Safety‐critical systems are evolving into complex, networked, and distributed systems. As a result of the high interconnectivity among all networked systems and of potential security threats, security countermeasures need to be incorporated. Nonetheless, albeit cutting‐edge security measures are adopted and incorporated during the system development, such as latest recommended encryption algorithms, these protection mechanisms may turn out obsolete because of the long operational periods. New security flaws and bugs are continuously detected. Software updates are then essential to restore the security level of the system. However, system shutdowns may not be acceptable when high availability is required. As expressed by the European Union Agency for Network and Information Security (ENISA) “the research in the area of patching and updating equipment without disruption of service and tools” is needed. In this article, a novel live updating approach for zero downtime safety‐critical systems named Cetratus is presented. Cetratus, which is based on a quarantine‐mode execution and monitoring, enables the update of non‐safety‐critical software components while running, without compromising the safety integrity level of the system. The focus of this work lies on the incorporation of leading‐edge security mechanisms while safety‐related software components will remain untouched. Other non‐safety‐related software components could also be updated.

中文翻译：

---

Cetratus：安全关键系统中零停机安全软件更新的框架

安全关键系统正在演变为复杂的、网络化的和分布式系统。由于所有网络系统之间的高度互连性和潜在的安全威胁，需要纳入安全对策。尽管如此，尽管在系统开发过程中采用并结合了最先进的安全措施，例如最新推荐的加密算法，但由于运行周期长，这些保护机制可能会过时。不断检测到新的安全漏洞和错误。软件更新对于恢复系统的安全级别至关重要。但是，当需要高可用性时，系统关闭可能是不可接受的。正如欧盟网络和信息安全局 (ENISA) 所表示的那样，“需要在不中断服务和工具的情况下修补和更新设备领域的研究”。在本文中，介绍了一种名为 Cetratus 的零停机安全关键系统的新型实时更新方法。Cetratus 基于隔离模式执行和监控，可以在运行时更新非安全关键软件组件，而不会影响系统的安全完整性级别。这项工作的重点在于整合领先的安全机制，而与安全相关的软件组件将保持不变。其他与安全无关的软件组件也可以更新。提出了一种名为 Cetratus 的零停机安全关键系统的新型实时更新方法。Cetratus 基于隔离模式执行和监控，可以在运行时更新非安全关键软件组件，而不会影响系统的安全完整性级别。这项工作的重点在于整合领先的安全机制，而与安全相关的软件组件将保持不变。其他与安全无关的软件组件也可以更新。提出了一种名为 Cetratus 的零停机安全关键系统的新型实时更新方法。Cetratus 基于隔离模式执行和监控，可以在运行时更新非安全关键软件组件，而不会影响系统的安全完整性级别。这项工作的重点在于整合领先的安全机制，而与安全相关的软件组件将保持不变。其他与安全无关的软件组件也可以更新。这项工作的重点在于整合领先的安全机制，而与安全相关的软件组件将保持不变。其他与安全无关的软件组件也可以更新。这项工作的重点在于整合领先的安全机制，而与安全相关的软件组件将保持不变。其他与安全无关的软件组件也可以更新。