DE102021129026A1 - Methods and associated computer systems for ensuring the integrity of data - Google Patents

Abstract

The present invention generally relates to a method and corresponding computer-based devices for securing the integrity of data for operating a service (8). The invention relates in particular to a method for generating an intended state (3) of data that can be stored or secured in a medium or system (1), for transmitting the intended state of the data to a further system (7), to ensure the integrity of the data on the further system and to enable later analysis after undesired manipulation of the data. The invention also relates to computer-based devices, a computer system and a computer network, which execute or use or enable this method or the individual method steps therein, as well as computer-readable media with computer-executable instructions.

Description

technical field

The present invention generally relates to a method and corresponding computer-based devices for ensuring the integrity of data for operating a service. The invention relates in particular to a method for generating an intended state of data that can be stored or secured in a medium or system, for transferring the intended state of the data to another system, for securing the integrity of the data on the other system, and to enable later analysis after undesired manipulation of the data. The invention also relates to computer-based devices, computer systems or a computer network, which at least partially or fully execute the method or the individual method steps, and a computer-readable medium with computer-executable instructions.

State of the art

The present invention relates to the technical field of data processing, in particular it is an invention from the field of IT security. Various prior art techniques are known in this technical field of data processing.

Security in IT must be understood less as a state and much more as a process, since there are always new developments, both on the part of the attackers and on the part of the users who want to protect their systems spread the internet quickly.

Various methods have been established to secure communication between computers via networks.

A computer is a physical representation of a universal Turing machine. A computer program is run on it, which provides basic functions such as file access, (visual) user interfaces ((graphic) user interface, (G)UI) or network functionalities (operating system/operating system, OS). The operating system, in turn, allows the operation of additional software that can be written on a different level of abstraction.

A computer usually consists of at least one central processing unit (CPU), main memory (RAM) and permanent storage.

So-called smartphones or loT (Internet of Things) devices, such as webcams, smart lamps, thermostats, but also washing machines, dishwashers, etc. can also be computers according to this definition.

A network is a group of logically separate computer systems that can communicate with each other. If several computer systems are operated on one physical computer and these computer systems can communicate with each other, this is also referred to as a network.

If you want to distinguish between a network of computers and a network of computer systems within a computer, the former is referred to as a physical network and the latter as a virtual network. A virtual local area network (VLAN) can also be established over a physical network between computer systems spread across multiple computers.

Networks are primarily used to exchange information between computers. This exchange of information takes place through various (web) services.

A (web) service consists of at least one computer program that provides at least one functionality over a network. It can also be a virtual network within a host computer. Usually, web services reveal information. The words service, web service or internet service are used interchangeably with web services. Web services are usually characterized by the fact that they can be addressed via specific, predefined protocols such as Hypertext Transfer Protocol (HTTP).

In principle, there are various options for operating and scaling a web service. The obvious way would probably be to run a computer on a network with an operating system and run a web service on that computer.

For scaling, one could then first upgrade the computer until it was at the maximum performance of the current hardware generation.

For a variety of reasons, different means of virtualization, in particular virtual machines and so-called containers (also called jails), have prevailed.

A computer system therefore designates any configuration (computer with operating sys tem, virtual machine, container or similar) that meets the necessary requirements for operating a web service (usually providing a file system, network functionality and operating software).

A computer system that provides a web service in a network is called a server or web server.

A network in which one has to assume that a potential attacker has access to another computer in this network, so that the attacker can send any data over the network and possibly attack his own computer system, is insecure. In particular, the Internet is an insecure network.

Various techniques are available to secure communication over a potentially insecure network.

A technique is known from the prior art, for example, in which a so-called spread value (also referred to as hash value or checksum) is calculated from data. A so-called scatter value function (hash function) is regularly used. Such a hash function is provided, for example, by the secure hash algorithm (SHA, secure hash algorithm). With a hash function, a data block that is not necessarily limited in size can often be mapped to a data block of a fixed size, the hash or hash value. A typical length for a hash is 256 bits, for example. A desirable property of a good cryptological hash function is an approximate injectivity and thereby an approximate collision resistance. The "ideal hash function" is therefore completely left-unique and collision-free and always maps different input data to different hashes.

The Transmission Control Protocol (TCP) is a typical use case for a hash function, where a hash value is calculated for a larger amount of data. For example, a larger volume of data is to be transmitted via a transmission medium that may not be secure, such as the Internet. For example, a technical error can result in part of the data being transmitted incorrectly, or a third party (attacker) manipulating this data.

If the sender of the data calculates its hash value and makes this hash value available to the recipient, the recipient can verify the authenticity and genuineness of the data, provided the hash value itself is genuine and reliable.

Apart from the use of checksums, the use of encryption, in particular asymmetric encryption, has become established. This offers the advantage that the key exchange can take place via an insecure network. A private and a public key are generated. Data encrypted with the public key can only be decrypted using the private key.

In addition to checking the integrity after a transmission using checksums, there is also the protection of integrity by using certificates. This is usually based on the use of asymmetric encryption, in which a web service provides a certificate in which a trustworthy entity (certificate authority) guarantees the identity of the web service (by signing using a certificate). A certificate usually contains a public key that can be used to encrypt the initial communication with the web service.

However, the hash procedure has the disadvantage that the procedure is completely invalidated if the hash value itself is manipulated during a man-in-the-middle attack. In one example, user A (e.g., Alice) transmits a file to user B (e.g., Bob) along with the hash of the file. An attacker E (e.g. Eve) intercepts this communication and replaces the file with a fake file. The fake file contains fake data. Also, E replaces the hash of the file with the hash of the fake file. If B now receives the data and verifies it by calculating the hash function of the file itself and comparing it to the hash value, he concludes that the data has not been tampered with. Thus, E successfully manipulated the data without B realizing this. This cannot necessarily be determined even with common encryption methods such as SSL, since the certificates used for encryption can also be replaced by E, so that both parties communicate encrypted with E and assume that the connection is secure.

Man-in-the-middle attacks can be avoided as far as possible if, during communication between A and B, both exchange beforehand which certificates they expect from each other and can thus prevent an attacker E from manipulating the communication. This process is known as certificate pinning.

As soon as the communication between two computers is sufficiently protected, it becomes easier for a possible attacker and therefore also cheaper to attack one of the communication parties directly in order to intercept or manipulate the communication. It is therefore essential to protect individual computer systems sufficiently.

Attacks on web services are particularly attractive for possible attackers because a successful attack sometimes gives them access to communication with dozens, hundreds or thousands of the victim's customers, who in turn believe the loaded data to be legitimate and trust them.

This results in a special need for protection for operators of web services, especially since the operator's competition or other interest groups such as hackers with a profit intention, but also groups such as Anonymous, which attack targets purely on the basis of an ideological drive.

In addition, at the latest with the introduction of data protection regulations such as the General Data Protection Regulation (GDPR), but also beforehand in the handling of payment data such as credit card data, there is a considerable risk of economic damage associated with the operation of a web service.

In general, it can be said that when protecting computer systems, an approach with as many protective layers as possible is required, since almost any protective system can be defeated, but especially economically motivated attackers usually attack the simplest targets first, since they too are subject to the intention of maximizing profits. Many attacks that are easy to carry out and are successful are usually more profitable than an attack on a complex secured system. Therefore, the benefits of further security measures normally outweigh the costs incurred for the security measures.

The first layer of protection against an attacker is usually a firewall that monitors both incoming and outgoing communication on a computer and allows processes on the computer to be assigned to specific protocols, ports, URLs and IP addresses.

A blacklisting, ie a negative determination of access rights, or a whitelisting, a positive determination of access rights, can take place.

Antivirus programs regularly scan a computer's permanent storage for known malicious programs. To do this, the provider of an antivirus program collects signatures of known malware and often also certain behavioral patterns. The disadvantage here is that checking the storage medium in this way is relatively computationally expensive and therefore time-consuming. It is also necessary that the malware is already known.

Authorization management, which regulates the sensible administration of access authorizations, serves as a further protective measure for securing IT systems. According to the "principle of least privilege", applications and processes should only be started with the minimum necessary authorizations. Furthermore, structures in the file system should only be changeable insofar as this is necessary for the respective technical user (e.g. user for running a web server). This could, for example, have read authorization for the corresponding configuration without being able to write the configuration.

In practice, this measure is very time-consuming and incorrect configurations occur again and again, since the correct configuration of the authorization management is very complex and confusing.

Sandboxing is a procedure in which the operating system usually ensures that an application can only access an area of the file system that is assigned to it, so that this application cannot manipulate data from other applications and in particular no other applications. It is therefore basically an automated special application of authorization management.

Another possibility is the isolation of different services in separate computer systems. Instead of providing several services such as webmail, database and website on one computer within one operating system, these services are distributed to different virtual machines or containers, which means, for example, a compromised mail server does not automatically lead to a compromise of the database.

In addition to the solution using antivirus programs, in which a negative authorization list (programs that are not allowed to run) is kept, there is also the option of only allowing certain applications, the integrity of which in turn is often ensured by checksums. This possibility is called whitelisting.

A computer system that is protected to a particular extent by using other, in particular several complementary methods from the prior art and in particular only to a limited extent from an insecure network such as accessible from the Internet is a protected computer system within the meaning of this document.

In addition to securing a web service, efficiency is also a priority. In particular, long loading times quickly lead to the user "jumping off" and accessing the website of an alternative provider out of impatience, but cost-effective scaling also plays a role in the economic operation of web services.

The data provided by a web service is often recalculated in part or in full at the time of the request. Caching is the process in which the data generated, e.g. HTML documents, is stored for a period of time and delivered again if an identical request occurs during this period, without the entire calculation having to take place again. This saves computing power and minimizes the loading time of the data accordingly.

As already described, when operating a web service, there is sometimes a need to process the load more efficiently, for example to be able to satisfy more users. An essential feature for the success of a web service is sometimes the loading time before the server provides the user with an answer (response time).

In order to keep this loading time as short as possible, additional computer systems are usually provided as servers, which process requests in parallel and can thus significantly reduce the waiting time for a large number of requests on average.

Furthermore, operators of an international web service can also decide to operate computer systems in other data centers in order to reduce the distance to their customers, so that the loading times for the customer are not affected by imponderables such as physical limitations of the transmission lines, peering agreements between different Internet service providers (ISPs ) or the like may be affected.

Furthermore, these methods are usually also suitable for increasing the reliability of a web service.

Procedures of the type described here are called “load balancing” or load distribution.

• Bittorrent ist ein Protokoll zum Austausch von Dateien im Internet. Dabei werden Dateien in direkt zwischen Computern über ein Netzwerk ausgetauscht, ohne dass eine zentrale Instanz zur Koordinierung nötig ist. In dem Protokoll werden ebenfalls Prüfsummen genutzt, um Teile von Dateien auf die korrekte Übertragung zu überprüfen. Auf Basis dieses Protokolls bieten einige Anbieter die Synchronisierung von Daten an. Dies ist bspw. auch geeignet, um die Daten zum Betrieb eines Webservices zwischen verschiedenen Computersystemen, die gemeinsam das Load Balancing umsetzen, zu synchronisieren.

In addition to the methods already described, other technologies that can play a role in the operation of a web service should also be mentioned for the sake of completeness:

• Bittorrent is a protocol for exchanging files on the Internet. Files are exchanged directly between computers over a network without the need for a central authority for coordination. Checksums are also used in the protocol to check parts of files for correct transmission. Some providers offer data synchronization based on this protocol. This is also suitable, for example, for synchronizing the data for operating a web service between different computer systems that implement load balancing together.

In many networks, especially company networks, there is also a so-called proxy, which accepts requests from computers in the network to the Internet and forwards them to the appropriate server. This is usually done for security reasons or for the purpose of prohibitions within the network. A computer's IP address can also be disguised by using a proxy, since the computer addressed only receives the IP address of the proxy.

A reverse proxy is the opposite. This is usually installed before the actual web service when operating a web service, in order to secure the web service, to conceal certain functions of the web service from the Internet, or to implement load balancing.

Task

The object of the present invention is to ensure the integrity of data such as files or data stored in databases on servers offering a service and exposed in a network. Furthermore, it is the object of the present invention to bring about immediate isolation of compromised data, in particular on a server or on a computer-readable medium, which has arisen as a result of manipulation. In addition, the manipulated data should be brought into a state before the manipulation.

Solution

1. a) Erzeugen (S01) eines intendierten Zustands von Daten, insbesondere Dateien und Daten in Datenbanken, auf einem ersten, sicheren Computersystem (primäres System),
2. b) Übertragen (S02) der Daten durch eine gesicherte Verbindung auf einen oder mehrere Server (sekundäres Computersystem) in einem potentiell unsicheren Netzwerk zum Bereitstellen eines Web-Service,
3. c) Prüfen (S03) der Integrität der Daten in der Weise, dass ein Manipulieren der Daten durch einen Angreifer unmittelbar, also bevor der Angreifer, der die Datei manipuliert hat, auffällt und keinen weiteren Schaden anrichten kann,
4. d) sofortiges Wiederherstellen (S04) des intendierten Status der manipulierten Daten vor dem unbeabsichtigten Manipulieren.

According to the invention, the object is achieved by a method with the following steps:

1. a) Generating (S01) an intended state of data, in particular files and data in databases, on a first, secure computer system (primary system),
2. b) Transmission (S02) of the data through a secure connection to one or more servers (secondary computer system) in one potentially insecure network for providing a web service,
3. c) Checking (S03) the integrity of the data in such a way that a manipulation of the data by an attacker is noticed immediately, i.e. before the attacker who has manipulated the file and cannot cause any further damage,
4. d) immediately restoring (S04) the intended status of the manipulated data before unintentional manipulation.

Further advantageous configurations can be found in the dependent claims and the description.

General Benefits

1. a) wissen muss, dass der Webservice durch dieses Verfahren geschützt ist,
2. b) den Agenten (11) nicht angreifen kann, da der Agent selbst durch das Verfahren geschützt ist,
3. c) er den Webservice (8) nicht nutzen kann, um Angriffe auf weitere Nutzer vorzunehmen, ohne dabei entdeckt zu werden,
4. d) auch nicht das primäre System (1) angreifen kann, da dieses durch eine sichere Verbindung ausschließlich mit dem Agenten kommuniziert und sonst nicht mit dem unsicheren Netzwerk verbunden ist.

The method according to the invention significantly increases security when operating a web service, while significantly reducing the technical outlay for protection and thus the costs of operation. The software architecture principles reduce or eliminate the well-known technical risks of operating a web service without in-depth specific knowledge of the program used. Furthermore, the method according to the invention increases the technical complexity and thus the costs for a potential attacker enormously, since this

1. a) must know that the web service is protected by this procedure,
2. b) cannot attack the agent (11) since the agent itself is protected by the method,
3. c) he cannot use the web service (8) to attack other users without being discovered,
4. d) cannot attack the primary system (1) either, since this only communicates with the agent via a secure connection and is otherwise not connected to the insecure network.

Due to the significantly increased costs for the attacker, it cannot be assumed that a secondary system (7) protected in this way would continue to be attacked, since attackers are also subject to economic constraints and must therefore maximize the profit per effort.

Detailed Description of the Invention

According to a preferred embodiment of the present invention, between steps S03 and S04 the data is quarantined after a detected unintentional manipulation, so that the data can be analyzed afterwards but can no longer be executed, which advantageously prevents further damage after the check.

The quarantine of data serves to protect the computer system. For this, conspicuous (manipulated) data, e.g. a corrupted file, can be placed in a directory, preferably on a server, from which a program in this file cannot be started (isolation).

In a preferred embodiment, the integrity of the files is ensured on the basis of cryptographic methods.

Signatures using certificates, for example, are suitable as a cryptographic method. This procedure is standardized and not very error-prone, so so-called false positives should not occur.

Alternatively, it can preferably be ensured on the basis of hash values such as SHA256, SHA512, MD5 with the lowest possible probability of collision that the file is not changed in any way, which may be slightly more error-prone, but also more secure.

In another preferred embodiment of the invention, the files are checked immediately after the data has been manipulated.

This can be done, for example, by regularly checking the integrity, in particular more frequently than once an hour, more particularly more frequently than once every 30 minutes, more particularly more frequently than once every 10 minutes, more particularly more frequently than once every 5 minutes, more particularly more frequently than once every Minute, especially more often than once per second, especially more often than once per 500 milliseconds, especially more often than once per 100 milliseconds, especially more often than once per 10 milliseconds, especially more often than once per millisecond, especially more often than once per 500 microseconds, more particularly more often than once per 100 microseconds, more particularly more often than once 100 microseconds, more particularly more often than once per 10 microseconds, more particularly more often than once per microsecond, more particularly more often than once per 500 nanoseconds, more particularly more often than once per 100 nanoseconds, more particularly more frequently than once per 10 nanoseconds, more particularly more frequently than once per nanosecond, more particularly more frequently than once per 500 picoseconds, more particularly more frequently than once per 100 picoseconds, more particularly frequently more than once per 10 picoseconds, more particularly more than once per picosecond, more particularly more than once per 500 femtoseconds, more particularly more than once per 100 femtoseconds, more particularly more than once per 10 femtoseconds, more particularly more than once per femtosecond, be reached.

In the case of regular checking of the files, the checking interval should preferably be in the order of magnitude of the execution time of the necessary clock cycles of the CPU, depending on the checking algorithm used.

Regular checks within the shortest possible time intervals advantageously shorten the time an attacker has to reach his goals, so that in the best-case scenario he cannot cause any damage. Since many attacks require a manual analysis by the attacker after a (partially) automatic infection of the attacked system, a significantly higher level of security can be achieved with checks at intervals of the order of a few minutes. By further reducing the test interval, highly automated attacks can also be detected and blocked before damage can occur.

Alternatively, the immediacy of the exam can be ensured through the use of watch dogs. Modern operating systems allow the registration of a so-called watch dog. The operating system is informed that a certain process should be started when a file or the contents of a directory are manipulated. This process is called Watch Dog.

In one embodiment of the method according to the invention, based on the use of a watchdog, its immediate reaction to a manipulation of the data can take place without many resources being blocked by the constant checking. It is therefore a resource-saving implementation to ensure the immediacy of checking the manipulated data.

In a further preferred embodiment, supposedly dynamic files, such as HTML pages rendered by PHP, are displayed as static files, such as HTML, JSON or XML files, insofar as this is permitted by the service operated, in step S01 of the method transfer to the secondary system. This is helpful in order to run possible security gaps in the executable program code exclusively on the primary, secure system and to improve the loading times and reliability of the service.

In one possible embodiment of the method according to the invention, the data is transmitted manually from a primary to a secondary system. This offers the operator of the website full control over which data is transmitted and when.

In a preferred embodiment, the data is transmitted automatically in a time-controlled manner, which ensures that the web service in its publicly accessible form is regularly updated to the current intended state of the data. The timing, in turn, can follow a random pattern so that a would-be attacker cannot anticipate when a retransmission will occur.

In a particularly preferred embodiment of the method, the data is transmitted automatically after the intended state of the data has changed. This has the advantage that the publicly accessible version of the data always corresponds to the last updated status.

The transmission of the data can optionally include a) the entire intended state, but preferably b) only the difference to the previous intended state of the data from the primary to the secondary system. According to a), the possibility of errors due to an incorrect delta calculation is more limited, but b) offers a bandwidth saving, which is of great advantage, especially with extensive data. In addition, the incremental update option offers the advantage that even if the communication between the primary and secondary systems is compromised, it is not possible to draw any conclusions about all data relating to the operation of the web service.

In a further development of the method, the change in the intended statuses and their transmission are stored in an audit-proof manner, which makes subsequent auditing possible.

The auditing of the change represents a practice in which it is possible to trace back when which changes were made and by whom. To do this, the data must be able to be stored in an audit-proof manner as unchangeable.

This is preferably done using a blockchain, since information is stored and transmitted in a decentralized manner in this blockchain, which means that S02 can also be implemented at least partially.

Blockchain is a technology that stores information similar to a database. The information is not stored centrally in one computer system, but is located on many systems at the same time. All instances of the database contain all information and the entire history can be called up at any time. As long as no consensus is formed in the network of all instances, historical entries cannot be deleted.

• a) entweder nach jedem erwünschten Manipulieren der Daten durch den Webservice die entsprechende Abfrage (Query) zunächst auf schadhafte Eingaben (bspw. SQL Injections, oder Änderungen an verbotenen Datensätzen, wie Datenbanknutzern) überprüft, dann gesichert an das primäre System übertragen und in der Folge die erfolgten Änderungen der Daten an die sekundären Systeme gespiegelt werden, oder
• b) nach jedem erwünschten Manipulieren der Daten durch den Webservice die Query zunächst auf schadhafte Eingaben (bspw. SQL Injections, oder Änderungen an verbotenen Datensätzen, wie Datenbanknutzern) überprüft und dann gesichert an das primäre System übertragen wird und auch Lesezugriffe auf die Datenbank durch den Agenten geprüft und an das primäre System übertragen werden, sodass keine Datenbank im sekundären System notwendig ist, oder
• c) die Datenbank auf dem Sekundärsystem regelmäßig auf ein unintendiertes Ändern von verbotenen Datensätzen wie Datenbanknutzern oder anderen Daten, die nicht durch den Service bearbeitet werden müssen, überprüft wird.

The method according to the invention also protects data in a database. The integrity of the data in the database is secured by

• a) either after each desired manipulation of the data by the web service, the corresponding query (query) is first checked for defective inputs (e.g. SQL injections or changes to forbidden data records, such as database users), then transferred securely to the primary system and subsequently the changes made to the data are mirrored to the secondary systems, or
• b) after each desired manipulation of the data by the web service, the query is first checked for defective inputs (e.g. SQL injections, or changes to forbidden data records, such as database users) and then securely transferred to the primary system and read access to the database is also carried out by the Agents are checked and transferred to the primary system, eliminating the need for a database in the secondary system, or
• c) the database on the secondary system is regularly checked for unintentional changing of prohibited records such as database users or other data that does not need to be processed by the service.

The protection of data in databases is particularly relevant because it can prevent well-known problems such as so-called SQL injections. SQL injections are a major security problem where an attacker can gain access to any data in a database if the software accessing the database has not been adequately secured. No prior art method protects any third-party software from such attacks.

This is particularly relevant because small and medium-sized companies in particular often use software, e.g. to operate a web shop, that they do not develop themselves, which means that they have no information about possible security gaps.

In a preferred embodiment, a number of secondary systems are operated in parallel in order to distribute the load by means of load balancing and thus to minimize loading times for the service operated and furthermore advantageously to increase reliability.

In a further preferred implementation of the method with multiple secondary systems, after a breach of the integrity of a piece of data, the entire secondary server on which the integrity was damaged is isolated in order to enable later analysis of the entire attack. In this case, the isolation also includes stopping the entire system in order to prevent any running malware from removing its traces. This advantageously facilitates the attribution of the attack.

Furthermore, if a secondary system is isolated, a backup system is preferably started in order to maintain the load balancing function.

In a further embodiment of the method, a reverse proxy is also introduced in order to prevent so-called (D)DoS attacks. This can be done in an embodiment with one or more secondary systems.

Denial of Service (DoS) is an attack strategy on web services in which the attacker tries to send as many requests as possible to the server at the same time, which the server cannot answer all at the same time.

In this way, the service becomes overloaded and customers of the service sometimes receive no response at all, an error, or the response takes a long time. This can cause considerable damage to the operator, especially if the attack lasts longer, since sales are usually lost during this time because potential customers cannot call up the performance of the web service. If the attack occurs from many distributed computer systems, this is referred to as a Distributed Denial of Service (DDoS).

Especially in recent years, Internet of Things (loT) devices such as smart light bulbs or webcams have been used for such DDoS attacks. This is particularly possible because their software is rarely provided with security updates. By using the method according to the invention in such IoT devices, these would also be protected and the use of such devices for corresponding attacks would be made significantly more difficult.

Furthermore, a reverse proxy is implemented in the method according to the invention, which serves, among other things, to protect against (D)DoS attacks in order to advantageously contribute to shorter loading times and to avoid a failure of the service with the associated loss of revenue.

In particular, several secondary systems can also be used for the purpose of load balancing and reducing loading times through clever spatial distribution.

Due to its application to different computer systems, a primary and at least one secondary system, the method according to the invention is implemented by one or more computer program products.

A first computer program product that implements step S01, wherein supposedly dynamic data are preferably also converted into static data. In addition, it controls the transmission of the intended status to the server in the insecure network either manually, time-controlled or automatically after the intended status of the data has changed. It is also suitable for transmitting the intended status either in full or as a differential update.

A computer-readable medium (data carrier), comprising the first computer program product for defining the intended state in S01.

The computer system comprising the first computer program product and the computer-readable medium with the first computer program product is the primary system.

The secondary computer program product implements steps S03 and S04. The bringing of the manipulated data into quarantine is preferably implemented, with the checking of the data taking place by means of cryptographic methods immediately after their manipulation and the database being secured by one of the options mentioned above. Should the secondary computer program product terminate, it will be automatically restarted by the secondary computer system.

The secondary computer program product is contained on a secondary computer-readable medium (data carrier).

The secondary computer program product preferably protects a tertiary computer-readable medium (data carrier).

A secondary computer system preferably includes a secondary and a tertiary medium. A medium can combine the properties of the secondary and tertiary medium. The computer program products of this application are preferably also protected themselves by a secondary computer program product, so that they themselves are advantageously protected against manipulation.

A tertiary computer program product implements the transfer of intended state from the primary to the secondary system. It is part of a computer-readable medium and runs on either the primary or a secondary or another tertiary system.

The computer program products can also be expanded by plugins to include additional functionalities for operating and improving a web service. For example, a plugin could be added to process and analyze the generated data traffic, which advantageously means that this service does not have to be provided by a third party and other aspects of data economy and data protection can be preserved by keeping the information with the operator of the web service.

There are several methods available to ensure that the computer program product itself is not tampered with, which would void the protection. These positively make it more difficult to change the functionality of the computer program product, so that the protection is further increased.

On the one hand, the computer program product for implementing the method can monitor the folder structure or the medium in which it is stored. While it resides in the computer's memory, it is highly protected from manipulation. If the program itself is now modified on the medium, it can recognize the change and restore itself.

Furthermore, the program can be stored on a medium that cannot be rewritten, such as an EPROM or an SD card with write protection.

Furthermore, many operating systems already protect parts of their directory structure in such a way that they can only be written to in safe mode and otherwise cannot even be modified by the system itself. The computer program product could be stored in such a part of the directory structure while using the safe mode in order to further protect it advantageously.

Manipulation of the computer program product in the main memory is also possible. The structure of the program in working memory could be recognized by a person skilled in the art, which would allow him to search for the program in memory and manipulate it by exploiting other vulnerabilities, such as buffer overflows. With targeted measures, the computer program product can make such attacks more difficult. To do this, it fills random memory areas with random content to make it difficult to analyze and manipulate the instructions contained in the program by changing their position with each execution and over time.

Further advantageous refinements and developments result from the dependent claims and from the description with reference to the figures.

exemplary embodiments

The present invention is explained in more detail on the basis of the following figures and exemplary embodiments, without restricting the invention to these.

• 1: eine schematische Darstellung des primären Computersystems CS1 (1). Abgebildet ist ein auf CS1 laufender Webservice (2) mit dynamischen Inhalten („index.php“ und „shop.php“), sowie eine statische Bilddatei (image.png). Beide dynamische Dateien verwenden die Datenbank (4), allerdings liest (5) die Datei „index.php“ Daten aus der Datenbank (4), die sich in diesem Beispiel nicht ändern. Daher kann die Datei „index.php“ durch ein Computerprogrammprodukt nach den Ansprüchen 12 und 5 in eine statische Datei (index.html) umgewandelt werden (S01). Die Datei „shop.php“ liest und schreibt (6) Daten aus der bzw. in die Datenbank (4). Daher kann diese nicht in eine statische Datei umgewandelt werden. Auch an der bereits statischen Datei ändert sich nichts. Somit ergibt sich der intendierte Zustand der Dateien des Webservice (3). Ferner werden in Schritt S01 die Hashes, angedeutet durch alphanumerische Zeichenketten neben den Dateinamen, berechnet und gespeichert. Der Schild soll die entsprechende Sicherung der Dateien verdeutlichen.
• 2: Eine schematische Darstellung des CS1 (1) aus 1 samt eines zweiten, sekundären Systems CS2 (7) in einem unsicheren Netzwerk. Durch S02 wird der intendierte Zustand (3) der Datenbank (4) sowie der Dateien des Webservice (2) in das sekundäre System (7) überführt. Ein Agent (11) wird bei Veränderungen der Daten auf Dateisystemebene (gemeldet durch das Betriebssystem (10)) oder zeitlich regelmäßig tätig, um die Integrität der Daten des Webservice (2) zu überprüfen. Änderungen an der Datenbank (4) (in dem Beispiel durch die Datei „shop.php“) werden durch den Agenten (11) geprüft (13), bevor dieser diese Änderungen an die Datenbank (4) im primären System (1) überträgt (14) und diese erneut durch S02 in die sekundäre Datenbank (9) des sekundären Systems (7) eingepflegt werden. Die dynamischen Dateien (im Beispiel die Datei „shop.php“) lesen (12) die notwendigen Daten aus der Datenbank im sekundären System (9). Der Schritt S03, das Prüfen der Dateien des sekundären Webservice (8) durch den Agenten (11) nach der Manipulation, wird entweder zeitgesteuert oder durch einen Watchdog ausgelöst.
• 3: Eine schematische Darstellung des primären Computersystems (1) und des sekundären Computersystems (7). In diesem Fall gibt es keine Datenbank im sekundären System (7). Durch S02 wird der intendierte Zustand (3) der Dateien des Webservice (2) in das sekundäre System CS2 (7) übertragen. Erneut löst das Betriebssystem (10) entweder bei Veränderung der Daten (über einen Watchdog) oder zeitlich gesteuert Schritt S03 aus, woraufhin der Agent (11) die Dateien des Webservice (8) im sekundären System (7) mit den intendierten Daten (3) des primären Systems (1) abgleicht. Da die sekundäre Datenbank entfällt, findet der Lesezugriff (15) von Dateien wie der „shop.php“ auf die Datenbank (4) des primären Systems (1) durch den Agenten (11) statt (16). Der Schreibzugriff (13) wird analog zu 2 durch den Agenten (11) geprüft und danach an die primäre Datenbank (4) übertragen (14).
• 4: Schematische Darstellung des Agierens des Agenten (11) im Falle einer unerwünschten Manipulation (17 der Dateien (S04)).
  1. A) Das Verfahren mit Hilfe eins Watch Dog: In diesem Fall reagiert (23) das Betriebsystem (10) auf die Änderung der Dateien des Webservices (8) und informiert (22) den Agenten (11). Dieser prüft (20) alle Dateien des Webservice im ggf. manipulierten Zustand (18). Nachdem er mittels eines kryptographischen Verfahrens, in diesem Fall mittels eines Hashwertes, eine Änderung erkannt hat, stellt er die erwünschten Datei-Zustände (19) wieder her (21) und verbringt die manipulierten Dateien ggf. zwecks späterer Analyse in Quarantäne.
  2. B) In diesem Fall meldet (22) das Betriebssystem (10) regelmäßig die Systemzeit oder das Überschreiten eines bestimmten Zeitintervalls an den Agenten (11), der den gegenwärtigen Zustand der Dateien des Webservices (18) prüft (20) und nach einer unerwünschten Manipulation (17) zu dem Schluss kommt, dass diese manipuliert wurden, woraufhin er den erwünschten Zustand der Dateien wiederherstellt (21) und ggf. die manipulierten Dateien (18) zwecks späterer Analyse in Quarantäne verbringt.
  Allen Ausführungsformen ist der Umstand gemein, dass das primäre Computersystem CS1 (1) nur durch eine sichere Verbindung durch den Agenten (11) erreicht werden kann. Der Webservice (2) des primären Systems (1) ist ausschließlich notwendig, um den intendierten Zustand (3) herzustellen und vermeintlich dynamische Dateien in statische Dateien umwandeln zu können (bspw. durch Rendering von HTML durch eine PHP-Datei). Das Feststellen des intendierten Zustands in Schritt S01 kann durch verschiedene kryptographische Methoden erfolgen. 2 und 3 unterscheiden sich lediglich in der Verwendung der Datenbank, insbesondere darin, wie die Integrität der Daten in der Datenbank sichergestellt wird.. Prinzipiell kann es eine beliebige Zahl der sekundären Systeme (7) geben, auch wenn dies nicht grafisch dargestellt wird. Der Agent (11) dient in der Konfiguration mit einem sekundären System (7) ferner auch als Reverse Proxy zum Schutz vor DDoS-Angriffen, sodass auch bei den sekundären Systemen (7) kein direkter Zugriff auf den Webservices (8) des sekundären Systems (7) erfolgt.

while showing

• 1 : a schematic representation of the primary computer system CS1 (1). A web service (2) running on CS1 with dynamic content (“index.php” and “shop.php”) is shown, as well as a static image file (image.png). Both dynamic files use the database (4), however (5) the "index.php" file reads data from the database (4), which in this example does not change. Therefore, the file "index.php" can be converted into a static file (index.html) by a computer program product according to claims 12 and 5 (S01). The "shop.php" file reads and writes (6) data from and into the database (4). Therefore, it cannot be converted to a static file. Nothing changes in the already static file either. This results in the intended state of the web service files (3). Furthermore, in step S01 the hashes, indicated by alphanumeric character strings next to the file names, are calculated and stored. The sign is intended to clarify the corresponding backup of the files.
• 2 : A schematic of the CS1 (1) from 1 along with a second, secondary system CS2 (7) in an insecure network. S02 transfers the intended state (3) of the database (4) and the web service files (2) to the secondary system (7). An agent (11) is active when there are changes in the data at the file system level (reported by the operating system (10)) or at regular intervals in order to check the integrity of the web service (2) data. Changes to the database (4) (through the "shop.php" file in the example) are checked (13) by the agent (11) before it transfers these changes to the database (4) in the primary system (1) ( 14) and these are again entered into the secondary database (9) of the secondary system (7) by S02. The dynamic files (in the example the "shop.php" file) read (12) the necessary data from the database in the secondary system (9). Step S03, checking the files of the secondary web service (8) by the agent (11) after the manipulation, is either time-controlled or triggered by a watchdog.
• 3 : A schematic representation of the primary computer system (1) and the secondary computer system (7). In this case there is no database in the secondary system (7). The intended state (3) of the files of the web service (2) is transferred to the secondary system CS2 (7) by S02. The operating system (10) again triggers step S03 either when the data changes (via a watchdog) or in a time-controlled manner, whereupon the agent (11) updates the files of the web service (8) in the secondary system (7) with the intended data (3) of the primary system (1). Since there is no secondary database, the read access (15) of files such as "shop.php" to the database (4) of the primary system (1) takes place through the agent (11) (16). The write access (13) is analogous to 2 checked by the agent (11) and then transmitted (14) to the primary database (4).
• 4 : Schematic representation of the actions of the agent (11) in the event of undesired manipulation (17 of the files (S04)).
  1. A) The method using a watch dog: In this case (23) the operating system (10) reacts to the change in the files of the web service (8) and informs (22) the agent (11). This checks (20) all files of the web service in possibly manipulated state (18). After he has recognized a change using a cryptographic method, in this case using a hash value, he restores the desired file states (19) (21) and, if necessary, quarantines the manipulated files for later analysis.
  2. B) In this case (22) the operating system (10) regularly reports the system time or the exceeding of a certain time interval to the agent (11), which checks (20) the current status of the files of the web service (18) and after an unwanted manipulation (17) comes to the conclusion that these have been manipulated, whereupon he wishes the restores the files to their current state (21) and, if necessary, quarantines the manipulated files (18) for later analysis.
  All of the embodiments have in common that the primary computer system CS1 (1) can only be reached by the agent (11) via a secure connection. The web service (2) of the primary system (1) is only necessary to create the intended state (3) and to be able to convert supposedly dynamic files into static files (e.g. by rendering HTML with a PHP file). The intended state can be determined in step S01 using various cryptographic methods. 2 and 3 differ only in the use of the database, in particular how the integrity of the data in the database is ensured. In principle there can be any number of secondary systems (7), although this is not shown graphically. In the configuration with a secondary system (7), the agent (11) also serves as a reverse proxy to protect against DDoS attacks, so that the secondary systems (7) also have no direct access to the web services (8) of the secondary system ( 7) done.

reference list

1

Computer system 1 (primary system)

2

Web service on the primary system

3

Intended status of the web service files after reduction to static files (S01) by the primary computer program product

4

Database of the web service on the primary system

5

Read access of the "index.php" file to the database

6

Read/write access of the shop.php to the database

7

Computer system 2 (secondary system)

8th

Web service with the intended state of the files after step S02

9

Database on the secondary system, with desired state synchronized by S02

10

Operating system mechanism for starting the test (S03) (watchdog or timer)

11

Agent Running on Computer System 2 (Secondary Computer Program Product)

12

Read access to shop.php file from secondary system database

13

Write access to the file "shop.php" sent to the agent (14)

14

Write access to the "shop.php" file after verification to the agent for updating the desired state of the primary system database

15

Read access to the shop.php file, where the agent reads directly from the primary system's database (16) without first mirroring it to a secondary database

16

Agent read access triggered by read access to shop.php file (15) checked by agent (11)

17

Manipulation of the web service files

18

Manipulated web service

19

Web service in restored intended state

20

Determination of the manipulated state of the files by the agent

21

Restoration of the intended state by the agent with deletion of the manipulated files or preferably bringing the files in the manipulated state into "quarantine"

22

Signal from the system to the agent that a file has been changed (watchdog) or a time interval has elapsed (timer)

23

Registering the file change with the system

Claims (25)

Method for protecting the integrity of data, comprising the following steps: a) generation (S01) of an intended state (3) of data of a web service (2) on a first, secure computer system (primary system) (1), b) transmission ( S02) the data through a secure connection to one or more servers (secondary computer system) (7) in a potentially insecure network for providing a web service, c) checking (S03) the integrity of the data in such a way that manipulation of the Files and data are immediately noticed by an attacker, d) immediate restoration (21) (S04) of the inten ed state of the data (19) before unintentional manipulation. procedure after claim 1 , whereby between step S03 and S04 the data is quarantined after the manipulation (17) so that it can be analyzed afterwards, but can no longer be executed and can therefore not cause any damage. procedure after claim 1 or 2 , whereby the integrity of the data is ensured on the basis of cryptographic procedures. Procedure according to one of Claims 1 until 3 , wherein the checking of the files (20) takes place immediately after the manipulation (17) of the files. Procedure according to one of Claims 1 until 4 , wherein in step S01 supposedly dynamic files, such as HTML pages rendered by PHP, are transmitted to the secondary system as static files, such as HTML, JSON or XML files, to the extent permitted by the service operated. Procedure according to one of Claims 1 until 5 , whereby the triggering of the transmission of the data from a primary system (1) to a secondary system (7) a) is triggered manually, or b) is triggered automatically in a time-controlled manner, or c) is triggered automatically after a change in the intended state of the data . Procedure according to one of Claims 1 until 6 , in which either the entire intended state (3), but preferably only the difference to the previous intended state of the data from the primary system (1) to the secondary system (7) is transmitted. Procedure according to one of Claims 1 until 7 , wherein the change in the intended states (3) and their transmission to a secondary system in step (S02) is stored in an audit-proof manner, which enables later auditing. Procedure according to one of Claims 1 until 8th , where the data is selected from data in a database, and where the integrity of the data in the database (4) is secured by a) either each request to the database (query) first for defective inputs (e.g. SQL injections, or changes on prohibited data records, such as database users), then securely transferred to the primary database (4) of the primary system (1) and subsequently the changes made to the secondary database (9) in the secondary system (7) are mirrored, or b ) after each desired manipulation of the data (13) by the web service, the query is first checked for defective inputs (e.g. SQL injections, or changes to forbidden data records, such as database users) and then securely transferred to the primary system (1) (14) and also read accesses to the database (15) are checked by the agent (11) and transferred to the primary system (16, so that no database is necessary in the secondary system (7), or c) the database on the secondary system (9) is regularly checked for unintentional changing of prohibited data records such as database users or other data that does not need to be processed by the service (8). Procedure according to one of Claims 1 until 9 , whereby several secondary systems (7) are operated in parallel to enable load balancing. procedure after claim 10 , where after breaching the integrity of a datum, the entire secondary system (7) on which the integrity has been damaged (compromised system) is isolated. procedure after claim 11 , where after the compromised system is isolated, another secondary system is started as a backup system. Procedure according to one of Claims 1 until 9 , wherein a reverse proxy is used on the secondary system (7) in order to advantageously protect the web service (8) against (D)DoS attacks. Procedure according to one of Claims 10 until 13 , whereby protection against (D)DoS is implemented in addition to load balancing. Computer program product that executes step S01 claim 1 executable, with supposedly dynamic data being converted into static data. A computer-readable medium comprising a computer program product according to claim 15 . A primary computer system (1) comprising a computer-readable medium according to Claim 16 , which is used to define the defined status of the data claim 1 suitable is. Computer program product that performs steps S03 and S04 of claim 1 implemented, preferably any combination of the features from the claims 2 , 3 , 4 and 9 imple is mented, wherein all features from the claims mentioned are particularly preferably implemented. A computer-readable medium comprising a computer program product according to Claim 18 . A computer-readable medium protected at least in part by a computer program product Claim 18 . A computer system comprising a computer-readable medium claim 19 and a computer-readable medium claim 20 , also being a computer-readable medium claim 19 and claim 20 can fulfill. Computer program product, step S02 of claim 1 implemented, preferably any combination of the features from the claims 6 , 9 , 19 , 11 , 12 , 13 and 14 is implemented, wherein all features from the claims mentioned are particularly preferably implemented. A computer-readable medium comprising a computer program product according to Claim 22 . A computer system comprising a computer-readable medium Claim 23 . Network, comprising computer systems according to claims 17 , 21 and 24 .

Images