Procedure, devices and computer program product for the execution of software on a computer intended for the control of a technical system, in particular a railway control system

Abstract

A method for running software on a computer to control a technical system, particularly for railway control, comprises the following steps. A launch seal is used. The launch seal consists of a linked value derived from a key and a software and / or hardware-specific identification number. The launch seal key is extracted using a software-specific identification number stored on the computer and / or a hardware-specific identification number stored on the computer. At least one encrypted portion of the software is decrypted based on the extracted key. The decrypted portion of the software is used to control the technical system.

Description

[0001] The present invention relates to a computer-implemented method for executing software on a computer for controlling a technical system, in particular for railway control. The invention further relates to a computer for controlling a technical system, a computer-implemented method for generating a startup seal for decrypting at least one encrypted part of software, and a computer for executing this method.

[0002] For safety-critical systems, remote software updates for secure computers must ensure that a correct version of the software is installed on a correct computer. Until these checks have been performed or have failed, newly loaded software must not become active in the system from a security perspective. Until this check has been performed or has failed, it must be ensured that the secure computer is in a secure state. This means that the secure computer must not operate any safety-relevant outputs or conduct any secure communication in this state.

[0003] Ensuring that a secure computer remains secure even in the event of an error, such as after incorrect software has been loaded, is a challenge. Currently, no generic method for remote software updates is known.

[0004] EP 0 679 977 A1 describes a method and apparatus for transferring encrypted files from a source computer to one or more destination computers. An export program is provided on the source computer and an import program on the destination computer. The export program decrypts the encrypted file and marks the export operation with an export counter value. The plaintext file is then encrypted using an encryption operation.

[0005] One object of the present invention is to provide an improved method for executing software on a computer for controlling a technical system, which can address the challenges mentioned above. This object is achieved by a method for executing software on a computer for controlling a technical system, comprising the features of independent claim 1. Further objects of the present invention are to provide a computer for controlling a technical system, to provide a computer-implemented method for generating a startup seal for decrypting at least one encrypted part of software, and to provide a computer for executing the method for generating a startup seal. These objects are each achieved by the subject matter of independent claims 9, 14, and 15. Advantageous embodiments are specified in dependent claims.

[0006] A computer-implemented method for executing software on a computer for controlling a technical system, in particular for a railway control system, comprises the following method steps according to the invention. A startup seal is used. The startup seal comprises a linked value consisting of values ​​of a key and a software-specific identification number and a computer-specific identification number (the term identification number is to be understood in the broadest sense, whereby it need not consist of a number, i.e., it is to be understood as an identification code).The key of the startup seal is extracted by using a software-specific identification number from software stored on the computer and a computer-specific identification number stored on the computer (specifically, by comparing the identification numbers, i.e., the software-specific identification numbers and the computer-specific identification numbers, of the startup seal and the computer, respectively, whereby the software-specific identification numbers and the computer-specific identification numbers must match for extraction to occur). At least one encrypted part of the software is decrypted based on the extracted key. The decrypted part of the software is used to control the technical system.

[0007] Advantageously, this procedure ensures that the computer and the technical system remain secure after the software has been stored on the computer, without requiring additional information to decrypt that part of the software, as long as decryption has not been successfully completed. Only upon provision of the activation key, which contains the necessary information for decryption, is the software released for operation of the technical system. The software on the computer can only actively participate in the operation of the technical system if the activation key is present on the computer.

[0008] The key is initially stored in encrypted form within the startup seal. A value of the key, together with values ​​from the software-specific identification number and a computer-specific identification number, forms a linked value. To extract the key, the computer-specific identification number is stored on the computer. The computer also has access to the software-specific identification number of the software, since the software is stored on the computer. The key is extracted based on the software-specific identification number accessible to the computer and the computer-specific identification number. This is only successful if the software-specific identification number and the computer-specific identification number of the startup seal match the software-specific identification number and the computer-specific identification number stored on the computer.

[0009] Using only the software-specific identification number ensures that the correct software version is used. Using only the computer-specific identification number ensures that the software is used on the correct target computer. Using both identification numbers in the process ensures that the correct software version is used on the correct target computer. The process is designed to be independent of the specific configuration of the computer platform.

[0010] In one embodiment, the encrypted part of the software comprises at least those components of the software that are provided for controlling the technical system for access to at least one output and / or at least one communication interface between the computer and the technical system.

[0011] Advantageously, this ensures that the computer can only control the technical system if decryption is successful, as the software components required for accessing at least one output and / or at least one communication interface between the computer and the technical system are otherwise inoperable. This allows safety-critical technical systems to be controlled reliably and securely, as it ensures that the correct software and computer are used to control the system. This guarantees that the computer can only operate safety-relevant outputs or conduct safety-relevant communication with the technical system if decryption is successful.

[0012] Advantageously, the parts of the software intended for accessing security-relevant outputs and / or security-relevant communication interfaces constitute only a small fraction of the software. This allows the process to be particularly performant and to be executed by the secure computer without restrictions. The scope of the software parts to be encrypted is scalable and can advantageously be extended beyond a security-critical minimum, whereby any additional functionalities included are only available after decryption.

[0013] In one embodiment, the initial seal additionally includes a rule. Decryption is performed based on the extracted key and the rule. The rule thus represents an inverse operation to an operation used to encrypt that part of the software.

[0014] In one embodiment, if decryption is unsuccessful, a valid start seal is requested.

[0015] In one embodiment, the system checks whether a software update is available and, if no update is available, requests the activation seal for the software installed on the computer. Advantageously, checking for a software update ensures that an activation seal for an outdated software version is not requested and used.

[0016] In one embodiment, the system checks whether a software update is available. If an update is available, the computer receives and installs it. A launch seal for the software update is requested. Advantageously, this ensures that a current software version and a current launch seal are used.

[0017] In one embodiment, the procedure is performed after every startup or restart of the computer. This advantageously keeps the computer and the technical system in a secure state after each startup or restart until decryption can be successfully performed.

[0018] A computer program product comprises instructions which, when executed by the computer, cause it to execute the method according to one of the embodiments.

[0019] A computer for controlling a technical system, particularly a railway control system, is configured to receive a startup seal. The startup seal comprises a linked value consisting of a key, a software-specific identification number, and a computer-specific identification number. The computer is configured to extract the key from the linked value of the startup seal using a software-specific identification number of software stored on the computer and a computer-specific identification number stored on the computer. It is then configured to decrypt at least an encrypted portion of the software based on the extracted key. If decryption is successful, the computer is configured to execute the decrypted portion of the software for controlling the technical system.

[0020] In one embodiment, the encrypted part of the software comprises at least those components of the software that are provided for controlling the technical system for access to at least one output and / or at least one communication interface between the computer and the technical system.

[0021] In one embodiment, the components of the software intended for accessing at least one output and / or at least one communication interface of the computer with the technical system are stored separately from other components of the software on the computer.

[0022] In one embodiment, the computer is configured to control a function of a rail vehicle based on the released portion of the software. This could be, for example, a brake or a door locking mechanism of the rail vehicle. Such a function can only be controlled if correct software and a correct computer are used. Advantageously, this ensures that the computer and the technical system remain in a safe state until decryption is successful.

[0023] In one embodiment, the computer is configured to control a signaling system for rail vehicles and / or a switch. The method is therefore advantageously not limited to rail vehicle-side functions, but can also be used for trackside functions.

[0024] A computer-implemented method for generating a startup seal for decrypting at least one encrypted part of software comprises the following steps. A linked value is created from the values ​​of a key, a software-specific identification number, and a computer-specific identification number as a component of the startup seal. The key is intended for decrypting at least one encrypted part of the software.

[0025] Another computer includes means for executing the method for generating a start-up seal and means for outputting the start-up seal to the computer according to one of the embodiments.

[0026] The properties, features, and advantages of this invention described above, as well as the manner in which they are achieved, will become clearer and more readily understandable in connection with the following description of the exemplary embodiments, which are explained in more detail in conjunction with the drawings. The drawings show: FIG 1 : a rail vehicle in the area of ​​a switch; FIG 2 : a computer for controlling a technical system; FIG 3 : another computer for generating and issuing a startup seal; FIG 4 : a method for executing software on the computer for controlling the technical system; and FIG 5 : a computer program product for carrying out the procedure on the computer.

[0027] A computer-implemented method 20 for executing software on a computer 4 for controlling a technical system is based on the idea that it should be ensured that the computer 4 and the technical system remain in a secure state after the software has been placed on the computer 4 without additional information for decrypting the part of the software, as long as the decryption has not been successfully carried out.

[0028] The computer is intended for controlling a technical system. This technical system could, for example, be a railway control system. However, the technical system is not limited to railway control systems. Rather, it could be any technical system, in particular a system in which safety-critical functions are to be performed. Railway control elements are used in the following description merely as examples to illustrate procedure 20.

[0029] FIG 1 Figure 1 schematically depicts an exemplary scenario in which a rail vehicle 1 is located in the vicinity of a switch 2 and a signaling system 3. A computer 4 is shown, for example, located in the vicinity of the rails 5. Alternatively, the computer 4 can also be located inside the rail vehicle 1. The computer 4 can, for example, be configured to control a function of the rail vehicle 1, such as a brake. However, other functions of the rail vehicle 1 are also possible. For example, the computer 4 can be configured to monitor the status of the doors of the rail vehicle 1 and, if necessary, open or close the doors. The computer 4 can also be configured, for example, to control the signaling system 3 and / or the switch 2. More generally, the computer 4 can be configured to control an interlocking system.The interlocking system, as a safety-critical technical element, can be integrated into the railway control system together with elements for executing functions of the rail vehicle 1. In general, the computer 4 can be configured to control any rail vehicle-related functions and / or trackside functions of external facilities.

[0030] Computer 4 has software installed. Running this software on computer 4 allows the railway control system to be activated. The software has a software-specific identification number. Computer 4 is configured to read and use this software-specific identification number. Furthermore, a computer-specific identification number is stored on computer 4.

[0031] The software is stored at least partially encrypted on computer 4. For example, the encrypted part of the software may include at least those components of the software intended for controlling the railway control system, specifically for accessing at least one output and / or at least one communication interface between computer 4 and the railway control system. The software components intended for accessing at least one output and / or at least one communication interface between computer 4 and the technical system may be stored separately from other software components on computer 4.

[0032] FIG 2 The diagram schematically shows computer 4 and illustrates, by way of example, how components of the software can be stored on computer 4. However, the software can also be stored differently than shown. FIG 2 This will be shown.

[0033] Computer 4 has a memory 6. Components of the software are stored in memory 6 as executable files 7. These executable files 7 can be, for example, .exe files. Alternatively, the executable files 7 can be structured as so-called binary extract blocks. These are executable files 7 that have a binary format prescribed for a specific computer platform, such as the SIMIS platform, for exchangeable data modules from which the software system of a secure computer 4 is composed.

[0034] In the exemplary embodiment, at least one first executable file 8 comprises the software components intended for controlling the technical system to access at least one output of the computer 4, and at least one second executable file 9 comprises the software components intended for controlling the technical system to access at least one communication interface between the computer 4 and the technical system. In an alternative embodiment, the aforementioned components of the first executable file 8 and the second executable file 9 can also be contained in a single executable file. The first executable file 8 and the second executable file 9 form a so-called startup module 10. The executable files 8 and 9 of the software contained in the startup module 10 are stored in encrypted form. They must be successfully decrypted in order to be executed on the computer 4.

[0035] In addition to the executable files 8 and 9 of the startup module 10, other executable files 7 can also be stored in memory 6. All executable files can be combined into a single file 11. If the executable files 7 are binary blocks, the combined file can also be called a load file (LAD file). For the SIMIS computer platform's base system, a load file is a collection of binary blocks.

[0036] To run the software, computer 4 must access the encrypted part of the software, for example the part contained in startup module 10, according to FIG 2 , decrypt. This is done using a so-called startup seal. Computer 4 is designed to request and receive the startup seal via an interface with another computer 12. The startup seal comprises a linked value consisting of values ​​from a key, a software-specific identification number, and a computer-specific identification number. The startup seal is generated by the other computer 12 as part of a computer-implemented procedure.

[0037] FIG 3 Figure 12 schematically depicts the additional computer 12. This additional computer 12 comprises means 13 for generating the startup seal and means 14 for outputting the startup seal to computer 4. The additional computer 12 is configured to create the linked value from the values ​​of the key, the software-specific identification number, and the computer-specific identification number as a component of the startup seal. The key is intended for decrypting at least one encrypted part of the software. The startup seal can additionally contain a rule specifying how decryption should be performed using the key. Encryption is based on the key and an operation. The rule optionally included in the startup seal thus corresponds to an inverse operation. Alternatively, the rule can also be stored on computer 4.

[0038] Computer 4 is configured to extract the key from the linked value of the startup seal by using the software-specific identification number of the software stored on the computer and / or the computer-specific identification number stored on the computer, and to decrypt the encrypted part of the software based on the extracted key. Computer 4 is configured to use the decrypted part of the software for track control if the decryption is successful.

[0039] FIG 4 schematically shows the procedural steps of the computer-implemented procedure 20 for executing the software on computer 4.

[0040] After the software is installed on computer 4 as part of an update, and computer 4 is optionally started or restarted, a startup seal is used in the first process step 21. A startup seal stored on computer 4 before the software installation may, for example, be marked as invalid by computer 4 and can no longer be used in the process. If no valid startup seal has been stored on computer 4 after the software installation, the startup seal can be requested by computer 4 in a sixth process step 26, issued by computer 12, received by computer 4, and stored on computer 4 for use in the first process step 21.

[0041] The startup seal comprises the combined value of the key, the software-specific identification number, and the computer-specific identification number. The key can be, for example, 512 bits long. The key can be the same for all software versions and all computers 4 and cannot be changed. However, different keys can also be used for different software versions and / or computers 4. Optionally, the startup seal also includes the instructions for decrypting the encrypted part of the software or the startup module 10. These instructions can alternatively be stored on computer 4 without being part of the startup seal.

[0042] In a second process step 22, the key of the startup seal is extracted by using the software-specific identification number of the software stored on computer 4 and the computer-specific identification number stored on computer 4. The individual values, and in particular the key, can be obtained from the linked value by performing a reverse transformation of the link based on the software-specific identification number of the software stored on computer 4 and the computer-specific identification number stored on computer 4.

[0043] In a third process step 23, the encrypted part of the software is decrypted based on the extracted key. In a fourth process step 24, the decrypted part of the software is used to control the technical system, i.e., the railway control system, if the decryption was successful. Once the software has been released through decryption, the computer is in a safe operating state. This ensures that the railway control system operates correctly and safely. Only if the decryption is successful is the software executable and the railway control system can enter safety-related operation. Should this step fail, the computer 4 remains in a safe state, as, for example, no outputs can be accessed and / or no communication with the railway control system can be established.

[0044] If the linked value of the startup seal is generated based on both the software-specific identification number and the computer-specific identification number, it can be ensured that the correct software is executed on the correct computer 4. Alternatively, only one of the identification numbers can be used to generate the startup seal and to decrypt a part of the software, such as the startup module. In this case, it can be ensured that the correct software is executed on computer 4, or that the software is executed on the correct computer 4.

[0045] Optionally, after decryption, it can be further checked whether the software has been falsified or manipulated. In this case, the software is only released for use in controlling the technical system with the decrypted portion if no falsification or manipulation can be identified.

[0046] Should decryption fail, a valid launch seal can be requested in an optional sixth step 26. The launch seal can be requested by computer 4, for example, from an operator 15 who is responsible for releasing the software for operation of the technical system. The operator 15 can access a remote database to construct the launch seal from the key of the software-specific and computer-specific identification numbers, and optionally the relevant regulation. This grants release for the operation of the software and the computer 4 responsible for controlling the technical system. Alternatively, a computer-implemented system can be used, at least partially, to release the launch seal instead of the operator 15. FIG 4 The operator 15 is shown as an example only, to illustrate that the operator 15 may be involved in the process 20 in the course of requesting the start-up seal.

[0047] Additionally, before requesting a valid startup seal, an optional fifth process step (25) can be used to check whether a software update is available. If a software update is available, the software or software version stored or installed on computer 4 is no longer valid and must be replaced. In this case, an invalid startup seal was initially stored on computer 4 because the software version was already outdated. If, however, no software update is available, the startup seal can be requested again for the software already stored on computer 4.

[0048] If a software update is available, the software update is received by computer 4 in an optional seventh process step 27, installed on computer 4, and the activation seal for the software update (i.e., for a new version of the software or new software) is requested. A requested activation seal is issued by the other computer 12, received by computer 4, and stored on computer 4. After the sixth and / or seventh process steps 26 and 27, computer 4 can optionally be restarted.

[0049] In one variant, procedure 20 can be performed after every startup or restart of computer 4. In this case, information about whether decryption was successful or not is not stored on computer 4. This ensures that computer 4 and the technical system remain in a secure state after every startup or restart until decryption is successful.

[0050] FIG 5 A computer program product 30 comprises instructions 31 which, when executed by the computer 4, cause it to perform the procedure 20 according to FIG 4 to carry out.

Claims

1. Computer-implemented method (20) for running a piece of software on a computer (4) for control of a technical system with the following method steps: - receiving a start-up seal, wherein the start-up seal comprises a linked value consisting of values of a key and a computer-specific identification number, - extracting the key of the start-up seal by using a computer-specific identification number stored on the computer (4), - decrypting at least one encrypted part of the software on the basis of the extracted key, - using the decrypted part of the software for control of the technical system, characterised in that it is checked whether a software update is available, wherein, if a software update is available, a start-up seal for the software update is requested and the software update is received by the computer (4) and installed on the computer (4), with the following method steps: - using said start-up seal, wherein this start-up seal comprises a linked value consisting of values of a key and a software-specific identification number and a computer-specific identification number, - extracting the key of said start-up seal by using the software-specific identification number of a piece of software stored on the computer (4) and the computer-specific identification number stored on the computer (4), - decrypting at least one encrypted part of the software on the basis of the extracted key, - using the decrypted part of the software for control of the technical system.

2. Method (20) according to claim 1, wherein the encrypted part of the software comprises at least the constituent parts of the software which are provided for control of the technical system for access to at least one output or at least one communication interface of the computer (4) with the technical system.

3. Method (20) according to claim 1 or 2, wherein the start-up seal additionally has a rule, wherein the decryption takes place on the basis of the extracted key and the rule.

4. Method (20) according to one of the preceding claims, wherein, if the decryption was not successful, then a valid start-up seal is requested.

5. Method (20) according to one of the preceding claims, wherein the method (20) is performed after each start-up or restart of the computer (4).

6. Computer program product (30), comprising commands (31) which, when they are carried out on a computer (4), apply all method steps of one of the methods (20) according to one of claims 1 to 3.

7. Computer (4) for control of a technical system, wherein the computer (4) is configured to receive a start-up seal, wherein the start-up seal comprises a linked value consisting of values of a key and a software-specific identification number and a computer-specific identification number, wherein the computer (4) is configured to extract the key, by using a computer-specific identification number stored on the computer (4), from the linked value of the start-up seal and to decrypt at least one encrypted part of the software on the basis of the extracted key, wherein the computer (4) is configured to run the decrypted part of the software for control of the technical system, if the decryption was successful, wherein the computer (4) is configured to check whether a software update is available, wherein, if a software update is available, the computer (4) is configured to request a start-up seal for the software update and to receive the software update and to install it on the computer (4) while carrying out the method steps of claim 1.

8. Computer (4) according to claim 7, wherein the encrypted part of the software comprises at least the constituent parts of the software which are provided for control of the technical system for access to at least one output or at least one communication interface of the computer (4) with the technical system.

9. Computer (4) according to claim 8, wherein the constituent parts of the software that are provided for access to at least one output or at least one communication interface of the computer (4) with the technical system are stored separately from other constituent parts of the software on the computer (4).

10. Computer (4) according to one of the preceding claims 7 to 9, wherein the computer (4) is embodied to control a function of a rail vehicle (1) on the basis of the released part of the software.

11. Computer (4) according to one of the preceding claims 7 to 10, wherein the computer (4) is embodied to control a signal installation (3) for rail vehicles (1) or a set of points (2).

Images