Embedded Device Security Monitoring via Execution Trace Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software bill of materials (SBOMs) are too coarse to provide useful security information, especially for complex software packages, leading to inaccuracies in identifying relevant vulnerabilities and discrepancies between the ideal and actual software states on embedded devices, particularly in large-scale deployments.
Innovation Solution
A method that uses an agent component on embedded devices to ascertain execution traces, determine a digital fingerprint specific to the software's identity and enabled functions, and provide this information to a central monitoring unit for accurate security state assessment and monitoring, eliminating the need for manual SBOM creation and reducing errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If a conventional SBOM-based approach is used, then software components can be listed, but the information is too coarse to provide useful security information for complex software packages
Solution Approach 1:
The patent segments the software system into multiple layers: the SBOM provides high-level component information, while execution traces provide fine-grained behavioral information. This multi-level segmentation allows the system to maintain both the overview provided by SBOM and the detailed security information needed for complex packages, resolving the contradiction between information completeness and manageability.
Solution Approach 2:
The patent adds a temporal dimension to software monitoring by capturing execution traces that record the actual runtime behavior of software. This transforms the static SBOM information into dynamic, time-based execution data, enabling security analysis of complex software packages based on their actual behavior rather than just their component lists.
2Reliability
If SBOM is created in the development environment, then software components are documented, but discrepancies occur between the ideal SBOM and the actual software running on embedded devices
Solution Approach 1:
The patent implements a feedback mechanism where execution traces captured from the actual running software are continuously monitored and compared against the expected SBOM state. This feedback loop detects discrepancies between the documented software configuration and the actual runtime state, automatically identifying when software has been modified, updated, or compromised, thus maintaining reliability without requiring constant manual verification.
Solution Approach 2:
The patent performs preliminary instrumentation of the software during the development phase, embedding trace collection capabilities into the software before deployment. This preliminary action ensures that execution traces are automatically captured from the start, eliminating the need for later installation of monitoring tools and ensuring continuous accuracy of software state information.
3Reliability
If a host-based intrusion detection system is used, then security monitoring is provided, but an additional system must be installed on the embedded device
Solution Approach 1:
The patent merges the intrusion detection functionality with the existing software execution environment by capturing execution traces through the device's native debugging and logging capabilities. This integration combines security monitoring with the operational software stack, eliminating the need for separate HIDS installation and reducing system complexity while maintaining security monitoring capability.
Data Source
AI summary
A method for providing information about a security-critical software state of an embedded device, wherein the embedded device has a network connection to a central monitoring unit for the central monitoring of the embedded device and of further embedded devices. The method includes: ascertaining execution traces of at least one software executed on the embedded device; determining an identifier for the executed software on the basis of the ascertained execution traces, wherein the identifier is specific to an identity and/or to enabled functions of the executed software; determining the information about the security-critical software state on the basis of the identifier; providing the information about the security-critical software state for the central monitoring unit via the network connection.