DE102016106602A1 - Method and device for establishing a secure communication between a first network device (initiator) and a second network device (responder) - Google Patents

Abstract

The invention relates to a method for establishing a secure communication between a first network device (initiator) and a second network device (responder) in a communication network and an arrangement of network device suitable therefor, which are characterized in that by using a symmetric cryptosystem in which both network devices each use the same secrets as keys for encrypting and decrypting data records, each performing a separate authentication / authentication with respect to the first and the second network device before generating a secret to be used for the secure communication as a shared key.

Description

The invention relates to a method for secure communication between a first network device (initiator) and a second network device (responder) in a communication network and an arrangement of network devices suitable for this, in particular between network devices designed as embedded systems.

In the following description and the appended claims are referred to as network devices devices that communicate both independently and by a user communicate via at least one network with other devices, plus software components that have runtime environment access to at least one network and independent of it as well prompt a user to communicate with other devices.

As is known, in certain cases, the communication between network devices can be securely managed, for example to ensure the integrity, confidentiality and / or availability of the communication.

The integrity of the communication is jeopardized, for example, by disturbing influences which corrupt communication contents or by an active attack in which a third party modifies, suppresses and / or adds communication contents to its advantage.

Confidentiality of communications, for example, is compromised when communication content is inadvertently transmitted to the wrong addressee or an attacker can learn communication content.

Availability is jeopardized, for example, when inadvertently or intentionally recourse is made to communication resources by network devices with which no communication is intended or desired so that there are too few resources left for communication with the intended or desired network devices. For example, resources may be memory or computational speed, with embedded systems often being limited in their resources.

Thus, a network device embodied as an embedded system designates an embedded network device which, because of this, is typically subject to highly restrictive boundary conditions and has only greatly reduced resources.

To secure the communication exists manifold state of the art. Typically, communication partners identify each other in establishing their identity and authenticate each other, i.e., each other. they hand over information that permits verification of the identity by the respective other communication partner, whereupon the respective other communication partner then checks whether the given identity can be confirmed by the authentication data, ie. performs an authentication. Furthermore, prior to authentication / authentication, during or subsequent to the authentication, the communication partners generally create temporary shared secrets and use such secrets to secure messages. The temporary shared secrets serve to authenticate / authenticate and / or encrypt the messages exchanged after the authentication / authentication.

In this case, the network devices acting as communication partners can usually use both their own identity by means of their own secrets and alternatively or additionally the identity of their user on his initiative together with its secrets for authentication / authentication.

For example, the Internet Engineering Task Force (IETF) standard describes a procedure ( "RFC 5996 Internet Key Exchange Protocol Version 2", C. Kaufmann, P. Hoffmann, Y. Nir and P. Eronen; The Internet Engineering Task Force (IETF), 2010 ), which is designated by the abbreviation IKEv2. With reference to the attached 3 , which shows a basic scheme for establishing communication according to IKEv2, generate in this method two acting as a communication partner network devices when establishing a communication first a first temporary shared secret called SKEYSEED means of a so-called Diffie-Hellmann key exchange. One of the network facilities, in 3 called initiator, initiates the communication and the other, in 3 called responder, responds to this initiation.

SKEYSEED is then authenticated by means of known identities, persistent secrets PrivKey-I, PrivKey-R, in that the communication partners send each other signatures AUTH-I, AUTH-R to the messages exchanged for the Diffie-Hellmann key exchange, the signatures with Help of the permanent secrets generated and verified by the other communication partner by means of test criteria CERT-I, CERT-R, ie be authenticated. Both and each of the communication partners from SKEYSEED forward a second one temporary shared secret used as a composite of multiple cryptographic keys (eg, SK_d, SK_ai, SK_ar, SK_ei, SK_er, SK_pi, SK_pr), some of which are used for authentication / authentication and some for encrypting certain other messages. Depending on the direction of communication, different keys are used. Optionally, a third temporary shared secret is derived from each communication partner from a part of the second shared secret SK_d (called KEYMAT; 3 not included for clarity) that represents a composition of multiple cryptographic keys (for example, keys SK2_ei, SK2_ai, SK2_er, and SK2_ar). The derivation of the second and third temporary shared secret is done according to such algorithms as agreed at the beginning of the communication setup.

i:

Geheime vom Initiator gewählte Zufallszahl;

M1:

Erste Nachricht, enthaltend:

KEi:

Vom Initiator erzeugte Schlüsselaustauschdaten,

Ni:

Vom Initiator gewählte Zufallszahl zur einmaligen Verwendung;

r:

Geheime vom Responder gewählte Zufallszahl;

M2:

Zweite Nachricht, enthaltend:

KEr:

Vom Responder erzeugte Schlüsselaustauschdaten,

Nr:

Vom Initiator gewählte Zufallszahl zur einmaligen Verwendung;

SKEYSEED:

erstes temporäres gemeinsames Geheimnis – Größe zum Berechnen des zweiten temporären gemeinsamen Geheimnisses, enthaltend: mehrere Geheimnisse/Schlüssel, enthaltend:

SK_d:

Geheimer Schlüssel zur Ableitung von weiteren Schlüsseln,

SK_ai:

Geheimer Schlüssel zum Authentisieren/Authentifizieren von durch den Initiator gesendeten Nachrichten,

SK_ar:

Geheimer Schlüssel zum Authentisieren/Authentifizieren von durch den Responder gesendeten Nachrichten,

SK_ei:

Geheimer Schlüssel zum Verschlüsseln von durch den Initiator gesendeten Nachrichten,

SK_er:

Geheimer Schlüssel zum Verschlüsseln von durch den Responder gesendeten Nachrichten,

SK_pi:

Geheimer Schlüssel zum Initialisieren eines Pseudozufallszahlengenerators zur Verwendung durch den Initiator,

SK_pr:

Geheimer Schlüssel zum Initialisieren eines Pseudozufallszahlengenerators zur Verwendung durch den Responder;

PrivKey-I:

Privater Schlüssel des Initiators (dauerhaftes Geheimnis);

CERT-I:

Zertifikat zur Identität des Initiators – enthält den öffentlichen Schlüssel des Initiators;

PrivKey-R:

Privater Schlüssel des Responders (dauerhaftes Geheimnis);

CERT-R:

Zertifikat zur Identität des Responders – enthält den öffentlichen Schlüssel des Responders;

M3:

Dritte Nachricht;

IDi:

Identität des Initiators;

AUTH-I:

Daten, mit denen sich der Initiator authentisiert;

M4:

Vierte Nachricht;

IDr:

Identität des Responders;

AUTH-R:

Daten, mit denen sich der Responder authentisiert.

An overview of in 3 The reference number is listed in the following list.

i:

Secret random number chosen by the initiator;

M1:

First message containing:

KEi:

Key exchange data generated by the initiator,

Ni:

Random number chosen by the initiator for single use;

r:

Secret random number chosen by the responder;

M2:

Second message containing:

KBr:

Key exchange data generated by the responder,

No:

Random number chosen by the initiator for single use;

SKEYSEED:

first temporary shared secret - size for computing the second temporary shared secret, containing: multiple secrets / keys, containing:

SK_d:

Secret key for deriving further keys,

SK_ai:

Secret key to authenticate / authenticate messages sent by the initiator,

SK_ar:

Secret key to authenticate / authenticate messages sent by the responder,

SK_ei:

Secret key for encrypting messages sent by the initiator,

SK_er:

Secret key for encrypting messages sent by the responder,

SK_pi:

Secret key to initialize a pseudorandom number generator for use by the initiator,

SK_pr:

Secret key for initializing a pseudorandom number generator for use by the responder;

PrivKey-I:

Private key of the initiator (permanent secret);

CERT-I:

Certificate of identity of the initiator - contains the public key of the initiator;

PrivKey-R:

Private Key of the Responder (Permanent Secret);

CERT-R:

Responder Identity Certificate - contains the public key of the responder;

M3:

Third message;

IDi:

Identity of the initiator;

AUTH I:

Data with which the initiator authenticates;

M4:

Fourth message;

I Dr:

Identity of the responder;

AUTH-R:

Data with which the responder authenticates itself.

Durable secrets are referred to herein as persistent because they are commonly used for multiple connection setups and are rarely changed while the temporary secrets are used only for a short time, for example, no longer than for a communication relationship. For example, the corresponding, aforementioned IETF standard explicitly states that the generated temporary secrets may only be applied to different communication protocols for a certain amount of time and amount of data, and then new temporary secrets must be used.

However, the beginning of the IKEv2 communication set-up requires calculations, such as exponentiations, with large integers, which typically require significantly more bits each for the Diffie-Hellmann key exchange than fit into the register of a conventional processor. Thus, IKEv2 requires relatively high resources of main memory and computation time during the start of connection setup, which is scarce especially in embedded systems. For Real-time systems (ie systems for the immediate control and execution of processes in which a respective result within a previously defined time interval must be guaranteed) is also the need for computational time problematic, because usually short response times are required. Industrial controllers are typically embedded real-time systems with limited resources and fast response time.

Especially with small embedded systems with very low resources, it is particularly disadvantageous that just at the beginning of the communication structure, if no identities are known, the resource-demanding Diffie-Hellmann key exchange has to take place. This must be carried out before the network devices can determine from the subsequently exchanged identity whether the connection establishment with the other network device is desired or intended. Although the delayed exchange of identities according to the IKEv2 principle opens up the possibility of encrypting the identities with existing shared temporary keys and thus transmitting them with some confidentiality. With very small resources, however, the disadvantage prevails that accidentally or deliberately any network devices can cause the beginning of the communication structure and thus particularly easy to generate high resource usage on an embedded device, without being authorized and without being easily distinguished from unwanted network facilities can.

SD:

Erstes Datum;

M1:

Erste Nachricht;

GS:

Erstes gemeinsames Geheimnis;

R:

Zweites Datum;

M2:

Zweite Nachricht;

PS:

Zweites gemeinsames Geheimnis;

KE, KA:

Drittes gemeinsames Geheimnis.

In the patent DE 10 2012 220 990 B3 discloses a method and an arrangement in which two network devices generate by means of several steps a third shared secret KE, KA for secure communication. With reference to the attached 4 , which is a basic scheme for establishing communication according to DE 10 2012 220 990 B3 shows, in this case, a first common secret GS and a first algorithm and a second algorithm is stored in advance in both network devices. In order to establish secure communication between the two network devices, the one network device "initiator" then sends in a first message M1 a first data SD, for example its serial number, to the other network device "responder". Both network devices then generate a second secret PS from the first datum SD using the first shared secret GS and the first algorithm. The other network device then sends in a second message M2 a second date R, for example a random number, to which a network device. From this, both network devices compute the third shared secret KE, KA using the second shared secret PS and the second algorithm. The third shared secret KE, KA is then used to secure the subsequent communication, for example for its authentication / authentication and / or encryption. An overview of in 4 The reference number is listed in the following list.

SD:

First date;

M1:

First message;

GS:

First shared secret;

R:

Second date;

M2:

Second message;

PS:

Second common secret;

KE, KA:

Third common secret.

An authentication / authentication of the network devices thus arises only during the secure communication implicitly by using the correct third secret KE, KA. For if one of the two network devices did not know the first shared secret GS, then depending on the quality of the algorithms dependent probability would not create a third shared secret KE, KA, but the network devices would have as a result different values. As a consequence, the messages subsequently exchanged and secured by means of one of the variants of the third shared secret KE, KA can be authenticated and / or decrypted only with the variant of the third shared secret with which they were also signed and / or encrypted. Without a third shared secret, there would be no secure communication depending on the communication protocol, possibly even no further communication option.

Furthermore, it is at least very complicated to distinguish two error cases in this method, if actually different third common secrets have arisen. Thus, it is questionable whether such different third common secrets have been generated due to a confusion or whether the messages exchanged for their computation were inadvertently altered during transmission, for example by disturbances, or deliberately, for example by third parties.

For example, confusion can easily arise if a wrong production cell was accidentally addressed when establishing a connection with a network device, but the production cells are constructed and parameterized the same way as is usual in series machine construction. Here, network devices would possibly only differ by the first shared secret shared in advance.

Furthermore, it is disadvantageous in this method that first of all the steps of the method must be processed by both network devices before errors can be detected on the basis of a third secret that does not correspond. Thus, during call setup, resources are in use for all of the steps and algorithms that are not available for other call setups.

Another prior art describes the so-called Transport Layer Security Protocol, abbreviated as TLS protocol or TLS, as it is explained in version 1.2 (eg in "RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2", T. Dierks and E. Rescorla; The Internet Engineering Task Force, 2008 ), summarized two different methods for mutual authentication / authentication.

In these two TLS methods for the mutual authentication / authentication is in both communication partners, here called client and server, an asymmetric key pair stored in advance, consisting of a respective individual private key, ie, referring to 5 and 6 , Pc for the client and Ps for the server, respectively, and a matching public key in a certificate, ie, referring to 5 and 6 For example, the certificate Cc for the client or the certificate Cs for the server, the certificate also names the respective identity.

In the first of these methods according to 5 , which shows a basic scheme for establishing communication according to TLS without Diffie-Hellman, the communication partners first exchange random numbers Rc or Rs generated by them (Rc from the client and Rs from the server) and the identities together with the associated public keys in the form of the certificates Cc and Cs off. The communication partner initiating the connection, the client, authenticates itself with the aid of an asymmetrical signature AuthC over the previously exchanged data Rc, Rs, Cs, which it generates with its private key and which of the other communication partners, the server, together with this asymmetrical one Signature AuthC transmitted public key Cc checks (authenticated). In addition, the client generates from additional random values a first common secret ("premaster secret") 5 abbreviated as pms, which he transmits to the other communication partner as an encrypted value 5 is called Epms. The encryption of pms to Epms takes place with the public key from the certificate Cs of the server. Implicitly, the identity of the server is thus authenticated / authenticated, because only with its private key Ps is it able to decrypt the correct value of pms and, subsequently, a true second shared secret "master secret" 5 abbreviated as ms. For from the combination of pms and the random numbers Rc and Rs exchanged during the previous communication, both communication partners then independently generate the second shared secret ms with the aid of algorithms that were negotiated in the previous communication. From ms client and server derive a third shared secret, which serves as a combination of cryptographic keys (cwMk, swMk, cwk, swk, cwl, swl) for authentication / authentication and / or encryption of subsequent communication. In this authentication / authentication and / or encryption and in the derivation of the third shared secret also algorithms are used, as they were initially negotiated in the exchange of identities.

Ps:

Privater Schlüssel des Servers;

Pc:

Privater Schlüssel des Clients;

M1:

Erste Nachricht;

Rc:

Vom Client erzeugte Zufallszahl;

M2:

Zweite Nachricht;

Rs:

Vom Server erzeugte Zufallszahl;

Cs:

Zertifikat des Servers;

pms:

Erstes gemeinsames Geheimnis;

M3:

Dritte Nachricht;

Cc:

Zertifikat des Clients;

Epms:

Verschlüsseltes erstes gemeinsames Geheimnis;

AuthC:

Daten, mit denen sich der Client authentisiert;

VDc:

Durch Client gesendete Verifikationsdaten;

ms:

Zweites gemeinsames Geheimnis;

M4:

Vierte Nachricht;

VDs:

Durch den Server gesendete Verifikationsdaten;

cwMk:

(client write MAC key) – Bestandteil des dritten gemeinsamen Geheimnisses;

swMk:

(server write MAC key) – Bestandteil des dritten gemeinsamen Geheimnisses;

cwk:

(client write key) – Bestandteil des dritten gemeinsamen Geheimnisses;

swk:

(server write key) – Bestandteil des dritten gemeinsamen Geheimnisses;

cwI:

(client write initialization vector) – Bestandteil des dritten gemeinsamen Geheimnisses;

swI:

(server write initialization vector) – Bestandteil des dritten gemeinsamen Geheimnisses.

An overview of in 5 The reference number is listed in the following list.

ps:

Private key of the server;

pc:

Private key of the client;

M1:

First message;

rc:

Client-generated random number;

M2:

Second message;

rs:

Server-generated random number;

Cs:

Certificate of the server;

pms:

First shared secret;

M3:

Third message;

cc:

Certificate of the client;

ePMS:

Encrypted first shared secret;

AUTHC:

Data with which the client authenticates itself;

VDc:

Verification data sent by the client;

ms:

Second common secret;

M4:

Fourth message;

VDS:

Verification data sent by the server;

cwMk:

(client write MAC key) - part of the third shared secret;

swMk:

(server write MAC key) - part of the third shared secret;

cwk:

(client write key) - part of the third common secret;

swk:

(server write key) - part of the third shared secret;

CWI:

(client write initialization vector) - part of the third shared secret;

SWI:

(server write initialization vector) - part of the third shared secret.

Although it is advantageous in this method according to TLS that the identities are exchanged at the beginning of the process before significant computing time and resources have been consumed. Accidentally misdirected communication partners can therefore be rejected with little resources.

However, a disadvantage of the protection effect of this method according to TLS is, in particular, that it depends solely on the trustworthiness of the client that the first shared secret pms is really a mystery. Because only the client determines the value of pms. Therefore, the method is rarely used.

In the second of these methods according to 6 , which shows a basic scheme for communication setup according to TLS with Diffie-Hellman, also exchange client and server random numbers Rc and Rs as well as the certificates Cs and Cc. Together with the certificate Cs, the server also transmits a value Ys for the Diffie-Hellmann key exchange, which it deduces from the value pYs which it generates previously and which it keeps completely secret. For transmission, it supplements the derived value Ys by a signature. The combination of Ys and the signature is included 6 referred to as SYs. The signature is created by the server using its private key Ps. It is verified by the client using the Cs certificate, thereby authenticating / authenticating the identity of the server to the client and providing the client with the authenticated value Ys. The client also generates a value pYc known only to it and generates a second value Yc for the Diffie-Hellman exchange. Furthermore, he derives directly from pYc and Ys the first shared secret pms. Together with its certificate Cc, the client transmits the value Yc unencrypted to the server, together with a signature AuthC on all previously exchanged messages. The client creates this signature with the help of its private key Pc and checks it with the help of the certificate Cc. After receiving Yc, the server also generates the first shared secret pms from the combination of pYs and Yc. Both the client and the server calculate from pms in combination with the previously exchanged random numbers Rc and Rs the second shared secret ms and derive therefrom the third shared secret, which is a combination of cryptographic keys (cwMk, swMk, cwk, swk, cwl, swl) is used for authentication / authentication and / or encryption of the subsequent communication. In Diffie-Hellmann key negotiation algorithms are used in the generation of the first, second and third shared secrets and in the subsequent application of the cryptographic keys, which were negotiated during the client and server communication setup.

Ps:

Privater Schlüssel des Servers;

Pc:

Privater Schlüssel des Clients;

M1:

Erste Nachricht;

Rc:

Vom Client erzeugte Zufallszahl;

pYs:

Geheimer Anfangswert des Servers für den Diffie-Hellmann-Schlüsselaustausch;

Ys:

Abgeleiteter öffentlicher Anfangswert des Servers für den Diffie-Hellmann-Schlüsselaustausch;

M2:

Zweite Nachricht;

Rs:

Vom Server erzeugte Zufallszahl;

Cs:

Zertifikat des Servers;

SYs:

Abgeleiteter öffentlicher Anfangswert des Servers für den Diffie-Hellmann-Schlüsselaustausch in Kombination mit einer Signatur des Servers;

pYc:

Geheimer Anfangswert des Clients für den Diffie-Hellmann-Schlüsselaustausch;

M3:

Dritte Nachricht;

Cc:

Zertifikat des Clients;

AuthC:

Daten, mit denen sich der Client authentisiert;

VDc:

Durch Client gesendete Verifikationsdaten;

Yc:

Abgeleiteter öffentlicher Anfangswert des Clients für den Diffie-Hellmann-Schlüsselaustausch;

pms:

Erstes gemeinsames Geheimnis;

ms:

Zweites gemeinsames Geheimnis;

M4:

Vierte Nachricht;

VDs:

Durch Server gesendete Verifikationsdaten;

cwMk:

(client write MAC key) – Bestandteil des dritten gemeinsamen Geheimnisses;

swMk:

(server write MAC key) – Bestandteil des dritten gemeinsamen Geheimnisses;

cwk:

(client write key) – Bestandteil des dritten gemeinsamen Geheimnisses;

swk:

(server write key) – Bestandteil des dritten gemeinsamen Geheimnisses;

cwI:

(client write initialization vector) – Bestandteil des dritten gemeinsamen Geheimnisses;

swI:

(server write initialization vector) – Bestandteil des dritten gemeinsamen Geheimnisses.

An overview of in 6 The reference number is listed in the following list.

ps:

Private key of the server;

pc:

Private key of the client;

M1:

First message;

rc:

Client-generated random number;

Pyś:

Secret server initial value for the Diffie-Hellmann key exchange;

Ys:

Derived public initial value of the server for the Diffie-Hellmann key exchange;

M2:

Second message;

rs:

Server-generated random number;

Cs:

Certificate of the server;

SYs:

Derived public seed value of the Diffie-Hellmann key exchange server in combination with a signature of the server;

PYC:

Secret initial value of the client for the Diffie-Hellmann key exchange;

M3:

Third message;

cc:

Certificate of the client;

AUTHC:

Data with which the client authenticates itself;

VDc:

Verification data sent by the client;

yc:

Derived public initial value of the client for the Diffie-Hellmann key exchange;

pms:

First shared secret;

ms:

Second common secret;

M4:

Fourth message;

VDS:

Verification data sent by the server;

cwMk:

(client write MAC key) - part of the third shared secret;

swMk:

(server write MAC key) - part of the third shared secret;

cwk:

(client write key) - part of the third common secret;

swk:

(server write key) - part of the third shared secret;

CWI:

(client write initialization vector) - part of the third shared secret;

SWI:

(server write initialization vector) - part of the third shared secret.

A disadvantage of this second method according to TLS is that for the generation of the value SYs, the server still applies without knowledge of the identity of the client asymmetric cryptography, namely for the beginning of the Diffie-Hellman exchange and for the creation of the signature to Ys, at He therefore uses resources of memory and computation that are already significant to embedded devices. This resource consumption thus also occurs in the case of accidentally or intentionally misdirected connection setups and can be badly repulsed.

A disadvantage of both methods according to TLS is further that for authentication / authentication in both cases asymmetric cryptography and thus arithmetic operations with large integers are required, so memory and computing time are particularly stressed.

In "RFC 4279 Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)", P. Eronen and H. Tschofenig, The Internet Engineering Task Force In addition to the TLS methods described above, three additional TLS variants are described which also effect a mutual authentication / authentication of the communication partners. While two of them continue to use asymmetric cryptography, a "RFC 4279 Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)" is referred to as "PSK Key Exchange Algorithm" and incorporated herein by reference 7 , which shows a basic scheme for establishing communication according to TLS with PSK, as "TLS with PSK" designated method alone with symmetric cryptography, in that the first shared secret is a value previously stored in both communication partners.

Concrete exchange, again referring to 7 , at the beginning of the procedure "TLS with PSK", the client and the server random numbers Rc and Rs out as well as the identities IDh, as an indication of the identity of the server, and IDc as identity of the client, both of which then use a previously stored with them shared secret PSK to create a second pre-master secret pms The second shared secret is used to generate from the random numbers Rc and Rs a third master secret ms From the third shared secret ms, a fourth shared secret is again generated both by the client and by the server, which serves as a combination of cryptographic keys (cwMk, swMk, cwk, swk, cwl, swl) for authentication / authentication and / or encryption of the subsequent communication this authentication / authentication and / or encryption and in the derivation of the second, third and fourth common Go algorithms are used, as they were initially negotiated when exchanging the random numbers.

PSK:

Im Voraus gespeichertes erste gemeinsames Geheimnis;

M1:

Erste Nachricht;

Rc:

Vom Client erzeugte Zufallszahl;

M2:

Zweite Nachricht;

Rs:

Vom Server erzeugte Zufallszahl;

IDh:

Hinweis auf die Identität des Servers;

pms:

Zweites gemeinsames Geheimnis;

ms:

Drittes gemeinsames Geheimnis;

M3:

Dritte Nachricht;

VDc:

Durch Client gesendete Verifikationsdaten;

IDc:

Hinweis auf die Identität des Clients;

M4:

Vierte Nachricht;

VDs:

Durch den Server gesendete Verifikationsdaten;

cwMk:

(client write MAC key) – Bestandteil des vierten gemeinsamen Geheimnisses;

swMk:

(server write MAC key) – Bestandteil des vierten gemeinsamen Geheimnisses;

cwk:

(client write key) – Bestandteil des vierten gemeinsamen Geheimnisses;

swk:

(server write key) – Bestandteil des vierten gemeinsamen Geheimnisses;

cwI:

(client write initialization vector) – Bestandteil des vierten gemeinsamen Geheimnisses;

swI:

(server write initialization vector) – Bestandteil des vierten gemeinsamen Geheimnisses.

An overview of in 7 The reference number is listed in the following list.

PSK:

Pre-stored first shared secret;

M1:

First message;

rc:

Client-generated random number;

M2:

Second message;

rs:

Server-generated random number;

IDh:

Reference to the identity of the server;

pms:

Second common secret;

ms:

Third common secret;

M3:

Third message;

VDc:

Verification data sent by the client;

IDc:

Reference to the identity of the client;

M4:

Fourth message;

VDS:

Verification data sent by the server;

cwMk:

(client write MAC key) - part of the fourth shared secret;

swMk:

(server write MAC key) - part of the fourth shared secret;

cwk:

(client write key) - part of the fourth common secret;

swk:

(server write key) - part of the fourth shared secret;

CWI:

(client write initialization vector) - part of the fourth shared secret;

SWI:

(server write initialization vector) - part of the fourth shared secret.

A disadvantage of this method "TLS with PSK" is that although an identification of the communication devices is performed, but no explicit authentication / authentication.When a page only their identity or confused, but does not know the associated common secret, then arise in the end different Key for the authentication / authentication and / or encryption of the subsequent communication Also in this method, it is subsequently complicated to distinguish the two error cases, as in the method according to the patent DE 10 2012 220 990 B3 were shown: if different second have been common secrets, it is questionable whether this was the case because of a confusion or whether the messages exchanged for their calculation were altered accidentally during transmission, for example by disturbances, or intentionally, for example by third parties.

The OPC Foundation has opted for the OPC Unified Architecture (OPC UA) in "OPC Unified Architecture Part 2: Security Model", 2009 . "OPC Unified Architecture Part 4: Services", 2009 and "OPC Unified Architecture Part 6: Mappings", 2009 , a method is described in which two communication partners, a client and a server, mutually authenticate each other in order to communicate securely by means of shared secrets.

Referring to 8th which shows a basic scheme for setting up a secure connection to OPC UA, the client has already gained knowledge of a certificate Cs of the server containing the identity and the public key of the server in advance or at the beginning of the communication. Before communication begins, the client and the server are each in possession of an asymmetrical key pair, ie a respective individual private key and a matching public key in a certificate, as well as the associated certificate with which they can prove their identity.

In a first message Ml of the authentication / authentication process, the client sends its certificate Cc, which contains its identity and its public key, together with a value Nc and a signature AuthC to the server. The signature AuthC is generated by the client as a digital signature about relevant parts of the message Ml, comprising at least the certificate Cc and the value Nc, using its private key Pc associated with the certificate Cc. Before sending the message Ml, the client encrypts parts of the message, at least the value Nc and the signature AuthC, with the public key of the server from the certificate Cs, so that instead of the value Nc actually its encryption eNc and instead of the signature AuthC actually their Encryption eAuthC is transmitted. The server decrypts the message Ml using its private key Ps assigned to the certificate Cs and verifies the signature AuthC using the public key from this certificate Cc. Together with the verification of the certificate Cc, the server obtains secure knowledge about the identity of the client and knowledge of the secret random number Nc.

In a second message M2, the server analogously sends the client a value Ns together with a signature AuthS to the client. The signature AuthS generated by the server as a digital signature on relevant parts of the message M2, at least the value Ns and a checksum or other type of referencing of the certificate Cs involving. Before sending the message M2, the server encrypts parts of the message, at least the value Ns, with the public key of the client from the certificate Cc. The client decrypts the message M2 using its private key Pc and verifies with the public key from the certificate Cs the signature AuthS. Along with the verification of the certificate Cs, the client also obtains secure knowledge about the identity of the server and knowledge of the secret random number Ns.

After exchanging the messages Ml and M2, the client and the server each derive a shared secret G from the exchanged secret random numbers Nc and Ns. This shared secret is used as a combination of multiple cryptographic keys to authenticate / authenticate or authenticate / authenticate and encrypt the subsequent communication. The algorithms used in the derivation and the algorithms for the subsequent authentication / encryption of the communication are determined during the exchange of messages Ml and M2.

Ps:

Privater Schlüssel des Servers;

Pc:

Privater Schlüssel des Clients;

Cs:

Zertifikat des Servers;

Nc:

Vom Client erzeugte Zufallszahl;

AuthC:

Durch den Client erzeugte Signatur;

M1:

Erste Nachricht;

Cc:

Zertifikat des Clients;

eNc:

Verschlüsselung von Nc;

eAuthC:

Verschlüsselung von AuthC;

Ns:

Vom Server erzeugte Zufallszahl;

AuthS:

Durch den Server erzeugte Signatur;

M2:

Zweite Nachricht;

eNs:

Verschlüsselung von Ns;

eAuthS:

Verschlüsselung von AuthS;

G:

gemeinsames Geheimnis.

An overview of in 8th The reference number is listed in the following list.

ps:

Private key of the server;

pc:

Private key of the client;

Cs:

Certificate of the server;

nc:

Client-generated random number;

AUTHC:

Client generated signature;

M1:

First message;

cc:

Certificate of the client;

ENC:

Encryption of Nc;

eAuthC:

Encryption of AuthC;

ns:

Server-generated random number;

AUTHs:

Signature generated by the server;

M2:

Second message;

ENS:

Encryption of Ns;

eAuthS:

Encryption of AuthS;

G:

shared secret.

It is an object of the invention to provide a further improved set-up of secure communication between two network devices compared with the above-described prior art, which requires a low use of resources and, in particular, enables a simple, differentiated recognition of different error cases during the construction.

The solution according to the invention is given by a method, a computer program product and an arrangement having the features of the independent claims. Preferred developments are the subject of the dependent claims.

Accordingly, the invention proposes a method for establishing a secure communication between a first network device (initiator) and a second network device (responder) in a communication network, in which using a symmetric cryptosystem respectively a separate authentication / authentication with respect to the first and the second network device is performed prior to generating a secret to be used for secure communication as a shared key. Due to the symmetric cryptosystem, both network devices thus use the same secrets as keys for encryption and decryption of data records.

Accordingly, a computer program product is also proposed, which causes the implementation of such a method, as well as a particularly suitable for carrying out the method arrangement with a first network device and a second network device in a communication network.

• – dass die Lösung nach der Erfindung auf einem vorher vereinbarten geteilten Geheimnis basiert und folglich kein großer Rechenaufwand, wie ansonsten bei asymmetrischen Kryptographien bzw. Kryptosystemen notwendig ist,
• – dass die Lösung nach der Erfindung die Überprüfung, ob die vorgegebenen Identitäten der Kommunikationspartner bestätigt werden können, frühzeitig erlaubt, so dass bei versehentlichem oder absichtlich regelwidrigem Kommunikationsaufbau hierbei belegte Ressourcen wieder schneller freigegeben werden können,
• – dass aufgrund der jeweiligen separaten Authentisierung/Authentifizierung mögliche Fehlerfälle auf einfache Weise unterschieden werden können, wobei am Ende geheime und zwischen den Kommunikationspartnern geteilte Schlüssel für die Sicherung der nachfolgenden Kommunikation bereitstellt werden und,
• – dass mit dem erfolgreichen Abschluss des Verbindungsaufbaus für eine sichere Kommunikation sicherstellt ist, dass beide Seiten dieselben geteilten Schlüssel errechnet haben können.

Significant advantages are therefore to be seen in

• That the solution according to the invention is based on a previously agreed shared secret and consequently no large amount of computation, as is otherwise necessary in asymmetric cryptosystems or cryptosystems,
• - That the solution according to the invention, the review of whether the predetermined identities of the communication partners can be confirmed, allowed early on, so that in case of accidental or deliberately irregular communication setup here occupied resources can be released faster again,
• - That due to the respective separate authentication / authentication possible errors can be easily distinguished, in the end secret and shared between the communication partners keys are provided for securing the subsequent communication and,
• - that successful completion of secure communication establishment of the connection ensures that both parties have calculated the same shared keys.

Thus, in preferred embodiments, the invention is particularly suitable for embedded systems with very low resources, in particular for industrial controls implemented as embedded real-time systems with limited resources and a short reaction time.

The above-described and other features, features and advantages of the invention will become more apparent from the following description of preferred embodiments with reference to the accompanying drawings, in which:

1 : a basic flow chart for establishing a secure communication according to the invention;

2 FIG. 4 is a schematic view of an example of an arrangement having first and second network devices in a communication network according to the invention; FIG.

3 a basic flow diagram of the prior art for establishing communication according to IKEv2;

4 a basic flowchart of the prior art for communication setup according to DE 10 2012 220 990 B3 ;

5 a basic flow diagram according to the prior art for establishing communication according to TLS without Diffie-Hellman;

6 a basic flow diagram according to the prior art for establishing communication according to TLS with Diffie-Hellman;

7 a basic flow diagram of the prior art for establishing communication according to TLS with PSK;
and

8th a basic flowchart of the prior art for establishing a secure connection to OPC UA.

The following is in particular 1 Reference is made, which shows a basic scheme of a preferred procedure in the invention for establishing a secure communication.

In detail shows here 1 a preferred embodiment for establishing a secure communication between a first network device, in 1 referred to as a client or initiator, and a second network device 1 referred to as a server or responder, in a communication network, wherein the communication network is not shown here for reasons of clarity. How out 1 can be seen here using a symmetric cryptosystem or symmetric cryptography, in which / which thus both network devices each use the same secrets as keys for encryption and decryption of records, each performed a separate authentication / authentication with respect to the first and the second network device, before generating a for the secure communication as a common key Pw to be used secret G.

The invention accordingly combines pre-shared secret authentication / authentication using symmetric cryptographic algorithms with a separate authentication / authentication step prior to deriving shared keys for backup of the subsequent communication. Otherwise, a separate authentication / authentication step is known only from authentication / authentication using asymmetric cryptography. The separate step is necessary when using asymmetric algorithms, because in the prior art after asymmetric authentication, the subsequent communication is secured with symmetric methods. In symmetrical methods, however, it finds no use in the prior art, as discussed at the beginning.

Pw:

vorab geteiltes Geheimnis bzw. im Voraus bekanntes gemeinsames Geheimnis;

M1:

Erste Nachricht;

IDi:

Identität des Clients;

Ni:

Vom Client neu erzeugte Zufallszahl;

Pi:

Optionaler Parametersatz vom Client;

M2:

Zweite Nachricht;

IDr:

Identität des Servers;

Nr:

Vom Server neu erzeugte Zufallszahl;

Pr:

Optionaler Parametersatz vom Server;

M3:

Dritte Nachricht

AuthI:

Mit symmetrischem kryptographischem Algorithmus vom Client erzeugte Signatur zwecks seiner Authentisierung;

AuthI‘:

Vom Server zu Prüfzwecken nachgerechnete Signatur zum Vergleich mit AuthI zwecks Authentifizierung des Clients;

M4:

Vierte Nachricht;

AuthR:

Mit symmetrischem kryptographischem Algorithmus vom Server erzeugte Signatur zwecks seiner Authentisierung;

AuthR‘:

Vom Client zu Prüfzwecken nachgerechnete Signatur zum Vergleich mit AuthR zwecks Authentifizierung des Servers;

G:

Zweites geteiltes Geheimnis bzw. zweites gemeinsames Geheimnis mit folgenden Bestandteilen:

SK2_ai:

„Secret key for authenticating messages sent by the initiator“; Geheimer Schlüssel zum Authentisieren der vom Client gesendeten Nachrichten;

SK2_ar:

„Secret key for authenticating messages sent by the responder“; Geheimer Schlüssel zum Authentisieren der vom Server gesendeten Nachrichten

SK2_ei:

„Secret key for encrypting messages sent by the initiator“; Geheimer Schlüssel zum Verschlüsseln der vom Client gesendeten Nachrichten

SK2_er:

„Secret key for encrypting messages sent by the responder“; Geheimer Schlüssel zum Verschlüsseln der vom Server gesendeten Nachrichten

Before using the in 1 Some preferred embodiments relating to the establishment of secure communication between two network devices are described within the scope of the invention, one of the network devices, also referred to as client or initiator, initiating the setup and the other network device, also referred to below as server or responder , with which the communication is desired, responds to the desire to build, is first a basic overview of in 1 contained reference numerals in the list below.

Pw:

pre-shared secret or shared secret in advance;

M1:

First message;

IDi:

Identity of the client;

Ni:

Client newly generated random number;

Pi:

Optional parameter set from the client;

M2:

Second message;

I Dr:

Identity of the server;

No:

Newly generated random number by the server;

Pr:

Optional parameter set from the server;

M3:

Third message

AuthI:

Signature generated by the client for symmetric cryptographic algorithm for authentication;

AuthI ':

Served by the server for verification purposes recalculated signature for comparison with AuthI for authentication of the client;

M4:

Fourth message;

AUTHR:

Signature generated by the server for symmetric cryptographic algorithm for its authentication;

AUTHR ':

Client replicated signature for verification purposes for comparison with AuthR for authentication of the server;

G:

Second shared secret or second shared secret with the following components:

SK2_ai:

"Secret key for authenticating messages sent by the initiator"; Secret key for authenticating messages sent by the client;

SK2_ar:

"Secret key for authenticating messages sent by the responder"; Secret key to authenticate the messages sent by the server

SK2_ei:

"Secret key for encrypting messages sent by the initiator"; Secret key to encrypt the messages sent by the client

SK2_er:

"Secret key for encrypting messages sent by the responder"; Secret key to encrypt the messages sent by the server

Based on 1 is accordingly provided in an expedient embodiment that on a first network device (at 1 called client or initiator) first a record is generated, which contains at least one random number Ni, and this data set is then sent together with an identity identifier IDi of the first network device in a first message M1 from the first network device to a second network device. As a result, the first network device thus initiates the establishment of secure communication with the second network device. The second network device can initially be selected in principle by the first network device, for example from an internally stored list of possible network devices with which secure communication within a communication network can or may be performed.

Upon receipt of the first message M1, the second network device (at 1 called server or responder) a record is generated which likewise contains at least one random number Nr, and which then together with an identity identifier IDr of second network device is sent in a second message M2 from the second network device to the first network device. As a result, the second network device thus reacts to the request of the first network device to establish secure communication.

It is advantageous that the identity of the first network device of the second network device is already communicated with the initiation, so that the second network device is also given the opportunity to decide whether secure communication within the communication network can be carried out with the first network device or may. In an expedient development, it is therefore further provided that, after receiving the first message M1 from the second network device, a check of the identity IDi sent by the first network device is first carried out and, based on the result of this check, it is decided by the second network device, if at all Message M2, as described above, is sent from the second network device to the first network device or whether already after knowledge of the identity of the first network device, the structure is aborted. If the second network device agrees with the structure, the first network device with the message M2 thus also receives the identity of the second network device from the latter. This again opens up the early possibility of deciding on the part of the first network device whether the identity transmitted by the second network device actually corresponds to the network device with which the first network device intended to establish a connection for secure communication. In an expedient refinement, it is therefore provided that, after receiving the second message M2, the first network device first carries out a check of the identity identifier IDr sent by the second network device and, based on the result of this check, decides whether the structure is at all established by the first network device is continued or canceled.

It is thus also advantageous that the possibility is already opened on both sides at an early stage to recognize whether a request for establishing a secure communication or a response thereto is misdirected without the need for cryptographic operations. The generation of the random numbers Ni or Nr contained records requires no cryptographic operations and therefore no large resource allocation. Consequently, this generation, with the intention of being able to use these data records for subsequent authentication / authentication if appropriate, can advantageously be carried out early without a separate message exchange being necessary for this purpose.

Assuming that the setup continues, upon receipt of the second message M2, the invention provides that a record containing a first signature AuthI is generated on the first network device, which is then transmitted in a third message M3 from the first network device the second network device is sent. The first network device thus authenticates to this at the second network device. The first signature AuthI is generated by executing a first algorithm using a first secret Pw and data to be signed, which are composed of a first message part of the first message M1 and a second message part of the second message M2.

Furthermore, a data record containing a second signature AuthI 'is generated on the second network device, also by executing the first algorithm and using the first secret Pw and data to be signed, which are from the same first message part of the first message M1 and the same second message part of the second message M2, as in the generation of the first signature "AuthI" contained record. The second network device can thus perform an authentication of the first network device after receiving the third message M3. For this purpose, the data record generated by the first network device and containing the first signature AuthI is compared on the second network device with the data record generated by the second network device and containing the second signature AuthI '.

Consequently, both network devices can use a symmetric cryptographic algorithm for generating the AuthI or AuthI 'signatures, since for this purpose both of them rely on the first and thus shared secret Pw and compile the data to be signed from the same message parts of the messages M1 and M2.

Thus, by virtue of the separate authentication / authentication of the identity of the first network device of the second network device, it is possible to decide once again whether the establishment of secure communication continues with the first network device. In an expedient development, it is therefore further provided that the second network device, in response to the result of the comparison of the first signature AuthI with the second signature AuthI ', decides whether the structure of a secure communication is continued or the process is terminated at this point.

Assuming that the setup is continued, the invention provides that then a record is generated on the second network device, which contains a third signature AuthR and is sent in a fourth message M4 from the second network device to the first network device. The second network device thus authenticates itself to the first network device. The generation of the third signature AuthI is expediently carried out by executing a second algorithm using the first secret Pw and of data to be signed, which are composed of a third message part of the first message M1 and a fourth message part of the second message M2, the third message part another message part than the first message part and / or the fourth message part is a message part other than the second message part.

Furthermore, a record containing a fourth signature AuthR 'is generated on the first network device by executing the second algorithm using the first secret Pw and data to be signed, corresponding to the third signature AuthR from the same third message part of the message M1 and the same fourth message part of the message M2 as in the generation of the third signature AuthR. The first network device can thus perform an authentication of the second network device after receiving the fourth message M4. For this purpose, the data set generated by the second network device and containing the third signature AuthR is compared with the data record generated by the first network device and contains the fourth signature AuthR 'on the first network device.

Thus, by virtue of the separate authentication / authentication of the identity of the second network device, the first network device in turn has the possibility of deciding whether the establishment of secure communication is continued with the second network device. In an expedient refinement, it is therefore further provided that the first network device, in response to the result of the comparison of the third signature AuthR with the fourth signature AuthR ', decides whether the establishment of secure communication will be continued or the method aborted at this point becomes.

• – des wenigstens die Zufallszahl Ni enthaltenen Datensatzes,
• – des wenigstens die Zufallszahl Nr enthaltenen Datensatzes,
• – des die erste Signatur AuthI enthaltenen Datensatzes,
• – des die zweite Signatur AuthI‘ enthaltenen Datensatzes,
• – des die dritte Signatur AuthR enthaltenen Datensatzes, und/oder
• – des die vierte Signatur AuthR‘ enthaltenen Datensatzes.

Das zweite Geheimnis G kann hierbei bevorzugt eine Kombination aus mehreren kryptographischen Schlüsseln sein, insbesondere eine Kombination aus den vorstehend basierend auf 1 angeführten kryptographischen Schlüsseln SK2_ai, SK2_ar, SK2_ei und SK2_er. Assuming that the construction is continued, the invention provides that a second secret G can then be generated on the first network device and on the second network device, respectively by executing a third algorithm and using the first secret Pw and at least one of the data sets previously generated on the first network device and / or on the second network device, ie

• The set of data containing at least the random number Ni,
• The at least the random number Nr contained record,
• The record containing the first signature AuthI,
• The record containing the second signature AuthI ',
• The record containing the third signature AuthR, and / or
• The record containing the fourth signature AuthR '.

The second secret G may in this case preferably be a combination of a plurality of cryptographic keys, in particular a combination of those based on above 1 Cryptographic keys SK2_ai, SK2_ar, SK2_ei and SK2_er.

It should be noted that the generation of the second secret G on the second network device already after positive comparison on the second network device of the generated from the first network device, the first signature AuthI contained record with the generated by the second network device, the second signature AuthI 'contained Record is initiated.

This second shared secret G is then used by the first network device and the second network device as a common key for secure communication between the first network device and the second network device, in particular, for signing and / or encrypting the data records thereby communicated.

In a practical embodiment, in each case only generated data records with the respectively same data are used on the first and the second network device for respectively generating the second secret G. In particular, it is thus provided that in each case at least one of the data sets is used on the first and the second network device, which contains a random number Ni, Nr and / or expedient with respect to the first network device to at least one of the data records, which the first signature AuthI , third signature AuthR or fourth signature AuthR 'and expediently with respect to the second network device to at least one of the data sets, which contains the first signature AuthI, second signature AuthI' or third signature AuthR.

In an expedient embodiment, within the scope of the invention, furthermore, the first secret Pw can be stored permanently on the first network device as well as on the second network device or entered via an input interface. In the case of an input of the secret Pw, this can in each case be provided for a single use, ie in each case before the renewed initiation of a construction of a secure communication or for a repeated use, ie for the multiple initiation of a structure of secure communication. For the respective use of this first secret Pw, advantageously either the first secret Pw can be used directly on both network devices, or a value based on the first secret Pw on both network devices, but with the same derived value.

Alternatively, however, the first secret Pw can also be stored on one of the two network devices and a value derived based on the first secret Pw can be stored on the other of the two network devices or entered via an input interface, in which case the respective secret Pw is used for both network devices employ an identically derived value based on the first secret Pw.

Thus, the same secret Pw or an identical value derived from the secret Pw is always used on both network devices. Depending on the embodiment, the derivation of such a value can thus be effected on a respective such network device or, alternatively, prior to input of such a value into the network device.

When an identically derived value is used, an identical derivation method used for this purpose can thus be carried out, depending on the specific practical implementation, in each case expediently both on the network device or before it is introduced into the network device for the network device.

As in 1 It is furthermore preferably provided that the first message M1 additionally contains a parameter set Pi and / or the second message M2 additionally contains a parameter set Pr. Depending on the specific training, it may be expedient here for the parameter set Pi to contain the first algorithm, the second algorithm, the third algorithm, a rule for deriving a value based on the first secret Pw, identification of respective message parts for generating signatures and / or an identity identifier of the second network device. The parameter set Pr can also include, depending on the specific training, the first algorithm, the second algorithm, the third algorithm, a rule for deriving a value based on the first secret Pw, and / or identification of respective message parts for generating signatures.

How out 1 Further, the first and / or third message part of the first message M1 is preferably formed without using the random number Ni contained in this message. Additionally or alternatively, the second and / or fourth message part of the second message M2 is preferably formed without using the random number Nr contained in this message.

The invention also offers the possibility that the steps described above for establishing a secure communication in practical implementation can also be carried out in the event that there is already an existing communication relationship between the first network device and the second network device, and subsequently hedge this existing communication relationship is.

2 Fig. 2 shows a simplified schematic view of an example of an arrangement with a first and a second network device in a communication network for carrying out a method according to the invention. In detail, an exemplary arrangement having a first network device designated as a client and a second network device designated as a server is shown in a communication network not shown further for reasons of clarity. An unsecured communication connection, which is represented by the dotted double arrow, can already exist between the first network device and the second network device.

On the first network device a first processing means V1, a first communication means K1 and a first secure communication means sK1 are shown and on the second network means a second processing means V2, a second communication means K2 and a second secure communication means sK2. An unsecured communication connection thus takes place in particular via the communication means K1 and K2. In particular, the processing means V1, V2 and the secure communication means sK1, sK2 may comprise hardware and / or software components. In a hardware implementation, the respective means may be wholly or partly designed as a device or as part of a device, for example as a computer or as a microprocessor. In a software implementation, the respective means can be used in whole or in part as Computer program product, be designed as a function, as a routine, as part of a program code or as an executable object. In particular for carrying out a method according to the invention, the processing means V1 and V2, the communication means K1 and K2 and the secure communication means sK1 and sK2 are expediently set up, as explained below.

The first processing means V1 is first set up to generate a data record containing at least one random number Ni, and the first communication means K1 for sending from the first network device to the second network device of a first message containing this data record and at least one identity identifier IDi of the first network device ,

The second processing means V2 is arranged to generate a data record containing at least a random number Nr and the second communication means K2 to send from the second network device to the first network device of a second message containing this data record and at least one identity identifier IDr of the second network device.

The communication means K1 and K2 are also suitably set up to receive messages sent via the communication means K2 or K1.

Further, the first processing means V1 is arranged to execute a first algorithm A1 for generating a record containing a first signature AuthI using a first secret Pw and data to be signed, the first processing means V1 being arranged to compose signing data from a first message part of the first message M1 and a second message part of the second message M2. The first communication means K1 is further adapted to send a third message M3 from the first network device to the second network device containing this generated data set.

The second processing means V2 is further adapted to execute the first algorithm A1 for generating a record containing a second signature AuthI 'using the first secret Pw and data to be signed, the second processing means V2 being arranged to assemble data to be signed from the same first message part of the first message M1 and the same second message part of the second message M2, as the first processing means V1 in the generation of the record containing the first signature AuthI. The second processing means V2 is furthermore set up for comparing the data record generated by the first network device and containing the first signature AuthI with the data record generated on the second network device and containing the second signature AuthI '.

Further, the second processing means V2 is arranged to execute a second algorithm A2 for generating a record containing a third signature AuthR, using the first secret Pw and data to be signed, the second processing means V2 being arranged to write these data to be signed from a third message part of the first message M1 and a fourth message part of the second message M2, wherein the third message part is a message part other than the first message part and / or the fourth message part is a message part other than the second message part, and wherein the second communication means K2 is further arranged to send a fourth message M4 containing this generated record from the second network device to the first network device.

Also, the first processing means V1 is arranged to execute the second algorithm A2 on the first network device to generate a record containing a fourth signature AuthR 'using the first secret Pw and data to be signed, the first processing means V1 being further established to assemble these data to be signed according to the third signature AuthR from the same third message part of the message M1 and the same fourth message part of the message M2 as the second processing means V2 in the generation of the record containing the third signature AuthR, and wherein the first processing means V1 are set up for comparing the generated by the second network device, the third signature AuthR contained record with the generated by the first network device, the fourth signature AuthR 'contained record.

Both the first V1 and the second processing means V2 are further arranged to execute a third algorithm A3 to respectively generate a common second secret G using the first secret Pw and at least one of the random number Ni, the random number Nr, first Signature AuthI, the second signature AuthI ', the third signature AuthR or the fourth signature AuthR' included;

The first and second secure communication means sK1 and sK2 are finally arranged to use the shared second secret G as a common key for one secure communication between the first network device and the second network device, ie in particular for authentication / authentication and / or for encryption and decryption of data records for performing secure communication. The transmission and reception of correspondingly secured data sets can then take place in a practical implementation device-specifically also via the secure communication means sK1 and sK2 or again via the communication means K1 and K2.

Consequently, as already stated, the communication means K1 and K2 are also suitably arranged in practical implementation for receiving messages sent via the communication means K2 and K1, respectively. in particular the communication means K1 at least for receiving the messages M2 and M4 and the communication means K2 at least for receiving the messages M1 and M3.

In the arrangement according to 2 are also shown memory, which are divided for reasons of clarity in each case in two memory areas S1a and S1b or S2a and S2b and which can be accessed in particular the processing means V1 or V2. In this case, the first secret Pw, the identity identities IDi and IDr and the first, second and third algorithms A1, A2 and A3 can each be permanently stored in the memory area S1a of the client and / or entered via an input slit Es.

However, depending on the specific configuration, e.g. the first algorithm, the second algorithm, the third algorithm, a rule for deriving a value based on the first secret Pw and / or an identification of respective message parts for generating signatures are sent from the server to the client, which then e.g. be stored in the memory area S1a. Also in the memory area S2a of the server, e.g. the first secret Pw, the identity identifier IDr and the first, second and third algorithms A1, A2 and A3 are each stored permanently and / or entered via an input section Es.

However, depending on the specific configuration, e.g. the first algorithm, the second algorithm, the third algorithm, a rule for deriving a value based on the first secret Pw, an identification of respective message parts for generating signatures, and / or an identity identifier of the second network device are sent from the client to the server, which then eg be stored in the memory area S1a.

In the memory areas S1b and S2b of the client or server, e.g. the random numbers Ni and Nr, the second secret G as well as the signatures AuthI, AuthR and AuthR 'or the random numbers Ni and Nr, the second secret G and the AuthI, AuthI' and AuthR are stored for the respectively required.

The identity identifier Idi can also be stored or stored in the memory area S2a or S2b of the server, at least if, depending on the further embodiment described below, the processing means V2 should be able to fall back on it.

Again particularly with reference to the 1 is thus in particularly expedient embodiments of the invention for establishing a secure communication, hereinafter referred to as connection (ie for secure communication) known before this connection in both network devices, ie the initiator and the responder, a shared secret Pw.

The announcement may be made prior to each connection setup, for example, if there is an input unit at a network device and a user of the network device enters the secret Pw immediately before the connection is established. Pw advertising may also be unique for several or all of the subsequent connection setups, for example, if the network device is an embedded system in the field where there is no user on site. In the latter example, the secret Pw may e.g. also be included in the configuration of the network device or a device containing this network device.

In particular, the secret Pw can thus be stored in advance on both network devices or the secret Pw can be stored in advance on the second network device and the secret Pw can be entered on the first network device by a user before each connection establishment or on the second network device the secret Pw can be stored in advance and on the client, the secret Pw is pre-entered by a user for use with a set of the following connection setups.

First, the client creates in one 1 with the reference number 1 indicated step of the connection establishment a message M1 and sends it to the server. The message M1 comprises the identity IDi of the client, a random number Ni newly generated by the client, and optionally a parameter set Pi. The parameter set Pi can name algorithms that are to be used by the network devices during the connection setup for authentication / authentication. For example, Pi can name algorithms that should be used after the connection setup to protect the further communication. It is advantageous if the client in the parameter set Pi calls the assumed or desired identity of the server. Because then the server can decide when processing M1, whether the connection is really desired to him or was misdirected. The mention of the assumed or desired identity is particularly advantageous if the server itself has different identities, for example different identities for communicating with different groups of clients or one identity per service provided by it.

Then the server processes in one 1 with the reference number 2 indicated step the received message M1 and decides whether it agrees to establish a connection with the named identity IDi of the client. The advantage here is that no cryptographic operation is necessary to detect misdirected requests for connection setup at this point.

If the server agrees to the connection, he answers in a 1 with the reference number 3 indicated step to the client with a message M2, which contains its identity IDr, a random number Nr generated by it and optionally a parameter set Pr. The parameter set Pr may, for example, name the combination of algorithms which have been selected by the server for authentication / authentication in the course of the connection setup, for example in response to a set of algorithms proposed by the client for this purpose in Pi. Pr may also name the combination of algorithms to be used after completion of the connection setup to protect the further communication, for example, in response to a set of algorithms proposed by the client in Pi for this purpose.

In one at 1 with the reference number 4 indicated step, the client generates a message M3 and sends it to the server. The message M3 contains a signature AuthI generated with symmetric cryptographic algorithms, in which the shared secret Pw is composed as the key for generating the signature and the signed data, for example from the message M1 without the random number Ni and the complete message M2. One possible algorithm for this is, for example, message authentication by means of HMAC-MD5, as described, for example, in:
H. Krawczyk, M. Bellare and R. Canetti, "RFC 2104 - HMAC: Keyed Hashing for Message Authentication," Internet Engineering Task Force (IETF), 1997 , As already stated above, a significant advantage of using a symmetric signature for embedded systems is that they require less resources (computation time and processing memory) than asymmetric methods.

In one at 1 with the reference number 5 indicated step the server compares the signature AuthI from the message M3 with a self-calculated signature AuthI '. This tells the server if the client owns the same secret Pw.

Then the server sends in a 1 with the reference number 6 indicated step in the case of positive verification of the signature AuthI also generated by him signature AuthR in the message M4 to the client. The signature AuthR is also generated with a symmetric cryptographic algorithm, in which the shared secret Pw is also used as a signature key. This time the signed data is the combination eg of the complete message M1 with the message M2 reduced by the random number no.

• a) AuthI = Signatur von M1 und M2 sowie unter Verwendung von Pw und AuthR = Signatur von M1 und M2, jedoch ohne Nr sowie unter Verwendung von Pw;
• b) AuthI = Signatur von M1 und M2 jedoch ohne Nr sowie unter Verwendung von Pw und AuthR = Signatur von M1 und M2 sowie unter Verwendung von Pw;
• c) AuthI = Signatur von M1 und M2 sowie unter Verwendung von Pw und AuthR = Signatur von M1 jedoch ohne Ni und M2 sowie unter Verwendung von Pw;
• d) AuthI = Signatur von M1 jedoch ohne Ni und M2 sowie unter Verwendung von Pw und AuthR = Signatur von M1 und M2 sowie unter Verwendung von Pw.

Alternative expedient variations with regard to the signatures AuthI and AuthR can be, for example:

• a) AuthI = signature of M1 and M2 and using Pw and AuthR = signature of M1 and M2, but without Nr and using Pw;
• b) AuthI = signature of M1 and M2 but without Nr as well as using Pw and AuthR = signature of M1 and M2 as well as using Pw;
• c) AuthI = signature of M1 and M2 and using Pw and AuthR = signature of M1 but without Ni and M2 as well as using Pw;
• d) AuthI = signature of M1 but without Ni and M2 and using Pw and AuthR = signature of M1 and M2 as well as using Pw.

Essential in the context of particularly expedient embodiments of the invention is that the values AuthI and AuthR are not the same. Otherwise, an attacker could possibly make a very simple attack if he can manipulate the exchanged messages. Because he would no longer need the secret Pw to calculate AuthR, but simply sets the value of AuthI in the message M4 as the value of AuthR. Thus, it would be possible for the attacker, in particular without knowledge of Pw, to be of the content selected for the messages M1 and M3 determine that the server does not detect tampering.

From the AuthI and AuthR signatures server and client in in 1 with the reference numerals 7 indicated steps using the first secret Pw a second secret G, which is in particular a combination of a plurality of cryptographic keys SK2_ai, SK2_ar, SK2_ei, SK2_er, which are used to secure the subsequent communication, for example by signing and / or encrypt / decrypt. Server and client use previously agreed symmetric algorithms, for example HMAC-MD5, using Pw as the key and the AuthI and AuthR signatures as data.

As variants, instead of the signatures AuthI and AuthR in the 1 with the reference numerals 7 For example, only the random numbers Ni and Nr are used. It should be noted, however, that the use of at least one identical signature, which is present both network devices, either by own generation or by reception, then a cryptographic protection of signed components of the messages M1 and M2 takes place, for example, the identities IDi and IDr and / or the optional parameters Pi and Pr. However, this is missing in the exclusive use of the values Ni and No. In addition, must then be reserved on the network devices or the devices hosting these network devices as long as memory for the values Ni and Nr, so that they are still ready when algorithm A3 is executed. One of the signatures, on the other hand, is much more likely to be in RAM because of the immediately preceding comparison.

• a) G = Ausführen von A3 unter Verwendung von Pw, Ni, Nr;
• b) G = Ausführen von A3 unter Verwendung von Pw, AuthI, AuthR;
• c) G = Ausführen von A3 unter Verwendung von Pw, Ni, AuthR;
• d) G = Ausführen von A3 unter Verwendung von Pw, AuthI, Nr;

Wobei im Falle eines positiven Vergleichs der ersten Signatur mit der zweiten Signatur auch gegebenenfalls AuthI‘ anstelle von AuthI, d.h. bei Verifikation des Vorliegens identischer Signaturen, auf der zweiten Netzwerkeinrichtung und Falle eines positiven Vergleichs der dritten Signatur mit der vierten Signatur, d.h. bei Verifikation des Vorliegens identischer Signaturen, auch gegebenenfalls AuthR‘ anstelle von AuthR auf der ersten Netzwerkeinrichtung verwendet werden kann. Possible variations with respect to the second secrets may thus be, for example:

• a) G = performing A3 using Pw, Ni, Nr;
• b) G = execution of A3 using Pw, AuthI, AuthR;
• c) G = performing A3 using Pw, Ni, AuthR;
• d) G = execution of A3 using Pw, AuthI, Nr;

In the case of a positive comparison of the first signature with the second signature, AuthI 'instead of AuthI, ie upon verification of the presence of identical signatures on the second network device and case of a positive comparison of the third signature with the fourth signature, ie upon verification of the Presence of identical signatures, also possibly AuthR 'instead of AuthR on the first network device can be used.

Only after the successful sending of the message M4 at the server or receiving the message M4 at the client, the network devices begin to secure the subsequent secure communication using the symmetric keys that they have generated with the second shared secret G. In this case, it is advantageous that in the case of a negative check of the signature AuthI by the server, the server can still send an answer in plain text with the cause description to the client.

Because according to the invention the identification and authentication / authentication takes place in separate steps, the identification with the exchange of the messages M1 and M2, the authentication / authentication with the exchange of the messages M3 and M4, the error cases can be distinguished very easily which arise due to mismatched identities or otherwise due to non-identical secrets Pw.

It is advantageous for the separate authentications / authentications, which include sending, receiving and processing of the messages M3 or M4, that the respective check of AuthR and AuthI client and server is sure that they possess the same Pw and the same values of Ni and No are. Consequently, you use the same value for G for the subsequent protection of the communication and thus errors in the check of the subsequent communication (for example, their signatures) are not caused by incorrect authentication / authentication, but always a transmission error or a manipulation. Consequently, these errors can be distinguished. As already mentioned above, it does not assume that there is no communication relationship between the first and second network device before the method is used. An existing communication relationship can be hedged later by applying the method according to the invention.

Moreover, as already indicated above, with respect to the first secret Pw, advantageous variants arise when throughout the connection setup (ie, for secure communication) the network devices employ a Pw-derived value when using the first secret instead of Pw, for example a value generated by means of an HMAC (keyed-hash message authentication code) function or a key derivation function from Pw, for example by means of the already mentioned HMAC-MD5 or that in RSA Laboratories, "PKCS # 5 v2.0: Password-Based Cryptography Standard," 1999 PBKDF2 function (Password-Based Key Derivation Function 2).

In the derivation can advantageously incorporate features that are individual to the intended communication protocol. This increases security if the same secret is to be used in a network setup for various communication protocols. The use of PBKDF2 is particularly advantageous when there are larger resources in the first network device, such as a fast arithmetic unit, and a user enters the secret Pw and only the value derived by PBKDF2 is stored on the second network device, because then on the second , resource-poor network device significantly less arithmetic work, can be recovered by copying the derived from Pw per PBKDF2 value but not Pw.

Thus, in the context of the invention, when using the first secret Pw instead of Pw, the network devices may also employ a value derived from Pw, where in the derivative Pw is suitably combined with a constant, the constant being e.g. identifies the communication protocol used after establishing the connection. This is thus particularly advantageous if the same two network devices communicate with different protocols and establish a secure connection for each protocol according to the methods described. Different secrets can then be deduced and used instead of Pw for each communication protocol. For an attacker, it is therefore more difficult to guess the secret for each communication protocol.

Alternatively, in the context of the invention for connection establishment for secure communication e.g. Also stored on a network device not the secret Pw itself, but a value derived from it, for example, a value that arises after applying a key-derivation function on Pw. On the other network device, on the other hand, the secret Pw is stored or reentered before each call is established, and before each use, a derived value is again calculated and used. This is thus particularly advantageous if a number of different network devices or devices accommodating them are to be accessed from a central location with the same secret Pw and the derivation of Pw in each case incorporates a network and / or device identity. Because then it is an attacker who "steals" one of these network devices or one of these devices and gets hold of the derivative of the secret Pw, but essentially not possible to access the other devices instead of the control center, because the derivation of the secret Pw do not let the secret determine itself, at least only with great effort.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102012220990 B3 [0016, 0016, 0034, 0051]

Cited non-patent literature

• "RFC 5996 Internet Key Exchange Protocol Version 2", C. Kaufmann, P. Hoffmann, Y. Nir and P. Eronen; The Internet Engineering Task Force (IETF), 2010 [0010]
• "RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2", T. Dierks and E. Rescorla; The Internet Engineering Task Force, 2008 [0021]
• "RFC 4279 Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)", P. Eronen and H. Tschofenig, The Internet Engineering Task Force [0031]
• "OPC Unified Architecture Part 2: Security Model", 2009 [0035]
• "OPC Unified Architecture Part 4: Services", 2009 [0035]
• "OPC Unified Architecture Part 6: Mappings", 2009 [0035]
• H. Krawczyk, M. Bellare and R. Canetti, "RFC 2104 - HMAC: Keyed Hashing for Message Authentication," Internet Engineering Task Force (IETF), 1997 [0105]
• "PKCS # 5 v2.0: Password-Based Cryptography Standard," 1999 [0116]

Claims (18)

Method for establishing a secure communication between a first network device (initiator) and a second network device (responder) in a communication network, characterized in that using a symmetric cryptosystem, in which thus both network devices each have the same secrets as keys for encryption and decryption of Insert records, each a separate authentication / authentication is performed with respect to the first and the second network device before generating a secret to be used for secure communication as a common key.  Method according to claim 1, comprising the steps: a) generating on the first network device of a data set containing at least one random number (Ni), and Sending a first message (M1) containing an identity identifier (IDi) of the first network device and said generated data set from the first network device to the second network device; b) generating on the second network device of a data set containing at least one random number (Nr), and Sending a second message (M2) containing an identity identifier (IDr) of the second network device and said generated data set from the second network device to the first network device; c) generating on the first network device of a data record containing a first signature (AuthI) by executing a first algorithm (A1) using a first secret (Pw) and data to be signed, which consists of a first message part of the first Message (M1) and a second message part of the second message (M2), and Sending a third message (M3) containing this generated record from the first network device to the second network device; d) generating on the second network device a record containing a second signature (AuthI ') by executing the first algorithm (A1) using the first secret (Pw) and data to be signed from the same first message part the first message (M1) and the same second message part of the second message (M2) are composed as in the generation of the record containing the first signature (AuthI), and comparing the data set generated by the first network device and containing the first signature (AuthI) with the data set generated by the second network device and containing the second signature (AuthI '); e) generating on the second network device a record containing a third signature (AuthR) by executing a second algorithm (A2) using the first secret (Pw) and data to be signed, which consists of a third message part of the first one Message (M1) and a fourth message part of the second message (M2), wherein the third message part is a message part other than the first message part and / or the fourth message part is a message part other than the second message part, and Sending a fourth message (M4) containing this generated record from the second network device to the first network device; f) generating on the first network device a record containing a fourth signature (AuthR ') by executing the second algorithm (A2) using the first secret (Pw) and data to be signed, corresponding to the third signature ( AuthR) from the same third message part of the message (M1) and the same fourth message part of the message (M2) are composed as in the generation of the third signature (AuthR), and Comparing the data set generated by the second network device and containing the third signature (AuthR) with the data set generated by the first network device and containing the fourth signature (AuthR '); g) Generation of a respective second secret (G) on the first network device and on the second network device, respectively by executing a third algorithm (A3) using the first secret (Pw) and at least one of the previously in steps a) , b), c), d), e), f) generated data sets; h) using the second shared secret (G) by the first network device and the second network device as a common key for secure communication between the first network device and the second network device.  The method of claim 2, wherein in step g) on the first and the second network device in each case only generated data sets each having the same data is used, in particular each at least one of the data sets containing at least one random number (Ni, Nr) and / or at least one of the records containing the first, third or fourth signature and at least one of the records containing the first, second or third signature. A method according to claim 2 or 3, characterized in that - After step a) by the second network device, first a check of the transmitted from the first network device identity identifier (IDi) is performed and is decided based on the result of the test of the second network device, whether step b) is initiated or the method after step a ) is stopped, - after step b), the first network device first performs a check of the identity code (IDr) sent by the second network device and, based on the result of the check, decides whether step c) is initiated or not by the first network device Method after step b) is discontinued, - after step d) is decided by the second network device in response to the result of comparing the first signature with the second signature, whether step e) is initiated or the method is aborted after step d), and / or - after step f) vo n the first network device is decided in response to the result of comparing the third signature with the fourth signature, whether step g) is initiated or the method is aborted after step f). Method according to one of the preceding claims 2 to 4, characterized in that the first secret (Pw) is stored on the first network device and on the second network device or input via an input interface, in each case before each step of a) or for a repeated execution of step a), wherein when using the first secret (Pw) on both network devices either directly the first secret (Pw) is used or a value derived identically from the first secret (Pw), in particular by for or by the two Network devices each an identical derivation method is performed. Method according to one of the preceding Claims 2 to 4, characterized in that the first secret (Pw) is stored on one of the two network devices and a value derived based on the first secret (Pw) is entered on the other of the two network devices or entered via an input interface in each case before each step a) or for a repeated execution of step a), wherein in the case of the use of the first secret (Pw) on both network devices a value derived identically based on the first secret (Pw) is used. Method according to one of the preceding claims 2 to 6, characterized in that - the first message (M1) additionally contains a parameter set (Pi) containing the first algorithm (A1), the second algorithm (A2), the third algorithm (A3) , a rule for deriving a value based on the first secret (Pw), an identification of respective message parts for generating signatures and / or an identity identifier of the second network device and / or - the second message (M2) additionally a parameter set (Pr) containing the first algorithm (A1), the second algorithm (A2), the third algorithm (A3), an identification of respective message parts for generating signatures and / or a rule for deriving a value based on the first secret (Pw) includes. Method according to one of the preceding claims 2 to 7, characterized in that the first or third message part of the first message (M1) is formed without using the random number (Ni) contained in this message and / or the second or fourth message part of the second message (M2) without using the random number (Nr) contained in this message. Method according to one of the preceding claims 2 to 8, characterized in that the steps a) to h) are carried out in an already existing communication relationship between the first network device and the second network device to hedge this already existing communication relationship subsequently.  Computer program product, which causes the implementation of the method according to one of the preceding claims. Arrangement with a first network device and a second network device in a communication network, in particular for carrying out a method according to one of claims 1 to 9, wherein on the first network device a first processing means (V1), a first communication means (K1) and a first secure communication means ( sK1) are provided and on the second network device, a second processing means (V2), a second communication means (K2) and a second secure communication means (sK2) are provided; characterized in that a) the first processing means (V1) is arranged to generate a record containing at least one random number (Ni) and the first communication means (K1) is arranged to transmit a first message (M1) containing one Identity identifier (IDi) of the first network device and this record generated by the first network device, from the first network device to the second network device; b) the second processing means (V2) is arranged to generate a data set, the at least one random number (Nr), and the second communication means (K2) is arranged to transmit a second message (M2) containing an identity identifier (IDr) of the second network device and this record generated by the second network device from the second network device the first network device; c) the first processing means (V1) is further adapted to execute a first algorithm (A1) on the first network device to generate a data record containing a first signature (AuthI) using a first secret (Pw) and to be signed Data, wherein the first processing means (V1) is arranged to assemble these data to be signed from a first message part of the first message (M1) and a second message part of the second message (M2), and wherein the first communication means (K1) is further set up for Sending a third message (M3) containing this generated record from the first network device to the second network device; d) the second processing means (V2) is further arranged to execute the first algorithm (A1) on the second network device to generate a record containing a second signature (AuthI ') using the first secret (Pw) and to signing data, the second processing means (V2) being arranged to assemble these data to be signed from the same first message part of the first message (M1) and the same second message part of the second message (M2) as the first processing means (V1) at the Generating the record containing the first signature (AuthI), and wherein the second processing means (V2) is arranged to compare the data record generated by the first network device with the first signature (AuthI) and the second signature generated by the second network device (AuthI ') contained record; e) the second processing means (V2) is further adapted to execute a second algorithm (A2) for generating a record containing a third signature (AuthR) using the first secret (Pw) and data to be signed, wherein the second processing means (V2) is arranged to assemble these data to be signed from a third message part of the first message (M1) and a fourth message part of the second message (M2), the third message part being a message part other than the first message part and / or the fourth message part Message part is a message part other than the second message part, and wherein the second communication means (K2) is further arranged to send a fourth message (M4) containing this generated record from the second network device to the first network device; f) the first processing means (V1) is further adapted to execute the second algorithm (A2) on the first network device to generate a data set containing a fourth signature (AuthR ') using the first secret (Pw) and to signing data, the first processing means (V1) being arranged to assemble these data to be signed according to the third signature (AuthR) from the same third message part of the message (M1) and the same fourth message part of the message (M2) as the second processing means (V2) in the generation of the record containing the third signature (AuthR), and wherein the first processing means (V1) is arranged to compare the data set generated by the second network device with the third signature (AuthR) with that of the first network device generated record containing the fourth signature (AuthR '); g) the first and second processing means (V1, V2) are further arranged to execute a third algorithm (A3), to respectively generate a common second secret (G) using the first secret (Pw) and at least one of the data sets, containing the random number (Ni), the random number (Nr), the first signature (AuthI), the second signature (AuthI '), the third signature (AuthR) or the fourth signature (AuthR'); h) the first and second secure communication means (sK1, sK2) are arranged to use the shared second secret (G) as a common key for secure communication between the first network device and the second network device.

Images