Method for detecting anomalies suggesting a manipulation during a secure starting operation of a software-controlled device

A device comprising at least one processor, volatile and nonvolatile memory and at least one further system component necessary for the operation of the microprocessor, which are communicatively connected to one another via one or more data lines or one or more data buses, wherein computer program instructions are retrievably stored in the nonvolatile memory and, when the instructions are executed by the at least one processor, configure the device to carry out a method comprising:

• reading out at least one operating parameter from at least one system component necessary for an operation of the microprocessor, and comparing the at least one operating parameter read out with corresponding stored reference values, wherein, if the comparison shows a difference, a first signal, which signals a recognized side channel attack and a failed booting operation, is output and the method is ended and the further booting operation is terminated,
• checking a state of a flag that is set during an as yet unsuccessfully concluded booting operation, wherein, if the flag is set, a second signal, which signals a recognized fault injection attack and a failed booting operation, is output and the method is ended and the further booting operation is terminated, wherein, if the flag is not set, the flag is set after the check,
• calculating a hash value or a checksum over at least one block of a software or software component, and comparing with a hash value or checksum stored for a same at least one block of the software or software component during a preceding booting operation, or calculating an authentication code of software to be loaded or a software component to be loaded, and comparing the calculated authentication code with the authentication code of the preceding booting operation read out from a memory, wherein, if the comparison shows a difference, a third signal, which signals a recognized attack and a failed booting operation, is output and the method is ended and the further booting operation is terminated,
• calculating, if not already done previously, an authentication code of software to be loaded or a software component to be loaded, and comparing the calculated authentication code with a reference code read out from a memory, wherein, if the comparison shows a difference, a fourth signal, which signals a recognized fault injection attack and a failed booting operation, is output and the method is ended and the further booting operation is terminated,
• replacing the authentication code of the preceding booting operation read out from the memory with the authentication code calculated for the current booting operation, and deleting the flag that is set during an as yet unsuccessfully concluded booting operation.