Method and device for detecting a falsification during communication between components of a system having requirements for the functional security thereof
Patent Information
- Application Number
- PCT/EP2025/054606
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2024-03-05
- Filing Date
- 2025-02-20
- Publication Date
- 2025-10-02
AI Technical Summary
Conventional systems lack effective interface protection on the initiator and target sides, preventing simple end-to-end protection against tampering during communication between components from different manufacturers, which is crucial for functional safety in industries like automotive, aviation, and aerospace.
A bridge module is inserted between components and the bus connection to ensure uncorrupted communication by adding redundancy to requests and responses, using protocols and checksums to detect tampering and initiate risk mitigation measures.
Enables simple end-to-end protection without modifying bus connections or targets, effectively detecting and mitigating tampering risks, ensuring functional safety across components from different manufacturers.
Smart Images
Figure EP2025054606_02102025_PF_FP_ABST
Abstract
Description
[0001] Description
[0002] title
[0003] Method and device for detecting tampering when communicating between components of a system with requirements on its functional security
[0004] The present invention relates to a method and a device for detecting tampering during communication between components of a system with requirements for its functional safety, in particular for systems in the automotive, aviation, manufacturing and / or aerospace industries.
[0005] State of the art
[0006] When manufacturing, modifying and / or improving components of a system that is subject to safety requirements, it is necessary to develop the system and its components in such a way that the functional safety requirements of the components and / or the system are met, even if a component is provided by a third party.
[0007] In conventional systems, a bus connection may be coupled between respective integrated circuits of the components to enable communication between a plurality of components of the system. An initiator of a component may be configured to request a read from and / or write to an addressed target of a component of the system via the bus connection. An addressed target may thus be configured to enable reading from and / or writing to a component of the system.
[0008] The bus connection can map the address provided by the initiator to the addressed target and / or forward the initiator's request to the addressed target. The bus connection can also forward a response back to the requesting initiator, e.g., from the addressed target via the bus connection.
[0009] In the exemplary case of communication between safety-relevant components of a system in the automotive, aerospace, manufacturing, and / or aerospace industries, it may be necessary for the communication to meet the functional safety requirements of the components and / or the system to prevent damage in the event of tampering with communication via the bus connection. This means that any tampering with a request from an initiator or a response from an addressed target must be prevented or at least detected if the tampering is relevant to the functional safety of the system.
[0010] In conventional bus connections, functional safety requirements can be met by adding redundancies to communicated data, for example, to detect bit flips. Redundancy can be implemented simply in the form of a parity bit. Alternatively or additionally, in more complex systems, a cyclic redundancy check (CRC) and / or an error correction code (ECC) can be implemented, as conceptually described, for example, in Moreira, J.C. and Farrell, P.G., "Essentials of Error Control Coding," John Wiley & Sons, 2006.
[0011] To protect against tampering, communication between the initiator and the bus connection (interface protection on the initiator side), communication within the bus connection (transport protection), and communication between the bus connection and the target (interface protection on the target side) are regularly considered separately. Communication between components of a system is illustrated in Figure 1 using an example system. The solid and dotted lines indicate communication with interface and transport protection, while the dashed lines indicate communication without inherent protection.
[0012] End-to-end protection exists precisely when no communication occurs without inherent protection. For many use cases in the automotive, aviation, manufacturing, and / or aerospace industries, end-to-end protection is mandatory. For the purposes of this disclosure, it can be assumed that the components and the bus connection itself meet the functional safety requirements of the system. If this is not the case, two identical processor cores (central processing units, CPUs) can be used, for example, which operate in parallel and execute the same instructions simultaneously. This redundancy allows for tampering to be detected and, if necessary, responded to (dual core lock step, DCLS). Architectures with redundant memories are also possible.
[0013] While transport protection is regularly implemented in conventional systems, interface protection on the initiator and / or target side may be lacking in conventional systems because the components on the initiator and / or target side are regularly developed or have been developed without taking into account the functional safety requirements of the system in which they are used.
[0014] It would therefore be desirable to provide a method and a device for detecting errors when communicating between components of a system with requirements for its functional safety in order to enable simple end-to-end protection in the system with components from, for example, different manufacturers.
[0015] DE 102012 010 145 A1 discloses an input / output module (I / O module) for detecting input peripheral signals present at at least one signal peripheral connection and / or for outputting output peripheral signals at at least one signal peripheral connection, wherein the I / O module accommodates a microcontroller system with a first number of peripheral units, each with at least one signal peripheral connection, a second number of microprocessor units and at least one diagnostic unit.
[0016] Disclosure of the invention
[0017] The invention provides a method and a device for detecting
[0018] Falsifications when communicating between components of a system with requirements for its functional safety with the features of the independent patent claims.
[0019] Preferred embodiments are the subject of the respective subclaims.
[0020] The disclosed methods and apparatus are particularly directed to improving interface protection on the initiator and / or target side to enable simple end-to-end protection with components from different manufacturers in a system.
[0021] Instead of adapting a component on the initiator and / or target side to the system's requirements, a bridge module can be inserted between the component and the bus connection. The bridge module ensures that an initiator's request is not corrupted and adds its own redundancy to the initiator's request to ensure that subsequent communication with the bus connection is not corrupted.
[0022] According to a first aspect, the invention relates to a method for detecting tampering during communication between components of a system with requirements for its functional safety. The method comprises transmitting a request from an initiator to a bridge module of the system according to a first communication protocol and transmitting a response to the request from the bridge module to the initiator according to the first communication protocol in order to detect tampering during communication between the bridge module and the initiator; transmitting the request from the bridge module to a bus connection of the system according to a second communication protocol and transmitting a response to the request to the bridge module according to the second communication protocol.
[0023] According to a further development, the method further comprises adding, by the bridge module, a redundancy to the request according to the second communication protocol.
[0024] According to one development, the redundancy is configured to secure communication from the bridge module to the bus connection of the system. According to one development, transmitting the request from the initiator to the bridge module of the system according to the first communication protocol comprises sending, by the initiator, a first request to the bridge module, and sending, by the initiator, a second request to the bridge module, wherein the first request before sending and the second request before sending are identical; and transmitting the response to the request from the bridge module to the initiator according to the first communication protocol comprises sending, by the bridge module, a first response to the requests to the initiator, and sending, by the bridge module, a second response to the requests to the initiator, wherein the first response before sending and the second response before sending are identical.
[0025] According to a further development, the method comprises a comparison, by the bridge module, of the first request and the second request; and / or a comparison, by the initiator, of the first response and the second response.
[0026] According to a further development, the method comprises initiating an action in accordance with the functional safety requirements of the system in response to a determination that the first and second requirements do not match and / or the first and second responses do not match.
[0027] According to a further development, transmitting the request from the initiator to the bridge module of the system according to the first communication protocol comprises sending, by the initiator, a first checksum to the bridge module, and calculating, by the bridge module, a second checksum; and / or transmitting the response to the request from the bridge module to the initiator according to the first communication protocol comprises sending, by the bridge module, a third checksum to the initiator, and calculating, by the initiator, a fourth checksum.
[0028] According to a further development, the method comprises initiating a measure in accordance with the functional safety requirements of the system in response to a determination that the first and second checksums do not match; and / or initiating a measure in accordance with the functional safety requirements of the system (1000) in response to a determination that the third and fourth checksums do not match.
[0029] According to a second aspect, the invention relates to a device for detecting tampering during communication between components of a system with functional safety requirements. The device comprises a processor configured to perform the methods described above.
[0030] According to a third aspect, the invention relates to a system for detecting tampering during communication between components of the system with requirements for its functional safety. The system comprises a component with an initiator; a bus connection; and a device as described above, ie, a bridge module coupled between the initiator and the bus connection.
[0031] Short description of the drawings
[0032] It shows:
[0033] Figure 1 is a schematic representation of an exemplary embodiment of a device for detecting errors in communication between components of a system with requirements for its functional safety;
[0034] Figure 2 is a schematic representation of an exemplary embodiment of a method for detecting errors in communication between components of a system with requirements for its functional safety using duplicated sequences; and
[0035] Figure 3 shows a schematic representation of an exemplary embodiment of a method for detecting errors in communication between components of a system with functional safety requirements, using a checksum. In all figures, identical or functionally identical elements and devices are provided with the same reference numerals. The numbering of method steps serves the purpose of clarity and is generally not intended to imply a specific chronological order. In particular, multiple method steps can also be performed simultaneously.
[0036] Description of the embodiments
[0037] Figure 1 shows a schematic representation of an exemplary embodiment of a device 1200 for detecting errors during communication between components 1120 of a system 1000 with requirements for its functional safety. The system 1000 may include one or more components on an initiator side of the system 1000. The system 1000 may include one or more components on a target side of the system 1000. At least one component on the initiator and / or target side is coupled to a bus connection 1300 of the system 1000 via a bridge module 1200 of the system 1000.
[0038] In Figure 1, on the initiator side, components 1110 and 1120 are coupled to bus connection 1300. Components 1110 and 1120 can each comprise an initiator 1111 or 1121. On the initiator side, only one component or more than two components can be coupled to bus connection 1300. Component 1120 can be the only component coupled to bus connection 1300 via bridge module 1200. Multiple components can also be coupled to bus connection 1300 via a single bridge module. Alternatively, each component can be coupled to bus connection 1300 via a separate bridge module.
[0039] In Figure 1, on the target side, components 1410 to 1430 are coupled to bus connection 1300. Components 1410 to 1430 can each comprise a target 1411 to 1431. On the target side, only one component, or two or more than three components, can be coupled to bus connection 1300. As on the initiator side, on the target side, for example, only one, several, or every component can be coupled to bus connection 1300 via a single or separate bridge module. On the target side, each component can also be coupled directly to bus connection 1300. In other words, on the target side, no bridge module can be coupled between bus connection 1300 and the components on the target side.
[0040] Communication in the exemplary systems described above may follow a protocol that specifies which signals are set and read by the initiator or the target, and the order in which these signals occur to control communication. The signals may include an address signal that specifies which data is to be written and / or read according to a request from an initiator, and a data signal for transferring payload data between the initiator and the target, and vice versa. Furthermore, the signals may include control signals that, for example, define whether reading and / or writing is to take place, or that provide status regarding a request and / or a response to the request.
[0041] Figure 2 shows a schematic representation of an exemplary embodiment of a method 2000 for detecting errors in communication between components of a system with requirements for its functional safety using duplicated sequences.
[0042] The method 2000 may include sending, by an initiator 2121, a first request to a bridge module 2200, and sending, by an initiator 2121, a second request to the bridge module 2200, wherein the first request before sending and the second request before sending are identical. The bridge module may be configured to receive the first request and to receive the second request.
[0043] In one step, the method 2000 may include comparing, by the bridge module, the first request and the second request, and determining whether or not the first request and the second request match.
[0044] In response to a determination that the first request and the second request do not match, the bridge module may be configured to detect tampering to satisfy the functional safety requirements of the system, e.g., by initiating an action to mitigate a risk that may be associated with the tampering. In response to a determination that the first request and the second request match, the bridge module 2200 may be configured to send either only the first request or only the second request to a bus connection 2300. The bridge module 2200 may be further configured to add redundancy (Redundancy 1) to the first request or the second request.
[0045] In one step, the method 2000 may include transmitting the request to a bus connection 2300, and transmitting, through the bus connection 2300, a response to the request to the bridge module 2200, as shown in Figure 2. The request may be transmitted through the bus connection 2300 to one or more targets 2411 to 24K1. The response to the request may be transmitted through the bus connection 2300 from one or more targets 2411 to 24K1 to the initiator 2121.
[0046] In one step, the method 2000 may include sending, by the bridge module 2200, a first response to the requests to the initiator 2121, and sending, by the bridge module 2200, a second response to the requests to the initiator 2121, wherein the first response before sending and the second response before sending are identical. The initiator 2121 may be configured to receive the first response and to receive the second response.
[0047] Redundancy (Redundancy 1) can be configured to protect an address (Address 1) and data (Data 1). For example, redundancy can protect communication from bridge module 2200 to bus connection 2300. Alternatively or additionally, redundancy can protect communication from bus connection 2300 to one or more destinations 2411 to 24K1.
[0048] Analogously, a redundancy (Redundancy 1') can be configured to secure a response (Response 1). The redundancy can, for example, secure communication from one or more targets 2411 to 24K1 to the bus connection 2300. The redundancy can, alternatively or additionally, secure communication from the bus connection 2300 to the bridge module 2200. In one step, the method 2000 can include comparing the received redundancy with a redundancy determined based on received data or based on the received response, and determining whether or not the received redundancy and the determined redundancy match. Only redundancies calculated based on the same data are compared.
[0049] In response to a determination that the received redundancy and the determined redundancy do not match, the receiving module, e.g., the bridge module 2200, may be configured to detect tampering to satisfy the functional safety requirements of the system, e.g., by initiating an action to mitigate a risk that may be associated with the tampering.
[0050] In response to a determination that the received redundancy and the determined redundancy match, the method 2000 may include sending, by the bridge module 2200, a first response to the requests to the initiator 2121, and sending, by the bridge module 2200, a second response to the requests to the initiator 2121, wherein the first response before sending and the second response before sending are identical. The initiator 2121 may be configured to receive the first response and to receive the second response to enable the initiator 2121 to compare the first response and the second response to initiate, if appropriate, a risk mitigation measure upon detection of tampering in accordance with the functional safety requirements of the system.
[0051] Figure 3 shows a schematic representation of an exemplary embodiment of a method 3000 for detecting errors in communication between components of a system with requirements for its functional safety using a checksum.
[0052] The method 3000 may include, in one step, sending, by an initiator 3121, a request with a sequence of addresses and / or data and a first checksum calculated by the initiator 3121 to a bridge module 3200. A checksum may, for example, be a cyclic redundancy check. The configuration of the first checksum may be specified in a virtual address of the request. The first checksum calculated by the initiator 3121 may be transmitted as the last data word in the sequence. An address corresponding to the last data word may, for example, be a virtual address that enables the bridge module 3200 to recognize the end of the sequence and thus the first checksum.
[0053] In one step, the method 3000 may include calculating, by the bridge module 3200, a second checksum based on the request received from the initiator 3121 with the sequence of addresses and / or data to compare the first checksum and the second checksum.
[0054] In one step, the method 3000 may include transmitting the request with the sequence of addresses and / or data to a bus connection 3300, and transmitting, through the bus connection 3300, a response with a sequence of responses to the bridge module 3200, as shown in Figure 3.
[0055] The bridge module 3200 may be further configured to add redundancies (redundancy 1 through redundancy N) to the sequence of addresses and / or data.
[0056] The bus connection 3300 may be configured to transmit to one or more destinations 3411 to 34K1 and / or to transmit from one or more destinations 3411 to 34K1.
[0057] In one step, the method 3000 may include sending, by the bridge module 3200, a response including the sequence of responses and a third checksum calculated by the bridge module 3200 to the initiator 3121. The initiator 3121 may be configured to receive the response including the sequence of responses and to receive the third checksum to enable comparing the third checksum calculated by the bridge module 3200 with a fourth checksum calculated by the initiator 3121.
[0058] In one step, method 3000 may include comparing the received redundancies with redundancies determined based on received addresses and / or data or based on the received responses, and determining whether or not the received redundancies and the determined redundancies match. Only redundancies calculated based on the same data will be compared.
[0059] In response to a determination that the received redundancies and the determined redundancies do not match, the receiving module, e.g., the bridge module, may be configured to detect tampering in order to meet the functional safety requirements of the system, e.g., by initiating an action to mitigate a risk that may be associated with the tampering.
[0060] In response to a determination that the received redundancies and the determined redundancies match, the method 3000 may include sending, by the bridge module 3200, a response comprising the sequence of responses and a third checksum calculated by the bridge module 3200 to the initiator 3121. The initiator 3121 may be configured to receive the response comprising the sequence of responses and to receive the third checksum to enable a comparison of the third checksum calculated by the bridge module 3200 with a fourth checksum calculated by the initiator 3121 to initiate a risk mitigation measure, if appropriate, upon detection of tampering in accordance with the functional safety requirements of the system.
[0061] The devices and methods can be advantageous because neither the bus connection nor the addressed targets need to be modified to support the specific access patterns of an initiator. It is also not necessary for all accesses in a sequence to address the same target. Furthermore, redundant accesses from an initiator can be handled locally in the bridge module rather than forwarded to the other bus participants, preventing loading and / or overloading of the bus connection.
[0062] It should be noted that different functional safety requirements may be applicable in different industries, countries, and regions, to which reference is made generally without clearly identifying each applicable requirement. The principles of the devices and methods disclosed herein are applicable in conjunction with each of these requirements.
Claims
Claims 1. A method (2000; 3000) for detecting tampering during communication between components of a system (1000) with requirements for its functional safety, the method (2000; 3000) comprising: Transmitting a request from an initiator (1121; 2121; 3121) to a bridge module (1200; 2200; 3200) of the system (1000) according to a first communication protocol and transmitting a response to the request from the bridge module (1200; 2200; 3200) to the initiator (1121; 2121; 3121) according to the first communication protocol in order to detect tampering in communication between the bridge module (1200; 2200; 3200) and the initiator (1121; 2121; 3121); Transmitting the request from the bridge module (1200; 2200; 3200) to a bus connection (2300; 3300) of the system (1000) according to a second communication protocol and transmitting a response to the request to the bridge module (1200; 2200; 3200) according to the second communication protocol.
2. The method (2000; 3000) of claim 1, wherein the method (2000; 3000) further comprises: Adding, by the bridge module (1200; 2200; 3200), redundancy to the request according to the second communication protocol.
3. The method (2000; 3000) of claim 2, wherein the redundancy is configured to secure communication from the bridge module (1200; 2200; 3200) to the bus connection (2300; 3300) of the system (1000).
4. The method (2000) according to any one of claims 1 to 3, wherein transmitting the request from the initiator (2121) to the bridge module (2200) of the system (1000) according to the first communication protocol comprises sending, by the initiator (2121), a first request to the bridge module (2200), and sending, by the initiator (2121), a second request to the bridge module (2200), wherein the first request before sending and the second request before sending are identical; and transmitting the response to the request from the bridge module (2200) to the initiator (2121) according to the first communication protocol comprises sending, by the bridge module (2200), a first response to the requests to the initiator (2121), and sending, by the bridge module (2200), a second response to the requests to the initiator (2121), wherein the first response before sending and the second response before sending are identical.
5. The method (2000) of claim 4, wherein the method (2000) comprises: Comparing, by the bridge module (1200; 2200; 3200), the first request and the second request; and / or Comparison, by the initiator (2121), of the first answer and the second answer.
6. The method (2000) of claim 5, wherein the method (2000) comprises: Initiating an action in accordance with the functional safety requirements of the system (1000) in response to a determination that the first and second requirements do not match and / or the first and second responses do not match.
7. The method (3000) according to any one of claims 1 to 3, wherein transmitting the request from the initiator (3121) to the bridge module (3200) of the system (1000) according to the first communication protocol comprises sending, by the initiator (3121), a first checksum to the bridge module (3200), and calculating, by the bridge module (3200), a second checksum; and / or transmitting the response to the request from the bridge module (3200) to the initiator (3121) according to the first communication protocol comprises sending, by the bridge module (3200), a third checksum to the initiator (2121), and calculating, by the initiator (2121), a fourth checksum.
8. The method (3000) according to claim 7, wherein the method (3000) comprises: Initiating an action in accordance with the functional safety requirements of the system (1000) in response to a determination that the first and second checksums do not match; and or Initiating an action in accordance with the functional safety requirements of the system (1000) in response to a determination that the third and fourth checksums do not match.
9. Apparatus (1200) for detecting tampering in communication between components of a system (1000) having functional safety requirements, the apparatus (1200) comprising: a processor configured to perform the methods (2000; 3000) according to any one of claims 1 to 8.
10. A system (1000) for detecting tampering in communication between components of the system (1000) having functional safety requirements, the system (1000) comprising: a component (1120) having an initiator (1121); a bus connection (1300); and a device (1200) according to claim 9 coupled between the initiator (1121) and the bus connection (1300).