DE102021212595A1 - Method of monitoring a computing system - Google Patents

Abstract

The invention relates to a method for monitoring, and in particular securing, a basic computing system (120) with calculation instances using a security computing system (100) which is set up to establish a communication link (102) with the basic computing system (120) to be monitored, comprising if the communication link (102) is established, performing a self-diagnosis (110) of the security computing system (100) according to security mechanisms integrated into the security computing system (100); performing an external diagnosis (112) of the basic computing system (120) to be monitored in accordance with security mechanisms provided for this purpose; and monitoring (114) of the basic computing system (120) to be monitored based on a comparison of calculations carried out redundantly in the calculation instances of the basic computing system (120) to be monitored with one another.

Description

The present invention relates to a method for monitoring, and in particular securing, a computing system using a security computing system and a computing system and a computer program for its implementation.

Background of the Invention

Computing resources can be provided decentrally by computer systems. Examples of this are so-called "cloud computing" (computing resources accessible via a communication network, e.g. the Internet) or so-called "edge computing" (computing resources provided at the edge of a communication network). Modern networks, e.g. so-called 5G mobile networks, can have high bandwidths combined with low latency times. This makes it possible to relocate complex and computationally intensive algorithms that affect the functionality or operation of machines, especially vehicles, to computing resources provided in a decentralized manner in order to relieve the machine control units or to implement functions that are controlled by the machine control units are not affordable.

Disclosure of Invention

According to the invention, a method for monitoring a computing system and a computing system and a computer program for its implementation with the features of the independent patent claims are proposed. Advantageous configurations are the subject of the dependent claims and the following description.

The invention deals with edge computing or edge systems or edge networks (a network made up of several edge systems), in particular in connection with the communication from and to vehicles, e.g. automated or partially automated vehicles. In general, it is about computing systems that are used at certain locations and, for example, communicate with vehicles in order to transmit certain information to them or to query them and, if necessary, forward it and/or process it further.

Such computing systems or edge systems and edge networks built from them often have commercial so-called "off-the-shelf" components (so-called COTS, "components-off-the-shelf"), which themselves do not offer any security integrity and none dedicated security mechanisms included. It is therefore difficult or impossible to offer safety-related functions and services on these systems, such as those required for infrastructure-assisted driving, e.g. in connection with automated or semi-automated vehicles.

Against this background, the use of a security computing system for monitoring, and in particular for securing, such a basic computing system with calculation instances, e.g. an edge system, is proposed. The basic computing system can be a computing unit or a combination of computing units. The security computing system is set up to establish a communication link with the basic computing system to be monitored; this can, for example, be wireless but also wired. When a communication connection is established, various steps are carried out: On the one hand, a self-diagnosis (or self-monitoring) of the safety computing system is carried out in accordance with safety mechanisms integrated into the safety computing system, and on the other hand, an external diagnosis of the basic computing system to be monitored is carried out in accordance with the safety mechanisms provided for this purpose. In addition, the basic computing system to be monitored is monitored based on a comparison of calculations carried out redundantly in calculation instances of the basic computing system.

The external diagnosis is carried out, for example, in such a way that the safety computing system queries the basic computing system via an API (programming interface) or calls up specific predefined functions on the basic computing system using so-called remote procedure calls. In the simplest case, for example, the security computing system knows the correct answers for the given inputs. For example, if the basic computing system provides a function for extracting a root, the safety computing system with n known values (x = ROOT(y)) can call the function and check whether the basic computing system is calculating correctly.

Another possibility is that the safety computing system requests the basic computing system to send certain documents or simply so-called "blobs" that are stored on the basic computing system in a specific directory to the safety computing system (e.g. by means of a GET request). The security computing system can then check whether the received data corresponds to or is the same as expected (e.g. by the security computing system comparing the hash sums). If this is the case, it stands to reason that the basic calculation system is working correctly.

Such a diagnosis can also be used, for example, as part of a so-called “time window watchdog”. be sent, whereby requests from the security computing system are sent cyclically and with a predefined required response time in order to check the availability (“aliveness”) of the basic computing system.

The calculation instances are in particular computer programs, but can in principle also be implemented in hardware, e.g. as an ASIC or similar. Each calculation instance implements a function using at least one algorithm and is set up, when it is executed, in response to a call to the function at least one to determine result. The calculation instances can be provided in the form of so-called containers, for example. The calculation instances are executed in one or more computing units of the computing system. Each computing unit (e.g. a computer or a computer system) comprises one or more processors, each with at least one processor core in which the calculation instances (then in the form of computer programs) are executed, or an integrated circuit (e.g. ASIC). Each computing unit also includes a volatile and/or a non-volatile memory in which calculation instances can be stored. Each arithmetic unit can be set up to execute a number of calculation instances simultaneously or in parallel. Each computational unit can be viewed as specific hardware (e.g., particular processors, particular memory, etc.) (which may be different for different computational units) that provides a uniform environment for the execution of computational entities.

A dedicated hardware solution - the security computing system - should preferably be provided, with which another computing system - the basic computing system - such as an edge system or an edge network is enabled to calculate security-related functions and to offer security-related services. This basic computing system to be monitored does not have to offer any security integrity itself and contain no dedicated security mechanisms; this is guaranteed by the security computing system. In particular, retrofitting existing basic computing systems (e.g. in the form of COTS) with security computing systems is also possible and advantageous.

A particular advantage is that the entire system can be installed later and no hardware adaptation of existing systems (the basic computing system to be monitored) is necessary, and simpler updating is also possible (both the adaptation and the update relate primarily to hardware, but also to software ).

Since the aspects of "safety" (functional safety) and "security" (information technology safety) are implemented by the safety computing system, for which "certified" hardware and software in particular can be used, proof of safety is also easier to provide. In addition, information regarding unavailability (continuous diagnosis) is available more quickly. This is to be explained in more detail below.

The security computing system, in particular as a hardware solution, can be implemented entirely on the basis of tried and tested automotive systems; for example, an embedded control unit (with maximum ASIL-D as the safety level), i.e. a control unit of a vehicle, can be used as the basis for such a safety computing system. As mentioned, only the communication connection (wireless or wired) to a basic computing system to be monitored (edge system) must be available. The security computing system and basic computing system are then set up to implement a preferred embodiment of the invention. In a simple case, for example, an existing, tried and tested control unit that has proven to be reliable can be used as hardware, with the software being adapted accordingly in order to be able to carry out internal and external diagnostics. At the very least, the appropriate or required interfaces should be available on the control unit and safeguarded by the internal diagnostics concept.

Carrying out the self-diagnosis according to security mechanisms integrated into the security computing system preferably includes monitoring hardware components of the security computing system, in particular processors and/or memory units and/or communication components, e.g. monitoring the CPU, TPU, RAM, ROM, communication, etc. This can e.g. through built-in hardware diagnostics, dual-core lockstep (i.e. calculations executed in parallel and independently of one another on two processors or processor cores, the results of which are compared with one another, e.g. to detect processor core-induced calculation errors), hardware watchdogs (a function, e.g. to detect failures of the to recognize hardware and possibly software and to output information about it or to restart the system by means of a reset), and dedicated ASICs or FPGAs (i.e. specially tailored or adapted to one or more specific applications).

Carrying out the self-diagnosis can also include running applications or software on the security computing system according to a predetermined security level, in particular ASIL-D also include the monitoring of software components, in particular an operating system, of the safety computing system. This means that software can be implemented in accordance with ASIL-D development processes. For example, a software watchdog for program flow control is conceivable (a software watchdog is, for example, checking software in the microcontroller that checks whether all important program modules are executed correctly within a specified time frame or whether a module takes an inadmissibly long time to process) .

The security computing system thus forms what is known as a “safe island” on the basis of which the following security mechanisms for external diagnosis of the basic computing system to be monitored can be built. This can be, for example, monitoring (or checking) hardware components of the basic computing system to be monitored, monitoring (or checking) software components of the basic computing system to be monitored and/or monitoring (or checking) communication of the basic computing system to be monitored with others, the basic computing system to be monitored comparable basic computing systems, i.e. in particular other edge systems, e.g. in an edge network. This will be explained in more detail below.

Typically, complex functions (which usually have to be updated frequently) run on an edge system as an exemplary basic computing system, which represent calculation instances; the functioning or the availability of such an edge system is usually an important condition for the secure operation of the entire system, i.e. not only the edge system itself, but also, for example, other edge systems in an edge network and also the communication participants that communicate with it, such as vehicles.

The proposed security computing system can help to secure the functionality of this system, e.g. by detecting availability using a software watchdog (so-called kicking, i.e. restarting the watchdog), or also program flow control using a question-and-answer method (i.e. there are requests and the answers received are checked to see whether the software is processed in the correct order; e.g. by using function blocks at the beginning and end of a software module to process a checksum and this is only correct at the end if the order has been observed), similarly as in the so-called EGAS concept (standardized e-gas monitoring concept for petrol and diesel engine controls), implemented there by the watchdog.

A basic functional test using test patterns (requests or queries with a known answer) is also advantageous. In contrast to the question-and-answer procedure mentioned, the contents of the calculations of the basic computing system can be checked for plausibility on the security computing system, similar to the EGAS concept, implemented there by the function monitoring (level 2). In the case of the question-and-answer procedure with a watchdog, for example, only a checksum (without any functional significance) is checked and whether the answer was given within a time window. In the case of the test pattern, the answer must be functionally correct (e.g. correct measurement of an applied, known voltage). Ideally, these tests are generated automatically, e.g. by extracting inputs with which a high level of coverage of the relevant functions can be achieved. The aim is in particular to include as many relevant functions as possible of the typically very complex software architecture of an edge software stack (basic computing system) when diagnosing the correct program flow - but not all (i.e. also non-relevant) for resource and timing reasons. functions. The selection can also be made dynamically, for example, since the software can also change due to updates. Machine learning or fuzzing approaches are also conceivable in order to achieve the highest possible path coverage. In principle, such a diagnosis can be designed manually in the design phase, but the possibility can also be created to adapt it automatically, e.g. during operation.

Hardware components can be checked via hardware diagnostics, e.g. a cyclical test of the memory using queries or by activating and evaluating memory tests (e.g. "Checkerboard", alternating "0" and "1") in the edge system (Corresponding functions could also be loaded into the Edge system later). Standard methods for embedded systems can be used as memory tests, e.g. writing and reading a "checkerboard". These mechanisms can also be applied to the overall system via the interface between the basic and safety computing system.

Dedicated testing of standard edge components (distributed key value storage, containers, CEPH, etc.) is also possible through appropriate queries or execution of local diagnostic functions (these can also be reloaded). This also makes it possible, for example, to achieve such external testing options with standard components.

The monitoring of the communication with other computing units (in edge systems, so-called nodes) is possible in particular with regard to abnormalities, eg also monitoring of the power consumption with regard to abnormalities (e.g. for security, intrusion detection). Examples of this are unexpected power consumption, unexpected network traffic, unexpected files on the hard disk or unexpected processes.

In addition, a possibility can be provided to deactivate the basic computing system in the event of a safety-relevant or safety-critical problem or error or if a number of errors is exceeded via the hardware path ("fail silent", e.g. as with a CAN transceiver in the EGAS concept). For example, the supply voltage can be interrupted or communication with other participants can be interrupted.

The monitoring of the basic computing system to be monitored based on a comparison of calculations carried out redundantly in the monitoring basic computing system with one another can take place in particular in the form of a so-called "voting", generally in the form of an "n-out-of-m" comparison, i.e. m results must be at least n be identical. For example, in a "two-out-of-three" comparison, both an erroneous result and the correct result can be recognized. The security computing system can either monitor the comparison function executed in the basic computing system or carry out this comparison itself.

If a security-related problem is detected in the basic computing system to be monitored, operation of the basic computing system to be monitored can be terminated (in particular it can be stopped or shut down), its power supply can be interrupted, and/or communication between the basic computing system to be monitored and other communication participants can be interrupted be prevented. Depending on the external diagnosis, i.e. depending on the results obtained as part of the external diagnosis, in particular when a security-related problem is detected in the basic computing system to be monitored, further steps can be carried out or initiated. This can be, for example, informing other communication participants who communicate with the basic computing system to be monitored (e.g. vehicles) about the results of the external diagnosis, in particular a termination of operation of the basic computing system to be monitored, and/or updating software components of the basic computing system to be monitored .

The results of the diagnostics can therefore not only be communicated locally, but also e.g. via a dedicated path to other participants or a central computing system, e.g. to a Safe Edge Service, which can trigger appropriate reactions. The Safe-Edge Service is e.g. an extended concept, namely to centrally manage security in an edge network. Such a service can, for example, be run on a secure computer. These reactions can be, for example, a direct shutdown of a basic computing system (edge system) or edge network and the sending of information about this to other participants such as a fleet of vehicles (for a so-called "blacklist" of unavailable edge systems). As mentioned, deactivation of the power supply and/or communication paths can also be considered. If the security computing system is designed as a gateway, the communication to the outside can also be blocked.

If possible, a software update for the basic computing system can also be requested or carried out. In a backend (e.g. the central computing system mentioned or in the so-called cloud or as a cloud service, e.g. as a vehicle control server), a display can be made on a developer dashboard, triggering of "predictive maintenance" (i.e. a predictive maintenance of the safety computing system or the basic computing system to be monitored). A long-term analysis can also be carried out there, e.g. to identify relevant patterns and thus optimize the system.

As mentioned, the security computing system can be used or provided as a gateway for communication between the basic computing system to be monitored and other communication participants, in particular also for controlling the communication between the basic computing system to be monitored and the further communication participants. This can, for example, interrupt the communication of the basic computing system to be monitored with one or more selected or all other communication participants, the filtering of messages, in particular those identified as incorrect, in the communication of the basic computing system to be monitored with the further communication participants, and/or monitoring and/or analyzing the communication of the basic computing system to be monitored with the other communication participants.

Instead of only being used as a separate diagnosis and protection unit, the security computing system can also be used as a gateway for communication with vehicles (or other participants), for example be set. This enables the various functions mentioned.

The mentioned functions or tasks of the security computing system can also be distributed over a network of several individual security computing units, which then form the security computing system, since all of them can be connected indirectly (or also directly) via the basic computing system. This results in the possibility of further diverse calculations and comparisons. In addition, a security computing system or a part thereof (a security computing unit) can take on the task of informing the backend or the rest of the edge network if a basic computing system to be monitored with a connected security computing system would have to be deactivated or removed from the network.

A computing system according to the invention as a security computing system, e.g. a control unit of a motor vehicle, is set up, in particular in terms of programming, to carry out a method according to the invention.

The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is advantageous because this causes particularly low costs, especially if an executing control unit is also used for other tasks and is therefore available anyway. Finally, a machine-readable storage medium is provided with a computer program stored thereon as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical and electrical storage devices such as hard drives, flash memories, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.). Such a download can be wired or wired or wireless (e.g. via a WLAN network, a 3G, 4G, 5G or 6G connection, etc.).

Further advantages and refinements of the invention result from the description and the attached drawing.

The invention is shown schematically in the drawing using an exemplary embodiment and is described below with reference to the drawing.

character list

• 1 shows schematically a security computing system according to the invention in a preferred embodiment and basic computing systems to be monitored to explain the invention.
• 2a and 2 B show various preferred possible uses of a security computing system according to the invention.

embodiment(s) of the invention

In 1 a security computing system 100 according to the invention is shown schematically in a preferred embodiment and basic computing systems 120 and 130 to be monitored to explain the invention. The security computing system 100 is, for example, physically or wired connected to the basic computing system 120 by means of a communication link 102 . The basic computing system 120 can in particular be a so-called edge system, as can the basic computing system 130 . The basic computing systems 120, 130 together may be part of an edge network; the basic computing systems 120, 130 are in contact via a communication link 132; there is no direct communication connection between the security computing system 100 and the basic computing system 130, for example.

The security computing system 100 carries out a self-diagnosis 110 of itself, specifically according to security mechanisms integrated into the security computing system. The security computing system 100 also carries out an external diagnosis 112 of the basic computing system 120 to be monitored in accordance with security mechanisms provided for this purpose. In addition, the security computing system 100 carries out a monitoring 114 which is based on a comparison of calculations carried out redundantly in the monitoring basic computing system 120 and possibly also in the basic computing system 130 in the respective calculation instances. By way of example, three such calculation instances (or functions) 121, 122, 123 are shown in basic computing system 120, and one calculation instance 131 in basic computing system 130.

In this example, the overall safety concept of the safety computing system 100 consists of the three building blocks self-diagnosis 110, external diagnosis 112 of hardware and software components of the (physically connected) basic computing system 120 or the so-called edge node with an n-out-of-m comparator of function paths , which are instantiated e.g. via several containers (cf. calculations 121, 122, 123, 131) within one or more edge nodes.

In the case of a physical connection (communication connection 102), direct switch-off paths 116 of the power supply and/or 118 of the communication can be implemented externally, ie the power or energy supply can be interrupted and the communication of the basic computing system 120 to be monitored with other communication participants can be prevented

In 2a and 2 B various preferred possible uses of a security computing system 100 according to the invention are shown. In 2a the security computing system 100 is connected to the basic computing system 120 to be monitored, the edge system, via the communication link 102 . The basic computing system 120 to be monitored is in turn in communication or in a communication connection 142 with other communication participants such as a vehicle 140.

The security computing system 100 is only used here as a diagnostic system, i.e. it can prevent the communication 142 with the communication participants such as the vehicle 140 , as indicated by the switch-off path 118 .

In 2a the security computing system 100 is also connected to the basic computing system 120 to be monitored, the edge system, via the communication link 102 .

However, the basic computing system 120 to be monitored is not itself or not directly in communication with other communication participants such as e.g. the vehicle 140. Rather, the safety computing system 100 is in communication or in a communication connection 144 with other communication participants such as e.g. the vehicle 140.

The security computing system 100 is used here, for example, not only as a diagnostic system, but also as a gateway, i.e. it can control communication with the communication participants such as the vehicle 140 itself and, for example, also prevent it.

Claims (11)

Method for monitoring, and in particular securing, a basic computing system (120) with calculation instances, using a security computing system (100) which is set up to establish a communication connection (102) with the basic computing system (120) to be monitored, comprising if the communication connection ( 102) is made: Carrying out a self-diagnosis (110) of the security computing system (100) according to security mechanisms integrated into the security computing system (100), Carrying out an external diagnosis (112) of the basic computing system (120) to be monitored in accordance with security mechanisms provided for this purpose, and Monitoring (114) the basic computing system (120) to be monitored based on a comparison of calculations carried out redundantly in the calculation instances of the basic computing system (120) to be monitored with one another. procedure after claim 1 , wherein performing the self-diagnosis (110) comprises at least one of the following: - monitoring hardware components of the security computing system (100), in particular processors and/or memory units and/or communication components, - executing applications or software on the security computing system (100) according to a predetermined security level, in particular ASIL-D, and - monitoring software components, in particular an operating system, of the security computing system (100). procedure after claim 1 or 2 , wherein the performance of the external diagnosis (112) comprises at least one of the following: - monitoring hardware components of the basic computing system (120) to be monitored, - monitoring software components of the basic computing system (120) to be monitored, and - monitoring a communication of the basic computing system (120 ) with other basic computing systems comparable to the basic computing system to be monitored (130). Method according to one of the preceding claims, further comprising, upon detection of a security-related problem in the basic computing system (120) to be monitored, at least one of the following: - terminating an operation of the butterfly computer system (120) to be monitored, - interrupting (116) a power supply to the butterfly system (120) to be monitored, and - Preventing (118) a communication (142) to be monitored basic computing system (120) with other communication participants (140). Method according to one of the preceding claims, further comprising, depending on the external diagnosis (112), in particular when recognizing a security-related problem in the basic computing system (120) to be monitored, at least one of the following: Communicate butterfly system (120) about the results of the external diagnosis (112), in particular a Been terminating the operation of the basic computing system (120) to be monitored, and - updating software components of the basic computing system (120) to be monitored. A method according to any one of the preceding claims, further comprising: Providing the security computing system (100) as a gateway for communication (144) of the basic computing system (120) to be monitored with other communication participants (! 40), and in particular controlling the communication of the basic computing system (120) to be monitored with the further communication participants. procedure after claim 6 , comprising controlling the communication of the basic computing system (120) to be monitored with the further communication participants, further comprising at least one of the following: - interrupting the communication of the basic computing system (120) to be monitored with one or more selected or all further communication participants, - filtering of, in particular messages identified as faulty in the communication of the basic computing system (120) to be monitored with the other communication participants, and - monitoring and/or analyzing the communication of the basic computing system (120) to be monitored with the further communication participants. Method according to one of the preceding claims, in which the basic computing system to be monitored is used for communication with vehicles (140), in particular vehicles driving in an automated or partially automated manner. Computing system (100), in particular as a security computing system, which is set up to carry out all method steps of a method according to one of the preceding claims. Computer program that causes a computing system (100) to execute all method steps of a method according to one of Claims 1 until 8th to perform when executed on the computing system (100). Machine-readable storage medium with a computer program stored on it claim 10 .

Images