WO2018145798A1 - Network system and method for checking the functional capability of a cloud-based control function - Google Patents

Abstract

The invention relates to a network system and to a method for checking the functional capability of a cloud-based control function, and to an associated computer program (product). The invention claims a system or assembly, preferably a network system or network assembly having: a network infrastructure having at least one control function that can be coupled to the network infrastructure, which control function can exchange control information with at least one device, characterized by at least one checking function for checking the functional capability of the control function, which checking function can be coupled to the network infrastructure, the checking function having at least one release function, which is designed to provide cancellation information if the checking function detects a lack of functional capability and/or flawed functional capability, which cancellation information leads to the cancellation of a release of an activation and/or of an execution of the control function.

Description

description

Network system and method for checking the functionality of a cloud-based control function

The present invention relates to a network system and method for checking the functionality of a cloud-based control function and an associated computer program (product).

Background of the invention

There is a desire that the network infrastructures will be much faster and that communication will be practically complete without any delays. In the future, not only people with a mobile phone in hand will communicate, but also objects: self-driving cars, smart thermostats, robots, pacemakers, components or devices as well as workpieces in industrial plants. 5th generation (5G) and higher mobile networks will become the technology for the Internet of the future. This is also true for networked, "intelligent" industrial halls (industrial 4.0, Industrial In ^¬ ternet of Things). The security within such a network infrastructure, and the prevention of deliberate attacks plays an increasingly important role. A successful Manipula ^¬ tion there may be a Therefore, there is a need to protect the integrity of control functions particularly for autonomous or assisted driving and for cloud-based robot control (cloud robotics).

By cryptographic protections goals can tegrity, confidentiality and authenticity of data transmission ^¬ objects are achieved as home. This avoids intentional, targeted attacks on data transmission. The term "safety" refers mainly to the security, confidentiality and / or integrity of data so ^¬ as their transfer and security, confidentiality and / or integrity in accessing relevant data. The authentication in data transfers or data access belongs For example, the term "security." Cryptographic functionality generally refers, for example, to a function for encryption, protection of confidentiality, integrity protection and / or authentication of data (eg user data, control data, configuration data or administrative data) and / or authentication of users . understand or objects the cryptographic protection functionality since ^¬ include, for example at one or more of the functionalities positioned below ^¬ resulted:

key storage

 System and / or user authentication

 - attestation

 encoding

 decryption

 Calculating a cryptographic checksum (e.g., message authentication code or digital signature) - checking a cryptographic checksum (e.g., message authentication code or digital signature)

 key agreement

 key generation

 Generating random numbers (e.g., seed generation)

 - Licensing

 Support of systemic monitoring functions

(e.g., Tamper Protection, System Integrity, Security Incident and Event Management SIEM)

 Monitor or monitor data

 - Validation of data

Filtering of data The enumerated cryptographic functionalities can in each case be carried out again with other / further methods or combinations of these methods. A data interface for data transmission or communica tion ^¬ between the said objects and, if necessary servers for example, a wired or wireless

Interface (eg mobile radio interface (GSM, UMTS, LTE, 5G and higher), a WLAN, a Bluetooth, ZigBee (especially used in building services) or an NFC

Interface (NFC: Near Field Communication)). In this case, the data interface can be designed and set up as a serial or parallel data interface. Communication between the devices and servers is not limited to point-to-point (peer) communication. There are also group communication, broadcast news or

Publish / Subscribe communication pattern conceivable.

On a vehicle bus e.g. CAN bus, the control com- munication is cryptographically protected against manipulation on a vehicle bus. However, this protection relates to individual data packets, not to a control functionality.

From the publication Stefan Berger, Kenneth Goldman, Dimitrios Pendarakis, David Safford, Enriquillo Valdez, Mimi Zohar: Scalable Attestation: A Step Towards Secure and Trusted

Clouds, IEEE Cloud Computing 2015 vol. 2 Issue No. 05 - Sept. -Oct. .

https: // www. Computer . org / csdl / mags / cd / 2015/05 / mcd2015050010- abs.html is a confirmation of the integrity of a cloud server at multiple levels (infrastructure,

integrity, guest Virtual machine integrity, application integrity). In each case, a Trusted Platform Module (TPM) can provide an attestation to confirm the software status. It's also possible the Open Attestation

To use an open-source project, where a central server evaluates the TPM measurements of several clients. Attacks against cars are possible in which the brake system or the steering is manipulated. Out

https: // www. wired. com / 2016/08 / j eep-hackers-return-high-speed-steering-acceleration-hacks / is known that control functions can be implemented locally on a vehicle (especially in ECUs) or in a cloud. For example, there are several publications on "Cloud Robotics and Automation",

http: // goldberg .berkeley. edu / cloud-robotics /,

https://en.wikipedia.org/wiki/Cloud_robotics,

http: // goldberg .berkeley. edu / pubs / T-ASE-Cloud-RA-Survey-Paper-Final-2015.pdf).

Edge computing in the area of 5G mobile telephony is also expected to implement control functions in autonomous systems in the future

(https://www.ericsson.com/res / thecompany / docs / publications / er icsson_review / 2016 / etr-5g-cloud-robotics .pdf).

Assistance functions of a vehicle are realized by control units. Whether certain functionality is available, may be determined by the built-specific control unit, or it can be installed an appropriate functionality in Soft ^¬ ware on a controller or unlocked (eg at end-of-line programming at the factory accordingly ordered Equipment variant).

It is an object of the invention to improve the safety or protection ^¬ measures for a control function. Presentation of the invention

This object is achieved by the independent claims ge ^¬ triggers. Advantageous further developments are subject of the depen ^¬ Gigen claims.

The invention claims a system, preferably a network system comprising: a network infrastructure having at least one control function which can be coupled thereto and which can exchange control information with at least one device,

 characterized by at least one check function which can be coupled to the network infrastructure for checking the functionality of the control function, wherein

 - The verification function has at least one release function, which is designed to provide in the case of recognized by the verification function lack of functionality and / or faulty functionality, a revocation information, which leads to a revocation of a release activation and / or execution of the control function.

The network infrastructure may be a wired or wireless transmission network within which said functions may be organized, for example, in servers. Server or cloud providers can use storage space and

Cloud services are provided. The verification ^¬ function may include monitoring and / or detection and / or analysis functions, which network side or

can be implemented on the cloud side. The tasks and (partial) functions of the check function can be imple ^¬ mented or be fully implemented in a single device also comparable shares in one or more clouds and in one device.

A faulty functionality also includes an impairment or restriction of the functionality.

The checking of the functionality can be carried out continuously or permanently and / or once. It can then provide the revocation information, which can directly cause a revocation or initiate a revocation. The revocation information can lead to a one-time withdrawal of a possibly ongoing execution of Steuerungsfunkti ^¬ on or temporary or permanent. The reversal information can also be a

Non-revocation information, ie a kind of positive confirmation that the control function is not revoked. Devices can be, for example vehicles, driverless transport systems ^¬, robots, test equipment or other components of an industrial plant.

The control function may include safety-related measures, such as stopping a vehicle or robot before a collision occurs. It can be delivered to the devices and nodes / server network infrastructure through the Steue ^¬ approximate function and control of information regarding software or hardware versions to ensure compatibility and full functionality of the versions.

According to the invention, the safety or protective measures for a control function are ensured. The invention also serves as a kind of safety watchdog for a network infrastructure, which will be understood as a distributed cloud robotics system (see the following embodiment). This safety-critical "malfunction" can be secured and prevented tamper-resistant in one embodiment.

The invention is also characterized in that the Akti ^¬ vation of a non-released version of a prior Steue ^¬ approximation function is reliable and possibly tamper protected prevented. In particular, the compatibility of the device-side and network-side functionality versions is ensured.

A development of the invention provides a with a network infrastructure in communication and controllable with the control function test device from which is to be ^¬ sets to monitor the functioning of at least one product and to certify them to the network infrastructure for the control function , The test device can be provide speaking monitoring information regarding the functionality of one or more devices. The Testge ^¬ advises, the received control information actually execute (physical) or simulated (virtual).

A development of the invention provides that the

Revocation information can then be provided if a cryptographically protectable blocking information is present or an expected cryptographically protectable release information fails.

A development of the invention provides that the release and / or blocking information can be predetermined or determined by the checking function.

A development of the invention provides that the checking of the functionality of the control function comprises a cryptographically protectable integrity check. A development of the invention provides that a

Cloud processing center is arranged within the network infrastructure and is adapted to process the task of the at least one device instructed by the control ^¬ function and / or stop and / or to end, the cloud processing center provided by the release ^¬ function and the control function forwarded revocation information receives.

A further aspect of the invention provides a device for checking the functionality of a control function having at least one checking function for checking the functionality, wherein this is coupled with a network infrastructure bar, to which at least one control function for controlling at least one device is coupling bar, and at least one release function, which is designed, in the case of a detected by the verification ^¬ function lack of functionality and / or faulty functionality, a revocation information to provide, which leads to a revocation of a release ei ^¬ ner activation and / or execution of the control function.

A further aspect of the invention provides a method for operating the system of the type described above, wel ^¬ ches method for operating the system according to one of the preceding system claims, which

 a network infrastructure with at least one control function which can exchange control information with at least one device,

- and at least one with the network infrastructure Kopp ^¬ elbare check function,

 - which checks the functionality of the control function,

wherein by at least one release function of the check ^¬ fungsfunkton in the case of a detected by the verification function lack of functionality and / or faulty functionality, a revocation information is ^¬ provides, which leads to a revocation of a free ^¬ task of activation and / or execution of the control function ,

The above functions may be implemented in software, firmware and / or hardware. They can be understood as ei ^¬ ne kind of functional units into a single unit (component or server or device) integrated into your function in any combination be Kings ^¬ nen.

Another aspect of the invention may be a computer program or a computer program product with at least one Compu ^¬ terprogramm with means for carrying out the method and its referred embodiments when the computer program (product) and the at least one computer program ver ^¬ divides within the communication apparatus according to above described type is carried out for execution. Above means, methods, and optionally the Compu ^¬ terprogramm (product) may be substantially analogous off accordingly or be formed as the system or the arrangement and its embodiments or further developments.

Embodiment (e):

Further advantages, details and developments of the invention will become apparent from the following description of exemplary embodiments in conjunction with the drawings.

Showing:

FIG. 1 schematically shows a network infrastructure to which the procedure according to the invention can be applied, and

 Figure 2 is a flowchart.

FIG. 1 shows a possible embodiment of the invention. A network infrastructure such as a 5G 5G network has a control function CRS, the network side as a cloud service or as a function of a cloud server out ^¬ makes its can. In the case of a robotic device R to be controlled, the cloud server is a "cloud robotics server" for controlling critical control functions on a robot, and other devices V to be controlled in the form of autonomous vehicles are also conceivable For example, a verification function in the form of a server is provided to continuously verify the correct functionality of the Cloud Robotics server, through another second network infrastructure such as a public network PN Finally, the verification function is directly or indirectly via the network PN with the first network infrastructure coupled. as an embodiment of the validation feature a Cloud Robotics security Operati ^¬ on Center CRO is provided to detect security incidents and analyze them. It can be used as check function besides another Cloud Robotics test server CRT provided be, for example, includes a release function, the activation of unreleased version versions of said control function by providing a

Revocation information prevents or initiates revocation. Furthermore, a test device TD is provided which, like the devices V and R, is controlled by the Cloud Robotics server and which monitors the correct functionality (e.g.

by loading the Cloud Robotics server with Testda ^¬ th). Furthermore, can be arranged, not shown in the figure cloud processing location in the network infrastructure of the 5G network, the quasi represents the "intelligence" of the device V and R. You can handle operations of Robo ^¬ ters and is in communication with the control function The control function can also be integrated into the device eg V instead of as a Cloud Robotics Server CRS, which is more likely to be the case with an autonomously driving vehicle which, even in the absence of a network connection to the 5G network must continue to function "autonomously".

Both the verification function and the control function can be flexibly implemented in different forms within the network infrastructures. The verification function may also be integrated into the above-mentioned cloud processing site.

The provided revocation information can be cryptographically encrypted. The revocation information is provided when there is cryptographically protectable blocking information or when there is no expected cryptographically releasable release information. In this context, a cryptographic key and a digital certificate that includes a cryptographic key, be revoked wi ^¬. It is possible to perform or a certificate in a certificate revocation list to use an OCSP Response to confirm the current revocation status of a digita ^¬ len certificate. Such a kind of revocation can use the invention if the encrypted or certified fected release information should be revoked in this way.

A control function can only be activated if there is a cryptographically protected release information (release attestation) that can be assigned to the control function. This can be specified or administratively or automatically issued by a self-test or by the verification function. Several approvals require sary (eg no administrative revocation and positi ve ^¬ confirm the self-test). The several releases may relate in particular to different components of a cloud solution (eg backend self-test, released vehicle control function for current backend version status). This makes it possible to reliably prevent an outdated version level the equipment side is activated, which is not freige ^¬ give for the current version of the cloud side. Furthermore, it can reliably be prevented that a control function, in particular a device-side control function, is activated if the cloud side has a malfunction.

For the revocation can be a whitelisting or a

Blacklisting strategy can be used individually or in combination:

- Blacklisting: Revoked control functions (identified by hash value, version number, for example)

 - absence of a positive confirmation (there is no positive confirmation that the functionality is still valid).

The release or blocking information can refer to an abstract functionality, to a special software version of a firmware or to a combination of software versions of several control functions or control devices. Furthermore, the information can specify the hardware version of the control unit. Furthermore, a geographic area are specified, to which the release information or the lock information refers. The release or blocking information is preferably protected by a cryptographic checksum (digital signature, message authentication code). The release of information in particular a sicherheitskriti ^¬ rule control function according to the invention is variable, ie it can be restricted on the fly. This may in particular when a safety-relevant Steue ^¬ insurance function for autonomous or assisted driving has proven to be unreliable, flawed, manipulated or tampered already in practice, be disabled and no more threat emanating from it. The activation of a corresponding driving function in a vehicle can hereby be reliably prevented.

The following components issue release attestations:

 Self-test of device V or device R (evaluated by the Cloud Robotics Server)

 Cloud Robotics Security Operation Server CRO issues a release information (evaluated by Cloud Robotics

Server, device V, device R)

 Cloud Robotics Test Server CRT Issues Attestation (Reviewed by Cloud Robotics Server, Device V, Device R)

 - Test device TD issues attestation (evaluated by

Cloud Robotics Server)

Furthermore, the integrity can be checked during operation with akti ^¬ fourth control function continues. Possibly. a shutdown occurs (eg transfer to driver) or an activation of an autonomous emergency program (eg stop at the edge of the lane).

The check can be done locally on a vehicle or in a backend system (cloud robotics). The result of

Integrity check is preferably cryptographically protected (attestation of the release confirmation). This is described as above, as a cryptographically protected release formation used for the activation of a control function. This means that the release information (or blocking information) can both be administered administratively (eg in the case of recognized weak points) or can be determined by checking the functionality (attested self-test) itself.

FIG. 2 shows a flow chart for the procedure according to the invention, which indicates the starting point in step S0. In step S1, a control function is activated. In step S2, a check is performed by the checking function of this control function. It is checked whether there is a release information (release attestation) for the control function. This is the case if there is neither faulty functionality of the control function nor a lack of functionality. Is the result of the examination in order ^¬ (see step S3), then in step S4, the control function is activated. Is not the result of the check in order, then in step 6, a revocation information is provided which leads already acti ^¬ fourth and operating control function to revoke the activation released. Ultimately, it comes to tempo ^¬ Raeren or one-time or permanent blocking or deactivating control function. Step S6 marks the end of the procedure explained above.

Although the invention has been further illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

The implementation of the processes and procedures described above may be based on instructions SUC ^¬ gen, which (collectively referred to as computer readable storage) on computer readable storage media or in volatile computer memories. computer readable Memory is, for example, volatile memory such as caches, buffers or RAM and non-volatile memory such as Wechselda ^¬ tenträger, hard disks, etc. The functions or steps described above may be in the form of at least one instruction set in / on a computer-readable memory. The functions or steps are not specific to a particular instruction ^¬ set or to a particular form of instruction sets, or to a particular storage medium or to a

Processor or bound to specific execution schemes and can be performed by software, firmware, microcode, hardware, Prozes ^¬ sensors, integrated circuits, etc. in stand-alone mode or in any combination. Various processing strategies can be used, for example serial processing by a single processor or multiprocessing or multitasking or parallel processing, etc. The instructions can be stored in local memories, but it is also possible to store the instructions on a remote system and then via Network access.

The term "processor", "central signal processing",

"Control unit" or "data evaluation means" as here USAGE ^¬ det, processing means includes in the broad sense, that is, for example, servers, general purpose processors, Grafikprozesso ^¬ ren, digital signal processors, application specific inte ^¬ grated circuits (ASICs), programmable logic circuits, such as FPGAs, discrete analog or digital circuits and be ^¬ undesirables combinations thereof, and any other processing means known in the art or developed in the future. Processors can consist of one or more devices or devices or units. If a processor consists of several devices, these can be designed or configured for the parallel or sequential processing or execution of instructions.

Claims

claims 1. System comprising:  a network infrastructure (5G) with at least one control function (CRS) which can be coupled to it Can exchange control information with at least one device (V, R, TD, - characterized by at least one of be coupled to the network infrastructure ^¬ check function (CRT, CRO) to check the operability of the Steue ^¬ approximate function, wherein - the verification function comprises at least one release function, which is adapted onsfähigkeit in case of a detected from the check function absence of functional and / or provide a revocation information of a faulty Funktionsfä ^¬ capability which a revocation of a release of an activation and / or an execution the control function leads. 2. System according to the preceding claim, characterized by an associated with the network infrastructure and controllable with the control function test ^¬ device (TD), which is designed to monitor the Funktionsfä ^¬ ability of at least one device and this network Infrastructure for the control function. 3. System according to any one of the preceding claims, characterized in that the revocation information can then be provided if a cryptographically protectable Block information is present or fails an expected crypto ^¬ phically protectable release information. 4. System according to the preceding claim, characterized in that the release and / or lock information can be predetermined or determined by the verification function. 5. System according to any one of the preceding claims, characterized in that the checking of the functionality of the control function is a cryptographic  includes a protectable integrity check. 6. System according to any one of the preceding claims, characterized in that a cloud processing center is arranged within ^¬ half of the network infrastructure and ^¬ is designed to process the instructed by the control function steps of at least one device to ^¬ and / or stop and / or quit taking the cloud data controller receives the be of the release function ^¬ riding Asked and weitergelei ^¬ ended by the control function revocation information. 7. Device for checking the functionality of a control function having at least one check function ^¬ (CRT, CRO) for checking the operability, which is coupled to a network infrastructure (5G) bar to which at least one control radio ^¬ tion (CRS) for controlling at least one device (V, R, TD) is couplable bar, and at least one release function, which is designed, in the case of a recognized by the check ^¬ tion function lack of functionality and / or faulty functionality, a  Provide revocation information which results in revoking a release of activation and / or execution of the control function. 8. Device according to the preceding claim, characterized in that the revocation information can then ^{bereitge ¬} provides, if a cryptographically protectable blocking information is present or an expected crypto ^¬ phically protectable release information is missing. 9. Device according to one of the preceding device claims, characterized in that the verification of the functionality of the control function comprises a cryptographically protectable integrity check. 10. Device according to one of the preceding claims, characterized in that the device is connected via the network ^¬ werkinfrastruktur with a cloud processing center in the process of the control function instructed operations of the at least one device verar ^¬ work and / or pause and / or terminate wherein the cloud processing site receives the BE of the enable function ^¬ riding asked and weitergelei ^¬ ended by the control function revocation information. 11. A method of operating the system according to one of the preceding system claims, which  a network infrastructure (5G) with at least one control function (CR), which can exchange control information with at least one device (V, R, TD) and has at least one check function that is coupled to the network infrastructure,  which checks the functionality of the control function, wherein by at least one release function of the check ^¬ fungsfunkton in the case of a recognized by the verification function lack of functionality and / or faulty functionality, a revocation information is provided ^¬ , which leads to a revocation of a release of an activation and / or execution of the control function. 12. The method according to the preceding claim, characterized in that a related to the network infrastructure and controllable with the control function test device, the operability of the at least monitors a device and certifies this to the network infrastructure for the control function. 13. The method according to any one of the preceding method claims, characterized in that the Revocation information is then provided when a cryptographically protectable blocking information is present or an expected cryptographically protectable Freigabeinforma ^¬ tion fails. 14. The method according to the preceding claim, characterized in that the release and / or lock information is predetermined or determined by the verification function. 15. The method according to any one of the preceding method claims, characterized in that the verification of the functionality of the control function performs a kryptogra ^¬ phically protectable integrity check. 16. The method according to any one of the preceding claims, characterized in that arranged a cloud processing station within the network infrastructure, process the instructed by the control function operations of the at least one device and / or stop and / or terminate, the cloud processing center provided by the release function and receives revocation information forwarded by the control function. 17. Computer program product with at least one computer ^¬ program having means for carrying out the method according to one of the preceding method claims, when the at least one computer program distributed in the system according to one of the preceding system claims is executed.