DE102022102911A1 - Procedures for automating physical inspections of electronic devices, taking into account latently insecure supply chains and operating environments - Google Patents

Abstract

The invention relates to a method for automatically carrying out physical checks along a supply chain and/or during the operation of electronic devices (E), in particular for automatically collecting evidence of integrity, freedom from manipulation and/or authenticity, the device (E) having a housing ( G) and a data processing unit (C, CP) arranged in the housing (G) as an integral part, and at least one sensor (P, CP) is communicatively connected to the data processing unit (C, CP) and also arranged in the housing (G). where the physical device architecture is measured and thus unique electronic evidence (S1-Si) is generated. The aim of the invention is to further develop the method for the automated and simplified control and verification of electronic devices with regard to manipulations or other changes, so that false-positive manipulation detections are avoided. To this end, the invention proposes evaluating the freedom from manipulation of the device (E) based on models and using training and decision-making algorithms (A, B) and certifying this electronically.

Description

The invention relates to a method for automatically carrying out physical checks along a supply chain and/or during the operation of electronic devices, in particular for automatically collecting evidence of integrity, freedom from manipulation and/or authenticity, the device having a housing and a data processing unit arranged in the housing as an integral part, and at least one sensor is communicatively connected to the data processing unit,

field of invention

In everyday life, society will have to trust more and more electronic devices in the future, for example in critical infrastructures (e.g. data, energy and communication networks), autonomous and automated mobility (e.g. self-driving cars or service robots) as well as Industry 4.0 and the telemedicine can be used. As the number of networked intelligent objects, programs and data increases, so does the need for IT security and the reliability of these devices. Since these electronic devices are ubiquitous in our daily lives, this issue has become a significant societal challenge.

A large number of prominent examples of invasive attacks exist. For example, extracting cryptographic keys on trusted platform modules [D. Andzakovic, "Extracting BitLocker keys from a TPM," https://pulsesecurity.co.nz/articles/TPM-sniffing/], [Dolos Group, "From Stolen Laptop to Inside the Company Network," https://dolosgroup. io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network] and [H. Nurmi, "Sniff, there leaks my BitLocker key," https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/]. Another example is the manipulation of PIN input devices [p. Drimer, S.J. Murdoch, and R. Anderson, "Thinking Inside the Box: System-Level Failures of Tamper Proofing," in 2008 IEEE Symposium on Security and Privacy. IEEE, 2008, pp. 281-295, http://ieeexplore.ieee.org/document/4531159/] or circumventing encryption methods of FPGA bitstreams [M. Ender, A. Moradi, and C. Paar, "The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs," in 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Aug. 2020, pp. 1803-1819. https://www.usenix.ora/conference/usenixsecurity20/presentation/ender]. Other relevant attacks can be found in the so-called Snowden documents. According to the source, the NSA is able to intercept hardware in the mail and integrate backdoors (hardware or software related) in a way that makes it virtually impossible for the recipient to detect tampering [J. Appelbaum and J.H. to Christian Stöcker, "Catalog Advertises NSA Toolbox," 2015, https://www.spiegel.de/international/world/catalog-revealsnsa-has-back-doors-for-numerous-devices-a-940994. html]. A backdoor is a piece of software or hardware that allows attackers to gain access to the electronic device or an otherwise protected function of a computer program by bypassing normal access protection.

Attacks on electronic devices not only take place during the operation of the devices, but especially during transport along the supply chain. In addition to devices from the entertainment industry, this also applies in particular to devices used in industrial, public and safety-critical infrastructures. In the case of the latter in particular, strict security requirements exist in Germany, for example, by the legislator to prevent manipulation of the devices along the supply chain.

• P1 - Produktion und Lagerung beim Hersteller,
• P2 - Transport zum Messstellenbetreiber,
• P3 - Lagerung beim Messstellenbetreiber,
• P4 - Transport zum Montageort,
• P5 - Montage beim Letztverbraucher.

For example, the document "SiLKe - The secure supply chain for BSI-compliant SMGW transport" [Sagemcom, SiLKe - The secure supply chain for BSI-compliant SMGW transport from Sagemcom Dr. Neuhaus 1v2, BSI (Federal Office for Information Security)-compliant SMGW (SmartMeterGateWay) delivery secured by a supply chain divided into five phases, each phase employing dedicated devices and procedures to protect:

• P1 - production and storage at the manufacturer,
• P2 - transport to the meter operator,
• P3 - storage at the meter operator,
• P4 - transport to the assembly site,
• P5 - Assembly at the end consumer.

Specific requirements are described for each phase. Manufacturers and operators are required by the BSI to take strict security precautions throughout the device life cycle. For safe delivery, safe installation and safe operation, a great deal of effort must therefore be expended in order to meet the requirements. This applies in particular to the training of the respective staff (Simon - Safe Fitter). All in all, the fulfillment of the requirements in the individual phases results in high costs.

State of the art

Approaches are known from the prior art which are intended to prevent and/or detect manipulations in the company and along the supply chain.

This is how the pamphlet describes it EP 2869241 A2 for example a method that identifies and authenticates physical objects using digital fingerprints. Digital fingerprints are based on at least a portion of an object and can be used to better track a variety of objects along the distribution chain and help detect unauthorized changes. Scanners are suggested there for creating the digital fingerprints. The digital fingerprint is then formed from the photo (recording) of a part of the object generated by an external scanner. The procedure is used for official documents, e.g. ID cards as proof of identity. However, similar methods have also been proposed for the identification of weapons and other objects.

In the pamphlet U.S. 2011/0099117 A1 the general principle of a physically unclonable function (PUF) is described. Using a PUF pattern, the influencing of an object by changing the PUF pattern should be determined. In particular, the improper handling or manipulation between the production site and the place of use of the item is to be determined in this way.

The pamphlet US9071446B2 describes a method in which such a PUF pattern is put to practical use. There, a chip or the inner semiconductor module of a chip is protected by a PUF cover. This unique shell is produced in Manufacturing/Fabrication and is irrevocably attached to the Semiconductor Module. If this shell is manipulated in order to gain physical access to the chip, this can be recognized by comparing it with an initial measurement. The chip can then render itself unusable. Such a PUF cover can only be produced and attached at great expense with the necessary equipment. In addition, once the PUF shell has been tampered with, the system is unrecoverable. Therefore it is suitable in the US9071446B2 The method described only applies to individual computer chips and is therefore unsuitable for protecting entire systems with multiple chips and other components.

PUF applications at the system level - not just for protecting individual chips or circuit boards - have already been presented by the inventors of the present application [C. Zenger, D. Holin, and L. Steinschulte, "Enclosure-PUF, Tamper Proofing Commodity Hardware and other Applications," https://media.ccc.de/v/35c3-9611-enclosure-puf, 29 December 2018] . The general disadvantage of PUFs is that this method puts the protection goal of confidentiality ahead of that of availability. This means that the system is immediately unusable in the event of a false positive manipulation detection. To counteract this, the pamphlet DE10 2017 114 010 A1 introduced a reinitializable system-level PUF. However, both methods are not robust to legitimate changes over time, e.g. torsion during installation/installation/packaging of the device or changes in the operating and transport environment due to temperature or vibration. For stabilization, the above-mentioned methods require increased requirements, e.g. on the adequate inner packaging (and the solid fixation) and adequate outer packaging (and the stable closure) as well as special requirements on the packaging, transport and shipping process (reduced mechanical and climatic stresses, reduced maximum acceleration, reduced maximum fall height, etc.). Drop tests such as those described in DIN EN 22248 (height and direction of drop according to the UPS package standard) often lead to false-positive manipulation detection.

task

The aim of the present invention is to ensure a legally compliant implementation of physical IT security goals when using (transport, delivery, installation and operation) electronic devices with housings with any degree of protection. By achieving these IT security goals, the probability of success of the attack should be significantly reduced and attacks should be warded off and recognized as completely as possible. The security goals achieved are intended to guarantee a security standard that is equivalent to the BSI certifications for secure supply chains, as they are known, for example, in the context of the Smart Meter Gateway (SMGW). This should make it possible to use electronic devices for all applications that are safety-critical and therefore have to meet high safety goals. Accordingly, the invention can be used in almost every IoT application, starting with regulated metering points such as electricity meters and SMGWs, but also in non-regulated applications such as Industry 4.0, telemedicine or smart city applications.

It is therefore the object of the invention to provide a method for the automated and simplified control and verification of electronic devices with regard to manipulations or other changes provide, in which the aforementioned security goals are achieved both for the supply chain and for the operation and requirements for existing measures (control procedures, process structures, personnel expenses, devices, etc.) can be significantly reduced. In particular, the aim of the invention is to distinguish legitimate changes from illegitimate attempts at manipulation.

• - mindestens ein Sensor und die Datenverarbeitungseinheit als Bestandteil in oder an dem Gerät integriert werden,
• - wobei ein Teilbereich des Geräts mittels des Sensors vermessen wird und aus den Messdaten ein erster elektronischer Nachweis erstellt wird,
• - ein Anbieter des Geräts einem Nachweissystem direkt oder über einen Abnehmer des Geräts den ersten elektronischen Nachweis (S1) des initialen Zustands des mindestens einen Teilbereichs des Geräts (E) zur Verfügung stellt,
• - durch das Nachweissystem aus dem ersten elektronischen Nachweis, einem Basismodel und einem Trainingsalgorithmus ein Model erstellt wird
• - der Teilbereich des Geräts mittels des Sensors durch Triggern des Geräts mindestens ein zweites Mal vermessen wird, wobei aus den gewonnenen Messdaten mittels der Datenverarbeitungseinheit mindestens ein zweiter elektronischer Nachweis des aktuellen physischen Zustands des Teilbereichs des Geräts erzeugt wird und dem Nachweissystem zur Verfügung gestellt wird,
• - mittels des Nachweissystems ein elektronisches Testat anhand des Models, des mindestens zweiten elektronischen Nachweises und durch einen Entscheidungsalgorithmus erstellt wird.

To solve this problem, the invention, based on a method of the type mentioned at the outset, proposes that

• - at least one sensor and the data processing unit are integrated as components in or on the device,
• - whereby a part of the device is measured by the sensor and a first electronic proof is created from the measurement data,
• - a provider of the device provides a verification system directly or via a buyer of the device with the first electronic verification (S1) of the initial state of the at least one partial area of the device (E),
• - A model is created by the verification system from the first electronic verification, a base model and a training algorithm
• - the partial area of the device is measured at least a second time by means of the sensor by triggering the device, with at least a second electronic verification of the current physical state of the partial area of the device being generated from the measurement data obtained using the data processing unit and being made available to the verification system,
• - using the verification system, an electronic attestation is created using the model, the at least second electronic verification and a decision algorithm.

When using an active sensor and a data processing unit for devices with housings of any type of protection, the teaching of the invention enables cost-effective and time-saving production and at the same time the achievement of strong physical IT security goals.

As used in this document, a device is a 3D space that needs to be protected from tampering attempts. The space can also be viewed as an electronic volume, such as an embedded module with multiple chips, that needs to be protected from the attacker's tampering attempts.

An acoustic (ultrasonic) or electromagnetic (wireless sensor, radar sensor) sensor is preferably used. For example, a pilot signal can be used to measure mechanical or electromagnetic changes. Chips with wireless sensing and radar methods, e.g. Ultra Wide Band (UWB) chips, Continuous Wave (CW) chips, MIMO Frequency-Modulated Continuous Wave (FMCW) chips, or chips with Channel Probing methods, e.g Methods based on pilot signal, orthogonal frequency division multiplexing (OFDM) or continuous tone exchange can be used. It is advantageous to position the radiometric sensor as centrally as possible in the product.

However, it is also conceivable to use other sensors, for example mechanical (switches, microswitches), optical (photosensitive sensors), radiation-sensitive (radiation sensors, piezoelectric, pressure sensors, acceleration sensors), thermoelectric (temperature sensors), capacitive (acceleration sensors, barometers, humidity sensors, position sensors), magnetic (Hall sensors, Hall effect switches), piezoelectric (piezoelectric switches, ultrasonic sensors, pressure contacts), chemical (bleeding material) sensors or combinations thereof (surface plasom sensor, anti-drilling film).

The first electronic proof can be part of an electronic administrative document (e-AD) or delivery note from the provider (cf. https://ec.europa.eu/taxation_customs/taxation-1/excise-duties/excisemovement-control-system.de) . Whereby the user may not request the proof a priori and not specifically, but receive it automatically as part of the product purchase/product rental/product procurement.

The provider of the device can be, for example, the manufacturer, seller or other service provider. The user of the device can be an end customer, an intermediary, a supplier or other participant along the supply chain who is arranged along the supply chain behind the provider. In special cases, the provider can also be the purchaser of the device E at the same time, albeit in a different function. For example, an energy supplier can set up and equip a charging station as a provider and then operate the charging station as a customer.

The first electronic proof of the original condition of the device has significant advantages over electronic identification (eID) or a visual inspection. On the one hand, the provider is in able to verify the integrity or to detect changes or manipulations within the latently unsafe supply chain or the latently unsafe real operation. On the other hand, in the event of a compromise by the provider, the user can prove this and the provider cannot simply reject it or refer to the latently insecure supply chain in general.

A machine learning-based approach is proposed to detect legitimate states and anomalies/manipulations. For example, the data points of the first electronic credential can be divided into a number of legitimate state groups such that data points in the same state groups are more similar to other data points in the same state groups than to those in other state groups. In this way, new data points from the second electronic verification can be related to the status groups. Data points from a non-tampered device would be assignable to one or more status groups due to their similar characteristics. While data points of a manipulated device are outside the status groups.

A model is a statistical representation of a prediction task. A model is trained (or learned) using sample data. The model is then used to make predictions. As used in this document, sample data is electronic evidence. In claim 1, the electronic evidence includes the example data.

As used in this document, training algorithms are the methods and procedures used to learn models. Semi-supervised learning and unsupervised learning methods are particularly well suited to learning a model, for example K-means, K-Medoids, Fuzzy C-Means, Hierachical, Gaussian Mixture, Hidden Markov Model and Neural Networks.

The training algorithm can, but does not have to, receive further knowledge/information as input in addition to the example data. In the language of this document, this knowledge (whether present or not) is represented by the basic model. This means that the model can also be empty (iteration 0). The paradigm used is called transfer learning in specialist circles.

The model is applied. As used in this document, the decision algorithm corresponds to the methods and procedures for applying models and creating electronic attestations. The decision algorithm receives the learned model and new data points (from the second or further electronic proof) as input.

At the customer, at least a partial area of the device is measured using the sensor and by triggering the device. The measurement can be triggered via local or remote-controlled interfaces, e.g. by energizing, exceeding a threshold value of another sensor value, by a clock (periodic, cyclic, random) or other device triggers.

At least a second electronic proof of the current physical state of the partial area of the device is generated from the measurement data obtained by means of the data processing unit. The data processing unit can also be an integral part of the device, for example for processing application-related data, for example electricity meter readings.

The second electronic proof of the current status of the device has significant advantages over sensors that are permanently active to detect attempts at manipulation, because these require an additional backup battery, which increases costs and system complexity. Nevertheless, the device can validate freedom from manipulation and/or authenticity in real time and automatically. Depending on the application, validation cycles are every minute, hourly, daily or even monthly. The physical IT security can be checked before, during and after commissioning, i.e. also during live operation, on request or automatically.

The second electronic proof of the current status of the device, e.g. by sensors, which in turn makes the physical disorder of the electronic device machine-readable, also has significant advantages over classic seals. Seals are applied from the outside and are intended for manual visual verification. However, relevant studies (cf. Roger Johnston, "Tamper Indicating Seals: Practices, Problems, and Standards" 2003) summarize that although tamper-indicating seals play an important role, the currently available tamper-indicating seals can be counterfeited quickly and easily without expert knowledge. More reliable tamper detection is only possible with greatly improved training for installers and testers and better seals.

Furthermore, the method according to the invention provides that an electronic attestation is automatically issued on the basis of the first and at least the second electronic proof and by an Ent algorithm is created in the detection system.

By providing the attestation method according to the invention, the requirements set by the legislature for the secure supply chain and the secure operation of sovereign technologies are made possible. The protection goals of the protection methods that can be implemented by the invention are prescribed by the security catalog of the Telecommunications Act, the IT Security Act 2.0 and the Common Criteria (e.g. of the SMGWs) and thus represent an essential aspect for the market launch of 5G components, SMGWs, telematics infrastructure (health network ) and generally more secure IoT applications and operational technology (OT) in the area of critical information and communication infrastructures.

In the prior art, there are already approaches to protecting electronic devices (of any degree of protection) from manipulation by means of secure supply chains. These reveal measures (control procedures, process structures, devices, etc.) to reduce risks on the transport route, in the warehouse and during the transfer of risk.

In contrast to the known method (cf. EP 2869241 A2 ) the fully automated and electronic use of one or more control features along an entire supply chain and/or during operations, which not only includes identity, but also information on physical IT security and authenticity.

The method according to the invention is also characterized in that the sensors used, which measure at least a partial area of the device, are an integral part of the device. This reduces the requirements for the reproducible alignment of the sensors. However, additional hardware and manufacturing complexity is required, resulting in higher manufacturing costs. At the same time, however, it solves the above-mentioned challenges of supply chain security and any operational security. Existing process costs—in particular along a supply chain and/or when operating electronic devices—can be saved by the method according to the invention. The savings far outweigh the additional manufacturing costs.

The data processing unit generates a first electronic verification from the measurement data measured by the sensor. This information is generated, for example, by active sensors, which in turn make the physically unique disorder of tolerance-prone physical objects and materials of the electronic device machine-readable. The decisive factor is that the sensors can measure stationary states of the electronics, the housing or other materials of the device with sufficient high resolution, for example to detect meso- or macroscopic changes (e.g. in the electronics) caused by a housing opening that have taken place between two measurements have to recognize. Elaborate experiments and simulations by the applicant have shown that ultrasonic sensors, electromagnetic sensors or Hall sensors are suitable as soon as they have a sufficiently large spectral bandwidth.

The sensors thus measure parts of the sensor operating environment. This is arranged inside the housing interior, i.e. the closed system/hardware platform/module/etc. The sensors also measure (intentionally or unintentionally) parts of the device operating environment and the enveloping or partially enveloping housing. The measured sensor values usually vary depending on environmental influences.

The method according to the invention is characterized in that it significantly reduces the requirements for the manufacture of the housing (or the manufacture of the protective mechanism such as the multiple layers of conductor tracks, etc.) and the need for a seal. The important thing to note here is that each dimension (position, hole size, angle, etc.) must have a tolerance. Tolerance in part dimensions is required because manufacturing techniques do not produce perfect parts. The actual amount of tolerance is based on some (competing) factors such as cost and interchangeability of the parts, where the mating of different parts must work even with the extremes of their tolerances. From an information-theoretical point of view, an electronic device therefore represents a unique disorder of physical objects subject to tolerances. Due to the machine-readability of the physical disorder by means of sensors and the creation of a unique digital fingerprint (e.g. the radiometric profile dependent on the housing and housing interior), it is possible to constructively use the inherent properties of the component tolerances in order to evaluate or verify the physical IT security. The uniqueness of the electronic evidence of the three-dimensional electronic device makes it particularly difficult to counterfeit.

A preferred embodiment of the invention provides that the base model is a pre-trained machine learning model that was generated by data from at least one macro come from a device model that is scopically identical or similar. In this way, a predetermined device model, which, for example, except for the manufacturer tolerances, is structurally identical to the device used, can be measured under different environmental conditions—for example, in a thermal or pressure chamber. This allows example data to be collected and changes in the measurement results to be determined and evaluated. These changes may well be legitimate changes due to environmental and/or operational conditions. The pre-trained basic model is learned on the basis of this sample data. By using a pre-trained machine learning model, it is possible to distinguish legitimate from illegitimate changes and thus significantly reduce the number of false positive manipulation detections.

A development of the invention provides that current data is recorded with repeated measurements of the at least one partial area and a current model is generated on the basis of a model, the current data and the training algorithm and/or a current model is generated on the basis of a model, data and the decision algorithm Attestation of the state is generated. This enables the current status to be checked regularly, taking into account changing environmental conditions and in particular taking into account signs of wear and aging. Due to the regular measurement of the sub-area and the comparison with the last valid data and models, the environmental and aging-related changed measurement data do not lead to a false-positive manipulation detection.

It is advantageous if the first electronic verification is based on a series of measurements that are sequenced over time. This is because the full potential of the invention can only be used with sample data that captures the legitimate system states as comprehensively as possible. For example, the boot process of an electronic charging station consists of a series of legitimate system states. According to the development of the method according to the invention, it is therefore proposed to record the system states using a time series of example data. Now, if the system crashes while booting, this condition can be detected and dealt with.

It is also useful if the housing or sub-components are covered with conductive material. As a result of this measure, the electromagnetic properties of the housing change even with minor changes through manipulation. In addition, the reflection behavior improves and the resolution of changes within the housing is increased. When designing the disguise, care can be taken to ensure that areas in which legitimate changes are made are disguised differently than those in which illegitimate manipulations are more likely. As a result, the number of false-positive manipulation detections can be further reduced.

A further development of the method according to the invention provides that the attestation is stored in the verification system in accordance with the ascertained state of integrity, freedom from manipulation and/or authenticity. This is beneficial because it allows for more transparent and accurate end-to-end tracking in the supply chain. Proper active operation can also be verified completely. For the first time, an electronic real-time check of the device is possible. For example, the manual checking of seals can be omitted. The verification system can store the certificates in a database and/or in a block chain.

The certificates can be released in the form of a binding declaration in the verification system. In the language of this document, binding declarations are, in particular, electronic evidence based on cryptographic processes that are considered secure and non-repudiation. Examples of this are digital signatures, secure databases (e.g. multi-party), blockchain, smart contracts, etc.

This is advantageous because, for example, with a digital and cryptographically secure signature of the attestation, business processes can be further automated, digitized and verifications can be obtained at any time, regardless of time and location. In addition, the contracting parties (supplier and buyer) do not have to trust each other in order to conclude agreements on the basis of the attestations. The binding declaration contains the stated conditions that ensure that all partners are on an equal footing.

The method steps are particularly preferably carried out at regular or sporadic intervals or randomly, and further electronic evidence is thus generated in each case. This is advantageous because a time stamp can be assigned to the electronic evidence or the corresponding certificates. A change in system status (e.g. manipulation) can in turn be assigned to a section of the supply chain using the time stamp and, for example, tracking information from packages. Sporadic or random intervals can also significantly reduce battery/power requirements with only a small reduction in security levels.

In the method according to the invention, secret cryptographic material can advantageously be made available to the device. An extension provides that the verification system automatically makes cryptographic material available to the manipulation-free device (i.e. after successful certification of freedom from manipulation and/or authenticity). For example, symmetric keys, asymmetric keys, certificates, parameters and trust anchors established by cryptographic protocols. This is advantageous because such secret information is only available in the devices when absolutely necessary.

The device is particularly preferably equipped with a radio or other data interface. This can be used to trigger the device to carry out the process remotely via a cloud application or similar.

According to an advantageous development of the method according to the invention, the first electronic verification is reinitialized. This makes it possible, after legitimate maintenance or the like, to create a new initial electronic record by reinitializing the system.

In addition, it is advantageous if the temperature of the device is recorded and the measured temperature is taken into account when measuring the device and thus when generating the second electronic verification and/or the additional electronic verifications. An additional temperature sensor can be arranged in the device for this purpose. By capturing the temperature of the device, it is possible to take temperature-related changes into account when performing the check.

• 1: schematisch ein Ablaufdiagramm des erfindungsgemäßen Verfahrens in einer ersten Ausführungsform;
• 2: schematisch ein Ablaufdiagramm des erfindungsgemäßen Verfahrens in einer zweiten Ausführungsform;
• 3a: schematisch ein Ablaufdiagramm des erfindungsgemäßen Verfahrens in einer dritten Ausführungsform;
• 3b: schematisch ein Ablaufdiagramm des erfindungsgemäßen Verfahrens in der dritten Ausführungsform aus 3a in verallgemeinerter Form;
• 4a-c: schematisch drei Anwendungsfälle eines erfindungsgemäßen Verfahrens;
• 5a: schematisch ein Gerät mit einer Datenverarbeitungseinheit, einem Speicher und einem Kommunikationsmodul;
• 5b-5d: schematisch das Gerät aus 5a mit Erweiterungen zur Durchführung des erfindungsgemäßen Verfahrens;
• 6a: schematisch ein unmanipuliertes Gerät;
• 6b-d: das Gerät aus 6a in unterschiedlicher Weise manipuliert;
• 7: schematisch einen zeitlich aufgelösten Testatsverlauf;
• 8a-b: jeweils ein Ausführungsbeispiel des erfindungsgemäßen Verfahrens anhand einer Lieferkette.

The invention is explained in more detail below with reference to the drawings. Show it:

• 1 : a schematic flowchart of the method according to the invention in a first embodiment;
• 2 : a schematic flowchart of the method according to the invention in a second embodiment;
• 3a : a schematic flowchart of the method according to the invention in a third embodiment;
• 3b : schematically shows a flowchart of the method according to the invention in the third embodiment 3a in generalized form;
• 4a-c : schematically three applications of a method according to the invention;
• 5a : schematically a device with a data processing unit, a memory and a communication module;
• 5b-5d : schematically the device off 5a with extensions for carrying out the method according to the invention;
• 6a : schematic of an unmanipulated device;
• 6b-d : the device off 6a manipulated in different ways;
• 7 : Schematic of a chronologically resolved course of the attestation;
• 8a-b : each an embodiment of the method according to the invention based on a supply chain.

1 shows a flowchart of a method according to the invention. A device E is located at a provider of the device E. A data processing unit C and a sensor P are arranged in the device E, with the data processing unit C and the sensor P being communicatively connected. In addition, the device E has a housing G. The housing G can completely or only partially enclose the device E. Further components can also be arranged in the device E, such as fans, further sensors, a display or the like. The sensor P is, for example, a chip with wireless sensing. The volume of the device E can vary depending on the application. In very large application examples, it can be an entire freight container (e.g. as the housing of a mini power plant), a local network station, an electric charging station, an ATM or a slot machine; in a smaller exemplary embodiment, it can be a component of medical telematics, a gateway or an energy/water meter.

The device E is measured by means of the sensor P. The measured values are transmitted to the data processing unit C and a first electronic record S1 is created from the measured values. The first electronic proof S1 is transmitted to a proof system N. The verification system is usually operated by a third party service provider, but can also be located directly with a provider H of the device E or with a buyer D of the device E.

Provider H brings device E to customer D. Provider H within the meaning of the invention can usually be the manufacturer. In principle, however, it is true that any participant in a supply chain who is arranged before the customer D can be a supplier H within the meaning of the invention, ie for example also the warehouse operator or the supplier. In special cases, the provider H can also be the buyer D of the device E, but each in a different function. For example, an energy supplier as supplier H can set up and equip a charging station and then operate the charging station as customer D.

In the verification system N, a model M1 is created from the first electronic verification S1, a base model M0 and a training algorithm A.

The device E is triggered at the pickup D, whereupon the device E is measured again by means of the sensor P. A second electronic proof S2 of the current state of the device E is created by means of the data processing unit C from the measurement data obtained. The second electronic proof S2 is transmitted to the proof system N. In the verification system N, an electronic certificate T1 is created using the model M1, the second electronic verification S2 and a decision algorithm, which confirms that the device E is in a tamper-free state.

2 shows a further development of the method according to the invention. In this case, an additional process step is required. To generate the basic model M0, a device E0 of the same device class or the same device type, which is macroscopically identical, is measured by a large number of measurements using the sensor P under different operating and environmental conditions, for example under different temperature, pressure or humidity conditions. The base model M0 is created in the verification system N from the measurement data S0 obtained in this way and the training algorithm A. Due to the preceding method step, legitimate influences due to various operating and environmental conditions can be taken into account and thus false-positive manipulation detections can be avoided.

In the 3a a further embodiment of the method according to the invention is shown. A further step is planned here, in which, in addition to the preparation of the attestation T1 (cf. 1 or 2 ) a model M2 is created using the second electronic verification S2 and the training algorithm A in the verification system. The device E is then measured again and a third electronic verification S3 is generated from the measurement data. A further attestation T2 and a further model M3 can then be generated in an analogous manner by means of the third electronic verification S3 and the model M2.

In this way, new attestations and/or models can be created regularly or as required, as in 3b shown. In this way, legitimate changes due to wear and tear or the like can be taken into account, so that no false-positive manipulation detection takes place.

4a-4c show three different applications of the method according to the invention. In all cases, a basic model M0 is first trained in the verification system with a macroscopically identical device type E0 (cf. 2 ). At the provider H, the individual device E is measured and a first electronic verification S1 is generated from the measurement data and then made available to the verification system. A model M1 is generated in the verification system using the base model M0 and the first electronic verification S1. The device E is then delivered by the provider H to the customer D. At the consumer H, a second electronic proof S2 is created by re-measuring the device E and then made available to the proof system N. On the basis of the second electronic proof S2 and the model M1, an electronic certificate T1 is created with the aid of a decision algorithm and then made available to the customer D and/or the provider H. In this way, the freedom from manipulation of the device E is attested to the provider H and/or the buyer D.

The use case in 4b differs from that 4a in that the provider H provides the customer D with the electronic proof S1. After the device E has been measured at the customer D, the first and second electronic evidence S1, S2 is made available to the evidence system N. The attestation of the freedom from manipulation of the device E is then carried out analogously to the use case in 4a .

4c shows an application in which the provider H is also the customer D at the same time. This can be the case, for example, with an energy supplier who provides and equips a charging station as provider H and then operates it as customer D. Further examples are operators of existing machines that are retrofitted with the appropriate hardware in order to be able to use the method according to the invention. The procedure largely corresponds to that 4b .

In 5a a device is shown schematically, as is known from the prior art. The space inside the case G can be considered as an electronic volume containing a device E in the form of a simple embedded module with several chips (computing unit C0, memory C1, communication C2,) and circuit traces K1,K2, placed in front of the manipula Attempts by the attacker must be protected.

In 5b Schematically shows the device E from Figure 5a, which has been extended by an exemplary design of the present invention. The space inside the housing G can still be viewed as an electronic volume that must be protected from the attacker's attempts at manipulation. In this design, a chip P1 capable of wireless sensing was added as a sensor and connected to the data processing unit C0 by means of an additional conductor track K3.

In 5c FIG. 5a shows schematically the device of FIG. 5a, which has been extended by an exemplary embodiment of the present invention. The space inside the housing (G) can still be viewed as an electronic volume that must be protected from the attacker's attempts at manipulation. In this design, two chips capable of wireless sensing (C3 and C4) were added as sensors and each connected to the data processing unit C0 by means of an additional conductor track K3, K4. The larger the volume, the more chips capable of wireless sensing are required. A redundant design can also be advantageous for the purpose of increased resolution.

In 5d the device E is schematically off 5a shown, which was expanded by an exemplary embodiment of the present invention. The space inside the housing G can still be viewed as an electronic volume that must be protected from the attacker's attempts at manipulation. In this design, the data processing unit C has been replaced by a wireless sensing-capable data processing unit CP, which also serves as a sensor P.

In 6a is a non-manipulated device E according to schematic 5b shown, which measures the electronic volume electromagnetically using near-field energy W to generate electronic evidence. The space inside the housing G can be viewed as an electronic volume containing a simple embedded module with multiple chips (computing unit C0, memory chip C1, communication module C2, wireless sensing chip (P)) and conductive traces K1, K2, K3. The measurement result and the electronic proof are based on the oscillating near-field energy W, which in turn is influenced by the chips C0-C2, the sensor P itself, the conductor tracks K1-K3 and the housing G.

In 6b a manipulated device E according to FIG. 6a is shown schematically, which measures the electronic volume electromagnetically in order to generate electronic evidence. The space inside the housing G can be viewed as an electronic volume containing a simple embedded module with multiple chips (computing unit C0, communication module C2, wireless sensing chip P) and conductive traces K1, K2, K3. Because the memory chip C1 off 6a was replaced by another memory chip C1′, the measurement result and the electronic proof change, so that manipulation is detected by means of the proof system.

In 6c a further manipulated device E according to FIG. 6a is shown schematically, which measures the electronic volume electromagnetically in order to generate electronic evidence. The space inside the housing G can be viewed as an electronic volume containing a simple embedded module with multiple chips (computing unit C0, memory C1, communication module C2, wireless sensing chip P) and conductive traces (K1, K2, K3). Because the memory chip C1 off 6a has been replaced by another memory chip C1' and/or has been supplemented by a further chip (C4), the measurement result and the electronic proof change, so that manipulation is detected by means of the proof system.

In 6d is a schematic of another manipulated device E after 6a shown, which measures the electronic volume electromagnetically to generate electronic evidence. The space inside the housing G can be considered as an electronic volume containing a simple embedded module with several chips (computing unit C0, memory C1, communication module C2, wireless sensing chip P) and conductive traces K1, K2, K3. The fact that cables K4, K5, K6 are connected to the chip C1 changes the measurement result and the electronic verification, so that a manipulation is detected by the verification system.

According to the invention, the detection system can use the base model and the training and decision-making algorithm to distinguish legitimate changes from manipulation attempts by an attacker. 7 shows a schematic of a test attestation broken down over time. False positive manipulations are detected due to an insufficiently robust model (above). These may have been caused, for example, by a temporary drop in temperature. False positive manipulation detections can be prevented by teaching the basic model M0 and/or by further training the models.

8a shows schematically a time sequence along a supply chain of the device E up to active operation. The measurement of the device E is triggered in order to generate an electronic record from the measurement data. The triggering is initiated by energizing, additional sensors, predetermined software states or suitable measures. For example, the first electronic proof S1 can be created after assembly, the second electronic proof S2 after installation or receipt of goods, and the third electronic proof S3 during the regular or other review of the guarantee. A manipulation can only be detected between two proofs. In this application example, no battery is required.

8b shows a schematic of a chronological sequence of the location of the device E via the various links in the supply chain up to active operation. The electronic certificates (S1, S2, S3, S4, S5) are created at regular intervals after installation. The verifications (S1, S2, S3, S4, S5) are sent to the verification system N when the connection is available. In the offline case, these are temporarily stored in the device E. Manipulation can be detected between two pieces of evidence and thus assigned to the supply chain section. A battery is required in this application example.

Reference List

A

training algorithm

B

decision algorithm

C

data processing unit

D

customer

E

Device

G

Housing

H

Offerer

M

model

N

detection system

P

sensor

S

electronic proof

T

attestation

CP

Data processing unit with sensor

K

trace/cable

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• EP 2869241 A2 [0008, 0034]
• US 2011/0099117 A1 [0009]
• US 9071446 B2 [0010]
• DE 102017114010 A1 [0011]

Claims (13)

Method for automatically carrying out physical checks along a supply chain and/or when operating electronic devices (E), in particular for automatically collecting evidence of integrity, freedom from manipulation and/or authenticity, - the device (E) having a housing (G) and - has a data processing unit (C, CP) arranged in the housing (G) as an integral part, - and at least one sensor (P, CP) is communicatively connected to the data processing unit (C, CP), characterized in that - the sensor ( C, CP) and the data processing unit (C, CP) are integrated as a component in or on the device (E), - with a portion of the device (E) being measured by the sensor (P, CP) and a first one from the measurement data electronic proof (S1) is created, - a provider (H) of the device (E) provides a proof system (N) directly or via a buyer (D) of the device (E) with the first electronic proof (S1) of the initial state of the at least one Section of the device (E) is available, - a model (M1) is created by the verification system (N) from the first electronic verification (S1), a base model (M0) and a training algorithm (A) - the section of the device ( E) is measured at least a second time by means of the sensor (P, CP) by triggering the device (E), whereby at least a second electronic proof (S2) of the current physical condition of the partial area of the device (E) is generated and made available to the verification system, - by means of the verification system (N) an electronic certificate (T1) based on the model (M1), the at least second electronic verification (S2) and by a decision algorithm (B ) is created. procedure after claim 1 , characterized in that - the base model (M0) is a pre-trained machine learning model that was generated by measurement data (S0) that originate from at least one device model (E0) that is macroscopically identical or similar. Method according to one of the preceding claims, characterized in that - current electronic evidence (S _i+1 ) is recorded with repeated measurements of the at least one partial area and on the basis of a current model (M _i ), the current data (S _i+1 ) and the training algorithm (A) - a new model (M _i+1 ) is generated - and/or based on a model (Mi), data (S _i+1 ) and the decision algorithm (B) a current certificate (T _i ) of the state is generated. Method according to one of the preceding claims, characterized in that - the first electronic verification (S1) is based on a chronologically sequenced series of measurements. Method according to one of the preceding claims, characterized in that - the housing (G) is covered with conductive material. Method according to one of the preceding claims, characterized in that - the attestations (T1, T2, ..., T _i ) are stored in the verification system in accordance with the ascertained state of integrity, freedom from manipulation and/or authenticity. Method according to one of the preceding claims, characterized in that - at least one certificate (T) is released in the form of a binding declaration in the verification system. Method according to one of the preceding claims, characterized in that - the method steps are carried out at regular or sporadic intervals or randomly and further electronic evidence (S _i ) is thus generated in each case. Method according to one of the preceding claims, characterized in that - secret cryptographic material is made available to the device (E). Procedure according to one of claims 3 - 9 , characterized in that - the model (M1) is adapted and/or updated by the second and/or further electronic evidence (S2, S _i ). Method according to one of the preceding claims, characterized in that - the device (E) has a radio interface and can be triggered via this to carry out the method and that - no battery is required. Method according to one of the preceding claims, characterized in that - the first electronic record (S1) is reinitialized. Method according to one of the preceding claims, characterized in that - the temperature of the device (G) is detected and the temperature measured when measuring the device (G) and thus when generating the second electronic proof (S2) and/or the others electronic evidence (S _i ) is taken into account.

Images