EP4062615A1

EP4062615A1 - Method for secure data communication in a computer network

Info

Publication number: EP4062615A1
Application number: EP20807450.0A
Authority: EP
Inventors: Claudio COLOMBANO
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2019-11-21
Filing date: 2020-11-20
Publication date: 2022-09-28
Also published as: BR112022009812A2; US20220407848A1; CN114747178A; AU2020385641A1; WO2021099561A1

Abstract

A method is described for communicating data in a computer network (15) between a first computer (13) and a second computer (27), more particularly in a passenger transport system (1), and a computer network (15) configured to carry out this method. The first computer (13) and the second computer (27) are accommodated together in a room (35) protected against unauthorised access. The first computer (13) and the second computer (27) are connected to one another by a first and a second data connection (17, 29). The second data connection (29) runs only within the protected room (35) and permits only a transfer of data between the first computer (13) and the second computer (27). The method comprises at least the following steps: Generating, by the first computer (13), authentication data and transferring the authentication data from the first computer (13) to the second computer (27) via the second data connection (29). (Fig. 1)

Description

PROCEDURE FOR SECURE DATA COMMUNICATION IN A COMPUTER NETWORK

description

The present invention relates to a method for communicating data in a computer network and to a computer network configured to carry out this method, in particular in a passenger transport system.

Computers, which are often referred to as computers, are used in a wide variety of applications for processing data. In a wide range of applications, computers must be able to exchange data with other computers. For this purpose, several computers are connected to a computer network via data connections.

In many applications it must be ensured that data is only exchanged between computers that are authorized for such a data exchange. Computers that are not authorized for such a data exchange should not be able to exchange data with other computers in the computer network or intercept a data exchange between authorized computers.

For this purpose, when data is communicated in a computer network, the authenticity of computers participating in the data communication is usually checked in advance. For this purpose, the computers that strive for data communication can exchange authentication data. After checking the authenticity of the communicating computers, a previously created list can be used, for example, to check whether the authenticated computers are authorized to communicate with one another.

In some cases, data communication between computers is also encrypted. In other words, data to be communicated is encrypted by a sending computer using previously specified encryption data before they are transmitted to a receiving computer, and then decrypted again by the receiving computer using correlating encryption data. For example, the sending computer can encrypt the data to be transmitted with a public key of the receiving computer so that the latter can then decrypt the received data again with its private key, which is to be kept secret and which correlates with the public key. Because both computers use correlating encryption data, the authenticity or authorization of the communicating computers is also checked indirectly.

In the described type of communication of data between computers in a computer network, it must be ensured that authentication data or encryption data have been exchanged or made known between the computers in advance. It must also be ensured that these authentication data or encryption data are only known to the computers involved, but cannot be read, intercepted or otherwise determined by other computers.

In order to be able to meet the requirements mentioned, a considerable effort has to be made conventionally with computer networks in order to be able to ensure on the one hand that authorized computers can appropriately exchange authentication data and can then enter into data communication with one another, but on the other hand to be able to exclude that unauthorized computers can determine or listen to authentication data on their own in order to then be able to enter into data communication without authorization.

In conventional approaches, it is assumed, for example, that all authentication data of participants in a computer network are different from one another and sufficiently complex that they cannot be determined randomly or through targeted reverse engineering. Authentication data can be determined for each computer when it is produced and stored in the computer. However, this may require access to a certified authority computer that is responsible for generating such authentication data. This can be additional complex Infrastructure are needed. In addition, there can be a risk that the certified authority computer is eavesdropped, for example through data leaks, so that unauthorized third parties can gain access to authentication data. Data leaks can be difficult to detect and / or fix. In particular, data leaks can mean that authentication data that have already been created for a large number of computers have to be replaced by new authentication data, which is a costly process. In order to increase data security, provision can also be made for the authentication data to have a time-limited validity. However, this may require that after this validity has expired, new authentication data must be transmitted to the computers, which in turn may require a data connection between the computers and the authority computer.

Among other things, there may be a need for a method for communicating data in a computer network with which at least some of the deficits mentioned at the outset, as they occur in the conventional operation of computer networks, can be overcome. In particular, there may be a need for a method for communicating data in a computer network which can be implemented easily and / or with little hardware expenditure and which nevertheless allows a high level of security in data communication. Furthermore, there may be a need for a computer network that is configured to carry out or control such a method. Finally, there may be a need for a passenger transport system that is equipped with such a computer network.

Such a need can be met by the subject matter according to one of the independent claims. Advantageous embodiments are defined in the dependent claims and the description below.

According to a first aspect of the invention, a method for communicating data in a computer network between a first computer and a second computer, in particular in a passenger transport system, is proposed. The first computer and the second computer are accommodated together in a room protected against unauthorized access. The first computer and the second computer are also connected to one another via a first and a second data connection. The second data connection runs exclusively within the protected area. Furthermore, the second data connection only allows data to be transmitted between the first computer and the second computer. The method comprises at least the following method steps, preferably in the specified order:

Generation of authentication data by the first computer, these authentication data containing at least one key to be kept secret; Transmission of the key to be kept secret from the first computer to the second computer via the second data connection; and

Establishing an encrypted data communication for transmitting data via the first data connection and checking the authenticity of the second computer by the first computer based on the authentication data.

According to a second aspect of the invention, a computer network with a first computer and a second computer, in particular in a passenger transport system, is proposed. The first computer and the second computer are accommodated together in a room protected against unauthorized access. The first computer and the second computer are connected to one another via a first and a second data connection. The second data connection runs exclusively within the protected area. Furthermore, the second data connection only allows data to be transmitted between the first computer and the second computer. The computer network is configured to carry out or control the method according to an embodiment of the first aspect of the invention.

According to a third aspect of the invention, a passenger transportation system, in particular an elevator system, with a computer network according to an embodiment of the second aspect of the invention is proposed, the protected space being a machine room of the passenger transportation system.

Possible features and advantages of embodiments of the invention can be viewed, inter alia and without restricting the invention, as being based on the ideas and findings described below.

As already mentioned in the introduction, several computers must be reliably and securely connected to one another via a data network in a wide variety of technical applications communicate, ie exchange data, can. In many cases, it must be ensured that individual computers only communicate with certain other computers, but do not transmit data to computers that are not authorized for this purpose and / or accept data from computers that are not authorized for this purpose. For this purpose, computers must be able to authenticate, ie a computer must be able to reliably determine the identity of another computer coming into question as a communication partner and, on the basis of the identified identity, determine whether data exchange with this computer is permissible.

In this context, a first computer and a second computer can be part of a computer network made up of a large number of computers. The first computer can, for example, be a host computer or server computer and the second computer can be a client computer from a plurality of client computers included in the computer network. All these computers can be connected to one another via one or more data connections, i.e. in principle they can be able to exchange data with one another via wired or wireless interfaces.

So that the first computer can exchange data reliably and discretely with the second computer, it must be ensured that no other computer on the computer network can eavesdrop on the data communication between the first and the second computer and that no other computer can intercept the first computer other than the second computer can output.

To this end, it must generally be ensured that the second computer can authenticate itself to the first computer so that the first computer can be certain of the identity of the second computer and can then determine, based on the identity established in this way, whether there is data communication with the second computer is permissible, ie whether the second computer is authorized to exchange data with the first computer.

In order to be able to meet the requirements mentioned at least in certain application cases, a specially designed method for communicating data via a data network between a first computer and a second computer and a computer network designed to carry out this method are presented.

A prerequisite for the functioning of the method presented here is that the first computer and the second computer are accommodated together in a room protected against unauthorized access, i.e. are in the immediate vicinity of one another. Such a room can be understood as a physically delimited area, to which normally only persons authorized for this have access. Such a room can, for example, be a volume in a building or structure surrounded by walls or other physical boundaries, to which access is only possible via one or more lockable doors or the like. In order to get into the protected space through such a door, a person must be authorized beforehand, for example by being in possession of a key suitable for unlocking the door. It can thus be assumed with a very high degree of probability that only persons authorized for this purpose can gain access to the first and second computers accommodated in the interior of the protected space. Such a person can, for example, be a technician who is tasked with installing, configuring or maintaining these computers.

In the specific application in which the first and second computers are part of a computer network of a passenger transport system such as an elevator system, an escalator or a moving walk, the room protected against unauthorized access can be, for example, a machine room of the passenger transport system.

Such a machine room can typically be locked and thus secured against unauthorized access. Typically, both a drive machine and a controller used to control this drive machine are accommodated in a machine room. In modern passenger transport systems, this control usually has a computer that can be viewed as the first computer or host computer. This first computer can communicate with a large number of other computers, which in certain cases can be viewed here as second computers or client computers. Some of these computers can be located within the Machine room are located, other computers can be arranged outside the machine room.

As an example of a second computer that is arranged within the machine room, a computer can be viewed, for example, which should be able to communicate with the first computer for maintenance purposes or for troubleshooting and for this purpose should be able to exchange data with the first computer. The second computer can be permanently installed in the protected space. Alternatively, the second computer can be temporarily brought into the protected space, for example by a maintenance technician temporarily bringing a maintenance device controlled by the second computer into the machine room.

The first and the second computer should be connected to one another both via a first data connection and via a second data connection. Via each of the two data connections, data can be exchanged between the two computers from the first computer to the second computer and / or from the second computer to the first computer.

Each of the two data connections can be designed physically in different ways. A data connection can be established by wire, i.e. data can be transmitted between the two computers via devices and / or cables connecting the computers. Alternatively, a data connection can be established wirelessly, i.e. data can be transmitted between the two computers via radio, for example.

It is essential that the second data connection runs exclusively within the protected area. In other words, the second data connection should only be able to be implemented when both the first computer and the second computer are located within the protected area. In yet other words, the second data connection should neither be able to be established from outside the protected area nor can it be eavesdropped from outside the protected area. In the communication method proposed here, authentication data should first be generated by the first computer, by means of which the second computer can authenticate itself on the first computer. The authentication data contain at least one key to be kept secret. The key to be kept secret is transmitted from the first computer to the second computer via the second data connection. The key to be kept secret can, for example, be part of a key pair made up of a public key and a private key correlating with it. In particular, the key to be kept secret can be the private key of such a key pair.

However, the first computer does not send the key of this authentication data, which is to be kept secret, to the second computer via the first data connection, but rather via the second data connection. In this way, the first computer can be sure that the secret key of the authentication data has been sent to a computer that is located within the protected area. The first computer can therefore assume that the second computer receiving the key to be kept secret is authorized to exchange data with the first computer, since otherwise it would not have been allowed to enter the protected area. The first computer can also assume that the secret key can only be known to a second computer that is authorized for communication with the first computer.

After the second computer has received at least the key to be kept secret, encrypted data communication is established between the first and the second computer, the authentication data being used at least for the authentication of the second computer by the first computer. .

However, this data communication is not established via the second data connection, but via the first data connection, via which the first computer is also connected to other computers and which generally has different data transmission properties than the second data connection.

The first computer can thus check the authenticity of the second computer within the framework of the encrypted data communication established. The method described and the computer network specially designed for this purpose can ensure that data communication required for certain applications can only be established from the first computer with computers that are authorized for this purpose and that are located within the protected area. The data communication protected in this way can be set up with very simple hardware means.

According to one embodiment, the first data connection is configured for data communication at a higher data transmission rate than the second data connection.

In other words, due to its physical configuration and / or the hardware and software used for it, the first data connection can be designed to transmit data at a higher transmission rate than the second data connection. The first data connection can thus be designed for a larger bandwidth than the second data connection. For example, the data transmission rate to be established via the first data connection can be more than twice as high, preferably more than ten times as high, as that of the second data connection. While the first data connection can thus be designed for a high data throughput, the second data connection can be established with technically simpler means, since it only needs to enable a low transmission rate.

According to one embodiment, the first data connection is also accessible to subscribers in the computer network who are located outside the protected area.

In other words, the first data connection can be configured in such a way that it can also be used to communicate with the first computer via computers that are not located within the protected space, but are external to it. For example, the first data connection can be part of a local network (LAN - local area network), a wide network (WAN - wide area network) or even a global data network such as the Internet, via which a large number of computers inside and outside the protected space can communicate with each other. According to one embodiment, the first data connection can be an Ethernet connection.

Ethernet connections are a long-established and largely standardized option for data transmission between several computers. Ethernet connections use software in the form of protocols, etc., and hardware in the form of cables, distributors, network cards, etc., which are specified for wired data networks and which are originally for local area networks (LAN). They enable data to be exchanged between the devices connected in a local network using data frames. Transmission rates of up to 400 gigabit / s are currently possible. In its original form, a data network established with Ethernet connections typically extends over a building, but Ethernet variants over fiber optics can have a range of up to 70 km.

According to one embodiment, the second data connection can only allow data to be transmitted between the first computer and the second computer.

The second data connection can thus differ from the first data connection, which in principle can allow data to be transmitted between the first computer and a large number of other computers. The second data connection can thus ensure that only data can be exchanged via it between the first and the second computer, but not with other computers.

According to one embodiment, the second data connection can be a wired data connection.

Such a wired data connection can use one or more cables which run between the first and the second computer and via which these two computers can exclusively exchange data. On the one hand, a wired data connection can be established in a technically simple manner by, for example, plugging a data cable with its plugs into one of the computers at opposite ends. The data cable establishing the data connection can be used shielded so that data transmitted via the data cable cannot be intercepted from outside. Thus, the data transmission takes place via such a wired data connection exclusively between the two first and second computers arranged in the protected space and can neither be manipulated nor eavesdropped from outside the protected space.

According to one embodiment, the second data connection can be a serial data connection.

A serial data connection enables data to be transmitted sequentially between communication partners, for example in the form of individual bits. Such a serial data connection can be established with very simple technical means, for example with a single wire or cable, which can optionally be shielded.

According to one embodiment, the second data connection can be a unidirectional data connection.

A unidirectional data connection, which is sometimes also referred to as a monodirectional data connection, can be understood to mean a data connection which allows data transmission only in one direction, but not in the opposite direction. While a cable can typically not only transmit data unidirectionally, the interfaces to be provided on the first and second computers, which are connected to the cable and which are part of the data connection, can very well be designed for such unidirectional data communication. For this purpose, for example, the interface provided on the first computer can only be configured to send data but not receive it, whereas the interface provided on the second computer can only be configured to receive data, but not to send it. With the help of such a unidirectional data connection, a particularly confidential data transmission can be established. In particular, according to a specific embodiment, only a transmission of data from the first computer to the second computer can be made possible via the second data connection.

By using such a unidirectional data connection for the second data connection between the first computer and the second computer, it can be ensured that data that are to be kept secret, such as authentication data, can be sent from the first computer to the second computer in the opposite direction but neither the second computer nor any other computer can transmit data to the first computer. This makes it possible to improve the security of the data communication and, in particular, to reduce the risk of manipulation on the first computer.

According to one embodiment, the key to be kept secret is formed by a key for symmetrical data encryption, the key being stored on the first computer as well as on the second computer.

In other words, according to this embodiment, the data communication to be established between the first and the second computer is symmetrical encryption

According to one embodiment, the key to be kept secret is formed by a private key of the second computer. When the authentication data is generated by the first computer, a public key corresponding to the private key is generated by the first computer. In this case, the authentication data include at least the private key and the public key.

In other words, authentication data can include a key pair with a private and a public key, the private key being transmitted from the first computer to the second computer via the second data connection

According to one embodiment, the public key is stored on the first computer in a list of authorized keys. In other words, it becomes public The key of the second computer is stored on the first computer in such a way that it can be recognized as trustworthy at a later point in time

In other words, the public key, which is part of a key pair serving as authentication data and which is generated by the first computer itself and then stored, is stored as trustworthy, so that when encrypted data communication is established later for the first computer it can be seen that the associated Communication partner computer is trustworthy, ie authorized.

According to one embodiment, the public key is signed by the first computer and this signed key, together with the private key, forms the authentication data. The signed key can also be transmitted to the second computer. The signed key is also referred to as a certificate or can form a certificate.

Thus, for example, the second computer can set up an encrypted connection between the second computer and the first computer using Transport Layer Security or also using Secure Sockets Layer, the first computer being able to check the authenticity of the second computer. The second computer can dispense with checking the authenticity of the first computer. However, this could be done optionally.

It is pointed out that some of the possible features and advantages of the invention are described herein with reference to different embodiments, on the one hand, of a communication method and, on the other hand, of a computer network designed to carry out this method. A person skilled in the art recognizes that the features can be transferred, combined, adapted or exchanged in a suitable manner in order to arrive at further embodiments of the invention.

Embodiments of the invention are described below with reference to the accompanying drawing, neither the drawing nor the description being to be construed as restricting the invention. 1 shows a passenger transport system in the form of an elevator system with a computer network according to an embodiment of the present invention.

The figure is only schematic and not true to scale. Identical reference symbols denote identical or identically acting features.

1 shows a passenger transport system 1 in the form of an elevator system 3. Within an elevator shaft 5, an elevator car 7 is displaced vertically by a drive machine 9. The drive machine 9 is controlled by an elevator control 11. The elevator control 11 has a first computer 13 or is controlled by it.

The first computer is part of a computer network 15 in which several computers 19, 21, 23 can communicate with the first computer 13 via a first data connection 17. Computers 19 can be accommodated within a machine room 25 in which the controller 11 and the first computer 13 are also located. Other computers 21, 23 can be located outside this machine room 25.

The first data connection 17 can be an Ethernet connection and can enable high data transmission rates of, for example, a few kilobits per second through a few megabits per second up to a few gigabits per second.

For example, in order to be able to carry out configuration measures or maintenance measures on the passenger transport system 1, in particular on its controller 11, it may be necessary to have a second computer 27 exchange data with the first computer 13. The second computer 27 can, for example, be part of a maintenance tool that is brought along and / or operated by a technician 31 in order to configure the controller 11. The second computer 27 is located within the machine room 25. Since this machine room 25 can only be entered by people through a lockable door 33, it can be viewed as a room 35 protected against unauthorized access. The second computer 27 is connected to the first computer 13 via the first data connection 17 and can use this to exchange data with the first computer 13 at a high data transmission rate.

In addition, the second computer 27 is on the other hand connected to the first computer 13 via a second data connection 29. This second data connection 29 runs exclusively within the engine room 25. It is preferably designed as a wired data connection and is used exclusively to transmit data between the first computer 13 and the second computer 27. The second data connection 29 is designed as a serial and unidirectional data connection that it only enables data to be transmitted from the first computer 13 in one direction to the second computer 27, but not in the opposite direction.

With the computer network 15 described here and the communication method to be carried out with it, an approach can be described for data exchange and, in particular, handling of authentication data and / or encryption data between two computers 13, 27 that are in close proximity to each other and jointly in an unauthorized access protected space 35, safe and easy to design.

The two computers can assume different roles or perform different tasks. As a server or host computer, the first computer 13 can, for example, control the controller 11 of the elevator system 3 and thereby be responsible for correct and safe operation of the elevator system 3. The second computer 27 can be a client computer that should be able to interact with the controller 11. Such a client computer can, for example, display and / or modify status information and can be used for maintenance or troubleshooting of an elevator installation 3.

It must be ensured that only authenticated client computers are allowed to interact with the server or host computer and to exchange data in order to ensure the safety of the elevator system 3. The approach proposed here attempts to simplify the task of the controller 11, or of its first computer 13, of authenticating the second computer 27 acting as a client computer in the protected space 35. In other words, it should be ensured that the client computer is authorized to carry out data communication with the controller 11 or the first computer 13.

The approach described is based inter alia and in particular on the following assumptions: i) Client computer and host computer, ie first computer 13 and second computer 27, are all connected to the same local network, that is, can use the common first data connection 17 communicate with each other. This network is used as a connection with a wide bandwidth and shared by all computers in order to form a LAN for the elevator system 3. ii) The client computer, ie the second computer 27, is located together with the first computer 13 within the protected space 35, ie in close proximity to the first computer 13 with which it is to interact. iii) The protected space 35, that is to say the engine room 25 in the example mentioned, is regarded as trustworthy. It is believed that this room 35 has sufficient physical barriers, such as the lockable door 33, to prevent unauthorized entry. iv) The network can also be accessed by other computers 19, 21, 23 that are not necessarily in the vicinity of the first computer 13, ie by other computers 19, 21, 23 that are not located within the protected space 35 become. v) The data exchange must be secure. This means that only authorized client computers are allowed to communicate with the server via the local network. vi) A wide area network (WAN) such as the Internet may be available to interact with members of the local area network. vii) The local network, i.e. the first data connection 17, should not be allowed to be used to exchange data to be kept secret, such as authentication data or encryption data to be used accordingly, in order to rule out the possibility that this could be read by an attacker eavesdropping on the data traffic. Conventionally, such assumptions or problems are solved by gradually defining data to be kept secret, for example in the form of software keys or certificates, which identify the client computer and are recognized as authentic by the host computer. However, this can present the following logistical challenges:

I) All data to be kept secret must be different. If this is not the case, reverse engineering of the key or the certificate of a client computer can easily make it possible to duplicate or clone data to be kept secret and then to install this in fake client computers that are controlled by all controllers in the Network are accepted.

II) Data to be kept secret, such as keys or certificates, can be generated as different at the time of manufacture of a computer or an assembly by accessing a certified authority computer that is responsible for generating such keys and certificates. While this is possible, it introduces complex additional infrastructure into a manufacturing chain.

III) The mechanisms used by the authority computer that generates the data to be kept secret can have data leaks. This can lead to the possibility of being able to generate illegal, albeit authenticated, keys or certificates at will.

IV) Such data leaks can be difficult to detect and correct. The latter can require a complex process in order to declare data to be kept secret in an entire network as invalid or to replace it with new data.

V) Keys and certificates can have a kind of expiry date, i.e. have a limited validity in order to reduce the risks of security gaps that are not limited in time. Generating and installing new keys and certificates, for example at periodic intervals, can, however, lead to increased logistics costs, for example if no Internet connection is available and a visit on site is required to install such keys and certificates.

With the approach proposed here, a parallel connection can be established between the second computer 27 serving as the client computer and the first computer 13 serving as the server computer, which connection can be assumed to be reliable. The second data connection 29 can be used, for example, in the form of a short serial cable with a physical unidirectional transmission capability from the server computer to the client computer for a secure exchange of data to be kept secret.

For obvious reasons, the cable establishing the second data connection 29 can connect the client computer to the server computer, since these are assumed to be arranged in spatial proximity to one another. The cable can also be assumed to be secured against physical access, since it is located in the protected space 35 and is therefore not easily accessible for eavesdropping or eavesdropping. A configuration in which the cable only enables unidirectional data transmission can help to make it even more difficult to carry out an eavesdropping attack.

A possible sequence for carrying out an embodiment of the communication method proposed herein can be as follows:

1) The first computer 13 generates authentication data by means of which the second computer 27 can authenticate itself on the first computer. The authentication data contain a key of the second computer 27 to be kept secret and a public key of the second computer 27.

2) The first computer 13 stores the public key, for example in a list of authorized keys. This list can be used later to authenticate a client computer such as the second computer 27. The list can be formed, for example, by a file, a database or also by a directory structure and files.

As an alternative or in addition, the first computer 13 can also sign the public key of the authentication data with its own private key. The signed, public key of the authentication data is also referred to as the certificate in the following.

3) The first computer 13 sends the key of the authentication data to be kept secret to the second computer 27 via the serial, preferably unidirectional cables 29, for example with a standard serial protocol such as RS232. The public key of the authentication data or the certificate can also be transmitted to the second computer, this transmission being able to take place either via the first data connection 17 or via the second data connection 29.

4) After the key of the authentication data to be kept secret has been transmitted via the second data connection 29, the second computer 27 can store it, for example in a permanent data memory. Likewise, the public key of the authentication data or the certificate can be saved if this or this has been transmitted to the second computer 27.

5) The second computer 27 can then use this key, which is to be kept secret, in order to establish authenticated data communication with the first computer via the local network, that is to say via the first data connection 17.

6) The first computer 13 can authenticate the second computer 27, since the first computer 13 has the public key corresponding to the private key of the authentication data in the list of authorized keys. Alternatively, the first computer 13 can check the signature of the certificate.

The data connection between the first computer 13 and the second computer 27 is also encrypted. A known encryption method, such as, for example, Transport Layer Security or Secure Sockets Layer, can be used for this purpose.

Another possible embodiment of a sequence for carrying out the communication method proposed herein when using a symmetric key can be as follows:

1) The first computer 13 generates authentication data by means of which the second computer 27 can authenticate itself on the first computer. The authentication data contain a key that is to be kept secret. 2) The first computer 13 stores the key to be kept secret, for example in a list of authorized keys to be kept secret. This list can later be used to authenticate the second computer 27.

3) The first computer 13 sends the key to be kept secret to the second computer 27 via the serial, preferably unidirectional cable which forms the second data connection 29. For example, a standard serial protocol such as RS232 can be used for this.

4) After the key to be kept secret has been transmitted via the second data connection 29, the second computer 27 can store it, for example in a permanent data memory.

5) The second computer 27 can then use this key, which is to be kept secret, in order to establish authenticated as well as secure data communication with the first computer 13 via the local network, that is to say via the first data connection 17.

6) The first computer 13 can authenticate the second computer, since only the first computer 13 and the second computer know the secret key.

Finally, it should be pointed out that terms such as “having”, “comprising”, etc. do not exclude any other elements or steps and that terms such as “a” or “an” do not exclude a plurality. It should also be pointed out that features or steps that have been described with reference to one of the above exemplary embodiments can also be used in combination with other features or steps of other exemplary embodiments described above. Reference signs in the claims are not to be regarded as a restriction.

Claims

1. A method for communicating data in a computer network (15) between a first computer (13) and a second computer (27), in particular in a passenger transport system (1), the first computer (13) and the second computer (27) are accommodated together in a room (35) protected against unauthorized access, the first computer (13) and the second computer (27) being connected to one another via a first and a second data connection (17, 29), and the second data connection ( 29) runs exclusively within the protected space (35) and the second data connection (29) only allows data to be transmitted between the first computer (13) and the second computer (27), the method comprising:

Generation of authentication data by the first computer (13), these authentication data containing at least one key to be kept secret; Transmission of the key to be kept secret from the first computer (13) to the second computer (27) via the second data connection (29);

Establishing an encrypted data communication for transmitting data via the first data connection (17) and checking the authenticity of the second computer (27) by the first computer (13) based on the authentication data.

2. The method of claim 1, wherein the first data connection (17) is configured for data communication with a higher data transmission rate than the second data connection (29).

3. The method according to any one of the preceding claims, wherein the first data connection (17) is also accessible to subscribers in the computer network (15) who are located outside the protected space (35).

4. The method according to any one of the preceding claims, wherein the first data connection (17) is an Ethernet connection.

5. The method according to any one of the preceding claims, wherein the second data connection (29) is a wired data connection.

6. The method according to any one of the preceding claims, wherein the second data connection (29) is a serial data connection.

7. The method according to any one of the preceding claims, wherein the second data connection (29) is a unidirectional data connection.

8. The method according to claim 7, wherein only a transmission of data from the first computer (13) to the second computer (27) is possible via the second data connection (29).

9. The method according to any one of the preceding claims, wherein the key to be kept secret is formed by a key for symmetrical data encryption, the key being stored on the first computer (13) as well as on the second computer (27).

10. The method according to any one of the preceding claims, wherein the key to be kept secret is formed by a private key of the second computer (27) and wherein when generating the authentication data by the first computer, a public key corresponding to the private key by the first computer (13 ) is created, and wherein the authentication data include at least the private key and the public key.

11. The method of claim 10, wherein the public key is stored on the first computer in a list of authorized keys.

12. The method according to claim 10, wherein the public key is signed by the first computer and this signed key forms the authentication data together with the private key.

13. Computer network (15) with a first computer (13) and a second computer (27), in particular in a passenger transport system (1), the first computer (13) and the second computer (27) being jointly protected against unauthorized access Room (35) are included, the first computer (13) and the second computer (27) having a first and a second

Data connection (17, 29) are connected to one another, the second data connection (29) running exclusively within the protected space (35) and the second data connection (29) exclusively transmitting data between the first computer (13) and the second computer ( 27), and wherein the computer network (15) is configured to carry out the method according to one of

Execute or control claims 1 to 12.

14. Passenger transport system (1), in particular elevator system (3), with a computer network (15) according to claim 13, the protected space (35) being a machine room (25) of the passenger transport system (1).