EP3298721A1

EP3298721A1 - Method for generating a secret or a key in a network

Info

Publication number: EP3298721A1
Application number: EP16716541.4A
Authority: EP
Inventors: Timo Lothspeich; Andreas Mueller
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2015-05-22
Filing date: 2016-04-13
Publication date: 2018-03-28
Also published as: KR20180009753A; JP2018516019A; CN107624229A; US20180123786A1; CN107624229B; WO2016188667A1; US10841085B2; DE102015209496A1

Abstract

Disclosed is method for generating a secret or key in a network. The network comprises at least a first and a second subscriber and a common transmission channel between at least the first and second subscribers. The first subscriber can output at least a first value and a second value and the second subscriber can output at least the first value and the second value on the transmission channel, the first subscriber generating a first sequence of subscriber values and the second subscriber generating a second sequence of subscriber values in order for the transmission to occur largely synchronously on the transmission channel; and the first subscriber and the second subscriber each generate a common secret or a common key, the first subscriber doing so on the basis of information about the first sequence of subscriber values and on the basis of a sequence of superposed values resulting from a superposition of the second sequence of subscriber values onto the first sequence of subscriber values on the transmission channel, and the second subscriber doing so on the basis of information about the second sequence of subscriber values and on the basis of the sequence of superposed values resulting from the superposition of the second sequence of subscriber values onto the first sequence of subscriber values on the transmission channel. At certain intervals or in accordance with a detected sequence of superposed values, at least the first subscriber outputs at least one filler value outside the first sequence of subscriber values or the second subscriber outputs at least one filler value outside the second sequence of subscriber values onto the transmission channel such that an edge change or change in values occurs on the transmission channel.

Description

Description title

A method for creating a secret or key in a network

Technical area

The present invention relates to a method for generating a secret or a secret, cryptographic key in a network, in particular the generation of a common, secret key in two participants of the network. Also point-to-point connections are usually counted as networks and should also be addressed here with this term. The two participants communicate via a shared transmission medium. In this case, logical bit sequences (or, more generally, value sequences) are transmitted physically by means of corresponding transmission methods as signals or signal sequences. The underlying communication system may e.g. be a CAN bus. This provides for transmission of dominant and recessive bits or correspondingly dominant and recessive signals, whereby a dominant signal or bit of a participant of the network intersperses against recessive signals or bits. A state corresponding to the recessive signal adjusts itself to the transmission medium only if all participants involved provide a recessive signal for transmission or if all participants transmitting at the same time transmit a recessive signal level.

State of the art

Secure communication between different devices is becoming more and more important in an increasingly networked world, and in many applications is an essential prerequisite for the acceptance and thus the economic success of the corresponding applications. This includes various protection goals, depending on the application the confidentiality of the data to be transferred, the mutual authentication of the participating nodes or the safeguarding of data integrity. In order to achieve these protection goals, suitable cryptographic methods are usually used, which can generally be subdivided into two different categories: first, symmetric methods, in which the sender and receiver have the same cryptographic key, and, on the other hand, asymmetrical methods in which the sender uses the data to be transmitted is encrypted with the public (ie possibly also known to a potential attacker) key of the recipient, but the decryption can be done only with the associated private key, which is ideally known only to the recipient.

One of the disadvantages of asymmetric methods is that they usually have a very high computational complexity. Thus, they are only conditionally for resource-constrained nodes, such. As sensors, actuators, or the like., Which usually have only a relatively low processing power and low memory and energy-efficient work, for example due to battery operation or the use of energy harvesting. In addition, there is often limited bandwidth available for data transmission, making the replacement of asymmetric keys with lengths of 2048 bits or even more unattractive.

For symmetric methods, however, it must be ensured that both the receiver and the transmitter have the same key. The associated key management generally represents a very demanding task. In the area of mobile telephony, keys are used, for example, with the help of

SI M cards inserted into a mobile phone and the associated network can then assign the unique identifier of a SI M card the appropriate key. In the case of wireless LANs, on the other hand, a manual entry of the keys to be used (usually by entering a password) usually takes place when setting up a network. However, such key management quickly becomes very cumbersome and impractical if one has a very large number of nodes, for example in a sensor network or other machine-to-machine communication systems, e.g. As well as CAN-based vehicle networks. In addition, an amendment to the turning key often not at all or possible only with great effort.

Method for securing sensor data against tampering and ensuring transaction authentication, e.g. in a motor vehicle network, by means of common encryption methods, e.g. in the DE

102009002396 AI and in DE 102009045133 AI discloses.

For some time now, the term "physical layer security" has been used to investigate and develop novel approaches that can be used to automatically generate keys for symmetric algorithms based on physical properties of the transmission channels between the nodes involved, using reciprocity and the inherent However, in the case of wired or optical systems in particular, this approach is often only suitable to a limited extent since corresponding channels usually have only a very limited temporal variability and an attacker can draw conclusions about the channel parameters between the transmitter and the receiver relatively well, for example by means of modeling Such methods for secured communication in a distributed system based on channel characteristics of the connected units are not previously published in, for example, US Pat DE Applicants DE 10 2014 208975 AI and DE 10 2014 209042 AI described.

Methods for bit stuffing in the Controller Area Network (CAN) and CAN-FD can be found for example in DE 10 2011 080476 AI.

The non-prepublished DE 10 2015 207220 AI discloses a method for generating a shared secret or a secret symmetric key by means of public discussion between two communication participants. Disclosure of the invention

The methods for generating a secret or a cryptographic key according to the independent claims do not require any manual intervention and thus enable the automated establishment of secure communication relationships between two nodes. In addition, the methods have a very low complexity, in particular with regard to the required hardware design, such as e.g. the required memory resources and computing power, and they are associated with a low energy and time requirements. In addition, the methods offer very high key generation rates with a simultaneously very low probability of error.

The methods assume that participants in a network communicate with each other via a communication channel. In particular, they transfer logical sequences of values (in the case of binary logic, bit sequences) with the aid of physical signals on the transmission channel. Even if possible superimpositions take place on the transmission channel through the signals, that is to say on the physical level, in the description below the logical level is primarily considered. Thus, the transferred, logical value sequences as well as their logical overlay are considered. Subscribers of the network can thus give first signals (for example associated with logical bit "1") and second signals (associated, for example, with logical bit "0") to the communication channel and detect resulting signals on the communication channel. Now transmit two participants (largely) at the same time each one signal sequence, the participants can detect the resulting overlay on the communication channel. The effective signal resulting from the (largely) simultaneous transmission of two (independent) signals on the communication channel can then in turn be assigned to one (or more) specific logical values (or values). The transmission must be largely synchronous in that a superimposition of the individual signals of a signal sequence on the transmission medium takes place, in particular, that the signal corresponding to the n-th logical value or bit of the first subscriber with the signal corresponding to the n-th logical Value or bit of the second participant at least partially superimposed.

This overlay should be sufficiently long for the participants to be able to record the overlay or determine the corresponding overlay value.

The superimposition can be determined by arbitration mechanisms or by physical signal superposition. By arbitration mechanism is meant, for example, the case that a node wants to apply a recessive level, but detects a dominant level on the bus and thus omits the transmission. In this case, there is no physical interference between two signals, but only the dominant signal is seen on the transmission channel.

From the resulting value sequence of the overlay and its own value sequence, the participants can then generate a key that is secret to an outside attacker. The reason for this is that the outside attacker, who can listen to the effective overall signals applied to the shared transmission medium, sees only the superimposition of the value sequences, but does not have the information about the individual value sequences of the participants. Thus, the participants have more information that they can use against the attacker to generate a secret key.

If the described methods are used in certain systems, such as CAN, without additional measures, it may happen that relatively long sequences of the same bits or signal levels are present on the shared transmission medium (eg CAN bus). This may in turn lead to bit stuffing errors and / or synchronization losses, which may cause other nodes to send special error messages and abort the process, to avoid this, but still largely compatible with today available transceiver It is proposed to extend the described methods for generating keys in such a way that bit stuffing errors and / or synchronization losses are prevented and thus the compatibility of this key establishment method increases to already available standard components.

For this purpose, it is proposed that the participants involved in the key generation outside their subscriber value sequences, i. in addition to these, give at least one fill value to the common transmission channel such that a change of edge or a value change results (e.g., bit change 0 to 1 or 1 to 0 in a binary system). This can be done by only one of the participants. In a preferred embodiment, however, filling quantities are applied to the transmission channel largely synchronously by both subscribers, so that an edge change or a value change results from the superimposition signal of the filling values.

The fill values are given to the transmission channel at certain intervals (i.e., in particular after a certain number of individual values of the value sequences) or as a function of a detected overlay value sequence.

In a preferred embodiment, the subscribers place the fill values on the transmission channel if they each detect an overlay value sequence having a predetermined number of equal values. The fill values are preferably inverse to the detected same values. Since stuff bits generally increase the overhead of a communication protocol and thus reduce the efficiency of key establishment, it is advantageous to provide such fill values only when in fact a certain number of value repeats is exceeded, which is detected here on the basis of the superposition sequence.

If the subscribers are able to do so, the fill values may be added to the transmission channel immediately adjacent to the detected number of equal values in the superposition value sequence. In this variant, the number to be detected can be set exactly to the permissible maximum number of identical values, so that the filling values are really only inserted in cases which they are necessary. Otherwise, the fill values may also be inserted at a predetermined distance to detect a number of value repeats, which number should then be selected correspondingly lower than the maximum number. Although this creates a higher overhead, the method is less demanding (especially with respect to hardware requirements for the subscribers) and can be more reliable.

To perform even easier, and thus particularly compatible with existing communication systems and subscriber hardware, is an alternative embodiment in which the fill values are always inserted by the participants at fixed, predetermined intervals, in particular after a predetermined number of detected values on the transmission channel it must be the same values. In this case, two fill values are preferably inserted, which already contain a value change or edge change (for example, the bit sequence 01 from both subscribers or the bit sequence 10 from both).

Particularly advantageously, the method can be used in a network in which there is a dominant value (physically: a dominant signal) that prevails when only one subscriber applies it on the transmission channel and a recessive value (physically: a recessive signal ), on the

Transmission channel only results if both or all participants transmit a recessive value. Because of the clearly defined overlay rules, the subscribers of such a network can derive from the resulting overlay sequences particularly simple information for generating the key. Alternatively, the transmission of a recessive value of at least one of the subscribers can also be replaced by the fact that at this point the value sequence or, as one of the at least two possible values, nothing is transmitted. The subscriber value sequences, which are given largely simultaneously by the subscribers to the transmission channel, are generated in advance in the respective subscribers themselves with the aid of a random generator or pseudo-random generator. Since the resulting overlay sequence on the transmission channel can be accessible to a potential attacker, it is particularly advantageous for the security of the subsequent communication if the attacker is able to lows having to conclude on the individual value sequences of the participants, if these are generated locally and randomly or at least pseudorandomly in the participants.

The methods described can be implemented particularly well in a CAN, TTCAN or CAN FD bus system. Here, a recessive bus level is replaced by a dominant bus level. The superimposition of values or signals of the subscribers thus follows defined rules which the subscribers can use to derive information from the superimposed value or signal and the value or signal transmitted by them. The methods are also well suited for other communication systems such as LIN and I2C.

Alternatively, however, the method can also be used, for example, in a network with on-off-keying amplitude shift keying. Here, too, the overlay is fixed by allowing the subscribers to be "transmission" and "no transmission" signals and the beat signal corresponding to the "transmission" signal when one or both of the subscribers transmits and corresponds to the "no transmission" signal, if both participants do not transfer.

While the method has been described for two subscribers in a network, even a subscriber of a network can already derive a secret key from his own signal sequence and from an overlay of this with the signal sequence of a second subscriber. A network or subscriber to a network is set up to do this by having electronic memory and computational resources to perform the steps of a corresponding method. Also stored on a storage medium of such a user or on the distributed storage resources of a network may be a computer program configured to perform all the steps of a corresponding method when executed in the subscriber or in the network.

drawings The invention is described in more detail below with reference to the accompanying drawings and to exemplary embodiments. Show

1 schematically shows the structure of an exemplary, underlying communication system,

2 schematically shows a linear bus as an example of an underlying communication system,

FIG. 3 shows schematically exemplary signal sequences of two subscribers of a network as well as a resulting superposition value sequence on a transmission channel between the subscribers and

4 schematically shows the sequence of an exemplary method for generating a key between two subscribers of a network.

Description of the embodiments

The present invention relates to a method for generating a shared secret or (secret) symmetric cryptographic key between two nodes of a communication system (participants of a network) communicating with each other via a shared medium (transmission channel of the network). The generation or negotiation of the cryptographic keys is based on a public data exchange between the two participants, although a possible listening third party as an attacker is not or only very difficult to draw conclusions about the generated key. With the invention, it is thus possible to fully automatically and securely establish corresponding symmetrical cryptographic keys between two different subscribers of a network, in order then to implement certain security functions, such as eg data encryption, based thereon. As described in detail, a common secret is first established for this, which can be used to generate the key. However, such a shared secret can in principle also be used for purposes other than cryptography. tographische key in the strict sense, eg as a one-time pad.

The invention is suitable for a variety of wired or wireless as well as optical networks or communication systems, especially those in which the various participants communicate with each other via a linear bus and the media access to this bus using a bitwise bus arbitration. This principle represents, for example, the basis of the widespread CAN bus. Possible fields of application of the invention accordingly include, in particular, CAN-based vehicle networks as well as CAN-based networks in automation technology.

The present invention describes an approach with which automatically symmetric cryptographic keys can be generated in one, or in particular between two nodes of a network. This generation takes place by exploiting properties of the corresponding transfer layer. Unlike the usual approaches of "physical layer security", however, physical parameters of the transmission channel such as transmission strength etc. are not evaluated for this purpose, but instead there is a public data exchange between the participating nodes, thanks to the characteristics of the communication system and / or the used modulation method a possible listening aggressor no, or no sufficient conclusions on the negotiated key allows.

The following is an arrangement as shown in FIG. 1 in the abstract. Different subscribers 2, 3 and 4 can communicate with one another via a so-called shared transmission medium C, shared medium 10. In an advantageous embodiment of the invention, this divided transmission medium corresponds to a linear bus (wired or optical) 30, as shown by way of example in FIG The network 20 in Figure 2 consists of this linear bus 30 as a shared transmission medium (e.g., a wireline transmission channel), nodes 21, 22 and 23, and (optional) bus terminations 31 and 32. In the following, communication between the various nodes 21, 22 and 23 is assumed to be characterized by the distinction between dominant and recessive values. In this example, the possible values are the bits "0" and "1". In this case, a dominant bit (eg, the logical bit, 0 ') quasi displace or overwrite a simultaneously transmitted recessive bit (eg, the logical bit, 1').

An example of such a transmission method is the so-called on-off-keying (on-off-keying amplitude shift keying), in which exactly two transmission states are distinguished: in the first case (value, Οη ', or "0") If a signal is transmitted, for example in the form of a simple carrier signal, in the other case (value 'Off' or '1') no signal is transmitted. The state 'η' is dominant while the state 'Off' is recessive.

Another example of a corresponding communication system that supports this distinction of dominant and recessive bits is a (wired or optical) system based on bitwise bus arbitration, such as that used in the CAN bus. The basic idea here is also that if, for example, two nodes want to transmit a signal at the same time and one node transmits a '1', whereas the second node transmits a '0' which 'gains' '0' (ie the dominant bit) ie, the signal level that can be measured on the bus corresponds to a logical '0' .This mechanism is used in particular to resolve possible collisions, whereby priority messages (ie messages with a previous, dominant signal level) are transmitted by When the node itself transmits a recessive bit but a dominant bit is detected on the bus, the corresponding node breaks its transmission attempt in favor of the higher priority message (with the earlier dominant bit).

The distinction between dominant and recessive bits makes it possible to conceive of the shared transmission medium as a kind of binary operator which combines the various input bits (= all bits transmitted simultaneously) with the aid of a logical AND function. FIG. 3 shows, for example, how a subscriber 1 (T1) keeps the bit sequence 0, 1, 1, 0, 1 ready for transmission between the times t0 and t5 via the transmission channel. Subscriber 2 (T2) keeps the bit sequence 0, 1, 0, 1, 1 ready for transmission between times t0 and t5 via the transmission channel. With the above-described characteristics of the communication system and assuming that the bit level "0" in this example is the dominant bit, the bit string 0, 1, 0, 0, 1 will be seen on the bus (B) Only between times t1 and t2 and between t4 and t5, both subscriber 1 (T1) and subscriber 2 (T2) provide a recessive bit "1", so that only in this case does the logical AND operation result in a bit level of " 1 "on the bus (B) results.

Taking advantage of these characteristics of the transmission method of the communication system, a key generation between two subscribers of a corresponding network can now take place in that the subscribers detect a superimposition of bit sequences of the two subscribers on the transmission medium and from this information share information about the self-transmitted bit sequence (symmetric), generate secret key.

An exemplary, particularly preferred implementation will be explained below with reference to FIG. 4.

The process for generating a symmetric key pair is started in step 41 by one of the two nodes involved in this example (subscriber 1 and subscriber 2). This can be done, for example, by sending a special message or a special message header.

Both subscriber 1 and subscriber 2 initially generate a bit sequence locally (ie internally and independently of one another) in step 42. Preferably, this bit sequence is at least twice, in particular at least three times as long as the common key desired as a result of the method. The bit sequence is preferably in each case as a random or pseudo-random bit sequence, For example, with the help of a suitable random number generator or pseudo random number generator generated.

Example of local bit sequences of length 20 bits:

Generated bit sequence of participant 1:

S _T1 = 01001101110010110010

'Generated bit sequence of subscriber 2:

S _T2 = 10010001101101001011

In a step 43, subscriber 1 and subscriber 2 transmit (largely) synchronously their respectively generated bit sequences over the divided transmission medium (using the transmission method with dominant and recessive bits, as already explained above). Different possibilities for synchronizing the corresponding transmissions are conceivable. Thus, for example, either subscriber 1 or subscriber 2 could first send a suitable synchronization message to the respective other node and then start the transmission of the actual bit sequences after a certain period of time following the complete transmission of this message. Equally, however, it is also conceivable that only one suitable message header is transmitted by one of the two nodes (eg a CAN header consisting of arbitration field and control field) and during the associated payload phase then both nodes simultaneously (largely) transmit their generated bit sequences synchronously , In a variant of the method, the bit sequences of a subscriber generated in step 42 can also be transmitted to several messages distributed in step 43, for example if this necessitates the (maximum) sizes of the corresponding messages. In this variant too, the transmission of the correspondingly large number of correspondingly large messages distributed bit sequences of the other subscriber takes place again (largely) synchronously.

On the shared transmission medium, the two bit sequences then overlap, whereby due to the previously required property of the system with the distinction between dominant and recessive bits, the individual bits of subscriber 1 and subscriber 2 result in an overlay, in the example mentioned de facto AND-linked. This results in a corresponding overlay on the transmission channel, which could detect, for example, a listening third party. Example of an overlay bit sequence for the above local bit sequences:

• Effective bit sequence on the transmission channel:

Seff = S _T1 AND S _T2 = 00000001100000000010

Both subscriber 1 and subscriber 2 detect during the transmission of their bit sequences of step 43 in a parallel step 44, the effective (overlaid) bit sequences S _eff on the shared transmission medium. For the example of the CAN bus, this is usually done in conventional systems during the arbitration phase anyway.

This is likewise possible for systems with "η-off-keying" (wireless, wired or optical). In this case, the practical feasibility benefits in particular from the fact that in such a system the state 'η' is dominant and the state 'Off' is recessive (as already explained above). Consequently, even without measurement, a node knows that the effective state is dominant on the shared medium if the node itself has sent a dominant bit, but if a node has sent a recessive bit, it does not know the state on the shared transmission medium first Further, however, in this case he can determine by suitable measurement how it looks like, because, in this case, the node itself does not send anything, so there are no problems with so-called self-interference, which is a complex echo cancellation, especially in the case of wireless systems would require.

In a next step 45, both subscriber 1 and subscriber 2 also transmit (largely) synchronously their initial bit sequences S _T i and

S _T 2, but inverted this time. The synchronization of the corresponding transmissions can again be realized exactly in the same way as described above. On the shared communication medium, the two sequences are then ANDed together again. Attendees 1 and 2 in turn determine the effective, superimposed bit sequences S _e ff on the shared transmission medium.

Example of the above bit sequences:

Inverted bit sequence of participant 1:

S _T1 '= 10110010001101001101

'Inverted bit sequence of participant 2:

S _T2 '= 01101110010010110100

'Effective, overlaid bit sequence on the channel:

S _eff '= Sn AND S _T2 ' = 00100010000000000100

Both subscriber 1 and subscriber 2 determine during the transmission of their now inverted bit sequences then again the effective, superimposed bit sequences on the shared transmission medium. At this time, both nodes (subscriber 1 and subscriber 2), as well as a possible attacker (eg subscriber 3) who overhears the communication on the shared transmission medium, thus know the effective, superimposed bit sequences S _e ff and S _e ff '. In contrast to the attacker or third participant, however, participant 1 still knows his initially generated, local bit sequence S _T i and participant 2 his initially generated, local bit sequence S _T 2- participant 1 but in turn does not know the initially generated, local bit sequence of participant 2 and subscriber 2 does not have the initially generated, local bit sequence of subscriber 1. The detection of the overlay bit sequence again takes place during the transmission in step 46.

As an alternative to this exemplary embodiment, subscriber 1 and subscriber 2 can also send their inverted, local bit sequence directly with or directly after their original, local bit sequence, ie. Steps 45 and 46 are carried out with the steps 43 and 44. The original and the inverted bit sequence can be transmitted in a message, but also in separate messages as partial bit sequences.

In step 47, subscriber 1 and subscriber 2 now respectively locally (ie internally) link the effective, superposed bit sequences (S _e ff and S _e ff '), in particular with a logical OR function.

Example of the above bit sequences: S _tot = S _eff OR S _eff '= 00100011100000000110

The individual bits in the bit sequence (S _g es) resulting from the OR operation now indicate whether the corresponding bits of S _T i and S _T 2 are identical or different. For example, if the nth bit within S _tot is a '0', it means that the nth bit within S _T i is inverse to the corresponding bit within S _T 2. Likewise, if the nth bit within S _g is a '1', the corresponding bits within S _A iice and S _Bo b are identical.

Subscriber 1 and subscriber 2 then cancel in step 48, based on the bit sequence S _ges obtained from the OR combination, in their original, initial bit sequences S _T i and S _T 2 all bits which are identical in both sequences. This consequently leads to correspondingly shortened bit sequences.

Example of the above bit sequences:

Abbreviated bit sequence of participant 1:

S _{T1> V} = 01011100101100

'Abbreviated bit sequence of participant 2:

S _T2 , v = 10100011010011

The resulting, shortened bit sequences S _T i, v and S _T 2, v are now just inverse to each other. Thus, by inversion of its shortened bit sequence, one of the two subscribers can determine exactly the shortened bit sequence that already exists in the other subscriber.

The thus shared, shortened bit sequence is now processed locally by participant 1 and participant 2 in step 49 in a suitable manner in order to generate the actual desired key of the desired length N. Again, there are a variety of ways that this treatment can be done. One possibility is to select N bits from the common truncated bit sequence, where it must be clearly defined which N bits are to be taken, eg simply by selecting the first N bits of the sequence. Likewise possible is the calculation of a hash function via the jointly present, shortened bit sequence, which provides a hash of length N. In general, the rendering can be done with any linear and nonlinear function that returns a N bit length bit sequence when applied to the co-present truncated bit sequence. The mechanism of key generation from the common truncated bit sequence is preferably identical in both subscribers 1 and 2 and is performed accordingly in the same way.

Following the key generation, it may still be possible to verify that the keys generated by subscribers 1 and 2 are actually identical. For this purpose, for example, a checksum could be calculated using the generated keys and exchanged between subscribers 1 and 2. If both checksums are not identical, then obviously something has failed. In this case, the described method for key generation could be repeated.

In a preferred variant of the method for generating a key, in a number of passes, a whole series of resulting shortened bit sequences, which are each present in the case of subscribers 1 and 2, can be generated, which are then combined into a single large sequence before the actual key is derived therefrom , If necessary, this can also be done adaptively. If after performing the described procedure once, e.g. For example, if the length of the common, truncated bit sequence is less than the desired key length N, one could re-run e.g. Generate further bits before the actual key derivation.

Finally, the generated symmetric key pair can be subsumed by Subscriber 1 and Subscriber 2 in conjunction with established (symmetric) cryptographic methods, e.g. Ciphers for data encryption.

A goal of the linking of the two overlay partial value sequences, in particular by means of a logical OR function, is to be able to carry out a deletion of those bits which are also a passive attacker who controls the communication observed, can easily determine on the basis of his observations. An alternative to this would be to keep those bits, but initially generate significantly more bits than desired (that is, if, for example, a secret or a key of 128 bits is desired to first generate 300 bits) and then at the end, eg with the help of a Hash function or similar, to reduce to the desired length.

A potential attacker (eg subscriber 3) can listen to the public data transmission between subscriber 1 and subscriber 2 and thus gain knowledge of the effective, superposed bit sequences (S _e ff and S _e ff ') as described. The attacker then only knows which bits in the locally generated bit sequences of nodes 1 and 2 are identical and which are not. In addition, with the identical bits, the attacker can even determine whether it is a '1' or a '0'. For a complete knowledge of the resulting, shortened bit sequence (and thus the basis for the key generation), however, he lacks the information about the non-identical bits. In order to further aggravate possible attacks for the attacker, in a preferred variant the bit values identical in the original, locally generated bit sequences of the users 1 and 2 are additionally deleted. This means that participant 3 has only information that is not used for key generation. Although he knows that correspondingly shortened bit sequences emerge from the different between the local bit sequences of the participants 1 and 2 participants bits. However, he does not know which bits have been sent by subscriber 1 and subscriber 2 respectively.

In addition to the information about the superimposed overall bit sequence, subscriber 1 and subscriber 2 also have the information about the locally generated bit sequence transmitted by them in each case. The fact that the keys generated in subscribers 1 and 2 remain secret as a basis despite the public data transmission results from this information advantage over a subscriber 3 following only the public data transmission.

With the described methods for generating a key, it is possible that relatively long sequences of identical bits or signal levels in the simultaneous transmission by the users 1 and 2 are effectively transmitted on the transmission line. canal abut. This is due to the fact that both participants initially generate random bit sequences independently of one another, but only one superimposition of these bit sequences is effectively present on the channel. This can be, for example, a bit sequence combined with an AND operation, assuming a dominant bit 0 and a recessive bit 1. Since the two users do not know the randomly generated bit sequence of the other participant, it can always first happen that the effective bit sequence has almost arbitrarily long subsequences with the same consecutive bits. This in turn can be problematic in certain communication systems when using standard hardware and software, which will be explained in greater detail below using the example of CAN for example.

The CAN protocol stipulates that after N = 5 consecutive equivalent bits, a so-called 'stuff bit' with a complementary value must be inserted into the actual bit sequence to be transmitted, which is automatically removed at the receiver. These 'stuff bits' are not information bits but have the following background:

1) Bit sequences with more than N = 5 consecutive equivalent bits are used for control purposes (eg as an "end-of-frame" indication or as an "error frame") and therefore it must be ensured that such sequences do not occur in the actual information part ,

2) CAN uses a non-return-to-zero coding for the transmission of CAN messages. However, this favors synchronization losses due to not perfectly synchronous clocks in different nodes, which is why during the transmission or reception of a CAN message, a time synchronization must be performed in order to keep the hardware requirements low (eg requirements for the local oscillators ). Due to the introduction of a stuff bit, an edge change takes place at the latest after N = 5 consecutive bits, which can then be used for such a post-synchronization.

If the 'bit-stuffing rule' in the CAN is violated, all subscribers who detect this violation immediately transmit an'Error Flag '(= 6 or more consecutive). dominant bits) and try to cancel the process. This in turn prevents the successful establishment of symmetric cryptographic keys with the methods briefly outlined above.

In the following, therefore, expansions of the described methods are presented, by means of which bit stuffing errors can be avoided, so that e.g. in the case of CAN no'Error Flags' are sent by other nodes due to such an error. At the same time it can be ensured that a regular time synchronization by the participants of the communication system is possible and thus the probability of synchronization errors can be reduced. Depending on the type and type of communication system, both aspects may be important or just one of them.

The introduction of suitable 'stuff bits' is intended to prevent more than N consecutive bits from having the same value. However, this can not be done by transmission rules for the individual participants regardless of the other participants, since it depends on the described method to appropriate edge change or value change of a superposition value sequence. For this purpose, various possibilities are proposed.

In a first preferred embodiment, use is made of the fact that the first and second subscribers in the described method for generating the key during the synchronous transmission of the random bit sequences in step 43 always have the effective signal level (or the effective bit sequence) on the shared transmission medium Detect in parallel step 44. If the nodes notice that the effective bit value on the transmission medium is always the same N times in succession, both nodes will next send a stuff bit which is inverse to the effective N consecutive times. An essential difference to conventional bit stuffing is thus that the decision as to whether a stuff bit must be inserted does not depend primarily on the own message or bit string but only on the effective bit string on the shared transmission medium. The same applies to the value of the stuff bit to be sent.

Example: Random, initial (locally generated) bit sequence of participant 1:

011010110110101

Random, initial (locally generated) bit sequence of participant 2:

010100001111011

Effective bit sequence on the transmission medium with logical AND operation of the single sequences without stuff bits:

010000000110001

If N = 5 (as in the case of CAN, for example), then there would be a stuffing error since the effective bit value '0' is applied to the transmission medium 7 times in succession.

By contrast, with the approach proposed above according to the first embodiment, the following bit sequence would actually be present on the transmission medium:

0100000100110001

The underlined bit is the additionally introduced stuff bit, which is inserted and sent by both user 1 and user 2 after having detected the bit '0' on the common transmission medium 5 times. The actual bit sequences of Alice and Bob look like this example for this example:

Actually sent bit sequence of participant 1:

0110101110110101

Actually sent bit sequence from participant 2:

0101000101111011

In comparison to the above, randomly and locally generated, initial bit sequences of the participants 1 and 2, the corresponding stuff bit (here: 1) was inserted at position 8. In a second preferred embodiment, it is contemplated that in some communications systems for subscribers, it may be difficult (eg, because of the use of inexpensive, simple hardware) to insert a stuff bit immediately after detecting a sequence of N equal successive bits on the transmission medium (as shown above), since both the detection of one bit and the preparation of the transmission of the next bit require some time depending on the implementation and thus a sufficiently fast reaction may not be possible. In such a case, the approach of the first exemplary embodiment can be adapted such that the insertion of a stuff bit is already prepared after the detection of N-M (1 <M <N-2) of identical successive effective bits on the shared transmission medium is, but only after the transmission of N bits from the detection of the first bit of the sequence of (at least) NM same consecutive bits is actually sent.

In a particularly robust variant, this prepared stuff bit will be sent even if, after the NM identical bits and before the transmission of the stuff bit, an (effective) bit change takes place on the common transmission medium and thus there is actually no stuffing error even without the stuff bit in this case, there would be no more than N identical bits on the transmission medium). This also leads to a valid bit sequence (without stuffing error), but in this case with a higher overhead due to the (here actually unnecessary) stuff bit.

Example (N = 5, M = 2):

First, it is assumed that the initial generated bit sequences of the participants 1 and 2 are the same as the example of the first embodiment, i.

Random, initial (locally generated) bit sequence of participant 1:

0 1 1 0 1 0 1 1 0 1 1 0 1 0 1

Random, initial (locally generated) bit sequence of participant 2: 010100001111011

010000000110001

However, upon transmission, both Alice and Bob would detect after transmission of bit 5 that N - M = 3 consecutive identical bits were formed on the shared transmission medium and then prepare to insert a stuff bit at position 8 (with the value ,1').

The actual bit sequences transmitted by Alice and Bob thus correspond (analogous to before):

Actually sent bit sequence of participant 1:

0110101110110101

Actually sent bit sequence from participant 2:

0101000101111011

This results in the bit sequence actually applied to the transmission medium: 0100000100110001

The underlined bit is again the additionally introduced stuff bit, which is inserted and transmitted by both user 1 and user 2 after having detected bit 53 'bit 53' on the common transmission medium. Again, no bit-stuffing error would occur (with N = 5) and you would have exactly the same result as in the previous example. However, both subscriber 1 and subscriber 2 would have more time to prepare for the insertion or transmission of the stuff bit.

A method for avoiding stuffing errors and / or synchronization losses according to a third preferred embodiment is the periodic enforcement of bit or edge changes independently of the actual information bits, ie independent of subscriber sequences and independently from the detected overlay sequence. This can be designed in such a way that both subscriber 1 and subscriber 2 always insert two stuff bits after the transmission of K (with K <N) information bits (= originally randomly generated bits), which when superposed result in a bit or edge change to lead. For certain communication systems such as CAN, the two stuff bits may already contain a bit change for this purpose, eg either the bit sequence '01' or '10', so that the superimposition likewise results in the bit sequences '01' or '10'. Which of these two possible cases is inserted is irrelevant in this example, as long as it is ensured that both subscriber 1 and subscriber 2 always insert the same sequence.

This embodiment leads to a relatively high overhead, but is very robust and inexpensive to implement and can also be carried out particularly well with existing standard components.

Example (N = 5, K = 4):

First, it is assumed that the initial generated bit sequences of the participants 1 and 2 are the same as in the example of the first and second embodiment, namely.

Random, initial (locally generated) bit sequence of participant 1:

011010110110101

Random, initial (locally generated) bit sequence of participant 2:

010100001111011

010000000110001

However, always after K = 4 bits, the bit sequence '01' is now inserted by both subscriber 1 and subscriber 2, independently of the information bits. The actual bit sequences of subscriber 1 and subscriber 2 to be transmitted thus result in: Actual bit sequence to be transmitted by subscriber 1:

011001101101011001101

Actual bit sequence to be transmitted by user 2:

010101000001111101011

This results in the following effective bit sequence on the common transmission medium:

010001000001011001001

Thus, even in this case no stuffing error occurs (with N = 5).

Regardless of which of the approaches described is used, the stuff bits themselves are preferably discarded at the receiver side. In particular, they are not used as a basis for the generation of a symmetric cryptographic key in order to prevent the key from being weakened by the consideration of non-random structures in the key generation.

The described embodiments of the method can also be modified in an alternative embodiment such that the fill values (stuff bits) are not given by both participants to the common transmission medium, but that only one of the two participants generates and outputs the fill values. This method has the advantage that the participants can synchronize each other via this sequence of values. For this alternative, one of the participants is preferably determined to transmit the fill values. This can be, for example, the subscriber who initiates the key generation or a (for example by configuration) predetermined subscriber. The other participant detects the fill values and can use these, for example, to gain synchronization information. In particular, based on at least one fill value, a possible time offset of his clock with the clock of the other subscriber can be detected and, based on this determined offset, a re-synchronization of his clock can be carried out. The presented methods represent an approach for the generation of symmetric, cryptographic keys between two nodes by exploiting properties of the physical layer. The approach is particularly suitable for wired and optical communication systems, provided that this 'on-off-keying' or a bitwise bus arbitration support (eg CAN, TTCAN, CAN-FD, LIN, I2C). But also in wireless, (radio based) communication systems, preferably with a very short distance between transmitter and receiver and a possible direct line of sight, the approach can be used.

In principle, all communication systems that allow a distinction between dominant and recessive bits (as described above) are suitable for use. The methods described herein can be used in a variety of wireless, wired and optical communication systems. Of particular interest is the approach described here for the machine-to-machine communication, that is for the transmission of data between different sensors, actuators, etc., which generally have only very limited resources and may not be manageable with reasonable effort manually Field can be configured.

Further application possibilities are, for example, in home and building automation, telemedicine, car-to-x systems or industrial automation technology. Of particular interest is the use in future miniature sensors with radio interface as well as in all application areas of the CAN bus, i. in particular vehicle networking or automation technology.

Claims

Method for generating a secret or a key in a network (20), wherein the network (30) has at least a first subscriber (21) and a second subscriber (22) with a common transmission channel (30) between at least the first subscriber (21). and the second user (22), wherein the first user (21) has at least a first value (1) and a second value (0) and the second user (22) has at least the first value (1) and the second value (0 ) to the transmission channel (30), wherein the first subscriber (21) a first subscriber value sequence and the second subscriber (22) cause a second subscriber value sequence for each other largely synchronous transmission on the transmission channel (30) and the first subscriber (21) Based on information about the first subscriber value sequence and on the basis of a superimposition of the first subscriber value sequence with the second subscriber value sequence on the transmission line anal (30) resulting superposition value sequence and the second subscriber (22) based on information about the second subscriber value sequence and on the basis of the superimposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel (30) resulting overlay value sequence in each case a common secret or a common Generate keys, characterized in that at certain intervals or depending on a detected overlay value sequence at least the first participant (21) outside the first subscriber value sequence or the second participant (22) outside the second subscriber value sequence at least one fill value on the transmission channel (30), so an edge change or value change takes place on the transmission channel (30).

A method according to claim 1, characterized in that only one of the first subscriber (21) and the second subscriber (22) gives the filling value to the transmission channel (30) and that the other of the first subscriber (21) and the second subscriber (22) detected the filling value.

3. The method according to claim 2, characterized in that the other participant determined based on the detected filling value synchronization information.

A method according to claim 1, characterized in that the first participant (21) at least a first filling value outside the first subscriber value sequence and the second participant (22) for this substantially synchronously at least a second filling value outside the second subscriber value sequence on the transmission channel, so that by the superposition of the at least one first filling value and of the at least one second filling value, an edge change or value change takes place on the transmission channel.

Method according to one of the preceding claims, characterized in that at least the first subscriber (21) or the second subscriber (22) give the filling value to the transmission channel (33) if at least the first subscriber (21) or the second subscriber (22 ) an overlay value sequence having a predetermined number of equal values is detected.

A method according to claim 5, characterized in that the filling value is given directly as the next value to the transmission channel (30) as soon as a superposed value sequence with a predetermined number of identical values is detected.

A method according to claim 5, characterized in that the filling value is given to the transmission channel (30) with a delay by a certain number of values, after an overlay value sequence having a predetermined number of equal values is detected.

Method according to one of claims 5 to 7, characterized in that the filling value is inverse to the detected same values.

9. The method according to claim 7, characterized in that the filling value at fixed, predetermined intervals, in particular in each case after a pre- matched number of values of the subscriber value sequences given to the channel to which transmission channel (30) is given.

10. The method according to any one of the preceding claims, characterized in that at least two fill values are given to the transmission channel (30).

11. The method according to claim 10, characterized in that the two fill values include a value change.

12. The method according to any one of the preceding claims, characterized in that on the transmission channel (30) a state corresponding to the first value (0) sets when both the first participant (21) and the second participant (22) a transmission of cause the first value (0) via the transmission channel (30), and a state corresponding to the second value (1) sets when the first user (21) or the second user (22) or both (21, 22) transmit of the second value via the transmission channel (30).

13. The method according to any one of the preceding claims, characterized in that the first subscriber value sequence in the first subscriber (21) and the second subscriber value sequence in the second subscriber (22) locally, in particular by means of a random number generator or pseudo-random generator generated.

14. The method according to any one of the preceding claims, characterized in that the at least one first filling value and the at least one second filling value for generating the shared secret or the common key are not used.

Method for generating a secret or key in a first subscriber (21) of a network (20), wherein the first subscriber (21) is set up to use (at least) a second subscriber (22) of the network via a transmission channel (30). 20) receive information and transmit information to the second party (22), wherein the first subscriber (21) is arranged to be able to give at least a first value and a second value to the transmission channel (30) and to be able to detect thereon, wherein the first subscriber (21) has a first subscriber value sequence for a transmission substantially synchronous to a transmission of a second subscriber value sequence by the second subscriber (22) on the transmission channel (30) causes and wherein the first subscriber (21) generates a secret or a key based on information about the first subscriber value sequence and on the basis of an overlay value sequence, which on the transmission channel (30) resulting from the superposition of the first subscriber value sequence with the second subscriber value sequence, characterized in that at certain intervals or depending on a detected overlay value sequence, the first subscriber (21) at least a first filling value outside the first subscriber value sequence on the transfer gskanal (30), so that an edge change or value change takes place on the transmission channel.

16. The method according to any one of the preceding claims, characterized in that the network (20) is a CAN, TTCAN, CAN-FD, LIN or l2C bus system, that the first value (1) is a recessive bus level and that the second value (0) is a dominant bus level.

17. The method according to any one of claims 1 to 15, characterized in that in the network (20) an on-off-keying amplitude shift keying is provided for data transmission.

18. Network (20) having at least a first subscriber (21) and a second subscriber (22) and a transmission channel (30) via which the first subscriber (21) can communicate with the second subscriber (22), characterized in that the network (20) comprises means to perform all the steps of a method according to any one of claims 1 to 17.

19. Device which is set up as a participant (21) on a

Network (20) perform all the steps of the method according to claim 15.

A computer program adapted to perform all the steps of one of the methods of any one of claims 1 to 17.

21. A machine-readable storage medium with a computer program stored thereon according to claim 20.