Protection against unauthorized changes to the measurement system

Abstract

The present invention describes a method for protecting a measurement system having a plurality of measurement system components and at least one local storage device from unauthorized modification. The method comprises automatically retrieving a plurality of information items that identify the measurement system components and / or describe one or more characteristics of the measurement system components; automatically combining the retrieved information items for each of the plurality of measurement system components into a data set represented by summary data; creating a signature based on the summary data; and storing the summary data and the signature in at least one local storage device of the measurement system. The method provides a more efficient and secure protection of the measurement system and its individual components from unauthorized modification.

Description

[Technical field]

[0001] SUMMARY OF THE DISCLOSURE Embodiments of the present application relate to protecting measurement systems from tampering and checking the integrity of the measurement systems.

[0002] SUMMARY OF THE DISCLOSURE An embodiment of the present invention relates to a method for protecting a measurement system having multiple measurement system components and at least one local storage device from tampering.

[0003] A further embodiment of the present invention relates to a method for checking the integrity of a measurement system comprising a plurality of measurement system components and at least one local storage device.

[0004] A further embodiment of the present invention relates to a method for controlling the operation of a measurement system comprising a plurality of measurement system components and at least one local storage device, the method comprising protecting the measurement system against unauthorized modifications and checking the integrity of the measurement system.

[0005] A further embodiment of the present invention relates to a measurement system comprising a plurality of measurement system components and at least one local storage device.

[0006] A further embodiment according to the invention relates to a computer program for carrying out the method for protecting a measurement system against unauthorized modifications and for checking the integrity of the measurement system.

[0007] The present invention is applicable to protecting components used to calibrate manufacturing equipment. [Background technology]

[0008] A number of methods are currently known for checking the integrity of a measurement system to ensure that no tampering (unauthorized) modifications have been made to the system.

[0009] However, known methods usually use manual checking of the coherence measurement system and of the calibration state of the system and its separate parts. The results of known methods usually depend heavily on the human factor and also on the completeness of the information in the traceability documentation of the used measuring equipment. This not only makes the corresponding checking procedures difficult and time-consuming, but also leads to errors in the measurement due to imperfections or incorrect calibration of the system.

[0010] In view of the above, it is desirable to create a method that allows for improving the reliability (or trustworthiness) of a measurement system in an efficient manner, for example a method that allows for reporting of any unauthorized modifications to the system or its separate parts, which leads to an improvement in the operation of the measurement system.

[0011] It is therefore desirable to provide a more efficient concept in terms of the efficiency of the integrity check of the measurement system and in terms of protection against unauthorized modification of the measurement system.

[0012] This object is achieved by the subject matter of the pending independent claims. Summary of the Invention [Means for solving the problem]

[0013] An embodiment of the present invention creates a method for protecting a measurement system comprising a plurality of measurement system components (e.g., one or more voltmeters, and / or one or more frequency meters, and / or thermometers and / or hygrometers and / or cables and / or power distributors and / or relays and / or passive components, e.g., one or more smart devices having built-in functionality for reporting one or more items of information that uniquely identify the smart device, and / or one or more "manual" devices that do not have built-in functionality for reporting one or more items of information that uniquely identify the "manual" device, but are coupled to a local storage device having such items of information stored therein) and at least one local storage device, from unauthorized modification. The method comprises automatically reading, e.g., using a reading mechanism, a plurality of information items (e.g., type identifier and serial number) that identify (e.g., uniquely) the measurement system components and / or a plurality of information items that represent one or more characteristics of the measurement system components (e.g., software revision and / or calibration date and / or calibration interval); automatically combining, e.g., using a combiner, the read information items (e.g., serial number, type identifier, software revision and / or calibration date and / or calibration interval, etc.) for each (or at least a portion of) the plurality of measurement system components into a data set represented by summary data (e.g., a summary file); creating a signature based on the summary data; and storing the summary data and the signature in at least one local storage device of the measurement system.

[0014] This embodiment is based on the discovery that the integrity of the measurement system can be guaranteed (e.g., can be checked later) by collecting all possible information about the measurement system and its separate parts and protecting the collected information from unauthorized modifications by a signature (or signature).

[0015] According to an embodiment, creating the signature comprises signing the summary data with a private key, thus improving the security of data protection. Also, the integrity of the summary data can be checked using the public key, allowing for a highly reliable implementation. In particular, this concept allows the integrity to be checked by any third party that has access to the public key corresponding to the private key.

[0016] According to one embodiment, the private key is a secret private key, the secrecy of which provides an additional level of security for data protection.

[0017] According to one embodiment, the summary data and the signature are stored in two separate files (eg, a summary file and a signature file) or the summary data and the signature are stored in one file.

[0018] According to an embodiment, one or more of the measurement system components that do not have a built-in capability to report an information item for (e.g., uniquely) identifying each measurement system component (e.g., measurement system components that are configured to be read only manually and not automatically and are not tracked automatically; e.g., passive measurement system components such as cables, switches, relays, power distributors, shielding devices, connectors, adapters, etc., or older measurement devices that do not allow automatic reading of a unique identifier such as a serial number via an external communication interface) are coupled with an associated local storage device to enable automatic retrieval of a measurement system component specific information item that identifies the measurement system component that does not have a built-in capability to report an information item for (e.g., uniquely) identifying each measurement system component. Coupling the components to a local storage device with a communication interface allows automatic tracking of the status of measurement equipment that previously could not be tracked automatically and allows automatic retrieval of information items identifying all components of the measurement system without user involvement. In particular, such a concept allows automatic detection of replacement of passive components that may degrade the functionality of the measurement system.

[0019] According to an embodiment, the method comprises coupling measurement system components that do not have a built-in capability of reporting an item of information for (e.g. uniquely) identifying each measurement system component with an associated local storage device before automatically retrieving an item of information for (e.g. uniquely) identifying each measurement system component, thus providing for automatic collection of parameters of all components of the measurement system simultaneously (or at least in a single process flow) during the retrieval step.

[0020] According to an embodiment, measurement system components that do not have a built-in capability to report an item of information for (e.g. uniquely) identifying each measurement system component are inseparably coupled to the associated local storage device. This allows each measurement system component to be replaced together with its local storage device, and ensures an automatic reading of all components even when each component is replaced. In particular, it is prevented that measurement system components that do not have a built-in capability to report an item of information are replaced without the change being noticed.

[0021] According to an embodiment, the measurement system components that do not have a built-in capability to report an item of information for identifying each measurement system component (e.g. uniquely) are coupled to each associated local storage device in such a way that the measurement system components cannot be separated from each associated local storage device in a tool-less manner, or the measurement system components that do not have a built-in capability to report an item of information for identifying each measurement system component (e.g. uniquely) are coupled to each associated local storage device in such a way that the measurement system components cannot be separated from each associated local storage device in a non-destructive manner, or the measurement system components that do not have a built-in capability to report an item of information for identifying each measurement system component (e.g. uniquely) are coupled to each associated local storage device in such a way that the measurement system components cannot be separated from each associated local storage device without breaking the seal. This ensures that measurement system components that do not have a built-in capability to report an item of information are not replaced without the change being noticed, since a large amount of effort would be required to rearrange the local storage devices.

[0022] According to one embodiment, at least one of the measurement system components that does not have a built-in capability to report an item of information for (e.g. uniquely) identifying each measurement system component is attached to a respective one of the local storage devices, which is a particularly efficient solution for preventing unauthorized exchange of measurement system components.

[0023] According to an embodiment, at least one of the measurement system components that does not have a built-in capability of reporting an item of information for (e.g. uniquely) identifying each measurement system component is arranged in a separate housing (e.g. box, cover) together with each one of the local storage devices. Thus, a separate hardware unit with a communication interface is provided, which comprises the measurement system component and the local storage device with the communication interface.

[0024] According to one embodiment, one or more of the local storage devices is one of a USB storage device, a network attached storage device, preferably a wired LAN device, and an RFID tag. These storage devices are only examples of storage devices that may be used. In other embodiments, any other storage device may be used.

[0025] According to an embodiment, one or more measurement system components that do not have built-in functionality for reporting an item of information for (e.g. uniquely) identifying each measurement system component comprise one or more (e.g. active) measurement devices, e.g. measurement devices configured to report measurement results via an external interface, e.g. to a measurement system controller, In particular, older measurement devices that do not have a communication interface can be used.

[0026] According to an embodiment, the one or more measurement system components that do not have built-in capabilities to report an item of information to (e.g., uniquely) identify each measurement system component comprise one or more passive measurement system components, such as signal path components, passive switches, relays, attenuators, connectors, adapters, cables, and sensors. Reading information from memories, for example, attached to these passive measurement system components, allows tracking of the state of the measurement system as a whole and allows taking into account any variations in voltage, resistance, etc., in the connecting lines between the components. Changes in the passive components that may degrade system performance become detectable.

[0027] According to an embodiment, the one or more measurement system components that do not have built-in functionality to report an item of information for (e.g., uniquely) identifying each measurement system component may comprise one or more of the following measurement system components: signal path components, coupling components, couplers, adapters, and cables, such that changes to such components that may degrade system performance may be detectable.

[0028] According to an embodiment, the one or more measurement system components that do not have built-in functionality to report an item of information for (e.g., uniquely) identifying each measurement system component comprise one or more of the following measurement system components: thermodynamic components, fixed power components, antennas, shielded housing components, cooling components (e.g., fans, e.g., allowing tracking of the aerodynamic characteristics of the fan), etc. Thus, changes to such components that may degrade system performance may be detectable.

[0029] According to an embodiment, the method comprises automatically retrieving from each local storage device (e.g., a local memory, associated with one or more measurement system components that do not have built-in functionality to report an item of information for identifying (e.g., uniquely) each measurement system component) an item of information identifying the one or more measurement system components that do not have built-in functionality to report an item of information for identifying (e.g., uniquely) each measurement system component; and automatically including in a data set the retrieved items of information, e.g., serial number, type identifier, software revision, calibration data, calibration interval, etc., of the one or more measurement system components that do not have built-in functionality to report an item of information for identifying (e.g., uniquely) each measurement system component. This allows for automated monitoring of various types of measurement system components.

[0030] According to an embodiment, the one or more characteristics of the measurement system component comprise at least one wear state of the measurement system component, which makes it possible to determine whether all components of the measurement system are functioning properly in order to avoid any measurement errors.

[0031] According to one embodiment, the item of information identifying the wear status is the value of a counter located in each measurement system component, with one being added to the counter for each use of each measurement system component (or, generally speaking, with each use or state change of each measurement system component, the value is incremented or decremented). Thus, the memory associated with each measurement system component is also reused to track the wear of each measurement system component. By checking the wear information, a possible degradation in the reliability of the measurement system can be identified.

[0032] According to an embodiment, the method further comprises performing a self-assessment of each measurement system component, e.g., measuring one or more parameters, e.g., resistance measurements, for example, for relays, to determine a wear state of each component, thereby increasing the reliability of the measurement system by detecting fault conditions in the measurement system.

[0033] According to an embodiment, the method further comprises obtaining (e.g. reading from a user interface or reading, e.g. collecting, e.g. automatically obtaining) information about permissible (e.g. optimal) operating environmental conditions of the measurement system (e.g. used for calibration of the measurement system by a manufacturer or deviating within a permissible tolerance range from environmental conditions used for calibrating the measurement system); and storing information about the permissible (e.g. optimal) operating environmental conditions in at least one local storage device of the measurement system. This makes it possible to avoid unknown effects of environmental conditions such as too high or too low temperatures, extreme humidity levels and / or unknown effects of electromagnetic influences. When using the measurement system, it makes it possible to check whether the actual measurement conditions correspond to the permissible operating environmental conditions. The information about the permissible operating environmental conditions may be signed, e.g. a signature may be created and the signature may be stored in at least one local storage device of the measurement system.

[0034] According to an embodiment, the information regarding acceptable (eg optimal) operating environmental conditions comprises information regarding humidity and / or temperature and / or electromagnetic interference.

[0035] An embodiment of an invention creates a method for checking the integrity of a measurement system comprising a plurality of measurement system components (e.g., one or more voltmeters, and / or one or more frequency meters, and / or thermometers and / or hygrometers, and / or cables and / or power distributors and / or relays and / or passive components, such as one or more smart devices having built-in functionality for reporting one or more items of information that uniquely identify the smart device, and / or one or more "manual" devices that do not have built-in functionality for reporting one or more items of information that uniquely identify the "manual" device, but are coupled to a local storage device having such items of information stored therein) and at least one local storage device. The method includes automatically reading a number of information items (e.g., type identifier and serial number) that (e.g., uniquely) identify the measurement system component and / or a number of information items that represent one or more characteristics of the measurement system component (e.g., software revision and / or calibration date and / or calibration interval), e.g., to obtain a summary file associated with the current measurement system or "current combination", automatically reading reference summary data, e.g., represented by a (reference) summary file, and a signature associated with the reference summary data (e.g., associated with the (reference) summary file), e.g., represented by a signature file, from at least one local storage device of the measurement system; comparing current summary data based on information items (e.g. a summary file associated with the current measurement system or the "current combination"), or at least a plurality of information items of the current summary data (e.g. such information items as are required to uniquely identify the measurement system part and characteristics of the measurement system part that must remain unchanged), with reference summary data, e.g. to obtain part identity information as intermediate information, and verifying the authenticity of the reference summary data using a signature, e.g. performing a "signature check", to obtain measurement system integrity information, e.g. to obtain signature check information as intermediate information.For example, measurement system integrity information may be obtained based on part identity information and signature check information.

[0036] This embodiment is based on the discovery that the integrity of the measurement system can be ensured by using earlier collected reference data for each of the measurement system's components and for the entire measurement system as a model to check whether parameters of the measurement system and its components have been changed without authorization before a user intentionally operates the measurement system.

[0037] The method may optionally include automatically combining the retrieved information items of each of the multiple measurement system components, such as serial numbers, type identifiers, software revisions, calibration dates, calibration intervals, etc., into a data set represented by the actual summary data, such as a summary file. Combining the information items into one data set simplifies storage of the information items and comparison with reference values.

[0038] According to an embodiment, the method further comprises reporting (e.g. to a user, e.g. by means of a user interface) and / or e.g. storing measurement system integrity information, e.g. indicating the integrity of a current state of the measurement system and including, e.g., a date of acquisition of the measurement system integrity information. The measurement system integrity information may be used to determine whether the measurement system can be used in a current state and / or as a trigger to further shut down the measurement system to avoid operation of a measurement system that has been modified without authorization.

[0039] According to an embodiment, the method further comprises automatically shutting down the measurement system if the measurement system integrity information includes information about an imperfection state of the measurement system, thereby avoiding operation of an unauthorized modified measurement system and minimizing measurement errors due to improper operation of the measurement system and its components.

[0040] According to one embodiment, the measurement system is a calibration instrument configured to calibrate manufacturing equipment, for example automatic test equipment, thus ensuring that the manufacturing equipment is reliably calibrated.

[0041] According to one embodiment, the method comprises selectively verifying the validity of a calibration of manufacturing equipment, e.g., automatic test equipment, performed using the measurement system in dependence on the measurement system integrity information, such that the integrity of the calibration of the manufacturing equipment is verified only if a state of the measurement system matches a state defined by the reference summary data.

[0042] According to one embodiment, the method further comprises, in response to finding that the measurement system used to calibrate the manufacturing equipment has not been altered compared to a reference condition, obtaining a certificate confirming that the manufacturing equipment has been properly calibrated.

[0043] According to an embodiment, obtaining the certificate is performed by the measurement system and / or by a remote server. The certificate can be issued, for example, by a remote server of the manufacturer of the measurement system.

[0044] According to an embodiment, the method further comprises automatically transmitting the measurement system integrity information to a remote server, e.g. operated by the provider (company) of the measurement system, for example for storage in the remote server, thereby allowing the manufacturer to control whether the measurement device is used under proper conditions and to attest to the authenticity of the measurement device or of devices calibrated with the measurement device (or measurement system).

[0045] According to an embodiment, one or more of the measurement system components that do not have built-in functionality for reporting information items for (e.g., uniquely) identifying each measurement system component, e.g., measurement system components that are configured to be read only manually and not automatically and are not tracked automatically; e.g., passive measurement system components such as cables, switches, relays, power distributors, shielding devices, connectors, adapters, etc., or older measurement devices that do not allow automatic reading of a unique identifier such as a serial number via an external communication interface, are coupled with an associated local storage device to enable automatic retrieval of measurement system component specific information items that identify the measurement system components that do not have built-in functionality for reporting information items for (e.g., uniquely) identifying each measurement system component. Coupling the components to the local storage device with the communication interface allows automatic tracking of the status of measurement equipment that previously could not be tracked automatically and allows automatic retrieval of information items identifying all components of the measurement system without user involvement.

[0046] According to an embodiment, the method comprises coupling measurement system components that do not have a built-in capability of reporting an item of information for (e.g. uniquely) identifying each measurement system component with an associated local storage device before automatically retrieving an item of information for (e.g. uniquely) identifying each measurement system component, thus providing for automatic simultaneous collection of parameters of all components of the measurement system during the retrieval step.

[0047] According to an embodiment, measurement system components that do not have built-in functionality to report information items for (e.g. uniquely) identifying each measurement system component are inseparably coupled to their associated local storage devices, making it possible to replace each measurement system component together with its local storage device and to guarantee automatic reading of all components even when each component is replaced.

[0048] According to one embodiment, a measurement system component that does not have a built-in capability to report an item of information for identifying (e.g. uniquely) each measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device in a tool-less manner, or a measurement system component that does not have a built-in capability to report an item of information for identifying (e.g. uniquely) each measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device in a non-destructive manner, or a measurement system component that does not have a built-in capability to report an item of information for identifying (e.g. uniquely) each measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device without breaking the seal.

[0049] According to one embodiment, at least one of the measurement system components that does not have a built-in capability to report an item of information for identifying (eg, uniquely) each measurement system component is attached to a respective one of the local storage devices.

[0050] According to an embodiment, at least one of the measurement system components that does not have a built-in capability of reporting an item of information for (e.g. uniquely) identifying each measurement system component is arranged in a separate housing (e.g. box, cover) together with each one of the local storage devices. Thus, a separate hardware unit with a communication interface is provided, which comprises the measurement system component and the local storage device with the communication interface.

[0051] According to one embodiment, one or more of the local storage devices is one of a USB storage device, a network attached storage device, preferably a wired LAN device, and an RFID tag. These storage devices are only examples of storage devices that can be used. Any other storage device can be used in this embodiment.

[0052] According to an embodiment, one or more measurement system components that do not have built-in functionality for reporting an item of information for (e.g. uniquely) identifying each measurement system component comprise one or more (e.g. active) measurement devices, e.g. measurement devices configured to report measurement results via an external interface, e.g. to a measurement system controller, In particular, older measurement devices that do not have a communication interface can be used in this way.

[0053] According to an embodiment, the one or more measurement system components that do not have built-in functionality to report an item of information to (e.g., uniquely) identify each measurement system component include one or more passive measurement system components, such as signal path components, passive switches, relays, attenuators, connectors, adapters, cables, sensors, etc. Reading information about the passive measurement system components allows tracking of the state of the measurement system as a whole and allows taking into account any variations in voltage, resistance, etc. in the connecting lines between components.

[0054] According to one embodiment, the one or more measurement system components that do not have built-in functionality for reporting an item of information to identify (e.g., uniquely) each measurement system component include one or more of the following measurement system components: signal path components, coupling components, couplers, adapters, and cables.

[0055] According to an embodiment, the one or more measurement system components that do not have built-in functionality to report an item of information to (e.g., uniquely) identify each measurement system component comprise one or more of the following measurement system components: thermodynamic components, fixed power components, antennas, shielded housing components, cooling components (e.g., fans, e.g., enabling tracking of the aerodynamic characteristics of the fan).

[0056] According to one embodiment, the method comprises automatically retrieving an item of information identifying one or more measurement system components that do not have a built-in capability of reporting an item of information for (e.g., uniquely) identifying each measurement system component from each local storage device, e.g., local memory, associated with the one or more measurement system components that do not have a built-in capability of reporting an item of information for (e.g., uniquely) identifying each measurement system component, and automatically including the retrieved items of information, e.g., serial number, type identifier, software revision, calibration data, calibration interval, etc., of the one or more measurement system components that do not have a built-in capability of reporting an item of information for (e.g., uniquely) identifying each measurement system component, in a data set.

[0057] An embodiment of the present invention creates a method for controlling the operation of a measurement system comprising a number of measurement system components and at least one local storage device, the method comprising protecting the measurement system according to any of the above-mentioned embodiments against unauthorized modification and checking the integrity of the measurement system according to any of the above-mentioned embodiments.

[0058] An embodiment of the present invention creates a measurement system comprising a number of measurement system components and at least one local storage device, the measurement system being configured to perform a method according to any of the previously described embodiments.

[0059] An embodiment of the present invention generates a computer program having a program code for performing the method according to any of the previously described embodiments, when the computer program is run on a computer.

[0060] These and further advantageous aspects are the subject matter of the dependent claims.

[0061] The above-described methods and measurement systems may optionally be supplemented, individually or in combination, with any of the features, functions and details disclosed in this document (the entire document). [Brief description of the drawings]

[0062] Preferred embodiments of the present application are described below on the basis of the drawings. [Figure 1] 1 is a flow chart illustrating a method 100 for protecting a measurement system from tampering in accordance with one embodiment. [Diagram 2] 2 is a flow chart illustrating a method 200 for checking the integrity of a measurement system according to one embodiment. [Diagram 3] 3 is a flow chart illustrating a method 300 for determining whether a measurement system having multiple measurement components is being used in a legitimate manner according to one embodiment. [Figure 4] 4 is a flow chart illustrating a method 400 for assisting in determining whether a measurement system comprising a plurality of measurement system components is being used in a legitimate manner according to one embodiment. [Diagram 5] FIG. 1 is a schematic diagram illustrating a measurement system used as a calibration device to calibrate a manufacturing device in accordance with an embodiment. [Figure 6] FIG. 2 is a schematic diagram illustrating a procedure for generating a signature according to an embodiment. [Figure 7] FIG. 2 is a schematic diagram illustrating a procedure for verifying the authenticity of a data file according to an embodiment. [Figure 8] FIG. 1 is a schematic diagram illustrating a procedure for enabling automatic retrieval of measurement system component specific information items identifying measurement system components that do not have a built-in capability for reporting information items identifying each measurement system component, according to one embodiment. [Figure 9] FIG. 2 illustrates a method for protecting a measurement system against tampering according to an embodiment of the present invention. [Figure 10] FIG. 1 illustrates a method for checking the integrity of a measurement system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0063] FIG. 1 illustrates a method 100 for protecting a measurement system having a plurality of measurement system components and at least one local storage device from tampering (unauthorized) modification according to an embodiment of the present invention. The measurement system components may include measurement components such as, for example, a voltmeter, a frequency meter, a thermometer, a hygrometer. The measurement system components may include connection components such as cables. The measurement system components may include, for example, one or more of a power distributor, a relay, and a passive component. The measurement system components may further include, for example, one or more smart devices having built-in functionality for reporting one or more items of information that uniquely identify the smart devices. The measurement system components may also include one or more so-called "manual devices" that do not have built-in functionality for reporting items of information that uniquely identify these devices. Such "manual devices" may, for example, be coupled to a local storage device that stores such items of information.

[0064] The method for protecting a measurement system starts in step 101 by automatically reading out a number of information items, e.g., uniquely identifying the measurement system components and / or describing one or more characteristics of the measurement system components. A reading mechanism can be provided in the measurement system itself to perform the automatic reading step. Alternatively, an external reading device can be used to automatically read and collect all the information items. The information items identifying the measurement system components can include, e.g., a type identifier and a serial number of each component. The information items describing one or more characteristics of the measurement system components can include, e.g., software revision date, software version, calibration date, calibration interval, etc.

[0065] The method proceeds in step 102 with automatically combining the retrieved information items, for example using a combiner or a combining unit provided in or outside the measurement system. The respective information items of the multiple measurement system components are automatically combined in step 102 into a data set. The data collection is represented by summary data, which may be stored, for example, as a summary file or a summary data file. In step 103, a signature, which is stored, for example, as a signature file, is generated based on the summary data. The signature can be generated, for example, using a secret private key, for example, using the Open SSL toolkit. However, other signature generation concepts may also be used. Generally speaking, a signature is encrypted information that verifies in a cryptographically reliable (satisfying a desired reliability criterion) way that the summary data was generated by a specific (trusted) person or entity and that the summary data has not been modified in the meantime. In other words, a signature may be considered as information for verifying the authenticity of a digital message or document (for example of the summary data). A valid digital signature, assuming necessary conditions are met, gives a recipient very strong basis for believing that a message (e.g., summary data) was generated by a known sender (authentication) and that the message has not been altered in transit (integrity).

[0066] At step 104, the summary data and the signature are stored in at least one local storage device of the measurement system. The signature and summary data can be stored in two separate files, such as a summary file and a signature file, or can be stored in one file. The method ends.

[0067] The method 100 allows for the provision of information (e.g. summary data and associated signature) that allows for checking the integrity of the measurement system (e.g. using the method of Fig. 2). In other words, the summary data and the corresponding signature may serve as input data for the method according to Fig. 2, e.g. as reference summary data and a signature associated with the reference summary data.

[0068] However, it should be noted that the method 100 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in any combination.

[0069] FIG. 2 illustrates a method 200 for checking the integrity of a measurement system comprising a plurality of measurement system components and at least one local storage device according to an embodiment of the present invention. For example, the method may be used to check the integrity of the measurement system referred to in the discussion of FIG. 1. For example, the method may be used to check whether the measurement system referred to in the discussion of FIG. 1 remains unchanged. The measurement system components may include measurement components such as, for example, a voltmeter, a frequency meter, a thermometer, a hygrometer. The measurement system components may include connection components such as a cable. The measurement system components may include, for example, one or more of a power distributor, a relay, and a passive component. The measurement system components may further include one or more smart devices having a built-in capability to report one or more items of information that uniquely identify the smart device. The measurement system components may also include one or more of these devices that do not have a built-in capability to report an item of information that uniquely identifies a so-called "manual device". Such a "manual device" may, for example, be coupled to a local storage device having such items of information stored therein.

[0070] The method starts in step 201 by automatically reading out a number of information items, e.g., uniquely identifying the measurement system component and / or describing one or more characteristics of the measurement system component. A reading mechanism can be provided in the measurement system itself to perform the automatic reading step. Alternatively, an external reading device can be used to automatically read and collect all the information items. The information items identifying the measurement system component can include, e.g., a type identifier and a serial number of each component. The information items describing one or more characteristics of the measurement system component can include, e.g., software revision date, software version, calibration date, calibration interval, etc.

[0071] The retrieved information items can be used to obtain, for example, a summary file associated with the current measurement system or the current combination of measurement system components. In this example, the retrieved information items of each of the measurement system components are automatically combined into a data set represented by actual summary data that is stored, for example, in a summary file.

[0072] At step 202, the method proceeds with automatically reading reference summary data from at least one local storage device of the measurement system, the reference summary data being represented, for example, by a reference summary file and a signature, and the signature being represented, for example, by a signature file associated with the reference summary data, for example associated with the reference summary file. However, the reference summary data and the associated signature may also be obtained from a single file in which both data items are included.

[0073] The reference summary data and the signature may be generated, for example, by the steps of the method 100 shown in FIG. 1 and stored in at least one local storage device.

[0074] The method proceeds in step 203 with comparing the current summary data based on the retrieved information items, or at least a number of information items of the current summary data, with the reference summary data, or at least a number of information items of the reference summary data. The number of information items of the current summary data selected for comparison may include, for example, information items necessary to uniquely identify the measurement system part, and characteristics of the measurement system part that must remain unchanged (e.g. calibration date to ensure that no unauthorized calibration has been performed by an (untrusted) third party). The comparison is performed, for example, to obtain part identity information as intermediate information. If the retrieved information items are combined into a data set, such as a summary file, a comparison of the summary file with the reference summary file is performed in step 203.

[0075] The method uses the signature to verify the authenticity of the reference summary data, e.g., by signature checking, in step 204. The signature check can be performed, e.g., using the OpenSSL toolkit, e.g., using a public key that corresponds to the private key used to generate the signature. This verification step is performed, e.g., to obtain signature check information as intermediate information.

[0076] Steps 203 and 204 are performed to obtain measurement system integrity information, for example based on the part identity information and the signature check information. The measurement system integrity information indicates whether any of the measurement system parts have been replaced and / or their parameters have changed since the last use of the measurement system or after manufacture (or assembly) and calibration by the manufacturer. The measurement system integrity information can be further reported to the user of the measurement system or the manufacturer of the measurement system (e.g., using a user interface or an electronic message) in step 205. The measurement system integrity information can also be used as a trigger to further shut down the measurement system in order to prevent further use of the measurement system whose integrity has been altered.

[0077] However, it should be noted that the method 200 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0078] FIG. 3 illustrates a method 300 for determining whether a measurement system having multiple measurement components is being used in a legitimate manner, according to one embodiment of the present invention.

[0079] The method according to this embodiment considers not only the integrity of the measurement system but also the (relevant) environmental conditions in which the measurement system is used in order to determine whether the measurement system can be legitimately used without erroneous measurement results due to, for example, calibration errors and / or environmental influences (e.g. environmental humidity or temperature). In this embodiment, unknown influences of environmental conditions on the measurement results are avoided.

[0080] The method starts in step 301 with reading out a number of information items, e.g., uniquely identifying the measurement system component and / or describing one or more characteristics of the measurement system component. A reading mechanism can be provided in the measurement system itself to perform an automatic reading step. Alternatively, an external reading device can be used to automatically read and collect all the information items. The information items identifying the measurement system component can include, e.g., a type identifier and a serial number of each component. The information items describing one or more characteristics of the measurement system component can include, e.g., software revision date, software version, calibration date, calibration interval, etc.

[0081] At step 302, the method proceeds with automatically acquiring information about current operating environmental conditions of the measurement system. This information can be acquired, for example, by measuring the environmental conditions using a measurement device that is part of the measurement system, such as a temperature sensor, a humidity sensor, or an electromagnetic radiation sensor. Thus, information about various current operating environmental conditions can be received, such as temperature information, and / or humidity information, and / or electromagnetic interference information.

[0082] In step 303, the method proceeds with reading a reference information item, e.g. uniquely identifying the measurement system component and / or describing one or more characteristics of the measurement system component, and information on reference operating environmental conditions. The reference operating environmental conditions can be determined, e.g. by a manufacturer of the measurement system or of separate components of the measurement system, based on possible influences of the environmental conditions. The reference operating environmental conditions can be defined, e.g. as tolerance values ​​of temperature or electromagnetic radiation or humidity, but in most cases as tolerance ranges of these parameters. The tolerance ranges are ranges within which the measurement system operates without unexpected errors or large variations in the measurement results. Thus, the information on the reference operating environmental conditions can comprise, e.g., information describing a minimum and a maximum allowable temperature (e.g. in the form of minimum and maximum values ​​or in the form of target and tolerance values).

[0083] The method proceeds in step 304 with comparing the retrieved information item, which e.g. uniquely identifies the measurement system component and / or represents one or more characteristics of the measurement system component, with a reference information item, which e.g. uniquely identifies the measurement system component and / or represents one or more characteristics of the measurement system component.

[0084] In step 305, the method checks whether the current operating environmental condition with the tolerance value is within a tolerance range defined by information about the reference operating environmental condition.

[0085] Steps 304 and 305 are performed to determine whether a measurement system comprising a plurality of measurement system components is used in a legitimate manner. The result of the determination can be reported to a user, for example by means of a user interface. Alternatively, the result of the determination can be reported by means of an electronic message. In response to the determination that the measurement system is used in an unauthorized manner, a shutdown of the measurement system, for example automatically, can be performed.

[0086] A certificate regarding the correct state of the measurement system can be issued at the end of the method if it is determined that the measurement system is being used in a correct state. The certificate can further include the current state and current operating environmental conditions of the measurement system along with the date and time of execution of the method.

[0087] However, it should be noted that the method 200 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0088] FIG. 4 illustrates a method 400 for assisting in determining whether a measurement system having multiple measurement components is being used in a legitimate manner, according to one embodiment of the present invention.

[0089] The method starts in step 401 with reading out a number of information items, e.g., uniquely identifying the measurement system component and / or describing one or more characteristics of the measurement system component. A reading mechanism can be provided in the measurement system itself to perform an automatic reading step. Alternatively, an external reading device can be used to automatically read and collect all the information items. The information items identifying the measurement system component can include, e.g., a type identifier and a serial number of each component. The information items describing one or more characteristics of the measurement system component can include, e.g., software revision date, software version, calibration date, calibration interval, etc.

[0090] At step 402, the method proceeds with obtaining information regarding acceptable operating environmental conditions for the measurement system. Obtaining may include, for example, retrieving from a user interface or from a memory associated with the measurement system components, and may include, for example, collecting, or, for example, automatically obtaining. The acceptable operating environmental conditions may include, for example, an acceptable temperature range and / or an acceptable humidity range and / or an acceptable maximum electromagnetic interference. The acceptable operating environmental conditions may, for example, correspond to (e.g., match or be within a certain interval in the vicinity of) the environmental conditions used to calibrate the measurement system (e.g., by the manufacturer or by a trusted entity) or may deviate within an acceptable tolerance range from the environmental conditions used to calibrate the measurement system.

[0091] The information about the permissible operating environmental conditions may be signed, for example a signature may be generated and stored in at least one local storage device of the measurement system, for example the procedure for generating a signature described with reference to FIG.

[0092] The method concludes in step 403 by storing an item of information identifying and / or representative of one or more characteristics of the measurement system component and information regarding permitted operating environmental conditions for use in determining whether a measurement system including multiple measurement system components is being used in a legitimate manner.

[0093] The stored information can further be used as reference information when performing the method illustrated in FIG.

[0094] However, it should be noted that the method 400 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in any combination.

[0095] Figure 5 shows an embodiment in which a measurement system (e.g., the measurement system described above in the discussion of the methods of Figures 1 to 4) is used as a calibration instrument for the calibration of manufacturing equipment. As shown in Figure 5, the calibration instrument 500 is, for example, calibrated at the manufacturer's site (or, in general, at the trusted entity's site) and delivered to a user, who is at the same time, for example, a user of automatic test equipment 501 previously purchased (or rented) from the manufacturer.

[0096] Reference information items defining the calibration device 500 and the permissible operating environmental conditions (e.g. determined using the method according to FIG. 1 or according to FIG. 4) are stored (e.g. by the manufacturer or another trusted entity) in a local storage 502, e.g. a memory, of the calibration device 500. Additionally, the reference information items and the permissible operating environmental conditions are optionally stored on the manufacturer's remote server 503, e.g. in the cloud, for use as a backup in case the local storage 502 fails or does not function properly.

[0097] When a user uses the calibration equipment 500 to calibrate an automatic test equipment 501, the correct state of the calibration equipment 500 is checked at the calibration equipment 500. This check may be performed using the method 200 according to Fig. 2 or using the method according to Fig. 3. Alternatively, however, the check may use a combination of the methods of Fig. 2 and Fig. 3, and the method according to Fig. 2 may be supplemented by a check of the environmental operating conditions according to the method of Fig. 3. If it is verified (e.g. in the check steps 203 and 204 of the method of Fig. 2, in the check steps 304 and 305 of the method of Fig. 3) that the calibration equipment 500 is used in a correct state, a certification confirmation (or an electronic message, or a message on the user interface) that the calibration equipment 500 is used in a correct state can be issued by the calibration equipment 500 itself or by the manufacturer, based on the result of the determination of whether the calibration equipment 500 is valid, which result is provided by the calibration equipment 500 to the manufacturer.

[0098] For example, this method a) Whether the automated test equipment is calibrated using a measurement system within the prescribed required intervals (e.g., once per specified period, or once per specified number of tests, or in accordance with any other required rules); and b) When calibrating automated test equipment, it comprises checking whether the measurement system is "in order" (i.e., unchanged compared to a reference condition and / or operating at acceptable environmental operating conditions).

[0099] From such checks, it can be concluded that the automated test equipment can be trusted when testing one or more devices under test. Thus, the certification confirmation (which may be provided, for example, in electronic or printed form, or in any other suitable form) may indicate, for example, the reliability of the automated test equipment at a particular point in time, or when testing a particular batch of devices under test.

[0100] However, it should be noted that the system of FIG. 5 may be optionally supplemented with any of the features, functions and details disclosed herein, either individually or in any combination.

[0101] Figure 6 shows a procedure for generating a signature for use, for example, as a step in the method shown in Figure 1 (and / or, optionally, in the method shown in Figure 4). A data file (e.g. a summary file containing summary data) and a private key (e.g. a confidential private key) are used to generate a signature based on the summary data. The data file is then signed with the generated signature to protect its contents (e.g. in the sense that the signature can be used to check the authenticity and / or integrity of the data file). The signature is stored in the signature file. The signature and signed data can also be stored in one file (not shown).

[0102] This signature (or signature) is used, for example, to prohibit data in a data file, e.g., summary data and / or information describing permitted operating environmental conditions, from being altered without the alteration being detected. After the signature (or signature file) and the signed data file are stored, the signature (or signature file), e.g., the signature stored in the signature file, can be used to verify the authenticity and / or integrity of the stored data file, e.g., to check whether the data file and / or the signature file have been altered, as described below in FIG.

[0103] In conclusion, the signature process according to FIG. 6 may optionally be used in any of the methods and apparatus disclosed herein to enable verification of the authenticity and / or completeness of, for example, the summary file and / or information regarding permissible operating environmental conditions.

[0104] However, it should be noted that the method of FIG. 6 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0105] Figure 7 shows a procedure for verifying the authenticity of a data file, e.g., including reference summary data and / or information about permitted environmental operating conditions, used to check the integrity of a measurement system, e.g., in the method shown in Figure 2. The procedure of Figure 7 may optionally be used in the method of Figure 3 to check the authenticity and completeness of the information about permitted environmental operating conditions.

[0106] As shown in Figure 7, the integrity of the data file and the signature file are verified, and it is checked whether the signed data and / or the signature on that data has been modified since it was signed (or since it was signed). To check this integrity, a signature check is performed using the OpenSSL Toolkit (or any other signature checking method) using the stored data file, the signature file and a public key (associated with the person or entity that generates the signature using its private key). The public key corresponds to the private key used in the signature (or signatures), as shown in Figure 6.

[0107] If the signature check is successful, e.g. a passing result of the signature check is provided (or received), a report of the data not being altered (and / or authenticity, i.e. generated by a trusted entity) is provided to the measurement system or other entity requesting the signature check to be performed. If the signature check is unsuccessful, e.g. a failing result of the signature check is received, a report of the data being altered is provided to the measurement system or other entity requesting the signature check. Based on the report on the signature check result, measurement system integrity information is provided (or received), e.g. in the manner shown in FIG. 2.

[0108] However, it should be noted that the method of FIG. 7 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0109] FIG. 8 shows a procedure that allows automatic retrieval of measurement system component specific information items that identify measurement system components that do not have a built-in function to report information items for identifying each measurement system component. Measurement system components that do not have a built-in function to report information items for identifying each measurement system component are so-called "manual devices", e.g. old measurement equipment, e.g. passive components such as cables, relays, power distributors, antennas, shielding devices or shielding boxes. As shown in FIG. 8, a "manual" measurement system component 801 is coupled, e.g. inseparably coupled, to a local storage device 802. Inseparably coupled can be coupled in such a way that it cannot be separated from the local storage device 802 in a tool-less manner, in a non-destructive manner, in a manner that does not break the seal, etc. The component 801 can also be glued, or welded, or riveted, or crimped, or molded to the local storage device 802. The component 801 can also be placed together with the local storage device 802 in a separate enclosure, such as a box, or under a separate cover. The local storage device 802 can be any storage device, such as a USB storage device, a network attached storage device, an RFID tag, a wired LAN storage device, a wireless LAN storage device, etc. This list of storage devices is non-exclusive and any local storage device can be used.

[0110] As further shown in Fig. 8, one or more or all information items uniquely identifying the "manual" part, such as a serial number or a type identifier, and / or information items representative of one or more properties of the "manual" part, such as software revision or calibration date or calibration interval, and any other data characterizing the "manual" device, such as the calibration interval, are written (e.g. manually) to a summary file. The content of the summary file is then signed, e.g. with a private key, to protect the data stored in the summary file against modification (e.g. using the signing method described herein). The signing (or signature) procedure is, for example, the same as that shown in Fig. 6. The generated signature file and the signed signature file (or a combined file comprising the summary and the signature) are stored in a local storage device 802 associated with the "manual" device 801.

[0111] Thus, a measurement system component specific information item identifying a "manual" measurement system component can be automatically retrieved when performing any of the methods shown in Figures 1-4, as well as other methods described herein.

[0112] In conclusion, the method of Figure 8 may be used to obtain information about "passive" components (e.g., to check whether any passive components have been replaced) that may be used in other methods disclosed herein. In other words, by providing one or more passive components with corresponding memory (e.g., in an inseparable manner), the passive components can be monitored in a similar manner as any active components (which are originally configured to read out unique identification information).

[0113] However, it should be noted that the method of FIG. 8 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0114] FIG. 9 shows a schematic diagram of a measurement system comprising a number of measurement system components and a method for protecting the measurement system against tampering according to an embodiment of the present invention.

[0115] The measurement system 901 comprises a number of components A to X configured to measure various parameters of the manufacturing equipment, such as voltage, resistance and frequency (e.g. when performing a calibration of the automatic test equipment). Some components are also configured to measure environmental conditions, such as temperature or humidity, e.g. device X in FIG. 9. For example, there may be one or more components for measuring the temperature of the automatic test equipment or the temperature of the environment of the automatic test equipment, and there may be one or more components for measuring the temperature (or any other environmental parameter) of the measurement system itself (or of one or more components of the measurement system itself). The measurement system 901 further comprises a local storage device 902 for storing data relating to the measurement system components. The measurement system components coupled together form a service box provided by the manufacturer to a user and used for measurement purposes, such as calibration (e.g. of the automatic test equipment).

[0116] Measurement system parts are bound together by automatically storing their unique data in a summary file. All unique data such as serial number, device type, software revision, calibration date, calibration interval for each of the measurement system parts is collected in a data set 903. Some data about the parts, e.g., calibration interval, or data about the bound entity (service box), e.g., service box serial number, service box calibration date, or service box software revision, can be added manually to the data set, for example.

[0117] The data set is then stored as a summary file 904 in the local storage 902 of the measurement system 901. To prohibit modification of the data stored in the summary file 904, its contents are signed by a signature generation procedure, for example the one shown in Figure 6. This signature file 905 is also stored in the local storage 902 of the measurement system 901. Alternatively, the data summary and the signature may be stored in a single file.

[0118] The measurement system 901 is therefore protected against unauthorized modifications and its integrity can be checked by a user during operation.

[0119] However, it should be noted that the method of FIG. 9 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0120] Figure 10 shows a procedure for checking the integrity of a measurement system 901, e.g. a so-called service box as shown in Figure 9. Data regarding multiple parameters of the measurement system components, serial numbers, type of components, software revisions, calibration dates, calibration intervals, etc. are read (e.g. from memories individually associated with each measurement system component) and collected in a data set 1003. The data is read automatically for components that have a built-in capability to report items of information for identifying the component.

[0121] The data set 1003 is obtained as a result of the automatic combination of retrieved data and is represented by a summary file 1004 that represents the current combination of the measurement system 901 .

[0122] The summary file 904 and the signature file 905 stored in the local storage 902 of the measurement system 901 are read from the local storage. The summary file 1004 representing the current binding of the measurement system 901 is compared with the reference summary file 904 and an identity check 910 is performed. If the identity check is not successful, i.e. if the current summary file 1004 does not match the reference summary file 904, a report 950 is issued indicating that the state or measurement setup of the measurement system has changed and that the measurement system is not in a valid state for operation by the user.

[0123] Apart from the identity check 910, a signature check 920 is performed to check whether the summary file 904 matches the signature file 905. This check indicates whether the stored summary file and signature file have been modified since they were stored in the local storage 902 by the manufacturer of the measurement system 910. If the signature check 920 is not successful, i.e. if the summary file 904 does not match the signature file 905, a report 960 is issued indicating that the state or measurement setup of the measurement system has been changed and that the measurement system is not in a valid state for operation by the user.

[0124] If both the identity check 910 and the signature check 920 result in a positive outcome, a report 940 is issued indicating that the state of the measurement system or the measurement setup has not been altered and that the measurement system is in a valid state for operation by the user.

[0125] However, it should be noted that the method of FIG. 10 may be optionally supplemented by any of the features, functions and details disclosed herein, either individually or in combination.

[0126] Further embodiments and aspects

[0127] Further aspects and embodiments of the present invention are described below, which can be used individually or in combination with any other embodiment disclosed herein.

[0128] Furthermore, the embodiments disclosed in this section may be optionally supplemented, individually or in combination, with any other features, functions and details disclosed herein.

[0129] Measurement rack integrity

[0130] Objective of the invention

[0131] Below, several objects of the present invention will be described, which may be achieved in some or all of the embodiments.

[0132] Embodiments according to the present invention allow for assurance of the integrity of a measurement device, e.g., for assurance that a measurement device (e.g., a measurement system as disclosed herein) accurately measures what it is supposed to measure.

[0133] Embodiments of the present invention may be configured to check (or ensure) one or more of the following conditions (e.g., when operating the measurement system): -The correct environmental conditions (e.g. temperature, humidity) -Electromagnetic protection (e.g. the presence and / or status of electromagnetic protection) - Track and check warm-up time -Tracking and checking wear status (e.g. relays) -Equipment traceability

[0134] According to one aspect of the invention, the measurement equipment (eg, parts of the measurement system) used is identifiable (eg, serial number, unique identifier).

[0135] According to one aspect of the invention, there is the ability to (e.g. automatically) check the calibration date of the measurement equipment used, for example to ensure that the calibration status of the measurement equipment has not been altered since the status was recorded by an authorized entity. For example, it may be checked that there has been no recalibration by an unauthorized or untrusted entity.

[0136] Target users and business model

[0137] According to certain aspects, the intended users of the concepts disclosed herein may be engineers and technicians who need to operate reliable measurement equipment.

[0138] According to certain aspects, embodiments of the present invention enable business models that are based on (or that provide the following advantages): -More efficient, faster turnaround and more cost-effective solution. No manual checks for completeness required. -Mitigating the risk of quality issues that can have a significant cost impact in quality-sensitive industries.

[0139] Conventional Solutions and Problems - Improvements Achieved by Embodiments

[0140] Traditionally, manual checking of boundary conditions required for reliable measurements is error-prone: -Manual check of coherence measurement system -Manual check of the calibration status of the measurement device used, manual pairing of the calibration data and the measurement device -Manual check of environmental conditions

[0141] Traditionally, the problem arises from the unknown effects of electromagnetic influences.

[0142] Furthermore, problems are traditionally caused by incomplete traceability documentation of the measuring equipment used.

[0143] Conventionally, checking the wear state has not been common.

[0144] According to certain aspects of the invention, embodiments in accordance with the present invention are configured to overcome one or more of these shortcomings.

[0145] For example, embodiments according to the present invention are (optionally) adapted to perform an automatic check of the coherence measurement system.

[0146] As another example, embodiments of the present invention are adapted to (optionally) perform automatic checking of the calibration status of the measurement device being used, calibration data and manual pairing of the measurement device.

[0147] As another example, embodiments according to the present invention are adapted to automatically check environmental conditions.

[0148] As another example, embodiments according to the present invention are adapted to recognize problems caused by the unknown behavior of electromagnetic influences.

[0149] As another example, embodiments of the present invention are adapted to enable good or complete traceability documentation of the measurement equipment used.

[0150] As another example, embodiments of the present invention are adapted to perform wear status checks automatically.

[0151] Description of some (optional) aspects and ideas of the present invention

[0152] Below, aspects, ideas, features, functions and details are described which may optionally be implemented individually and in any combination in any of the embodiments disclosed herein.

[0153] However, the aspects described below may be arranged to form self-consistent embodiments.

[0154] Some embodiments of the present invention create a collection of measurement equipment including data storage integrated into a higher level unit where proper operating conditions of the measurement system are automatically ensured.

[0155] An embodiment of the present invention is (or comprises) an automated check to ensure the integrity of a measurement system. According to aspects of the present invention, one or more of the following features, functions or checks may be implemented in an embodiment of the present invention: -Optional automatic tracking of relevant environmental conditions (e.g. humidity, temperature, electromagnetic radiation) using sensors or other measurement systems - Environmental conditions adapted to the equipment (e.g. measurement system components) (optional) - Combining equipment (e.g. measurement system components) and calibration data (optional) -The equipment (e.g. measurement system parts) is in good condition (e.g. calibrated) (optional) - Checking the wear condition of components of the measuring system (e.g. relays) (optional) - Measuring equipment (e.g. measurement system components) that cannot be automatically tracked by themselves (e.g. passive measurement system components that do not have a built-in capability for reporting information items) are inseparably connected to a higher-level unit (e.g. active measurement system components, which may have the capability for reporting information items that uniquely identify them) and are thereby automatically tracked (optional).

[0156] Embodiments of the present invention may optionally provide for automatic generation of certificates for measurements performed (e.g., performed by a measurement system for calibration of automatic test equipment). According to aspects of the present invention, one or more of the following advantages, features, functions or checks may be performed: -Traceability of the measuring equipment used: serial numbers or unique identifiers of the measuring systems used are known. - Validating data before generating certificate

[0157] Optionally, embodiments of the present invention provide protection against external corruption. According to aspects of the present invention, one or more of the following features, functions or checks may be implemented in embodiments of the present invention: -The data is encrypted -Check if the system is swapped -Mechanical sealing of the measurement system and data storage to prevent unauthorized access

[0158] Completeness of the measurement setup

[0159] According to certain aspects, embodiments of the present invention are adapted to ensure the integrity of a measurement setup (eg, a measurement system).

[0160] In the following it is described how the integrity of the measurement setup can be ensured.

[0161] How to prevent data from being modified?

[0162] In the following it is described how modifications of data can be prohibited.

[0163] To prohibit data in, for example, a data file from being altered without the alteration being detected, its contents can be signed. The resulting signature may be stored in a signature file. The signature file and / or the data file can then not be altered without being detected.

[0164] As an example of signing (or signatures), note that OpenSSL offers the option to sign any data with a signature. Thus, a (secret!) private key is used. An example of this procedure is shown in Figure 6.

[0165] This concept of prohibiting data from being modified may optionally be used in any of the embodiments disclosed herein, for example to protect summary files (which may take the place of data files) and / or to protect information about permissible environmental operating conditions (which may in this case take the place of data files), or to protect combined information (e.g. comprising summary file information and information about permissible environmental operating conditions).

[0166] How do you check that the data has changed?

[0167] Below we describe how to check whether data has been modified (and / or whether the data is authentic, e.g., in that it originates from a trusted entity).

[0168] The integrity of the corresponding data file and signature file may need to be verified to check whether the signed data and / or the signature on that data has been altered since it was signed (or signed).

[0169] Below is an example for checking a signature: Open SSL offers the option to check whether the signed data matches the corresponding signature, therefore a public key is needed, which corresponds to the private key used in the signature.

[0170] An example of this procedure is shown in FIG.

[0171] This concept for checking whether data has been changed (and / or is authentic) may optionally be used in any of the embodiments disclosed herein, for example to check whether a summary file (which may stand in for a data file) has been changed, and / or to check whether information about permissible environmental operating conditions (which may stand in for a data file in this case) has been changed, or to check whether combined information (e.g. comprising summary file information and information about permissible environmental operating conditions) has been changed.

[0172] How to make a "manual" device uniquely identify itself

[0173] Below, we describe how a "manual" device can be made to uniquely identify itself (e.g., a device or measurement system that does not initially have the ability to electronically read information that uniquely identifies the device or measurement system equipment).

[0174] "Manual" devices (eg old measuring equipment, cables, relays) may for example be inseparably coupled to a local storage device with a communication interface.

[0175] Some or all of the unique data for this device (eg, SN or serial number, and / or calibration date) and other data (eg, calibration interval) may be manually written to the summary file, for example.

[0176] Optionally, this data may be signed to prevent modification, so that the signature file and / or summary file cannot be altered undetected.

[0177] An example of a procedure is shown in FIG.

[0178] Every device can uniquely identify itself

[0179] In the following, a procedure according to one aspect of the present invention is described.

[0180] For example, it may be assumed that all devices (e.g., all measurement system components) uniquely identify themselves (e.g., using built-in functionality that can read information that uniquely identifies the device, or using concepts described in the section "How to make a "manual" device that uniquely identifies itself", see e.g., Figure 8).

[0181] According to one aspect of the present invention, devices (eg, measurement system components) can be linked together (eg, logically) by automatically storing their unique data in a summary file (eg, a data file).

[0182] Other data about the device (or about multiple devices) (e.g. calibration interval) or about the associated entity - here the service box (or measurement system) (e.g. SN or serial number) may, for example, be added manually (or automatically) to the summary file.

[0183] Optionally, this data may be signed to prevent modification, so that the signature file and / or summary file cannot be altered without detection.

[0184] An example of this procedure is shown in FIG.

[0185] It is further noted that this procedure may be used as described in this section and may optionally be supplemented with any of the features, functions and details disclosed herein (this entire document), either individually or in combination.

[0186] Checking the measurement setup integrity

[0187] In the following, a procedure according to one aspect of the present invention is described.

[0188] To check that the measurement setup (e.g. the measurement system) has not been changed, a summary file (e.g. information describing the actual coupling of the measurement system parts at the time of the check) for the current coupling of the device may be collected, which must match an automatically generated part of the summary file (or a reference summary file) (e.g. information items of the summary file or of the reference summary file that have not been added manually but are automatically readable from a memory of the measurement system parts or a memory attached to the measurement system parts) (which may for example have been generated at an earlier time, e.g. when the measurement system has been assembled or checked or calibrated by a trusted person).

[0189] Additionally, a match of the summary file and the signature file is required, otherwise the measurement setup has changed since the last signature.

[0190] For example, if a mismatch is found (e.g., between the summary file for the device's current binding and the automatically generated portion of the reference summary file, or between the reference summary file and the signature file), a message may be provided indicating that the measurement system is in an invalid state.

[0191] An example of this procedure is shown in FIG.

[0192] It is further noted that this procedure may be used as described in this section and may optionally be supplemented with any of the features, functions and details disclosed herein (this entire document), either individually or in combination.

[0193] Alternative implementation examples

[0194] Although some aspects are described in the context of an apparatus, it will be apparent that these aspects also represent a description of a corresponding method, where a block or device corresponds to a method step or feature of a method step. Similarly, aspects described in the context of a method step also represent a description of a corresponding block or item or function of a corresponding apparatus. Some or all of the method steps may be performed by (or using) a hardware apparatus, such as, for example, a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, one or more of the most important method steps may be performed by such an apparatus.

[0195] Depending on the specific implementation requirements, the embodiments of the present invention can be implemented in hardware or software. The implementation can be performed using a digital storage medium having electronically readable stored control signals, such as a floppy disk, DVD, Blu-ray, CD, ROM, PROM, EPROM, EEPROM or flash memory, which cooperates (or has the ability to cooperate) with a programmable computer system such that the respective methods are executed. Thus, the digital storage medium may be computer readable.

[0196] Some embodiments of the present invention comprise a data carrier having electronically readable control signals capable of cooperating with a programmable computer system to cause one of the methods described herein to be performed.

[0197] Generally, embodiments of the present invention may be implemented as a computer program product having program code which operates to perform one of the methods when the computer program product is run on a computer. The program code may for example be stored on a machine readable carrier.

[0198] Other embodiments comprise the computer program for performing one of the methods described herein, stored on a machine readable carrier.

[0199] In other words, an embodiment of the inventive method is, therefore, a computer program having a program code for performing one of the methods described herein, when the computer program runs on a computer.

[0200] A further embodiment of the inventive method is therefore a data carrier (or digital storage medium, or computer readable medium) having recorded thereon a computer program for performing one of the methods described herein. The data carrier, digital storage medium, or recording medium is typically tangible and / or non-transitory.

[0201] A further embodiment of the inventive method is therefore a data stream or a sequence of signals representing the computer program for performing one of the methods described herein, the data stream or the sequence of signals may be adapted to be transferred via a data communication connection, for example via the Internet.

[0202] A further embodiment comprises a processing means, for example a computer, or a programmable logic device, configured to or adapted to perform one of the methods described herein.

[0203] A further embodiment comprises a computer having installed thereon the computer program for performing one of the methods described herein.

[0204] Further embodiments of the invention comprise an apparatus or system configured to transfer (e.g. electronically or optically) a computer program for performing one of the methods described herein to a receiving device. The receiving device may for example be a computer, a mobile device, a memory device, etc. The apparatus or system may for example comprise a file server for transferring the computer program to the receiving device.

[0205] In some embodiments, a programmable logic device (e.g., a field programmable gate array) may be used to perform some or all of the functions of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor to perform one of the methods described herein. In general, the methods are preferably performed by any hardware apparatus.

[0206] The apparatus described herein may be implemented using a hardware apparatus, or using a computer, or using a combination of a hardware apparatus and a computer.

[0207] The apparatus described herein, or any parts (components) of the apparatus described herein, may be implemented at least in part by hardware and / or software.

[0208] The methods described herein may be performed using a hardware apparatus, or using a computer, or using a combination of a hardware apparatus and a computer.

[0209] The methods described herein, or any parts (components) of the apparatus described herein, may be at least partially performed by hardware and / or software.

[0210] The embodiments described herein are merely illustrative of the principles of the present invention. It will be understood that improvements and modifications of the configurations and details described herein will be apparent to those skilled in the art. It is therefore intended to be limited only by the scope of the claims below, and not by the specific details presented in the description and embodiment description herein.

Claims

1. 1. A method for protecting a measurement system having a plurality of measurement system components and at least one local storage device from tampering, the method comprising: automatically retrieving, for each of the plurality of measurement system components, one or more items of information identifying each measurement system component and / or representative of one or more characteristics of each measurement system component; automatically combining a plurality of the one or more items of information corresponding to the plurality of measurement system components read for the plurality of measurement system components into a data set represented by summary data; generating a signature based on the summary data; storing the summary data and the signature in the at least one local storage device of the measurement system.

2. The method of claim 1 , wherein creating the signature comprises signing the summary data with a private key.

3. The method of claim 2 , wherein the private key is a confidential private key.

4. the summary data and the signature are stored in two separate files, or The method of claim 1 , wherein the summary data and the signature are stored in a single file.

5. 5. A method according to any one of claims 1 to 4, wherein one or more of the measurement system components that do not have a built-in capability of reporting an information item for identifying each measurement system component are coupled with an associated local storage device for enabling automatic retrieval of a measurement system component specific information item that identifies a measurement system component that does not have a built-in capability of reporting an information item for identifying each measurement system component.

6. 6. The method of claim 5, further comprising coupling the measurement system components that do not have a built-in capability for reporting an item of information for identifying each measurement system component with the associated local storage device prior to automatically retrieving the item of information for identifying each measurement system component.

7. 7. The method of claim 5 or 6, wherein the measurement system components that do not have a built-in capability to report an item of information for identifying each measurement system component are inseparably coupled to an associated local storage device.

8. A measurement system component that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device in a tool-free manner, or A measurement system component that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is coupled to each associated local storage device in such a manner that said measurement system component cannot be separated from each associated local storage device in a non-destructive manner, or 8. A method according to claim 5, wherein a measurement system component that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device without breaking the seal.

9. 9. A method according to claim 5, wherein at least one of the measurement system components that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is attached to a respective one of said local storage devices.

10. 10. The method of claim 5, wherein at least one of the measurement system components that does not have a built-in capability of reporting an item of information for identifying each measurement system component is located in a separate housing together with each one of the local storage devices.

11. 11. The method of any one of claims 5 to 10, wherein one or more of each local storage device is one of a USB storage device, a network attached storage device, a wired LAN device, and an RFID tag.

12. 12. A method according to any one of claims 5 to 11, wherein one or more measurement system components that do not have a built-in capability of reporting an item of information for identifying the respective measurement system component comprise one or more measurement devices.

13. 13. A method according to any one of claims 5 to 12, wherein the one or more measurement system components that do not have a built-in capability to report an item of information for identifying the respective measurement system component comprise one or more passive measurement system components.

14. 14. The method of claim 5, wherein the one or more measurement system components that do not have built-in functionality for reporting an item of information to identify each measurement system component comprise one or more of the following measurement system components: signal path components, coupling components, couplers, adapters, and cables.

15. 15. The method of any one of claims 5 to 14, wherein the one or more measurement system components that do not have a built-in capability to report an item of information to identify each measurement system component comprise one or more of the following measurement system components: thermodynamic components, fixed power components, antennas, shielded housing components, and cooling components.

16. The method includes automatically retrieving an item of information identifying one or more measurement system components that do not have built-in functionality for reporting an item of information for identifying each measurement system component from each local storage device associated with the one or more measurement system components that do not have built-in functionality for reporting an item of information for identifying each measurement system component; 16. The method according to claim 5, further comprising automatically including in the data set the retrieved information items of one or more measurement system components that do not have a built-in function for reporting information items for identifying each measurement system component.

17. The method of claim 1 , wherein the one or more characteristics of the measurement system component comprise at least one wear state of the measurement system component.

18. 18. The method of claim 17, wherein the item of information identifying the wear status is a value of a counter located in each measurement system component, the counter being incremented by one for each use of the measurement system component.

19. 20. The method of claim 17, further comprising performing a self-assessment of each measurement system component to determine the wear state of each component.

20. obtaining information regarding allowable operating environmental conditions of the measurement system; 20. The method of claim 1, further comprising storing information about the permissible operating environmental conditions in the at least one local storage device of the measurement system.

21. The method of claim 20 , wherein the information regarding the permissible operating environmental conditions comprises information regarding humidity and / or temperature and / or electromagnetic interference.

22. 1. A method for checking the integrity of a measurement system having a plurality of measurement system components and at least one local storage device, comprising: automatically retrieving, for each of the plurality of measurement system components, one or more items of information identifying each measurement system component and / or representative of one or more characteristics of each measurement system component; automatically retrieving reference summary data and a signature associated with the reference summary data from the at least one local storage device of the measurement system; comparing current summary data combining a plurality of said one or more items of information corresponding to said plurality of measurement system components read for said plurality of measurement system components, or at least two or more items of information of said current summary data, with said reference summary data, or at least two or more items of information of said reference summary data; and verifying authenticity of the reference summary data using the signature to obtain measurement system integrity information.

23. 23. The method of claim 22, further comprising reporting the measurement system integrity information.

24. 24. The method of any one of claims 22 to 23, further comprising automatically shutting down the measurement system if the measurement system integrity information includes information about an imperfection condition of the measurement system.

25. 25. The method of any one of claims 22 to 24, wherein the measurement system is a calibration instrument configured to calibrate manufacturing equipment.

26. 26. The method of claim 25, wherein the method comprises selectively verifying a calibration of the manufacturing equipment performed using the measurement system in dependence on the measurement system integrity information.

27. 27. The method of any one of claims 22 to 26, further comprising, in response to finding that the measurement system used to calibrate a manufacturing machine has not been altered compared to a reference condition, obtaining a certificate confirming that the manufacturing machine has been properly calibrated.

28. The method of claim 27 , wherein obtaining the certificate is performed by the measurement system and / or by a remote server.

29. 29. The method of any one of claims 22 to 28, further comprising automatically transmitting the measurement system integrity information to a remote server.

30. 30. A method according to any one of claims 22 to 29, wherein one or more of the measurement system components that do not have a built-in capability for reporting an information item for identifying the respective measurement system component are coupled with an associated local storage device for enabling automatic retrieval of a measurement system component specific information item that identifies the measurement system component that does not have a built-in capability for reporting an information item for identifying the respective measurement system component.

31. 31. The method of claim 30, further comprising coupling the measurement system components that do not have a built-in capability for reporting an item of information for identifying each measurement system component with the associated local storage device prior to automatically retrieving the item of information for identifying each measurement system component.

32. 32. The method of claim 30 or 31, wherein the measurement system components that do not have a built-in capability to report an item of information for identifying each measurement system component are inseparably coupled to an associated local storage device.

33. A measurement system component that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device in a tool-free manner, or A measurement system component that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is coupled to each associated local storage device in such a manner that said measurement system component cannot be separated from each associated local storage device in a non-destructive manner, or 33. A method according to any one of claims 30 to 32, wherein a measurement system component that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is coupled to each associated local storage device in such a manner that the measurement system component cannot be separated from each associated local storage device without breaking the seal.

34. 34. A method according to any one of claims 30 to 33, wherein at least one of the measurement system components that does not have a built-in capability of reporting an item of information for identifying the respective measurement system component is attached to a respective one of said local storage devices.

35. 35. A method according to any one of claims 30 to 34, wherein at least one of the measurement system components that does not have a built-in capability of reporting an item of information for identifying each measurement system component is located in a separate housing together with each one of the local storage devices.

36. 36. A method according to any one of claims 30 to 35, wherein one or more of each local storage device is one of a USB storage device, a network attached storage device, a wired LAN device, and an RFID tag.

37. 37. A method according to any one of claims 30 to 36, wherein one or more measurement system components that do not have built-in functionality for reporting an item of information for identifying each measurement system component comprise one or more measurement devices.

38. 38. A method according to any one of claims 30 to 37, wherein the one or more measurement system components that do not have a built-in capability for reporting an item of information for identifying each measurement system component comprise one or more passive measurement system components.

39. 39. The method of any one of claims 30 to 38, wherein the one or more measurement system components that do not have built-in functionality for reporting an item of information to identify each measurement system component comprise one or more of the following measurement system components: signal path components, coupling components, couplers, adapters, and cables.

40. 40. The method of any one of claims 30 to 39, wherein the one or more measurement system components that do not have a built-in capability to report an item of information to identify each measurement system component comprise one or more of the following measurement system components: thermodynamic components, fixed power components, antennas, shielded housing components, and cooling components.

41. The method includes automatically retrieving an item of information identifying one or more measurement system components that do not have built-in functionality for reporting an item of information for identifying each measurement system component from each local storage device associated with the one or more measurement system components that do not have built-in functionality for reporting an item of information for identifying each measurement system component; 41. The method of claim 30, further comprising automatically including in the data set the retrieved information items of one or more measurement system components that do not have built-in functionality for reporting information items for identifying each measurement system component.

42. 1. A method for controlling operation of a measurement system having a plurality of measurement system components and at least one local storage device, the method comprising: - protecting the measurement system according to any one of claims 1 to 21 against tampering; and checking the integrity of the measurement system according to any one of claims 22 to 41.

43. 43. A measurement system comprising a plurality of measurement system components and at least one local storage device, the measurement system being configured to perform the method of any one of claims 1 to 42.

44. A computer program having a program code for performing the method according to any one of claims 1 to 42, when the computer program runs on a computer.

Images