Device unit suitable for operation in a protected and/or open operating state and associated method

1. A device unit comprising a module that configures the device unit with one operating state from various operating states when the device unit is booted and/or during ongoing operation of the device unit;

wherein a first protected operating state of the various operating states is designed to permit an execution of at least one predeterminable operating procedure and to protect it, using defined cryptographic means,

wherein a second operating state of the various operating states is designed to permit at least one changeable operating procedure and to protect it, using predefinable cryptographic means,

wherein when the operating state is intended to be protected during a boot procedure and/or during ongoing operation of the device unit, integrity protection measures for booting and for ongoing operation are provided by the module, the integrity protection measures comprise device authentication and device integrity attestation;

wherein the module is able to freeze a software state loaded by the user that is not authorized by the device manufacturer, wherein the software state loaded by the user is recorded in a reference database during the freeze; and

wherein a third operating state of the device unit is designed to simultaneously permit the first and the second operating states executing simultaneously in a combined mode.

2. The device unit as claimed in claim 1 , wherein the device unit is an embedded system.

3. The device unit as claimed in claim 1 , wherein, depending on the operating state, at least one key for the integrity protection measures is able to be provided on the device side or by a user.

4. The device unit as claimed in claim 3 , wherein device certificate for both the first protected operating state and the second operating state is made available by the module.

5. The device unit as claimed in claim 4 , wherein the deactivation of the first protected operating state is able to be performed by deleting the at least one key and/or revoking the device certificate made available for the first protected operating state.

6. The device unit as claimed in claim 1 , wherein the device unit is able to be activated and/or able to be deactivated.

7. The device unit as claimed in 1 , wherein the first protected operating state, and the second and third operating states are each defined in at least one way selected from the group consisting of: device configuration settings, jumpers, activation codes, a device manufacturer key, the device certificate, a revocation state of the device certificate, a trust anchor, and a communication protocol with a further authority.

8. A method for operating a device unit in one operating state from various operating states when the device unit is booted and/or during ongoing operation of the device unit,

wherein, in a first protected operating state, the execution of at least one predeterminable operating procedure is permitted and protected using defined cryptographic means and

wherein, in a second operating state, the first protected operating state is deactivated and at least one changeable operating procedure is permitted and protected using predefinable cryptographic means, wherein the operating state is configured before and/or during the boot procedure and/or the ongoing operation and, if the configured operating state corresponds to the first operating state, so as then to maintain this state, or if the configured operating state corresponds to the second operating state, so as to deactivate the first operating state and to introduce and/or maintain the second operating state;

wherein, on a device side, when the operating state is intended to be protected during a boot procedure and/or during ongoing operation of the device unit, integrity protection measures suitable for booting and/or suitable for ongoing operation are provided, the integrity protection measures comprise device authentication and/or device integrity attestation;

wherein the module is able to freeze a software state loaded by the user that is not authorized by the device manufacturer, wherein the software state loaded by the user is recorded in a reference database during the freeze; and

wherein a third operating state of the device unit simultaneously permits the first and the second operating states executing simultaneously in a combined mode.

9. The method as claimed in claim 8 , wherein at least one key for the integrity protection measures is provided depending on the operating state.

10. The method as claimed in claim 9 , wherein a device certificate for both the first protected operating state and the second operating state is made available by the module.

11. The method as claimed in claim 10 , wherein the deactivation of the first protected operating state is performed by deleting the at least one key and/or revoking the device certificate made available for the first protected operating state.

12. The method as claimed in method claim 8 , wherein the first protected operating state, and the second and third operating systems are each defined in at least one way selected from the group consisting of: device configuration settings, jumpers, activation codes, a device manufacturer, the device certificate, a revocation state of the device certificate, a trust anchor, and a communication protocol with a further authority.

13. A computer program product, comprising a computer readable hardware storage device having computer readable program code stored therein, said program code executable by a processor of a computer system to implement a method, as claimed in claim 8 .