EP3298722A1

EP3298722A1 - Method for generating a secret or a key in a network

Info

Publication number: EP3298722A1
Application number: EP16721133.3A
Authority: EP
Inventors: Timo Lothspeich; Andreas Mueller
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2015-05-22
Filing date: 2016-05-02
Publication date: 2018-03-28
Also published as: DE102015220038A1; CN107836095A; WO2016188707A1; CN107836095B

Abstract

Disclosed is a method for generating a secret or a key in a network (20). The network (20) comprises at least a first subscriber (21) and a second subscriber (22) and a common transmission channel (30) between at least the first (21) and second subscribers (22). The first subscriber (21) can output at least a first value (1) and a second value (0) and the second subscriber (22) can output at least the first value (1) and the second value (0) on the transmission channel, the first subscriber (21) generating a first sequence of subscriber values and the second subscriber (22) generating a second sequence of subscriber values in order for the transmission to occur largely synchronously on the transmission channel (30); and the first subscriber (21) and the second subscriber (22) each generate a common secret or a common key, the first subscriber (21) doing so on the basis of information about the first sequence of subscriber values and on the basis of a sequence of superposed values resulting from a superposition of the second sequence of subscriber values onto the first sequence of subscriber values on the transmission channel (30), and the second subscriber (22) doing so on the basis of information about the second sequence of subscriber values and on the basis of the sequence of superposed values resulting from the superposition of the second sequence of subscriber values onto the first sequence of subscriber values on the transmission channel (30). At least the first subscriber (21) and the second subscriber (22) determine a sequence of test values in accordance with the resulting sequence of superposed values and output same on the transmission channel (30).

Description

A method for creating a secret or key in a network

The present invention relates to a method for generating a secret, cryptographic key in a network, in particular the generation of a common, secret key in two participants of the network. Also point-to-point connections are usually counted as networks and should also be addressed here with this term. The two participants communicate via a shared transmission medium. In this case, logical bit sequences (or, more generally, value sequences) are transmitted physically by means of corresponding transmission methods as signals or signal sequences. The underlying communication system may e.g. be a CAN bus. This provides for transmission of dominant and recessive bits or correspondingly dominant and recessive signals, whereby a dominant signal or bit of a participant of the network intersperses against recessive signals or bits. A state corresponding to the recessive signal adjusts itself to the transmission medium only if all participants involved provide a recessive signal for transmission or if all participants transmitting at the same time transmit a recessive signal level.

State of the art

Secure communication between different devices is becoming more and more important in an increasingly networked world and is an essential prerequisite for the acceptance and thus economic success of the corresponding applications in many areas of application. This includes various protection goals, depending on the application maintaining the confidentiality of the data to be transferred, mutual authentication of the nodes involved, or ensuring data integrity.

In order to achieve these protection goals, suitable cryptographic methods are usually used, which can generally be subdivided into two different categories: first, symmetric methods, in which the sender and receiver have the same cryptographic key, and, on the other hand, asymmetrical methods in which the sender uses the to be transferred with data the public key (that may also be known to a potential attacker) encrypted the recipient's key, but the decryption can only be done with the associated private key, which is ideally known only to the recipient.

One of the disadvantages of asymmetric methods is that they usually have a very high computational complexity. Thus, they are only conditionally for resource constrained nodes, such as e.g. Sensors, actuators, or similar, suitable, which usually have only a relatively low computing power and low memory and energy-efficient work, for example due to battery operation or the use of energy harvesting. In addition, there is often limited bandwidth available for data transmission, making the replacement of asymmetric keys with lengths of 2048 bits or even more unattractive.

For symmetric methods, however, it must be ensured that both the receiver and the transmitter have the same key. The associated key management generally represents a very demanding task. In the area of mobile telephony, for example, keys are inserted into a mobile telephone with the aid of SIM cards, and the associated network can then assign the corresponding key to the unique identifier of a SIM card. In the case of wireless LANs, on the other hand, a manual entry of the keys to be used (usually by entering a password) usually takes place when setting up a network. However, such key management quickly becomes very cumbersome and impractical if one has a very large number of nodes, for example in a sensor network or other machine-to-machine communication systems, e.g. also CAN-based vehicle networks. In addition, changing the keys to be used is often not possible or only possible with great effort.

Method for securing sensor data against tampering and ensuring transaction authentication, e.g. in a motor vehicle network, by means of common encryption methods, e.g. in the DE

102009002396 AI and in DE 102009045133 AI discloses. For some time now, the term "physical layer security" has been used to investigate and develop novel approaches that can be used to automatically generate keys for symmetric algorithms based on physical properties of the transmission channels between the nodes involved, using reciprocity and the inherent However, in the case of wired or optical systems in particular, this approach is often only suitable to a limited extent since corresponding channels usually have only a very limited temporal variability and an attacker can draw conclusions about the channel parameters between the transmitter and the receiver relatively well, for example by means of modeling Such methods for secured communication in a distributed system based on channel characteristics of the connected units are not pre-published in, for example, US Pat DE Applicants DE 10 2014 208975 AI and DE 10 2014 209042 AI described.

Methods for checksum calculation in the Controller Area Network (CAN) and CAN-FD can be found in DE 10 2011 080476 AI.

The non-prepublished DE 10 2015 207220 AI discloses a method for generating a shared secret or a secret symmetric key by means of public discussion between two communication participants.

Disclosure of the invention

The methods for generating a secret or a cryptographic key do not require any manual intervention and thus enable the automated establishment of secure communication relationships or links between two nodes. In addition, the methods have a very low complexity, in particular with regard to the required hardware design, such as the required memory resources and computing power, and they are associated with a low energy and time requirements. In addition, offer the procedures very high key generation rates with simultaneously very small probability of error.

The procedures assume that subscribers in a network communicate with each other via a communication channel. In particular, they transfer logical sequences of values (in the case of binary logic, bit sequences) with the aid of physical signals on the transmission channel. Even if possible superimpositions take place on the transmission channel through the signals, that is to say on the physical level, the logical level is considered in the description above in the foli oenden. Thus, the transferred, logical value sequences as well as their logical overlay are considered.

Subscribers of the network can thus first signals (for example, the logical bit "1" are assigned) and second signals (for example, the

If two subscribers transmit (largely) one signal sequence at a time, the subscribers can detect the resulting superimposition on the communication channel the (largely) simultaneous transmission

20 of two (independent) signals resulting signal on the communication channel in turn can be assigned to one (or more) specific logical value (or values).

In this case, the transmission must be largely synchronous in that the individual signals of a signal sequence are superimposed on the transmission medium, in particular that the signal corresponds to the nth logical value or bit of the first subscriber with the signal corresponding to the n -tenten logical value or bit of the second participant at least partially overlaid. In each case, this superimposition should be sufficient for the subcontractors to be able to record the superimposition or to determine the corresponding superimposition value.

The superimposition can be determined by arbitration mechanisms or by physical signal superposition. By arbitration mechanism is meant, for example, the case where a node applies a recessive level. would like to, but detects a dominant level on the bus and thus omits the transmission. In this case, there is no physical interference between two signals, but only the dominant signal is seen on the transmission channel.

From the resulting value sequence of the overlay and its own value sequence, the participants can then generate a key that is secret to an outside attacker. The reason for this is that the outside attacker who, for example, can hear the effective overall signals present on the shared transmission medium, only the

Overlay the value sequences looks, but does not have the information about the individual value sequences of the participants. Thus, the participants have more information that they can use against the attacker to generate a secret key.

In the context of such a method for generating a shared secret or symmetric cryptographic key by means of public discussion using PHY-layer properties, it is now to be ensured that this method does not contain any test value errors or checksum errors (eg in the context of a cyclic redundancy check). provided that the message formats used provide for the transmission of appropriate test values or checksums. For this purpose, at least one of the participating network participants transmits a test value sequence on the common communication channel - however, it does not generate this on the basis of the information (or value sequence) transmitted by it, but on the basis of the one on the connecting one

Communication channel detected overlay value sequence. Among other things, this contributes to increasing the compatibility of this key establishment method with already available standard components (hardware / software, for example CAN controllers).

In addition to avoiding test value sequence errors or checksum errors, such a method makes it possible to check whether the detected or extracted raw information for the keys to be generated is identical (with a high degree of probability) to the participants involved, so that additional overhead may be necessary for a separate check one- can be saved. The check can in particular be carried out by a participant comparing the detected test value sequence on the communication channel with the self-determined test value sequence.

The test value sequence is preferably transmitted directly after the overlay value sequence if the transmitting subscribers are able to do so. Otherwise, in an alternative embodiment, the test value sequence can also be transmitted at a predetermined distance from the overlay value sequence. This variant has the advantage that the participants have more time to calculate the test value sequence and thus have fewer requirements for the design of the participants and the method is less error-prone.

In order not to allow weakening of the common key, the check value sequence (also visible to an attacker) should preferably not be used for its generation.

Particularly advantageously, the method can be used in a network in which there is a dominant value (physically: a dominant signal) that prevails when only one subscriber applies it on the transmission channel and a recessive value (physically: a recessive signal ) which results on the transmission channel only if both or all participants transmit a recessive value. Because of the clearly defined overlay rules, the subscribers of such a network can derive from the resulting overlay sequences particularly simple information for generating the key.

The subscriber value sequences, which are given largely simultaneously by the subscribers to the transmission channel, are generated in advance in the respective subscribers themselves with the aid of a random generator or pseudo-random generator. Since the resulting overlay sequence on the transmission channel can be accessible to a potential attacker, it is particularly advantageous for the security of the subsequent communication if the attacker has as difficult as possible to infer the individual value sequences of the participants, ie if they are local in the participants as well be generated randomly or at least pseudorandomly. The methods described can be implemented particularly well in a CAN, TTCAN or CAN FD bus system. Here, a recessive bus level is replaced by a dominant bus level. The superimposition of values or signals of the subscribers thus follows defined rules which the subscribers can use to derive information from the superimposed value or signal and the value or signal transmitted by them. The methods are also well suited for other communication systems such as LIN and I2C.

Alternatively, however, the method can also be used, for example, in a network with on-off-keying amplitude shift keying. Here, too, the overlay is fixed by allowing the subscribers to be "transmission" and "no transmission" signals and the beat signal corresponding to the "transmission" signal when one or both of the subscribers transmits and corresponds to the "no transmission" signal, if both participants do not transfer.

While the method has been described for two subscribers in a network, a subscriber to a network may already have a secret

Key from a separate signal sequence and from a superposition of these are derived with the signal sequence of a second participant. A network or participant of a network is set up to do this by having electronic memory and computational resources to perform the steps of a corresponding method. On a storage medium of such

Subscriber or on the distributed memory resources of a network can also be stored a computer program that is configured to perform all the steps of a corresponding method when it is executed in the subscriber or in the network. drawings

The invention is described in more detail below with reference to the accompanying drawings and to exemplary embodiments. Show

1 schematically shows the structure of an exemplary, underlying communication system,

2 schematically shows a linear bus as an example of an underlying communication system,

3 is a schematic illustration of exemplary signal sequences of two subscribers of a network and a resulting subsequence value sequence on a transmission channel between the subscribers,

4 schematically shows the sequence of an exemplary method for generating a key between two subscribers of a network,

5 shows a CAN data telegram in the so-called base frame format and

6 shows an exemplary sequence of a comparison between the detected and calculated test value sequence.

Description of the embodiments

The present invention relates to a method for generating a shared secret or (secret) symmetric cryptographic key between two nodes of a communication system (participants of a network) communicating with each other via a shared medium (transmission channel of the network). The generation or negotiation of the cryptographic keys is based on a public data exchange between the two participants, although a possible listening third party as an attacker is not or only very difficult to draw conclusions about the generated key. It is with the invention Thus, it is possible to fully automatically and securely establish appropriate symmetric cryptographic keys between two different subscribers of a network in order to then implement specific security functions, such as data encryption. As described in detail, a common secret is first established for this, which can be used to generate the key. However, such a shared secret can in principle also be used for purposes other than cryptographic keys in the narrower sense, for example as a one-time pad.

The invention is suitable for a variety of wired or wireless as well as optical networks or communication systems, especially those in which the various participants communicate with each other via a linear bus and the media access to this bus using a bitwise bus arbitration. This principle represents, for example, the basis of the widespread CAN bus. Possible fields of application of the invention accordingly include, in particular, CAN-based vehicle networks as well as CAN-based networks in automation technology.

The present invention describes an approach with which automatically symmetric cryptographic keys can be generated in one, or in particular between two nodes of a network. This generation takes place by exploiting properties of the corresponding transfer layer. Unlike the usual approaches of "physical layer security" but not physical parameters of the transmission channel such as transmission strength are evaluated .. Rather, there is a public data exchange between the nodes involved, thanks to the characteristics of the communication system and / or the modulation method used a possible listening attacker no, or no sufficient conclusions on the negotiated key allows.

The following is an arrangement as shown in FIG. 1 in the abstract. In this case, different users 2, 3 and 4 can communicate with one another via a so-called shared transmission medium C, shared medium ") 10. In an advantageous embodiment of the invention, this corresponds to a shared one Transmission medium a linear bus (wired or optical) 30, as shown by way of example in Fig. 2. The network 20 in FIG. 2 consists of just this linear bus 30 as a shared transmission medium (for example, as a wired transmission channel), nodes 21, 22 and 23, and (optional) bus terminations 31 and 32.

In the following, communication between the various nodes 21, 22 and 23 is assumed to be characterized by the distinction between dominant and recessive values. In this example, the possible values are the bits "0" and "1". In this case, a dominant bit (e.g., the logical bit '0') may quasi supersede a concurrently transmitted recessive bit (e.g., the logical bit '1').

An example of such a transmission method is the so-called on-off-keying (on-off-keying amplitude shift keying), in which exactly two transmission states are distinguished: in the first case (value, Οη ', or "0") If a signal is transmitted, for example in the form of a simple carrier signal, in the other case (value 'Off' or '1') no signal is transmitted. The state 'η' is dominant while the state 'Off' is recessive.

Another example of a corresponding communication system that supports this distinction of dominant and recessive bits is a (wired or optical) system based on bitwise bus arbitration, such as that used in the CAN bus. The basic idea here is also that if, for example, two nodes want to transmit a signal at the same time and one node transmits a '1', whereas the second node transmits a '0' which 'gains''0' (ie the dominant bit) ie, the signal level that can be measured on the bus corresponds to a logical '0' .This mechanism is used in particular to resolve possible collisions, whereby priority messages (ie messages with a previous, dominant signal level) are transmitted by each node simultaneously monitors the signal level on the bus while transmitting its CAN identifier, if the node itself transmits a recessive bit but a dominant bit is detected on the bus, the corresponding node aborts its transmission attempt in favor of the higher priority message (with the earlier dominant bit).

The distinction between dominant and recessive bits makes it possible to interpret the shared transmission medium as a kind of binary operator that combines the various input bits (= all bits transmitted simultaneously) using a logical AND function.

FIG. 3 shows, for example, how a subscriber 1 (T1) keeps the bit sequence 0, 1, 1, 0, 1 ready for transmission between the times t0 and t5 via the transmission channel. Subscriber 2 (T2) keeps the bit sequence 0, 1, 0, 1, 1 ready for transmission between times t0 and t5 via the transmission channel. With the above-described characteristics of the communication system and assuming that the bit level "0" in this example is the dominant bit, the bit string 0, 1, 0, 0, 1 will be seen on the bus (B) Only between times t1 and t2 and between t4 and t5, both subscriber 1 (T1) and subscriber 2 (T2) provide a recessive bit "1", so that only in this case does the logical AND operation result in a bit level of " 1 "on the bus (B) results.

Taking advantage of these characteristics of the transmission method of the communication system, a key generation between two subscribers of a corresponding network can now take place in that the subscribers detect a superimposition of bit sequences of the two subscribers on the transmission medium and from this information share information about the self-transmitted bit sequence (symmetric), generate secret key.

An exemplary, particularly preferred implementation will be explained below with reference to FIG. 4.

The process for generating a symmetric key pair is started in step 41 by one of the two nodes involved in this example (subscriber 1 and subscriber 2). This can be done, for example, by sending a special message or a special message header. Both subscriber 1 and subscriber 2 initially generate a bit sequence locally (ie internally and independently of one another) in step 42. Preferably, this bit sequence is at least twice, in particular at least three times as long as the common key desired as a result of the method. The bit sequence is preferably generated in each case as a random or pseudo-random bit sequence, for example with the aid of a suitable random number generator or pseudo random number generator.

Example of local bit sequences of length 20 bits:

Generated bit sequence of participant 1:

Su = 01001101110010110010

'Generated bit sequence of subscriber 2:

S _T2 = 10010001101101001011

In a step 43, subscriber 1 and subscriber 2 transmit (largely) synchronously their respectively generated bit sequences over the divided transmission medium (using the transmission method with dominant and recessive bits, as already explained above). Different possibilities for synchronizing the corresponding transmissions are conceivable. Thus, for example, either subscriber 1 or subscriber 2 could first send a suitable synchronization message to the respective other node and then start the transmission of the actual bit sequences after a certain period of time following the complete transmission of this message. Equally, however, it is also conceivable that only one suitable message header is transmitted by one of the two nodes (eg a CAN header consisting of arbitration field and control field) and during the associated payload phase then both nodes simultaneously (largely) transmit their generated bit sequences synchronously , In a variant of the method, the bit sequences of a subscriber generated in step 42 can also be transmitted to several messages distributed in step 43, for example if this necessitates the (maximum) sizes of the corresponding messages. In this variant as well, the transmission of the corresponding number of speaking large messages distributed bit sequences of the other subscriber turn (largely) synchronously.

On the shared transmission medium, the two bit sequences then overlap, whereby due to the previously required property of the system with the distinction of dominant and recessive bits, the individual bits of subscriber 1 and subscriber 2 result in an overlay, in the example mentioned de facto AND-linked. This results in a corresponding overlay on the transmission channel, which could detect, for example, a listening third party.

Example of an overlay bit sequence for the above local bit sequences:

• Effective bit sequence on the transmission channel:

Seft = Su AND S _T2 = 00000001100000000010

Both subscriber 1 and subscriber 2 detect during the transmission of their bit sequences of step 43 in a parallel step 44, the effective (overlaid) bit sequences S _e ff on the shared transmission medium. For the example of the CAN bus, this is usually done in conventional systems during the arbitration phase anyway.

This is likewise possible for systems with "η-off-keying" (wireless, wired or optical). In this case, the practical feasibility benefits in particular from the fact that in such a system the state 'η' is dominant and the state 'Off' is recessive (as already explained above). Consequently, even without measurement, a node knows that the effective state is dominant on the shared medium if the node itself has sent a dominant bit, but if a node has sent a recessive bit, it does not know the state on the shared transmission medium first Further, however, in this case he can determine by suitable measurement how it looks like, because, in this case, the node itself does not send anything, so there are no problems with so-called self-interference, which is a complex echo cancellation, especially in the case of wireless systems would require. In a next step 45, both subscriber 1 and subscriber 2 also again (largely) synchronously transmit their initial bit sequences STI and ST2, but this time inverted. The synchronization of the corresponding transmissions can again be realized exactly in the same way as described above. On the shared communication medium, the two sequences are then ANDed together again. Subscribers 1 and 2 in turn determine the effective, superimposed bit sequences S _e ff on the shared transmission medium.

Example of the above bit sequences:

Inverted bit sequence of participant 1:

Sn = 10110010001101001101

Inverted bit sequence of participant 2:

S _T2 '= 01101110010010110100

'Effective, overlaid bit sequence on the channel:

Seff '= Sn AND S _T2 ' = 00100010000000000100

Both subscriber 1 and subscriber 2 determine during the transmission of their now inverted bit sequences then again the effective, superimposed bit sequences on the shared transmission medium. At this time, both nodes (subscriber 1 and subscriber 2), as well as a possible attacker (eg subscriber 3) who overhears the communication on the shared transmission medium, thus know the effective, superimposed bit sequences S _e ff and Seff '. In contrast to the attacker or third participant, however, participant 1 still knows his initially generated, local bit sequence STI and participant 2 his initially generated, local bit sequence ST2. However, subscriber 1 in turn does not know the initially generated, local bit sequence of subscriber 2 and subscriber 2 does not know the initially generated, local bit sequence of subscriber 1. The detection of the overlay bit sequence again takes place during the transmission in step 46.

As an alternative to this exemplary embodiment, subscriber 1 and subscriber 2 can also send their inverted, local bit sequence directly with or directly after their original, local bit sequence, ie steps 45 and 46 take steps 43 and 44. The original and the inverted bit sequences can be transmitted in a message, but also in separate messages as partial bit sequences.

In step 47, subscriber 1 and 2 now associate each local (ie internal) the effective superimposed bit sequences (S _e ff and S _e ff '), in particular egg ^¬ ner logical ODE R- function.

Example of the above bit sequences:

S _g = Seff it Seff OR '= 00100011100000000110

The individual bits in the bit sequence (Sges) resulting from the ODE R operation now indicate whether the corresponding bits of STI and ST2 are identical or different. For example, if the nth bit within S _tot is a '0', it means that the nth bit within S _{TI is} inverse to the corresponding bit within S _T2 . Similarly applies that when the n-th bit is within a Stotal, 1 ', the corresponding bits are identical ^¬ table within ŠANCE and Sßob.

Subscriber 1 and subscriber 2 then cancel in step 48, based on the bit sequence S _ges obtained from the ODE R combination, in their original, initial bit sequences S _TI and S _T2 all bits which are identical in both sequences. This consequently leads to correspondingly shortened bit sequences.

Example of the above bit sequences:

Abbreviated bit sequence of participant 1:

Su, v = 01011100101100

Abbreviated bit sequence of participant 2:

S _T2 , v = 10100011010011

The resulting, shortened bit sequences STI.V and ST2, V are now just inverse to each other. Thus, by inversion of its shortened bit sequence, one of the two subscribers can determine exactly the shortened bit sequence that already exists in the other subscriber.

The shortened bit sequence, which is present in this way in common, will now be activated locally by subscriber 1 and subscriber 2 in step 49 in a suitable manner. se prepared to generate the actually desired key of the desired length N. Again, there are a variety of ways that this treatment can be done. One possibility is to select N bits from the common truncated bit sequence, where it must be clearly defined which N bits are to be taken, eg simply by selecting the first N bits of the sequence. It is also possible to calculate a hash function via the shared, shortened bit sequence which provides a hash of length N. In general, the rendering can be done with any linear and nonlinear function that returns a N bit length bit sequence when applied to the co-present truncated bit sequence. The mechanism of key generation from the common truncated bit sequence is preferably identical in both subscribers 1 and 2 and is performed accordingly in the same way.

Following the key generation, it may still be possible to verify that the keys generated by subscribers 1 and 2 are actually identical. For this purpose, for example, a checksum could be calculated using the generated keys and exchanged between subscribers 1 and 2. If both checksums are not identical, then obviously something has failed. In this case, the described method for key generation could be repeated.

In a preferred variant of the method for generating a key, in a number of passes, a whole series of resulting shortened bit sequences, which are each present in the case of subscribers 1 and 2, can be generated, which are then combined into a single large sequence before the actual key is derived therefrom , If necessary, this can also be done adaptively. If, for example, the length of the common, shortened bit sequence is, for example, less than the desired key length N after a single pass through the described procedure, then one could, for example, generate further bits before the actual key derivation. Finally, the generated symmetric key pair can be used by subscriber 1 and subscriber 2 in conjunction with established (symmetric) cryptographic methods, such as ciphers for data encryption.

A potential attacker (eg subscriber 3) can listen to the public data transmission between subscriber 1 and subscriber 2 and thus gain knowledge of the effective, superposed bit sequences (S _e ff and S _e ff ') as described. The attacker then only knows which bits in the locally generated bit sequences of nodes 1 and 2 are identical and which are not. In addition, with the identical bits, the attacker can even determine whether it is a '1' or a '0'. For a complete knowledge of the resulting, shortened bit sequence (and thus the basis for key generation), however, he lacks the information about the non-identical bits. In order to further complicate the attacker possible attacks, is in a preferred

Variant additionally deleted in the original, locally generated bit sequences of the participants 1 and 2 identical bit values. This means that participant 3 has only information that is not used for key generation. Although he knows that correspondingly shortened bit sequences emerge from the different between the local bit sequences of the participants 1 and 2 participants bits. However, he does not know which bits have been sent by subscriber 1 and subscriber 2 respectively.

In addition to the information about the superimposed overall bit sequence, subscriber 1 and subscriber 2 also have the information about the locally generated bit sequence transmitted by them in each case. The fact that the keys generated in subscribers 1 and 2 remain secret as a basis despite the public data transmission results from this information advantage over a subscriber 3 following only the public data transmission.

In many common communication systems (eg CAN), the messages to be transmitted are provided with a checksum or check value sequence (eg Cyclic Redundancy Checksum (CRC)), with the aid of which the receiver or receivers of a message can detect possible errors during transmission. In a typical structure of such a message frame, the actual lent message a corresponding checksum or Prüfwertfolge attached, in particular appended. In general, the checksum or check value sequence results as a function of the bits to be protected. The checksum or test value sequence thus secures a part of the actual message or the complete actual message, wherein the checksum field or the field for the test value sequence itself can also be included in the determination of the checksum or test value sequence, but need not.

Especially in the case of CAN, a data telegram in the so-called base frame format is shown in FIG. The checksum field (Cyclic Redundacy Checksum or CRC) has a length of 15 bits and protects the part of the CAN frame that extends from the start of frame bit to the last data bit of the data field. Especially for the case of a cyclic redundancy check, the checksum or check value sequence (C RC) essentially corresponds to the remainder of a polynomial division of the bit sequence to be protected with a special, predetermined generator polynomial. In the case of (standard) CAN (version 2.0), this generator polynomial is specified as follows:

G (x = x ¹⁵ + x ¹⁴ + x ¹⁰ + x ⁸ + x ¹ + x ⁴ + x ³ + 1

The achievable Hamming distance is h = 6, so that a maximum of 5 bit errors can be reliably detected.

If one of the proposed methods for generating a common, secret key between two subscribers of a communication system is to be used in which checksum protection or check value protection is provided, then it can lead to corresponding checksum or check value errors when standard message types are used come, in the case of CAN z. This may then lead to the corresponding messages being rejected by the participants involved or specific error messages being sent by these or other users. Instead of introducing special new message types in addition to or in addition to the standard message types, it should be avoided, in particular for reasons of compatibility. The potential checksum errors using the described key generation methods are due to the fact that in these methods the effective bits or signal levels on the shared transmission medium in the simultaneous transmission of the first and second subscribers in step 43 depends on both subscribers , for example assuming a communication system with recessive bit, 1 'and dominant bit, 0' correspond at logical level of an AND operation of the two individual messages of the participants. Since in this case the logical AND connection of two checksums or test value sequences (eg CRCs) does not correspond to the correct checksum or test value sequence of the logical AND operation of the bit sequences underlying these checksums or test value sequences, the verification of the checksum field or of the The effective message check value field on the shared transmission medium will fail on a regular basis. This in turn can occur in certain communication systems when using standard hardware or

Software can be problematic, for example for the following reasons:

1) Both subscriber 1 and subscriber 2 could, depending on the communication system, possibly directly discard the effective message that results from the superimposition of the respectively transmitted individual messages on the shared transmission medium due to the faulty checksum or check value sequence, without the content evaluate. This would then make a key statement impossible according to the methods described. This case is particularly critical if the participants use standard components and frames with incorrect checksums or Prüfwertfolgen are immediately discarded by the hardware or low-level software, without a transfer and analysis of the content is done to downstream software or hardware components if necessary, implementing the actual functionality of the described methods for generating a key (eg in the case of a pure software solution).

2) Other subscribers not directly involved in the key establishment could also detect that an invalid frame is being transmitted via the shared transmission medium (in the sense of a frame with unobstructed transmission medium). Consequently, depending on the communication system, send a special error message to all subscribers in order to indicate this to the other subscribers and, if appropriate, to abort the transmission of further messages or sub-items. Consequently, this case would be relevant even if subscribers 1 and 2 have special hardware or software components which, in the case of key establishment, also cope with a violation of the checksum or check value sequence of the effective messages on the shared transmission medium, but the other subscribers Not. In this case too, the sensible use of the described methods for generating the key would not be possible or would only be possible to a very limited extent.

In order to avoid this, but nevertheless to be as far as possible compatible with already available transceivers and controllers, an approach is proposed below that extends the described methods such that checksum or test value errors are prevented and thus the compatibility of these key establishment methods already today available systems and standard components (eg CAN) increased. In addition, this enhancement can also be used to ensure that the raw information for the keys to be generated is highly likely to be identical among the participants involved, so that additional overhead can be saved for a separate check.

It is proposed that subscriber 1 and subscriber 2 do not separately calculate (and transmit) a checksum or test value sequence for the locally generated and transmitted bit sequences, but first transmit the actual bit sequences synchronously and the thereby adjusting effective signal levels (= effective bits) determine the shared transmission medium. This must be done in the context of step 44 anyway. Then, each participant determines the matching bit sequence for the resulting effective bit sequence

Checksum or Prüfwertfolge and then transfer them again in a field provided. In the case of CAN (see FIG. 5), the locally generated (and generally different) bit sequences could be transmitted simultaneously, for example, using the 'data field', and the CRC field would then be dynamically linked to the test field. sum or test value sequence are transmitted, participants 1 and 2 have each determined based on the effective present on the CAN bus bit sequence. In the further description, the term checksum is used as an example of a test value sequence.

Example:

Random, initial bit sequence of participant 1:

011010110110101

Random, initial bit sequence of participant 2:

010100001111011

It is assumed that the checksum consists of 2 bits, the first bit corresponding to the parity of all the odd digits of a bit sequence (ie bits 1, 3, 5, ....) and the second bit corresponding to the parity of all even digits of a bit sequence (ie bits 2, 4, 6, ...).

For the above numerical example one would thus obtain as local checksums for the local bit sequences of the participants:

Checksum of the bit sequence of subscriber 1: 01

Checksum of the bit sequence of user 2: 11

If these checksums were simply appended to the associated random bit sequences by the participants, the following messages would be obtained (the checksum bits are underlined in each case):

Bit sequence of subscriber 1 including checksum:

01101011011010101

Bit sequence of participant 2 including checksum:

01010000111101111 The effective bit sequence on the transmission medium in the case of logical ANDing of the individual messages would then look like this:

01000000011000101

The effective checksum bits are underlined again. If, on the other hand, one were to separately determine the correct checksum for the effective bit sequence (without checksum), one would obtain the sequence '00', which obviously does not equal the underlined values '01'. As previously described, this could then result in the effective bit sequence being discarded on the transmission medium and / or some subscribers sending a special error message due to the violated checksum.

With the proposed method for checksum calculation, however, subscriber 1 and subscriber 2 first determine or detect the effective bit sequence on the transmission channel (ie the pure information part of the above message without the underlined check bits). For this effective bit sequence, they then determine the correct checksum and append it directly to the effective bit sequence (ie the information part of the message). In this case follows:

Actually sent bit sequence of participant 1, including checksum (underlined):

01101011011010100

Actually sent bit sequence of participant 2, including checksum (underlined):

01010000111101100

Effective bit sequence on the medium, including checksum (underlined):

01000000011000100

The checksums of the individual messages of the participants 1 and 2 thus seem wrong initially when sending, as long as they refer to the corresponding individual messages. But you get as a superposition of the checksums on the transmission medium, a correct checksum for effectively on the shared transmission medium training message so that it is discarded by any participant and also no error message is generated. With this procedure, the messages actually sent (including checksums) of the users 1 and 2 are no longer necessarily inverse to each other since the checksum of an inverted bit sequence does not necessarily correspond to the inverse checksum of the non-inverted bit sequence.

In step 44 according to the methods presented above, both subscriber 1 and subscriber 2 each determine the effective bit sequence on the shared transmission medium. The values determined in this case then form the basis for the generation of the actual, symmetrical cryptographic keys. If subscribers 1 and 2 detect different effective bit sequences (eg due to quantization or transmission errors), then the downstream derivative of the actual symmetric key fails because the underlying raw information is not identical. In a practical system, therefore, it should be advantageously checked whether such errors occurred and thus the derived keys are really symmetrical. This can also be done to some extent by the proposed method of checksum generation.

To do this, both participants verify that the checksums sent appended to the actual local bit strings match those that effectively build on the channel-forming checksums. That is, if user 1, for example, determines the checksum '0 1' based on the information bit sequence effectively being formed on the common transmission medium and transmits it immediately following that information bit sequence, that checksum should also be effectively formed on the transmission medium. This is not the case in particular if subscriber 1 transmits a recessive bit at one or more locations while Bob transmits a dominant bit at at least one of the locations and vice versa. If this condition is not met, this means with high probability that subscriber 1 and subscriber 2 have detected different information bit sequences (since a miscalculation or incorrect transmission of the checksums or a misdetection of the relatively short effective checksum compared to the message is less likely Sources of error are). In this

In this case, the key establishment process should either be aborted or restarted, or a so-called "information reconciliation" phase should be added, which can be used to correct any errors that might exist.An example of a corresponding "information reconciliation" protocol is this known from quantum cryptography CASCADE protocol.

On the other hand, if the above condition is met, then it implies that Alice and Bob were most likely to have detected the same information bit sequences. In the general case, however, this probability is never 100%, since there is always a residual probability that despite possible bit errors in the

Information bit sequence receives the same checksum. However, this residual error probability can, depending on the system design, in most cases become negligibly small. In a second, modified embodiment of checksum protection, only one of the participating subscribers 1 and 2 transmits the checksum for the channel sequence that effectively forms on the channel in the part of the message frame used for this purpose. In order to determine which of the participants involved is to do so, different options are again possible. For example, this could always be the one who initiated or did not initiate the key establishment, or it could be preconfigured.

If only the transmission of the checksum to a subscriber is limited, but both users 1 and 2 determine or calculate the checksum, then the previously described residual error probability that subscriber 1 and subscriber 2 have detected different information bit sequences, but not on the checksum can be further reduced for certain transmission systems. If, for example, both participants transmit the effective checksum on a CAN bus following the actual information part, they can only determine whether the other participant in an a particular location transmits a different checksum bit than itself if they themselves transmit a recessive bit. With the modification described, however, one of the participants sends the checksum determined by him while the other participant can completely detect this checksum and then compare it with the locally determined (but not transmitted) checksum. If both of them do not match, then in this case the second participant would have to start a corresponding error handling since in this case the first participant initially has no possibility of detecting a possible error himself.

In some communications systems, or with some hardware or software components, a subscriber may not be able to determine the checksum fast enough based on the information bit sequence that effectively builds on the shared transmission medium to be able to detect it quickly Connection to transfer. Possible reasons for this are, in particular, processing latencies in a subscriber. Therefore, it is possible to modify the method according to the invention as in the following third exemplary embodiment such that a time interval is provided between the propagation of the effective information bit sequence on which the checksums are based and the transmission of the checksums in order to obtain the checksum available To increase time.

After the synchronous transmission of the locally generated, random information bit sequences of the subscribers 1 and 2, a few additional bits may be transmitted by both subscribers, e.g. previously set appropriately (e.g., a fixed bit sequence could always be used). In contrast to the actual information bit sequences, these additional bits must be identical in the largely synchronous transmissions of the two subscribers. The number of additional bits to be inserted depends on the additional time required to determine the checksum.

As before, both participants will now always determine the information bit sequences that effectively form on the channel. Since the subsequently to be transmitted additional bits are known to the two participants know Both participants already after the transmission of the actual information bit sequences the complete message on which the checksum should be based (ie consisting of information bits and additional bits) and thus can already begin with the calculation of the checksum for this complete message, while still the additional bits are transmitted.

Following the transmission of the additional bits, the calculation of the checksum should then be completed so that it can be transmitted directly by both or one of the subscribers (corresponding to the first or the second embodiment).

A disadvantage of this embodiment is that with the additional bits, an additional overhead is generated. But just as described, the latency requirements for the signal processing of the involved participants can be reduced.

For further processing as part of the generation or establishment of the key, the checksums are no longer considered, but simply rejected or cut off at the receiving end.

The presented methods represent an approach for the generation of symmetric, cryptographic keys between two nodes by exploiting properties of the physical layer. The approach is particularly suitable for wired and optical communication systems, provided these 'on-off-keying' or a bitwise bus arbitration support (eg CAN, TTCAN, CAN-FD, LIN, I2C). But also in wireless, (radio based) communication systems, preferably with a very short distance between transmitter and receiver and a possible direct line of sight, the approach can be used.

In principle, all communication systems that allow a distinction between dominant and recessive bits (as described above) are suitable for use. The methods described herein can be used in a variety of wireless, wired and optical communication systems. Particularly interesting is the described This is for the machine-to-machine communication, ie for the transfer of data between different sensors, actuators, etc., which generally have only very limited resources and may not be manually configured in the field with reasonable effort.

Further application possibilities are, for example, in home and building automation, telemedicine, car-to-x systems or industrial automation technology. Of particular interest is the use in future miniature sensors with radio interface as well as in all application areas of the CAN bus, i. in particular vehicle networking or automation technology.

As described above, the checksums can be used by the network subscribers to check that the same information bit sequence has been detected on the transmission channel (which is the prerequisite for the secure establishment of a shared cryptographic secret). However, this does not ensure that both network participants involved in each scenario are equally able to recognize the deviation from the individually determined test value to the test value read back from the transmission channel. In particular, it may happen that one of the network participants involved detects a deviation, but the other does not. Therefore, the start of a corresponding error handling is proposed for these cases. FIG. 6 shows an exemplary overall sequence of a method for generating a secret on the basis of a value sequence overlay and for checking the detected value sequence overlay on the basis of a detected test value sequence. In a first step 61, the method is started. In a second step

62, the steps for establishing a cryptographic secret, in particular the (largely) synchronous superposition of value sequences by the two network subscribers and the safeguarding of the transmission by a test value sequence as described above, take place. In a third step 63, by at least one of the participating network subscribers nal resulting test value sequence detected. In a fourth step 64, the detected test value sequence is compared with a self-calculated (and possibly transmitted) test value sequence and checked for conformity.

If the detected and the self-calculated test value sequence match, then branching is made from step 64 to step 65 and the method for checking the overlay value sequence based on test values is ended without a detected error. An error handling can nevertheless occur in this case, provided that the other network participant detects a deviation and triggers the error handling accordingly.

If the detected and the self-calculated test value sequence do not match, a branch is made from step 64 to step 66. In step 66, the checking network subscriber sends an error message, in particular he notifies the second, also involved network subscriber.

If both network participants detect a deviation, both can send a corresponding message (sequential or possibly superimposed) or only the node that sends them first.

Depending on the configuration, the method can then be branched from step 66 in step 65 and thus terminated or branched in step 67. Step 67 corresponds to a waiting time after which the process can be restarted by branching to step 61.

In the following, the step 66, the notification of the respective communication partner, will be highlighted. By communicating the non-conformity of the detected with the calculated test value both communication partners have the same level of knowledge and can dispense in particular with a use of the established (supposedly) shared secret or cryptographic key.

The network participant who has determined the non-conformity by checking the Prüfwertfolgen, this has various ways to inform the second network participant. In a first preferred embodiment, the checking network subscriber sends a signal for this purpose-via the same communication system or another physical transmission path. For example, immediately after detecting the deviation, the checking network subscriber may begin to send a physical signal which is recognized by the participating communication partner (the second network subscriber) and signals the deviation. The detection of the physical signal may be based on the fact that it deliberately violates the specified frame format of the communication protocol used. In a CAN network, for example, an error frame (error frame) can be sent.

Alternatively, the checking network subscriber can also (again via the transmission channel also used for the synchronous transmission of the value sequences or another communication system) send a dedicated message to the second network subscriber. The message may include the check value calculated by the checking network subscriber and / or the check value received or detected by him on the transmission channel. If possible, it is possible to send the result (X) of a function, for example a hash function, which depends on the test value (s): X = f (CRCc _a icuiated, CRCR _eC eived). If the information about calculated and / or detected test value sequences is also transmitted, then it is possible for the communication partner to check whether the test value sequences calculated by the two network subscribers actually differ. If not, the second network participant could work towards the established secret despite the negative check by the first one

Network participants to use. (This case may occur, for example, if the comparison of the detected and calculated test value sequence by the first network subscriber or his detection of the transmitted test value sequence were incorrect.)

The message may also be provided as part of a message and, if appropriate, by intentionally not transmitting a designated signal, message or part of a message. An automatic restart can also be initiated after a certain time has elapsed by the checking network subscriber. In a further alternative embodiment, the checking network subscriber can also use a communication confirmation provided according to the communication protocol used for the message to the second network subscriber. For example, he may refrain from sending an acknowledgment (acknowledgment) or transmit a negative acknowledgment (negative acknowledgment), thus indicating that the comparison or checking of the test value sequences has been negative. In the case of a CAN network, for example, the checking network subscriber may refrain from sending a dominant acknowledgment bit. However, this method only leads to the desired success if there is no further active CAN node in the network.

Depending on the characteristic of the communication system used, it may be advantageous to send the signal used for the message or the message used for this purpose either directly after detection of the deviation or to delay the transmission suitably. In particular, the delay can occur until the beginning of the next bit time. Alternatively, a delay can be provided even after the complete reception of the test value sequence. In this way, the network participants can check in a further step whether the calculated

Actually distinguish test value sequences or possibly a transmission error occurred during the test value transmission.

Claims

claims

A method of generating a secret or key in a network (20), wherein the network (20) comprises at least a first party (21) and a second party (22) having a common one

Transmission channel (30) between at least the first participant (21) and the second participant (22), wherein the first participant (21) at least a first value (1) and a second value (0) and the second participant (22) at least the first value (1) and the second value (0) on the transmission channel (30), wherein the first participant

(21) a first subscriber value sequence and the second subscriber (22) cause a second subscriber value sequence for each other largely synchronous transmission on the transmission channel (30) and wherein the first subscriber (21) based on information about the first subscriber value sequence and based on one of a Superposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel (30) resulting superimposed value sequence and the second subscriber (22) based on information about the second subscriber value sequence and on the basis of the superposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel (30) each generate a shared secret or a common key, characterized in that at least the first participant (21) or the second participant (22) a Prüfwertfolge depending on the resulting overlay determined value sequence and on the transmission channel (30).

2. The method of claim 1, wherein the check value sequence is transmitted after the overlay value sequence.

3. The method of claim 2, wherein the Prüfwertfolge is transmitted directly after the overlay value sequence.

4. The method of claim 2, wherein the test value sequence is transmitted at a distance to the overlay value sequence.

5. The method according to claim 4, wherein the first subscriber (21) and the second subscriber (22) transmit a specific additional value sequence between the superposition value sequence and the test value sequence, the additional value sequence being taken into account in the determination of the test value sequence.

6. The method according to claim 1, wherein the first user and the second user determine the test value sequence and transmit to the transmission channel and wherein the first user or the second user or the first user Participants (21) and the second participant (22) check the resulting overlay of the respective Prüfwertfolgen based on the self-transmitted Prüfwertfolge then whether the Prüfwertfolge the first participant (21) with the Prüfwertfolge the second participant (22) matches.

7. The method according to any one of claims 1 to 5, characterized in that the first participant (21) or the second participant (22) check whether a detected, transmitted Prüfwertfolge coincides with a self-calculated Prüfwertfolge, and in the case of a mismatch each other participants (21, 22) informed about the mismatch, in particular via a signal or a message or a part of a message.

8. The method according to any one of claims 1 to 3, wherein only a specific subscriber from the first subscriber (21) and the second subscriber (22) the Prüfwertfolge on the transmission channel (30).

The method of claim 4, wherein the particular subscriber is the one initiating the key generation or a subscriber designated by configuration.

10. The method according to claim 1, characterized in that on the transmission channel, a state corresponding to the first value (1) sets when both the first participant (21) and the second participant (22) a transmission of the first value (1) cause over the transmission channel (30), and a state corresponding to the second value (0) sets, if the first subscriber (21) or the second subscriber (22) or if both the first subscriber (21) and the second subscriber (22) cause a transmission of the second value (0) via the transmission channel (30).

11. The method according to any one of the preceding claims, characterized in that the first subscriber value sequence in the first subscriber (21) and the second subscriber value sequence in the second subscriber (22) locally, in particular by means of a random number generator or pseudo-random generator generated.

12. The method according to any one of the preceding claims, characterized in that the network (20) is a CAN, TTCAN, CAN FD, LIN or I2C bus system, that the first value (1) is a recessive bus level and that the second value (0) is a dominant bus level.

13. The method according to any one of claims 1 to 11, characterized in that in the network (20) an on-off-keying Amplumestenumtastung is provided for data transmission.

14. The method according to any one of the preceding claims, characterized in that the test value sequence for generating the shared secret or the common key is not used.

15. A method for generating a key in a first subscriber (21) of a network (20), wherein the first subscriber (21) is arranged to transmit via a transmission channel (30) from at least one second subscriber (22) of the network (20). Receiving information and transmitting information to the second subscriber (22), wherein the first subscriber (21) is arranged to give at least a first value (1) and a second value (0) to the transmission channel (30) and to be able to detect thereon, wherein the first subscriber (21) initiates a first subscriber value sequence for a transmission substantially synchronous with a transmission of a second subscriber value sequence by the second subscriber (22) on the transmission channel (30) and the first subscriber (21) Secret or a key generated on the basis of information about the first subscriber value sequence and on the basis of an overlay value sequence, which results on the transmission channel (30) from the superposition of the first subscriber value sequence with the second subscriber value sequence, characterized in that at least the first subscriber (21) a Determines the test value sequence depending on the resulting overlay value sequence and gives it to the transmission channel (30).

16. Network (20) having at least a first subscriber (21) and a second subscriber (22) and a transmission channel (30) via which the first subscriber (21) can communicate with the second subscriber (22), characterized in that the network (20) comprises means to perform all the steps of a method according to any one of claims 1 to 15.

17. Device which is set up to perform all the steps of the method according to claim 15 as a participant in a network (20).

18. Computer program, which is adapted to perform all the steps of one of the methods according to one of claims 1 to 15.

19. A machine-readable storage medium with a computer program stored thereon according to claim 18.