DE102013014587A1 - Method for IT protection of security-relevant data and its processing - Google Patents

Abstract

A process for the IT protection of security-relevant data and its processing serves to prevent the spying and manipulation of security-relevant data and their processing. In essence, it is achieved by structurally structurally realized arrangement of microcontrollers, random source consisting of noise source and amplifier, nonvolatile memory, one of the subassemblies low pass, high pass, bandpass, bandstop, voltage divider, meandering conductor structures with individual tolerances on more than one inner level of a three-dimensional space , Dynamically random processing of program parts, dynamically random entry points for further program execution at an anticipated power interruption, random reading and writing of random data in random nonvolatilized memory located at different locations in three dimensional space, independently operating microcontrollers, dynamically randomized powering in randomly selected subarrays Random signals and random parameters ensure the IT protection of security-relevant data and their processing. Processing sequence, the data to be processed are never the same randomly, never recognizable and predictable.

Description

The present invention relates to a method for IT protection of security-relevant data and their processing in preferably embedded systems.

Prior art and background of the invention

Basic prerequisite for future IT technologies such as remote maintenance of systems, Internet freelancer development teams, product long-term tests with WLAN data transmission, Industry 4.0, cloud computing and more. a. m. Above all, it is the unmanipulable guarantee of relevant security objectives such as the authentication and authentication of persons and facilities, the protection of all kinds of data, the protection of communications, file and folder protection.

DE 10 2008 010 788 is a "method for authentication and authentication of persons and entities" published. Authentication and authentication of a person or entity is by person or entity identifying data, and inter-entity communication is performed by ONE-TIME-PAD encryption based on relative permuted data.

To ensure the secret protection is in EP 2 462 717 . WO 2011/015510 . DE10 2009 036 386 a "REAL-TIME QUANTUM COMPUTER SECURE ENCRYPTION OF DATA OF ALL KINDS" has been published. This encryption "is a simple, cipher-implemented ciphering and deciphering method. It is based on up to approximately 10 ³⁷ × 128-bit block-related dynamic random bit re-permutations, on a true one-time pad encryption with up to approximately 10 ³⁸ × 128-bit dynamic random block keys and up to approx . 10 ³⁷ permutations × 128-bit data double block-based dynamic random certain packet bit (re). The hierarchical structure of the solution according to the invention increases the complexity of a crypto attack data double block related to more than 10 ⁸⁵⁰ combinations. The "technical solution executed in the form of random-information-driven look-up tables and dynamically random-information-driven bit-related antivalent and / or equivalent logic links simultaneously withstands quantum computers and classical cryptanalytic attacks without loss of efficiency."

DE 10 2008 010 792 describes a "method for unmanipulable and tamper-proof file and folder access". An essential feature is that a file or a folder or both is assigned an access header which contains at least one datum for identifying a person authorized to create, an authorized and authorized person, key data, permutation data, and the like. A second characteristic is that the data in the access header is in the form of relative permuted data.

In DE 10 2008 010 794 is a "method for unmanipulierbaren, tap-proof and non-hackable P2P communication in multi-subscriber networks" disclosed. P2P communication realizes true end-to-end encryption. Absolute security-relevant data for authentication, subkey data, permutation control data, GPS data, signature data and many others are encrypted on a one-time pad based on permuted relative data and other data of all types are transmitted encrypted by cryptography. The permuted relative data will be calculated according to the book " IT security in 5D. Space + Time + Chance (ISBN 978-3-8322-9737-4) calculated dynamic random space and relative data model. According to the model, absolute data is transformed into relative data in a multi-level hierarchy within mathematical hyperbanks associated therewith.

IT security in 5D is a holistic, hardware-assisted security solution that performs calculations in foreclosed hardware systems. Embedded systems (three-dimensional space) are mostly used as sealed hardware systems.

Embedded systems such as smart cards typically consist of a microcontroller and nonvolatile memory. Security-related data, such as data for the authentication and authentication of persons and facilities, passwords, key codes, program codes for encryption, authentication of persons and facilities, etc., are stored in memory in many IT security applications and are processed by the microcontroller. In these applications, it is particularly important that the security-relevant data remain secret and their processing can not be overheard or manipulated.

Many techniques exist that only pursue the goal of spying out the security-relevant data. Side-channel attack Power Analysis measures and analyzes the current history of the embedded system to be spotted during repeated use. From the results, the attempt is made to lock on the security-related data. Other methods are based on the probing of IC pins or lines.

In order to be able to touch buried IC pins or lines, the embedded systems are drilled or nano-layer removed. In most cases, the components of the embedded system are damaged or destroyed, so that as a rule a proper use is no longer possible.

in the U.S. Patent 6,507,913 Shamir describes a device for protecting smart cards from simple and differential performance analysis. For protection, two capacitors are embedded in a substrate, which are alternately charged by an external power supply or partially discharged by a chip of the card. This principle decouples the direct power requirement of the chip from the externally detectable power consumption of the card.

An improved solution can be found in the patent DE 10 2004 003 078 B4 are removed, wherein "a variable energy storage element in the form of a variable capacitor and / or a variable inductance" are used. A disadvantage of these solutions is that although the power analysis is made difficult, but the safety-related data are not protected by techniques of ablation and Antastens.

The PEP protection (Protecting Electronic Products) of the Fraunhofer Institute AISEC also belongs to the state of the art. The PEP protection serves primarily the know-how protection of embedded systems (three-dimensional space), so also the secret protection of security-relevant data and is directed above all against product piracy. In addition, it provides protection against manipulation of any kind Press release from 08.04.2013 at the Hannover Messe, Hall 8 / Stand D06 / 12; See also computer-automation.de: "Researchers develop copy protection measures", online post from 10 December 2012 ]

Embedded systems can be photocopied and tamper-resistant with the help of an electronic protective film (membrane with integrated sensors), which completely covers a system. Electronic measuring circuits record the film properties in their intact condition. Damage to the film will cause the system to malfunction. This is also the disadvantage of this solution. Any damage, whether consciously spying on the data secrets of the security-relevant data or unconsciously, in any case, the system is inoperative.

In DE 10 2008 025 223 A1 discloses the embedding of electronic components in a substrate, wherein a plurality of electronic components are arranged next to or above each other. The aim of the local solution is to minimize the size, thickness and weight of electronic devices such as mobile phones, laptops and others.

A method for producing a multi-layer construction as well as multi-layer construction for an identification document is disclosed in DE 10 2006 037 383 A1 described. The local solution was based on the task "to propose a method for producing a multi-layer structure and a multi-layer structure for an identification document, in which the counterfeit security is increased."

The multilayer structure (three-dimensional space) comprises a substrate layer composed of one or more layers and further layers arranged on the sides of the substrate layer. Embedded in the substrate layer is a transponder module. Further features of the solution describe the chemical compositions of the layer structure.

Also known is a CodeMeter of the company Wibu system. The code meter is a CmStick that protects sensitive data such as program code from tampering. The security-relevant data is encrypted and stored on a memory integrated in a microchip. [ konstruktion.de: "A kit makes it easier for manufacturers to get started with the protection of their embedded systems", online article from 25.03.2013 ]

A method and arrangement for protecting data secrets in memory is disclosed in US Pat DE10 2012004780.0 illustrated. Data secrets are protected prior to addressing a memory by a random address transformation with or without address expansion, the data being encrypted with or without data expansion with at least one address-selected random number.

Both solutions ensure the protection of the secret through encryption, whereby the data in the solution described last can no longer be found by randomly encrypting the data secrets and by randomly distributing the associated data in the memory. A probing of data and lines is possible.

Object and objectives of the invention

The object of the invention is to provide a method for the IT protection of security-relevant data and its processing, so that it is not possible to spy on and manipulate security-relevant data and their processing.

The spying out of security-relevant data and its processing by means of side channel attacks, such as analyzes of the current flow and the course of electromagnetic fields should not lead to a usable result. The IT protection should also be ensured when probing IC pins or lines, even after nano layer-wise removal.

Disclosure of the invention

• – Mindestens ein Mikrocontroller, eine Zufallsquelle bestehend aus Rauschquelle und Verstärker, ein nichfflüchtiger Speicher und eine der Teilanordnungen Tiefpass, Hochpass, Bandpass, Bandsperre, Spannungsteiler, mäanderförmige Leiterstrukturen sind auf mehr als einer inneren Ebene eines dreidimensionalem Raumes angeordnet, wobei der Mikrocontroller mindestens einen nichtflüchtigen internen Speicher, Analog-Digital-Umsetzer, Digital-Analog-Umsetzer und ein Businterface enthält und der Ausgang der Zufallsquelle an einen Eingang des Analog-Digital-Umsetzers geschaltet ist.
• – Äußere Ebenen umschließen die inneren Ebenen des dreidimensionalen Raumes, wobei mindestens eine äußere Ebene eine Masse-Ebene oder eine Schirm-Ebene oder eine Masse-Schirm-Ebene ist.
• – Ein auf einer inneren Ebene des dreidimensionalen Raumes angeordneter Mikrocontroller kommuniziert über mindestens eine der Kopplungsarten transformatorisch, kapazitiv und galvanisch mit der Außenwelt, wobei bei galvanischer Kopplung die Kopplung über Signalkontakte erfolgt, die mindestens eine der äußeren Ebenen durchstoßen.
• – Auf mindestens einer der inneren Ebenen des dreidimensionalen Raumes ist mindestens ein Teil einer der Teilanordnungen Tiefpass, Hochpass, Bandpass, Bandsperre, Spannungsteiler, mäanderförmige Leiterstruktur mit individuellen Toleranzen angeordnet, wobei der Rest der Teilanordnung mit ihren individuellen Toleranzen auf einer anderen Ebene platziert ist.
• – Mindestens eine Teilanordnung wird von einem der Mikrocontroller gespeist und ausgangsseitig von dem speisenden Mikrocontroller und einem anderen Mikrocontroller oder von dem speisenden Mikrocontroller oder einem anderen Mikrocontroller abgefragt, wobei mindestens ein Teil der Teilanordnung auf einer anderen Ebene in Bezug zum speisenden oder abfragenden Mikrocontroller angeordnet ist.
• – Der speisende Mikrocontroller bestimmt in Verbindung mit der Zufallsquelle mindestens ein Signal oder mindestens ein Signalparameter oder mindestens ein Signal und mindestens ein Signalparameter des Signals, speichert diese in einem der nichtflüchtigen Speicher, wählt in Verbindung mit der Zufallsquelle mindestens ein Signal mit den Signalparametern aus und speist es in Verbindung mit der Zufallsquelle in mindestens eine der Teilanordnungen ein.
• – Die im unversehrten Zustand des dreidimensionalen Raumes über den Analog-Digital-Umsetzer des Mikrocontrollers ausgangsseitig der jeweiligen Teilanordnung abgefragten toleranzabhängigen Signalwerte oder aus ihnen abgeleiteten Größen werden in einem der nichtflüchtigen Speicher gespeichert, wobei der zum IT-Schutz sicherheitsrelevanter Daten und ihrer Verarbeitung gestaltete Verbund aller Ebenen durch die toleranzabhängigen Signalwerte oder aus ihnen abgeleitete Größen gekennzeichnet ist.
• – Der speisende Mikrocontroller speist in Verbindung mit der Zufallsquelle mindestens ein im nichtflüchtigen Speicher gespeichertes Signal mit den Signalparametern wiederholend in die Teilanordnung ein.
• – Die über den Analog-Digital-Umsetzer des Mikrocontroller ausgangsseitig der Teilanordnung abgefragten toleranzabhängigen Signalwerte oder aus ihnen abgeleitete Größen werden mit den im nichtflüchtigen Speicher gespeicherten toleranzabhängigen Signalwerten oder aus ihnen abgeleitete Größen verglichen, wobei bei nichttolerierbarer Abweichung oder bei nichttolerierbaren Abweichungen eine Gefährdung des zum IT-Schutz sicherheitsrelevanter Daten und ihrer Verarbeitung gestalteten Verbundes aller Ebenen erkannt wird.
• – Alternativ sind mindestens zwei Mikrocontroller in verschiedenen inneren Ebenen vorhanden, die über mindestens zwei der Kommunikationswege • nichtflüchtiger Speicher • Bussysteme, • In- und Outputs • direkt oder über eine der Teilanordnungen in Verbindung stehen. – Zwischen den Mikrocontrollern werden mehr als ein vereinbartes zufallsbestimmtes Zufallsdatum über mindestens einen vereinbarten zufallsbestimmten Kommunikationsweg zu zufallsbestimmten Zeiten ausgetauscht, wobei die Vereinbarungen zufallsbestimmt zwischen den Mikrocontrollern bei tolerierbarer Abweichung oder bei tolerierbaren Abweichungen der abgefragten toleranzabhängigen Signalwerte oder aus ihnen abgeleiteten Größen ausgehandelt werden.
• – Bei Feststellung eines der Fehler • falsch ausgetauschtes Zufallsdatum • falsche Zeit des Austausches des Zufallsdatums oder der Zufallsdaten • falscher Kommunikationsweg wird ein Fehlerzählwert 1 in einer Speicherzelle eines der nichtflüchtigen Speicher inkrementiert oder dekrementiert.
• – Zusätzlich generiert der Mikrocontroller in Verbindung mit der Zufallsquelle Zufallsdaten und Permutationssteuerdaten, bewertet deren Güte, speichert die gütebewerteten Zufallsdaten und Permutationssteuerdaten in dem Mikrocontroller internen nichtflüchtigen Speicher oder verschlüsselt in mindestens einem der nichtflüchtigen Speicher, verschlüsselt die sicherheitsrelevanten Daten mit mindestens einem Zufallsdatum dieser Zufallsdaten und speichert sie in Abhängigkeit von mindestens einem anderen Zufallsdatum dieser Zufallsdaten in mindestens einem der nichtflüchtigen Speicher, wobei mindestens ein der nichtflüchtigen Speicher mit Zufallsdaten vorbelegt ist.
• – Ein der Mikrocontroller führt mindestens eine der IT-Operationen • Authentifikation • Datenverschlüsselung • Datenentschlüsselung • Berechnungen permutierter relativer Daten aus.
• – Mindestens einer der Mikrocontroller liest oder schreibt mindestens einen nichtflüchtigen Speicher zu zufallsbestimmten Zeiten an zufallsbestimmten Adressen des nichtflüchtigen Speichers.
• – Der Mikrocontroller legt mindestens eine Kopie einer zufallsbestimmten Anzahl der gelesenen und geschriebenen Daten einschließlich derer Adressen des nichtflüchtigen Speichers in den internen nichtflüchtigen Speicher des Mikrocontrollers ab.
• – Der Mikrocontroller liest nach einer zufallsbestimmten Zeit die Speicherinhalte an zufallsbestimmten Adressen des nichtflüchtigen Speichers, die die Adressen der in dem internen nichtflüchtigen Speicher des Mikrocontrollers abgelegten Daten enthalten, und vergleicht die gelesenen Speicherinhalte und ihre Adressen im gelesenen flüchtigen Speicher mit den im internen nichtflüchtigen Speicher abgelegten Daten und zugeordneten Adressen.
• – Bei fehlerhaftem Vergleich der gelesenen und abgelegten Daten, Speicherinhalte und Adressen wird ein Fehlerzählwert 2 in einer Speicherzelle eines der nichtflüchtigen Speicher inkrementiert oder dekrementiert.
• – Beim Erreichen eines Grenzwertes des jeweiligen Fehlerzählwertes wird mindestens eins der im nichtflüchtigen Speicher oder im internen nichtflüchtigen Speicher des Mikrocontrollers gespeicherten Signale mit deren Signalparametern in die jeweilig zugeordnete Teilanordnung eingespeist. Die über den Analog-Digital-Umsetzer des Mikrocontrollers ausgangsseitig der Teilanordnung abgefragten toleranzabhängigen Signalwerte oder aus ihnen abgeleitete Größen werden mit den im nichtflüchtigen Speicher gespeicherten toleranzabhängigen Signalwerten oder aus ihnen abgeleitete Größen verglichen, wobei bei nichttolerierbarer Abweichung oder bei nichttolerierbaren Abweichungen eine Gefährdung des zum IT-Schutz sicherheitsrelevanter Daten und ihrer Verarbeitung gestalteten Verbundes aller Ebenen erkannt wird.
• – Der mit der Zufallsquelle in Verbindung stehende Mikrocontroller des dreidimensionalen Raumes arbeitet nach einem Rahmenprogramm, das Programmteile zur Generierung von Zufallsdaten, zur Generierung von Permutationssteuerdaten, zur Gütebewertung der Zufallsdaten und Permutationssteuerdaten, zum Schreiben und Lesen der nichtflüchtigen Speicher, zur zufallsbestimmten Auswahl eines Signals oder von Signalen, zur zufallsbestimmten Generierung aller zufallsbestimmten Signalparameter, zur Generierung des in die Teilanordnung zu speisenden Signals oder der in die Teilanordnungen zu speisenden Signale, zur zufallsbestimmten Auswahl der zu speisenden Teilanordnung und zur Speisung der Teilanordnung enthält, deren Bearbeitungsfolge zufallsbestimmt in Verbindung mit der Zufallsquelle festgelegt wird.
• – Die Generierungen von Zufallsdaten und Permutationssteuerdaten werden durch Zufallsdaten gesteuert, wobei die Anzahl der zu generierenden Zufallsdaten oder Permutationssteuerdaten oder die Anzahl der zu generierenden Zufallsdaten und Permutationssteuerdaten durch Zufallsdaten vorgegeben werden.
• – Jedem Programmteil sind eine festzugeordnete Programmteil-Kennung und mindestens eine sich ändernde Bearbeitungs-Kennung zugeordnet, wobei die Programmteil-Kennung den Programmteil bezeichnet und die Bearbeitungs-Kennung oder die Bearbeitungs-Kennungen den Bearbeitungsstand des Programmteils anzeigt oder anzeigen.
• – Die Programmteil-Kennungen werden zufallsbestimmt in einer Bearbeitungsfolge aneinandergereiht, wobei mindestens eine Bearbeitungsfolge in Speicherzellen eines der nichtflüchtigen Speicher, dessen Adressen in Verbindung mit der Zufallsquelle festgelegt werden, hinterlegt wird.
• – Die Bearbeitung eines Programmteils wird durch einen Folgeindex der Bearbeitungsfolge angezeigt, wobei der Folgeindex des in Bearbeitung befindenden Programmteils dem Ort der Programmteil-Kennung in der Bearbeitungsfolge entspricht, dessen Wert in einer Speicherzelle eines der nichtflüchtigen Speicher gespeichert wird und der Inhalt dieser Speicherzelle als Einstiegspunkt zur weiteren Programmabarbeitung bei Spannungsunterbrechung dient.
• – Jede Bearbeitungs-Kennung des in Bearbeitung befindenden Programmteils wird in einer anderen Speicherzelle eines der nichtflüchtigen Speicher gespeichert.
• – Eine Bearbeitungs-Kennung des Programmteils Generierung von Zufallsdaten kennzeichnet mindestens eines von beiden Anzahl der zu generierenden Zufallsdaten, Anzahl der für die Bildung eines Zufallsdatums zu verwendenden niederwertigen Bits der abgetasteten Signalwerte, wobei die Anzahl der für die Bildung eines Zufallsdatums zu verwendenden niederwertigen Bits der abgetasteten Signalwerte zufallsbestimmt festgelegt wird. Eine Bearbeitungs-Kennung des Programmteils Generierung von Permutationssteuerdaten gibt die Anzahl der zu generierenden Permutationssteuerdaten an. Weitere Bearbeitungs-Kennungen kennzeichnen das gewählte Signal oder die gewählten Signale und die zu speisenden Teilanordnungen.
• – In einer vorzugsweisen Ausführungsvariante sind auf mehr als einer inneren Ebene eines dreidimensionalem Raumes mindestens ein Mikrocontroller, eine Zufallsquelle bestehend aus Rauschquelle und Verstärker, ein nichtflüchtiger Speicher, ein Ladeschaltkreis, ein Akku und eine der Teilanordnungen Tiefpass, Hochpass, Bandpass, Bandsperre, Spannungsteiler, mäanderförmige Leiterstrukturen angeordnet.
• – Alle Ebenen sind irreversibel miteinander verbunden.
• – Bei tolerierbarer Abweichung oder bei tolerierbaren Abweichungen der abgefragten toleranzabhängigen Signalwerte oder aus ihnen abgeleiteten Größen werden in Verbindung mit der Zufallsquelle mindestens ein weiteres Signal oder mindestens weitere Signalparameter oder mindestens ein weiteres Signal und mindestens weitere Signalparameter des Signals bestimmt, diese werden in einem der nichtflüchtigen Speicher gespeichert und in Verbindung mit der Zufallsquelle das Signal mit den Signalparametern oder die Signale mit den Signalparametern in mindestens eine der Teilanordnung eingespeist.
• – Ausgangsseitig der Teilanordnung werden über den Analog-Digital-Umsetzer des Mikrocontrollers die abgefragten toleranzabhängigen Signalwerte oder aus ihnen abgeleiteten Größen in einem der nichtflüchtigen Speicher gespeichert. Bei Erkennung einer Gefährdung des zum IT-Schutz sicherheitsrelevanter Daten und ihrer Verarbeitung gestalteten Verbundes aller Ebenen werden die Daten mit Zufallsdaten überschrieben und zufallsgesteuerte unsinnige Verarbeitungs- und Schreib-Lese-Operationen ausgeführt.

Compared to the prior art, the IT protection of security-relevant data and its processing are carried out according to the invention with the following features:

• At least one microcontroller, a random source consisting of noise source and amplifier, a non-volatile memory and one of the subassemblies lowpass, highpass, bandpass, bandstop, voltage divider, meandering conductor structures are arranged on more than one inner level of a three-dimensional space, wherein the microcontroller has at least one non-volatile internal memory, analog-to-digital converter, digital-to-analog converter and a bus interface and the output of the random source is connected to an input of the analog-to-digital converter.
• Outer levels enclose the inner planes of the three-dimensional space, wherein at least one outer plane is a ground plane or a screen plane or a ground-screen plane.
• - A arranged on an inner level of the three-dimensional space microcontroller communicates via at least one of the coupling types transformer, capacitive and galvanic with the outside world, wherein in galvanic coupling, the coupling via signal contacts that pierce at least one of the outer levels.
• On at least one of the inner planes of the three-dimensional space, at least a part of one of the subassemblies low-pass, high-pass, bandpass, bandstop, voltage divider, meander-shaped conductor structure is arranged with individual tolerances, the rest of the subassembly being placed with its individual tolerances on a different plane.
• - At least one subassembly is powered by one of the microcontroller and queried on the output side by the feeding microcontroller and another microcontroller or by the feeding microcontroller or another microcontroller, wherein at least a part of the subassembly is arranged at a different level with respect to the feeding or interrogating microcontroller ,
• - The feeding microcontroller determines in conjunction with the random source at least one signal or at least one signal parameter or signal and at least one signal parameter of the signal, stores it in one of the nonvolatile memory, selects in conjunction with the random source at least one signal with the signal parameters and feeds it into at least one of the subassemblies in conjunction with the random source.
• The tolerance-dependent signal values or values derived therefrom in the intact state of the three-dimensional space via the analog-to-digital converter of the microcontroller on the output side are stored in one of the nonvolatile memories, wherein the network configured for IT protection of security-relevant data and its processing is characterized by the tolerance-dependent signal values or variables derived from them.
• - The feeding microcontroller fed in conjunction with the random source at least one stored in the nonvolatile memory signal with the signal parameters repeatedly in the subassembly.
• The tolerance-dependent signal values queried via the analog-to-digital converter of the microcontroller on the output side or variables derived therefrom are compared with the tolerance-dependent signal values stored in the nonvolatile memory or with variables derived therefrom, whereby a risk for the non-tolerable deviation or non-tolerable deviations IT protection of security-relevant data and their processing of a network of all levels is detected.
• - Alternatively, there are at least two microcontrollers in different internal levels, which are connected via at least two of the communication paths • nonvolatile memory • bus systems, • in- and outputs • directly or via one of the subassemblies. More than one agreed random random data is exchanged between the microcontrollers at least one agreed random communication path at random times negotiating the agreements randomly between the microcontrollers with tolerable deviation or tolerable deviations of the requested tolerance dependent signal values or quantities derived therefrom.
• - If one of the errors is detected • Incorrectly exchanged random date • Incorrect time of the random or random data exchange • Incorrect communication path For example, an error count 1 in a memory cell of one of the non-volatile memories is incremented or decremented.
• In addition, the microcontroller generates random data and permutation control data in conjunction with the random source, stores the quality-evaluated random data and permutation control data in the microcontroller internal nonvolatile memory or encrypts in at least one of the nonvolatile memories, encrypts the security relevant data with at least one random data of these random data and stores it in at least one of the non-volatile memories in dependence on at least one other random data of this random data, wherein at least one of the non-volatile memories is pre-assigned with random data.
• - One of the microcontrollers performs at least one of the IT operations • Authentication • Data encryption • Data decryption • Calculations of permuted relative data.
• At least one of the microcontrollers reads or writes at least one nonvolatile memory at random times at random addresses of the nonvolatile memory.
• The microcontroller places at least one copy of a random number of the read and written data, including the addresses of the nonvolatile memory, in the internal nonvolatile memory of the microcontroller.
• The microcontroller reads, after a random time, the memory contents at random addresses of the nonvolatile memory containing the addresses of the data stored in the internal nonvolatile memory of the microcontroller and compares the read memory contents and their addresses in the read volatile memory with those in the internal nonvolatile memory stored data and assigned addresses.
• In case of erroneous comparison of the read and stored data, memory contents and addresses, an error count value 2 in a memory cell of one of the non-volatile memories is incremented or decremented.
• - Upon reaching a limit value of the respective error count value, at least one of the signals stored in the nonvolatile memory or in the internal nonvolatile memory of the microcontroller is fed with its signal parameters into the respective assigned subassembly. The tolerance-dependent signal values retrieved via the analog-to-digital converter of the microcontroller on the output side or from variables derived therefrom are compared with the tolerance-dependent signal values stored in the nonvolatile memory or variables derived therefrom, whereby if the deviation is non-tolerable or intolerable deviations endanger IT Protection of safety-relevant data and their processing designed network of all levels is detected.
• The random-source micro-controller of the three-dimensional space operates according to a framework program which generates random data, generates permutation control data, evaluates the random data and permutation control data, writes and reads the nonvolatile memories, randomly selects a signal or of signals, for randomly generating all randomly determined signal parameters, for generating the signal to be fed to the subassembly or the signals to be fed into the subarrays, for randomly selecting the subarray to be fed and for feeding the subassembly whose processing sequence is randomly determined in conjunction with the random source is determined.
• - The generation of random data and permutation control data are controlled by random data, wherein the number of random data or Permutationssteuerdaten to be generated or the number of random data to be generated and Permutationssteuerdaten are specified by random data.
• - Each program part are assigned a permanently assigned program part identifier and at least one changing processing identifier, wherein the program part identifier designates the program part and the processing identifier or processing identifiers displays or displays the processing status of the program part.
• - The program part identifiers are randomly strung together in a processing sequence, wherein at least one processing sequence is stored in memory cells of one of the non-volatile memories whose addresses are determined in conjunction with the random source.
• The processing of a program part is indicated by a sequence index of the processing sequence, the sequence index of the program part being processed corresponding to the location of the program part identifier in the processing sequence whose value is stored in a memory cell of one of the nonvolatile memories and the contents of this memory cell as the entry point for further program execution at power interruption is used.
• Each processing identifier of the program part being processed is stored in another memory cell of one of the nonvolatile memories.
• A processing identifier of the random data generation part of the program identifies at least one of both the number of random data to be generated, the number of low-order bits of the sampled signal values to be used for the formation of a random data, the number of low-order bits to be used for the formation of a random datum sampled signal values is determined randomly. A processing identifier of the program part Generation of permutation control data specifies the number of permutation control data to be generated. Further processing identifiers identify the selected signal or the selected signals and the partial arrangements to be fed.
• In a preferred embodiment, at least one microcontroller, a random source consisting of a noise source and amplifier, a nonvolatile memory, a charging circuit, a battery and one of the subassemblies low-pass, high-pass, bandpass, band-stop filter, voltage divider, are provided on more than one inner level of a three-dimensional space. Meander-shaped conductor structures arranged.
• - All levels are irreversibly connected.
• In the case of a tolerable deviation or tolerable deviations of the requested tolerance-dependent signal values or variables derived from them, at least one further signal or at least further signal parameters or at least one further signal and at least further signal parameters of the signal are determined in connection with the random source, these being in one of the non-volatile ones Memory stored and fed in conjunction with the random source, the signal with the signal parameters or the signals with the signal parameters in at least one of the sub-array.
• On the output side of the subassembly, the interrogated tolerance-dependent signal values or variables derived therefrom are stored in one of the nonvolatile memories via the analog-to-digital converter of the microcontroller. If a threat to the security of all data related to IT security and its processing is detected at all levels, the data is overwritten with random data and randomized nonsensical processing and read-write operations are executed.

According to the invention the object is achieved by the teaching presented in the claims. In the following, the invention will be described by way of example and in detail with reference to FIG 1 to 5 explained in more detail.

In detail show:

1 : A sectional view of a three-dimensional space of a first embodiment for implementing the method according to the invention for the IT protection of security-relevant data and their processing

2 : An embodiment of a meandering conductor structure of an inner plane of the three-dimensional space of the embodiment for implementing the method according to the invention

3 A second embodiment of a meander-shaped conductor structure of a further inner plane of the three-dimensional space of the exemplary embodiment of the method according to the invention

4 : A sectional view of a three-dimensional space of a second embodiment for implementing the method according to the invention

5 : An embodiment of the interconnection of the features of the method according to the invention

In the sectional image of the three-dimensional space, 1 , are represented outer levels 11 . 12 . 13 . 14 , inner levels 21 . 22 . 23 . 24 . 25 . 26 . 27 , a microcontroller 31 , a non-volatile memory 41 , a random source 51 , Voltage divider 82 . 83 , a subassembly in the form of a high pass, consisting of capacitor 61 and resistance 81 , As you can see, the capacitor 61 the high pass on the inner level 23 and the resistance 81 the high pass on the plane 24 arranged. Thus, the part are capacitor 61 the subassembly high pass with its individual tolerance and the rest resistance 81 the subassembly high pass with its individual tolerance placed on different levels.

The inner plane 27 connects the inner levels 23 and 24 , It connects via unillustrated lines or contact strips outputs and inputs of the microcontroller 31 with the voltage divider 83 , the capacitor 61 , the contacts 7 and with the outputs and inputs of the non-volatile memory 41 , The outer levels 11 . 12 . 13 . 14 enclose with the unrepresented outer levels 15 . 16 completely the three-dimensional space. All outer planes are advantageously designed as ground-screen planes, with the outer plane 11 from the signal contacts 7 (Ball Grid contacts) is pierced. Preferably, all levels are irreversibly connected to each other, so that the inner components and sub-assemblies are sealed off from the outside world. Only about the ball grid contacts 7 is the microcontroller 31 in contact with the outside world. In the case of externally powered, enclosed, three-dimensional space, energy is supplied via individual contacts 7 , where the inside ICs, like microcontroller 31 and non-volatile memory 41 , of the three-dimensional space built up of several outer and inner levels are buffered energized.

2 and 3 show meander-shaped conductor structures 9i and 9j , In the exemplary embodiment, the conductor structures 9i and 9j in the levels 2i and 2y with i = 1, 6 and j = 2, 5 arranged. The ladder structures 91 . 92 . 95 . 96 represent printed coils, each pair 91 . 92 and 95 . 96 is transformerically coupled together.

In the sectional image of the three-dimensional space, 4 , are represented outer levels 11 . 12 . 13 . 14 , inner levels 21 . 22 . 23 . 24 . 25 . 26 . 27 . 28 , a microcontroller 31 , a non-volatile memory 41 , a random source 51 , Voltage divider 82 , a charging circuit 101 , a battery 201 , a subassembly in the form of a high pass, consisting of capacitor 61 and resistance 81 , As you can see, the capacitor 61 the high pass on the inner level 23 and the resistance 81 the high pass on the plane 24 arranged. Thus, the part are capacitor 61 the subassembly high pass with its individual tolerance and the rest resistance 81 the subassembly high pass with its individual tolerance placed on different levels.

The inner plane 27 connects the inner levels 23 and 24 , in turn, with the battery level 28 communicates. It connects via unillustrated lines or contact strips separate outputs and inputs of the microcontroller 31 with the capacitor 61 , the contacts 7 and with the outputs and inputs of the non-volatile memory 41 , The battery 201 is about the inner levels 27 . 26 . 25 . 24 and 23 with the charging circuit 101 connected. The outer levels 11 . 12 . 13 . 14 enclose with the unrepresented outer levels 15 . 16 completely the three-dimensional space. All outer planes are advantageously designed as ground-screen planes, with the outer plane 11 from the signal contacts 7 (Ball Grid contacts) is pierced. Preferably, all levels are irreversibly connected to each other, so that the inner components and sub-assemblies are sealed off from the outside world. Only about the ball grid contacts 7 is the microcontroller 31 in contact with the outside world. In sealed three-dimensional space without constant external energy supply, the microcontroller 31 and the non-volatile memory 41 with the on the inner level 28 arranged battery 201 provided.

The basic interconnection of the components and sub-assemblies of the first embodiment 1 disclosed 5 , You can see the printed coils 91 . 92 . 95 . 96 , the voltage dividers 82 . 83 , the condenser 61 , the resistance 81 , the microcontroller 31 , the random source 51 and the nonvolatile memory 41 , The microcontroller 31 contains not shown analog-to-digital converter, digital-to-analog converter, internal non-volatile memory and bus interface for the I2C bus. The random source 51 is composed of the unillustrated noise source and the unrepresented amplifier. microcontroller 31 and memory 41 are connected via the I2C bus.

capacitor 61 and resistance 81 with an extended tolerance range, the subassembly form high pass. Also the resistors of the voltage divider 82 . 83 preferably have a higher tolerance range.

The feeding microcontroller 31 determines, in conjunction with the random source, at least one signal or signal parameter and stores it in the unillustrated internal nonvolatile memory of the microcontroller 31 or stores them encrypted in non-volatile memory 41 , As signal types are preferably sinusoidal, rectangular or triangular signals are used. Parameters of the sine signal are amplitude value, period duration, zero phase angle. Parameters of the square wave signal are amplitude, pulse width, pulse pause width, and edge slope and edge fall times. In conjunction with the random source, the microcontroller selects 31 sends a signal with the signal parameters and randomly feeds a signal with the signal parameters into at least one of the sub-orders high-pass, meander-shaped conductor structure 91 Meander-shaped conductor structure 96 one. On the output side, at least one of the subassemblies becomes high-pass, meander-shaped conductor structures 92 and 95 via the analog-to-digital converter of the feeding microcontroller 31 queried. The tolerance-dependent signal values queried in the intact state of the three-dimensional space or the quantities derived from them characterize the guaranteed IT protection of security-relevant data and their processing. In conjunction with the random source, the microcontroller feeds 31 a signal stored in the nonvolatile memory with the signal parameters repeating in the subassembly. The tolerance-dependent signal values queried on the output side at the subassembly or variables derived therefrom are compared with the signal values stored in the nonvolatile memory or with variables derived from them. In case of non-tolerable deviation or deviations that can not be tolerated, the microcontroller recognizes 31 a threat to the interconnection of all levels designed for the IT protection of security-relevant data and their processing.

Deviations of the signal values or variables derived from them occur in each case In the event of damage or damage to a cable, an IC pin or a part of the subassembly, damage to the nano layer removal is unavoidable.

In a third non-illustrated embodiment is on the inner level 23 in the 1 an unillustrated second microcontroller 32 arranged with not shown analog-to-digital converter, digital-to-analog converter, internal non-volatile memory and bus interface. microcontroller 31 and 32 are connected via at least two of the communication paths nonvolatile memory, bus systems, inputs and outputs directly or via one of the subassemblies low pass, high pass, bandpass, bandstop, voltage divider, meandering conductor structures in combination. At random times, the microcontrollers exchange more than one agreed random random date via at least one agreed random communication path. The agreements between the microcontrollers 31 and 32 are negotiated randomly with tolerable deviation or with tolerable deviations of the requested tolerance-dependent signal values or variables derived from them.

If one of the errors of erroneously exchanged random data, wrong time of random data exchange or random data, wrong communication path is detected, an error count 1 in a memory cell of a nonvolatile memory is incremented or decremented.

In this embodiment, both microcontrollers ask 31 . 32 that from the microcontroller 31 fed partial arrangements and exchange via one of the agreed communication channels, the results of the deviation of the comparison. Furthermore, the microcontroller takes over 32 the communication to the outside world via the signal contacts 7 so that the microcontroller 31 has no connection with the outside world.

The one with the random source 51 related microcontroller 31 operates according to a framework program, the program parts for generating random data, for generating permutation control data, for quality evaluation of random data and permutation control data, for writing and reading the nonvolatile memory, for random selection of a signal, for randomly generating all random signal parameters, for generating the in the Partial arrangement to be fed signal or the signals to be fed in the sub-assemblies, for the random selection of the sub-assembly to be fed and for feeding the sub-assembly contains. The processing sequence of the program parts becomes in connection with the random source 51 determined at random.

For this purpose, each program part is assigned a permanently assigned program part identifier and at least one changing processing identifier. The program part identifier designates the respective program part and the processing identifier or the processing identifiers the processing status of the program part. The program part identifiers are randomly sequenced in the processing sequence stored in memory cells of a nonvolatile memory whose addresses are associated with the random source 51 be deposited.

The processing of a program part is indicated by a sequence index of the machining sequence. The sequence index of the program part being processed indicates the location of the program part identifier in the processing sequence. The value of the sequence index is stored in a memory cell of a nonvolatile memory. The content of this memory cell is used as an entry point for further program execution in case of power failure. The processing identifiers associated with a program part identifier are also stored in memory cells of one of the nonvolatile memories. A processing identifier of the program part Generation of Random Data identifies the number of random data to be generated. A further processing identifier of the random data generation part of the program specifies the number of low-order bits of the sampled signal values to be used for the formation of a random data. To generate a random data, the signal values supplied by the random source via the analog input DAI3 to the analog-to-digital converter of the microcontroller 31 guided and scanned by him. The lower two bits of the sampled signal value decide, by way of example, whether one, two, three or four least significant bits of the signal value are used in the formation of subsequent n-bit wide random data. In accordance with the n-bit random data to be formed, m signal values are sampled. The low-order bits of the m signal values form the microcontroller 31 the n-bit wide random date. After randomly generating z-random data, the microcontroller evaluates 31 the quality of the random data set. One of the quality assessment methods is, for example, the entropy value of the random data set. The quality-evaluated random data is stored by the microcontroller 31 in internal nonvolatile storage or encrypted in nonvolatile storage 41 ,

A processing identifier of the program part Generation of permutation control data specifies the number of permutation control data to be generated, wherein the permutation control data is a random number sequence of numbers 0 to 127 or 0 to 255 or more. The numbers of the random number sequence indicate the bit location in the permuted or re-mutated 128 or 255-bit bitstream. Another processing identifier of the program part Generation of permutation control data identifies the number of permutation control data still available.

The microcontroller 31 works independently of the microcontroller 32 randomly determined. It encrypts the security-relevant data with at least one random date and stores the encrypted security-relevant data as a function of at least one other random date in at least one of the non-volatile memories. He writes at random times in the non-volatile memory 41 , He reads at random times to random addresses of the non-volatile memory 41 , He places at least one copy of a random number of the read and written data, including their non-volatile memory addresses 41 into the internal nonvolatile memory of the microcontroller. After a random time, the microcontroller reads 31 the memory contents at random addresses of the non-volatile memory 41 containing the addresses of the internal nonvolatile memory of the microcontroller 31 stored data and compares the read memory contents and their addresses in the read volatile memory with the data stored in the internal nonvolatile memory and associated addresses. Incorrect comparison of the read and stored data, memory contents and addresses causes the microcontroller to increment or decrement 31 an error count 2 in a memory cell of one of the non-volatile memories.

When a limit value of the respective error count 1 or 2 is reached, at least one of the signals stored in the nonvolatile memory or in the internal nonvolatile memory of the microcontroller is fed with the signal parameters into the respective assigned subassembly. The tolerance-dependent signal values queried via the analog-to-digital converter of the microcontroller on the output side or from variables derived therefrom are compared with the tolerance-dependent signal values stored in the nonvolatile memory or variables derived therefrom, whereby if the deviation is non-tolerable or intolerable deviations endanger IT Protection of safety-relevant data and their processing designed network of all levels by the microcontroller 31 is recognized.

In the case of tolerable deviation or tolerable deviations of the requested tolerance-dependent signal values or variables derived from them, the microcontroller determines 31 in connection with the random source again at least one further signal or at least further signal parameters or at least one further signal and at least further signal parameters of the signal, stores the microcontroller 31 this in one of the nonvolatile memories and, in conjunction with the random source, feeds the signal with the signal parameters into at least one of the subassemblies.

The output side of the sub-array are via the analog-to-digital converter of the microcontroller 31 the requested tolerance-dependent signal values or quantities derived therefrom are stored in one of the non-volatile memories.

Regardless of the dynamic random operations of the microcontroller 31 leads the microcontroller 32 at least one of the IT operations authentication, data encryption, data decryption, permuted relative data calculations.

If a threat to the security of all data related to the IT security of data and its processing is detected at all levels, the data is overwritten with random data and randomized nonsensical processing and read-write operations are executed.

Advantages of the invention

The solution according to the invention has the following advantages over the prior art:
Real-world attacks through evaluation of current waveforms, electromagnetic fields, as well as re-assembling or debugging the programs are not possible.

• • gepufferte Energieversorgung der ICs Mikrocontroller und nichtflüchtigen Speicher
• • dynamisch zufallsbestimmter Bearbeitung von Programmteilen
• • dynamisch zufallsbestimmte Eintrittspunkte zur weiteren Programmabarbeitung bei vorrangegangener Spannungsunterbrechung
• • zufallsbestimmtes Lesen und Schreiben zufallsbestimmter Daten in nichtflüchtigen mit Zufallsdaten belegten Speichern
• • unabhängig voneinander parallel arbeitenden Mikrokontrollern
• • dynamisch zufallsbestimmter Speisung von zufallsausgewählten Teilanordnungen mit zufallsbestimmten Signalen und zufallsbestimmten Parametern
• • individuelle Toleranzen von Bauelementen und Teile der Teilanordnungen.

Analyzes of the current characteristics of externally powered, sealed three-dimensional rooms do not provide any evaluable insights into the safety-relevant data and their processing

• • buffered power supply of the ICs microcontroller and nonvolatile memory
• • dynamically random processing of program parts
• • dynamically random entry points for further program execution in case of an earlier power interruption
• • Random reading and writing of random data in non-volatile random-access memory
• • independently working microcontrollers
• Dynamically randomized feeding of randomly selected subarrays random signals and random parameters
• • individual tolerances of components and parts of subassemblies.

Analyzes of the external electromagnetic fields of isolated three-dimensional spaces for the purpose of spying out safety-relevant data and their processing also do not provide any information about the safety-relevant data and their processing for the above reasons.

The defense against side channel attacks Analysis of current profiles, of electromagnetic fields is supported by the construction of the isolated three-dimensional space. The implementation of meander-shaped conductor structures and subassemblies such as low-pass, high-pass, bandpass, band-stop filters or voltage dividers distributed on several inner levels prevent penetration into the sealed-off three-dimensional space. The probing of conductor structures, IC pins or parts of the subassemblies change the circuitry and constructively realized solution. Nanoschichtweisees removal or drilling leads to the damage of them. The microcontrollers notice the changes in the circuitry and design solution and damage.

Analyzes of current flows in a sealed-off three-dimensional space without constantly external energy supply, in a sealed, three-dimensional space supplied with energy from the inside, are useless from the outset in order to infer the safety-relevant data and its processing.

The method according to the invention for the IT protection of security-relevant data and its processing, in conjunction with the inventive method features, prevents the spying and manipulation of security-relevant data and their processing. It ensures the IT protection of security-relevant data, such as data for the authentication and authentication of persons and facilities, passwords, key codes, program codes for encryption, authentication of persons and facilities and the IT protection of the processing of security-relevant data.

The IT protection of security-relevant data and its processing is ensured by the dynamically random operation and by the individual tolerances of the structurally structurally realized solution of the partitioned irreversibly connected three-dimensional space. The processing sequence, the data to be processed are never the same, never recognizable and predictable.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102008010788 [0003]
• EP 2462717 [0004]
• WO 2011/015510 [0004]
• DE 102009036386 [0004]
• DE 102008010792 [0005]
• DE 102008010794 [0006]
• US 6507913 [0011]
• DE 102004003078 B4 [0012]
• DE 102008025223 A1 [0015]
• DE 102006037383 A1 [0016]
• DE 102012004780 [0019]

Cited non-patent literature

• IT security in 5D. Space + Time + Randomness (ISBN 978-3-8322-9737-4) [0006]
• Press release from 08.04.2013 at the Hannover Messe, Hall 8 / Stand D06 / 12; see also computer-automation.de: "Researchers develop copy protection measures", online article from December 10, 2012 [0013]
• konstruktion.de: "A kit makes it easier for manufacturers to get started with the protection of their embedded systems", online article from 25.03.2013 [0018]

Claims (10)

Method for IT protection of security-relevant data and its processing, in which components are arranged in planes in a three-dimensional space, characterized in that - at least one microcontroller, a random source consisting of noise source and amplifier, a nonvolatile memory and one of the subassemblies low-pass, high-pass Bandpass, band-stop filter, voltage divider, meander-shaped conductor structures are arranged on more than one inner level of a three-dimensional space, the microcontroller contains at least one nonvolatile internal memory, analog-to-digital converter, digital-to-analog converter and a bus interface and the output of the random source is connected to an input of the analog-to-digital converter, that outer layers enclose the inner planes of the three-dimensional space, wherein at least one outer plane is a ground plane or a shield plane or a ground-shield plane, that one on an inner Eb Ene of the three-dimensional space arranged microcontroller via at least one of the coupling types transformer, capacitive and galvanic communicates with the outside world, wherein in galvanic coupling, the coupling via signal contacts that pierce at least one of the outer planes, - that on at least one of the inner levels of the three-dimensional space at least a part of one of the subassemblies low-pass, high-pass, bandpass, bandstop, voltage divider, meander-shaped conductor structure with individual tolerances is arranged, the rest of the subassembly being placed with its individual tolerances on a different level, - that at least one subassembly is fed by one of the microcontrollers and polled on the output side by the feeding microcontroller and another microcontroller or by the feeding microcontroller or another microcontroller, wherein at least a part of the subassembly is on a different plane e is arranged in relation to the feeding or polling microcontroller, - that the supplying microcontroller in conjunction with the random source determines at least one signal or at least one signal parameter or at least one signal and at least one signal parameter of the signal, stores them in one of the nonvolatile memories selects with the random source at least one signal with the signal parameters and feeds in connection with the random source in at least one of the subassemblies, - that in the intact state of the three-dimensional space via the analog-to-digital converter of the microcontroller on the output side of the respective sub-array queried tolerance-dependent signal values or stored values in one of the nonvolatile memories, wherein the IT-protection of safety-related data and their processing designed interconnectedness of all levels by the tolerance-dependent signal values or from them characterized in that the feeding microcontroller, in conjunction with the random source, feeds at least one signal stored in the non-volatile memory with the signal parameters repetitively into the subassembly, that the tolerance-dependent signal values or interrogated via the analog-to-digital converter of the microcontroller on the output side of the subassembly variables derived therefrom are compared with the tolerance-dependent signal values stored in the nonvolatile memory or variables derived from them, wherein a risk of non-tolerable deviation or non-tolerable deviations is recognized as a threat to the network of all levels designed for IT protection of security-relevant data and its processing. Method according to claim 1, characterized in that - at least two microcontrollers are present in different internal levels, which are connected via at least two of the communication paths of nonvolatile memory, bus systems, inputs and outputs directly or via one of the subassemblies, - that between the microcontrollers more than an agreed random random data is exchanged at random by at least one agreed random communication path, the agreements being negotiated randomly between the microcontrollers with tolerable deviation or tolerable deviations of the requested tolerance dependent signal values or quantities derived therefrom - if one of the errors is false exchanged random data, wrong time of the exchange of the random data or the random data, wrong communication path, an error count 1 in a memory cell of one of non-volatile memory is incremented or decremented. Method according to one of the preceding claims, characterized in that the microcontroller in conjunction with the random source generates random data and permutation control data, evaluates their quality, stores the quality-evaluated random data and permutation control data in the microcontroller internal non-volatile memory or encrypted in at least one of the non-volatile memory, the security relevant Data with at least one random date of this random data encrypted and dependent on at least one other random date of this random data in at least one of the non-volatile Memory stores, wherein at least one of the non-volatile memory is pre-occupied with random data, - that one of the microcontroller performs at least one of the IT operations authentication, data encryption, data decryption, calculations of permuted relative data. Method according to one of the preceding claims, characterized in that - at least one microcontroller reads or writes at least one nonvolatile memory at random times at random addresses of the nonvolatile memory, - that the microcontroller has at least one copy of a random number of the read and written data including the addresses of the into the internal nonvolatile memory of the microcontroller, that after a random time the microcontroller reads the memory contents at random addresses of the nonvolatile memory containing the addresses of the data stored in the internal nonvolatile memory of the microcontroller and the read memory contents and their Comparing addresses in the read volatile memory with the data and assigned addresses stored in the internal nonvolatile memory, - that in the event of an erroneous comparison d read and stored data, memory contents and addresses, an error count 2 in a memory cell of one of the nonvolatile memories is incremented or decremented. Method according to Claim 2 or 4, characterized in that, when a limit value of the respective error count value is reached, at least one of the signals stored in the nonvolatile memory or in the internal nonvolatile memory of the microcontroller is fed with its signal parameters into the respective assigned subassembly and the signals are transmitted via the analog digital system -Umsetzer of the microcontroller on the output side of the sub-array queried tolerance-dependent signal values or derived variables with the stored in the nonvolatile memory tolerance-dependent signal values or derived from them variables are compared, with non-tolable deviation or non-tolerable deviations endanger the IT protection security-relevant data and their Processing designed composite of all levels is detected. Method according to one of the preceding claims, characterized in that the random-source-related microcontroller of the three-dimensional space operates according to a framework program, the program parts for generating random data, for generating permutation control data, for quality evaluation of the random data and permutation control data, for writing and reading the nonvolatile memory, for the random selection of a signal, for the random generation of all random signal parameters, for generating the signal to be fed into the subassembly or the signals to be fed to the subassemblies, for the random selection of the part arrangement to be fed and for feeding the subassembly whose The sequence of randomly determined in conjunction with the random source, - that the generation of random data and permutation control data are controlled by random data, with the number of generi random data or permutation control data or the number of random data to be generated and Permutationssteuerdaten be predetermined by random data. A method according to claim 6, characterized in that - each program part is assigned a permanently assigned program part identifier and at least one changing processing identifier, the program part identifier designating the program part and the processing identifier or processing identifiers indicating the processing status of the program part or indicating - that the program part identifiers are randomly arranged in a processing sequence, wherein at least one processing sequence is stored in memory cells of one of the nonvolatile memories whose addresses are determined in conjunction with the random source, - the processing of a program part by a sequence index of the Processing sequence is displayed, wherein the sequence index of the program part being processed corresponds to the location of the program part identifier in the processing sequence, the value of which is stored in a memory cell of one of the non-volatile memories, and de The content of this memory cell serves as an entry point for further program execution in the event of a voltage interruption, that each processing identifier of the program part being processed is stored in another memory cell of one of the nonvolatile memories. A method according to claim 7, characterized in that - at least one processing identifier of the program part generation of random data of at least one of the two number of random data to be generated, number of for the formation of a random date to indicates that the number of least significant bits of the sampled signal values to be used for the formation of a random data is determined at random, that a processing identifier of the part of the generation of permutation control data specifies the number of permutation control data to be generated, further processing Identifiers identify the selected signal or signals and the sub-assemblies to be fed. Method according to one of the preceding claims, characterized in that - at least one microcontroller, a random source consisting of noise source and amplifier, a non-volatile memory, a charging circuit, a battery and one of the sub-assemblies low pass, high pass, bandpass, bandstop, voltage divider, meandering conductor structures on more are arranged as an inner plane of a three-dimensional space. Method according to one of the preceding claims, characterized in that - all levels are irreversibly connected to each other, - that at tolerable deviation or tolerable deviations of the requested tolerance-dependent signal values or derived variables in conjunction with the random source at least one further signal or at least further signal parameters or at least one further signal and at least further signal parameters of the signal are determined, these are stored in one of the nonvolatile memories, and in connection with the random source the signal with the signal parameters or the signals with the signal parameters are or are fed into at least one of the subassemblies On the output side of the subassembly via the analog-to-digital converter of the microcontroller, the requested tolerance-dependent signal values or variables derived therefrom are stored in one of the nonvolatile memories, that be i Identification of a threat to the IT-protection of security-relevant data and its processing of a network of all levels. The data is overwritten with random data and randomly operated random read and write operations are performed.

Images