WO2017064027A1

WO2017064027A1 - Method for generating a secret or a key in a network

Info

Publication number: WO2017064027A1
Application number: PCT/EP2016/074276
Authority: WO
Inventors: Andreas Soenkens; Arthur Mutter
Original assignee: Robert Bosch Gmbh
Priority date: 2015-10-15
Filing date: 2016-10-11
Publication date: 2017-04-20
Also published as: DE102015220055A1

Abstract

The invention relates to a method for generating a secret or key in a network. According to the invention, the network comprises at least one first client and one second client, having a common transmission channel between at least the first client and the second client. In addition, the first client has at least one circuit arrangement having at least one communications module for communication via the transmission channel and at least one additional module. Via the at least one additional module, the first client initiates the transmission of at least one first value sequence on the transmission channel, substantially synchronously with a transmission of at least one second value sequence by the second client, and generates a secret or a key on the basis of information relating to the at least one first value sequence and on the basis of a superimposed value sequence, resulting from superimposition of the at least one first value sequence and the at least one second value sequence on the transmission channel. The transmission of the at least one first value sequence by the at least one additional module is initiated in dependence on a first message received by the first client from the second client.

Description

A method for creating a secret or key in a network

The present invention relates to a method for generating a cryptographic secret in a network, in particular the generation of a common, secret key in two subscribers of the network. Also point-to-point connections are usually counted as networks and should also be addressed here with this term. The two participants communicate via a shared transmission medium. In this case, logical bit sequences (or, more generally, value sequences) are transmitted physically by means of corresponding transmission methods as signals or signal sequences. The underlying communication system may e.g. be a CAN bus. This provides for transmission of dominant and recessive bits or correspondingly dominant and recessive signals, whereby a dominant signal or bit of a participant of the network intersperses against recessive signals or bits. A state corresponding to the recessive signal adjusts itself to the transmission medium only if all participants involved provide a recessive signal for transmission or if all participants transmitting at the same time transmit a recessive signal level.

State of the art

Secure communication between different devices is becoming more and more important in an increasingly networked world and is an essential prerequisite for the acceptance and thus economic success of the corresponding applications in many areas of application. This includes various protection goals, depending on the application maintaining the confidentiality of the data to be transferred, mutual authentication of the nodes involved, or ensuring data integrity.

In order to achieve these protection goals, suitable cryptographic methods are usually used, which can generally be subdivided into two different categories: first, symmetric methods, in which the sender and receiver have the same cryptographic key, and, on the other hand, asymmetrical methods in which the sender uses the to be transferred with data the public key (that may also be known to a potential attacker) encrypted the recipient's key, but the decryption can only be done with the associated private key, which is ideally known only to the recipient.

One of the disadvantages of asymmetric methods is that they usually have a very high computational complexity. Thus, they are only conditionally for resource constrained nodes, such as e.g. Sensors, actuators, or similar, suitable, which usually have only a relatively low computing power and low memory and energy-efficient work, for example due to battery operation or the use of energy harvesting. In addition, there is often limited bandwidth available for data transmission, making the replacement of asymmetric keys with lengths of 2048 bits or even more unattractive.

For symmetric methods, however, it must be ensured that both the receiver and the transmitter have the same key. The associated key management generally represents a very demanding task. In the area of mobile telephony, for example, keys are inserted into a mobile telephone with the aid of SIM cards, and the associated network can then assign the corresponding key to the unique identifier of a SIM card. In the case of wireless LANs, on the other hand, a manual entry of the keys to be used (usually by entering a password) usually takes place when setting up a network. However, such key management quickly becomes very cumbersome and impractical if one has a very large number of nodes, for example in a sensor network or other machine-to-machine communication systems, e.g. also CAN-based vehicle networks. In addition, a change in the key to be used is often not possible or only with great effort. In current procedures, the keys are generated centrally. The assignment to individual ECUs takes place in a secure environment z. B. in the factory of the vehicle manufacturer. There, the keys are also activated.

Method for protecting sensor data against manipulation and ensuring transaction authentication, eg in a motor vehicle network work, with the help of common encryption methods are z. B. in the DE

102009002396 AI and in DE 102009045133 AI discloses.

For some time now, the term "physical layer security" has been used to investigate and develop novel approaches that can be used to automatically generate keys for symmetric algorithms based on physical properties of the transmission channels between the nodes involved, using reciprocity and the inherent However, in the case of wired or optical systems in particular, this approach is often only suitable to a limited extent since corresponding channels usually have only a very limited temporal variability and an attacker can draw conclusions about the channel parameters between the transmitter and the receiver relatively well, for example by means of modeling Such methods for secured communication in a distributed system based on channel characteristics of the connected units are not previously published in, for example, US Pat en applications DE 10 2014 208975 AI and D E 10 2014 209042 AI described.

The non-prepublished DE 10 2015 207220 AI discloses a method for generating a shared secret or a secret symmetric key by means of public discussion between two communication participants.

Disclosure of the invention

The presented methods for generating a secret or a cryptographic key require no manual intervention and thus enable the automated establishment of secure communication relationships between two nodes. In addition, the methods have a very low complexity, in particular with regard to the required hardware design, such. As the required memory resources and computing power, and they go with a low energy and time requirements. In addition, the methods offer very high key generation rates with a simultaneously very low probability of error. The methods assume that participants in a network communicate with each other via a communication channel. In particular, they transfer logical sequences of values (in the case of binary logic, bit sequences) with the aid of physical signals on the transmission channel. Even if possible superimpositions take place on the transmission channel through the signals, that is to say on the physical level, in the description below the logical level is primarily considered. Thus, the transferred, logical value sequences as well as their logical overlay are considered.

Subscribers of the network can thus give first signals (for example associated with logical bit "1") and second signals (associated, for example, with logical bit "0") to the communication channel and detect resulting signals on the communication channel. Now transmit two participants (largely) at the same time each one signal sequence, the participants can detect the resulting overlay on the communication channel. The effective signal resulting from the (largely) simultaneous transmission of two (independent) signals on the communication channel can then in turn be assigned to one (or more) specific logical values (or values).

The transmission should be largely synchronous in that a superimposition of the individual signals of a signal sequence on the transmission medium takes place, in particular, that the signal corresponding to the n-th logical value or bit of the first subscriber with the signal corresponding to the n-th logical Value or bit of the second participant at least partially superimposed. This overlay should be sufficiently long for the participants to be able to record the overlay or determine the corresponding overlay value.

In order to reliably ensure the required synchronicity between the participants, a triggering message can be exchanged between them, in particular via the common transmission channel. In this way, the start of the decisive method steps, in particular the synchronous transmission of the value sequences, can be efficiently exchanged between the users become. The triggering in the subscriber depending on the triggering message can be determined by various components of a circuit arrangement, in particular a microcontroller, of the subscriber, in particular by a communication module or a special module for generating the key.

The superimposition of the value sequences can be determined by arbitration mechanisms or by physical signal superposition. By arbitration mechanism is meant, for example, the case where a node wants to apply a recessive level, but detects a dominant level on the bus and thus omits the transmission. In this case, there is no physical interference between two signals, but only the dominant signal is seen on the transmission channel.

From the resulting value sequence of the overlay and its own value sequence, the participants can then generate a key that is secret to an outside attacker. The reason for this is that the outside attacker, who can listen to the effective overall signals applied to the shared transmission medium, sees only the superimposition of the value sequences, but does not have the information about the individual value sequences of the participants. Thus, the participants have more information that they can use against the attacker to generate a secret key.

The methods described can be implemented particularly well in a CAN, TTCAN or CAN FD bus system. Here, a recessive bus level is replaced by a dominant bus level. The superimposition of values or signals of the subscribers thus follows defined rules which the subscribers can use to derive information from the superimposed value or signal and the value or signal transmitted by them. The methods are also well suited for other communication systems such as LIN and I2C.

While the method has been described for two subscribers in a network, even a subscriber of a network can already derive a secret key from his own signal sequence and from an overlay of this with the signal sequence of a second subscriber. A network or a participant of a network is set up to do this by having electronic memory and computational resources to perform the steps of a corresponding method. Also stored on a storage medium of such a user or on the distributed storage resources of a network may be a computer program configured to perform all the steps of a corresponding method when executed in the subscriber or in the network.

drawings

The invention is described in more detail below with reference to the accompanying drawings and to exemplary embodiments. Show

1 schematically shows the structure of an exemplary, underlying communication system,

2 schematically shows a linear bus as an example of an underlying communication system,

3 is a schematic illustration of exemplary signal sequences of two subscribers of a network and a resulting subsequence value sequence on a transmission channel between the subscribers,

4 schematically shows the sequence of an exemplary method for generating a key between two subscribers of a network,

5 shows an exemplary communication module as part of a circuit arrangement of a network participant,

6 shows an exemplary module for generating a secret or key exchange as part of a circuit arrangement of a network participant and 7 shows an exemplary detail of a circuit arrangement of a subscriber with a communication module and a further module (as shown in FIG. 6) for the key generation.

Description of the embodiments

The present invention relates to a method for generating a shared secret or (secret) symmetric cryptographic key between two nodes of a communication system (participants of a network) communicating with each other via a shared medium (transmission channel of the network). The generation or negotiation of the cryptographic keys is based on a public data exchange between the two participants, although a possible listening third party as an attacker is not or only very difficult to draw conclusions about the generated key. With the invention, it is thus possible to completely automatically and securely establish corresponding symmetrical cryptographic keys between two different subscribers of a network in order then to build certain security functions, such as e.g. a data encryption or message authentication. As described in detail, a common secret is first established for this, which can be used to generate the key. However, such a shared secret can in principle also be used for purposes other than cryptographic keys in the strict sense, e.g. as a one-time pad.

The invention is suitable for a variety of wired or wireless as well as optical networks or communication systems, especially those in which the various participants communicate with each other via a linear bus and the media access to this bus using a bitwise bus arbitration. This principle represents, for example, the basis of the widespread CAN bus. Possible fields of application of the invention accordingly include, in particular, CAN-based vehicle networks as well as CAN-based networks in automation technology. The present invention describes an approach with which automatically symmetric cryptographic keys can be generated in one, or in particular between two nodes of a network. This generation takes place using properties of the corresponding transmission layer. Unlike the usual approaches of the "Physical Layer

Security "are evaluated but not physical parameters of the transmission channel such as transmission strength, etc. Rather, there is a public data exchange between the nodes involved, thanks to the properties of the communication system and / or the modulation method used a possible listening attacker no, or does not allow sufficient conclusions to be drawn on the key negotiated therefrom.

The following is an arrangement as shown in FIG. 1 in the abstract. In this case, different subscribers 2, 3 and 4 can communicate with one another via a so-called shared transmission medium ("shared medium") 10. In an advantageous embodiment of the invention, this divided transmission medium corresponds to a linear bus (wired or optical) 30, as is by way of example The network 20 in Fig. 2 consists of just this linear bus 30 as a shared transmission medium (e.g., a wireline transmission channel), subscribers or nodes 21, 22 and 16, respectively

23 and (optional) bus terminations 31 and 32.

In the following, communication between the various nodes 21, 22 and 23 is assumed to be characterized by the distinction between dominant and recessive values. In this example, the possible values are the bits "0" and "1". In this case, a dominant bit (e.g., the logical bit '0') may quasi supersede a concurrently transmitted recessive bit (e.g., the logical bit '1'). An example of such a transmission method is the so-called on-off

Keying (on-off-keying amplitude shift keying), in which exactly two transmission states are distinguished: In the first case (value, Οη ', or "0"), a signal is transmitted, for example in the form of a simple carrier signal, in the other case Case (value, Off, or "1"), no signal is transmitted. The state 'η' is dominant while the state 'Off' is recessive. Another example of a corresponding communication system that supports this distinction of dominant and recessive bits is a (wired or optical) system based on bitwise bus arbitration, such as that used in the CAN bus. The basic idea here is also that if, for example, two nodes want to transmit a signal at the same time and one node transmits a '1', whereas the second node transmits a '0' which 'gains''0' (ie the dominant bit) ie, the signal level that can be measured on the bus corresponds to a logical '0' .This mechanism is used in particular to resolve possible collisions, whereby priority messages (ie messages with a previous, dominant signal level) are transmitted by When the node itself transmits a recessive bit but a dominant bit is detected on the bus, the corresponding node breaks its transmission attempt in favor of the higher priority message (with the earlier dominant bit).

The distinction between dominant and recessive bits makes it possible to interpret the shared transmission medium as a kind of binary operator that combines the various input bits (= all bits transmitted simultaneously) using a logical AND function.

FIG. 3 shows, for example, how a subscriber 1 (T1) keeps the bit sequence 0, 1, 1, 0, 1 ready for transmission between the times t0 and t5 via the transmission channel. Subscriber 2 (T2) keeps the bit sequence 0, 1, 0, 1, 1 ready for transmission between times t0 and t5 via the transmission channel. With the above-described characteristics of the communication system and assuming that the bit level "0" in this example is the dominant bit, the bit string 0, 1, 0, 0, 1 will be seen on the bus (B) Only between times t1 and t2 and between t4 and t5, both subscriber 1 (T1) and subscriber 2 (T2) provide a recessive bit "1", so that only in this case does the logical AND operation result in a bit level of " 1 "on the bus (B) results. Taking advantage of these characteristics of the transmission method of the communication system, a key generation between two subscribers of a corresponding network can now take place in that the subscribers detect a superposition of bit sequences of the two subscribers on the transmission medium and from this information together with information about the self-transmitted bit sequence create a common (symmetric), secret key.

An exemplary, particularly preferred implementation will be explained below with reference to FIG. 4.

The process for generating a symmetric key pair is started in step 41 by one of the two nodes involved in this example (subscriber 1 and subscriber 2). This can be done, for example, by sending a special message or a special message header.

Both Subscriber 1 and Subscriber 2 initially generate a bit sequence locally (i.e., internally and independently) in step 42. Preferably, this bit sequence is at least twice, in particular at least three times as long as the common key desired as a result of the method. The bit sequence is preferably generated in each case as a random or pseudo-random bit sequence, for example with the aid of a suitable random number generator or pseudo random number generator.

Example of local bit sequences of length 20 bits:

Generated bit sequence of participant 1:

Su = 01001101110010110010

'Generated bit sequence of subscriber 2:

S _T2 = 10010001101101001011

In a step 43, subscriber 1 and subscriber 2 transmit (largely) synchronously their respectively generated bit sequences over the divided transmission medium (using the transmission method with dominant and recessive bits, as already explained above). There are different ones Possibilities for synchronization of the corresponding transmissions conceivable. Thus, for example, either subscriber 1 or subscriber 2 could first send a suitable synchronization message to the respective other node and then start the transmission of the actual bit sequences after a certain period of time following the complete transmission of this message. Equally, however, it is also conceivable that only one suitable message header is transmitted by one of the two nodes (eg a CAN header consisting of arbitration field and control field) and during the associated payload phase then both nodes simultaneously (largely) transmit their generated bit sequences synchronously , In a variant of the method, the bit sequences of a subscriber generated in step 42 can also be transmitted to several messages distributed in step 43, for example if this necessitates the (maximum) sizes of the corresponding messages. In this variant too, the transmission of the correspondingly large number of correspondingly large messages distributed bit sequences of the other subscriber takes place again (largely) synchronously.

On the shared transmission medium, the two bit sequences then overlap, whereby due to the previously required property of the system with the distinction of dominant and recessive bits, the individual bits of subscriber 1 and subscriber 2 result in an overlay, in the example mentioned de facto AND-linked. This results in a corresponding overlay on the transmission channel, which could detect, for example, a listening third party.

Example of a overlay bit string for the above local bit strings:

• Effective bit sequence on the transmission channel:

Seft = Su AND S _T2 = 00000001100000000010

Both subscriber 1 and subscriber 2 detect during the transmission of their bit sequences of step 43 in a parallel step 44, the effective (overlaid) bit sequences S _e ff on the shared transmission medium. For the example of the CAN bus, this is usually done in conventional systems during the arbitration phase anyway. This is likewise possible for systems with "η-off-keying" (wireless, wired or optical). In this case, the practical feasibility benefits in particular from the fact that in such a system the state 'η' is dominant and the state 'Off' is recessive (as already explained above). Consequently, even without measurement, a node knows that the effective state is dominant on the shared medium if the node itself has sent a dominant bit, but if a node has sent a recessive bit, it does not know the state on the shared transmission medium first Further, however, in this case he can determine by suitable measurement how it looks like, because, in this case, the node itself does not send anything, so there are no problems with so-called self-interference, which is a complex echo cancellation, especially in the case of wireless systems would require.

In a next step 45, both subscriber 1 and subscriber 2 also again (largely) synchronously transmit their initial bit sequences STI and ST2, but this time inverted. The synchronization of the corresponding transmissions can again be realized exactly in the same way as described above. On the shared communication medium, the two sequences are then ANDed together again. Subscribers 1 and 2 in turn determine the effective, superimposed bit sequences S _e ff on the shared transmission medium.

Example of the above bit sequences:

Inverted bit sequence of participant 1:

Sn = 10110010001101001101

Inverted bit sequence of participant 2:

S _T2 '= 01101110010010110100

'Effective, overlaid bit sequence on the channel:

Seff '= Sn AND S _T2 ' = 00100010000000000100

Both subscriber 1 and subscriber 2 determine during the transmission of their now inverted bit sequences then again the effective, superimposed bit sequences on the shared transmission medium. At this time both nodes (participant 1 and participant 2), as well as a possible rather attackers (eg subscriber 3) who overhear the communication on the shared transmission medium, the effective, superimposed bit sequences S _e ff and Seff '. In contrast to the attacker or third participant, however, participant 1 still knows his initially generated, local bit sequence STI and participant 2 his initially generated, local bit sequence ST2. However, subscriber 1 in turn does not know the initially generated, local bit sequence of subscriber 2 and subscriber 2 does not know the initially generated, local bit sequence of subscriber 1. The detection of the overlay bit sequence again takes place during the transmission in step 46.

As an alternative to this exemplary embodiment, subscriber 1 and subscriber 2 can also send their inverted, local bit sequence directly with or directly after their original, local bit sequence, ie. Steps 45 and 46 are carried out with the steps 43 and 44. The original and the inverted bit sequence can be transmitted in a message, but also in separate messages as partial bit sequences.

In step 47, subscriber 1 and subscriber 2 now respectively locally (ie internally) link the effective, superposed bit sequences (S _e ff and S _e ff '), in particular with a logical OR function.

Example of the above bit sequences:

S _g = Seff it Seff OR '= 00100011100000000110

The individual bits in the bit sequence (Sges) resulting from the OR operation now indicate whether the corresponding bits of STI and ST2 are identical or different. For example, if the nth bit within S _tot is a '0', it means that the nth bit within STI is inverse to the corresponding bit within ST2. Likewise, if the nth bit within Sges is a '1', the corresponding bits within STI and ST2 are identical.

Subscriber 1 and subscriber 2 then cancel in step 48 based on the bit sequence S _ges obtained from the OR operation in their original, initial bit sequences STI and ST2 all bits which are identical in both sequences. This consequently leads to correspondingly shortened bit sequences. Example of the above bit sequences:

Abbreviated bit sequence of participant 1:

Sn, v = 01011100101100

Abbreviated bit sequence of participant 2:

S _T2 , v = 10100011010011

The resulting, shortened bit sequences STI.V and ST2, V are now just inverse to each other. Thus, by inversion of its shortened bit sequence, one of the two subscribers can determine exactly the shortened bit sequence that already exists in the other subscriber.

The thus shared, shortened bit sequence is now processed locally by participant 1 and participant 2 in step 49 in a suitable manner in order to generate the actual desired key of the desired length N. Again, there are a variety of ways that this treatment can be done. One way is to select N bits from the co-ordinated, truncated bit sequence, where it must be clearly defined which N bits to take, e.g. by simply selecting the first N bits of the sequence. It is also possible to calculate a hash function via the shared, shortened bit sequence which provides a hash of length N. In general, the rendering can be done with any linear and nonlinear function that returns a N bit length bit sequence when applied to the co-present truncated bit sequence. The mechanism of key generation from the common truncated bit sequence is preferably identical in both subscribers 1 and 2 and is performed accordingly in the same way.

After the key generation, it may still be possible to verify that the keys generated by subscribers 1 and 2 are actually identical. For this purpose, a checksum, for example, could be calculated using the generated keys and exchanged between subscribers 1 and 2. If both checksums are not identical, then obviously something has failed. In this case, the described method for key generation could be repeated. In a preferred variant of the method for generating a key, in a number of passes, a whole series of resulting shortened bit sequences, which are each present in the case of subscribers 1 and 2, can be generated, which are then combined into a single large sequence before the actual key is derived therefrom , If necessary, this can also be done adaptively. If, for example, the length of the common, shortened bit sequence is, for example, less than the desired key length N after a single pass through the described procedure, then one could, for example, generate further bits before the actual key derivation.

Finally, the generated, symmetric key pair can be subsumed by Subscriber 1 and Subscriber 2 in conjunction with established (symmetric) cryptographic methods, e.g. Ciphers for data encryption.

A potential attacker (eg subscriber 3) can listen to the public data transmission between subscriber 1 and subscriber 2 and thus gain knowledge of the effective, superposed bit sequences (S _e ff and S _e ff ') as described. The attacker then only knows which bits in the locally generated bit sequences of nodes 1 and 2 are identical and which are not. In addition, with the identical bits, the attacker can even determine whether it is a '1' or a '0'. For a complete knowledge of the resulting, shortened bit sequence (and thus the basis for the key generation), however, he lacks the information about the non-identical bits. In order to further aggravate possible attacks for the attacker, in a preferred variant the bit values identical in the original, locally generated bit sequences of the users 1 and 2 are additionally deleted. This means that participant 3 has only information that is not used for key generation. Although he knows that correspondingly shortened bit sequences emerge from the different between the local bit sequences of the participants 1 and 2 participants bits. However, he does not know which bits have been sent by subscriber 1 and subscriber 2 respectively. In addition to the information about the superimposed overall bit sequence, subscriber 1 and subscriber 2 also have the information about the locally generated bit sequence transmitted by them in each case. The fact that the keys generated in subscribers 1 and 2 remain secret as a basis despite the public data transmission results from this information advantage over a subscriber 3 following only the public data transmission.

FIG. 5 shows a communication module or protocol module. In this exemplary embodiment, this is a so-called CAN protocol controller module or else a short CAN module. For a CAN bus system, this can be done e.g. a CAN communication module based on a CAN controller IP module from Robert Bosch GmbH such as M_CAN, C_CAN or D_CAN or for a LIN bus system a LIN communication module based on a LIN communication controller IP module from Robert Bosch GmbH such as C_LIN be used. FIG. 5 shows a CAN module 50 based on the M_CAN-IP.

A CAN core 51 executes the communication according to a specific CAN protocol version, eg version 2.0 A, B and ISO 11898-1 and can also support CAN FD. With the connections 503 and 504, the logical CAN transmit or CAN receive connections are designated. The synchronization block 52 synchronizes signals between the two existing clock domains. The module-internal clock is designated 59. The configuration and control block 55 can be used to set CAN core-related configuration and control bits. Block 56 is for interrupt control and the generation of receive and transmit timestamps. The interface 58 serves as a generic slave interface for the possible connection of the CAN module with many different CPU types via the connection 501. The interface 57 serves as a generic master interface for accessing a message memory, in particular a RAM, via the connection 502 Block 53 corresponds to a Tx handler or send manager which controls the message transfer from an external message store to the CAN core. Up to 32 transmit buffers can be configured for transmission. Transmit timestamps are stored with corresponding message IDs. The blocks 531 and 532 in the send manager correspond to a control and configuration block and a send prioritization block, respectively. Of the Rx handler or receive manager 54 controls the transmission of received messages from the CAN core to external message memory. It supports the storage of up to 128 messages. A reception time stamp is stored with each message.

Thus, the communication module comprises a central circuit part (in this case CAN core 51) for the protocol-controlled control of communication between a host CPU and an external message memory as well as for protocol-based reception and transmission of messages via the Kommunikationsssys- tem (here via the connections 503 and 504). Via an interface (here master interface 57 and the connection 502), the module is connected to the external message memory. Via another interface (here slave interface 58 and the connection 501), the module is connected to the host CPU. It can be implemented as a stand-alone unit, as part of an ASIC or with an FPGA.

The connection to the physical layer can be supported by additional transceiver hardware. Several communication modules can share an external message store.

6 shows a module 60 which, in a circuit arrangement of a subscriber on a network, can support this subscriber in generating a shared secret with other network subscribers (hereinafter also referred to as "further module") Messages on the bus 600 give, which is realized in a preferred embodiment as a CAN bus.

In this case, the module 60 has a block 64 for configuring the module via an interface 604, in particular for protocol-specific configurations such as baud rate, IDs, etc. Furthermore, it comprises a block 63 (e.g.

Register) in which a character string, in particular a random number or pseudorandom number can be stored, in particular received via an interface 603. Block 62 denotes a trigger module, which in a preferred embodiment can be triggered via the interface 602 to form a trigger signal. Alternatively, the trigger module can also trigger a trigger signal. to induce constantly. The module also has transmission means such as the transmission buffer memory (Tx buffer) shown as block 61, which can transmit messages or data to the bus 600 via an interface 601.

The main mode of operation of the module is that, depending on a configuration (indicated by the connection 605 between configuration block 64 and transmission means 61), a random number or pseudo-random number from block 63 is given via connection 606 to the transmission means 61 and via the interface 601 to the CAN Bus 600 is output. This process is triggered (either already the transmission of the number of block 63 to block 61 or at least the transmission of the number of block 61 to the bus 600), in particular by a trigger signal by the trigger module 62 via the connection 607 to the transmitting means 61.

In preferred embodiments of the module 60, the latter can also have a memory 65 (in particular a RAM) in which one or more random numbers or pseudorandom numbers are stored, which are output via the transmission means 61 as a function of the trigger signal. These random numbers can also be generated by an optional random number generator (in particular a TRNG) in the module 60.

Furthermore, in a preferred embodiment, the module 60 can also have receiving means 67, in particular receiving buffer memory 67, which can receive messages or data from the bus 600 via an interface 612. Via an interface 613 between receiving means 67 and trigger block 62, a trigger signal for transmitting data can also be triggered in this embodiment depending on received data. For example, it can be recognized that a random number sequence for secret generation is placed on the bus by another network subscriber (eg via a corresponding message ID) and then the trigger is made by the trigger block 62, that this subscriber also has a random number sequence (largely ) in synchronism with the transmission of the random number sequence by the other network participant on the bus. In an optional block 68 error states of the module 60 can be stored and these are also reported via an interface 608 to external or retrieved from external.

In a further preferred embodiment, the module 60 may also have a circuit part 69 for dynamic message generation. The latter can receive a random number or pseudorandom number via an interface 609 and, depending on this, generate a message and forward it to the transmission means 61 via the connection 610. The message is intended for largely synchronous transmission of random numbers with another network participant in order to generate a shared secret between the network participants as described above.

In a circuit arrangement (in particular a microcontroller), which is intended to support the above-described methods for secret or key generation between network users, at least one communication module as described with reference to FIG. 5 and at least one further module as shown in FIG. 6 described included. Communication module and further module can also be integrated in a circuit part of the circuit arrangement.

Particularly preferred is an embodiment in which the first network participant is a control unit of a vehicle and the circuit arrangement of the network participant a microcontroller, in addition to the at least one communication unit and the at least one further module interfaces, memory means and a computing unit, in particular a central processing unit (CPU ) having.

The two network subscribers transmit the key sequences or value sequences which are decisive for the key generation (largely) synchronously via the common communication connection. This synchronous transmission preferably takes place via messages synchronously exchanged by the first or the second network participant, which comprise the first or the second value sequence. In order to ensure the synchronicity of the transmissions, the process for generating the secret or symmetrical key pair is preferably started or triggered by one of the network participants involved. In particular, this is done via a trigger message, which is transmitted from one of the participating network participants to the other network participants. In an efficient, preferred embodiment, the transmission takes place via the common transmission channel. Alternatively, the triggering message can also be transmitted via an additional communication link.

In this case, the transmission of the first value sequence or of the message comprising the first value sequence preferably takes place by a specific period of time after a reception or a transmission of the triggering message. (Largely) synchronously, the second value sequence is transmitted on the basis of the same information by the second subscriber. The beginning of the transmission of the triggering message by a subscriber or the complete receipt of the triggering message by a subscriber can preferably be detected by both subscribers on the common transmission channel. Alternatively, information can be transmitted in particular for the transmission time via timestamps.

The value of the time to be awaited may be predefined, dynamically configured (e.g., by a computing unit or software of the circuitry or subscriber), or co-transmitted with the triggering message. So that the time between the participants is clearly defined, these are preferably synchronized. The components within a subscriber or his circuit arrangement (in particular communication module and further module) preferably access the same time source.

In a specific embodiment, the time duration may also be defined as zero, in particular if it is defined as the time duration after the reception. This means that the synchronous transmission of the value sequences or corresponding messages takes place directly after the reception of the triggering message.

According to a first refinement of the triggering message, the second network participant sends a message to the first network participant specifically for triggering the triggering message. Sung of the further method for generating the secret, in particular sent to the transmission of the first value sequence specific message. This message can be recognized by the first network participant as, for example, a message ID, a content of the message's payload, or a combination thereof as a triggering message.

According to a second embodiment of the release message, the second network subscriber immediately sends the message comprising the second value sequence. The first network participant recognizes upon receipt of the message (eg, based on the message ID or on the basis of user data, which are arranged before the second value sequence), that it is a message comprising the second value sequence, to which the first network participant largely the first value sequence synchronously and causes the corresponding transmission of a message comprising the first value sequence. Thus, the message comprehensively serves the second value sequence also as a triggering message. This requires a fast response of the first network participant to the receipt of the message by the second network participant. In a preferred variant of this embodiment, the first network subscriber has therefore already prepared a first value sequence which can be sent quickly on the transmission channel.

FIG. 7 shows a detail of a circuit arrangement (in particular a microcontroller) with a central processing unit (in particular CPU) 70, a communication module 71 (in particular according to FIG. 5) and a further module 72 (in particular corresponding to FIG. 6). The computing unit 70, the communication module 71 or the further module 72 have connections 701, 711 and 721 to a computer unit interface 700. The communication module 71 or the further module 72 comprise receive connections 712 or 722 and transmit connections 713 or 723 to a communication interface 73. The communication interface 73 comprises a receive connection 732 and a transmit connection 733 to a communication system or a transmission channel of a communication system, in particular to one bus service. Via connections 741 or 742, the communication module 71 or the further module 72 have access to the Time source 74. Via an optional trip connection 714, the communication module 71 can send a triggering signal to the further module 72.

Within the network subscriber, in particular within the described circuit arrangement of the network subscriber, the triggering by the trigger message can be realized in various ways.

In a preferred first refinement of the circuit arrangement, the further module 72 described above with reference to FIG. 6 receives the trigger message via the receive link 722, recognizes this as a trigger message and triggers the transmission of the first value sequence via the transmit link 723 independently. Alternatively, the communication module 71 described above with reference to FIG. 5 can receive the trigger message via the receive connection 712, recognize it as a trigger message and then generate a trigger signal and send it via the connection 714 to the further module 72. The further module 72 triggers the transmission of the first value sequence via the transmission link 723, depending on the reception of the trigger signal from the communication module 71. In a further variant, in turn, the communication module 71 can receive and process the triggering message via the receive connection 712, in particular store it. The reception time can also be saved. An arithmetic unit of the circuit arrangement (eg a CPU of a microcontroller) 70 or a software processed by the arithmetic unit recognizes the reception of the tripping message and sends a tripping signal to the further module, in particular via the connection 701, via the arithmetic unit interface 700 and via the connection 721. The further module in turn triggers the transmission of the first value sequence via the transmission link 723 depending on the reception of the triggering signal from the arithmetic unit or software.

In order to generate a longer, shared secret between the first and the second network participant, it may be necessary to transmit a plurality of value sequences (largely) synchronously over the transmission channel. For this purpose, the first or the second network participant can prepare one or more further first or second value sequences for the transmission and have them ready. These can then be directly following the first synchronous transmission of value sequences are transmitted. This can be done so that the transmission channel between the network participants is not free until the completion of multiple synchronous transmissions. High-priority messages (including other network participants) can be transferred between the synchronous transmissions of messages with value sequences, eg if they gain a corresponding abitration. If there are no such high-priority messages, the synchronous transmissions of messages with value sequences take place directly on each other. No new triggering messages are needed anymore.

If the synchronization between the network subscribers fails, it may happen that one subscriber sends a value sequence or message with a value sequence, but the other subscriber does not initiate a synchronous transmission of his value sequence or message. In this case, the transmitting network participant recognizes that the overlay on the transmission channel corresponds to the own transmitted value sequence. (Note: This special case of sent and superimposed value sequences being the same may occur even if both network participants randomly send the same value string, but since these are based on sufficiently long random numbers, this case is very rare.) In such a case, send the transmitting network participant immediately another value sequence or message. This can take place until a successful synchronization between the network subscribers sets in and the other network subscriber transmits synchronous value sequences or corresponding messages. The synchronicity is then ensured by seamlessly transmitted value sequences of the communication channel is continuously occupied and only higher priority messages can be transmitted in between.

Claims

claims

A method of generating a secret or key in a network (20), the network (20) comprising at least a first subscriber (21) and a second subscriber (22) having a common transmission channel (30) between at least the first subscriber (20). 21) and the second subscriber (22), wherein the first subscriber (21) has at least one circuit arrangement with at least one communication module (50) for communication via the transmission channel (30) and at least one further module (60), wherein the first subscriber (21) via the at least one further module (60) causes the transmission of at least one first value sequence on the transmission channel (30) largely synchronously to a transmission of at least one second value sequence by the second participant (22) and wherein the first participant (21) Base of information about the at least one first value sequence and on the basis of one of an overlay of the at least one generated first sequence of values with the at least one second value sequence on the transmission channel (30) resulting overlay value sequence a secret or a key, characterized in that the transmission of the at least one first value sequence by the at least one further module (60) depends on one by the first participant (21) is initiated by the second participant (22) received first message.

A method according to claim 1, characterized in that the first message is received by the first subscriber (21) via the transmission channel (30).

3. The method according to any one of claims 1 or 2, characterized in that the first message is provided exclusively for triggering the transmission of the first value sequence.

4. The method according to any one of claims 1 or 2, characterized in that the first message comprises the second value sequence.

5. The method according to any one of the preceding claims, characterized in that the transmission of the first value sequence takes place at a predetermined time after receiving or sending the first message.

6. The method according to claim 5, characterized in that the predetermined time is configurable, in particular by a computing unit of the circuit arrangement.

7. The method according to any one of the preceding claims, characterized in that the at least one further module (60) receives the first message and independently causes the transmission of the first value sequence depending on the reception of the first message.

8. The method according to any one of claims 1 to 6, characterized in that the at least one communication module (50, 71) receives the first message that at least one communication module (50, 71) depending on the reception of the first message, a trigger signal to the at least sends a further module (60, 72) and that the at least one further module (60, 72) causes the transmission of the first value sequence depending on the trigger signal.

9. The method according to any one of claims 1 to 6, characterized in that the communication module (50, 71) receives the first message that a computing unit (70) of the circuit arrangement depends on the receipt of the first message by the communication module (50, 71). a trigger signal to the at least one further module (60, 72) transmits and that the at least one further module (60, 72) causes the transmission of the first value sequence depending on the trigger signal.

10. The method according to any one of the preceding claims, characterized in that the first subscriber (21) provides at least one further first value sequence so that it can be transmitted directly after the previously transmitted first value sequence via the transmission channel (30).

11. The method according to claim 10, characterized in that the further first value sequence is transmitted largely synchronously to a transmission of a further second value sequence by the second subscriber (22).

12. Computer program, which is adapted to perform the steps of a method according to any one of claims 1 to 11.

13. An electronic storage medium on which a computer program according to claim 12 is stored.

14. Circuit arrangement, in particular microcontroller, comprising at least one communication module (50, 71) for communication of the circuit arrangement as part of a first network participant (21) with at least one second network participant (22) via a transmission channel (30), in particular via a bus connection, wherein the Circuit arrangement has at least one further module (60, 72), which is adapted to cause a transmission of at least one first value sequence on the transmission channel (30) at least partially synchronously to a transmission of at least one second value sequence by the second network participant (22), and to determine a secret on the basis of the at least one first value sequence and on the basis of a value sequence resulting on the transmission channel (30) during the synchronous transmission of the at least one first value sequence and the at least one second value sequence, characterized in that the further module (60, 72 ) to ei is directed to cause the transmission of the at least one first value sequence depending on a first message received by the first subscriber (21) from the second subscriber (22).