Passenger Transport Safety Module Updates Without Tampering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security devices for building-based passenger transport systems face challenges in maintaining software updates while ensuring security and preventing unauthorized access, requiring a simple yet robust update mechanism that protects against tampering and ensures continuous operation.
Innovation Solution
A security device equipped with a microcontroller having a processor, memory, and communication interface, featuring a safety module for evaluating safety signals and an update module for secure software updates, utilizing a hypervisor to restrict access and encryption for secure communication, ensuring only authorized changes to the security module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an external communication interface is added to enable software updates, then the update capability is improved, but the security risk increases
Solution Approach 1:
The microcontroller is divided into two separate cores: a first core for executing the safety module and a second core for executing the update module. This segmentation isolates the update functionality from the safety-critical code, allowing external communication for updates without compromising the integrity of the safety module. The safety module can only be modified by the update module through controlled inter-core communication.
Solution Approach 2:
A hypervisor is introduced as an intermediary layer between the update module and the safety module. The hypervisor manages memory access rights and controls communication between cores, acting as a security gateway that verifies and regulates all interactions. This mediator ensures that the update module cannot directly access or corrupt safety module memory without proper authorization and validation.
2Reliability
If access restrictions are implemented to protect the security module, then the security is improved, but the device complexity increases
Solution Approach 1:
The hypervisor performs multiple security functions within a single component: it manages memory allocation, controls inter-core communication, enforces access rights, and validates update operations. By consolidating these security mechanisms into one multi-functional layer, the system achieves strong protection without proportionally increasing complexity. The hypervisor serves as a universal security manager for all access requests to the safety module.
3Reliability
If the security module is made immutable to prevent unauthorized changes, then the reliability is improved, but the update capability deteriorates
Solution Approach 1:
The system implements dynamic immutability where the safety module remains read-only during normal operation to ensure integrity, but can be temporarily modified through a controlled update process. The update module, running on a separate core, can request and execute updates to the safety module through the hypervisor, which validates the changes before applying them. This dynamic approach maintains protection during operation while enabling scheduled updates.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A security device (36) for a building-related passenger transport system (10) comprises a microcontroller (42) having a memory (58), a processor (56, 56') and a communication interface (54); wherein a security module (40) is stored in the memory (58) and, when it is executed on the processor (56, 56'), receives security-relevant signals (52) from components (26) of the passenger transport system (10), evaluates them with regard to a security problem and transmits a warning signal (52') to a controller (22) of the passenger transport system (10) in the event of a security problem; wherein an update module (38) is stored in the memory (58) and, when it is executed on the processor (56, 56'), receives a software package (50) via the communication interface (54) and updates at least parts of the security module (40) with the software package (50); and wherein the microcontroller (42) is configured such that the security module (40) is able to be amended only by the update module (38).