Computer system for providing a plurality of functions for a device, in particular for a vehicle, by separation of a plurality of zones

A computer-implemented method for a computer system, the computer system being configured to provide a plurality of functions for a device with a separation of a plurality of zones, the computer system including a plurality of system modules that are each a respective hardware and/or software component of the computer system, wherein:

• (I) the respective hardware and/or software component of the computer system are:
• (i) configured to provide respective functions that are differently critical for operational security of the device, (ii) grouped within the computer system into different ones of the plurality of zones, so that different ones of the plurality of zones are populated with different subsets of the plurality of system modules;
• (II) each zone of the plurality of zones is a logically and/or physically delimitable unit in the computer system, (III) different ones of the plurality of zones are treated by the computer system at a zone-level as being of different trustworthiness levels so that a first zone of the plurality of zones more trustworthy than a second, less trustworthy zone of the plurality of zones, so that a danger of a manipulation of a more trustworthy zone is lower than of a less trustworthy zone, (IV) the different trustworthiness levels result from assignments by the computer system of different subsets of a plurality of protective mechanisms, which handle module protection from manipulation, to different ones of the plurality of zones, so that, for each of the plurality of zones, the respective subset of the plurality of protective mechanisms is indirectly assigned to perform their respective protections for those respective ones of the plurality of system modules that are grouped into the respective zone, (V) the assignments of the different subsets of the plurality of protective mechanisms result in the first zone being assigned a first one of the subsets of the protective mechanisms and the second zone being assigned a second one of the subsets of the protective mechanisms, and (VI) the first one of the subsets of the protective mechanisms protects those of the plurality of modules that are assigned to the first zone from manipulation to a greater extent than that to which the second one of the subsets of the protective mechanisms protects the those of the plurality of modules that are assigned to the second zone, the method comprising:
• sequentially performing, by a security device included as part of the first one of the subsets of the protective mechanisms, a verification of at least some steps of a booting process those of the plurality of system modules that are grouped into the first zone, the verification verifying against manipulation or corruption of the respectively verified steps, thereby establishing a chain of trust for proceeding from one of the at least some steps to subsequent ones of the at least some steps, wherein the second one of the subsets of the protective mechanisms are such that a booting process of those of the plurality of system modules that are grouped into the second zone proceeds without the chain of trust.

A computer system configured to provide a plurality of functions for a device with a separation of a plurality of zones, the computer system comprising:

• a plurality of system modules that are each a respective hardware and/or software component of the computer system, wherein:
• the respective hardware and/or software component of the computer system are:
• configured to provide respective functions that are differently critical for operational security of the device;
• and
• grouped within the computer system into different ones of the plurality of zones, so that different ones of the plurality of zones are populated with different subsets of the plurality of system modules;
• each zone of the plurality of zones is a logically and/or physically delimitable unit in the computer system;
• different ones of the plurality of zones are treated by the computer system at a zone-level as of different trustworthiness levels so that a first zone of the plurality of zones being more trustworthy than a second, less trustworthy zone of the plurality of zones, so that and a danger of a manipulation of a more trustworthy zone is lower than of a less trustworthy zone;
• the different trustworthiness levels result from assignments by the computer system of different subsets of a plurality of protective mechanisms, which handle module protection from manipulation, to different ones of the plurality of zones, so that, for each of the plurality of zones, the respective subset of the plurality of protective mechanisms is indirectly assigned to perform their respective protections for those respective ones of the plurality of system modules that are grouped into the respective zone;
• the assignments of the different subsets of the plurality of protective mechanisms result in the first zone being assigned a first one of the subsets of the protective mechanisms and the second zone being assigned a second one of the subsets of the protective mechanisms;
• the first one of the subsets of the protective mechanisms protects those of the plurality of modules that are assigned to the first zone from manipulation to a greater extent than that to which the second one of the subsets of the protective mechanisms protects the those of the plurality of modules that are assigned to the second zone;
• the first one of the subsets of the protective mechanisms includes a security device for sequentially performing verification of at least some steps of a booting process of those of the plurality of system modules that are grouped into the first zone, the verification verifying against manipulation or corruption of the respectively verified steps, thereby establishing a chain of trust for proceeding from one of the at least some steps to subsequent ones of the at least some steps;
• and
• the second one of the subsets of the protective mechanisms are such that a booting process of those of the plurality of system modules that are grouped into the second zone proceeds without the chain of trust.

A non-transitory computer-readable medium on which is stored a computer program that is executable by hardware of a computer system and that, when executed by the hardware of the computer system, causes the hardware of the computer system to execute a method for the computer system, the computer system being configured to provide a plurality of functions for a device with a separation of a plurality of zones, the computer system including a plurality of system modules that are each a respective hardware and/or software component of the computer system, wherein:

• (I) the respective hardware and/or software component of the computer system are:
• (i) configured to provide respective functions that are differently critical for operational security of the device, (ii) grouped within the computer system into different ones of the plurality of zones, so that different ones of the plurality of zones are populated with different subsets of the plurality of system modules;
• (II) each zone of the plurality of zones is a logically and/or physically delimitable unit in the computer system, (III) different ones of the plurality of zones are treated by the computer system at a zone-level as being of different trustworthiness levels so that a first zone of the plurality of zones more trustworthy than a second, less trustworthy zone of the plurality of zones, so that a danger of a manipulation of a more trustworthy zone is lower than of a less trustworthy zone, (IV) the different trustworthiness levels result from assignments by the computer system of different subsets of a plurality of protective mechanisms, which handle module protection from manipulation, to different ones of the plurality of zones, so that, for each of the plurality of zones, the respective subset of the plurality of protective mechanisms is indirectly assigned to perform their respective protections for those respective ones of the plurality of system modules that are grouped into the respective zone, (V) the assignments of the different subsets of the plurality of protective mechanisms result in the first zone being assigned a first one of the subsets of the protective mechanisms and the second zone being assigned a second one of the subsets of the protective mechanisms, and (VI) the first one of the subsets of the protective mechanisms protects those of the plurality of modules that are assigned to the first zone from manipulation to a greater extent than that to which the second one of the subsets of the protective mechanisms protects the those of the plurality of modules that are assigned to the second zone, the method comprising:
• sequentially performing, by a security device included as part of the first one of the subsets of the protective mechanisms, a verification of at least some steps of a booting process those of the plurality of system modules that are grouped into the first zone, the verification verifying against manipulation or corruption of the respectively verified steps, thereby establishing a chain of trust for proceeding from one of the at least some steps to subsequent ones of the at least some steps, wherein the second one of the subsets of the protective mechanisms are such that a booting process of those of the plurality of system modules that are grouped into the second zone proceeds without the chain of trust.