DE102017208199A1 - Arithmetic unit and operating method for a computing unit - Google Patents

Abstract

The invention relates to a method for operating a computing unit (100) which is designed to execute a computer program (CP), the computer program (CP) having at least one function call of a function provided in the form of machine code, comprising the following steps: loading ( 200) of at least a portion of the machine code of the function, comparing (210) the at least a portion of the machine code of the function or secondary data derived therefrom with a predetermined reference code (REF).

Description

State of the art

The invention relates to a computing unit which is designed to execute a computer program, wherein the computer program has at least one function call of a function provided in the form of machine code. The invention further relates to an operating method for such a computing unit.

Arithmetic units and operating methods of the aforementioned type are known. The function call makes it possible to extend the functionality of the computer program by other computer programs or program libraries in that the computer program calls the functions present in the other computer programs or program libraries using the function calls mentioned. In particular, this also allows separate maintenance and modification of the computer program on the one hand and the program libraries on the other hand. For example, extensions to the program library and the functions contained therein can be made without having to change the computer program, and vice versa.

The function provided in the form of machine code can be stored, for example, together with the computer program, that is to say in the same memory of the arithmetic unit, or also in another memory, in particular also externally to the arithmetic unit. In particular, the function may also be provided as part of system libraries (libc, "stdio.h", * .dll, etc.) of operating systems for the computing unit or standard libraries. Operating systems or standard libraries, for example, can be installed in advance on a memory or a memory device of the arithmetic unit during commissioning of the arithmetic unit and comprise one or more of the aforementioned functions, in particular provided in the form of standard libraries. Optionally later on the arithmetic unit to be executed application programs such as the aforementioned computer program can then advantageously access the already pre-installed functions, by way of the function calls described above.

It is known that attacks on existing systems and their implementations are possible in such a way that existing functions, which for example are part of system libraries or standard libraries, are exchanged for manipulated functions, which are e.g. in addition to or instead of the regular functionalities of the existing program functions include malicious code and the like. For example, the machine code of the relevant function can be exchanged or manipulated ("patched") directly. This places the manipulated functions, as it were, in a man-in-the-middle attack position, allowing them to manipulate function calls or system calls (function calls of functions provided by an operating system) from application programs running on the arithmetic unit, and / or to change or copy their output or return values to the application program and if necessary to transmit them to an unauthorized recipient.

Disclosure of the invention

Accordingly, it is an object of the present invention to improve a computing unit of the type mentioned and an operating method of the type mentioned in that an increased reliability and security against the aforementioned attacks is given.

This object is achieved in the method of the type mentioned according to the invention by the following steps: loading at least a part of the machine code of the function, comparing the at least part of the machine code of the function with a predetermined reference code.

Alternatively, secondary data derived from the at least one loaded part of the machine code of the function may also be compared with a predefinable reference code.

This advantageously makes it possible to ascertain the "authenticity" of the relevant machine code or at least of the loaded part of the machine code. For example, the arithmetic unit can be provided with a reference code for a specific function during its manufacture or at a later time, for which the computer program of the arithmetic unit has one or more function calls. Using the principle according to the invention, the arithmetic unit can then load at least part of the machine code of the function, for example before the function call of the specific function is to take place, and Compare this loaded part with the already existing in the arithmetic unit reference code. If this information matches, it can be concluded that the function or machine code whose part has been previously loaded and matched with the reference code is a non-manipulated machine code of the function, hence a machine code corresponding to the reference code , Unless this information matches, it can be concluded that the function or machine code whose part has been loaded and compared to the reference code is a machine code modified or manipulated from the original machine code of the function.

In a preferred embodiment, the loading step comprises at least one of the following steps: loading a predeterminable number of bytes from the beginning of the machine code of the function, eg loading n many bytes starting with the starting address of the machine code of the function, loading one predeterminable number of bytes from the end of the machine code of the function, thus, for example, the loading of m many bytes up to the end address of the machine code of the function, - loading a predefinable number of bytes from a predefinable position of the machine code of the function, wherein the specifiable location is different from the beginning and the end of the machine code and the starting address and the end address, respectively - Loading a predefinable number of bytes from a pseudorandom or randomly selected location of the machine code of the function.

In the above-selected variant - or a combination of several variants thereof - it is expedient to provide a matching predefinable reference code for the arithmetic unit for comparison with the loaded data or to make the arithmetic unit available at the latest for the time of comparison.

The predeterminable reference code can be provided, for example, during production of the arithmetic unit by writing the predefinable reference code into an internal and / or external memory assigned to the arithmetic unit. Alternatively or additionally, the provision can also be made later, for example also in the field, by transmitting one or more corresponding reference codes to the arithmetic unit, which can be stored by the arithmetic unit at least temporarily, in particular for future use.

In a further advantageous embodiment, the secondary data can be determined as a function of the loaded at least part of the machine code using a hash function (scatter value function). In particular, in further embodiments it is possible to load one or more areas of the machine code of the function and to base the hash value formation on. Particularly preferred may be a cryptographically secure hash function, e.g. according to the SHA-2 standard (specification available, for example, available at the Internet address http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf), thereby further enhancing tamper resistance.

If secondary data is derived from the at least one loaded portion of the machine code of the function, the step of comparing with a predeterminable reference code may comprise comparing the reference code with the secondary data, e.g. the corresponding hash value. For example, in this case, a reference hash value may be provided as the reference code.

In a further advantageous embodiment it is provided that an error reaction is initiated if the comparison results in a difference between the at least one part of the machine code of the function and the reference code or between the secondary data and the reference code or reference hash value.

If the aforementioned comparison does not result in a difference, it can be provided in further embodiments that the function is called. In this case, it can be concluded from the preceding comparison according to the invention that the relevant function call of the computer program can be carried out without danger, because the machine code of the function to be called has been classified as non-manipulated.

Further aspects of the present invention relate to a computing unit according to claim 7. In further preferred embodiments, the computing unit is designed to carry out at least one embodiment of the method described above.

Another aspect of the present invention is provided by a data processing apparatus according to claim 9. The device is designed to carry out the following steps: storing at least a part of a machine code of a function that can be executed by means of a computing unit, in particular by means of the inventive computing unit, transmitting the at least one part of the machine code as the reference code to the computing unit. The device according to the invention advantageously enables the efficient provision of the reference codes for the application of the inventive principle within the computing unit.

In a preferred embodiment, the device may be associated with a database for storing the reference codes. In further embodiments, the device may also be configured to execute a hash function on the at least part of the machine code to obtain the reference code. The reference hash values obtained here as reference code can also be stored at least temporarily in the database or in other memory and possibly one or more arithmetic units provided as reference code, so that these arithmetic units in the future using the inventive principle, the authenticity of a machine code can check the provided function.

Another aspect of the present invention is provided by a method of processing data according to claim 11. The method may be performed, for example, by the data processing apparatus described above.

Other features, applications and advantages of the invention will become apparent from the following description of embodiments of the invention, which are illustrated in the figures of the drawing. All described or illustrated features, alone or in any combination form the subject matter of the invention, regardless of their summary in the claims or their dependency and regardless of their formulation or representation in the description or in the drawing.

• 1A, 1B, 1C jeweils schematisch ein vereinfachtes Flussdiagramm einer Ausführungsform eines erfindungsgemäßen Betriebsverfahrens für eine Recheneinheit,
• 2 schematisch ein Blockdiagramm einer Ausführungsform einer erfindungsgemäßen Recheneinheit,
• 3 schematisch einen Maschinencode einer Funktion gemäß einer Ausführungsform,
• 4 schematisch ein Blockdiagramm einer Ausführungsform einer erfindungsgemäßen Vorrichtung zur Verarbeitung von Daten,
• 5 schematisch ein vereinfachtes Flussdiagramm einer Ausführungsform eines erfindungsgemäßen Verfahrens zur Verarbeitung von Daten,
• 6 schematisch ein Betriebsszenario gemäß einer Ausführungsform,
• 7 schematisch ein Betriebsszenario gemäß einer weiteren Ausführungsform, und
• 8 schematisch ein Betriebsszenario gemäß einer weiteren Ausführungsform.

In the drawing shows:

• 1A . 1B . 1C each schematically a simplified flowchart of an embodiment of an operating method according to the invention for a computing unit,
• 2 1 is a schematic block diagram of an embodiment of a computing unit according to the invention;
• 3 schematically a machine code of a function according to an embodiment,
• 4 1 is a schematic block diagram of an embodiment of a data processing device according to the invention;
• 5 1 is a simplified flowchart of an embodiment of a method according to the invention for processing data;
• 6 schematically an operating scenario according to an embodiment,
• 7 schematically an operating scenario according to another embodiment, and
• 8th schematically an operating scenario according to another embodiment.

1A schematically shows a simplified flowchart of an embodiment of an operating method according to the invention for a computing unit 100 schematically exemplified in 2 is shown. At the arithmetic unit 100 It may, for example, be at least one of the following components: CPU (central processing unit), processor, microcontroller, digital signal processor, etc.

The arithmetic unit 100 is designed to execute computer programs CP (for example application programs) and has at least one calculation kernel 110 and a memory device 120 which may be volatile memory or nonvolatile memory or any combinations thereof. The computer program CP can, for example, in the storage device 120 be saved. Particularly preferably, the arithmetic unit 100 an arithmetic unit of a so-called embedded system, which is part of a control unit for a motor vehicle or a loT (Internet of Things) device. An operating system BS for the computing unit 100 can also be in the storage device 120 be saved.

The computer program CP can contain one or more function calls FA (in the case of the call of system functions, for example of the operating system BS, also "system calls") which initiate the execution of corresponding functions F in a manner known per se. The function F or a machine code assigned to it, by the calculation kernel 110 is executable, may be part of the computer program CP in some embodiments, and in particular in the memory device 120 , possibly together with the computer program CP be saved. In other embodiments, the machine code of the function (s) F may also be in the form of a separate from the computer program CP be stored program library or function library. Such libraries may also be included in the memory device, for example 120 For example, as part of the operating system for the processing unit installed there 100 , or externally to the arithmetic unit 100 , be provided. In the present case, the function F, which by means of said function call FA of the computer program CP is executable, in 2 symbolic external to the arithmetic unit 100 shown to illustrate that the function F associated machine code can generally be stored anywhere, as long as it is ensured that the computing device 100 for the function call FA can access it.

3 schematically shows by way of example a machine code MCF the function F according to 2 , A beginning characterized by a start address in one of the machine code MCF containing memory is denoted by the reference numeral A and an end characterized by an end address in which the machine code MCF containing memory is denoted by the reference numeral e designated.

The inventive method, see 1A , provides the following steps. First, in a first step 200 at least a part T , compare 3 , the machine code MCF , by the arithmetic unit 100 ( 2 ). The loading 200 can be done, for example, using known program functions or operating system functions, for example by copying a corresponding part T ( 3 ) of the machine code MCF the function F in a working memory 120 the arithmetic unit 100 , Unlike a direct function call FA as with conventional program flows of computer programs CP is provided, where the function F is to be executed, so at the step 200 (for the time being) only a part of the machine code MCF forming the function F from which the machine code MCF containing memory in, for example, the main memory of the arithmetic unit 100 loaded or copied.

Then in step 210 ( 1A ) a comparison of the previously loaded at least one part T of the machine code with a predefinable reference code REF , The predefinable reference code REF is in a preferred embodiment in the arithmetic unit 100 or their storage device 120 stored, for example, is already present when the part T is loaded. In other embodiments, it is conceivable that the predefinable reference code REF even during the execution of the computer program CP is loaded by the arithmetic unit from an external unit (not shown).

If the comparison 210 indicates a difference between the at least one part T and the reference code REF, it can be concluded from one embodiment that the loaded part T or the entire machine code MCF of which the part T in the step 200 has been manipulated because it does not match the reference code REF. In this case, according to 1A an optional error reaction 220 be initiated. The error reaction 220 For example, it may be the subject matter of one actually in the computer program CP provided function call FA the function F ( 2 ), except for the function recognized as being manipulated F to carry out.

In other words, in some embodiments, one may be through the computer program CP for the arithmetic unit 100 provided function call FA conditionally executed, under the condition that the inventive comparison 210 a non-manipulated function or a non-manipulated machine code MCF or part T of the machine code. This embodiment is also illustrated by the flowchart of FIG 1B indicated. The steps 200 . 210 correspond to the above with reference to 1A described steps. step 230 from 1B represents the calling or execution of the function F by means of the function call FA ( 2 ), provided the comparison 210 ( 1B ) no difference between the charged part T the machine code and the reference code REF has resulted.

1C shows a method sequence according to another embodiment. The steps 200 . 210 iw correspond in turn to those previously described with reference to the 1A . 1B described steps 200 . 210 , step 205 provides that, depending on the charged at least one part T ( 3 ) of the machine code MCF the function F secondary data, in particular using a hash function. Further, in the step 210 Comparing now not the loaded part T directly compared with the reference code REF, but the determined hash value from step 205 with a corresponding reference hash value, which is analogous to the reference code REF in the memory device, for example 120 the arithmetic unit 100 can be stored. Unless the comparison 210 according to 1C that results in the step 205 determined hash value with the reference hash value REF can agree in step 230 again the execution of the function F by means of the function call FA be performed. Otherwise, again, is an optional error reaction that is not in 1C is imaginable.

In a further embodiment, the step 200 ( 1A ) of the loading, that a predeterminable number of bytes from the beginning A ( 3 ) or the start address of the machine code MCF is loaded. It is also conceivable in further embodiments that a predefinable number of bytes is loaded up to the end E or the end address of the machine code MCF. The loading of a predeterminable number of bytes of the machine code of the function from any memory location between beginning A and end E is also conceivable in further embodiments. In other embodiments, provision may also be made for a predeterminable number of bytes to be loaded from a pseudorandom or randomly selected memory location of the machine code MCF of the function F to the comparison 210 to be fed. In the above-mentioned embodiments, corresponding matching reference codes are advantageous REF , which correspond to the memory locations to be loaded, provide. For example, in one embodiment, if the last three bytes of the machine code MCF the function F in step 200 can be loaded, then a reference code REF for the corresponding last three bytes of a non-manipulated reference function or its machine code.

4 schematically shows a device 300 for processing data, which is advantageously provided in dependence on a function supplied to it as input data F or the machine code MCF the function F a corresponding reference code REF to investigate. Determining the reference code REF For example, selecting one or more bytes from the machine code MCF the function F in one embodiment, these selected bytes are used as a reference code REF to provide. Particularly preferred by the device 300 determined reference code REF (alone or together with the function F supplied as input data for this purpose or with the machine code MCF of the function F ) through the device 300 get saved. This can for example be in one in the device 300 provided memory device 301 or generally in one of the devices 300 associated memory device (not shown) take place. In one embodiment, the device 300 for example, a computing unit 100 according to 2 include, for example, can be used as a reference system for the determination of the reference codes REF. In other embodiments, the device may 300 For example, also part of a software development environment for the processing unit 100 or for computer programs CP for the arithmetic unit 100 be.

Optionally, the device 300 also about a unit 302 for the formation of hash values, the reference code for the functions supplied on the input side or their machine code also has corresponding hash values through the device 300 are imageable. Also, the hash values can either be local to the memory device 301 the device 300 or in one of the device 300 associated, possibly also provided externally thereto, memory device (not shown) are stored at least temporarily.

The means of the device 300 obtained reference codes REF or reference hash values can either directly after their determination or at a later time or, if appropriate, periodically a target system such as the arithmetic unit 100 be made available to the arithmetic unit 100 the comparison described above 210 can perform.

5 schematically shows a flowchart of an embodiment of an operating method for the device 300 according to 4 , In the step 400 at least part of the machine code MCF is stored, for example in the memory device 301 , In the step 410 the at least one part is referred to the arithmetic unit as a reference code REF 100 transfer.

Optionally, also a step 405 between the steps 400 . 410 be executed, the above-mentioned formation of the hash value in dependence of the input side supplied machine code MCF the function F has the object. In this case, in step 410 also the reference hash value in step 405 has been formed, the arithmetic unit 100 be supplied.

6 schematically shows an operating scenario according to an embodiment. Shown is a runtime environment 500 as determined by the arithmetic unit 100 according to 2 , for example together with a operating system BS for the arithmetic unit 100 , provided. In particular, the runtime environment 500 also include at least one program library having the function F or the machine code MCF holds the function F so that it can be called by function calls FA ( 2 ) from the computer program CP is callable. reference numeral 502 In the present case, an operating state is defined that involves the formation of at least one reference code REF or reference hash value for the function F or their machine code MCF has the object. The reference codes determined here REF can then be stored at least temporarily in a database Db.

The above with reference to 6 described operating scenario, for example, using the arithmetic unit 100 be realized, wherein the arithmetic unit 100 instead of or in addition to the execution of the computer program CP , which is in particular an application program, advantageous for the formation of the reference code REF is usable. In that regard, the functionality of the configuration corresponds to 6 or the associated arithmetic unit 100 essentially the configuration of the device 300 according to 4 ,

In further embodiments, however, it is also conceivable that the device 300 according to 4 the operating scenario according to 6 realized, for example by providence of a reference computing unit, the identical or similar to the arithmetic unit 100 according to 2 is trained. Particularly preferred is the scenario according to 6 realized in a secure operating environment, for example as part of a production of the computing unit 100 , which prevents manipulation by attackers when the reference codes REF are formed.

7 schematically shows an operating scenario according to another embodiment. It is assumed that one or more reference codes REF whose formation has already been described above with reference to the 4 . 5 . 6 has been described, present and at least temporarily stored in the database Db. reference numeral 504 according to 7 designated, together with arrow 410 ' , the transmission of at least one reference code from the database Db to a target system, for example the arithmetic unit 100 according to 2 , This transmission also corresponds to the step, for example 410 of the above with reference to 5 described method.

After transmission to the arithmetic unit 100 can the arithmetic unit 100 For example, before a scheduled function call FA a function F as part of the execution of the application program CP , first the steps 200 . 210 according to 1A Run to compare with the reference code REF verify the authenticity of the machine code of function F.

8th schematically shows an operating scenario according to another embodiment. reference numeral 506 denotes an application level (English: "user-level application"), for example, with the execution of the computer program CP ( 2 ) on the arithmetic unit 100 is associated. reference numeral 500 it already represents the above with reference to 6 described runtime environment.

reference numeral 200 in 8th symbolizes the above with reference to 1A described step of loading at least a part T ( 3 ) of the machine code MCF a function F ( 2 ), if necessary by the computer program CP in the context of a function call FA to be executed. reference numeral 200 ' according to 8th denotes a transfer of the loaded data T to the application level 506 , reference numeral 210 denotes the previously described step of comparing the charged part T with a reference code REF , reference numeral 230 denotes the step of calling the function already described above F in the event that the previous comparison 210 has revealed that no manipulation of the machine code of the function F is present. reference numeral 230 ' denotes a return to the computer program CP after the execution of the function F in the way of the function call FA ,

1 #include <stdio.h>

 2 #include <stdlib.h>
 3 #include <dlfcn.h>
 4
 5 // The assembler of the function fopen starts with
 6 const unsigned char g_FirstSomeByte[3] =
 7 { 0x83, 0xec, 0x1c};
 8
 9 int main()
 10 {
 11 //
 12//
 13 const unsigned char* ptFopenCode =
 14 (const unsigned char*)dlsym( RTLD_NEXT, „fopen“);
 15 // only for debugging purpose:
 16 printf(„fopen = %p [0x%02X, 0x%02X, 0x%02X, ... ]\n“,
 17 &fopen,
 18 ptFopenCode[0], ptFopenCode[1],
 19 ptFopenCode[2]);
 20
 21 // this check for the correct function - depends on the glibc version !!
 22 if (
 23 (ptFopenCode[0]!=g_FirstSomeByte[0]) ||
 24 (ptFopenCode[1]!=g_FirstSomeByte[1]) ||
 25 (ptFopenCode[2]!=g_FirstSomeByte[2])
 26 ){
 27 printf(„»> It seems to be i am hacked !!!\n“);
 28 printf(„»> I will leave the program ...\n“);
 29 exit(-1);
 30 }
 31 printf(„Hello World\n“);
 32 return 0;
 33 }

Hereinafter, by way of example, "Listing 1" is a source code of a computer program written in the C programming language to illustrate aspects of the embodiments. The individual lines of code are preceded by line numbers, in this case 1-33, in order to simplify a following explanation and referencing to the source code:

 1 #include <stdio.h>

 2 #include <stdlib.h>
 3 #include <dlfcn.h>
  4
 5 // The assembler of the function fopen starts with
 6 const unsigned char g_FirstSomeByte [3] =
 7 {0x83, 0xec, 0x1c};
 8th
 9 int main ()
 10 {
 11 //
 12 //
 13 const unsigned char * ptFopenCode =
 14 (const unsigned char *) dlsym (RTLD_NEXT, "fopen");
 15 // only for debugging purpose:
 16 printf ("fopen =% p [0x% 02X, 0x% 02X, 0x% 02X, ...] \ n",
 17 & fopen,
 18 ptFopenCode [0], ptFopenCode [1],
 19 ptFopenCode [2]);
 20
 21 // this check for the correct function - depends on the glibc version !!
 22 if (
 23 (ptFopenCode [0]! = G_FirstSomeByte [0]) ||
 24 (ptFopenCode [1]! = G_FirstSomeByte [1]) ||
 25 (ptFopenCode [2]! = G_FirstSomeByte [2])
 26) {
 27 printf (""> It seems to be on the hacked !!! \ n ");
 28 printf (""> I will leave the program ... \ n ");
 29 exit (-1);
 30}
 31 printf ("Hello World \ n");
 32 return 0;
 33} 

The lines 6 . 7 by listing 1 contain a constant definition of the first 3 bytes of a machine code of a presently considered non-manipulated function "fopen ()" (opening a file). This definition corresponds to the reference code REF as exemplified herein with reference to 2 has been described. In other words, the reference code lies REF in the form of this constant definition in the present Listing considered 1 already before.

In the lines 13 . 14 the function "dlsym ()" is used to load the machine code MCF of the function "fopen ()" actually considered in the relevant library "stdio.h" or "glibc", cf. step 200 according to 1A ,

In the lines 22 - 30 gets through the lines 13 . 14 loaded machine code of the actually contained function "fopen ()" compared with the reference code REF defined here as a constant and by virtue of the program code of the lines 26 - 29 evaluated.

The inventive principle advantageously allows attacks on, for example, a runtime environment for computer programs CP for a computing unit 100 to recognize, in particular a manipulation of machine code one or more provided functions F to recognize. As a result, application programs CP can advantageously also be protected against such manipulations or at least put in a position to detect such manipulations. Compared to conventional methods of software security, which focus primarily on aspects of the security of the computer program or the application programs CP In itself, the approach according to the invention advantageously makes it possible to detect manipulations in the area of the runtime environment, that is to say in particular in the area of by means of function calls FA Callable functions F, which are provided for example by means of program libraries or system libraries or the like.

The inventive principle works in particular independent of scheduling algorithms or temporal fluctuations during the execution of the function F as it is on a comparison of the machine code MCF the function F with the reference code REF based. Therefore, the inventive principle is also on computing units 100 can be used, which use a "scheduling" with interruptions ("preemptive scheduling").

The principle according to the invention can be used very flexibly and as needed. For example, a software developer who runs the computer program CP developed, specify which functions F are to be checked or secured using the principle of the invention. For example, it is conceivable in some embodiments that less important program functions or their calls are not hedged by the inventive principle, whereas more important functions are safeguarded. A dynamic definition of when the inventive principle applies, according to other embodiments is also conceivable, for example during the term of the computer program CP , for example, depending on one or more operating parameters of the computer program CP or the arithmetic unit 100 , For example, it can be provided that the check according to the invention, for example, according to the steps 200 . 210 to 1A in some embodiments always for certain functions F is provided when the arithmetic unit is integrated in a specific target system, which, for example, due to communication patterns or other operating parameters of the arithmetic unit 100 can be recognized.

Particularly advantageously, the application of the principle according to the invention requires comparatively little additional effort, in particular with regard to the execution time of the computer program CP because efficient instructions and mechanisms for comparing the at least one part T of the machine code MCF function F or corresponding hash values with associated reference codes REF or reference hash values. The programming effort is also comparatively low, compare the listing described above by way of example 1 ,

Furthermore, the principle according to the invention can also be used efficiently if the runtime environment or the program library (s) or functions F contained therein or their machine code MCF to change. In this case, only correspondingly updated reference codes are available REF to provide, for example by means of the device 300 according to 4 or by the method according to 5 ,

Claims (11)

A method of operating a computing unit (100) adapted to execute a computer program (CP), the computer program (CP) having at least one function call (FA) of a function (F) provided in the form of machine code, comprising the following steps: Loading (200) at least a part (T) of the machine code (MCF) of the function, comparing (210) the at least part of the machine code of the function or secondary data derived therefrom with a predefinable reference code (REF). Method according to Claim 1 wherein the step of loading (200) comprises at least one of the following steps: loading a predetermined number of bytes from the beginning (A) of the machine code of the function, loading a predetermined number of bytes from the end (E) of the machine code of the function, Loading a predeterminable number of bytes from a predefinable location of the machine code of the function, loading a predeterminable number of bytes from a pseudorandom or randomly selected location of the machine code of the function. The method of any one of the preceding claims, wherein after loading (200), the step of: determining (205) the secondary data in response to the loaded at least a portion of the machine code using a hash function. Method according to Claim 3 wherein the step (210) of comparing comprises comparing the secondary data with a reference hash value. The method of any one of the preceding claims, wherein an error response (220) is initiated when the comparison (210) results in a difference between the at least a portion of the machine code and the reference code or between the secondary data and the reference code or reference hash value. The method of any preceding claim, wherein the function (F) is called (230) if the comparison (210) does not discriminate between the at least a portion of the machine code and the reference code or between the secondary data and the reference code or reference hash value results. Arithmetic unit (100) which is designed to execute a computer program (CP), wherein the computer program (CP) has at least one function call (FA) of a function (F) provided in the form of machine code, wherein the arithmetic unit (100) is designed for this purpose performing the steps of: loading (200) at least part of the machine code (MCF) of the function, comparing (210) the at least one part of the machine code of the function or secondary data derived therefrom with a predefinable reference code (REF). Arithmetic unit (100) according to Claim 7 wherein the arithmetic unit (100) for carrying out the method according to one of Claims 2 to 6 is trained. Device (300) for processing data, wherein the device (300) is designed for carrying out the following steps: storing (400) at least a part of a machine code (MCF) by means of a computing unit, in particular by means of a computing unit (100) according to one of Claims 7 to 8th , executable function (F), transmitting (410) of the at least part of the machine code as a reference code (REF) to the arithmetic unit (100). Device (300) according to Claim 9 wherein the apparatus (300) is adapted to perform a hash function on the at least a portion of the machine code (405) to obtain the reference code (REF). A method of processing data, the method comprising the steps of: storing (400) at least part of a machine code (MCF) of one by means of a computing unit, in particular by means of a computing unit (100) according to one of Claims 7 to 8th , executable function (F), transmitting (410) of the at least part of the machine code as a reference code (REF) to the arithmetic unit (100).

Images