-physical system. The distributed system can comprise various components, such as hardware, software, or data. Furthermore, the distributed system can have at least one orchestrator, which, for example, uses software and / or hardware components and corresponding data to execute the function of the distributed system. An orchestrator can generally provide automated configuration, management, and coordination of the functions of the distributed system.The orchestrator can be designed as a software module and create at least one replica as a component to execute the function, with each replica having redundant access to the software and / or hardware components and corresponding data. For a software component, the characteristic can be, for example, a software library, and the information about it can be a specific software library that the software component uses. Similarity therefore exists in particular if, for example, the component and the at least one other component use the same software library. Other classes within the framework of classification could, for example, be classes along the lines of "sufficiently independent", "not sufficiently independent", and / or "independent but optimizable". Metainformation in general is, in particular, structured data that contains information about characteristics of other data.Examples of metadata for a book might include the author's name, edition, year of publication, publisher, and ISBN, while metadata for a computer file might include the file name, access rights, and the date of the last modification. The metadata of the respective components of the distributed system can be advantageously used during the runtime of the distributed system and forwarded along paths between the components of the distributed system. The method can thus provide the advantage of allowing dynamic configurations of the distributed system to be evaluated for sufficient independence during the operation of the distributed system for the execution of the function. Furthermore, influences can be advantageously detected early on.

[0011] Furthermore, within the scope of the invention, it can be provided that the distributed system is a cyber-physical system and has a hierarchical structure with at least two levels, wherein the component and the at least one further component are each present in one of the at least two levels. Preferably, the component and the at least one further component are each present in the same of the at least two levels. A cyber-physical system refers in particular to a network of information technology, software components with mechanical and electronic parts that communicate via a data infrastructure, such as the Internet. A top level can, for example, represent the entire distributed system, and a further level can, for example, represent functions or services of the distributed system.It is also conceivable that the determination of safety integrity is carried out based on the metadata for individual levels, with the component and the at least one further component preferably being present at the same level. It may be advantageous if the safety integrity is determined in a cascaded manner for each level and the respective result is forwarded to the next higher level.

[0012] The procedure optionally further comprises the following step:

[0013] Securing the metadata via a certificate and / or a public key infrastructure and / or a distributed ledger technology and / or a checksum.

[0014] By securing metadata, the integrity of the metadata can be advantageously verified. Even compressed and / or selected metadata can be secured as described above.

[0015] Optionally, it can be provided that the influence is determined by a dependency and / or a correlation between the component and the at least one further component of the distributed system and the method further comprises the following step:

[0016] Evaluating a criticality of the dependency and / or the correlation between the component and the at least one further component taking into account at least one boundary condition of the component and / or the at least one further component.

[0017] Criticality is understood in particular as a relativization that expresses how critical the dependency and / or the correlation is in relation to the independence of the function of the distributed system. For this purpose, ranges can be defined which, for example, express whether the dependency and / or the correlation is critical or non-critical. A dependency can exist, for example, if two components have the same hardware. A correlation can exist with correlated data or models that could contain the same deficiencies. A boundary condition can, for example, be determined by another characteristic of the component or can be considered separately. For example, a spatial arrangement of the component can be considered as a boundary condition. By assessing criticality, a more differentiated analysis of the meta information can advantageously be carried out.

[0018] It is also optionally conceivable that the method further includes the following step:

[0019] Transmitting the meta information from the component and the at least one further component to a central data processing device to determine the security integrity of the function of the distributed system by the central data processing device.

[0020] The central data processing device can be part of the distributed system. Centralized determination of the safety integrity of the distributed system's function can be advantageous, as it allows all components currently used for the function to be collectively analyzed for impact.

[0021] According to an advantageous development of the invention, it can be provided that the method further comprises the following step: initiating a measure depending on a result of the classification of the function of the distributed system.

[0022] One measure could be to reconfigure at least part of the distributed system, for example, using other components of the distributed system. It is also conceivable that no action is taken, especially if the class specific to the independence of the distributed system's function is present.

[0023] Furthermore, within the scope of the invention, it is conceivable that the method further comprises the following step:

[0024] Compressing and / or selecting the metainformation, wherein the compression and / or selection of the metainformation is carried out on the basis of a check of functional data of the component and / or the at least one further component with regard to an integrity of the functional data.

[0025] Compressing and / or selecting metadata can be understood as removing parts of the metadata or replacing them with a compressed alternative in order to shorten it. For example, at least one characteristic statement for a respective component can be removed if, when checking the functional data of the respective component, sufficient integrity of the functional data is determined. This can advantageously shorten the transmission time between the components due to the lower data load. The integrity of the functional data can be determined, for example, by common deficiencies, such as the same hardware model or the same sensor used.

[0026] It may be advantageous if, within the scope of the invention, the analysis of the meta-information comprises the following step:

[0027] Performing a dynamic reconstruction of currently used paths of the function of the distributed system and / or a redundancy architecture of the distributed system, wherein preferably further on the basis of the dynamic reconstruction and / or the redundancy architecture at least one fault tree and / or at least one failure mode and effects analysis network and / or at least one causal graph is created.

[0028] Dynamic reconstruction can advantageously provide a more precise and flexible determination of the safety integrity of the function of the distributed system.

[0029] It is possible for the method according to the invention to be used in a vehicle. For example, the distributed system can be a vehicle with a cloud connection. The vehicle can be designed, for example, as a motor vehicle and / or passenger vehicle and / or an autonomous vehicle. The vehicle can have a vehicle device, for example for providing an autonomous driving function and / or a driver assistance system. The vehicle device can be designed to control the vehicle at least partially automatically and / or to accelerate and / or decelerate and / or steer.

[0030] The invention also relates to a computer program, in particular a computer program product, comprising instructions that, when executed by a computer, cause the computer to carry out the method according to the invention. Thus, the computer program according to the invention provides the same advantages as those described in detail with reference to a method according to the invention.

[0031] The invention also relates to a data processing device configured to carry out the method according to the invention. The device can be, for example, a computer that executes the computer program according to the invention. The computer can have at least one processor for executing the computer program. A non-volatile data memory can also be provided, in which the computer program is stored and from which the computer program can be read by the processor for execution.

[0032] The invention may also provide a computer-readable storage medium that has the computer program according to the invention and / or includes instructions that, when executed by a computer, cause the computer to carry out the method according to the invention. The storage medium is designed, for example, as a data storage device such as a hard disk and / or a non-volatile memory and / or a memory card. The storage medium can, for example, be integrated into the computer.

[0033] Furthermore, the method according to the invention can also be implemented as a computer-implemented method.

[0034] Further advantages, features, and details of the invention will become apparent from the following description, which describes embodiments of the invention in detail with reference to the drawings. The features mentioned in the claims and in the description may be essential to the invention individually or in any combination. They show:

[0035] Fig. 1 shows a schematic visualization of a method, a central data processing device, a device, a storage medium and a computer program according to embodiments of the invention.

[0036] Fig. 2 is a schematic representation of a distributed system according to embodiments of the invention,

[0037] Fig. 3 is a schematic representation of a method for determining a measure according to embodiments of the invention.

[0038] In Fig. 1, a method 100, a central data processing device 30, a device 10, a storage medium 15 and a computer program 20 according to embodiments of the invention are schematically shown.

[0039] According to an embodiment illustrated in Fig. 1, the method 100 for determining a safety integrity of a function 2 of a distributed system 1 comprises the following steps. In a first step 101, at least one piece of information about at least one characteristic of a component 9 of the distributed system 1 is provided in order to provide the at least one piece of information about the at least one characteristic as meta information of the component 9. The component 9 is involved in executing the function 2 of the distributed system 1. In a second step 102, the meta information of at least one further component 9' is preferably analyzed with regard to the meta information of the component 9 in order to determine an influence between the component 9 and the at least one further component 9' on the basis of the analysis.The at least one further component 9' is also preferably involved in executing function 2 of the distributed system 1. The influence is determined at least based on a similarity between the at least one piece of information from component 9 and the at least one piece of information from the at least one further component 9'. In a third step 103, function 2 of the distributed system 1 can be classified based on the determined influence in order to determine the safety integrity of function 2 of the distributed system 1 based on the classification. Preferably, at least one class is specific to the independence of function 2 of the distributed system 1.

[0040] Fig. 2 shows in particular a possible embodiment of the distributed system 1. This provides various functions 2, which in turn can access different orchestrators 3. The orchestrators 3 can create a replica 4 for executing a specific function 2, which replica 4 determines, for example, which software 5, hardware 6 or data 7 is used to execute the function 2. Each replica 4 can execute the same function 2 in order to provide redundancy. It is conceivable that the safety integrity is determined at the level of the replicas 4, with the respective components 9 representing, for example, different hardware modules 6. In addition, the safety integrity could be determined at the level of the entire distributed system 1. It can be advantageous if the safety integrity is determined in a cascade for each level and the respective result is forwarded to the next higher level.

[0041] Fig. 3 shows a schematic representation of a method 200 for determining a measure according to embodiments of the invention. In a first step 201, a function 2 is selected which is to be executed with a defined redundancy. For each redundancy, a replica 4 can then be generated in a second step 202, which replica 4 accesses various components 9 such as hardware 6 and software 5. In a third step 203, calculation results of the replica 4 can be received, for example by a central data processing device 30, including respective meta information of the components 9 of the replica 4. In a fourth step 204, the meta information of the respective components 9 of the replica 4 is then preferably checked with regard to critical dependencies and / or correlations.If no critical dependencies and / or correlations exist (path "N", for "No"), the calculation result can then be returned in a step 206. If a critical dependency and / or correlation is determined in step 204, a new replica 4, which uses, for example, other components 9, can be generated according to a first alternative (path "Y1", for "Yes 1"). According to a second alternative (path "Y2", for "Yes 2"), an error message can be output in a step 205.

[0042] One aspect of the invention can be a determination or provision of meta information in a distributed system 1 of dynamically networked functions 2 with regard to possible critical influences, i.e. in particular dependencies or correlations, between components 9, in particular redundant components 9.

[0043] Critical dependencies can be, for example, the same software 5, the same hardware 6 or the same data 7, which could contain the same systematic or random errors, e.g. in the sense of the ISO 26262 standard.

[0044] Correlations are, for example, correlated data 7 or models that may contain the same deficiencies, e.g. in the sense of the ISO 21448 standard.

[0045] This metadata can be used during runtime – e.g., by an orchestrator 3 or a security monitor – to identify dependencies or correlations critical to the security integrity of the function 2 to be executed in the distributed system 1 and, if identified, to initiate measures, in particular mitigation measures. At the same time, a check 8 for independence is preferably carried out in a cascaded manner (see Fig. 2). This means that if part of the function chain is sufficiently independent, this determined metadata can be passed on explicitly, e.g., via a secured certificate, without the need for further verification in the receiving system. If details of components 9 are required for further verification at higher levels, they can be encrypted, e.g., using a hash value.

[0046] Advantages of the invention can be, inter alia, the following: By applying the invention, it can be possible to evaluate dynamic configurations, such as those present in distributed systems 1, during operation with regard to sufficient independence and thus advantageously make them more secure. Furthermore, increased security can be provided through mitigation. By detecting dependencies at an early stage, measures, in particular mitigation measures, can be initiated, either at a lower functional level in order to still achieve the required independence or at the level of the safety-critical system that requested the calculation by responding safely (e.g. transition to the safe state). Furthermore, in particular through a cascaded forwarding of the test results, no details of the components 9 at the lower levels are revealed.In addition, this can reduce the amount of data that needs to be exchanged between components or levels. This can enable simple and efficient (vertical and horizontal) scaling of the approach.

[0047] The following discusses possible initiators for dependencies and correlations that can be covered in the exchanged metainformation. For a network node, for example, an identical cloud, hyperscaler, or software stack can be an initiator. For software 5, for example, identical software modules or libraries, manufacturers, versions, configurations, or hyperparameters can be an initiator. With regard to hardware 6, an identical hardware type (e.g., memory), manufacturer, version, or spatial position (e.g., of the server) can be an initiator. Furthermore, electromagnetic interference, humidity, and heating can be specific to the spatial position of hardware 6. Another factor in hardware 6 can be a power supply. With regard to data 7, initiators can be identical database, sensor modality, sensor, input signal, version, spatial position, or field of view.With regard to applied machine learning models, initiators can be the same database, the presence of a digital twin, the same manufacturer, the same (probabilistic) algorithms or the same AI module (even different versions).

[0048] A format for providing the meta information can, for example, be explicit information in the messages, i.e. in particular the data exchanged between the components 9, or the meta information can be provided in coded form, e.g. by hash or MAC.

[0049] An aggregation of the (possibly cascaded) metadata is described in more detail below. In order to be able to understand whether relevant dependencies exist in a multi-level networked system consisting of a branched tree of data processing functions and / or data processing systems, the metadata can be passed along a chain of components in a suitable form.

[0050] The metadata can be forwarded in the following exemplary ways, depending on latency requirements, communication resources, and the desired data protection. The metadata of the participants can be stored in a specially protected, central data processing device 30, wherein the central data processing device 30 is preferably a backend service, and examined there for relevant influences. For example, methods for PSI (Private Set Intersection), MPC-based approaches, or even cleanrooms based on Trusted Execution Environment (TEE), which are particularly known in the prior art, could be used here. Individual elements then preferably only receive feedback from the central data processing device 30, if necessary, as to whether or not influences to be considered exist for a desired combination, in particular a safety composition.Alternatively, the metadata can be passed on only as hashes, and these can be evaluated. For example, a software library is assigned a hash function so that an overlying component 9 can check whether a redundant component 9 provides the same hash function, thus identifying the interference.

[0051] Decentralized executions can exchange meta information between participants, or components, using security techniques such as “private set intersection” 9 to identify common influences without directly revealing all internal system details to the outside world, where the internal system details may contain information that must be kept secret.

[0052] To minimize latency, the metadata can be compressed or selected by checking which functional data has already been verified with a high diagnostic coverage by previous data processing and therefore already enjoys a correspondingly high level of integrity and preferably does not require further verification. Functional data that has previously been primarily "passed through" and whose final integrity check is still pending is preferentially associated with the relevant metadata, and further preferentially, only this metadata is passed on in the chain.

[0053] The metadata can be secured, for example, via a certificate, PKI, ledge or checksums.

[0054] An evaluation of the metainformation can, for example, be carried out by a simple check of the metainformation provided by “redundant” functions 2 for (critical) common parts. A detailed check can include a dynamic reconstruction of the currently used function paths or redundancy architecture, e.g. by using standard system models for modular representation (MBSE system models) or by evaluating additional metainformation with regard to functional relationships. Furthermore, a detailed check can include a dynamic creation of fault trees based on this architecture and a check for critical common parts, e.g. using cut sets. Additionally or alternatively, part of a detailed check can be a dynamic creation of FMEA networks based on this architecture and a check for critical common parts, e.g. using string comparison.Additionally or alternatively, part of a detailed review can be a dynamic creation of causal graphs based on this architecture and checking for critical paths.

[0055] Possible objectives of the evaluation can be the identification of identical elements (in the sense of “the same”) and / or the identification of “identical parts” (homogeneous redundancy, e.g. same hardware type, same software library). Furthermore, a subsequent assessment of the criticality of the similarity can be carried out, depending on, among other things, current boundary conditions, e.g. if the same hardware 6 is present but spatially separated or depending on a current context, e.g. whether a simultaneous failure or merely a similar corruption would result. For this purpose, relevant boundary conditions and context information of the component 9 to be tested can be provided, e.g. from the requesting system. Another objective can be to determine correlation factors, e.g. correlated data or sensors. In addition, the criticality of the correlation can be assessed, depending on, among other things, current boundary conditions or a current context.The evaluation can also be carried out over a defined period of time or continuously during an operation.

[0056] The result output can define different classes, for example, "sufficiently independent," "insufficiently independent," or "independent but optimizable." A measure, in particular a mitigation measure, can, for example, be a reconfiguration for an orchestrator 3 at low levels, e.g., a request for other or additional replicas 4. At the system level, an error reaction can be triggered, e.g., a transition to a safe state. For the area "independent but optimizable," a measure, in particular a mitigation measure, can, for example, be a reconfiguration with selection of paths with fewer, no, or even negative correlations by the components 9 present in the path. The results can be evaluated using a look-up table, a machine learning model, or a probabilistic model (e.g., Bayesian Network), and further locally, e.g., in a vehicle, or centrally, e.g.,in a cloud or a central “safety node”.

[0057] Possible extensions could extend the application not only to homogeneously redundant computations, but also to heterogeneously redundant computations, e.g., if nodes or functions, or services, are to be used for the simultaneous calculation of multiple hypotheses (e.g., with different parameters, data, and model assumptions). Furthermore, a combination with a component criticality analysis or the additional use of Bayesian networks for the evaluation of entire software stacks is conceivable.

[0058] The above explanation of the embodiments describes the present invention exclusively by way of examples. Of course, individual features of the embodiments can be freely combined with one another, provided they are technically feasible, without departing from the scope of the present invention.

Claims

Claims 1 . Method (100) for determining a safety integrity of a function (2) of a distributed system (1), comprising the following steps: Providing (101) at least one piece of information about at least one characteristic of a component (9) of the distributed system (1) in order to provide the at least one piece of information about the at least one characteristic as metainformation of the component (9), wherein the component (9) is involved in executing the function (2) of the distributed system (1); analyzing (102) the metainformation of at least one further component (9') with regard to the metainformation of the component (9) in order to determine, on the basis of the analysis, an influence between the component (9) and the at least one further component (9'), wherein the influence is determined at least on the basis of a similarity of the at least one piece of information of the component (9) and the at least one piece of information of the at least one further component (9'), wherein the at least one further component (9') is involved in executing the function (2) of the distributed system (1);Classifying (103) the function (2) of the distributed system (1) based on the determined influence, wherein at least one class is specific for an independence of the function (2) of the distributed system (1), in order to determine the safety integrity of the function (2) of the distributed system (1) based on the classification.

2. Method (100) according to claim 1, characterized in that the distributed system (1) is a cyber-physical system and has a hierarchical structure with at least two levels, wherein the component (9) and the at least one further component (9') are each present in one of the at least two levels, wherein the method (100) optionally further comprises the following step: securing the meta information via a certificate and / or a public key infrastructure and / or a distributed ledger technology and / or a checksum.

3. Method (100) according to one of the preceding claims, characterized in that the influence is determined by a dependency and / or a correlation between the component (9) and the at least one further component (9') of the distributed system (1) and the method (100) further comprises the following step: Assessing a criticality of the dependency and / or the correlation between the component (9) and the at least one further component (9') taking into account at least one boundary condition of the component (9) and / or the at least one further component (9').

4. Method (100) according to one of the preceding claims, characterized in that the method (100) further comprises the following step: transmitting the meta information from the component (9) and the at least one further component (9') to a central data processing device (30) in order to determine the security integrity of the function (2) of the distributed system (1) by the central data processing device (30).

5. Method (100) according to one of the preceding claims, characterized in that the method (100) further comprises the following step: initiating a measure depending on a result of the classification (103) of the function (2) of the distributed system (1).

6. Method (100) according to one of the preceding claims, characterized in that the method (100) further comprises the following step: compressing and / or selecting the meta information, wherein the compression and / or selection of the meta information is carried out on the basis of a check of functional data of the component (9) and / or the at least one further component (9') with regard to an integrity of the functional data.

7. Method (100) according to one of the preceding claims, characterized in that the analysis (102) of the meta-information comprises the following step: Carrying out a dynamic reconstruction of currently used paths of the function (2) of the distributed system (1) and / or a redundancy architecture of the distributed system (1), wherein preferably further on the basis of the dynamic reconstruction and / or the redundancy architecture at least one fault tree and / or at least one failure mode and effects analysis network and / or at least one causal graph is created.

8. A computer program (20) comprising instructions which, when the computer program (20) is executed by a computer (10), cause the computer (10) to carry out the method (100) according to any one of the preceding claims.

9. Device (10) for data processing which is arranged to carry out the method (100) according to one of claims 1 to 7.

10. A computer-readable storage medium (15) comprising instructions which, when executed by a computer (10), cause the computer (10) to carry out the steps of the method (100) according to any one of claims 1 to 7.

Images