Embedded Metrological Systems

Working Group 8.52

Profile

The working group focuses on IT security research for embedded metrological systems and supports
the working groups of the department that fulfill legal.

In particular, research topics are identified on the basis of economically relevant technological developments,
focussing on basic technologies that are drivers of whole technology fields.

A main task is the development and application of the necessary test environments as well as their continuous development and maintenance.

Other tasks are:

Supporting Group 9.3 (International Cooperation),
Representating the PTB in DIN committees (Software Engineering),
Developing reference architectures in the context of the technology transfer for SME promotion.

To top

Research/Development

A Reference Architecture for Secure Embedded Systems

Using microkernels to securely encapsulate software into modules

Measuring instruments often use large standard operating systems as their software foundation.

These operating systems hinder software testing because they contain numerous "bugs".

A new software reference architecture developed at the PTB makes use of the benefits standard operating systems have, such as the greater functionality, a familiar user interface and many drivers, but still ensures security due to the encapsulation and modularization of the software.

This configurable software reference architecture is based on a microkernel.

The microkernel is software that runs on the lowest level, under the actual operating systems.

These operating systems in turn, are encapsulated into modules, so-called virtual machine (VM).

The operating systems can continue to load their usual programs and drivers, but are obligated to communicate via the microkernel with each other and the hardware.

The system architecture is based on a modular design that fulfils the requirements of the Measuring Instruments Directive of the European Union (MID) and the WELMEC 7.2 Software Guides.

These can be seen in the figure and are as follows: displaying data (Secure GUI), data protection (Key & Signature Manager), storing data (Storage Manager), executing downloads (Download Manager), transferring data (Connection Manager), and internal data processing (Communication Monitor).

Hence, the reference architecture ensures that all legally relevant measurement functions can be monitored safely.

In addition, the architecture separates non-legally relevant software (N) and legally relevant software (L). All calculations that fall under legal control are carried out in the L-VM, everything else in the N-VM.

This strict separation ensures that legally relevant software is not irregularly affected.

Fig.: Communication between the individual modules within the system architecture

The project will be continued in cooperation with the Technical University of Berlin, which is developing a new microkernel that will be mathematically formally verified, showing that typical operating system vulnerabilities are not present.

This is important for instruments that need to judicially prove their correctness (e.g. traffic enforcement cameras).

With this microkernel, the proposed framework has been implemented on a demonstrator.

These measuring instruments are a medical device and a traffic enforcement camera.

Contact

Dr. Ing. Daniel Peters

Department 8.5 Metrological Information Technology

Phone: +49 (0)30 3481-7916

EMail: daniel.peters@ptb.de

Scientific Publications

Dr. Daniel Peters: Patents and Publications

Patents (German):

Publications

Blockchain

Software-controlled measuring devices (such as smart meters) use modern technologies that are more complicated and raise several security issues in all countries.

The widespread deployment of smart meters in complex situation makes these challenges more significant.

We propose a Public-Key Infrastructure (PKI) based on blockchain technology and describe how to customize it to handle specific difficulties with protecting smart meters.

Digital signature is one of the major purposes of public-key cryptography.

The results show the effectiveness of our strategy and provide a strong framework for managing digital certificates.

Talking about a blockchain made up of just one single node is irrational.

A blockchain network requires a set of peers, or machines, which are given by the various organizations that integrate it.

Therefore, we now enhance the research for systems using multiple hosts by connecting several National Metrology Institutes (NMIs) to the blockchain network.

We seek to eliminate a single point of failure and increase the number of hosts in the network. Peer nodes boost the transaction rate while reducing reliance on a single peer node.

The blockchain network's transaction rate is undoubtedly increased with more endorser peers, which permits transactions to be processed simultaneously from many NMI servers.

Our analysis of how to include other NMIs in this blockchain network is prompted by the outcomes of the inter-NMI blockchain network and the underlying metrology processes.

We implemented our inter-NMI blockchain network and proposal as a smart contract using the Hyperledger Fabric platform. Currently, the implementation integrates servers and nodes from:

• Physikalisch-Technische Bundesanstalt (PTB), Germany

• Czech Metrology Institute (CMI), Czech Republic

• National Institute of Metrology, Standardization, and Industrial Quality (INMETRO), Brazil

• National Metrology Institute of Japan (NMIJ), Japan

• National Metrology Institute of Malaysia (NMIM), Malaysia

We establish the blockchain network and give directions about managing our inter-NMI network’s eventual growth.

Figure: Inter-NMI Network

Contact

Mahbuba Moni

Fachbereich 8.5 Metrologische Informationstechnik

8.52 (Embedded Metrological Systems)

Telefon: (030) 3481-7066

E-Mail: mahbuba.moni(at)ptb.de

Scientific Publications

Secure and data-saving solutions for data analysis on conditionally trustworthy systems

Secure and data-saving solutions for data analysis on conditionally trustworthy systems

Digitization and increasing networking are also finding their way into metrology.

But in addition to numerous advantages, modern technologies are accompanied by new challenges, especially in the area of data protection.

While the classic encryption methods adequately secure the transport and storage of data, innovative solutions are required to also be able to process data on encrypted data.

For example, homomorphic encryption enables secure data evaluation in conditionally trustworthy systems.

Such a solution is particularly interesting in the context of distributed measuring devices.

With the help of functional encryption, a weighted accumulation of measured values can be realized without disclosing individual data sets.

SmartMeter in particular could benefit from such a solution.

A remote comparison of certain system parameters, such as the presence of a certain software version, can also be implemented securely and data-efficiently using cryptographic methods.

In this way, the Zero Knowledge Proof method makes it possible to compare two values without having to disclose the specific value.

Many of the methods mentioned are still relatively new and it is therefore particularly important to test the application of these methods today in order to be prepared for future challenges in metrology.

Contact

Artem Yurchenko

Fachbereich 8.5 Metrologische Informationstechnik

8.52 (Embedded Metrological Systems)

Telefon: (030) 3481-7015

E-Mail: artem.yurchenko(at)ptb.de

More Contact:

Robert Stojic

Fachbereich 8.5 Metrologische Informationstechnik

8.52 (Embedded Metrological Systems)

Telefon: (030) 3481-7211

E-Mail: robert.stojic(at)ptb.de

Dr. Ing. Daniel Peters

Fachbereich 8.5 Metrologische Informationstechnik

Telefon: (030) 3481-7916

E-Mail: daniel.peters(at)ptb.de

Scientific Publications

Technology transfer

Network security for communicative medical devices (NetMed)

The TransMeT cooperation project with Xiralite GmbH started in April 2017 and was finished March 2020 to develop a novel, secure system software architecture for the Xiralite® medical device of the same name, which is connected to the network.

Xiralite GmbH is the market and innovation leader for optical imaging in rheumatology and, with the Xiralite® X5, has created a fluorescence camera system that represents microcirculation in the hands in order to detect centers of inflammation.

For this purpose, the fluorescent dye indocyanine green, which is approved for microcirculation diagnostics in Europe, is incorporated during an examination.

The XiraView® diagnostic software controls the examination and assists in the subsequent evaluation.

The new software concept is based on a software reference architecture that has been researched and tested in Department 8.5 and uses separation or microkernels and virtualization techniques.

In order to adapt and further develop these for this special medical device, the risk analysis methods also developed in Department 8.5 were initially used and, together with the MPG, the BDSG, various DIN and FDA recommendations, new protection targets, threats and concrete attack vectors in the medical field were identified.

Based on the security analysis for the Xiralite® X5, a software system was selected with lower but sufficient security compared to the microkernel reference architecture, which considers handling and user friendliness for later use.

The developments are also intended to promote a later expansion of the device into the US market.

The basis of the software implementation is a Linux Ubuntu with poor functionality and therefore less susceptible to errors, including the latest security updates.

Xen is used as a hypervisor for establishing, controlling and monitoring two virtual machines.

One virtual machine is provided for legally relevant purposes such as the XiraView® diagnostic software and another for legally irrelevant purposes in order to update the software contained therein without re-certification.

In addition, intrinsic software security is established inside the legally relevant virtual machine through restrictions, guidelines, and rights management at operating system level.

UEFI uses Secure Boot, which guarantees a signed and authenticated, secure boot sequence until the virtual machines start.

By two 1 TB hard disks, which are organized to a RAID 1, mirroring of the non-removable disks, a high Resilienz of the system data and thus the later patient data as worth protecting good is reached.

A secured access from external serves as maintenance access and in a more restrictive variant with limited rights also as remote session for later training of the medical personnel and as remote diagnosis support services for physicians.

New method for validating measurement algorithms. Update without recertification.

Problem description

The advancing networking of measuring instruments not only holds numerous advantages, but also risks.

While the unauthorized software modification of devices without a network connection previously required a seal break, this is often not the case with networked devices.

The presence of a potentially exploitable programming error is already sufficient.

In view of the increasing complexity of the measuring devices, the probability of the presence of such an error also increases.

Similar to the physical seal that confirms the integrity of the hardware, the checksum for the software components therefore represents an integrity and authenticity feature.

The comparison of a checksum with the expected value thus enables the detection of a persistent software change, but many manipulations take place in volatile memory (RAM) and therefore cannot be detected by the checksum comparison.

In addition, the checksum calculation routine itself represents a point of attack whose manipulation can be used to hide the unauthorized changes to the persistent memory.

These examples show that the checksum methods offer only limited protection against possible software manipulations of the networked devices that are unwanted by the manufacturer.

A further problem is the software manipulation desired by the manufacturer, which includes updates, because even the slightest change to the persistent memory leads to a change in the checksum.

Since the checksum does not provide any information about the type of software change, a software update usually entails a recertification process.

One possible solution is software separation, the core idea of which involves separating the software into a legally relevant and a non-legally relevant part.

This makes it possible to allow updates of the non-legally relevant part without recertification, but the technical prerequisites for such a separation represent a major hurdle, especially for smaller measuring instruments.

Therefore, PTB conducts research on the development of alternative methods for software validation, which would allow updates without recertification.

The approach presented here is based on a logical separation of the measurement software into core and auxiliary algorithms. The core algorithms include the methods that are directly involved in the processing of the raw measurement data into a measurement result.

Solution Approach

In the first step, a meta-description of the core algorithm is generated, on the basis of which a mathematical proof is constructed in the next step.

The proof contains the complete logical description of the core algorithm without reference to a concrete implementation.

If, for example, the software is described without changing the logic of the core algorithm, the proof remains valid.

The proof itself is additionally secured by cryptographic methods and cannot be misused to reconstruct the core algorithm.

The application of a proof in connection with the raw sensor data and the result displayed by the measuring device leads to a binary statement as to whether the transformation of the raw measurement data into the measurement result strictly follows the rules of the core algorithm.

The great advantage of such a method over the checksums is its dynamic nature, so the evidence can be used to validate each individual measurement.

The second and most important advantage is that the use of evidence makes software updates possible without recirculation, thus significantly improving the security of networked systems.

To top

Services

We provide technical counseling for manufacturer, national metrology institutes, market surveillance authorities and all PTB’s departments specialized on the testing of the physical properties of the measuring instruments.

With this services the working group helps closing technology gaps and to support innovations.

Software Examination (DIN EN 12830):

The working group is concerned with preparing the software testing report based on DIN EN 12830 to check the suitability of the temperature recorder software in the context of verification processes in legal metrology.

The standard DIN EN 12830 specifies the technical and functional characteristics of temperature recording devices intended for the transport, storage and distribution of temperature sensitive goods.

Based on this standard, the working group generates the test reports by evaluating and consulting the improvement of the software documentation of the manufacturer.

Therefore, the test methods used to verify the suitability of the software depending on the temperature recorder design documentation and user documentation provided by the manufacturer.

The detailed checklist-based documentation review includes a series of steps – software identification to verifying the authenticity of measurement data stored.

Protection of Windows systems according to Welmec 7.2 requirements

Working Group 8.52 offers support and advice to manufacturers of Windows-based measuring instruments on questions relating to the requirements of the Welmec 7.2 software guide.

In addition, the working group has a self-developed and constantly extended reference implementation of a rights- and rule-based security architecture.

This can be used as a basis for new products that meet the requirements of Welmec 7.2, taking customer-specific requirements into account.

To top

Information

Scientific Publications

Patents (German):

Publications

Continuation

To top