DE102020214499A1 - Method for generating keys and replacing participants in a network - Google Patents

Abstract

The invention relates to a method for generating a secondary subscriber key (106) in a secondary subscriber of a network (100), with receiving a main key (102) of the network (100), generating the secondary subscriber key (106) from the main key (102) as required a secondary subscriber key generation rule, and storing the secondary subscriber key (106) in the secondary subscriber (120); and a method for generating a master key (102) in a main subscriber (110) with generating a master key (102) in accordance with a master key generation rule; sending the master key (102) and a network identifier (103) to a key management agency (30), and storing the master key (102) and the network identifier (103) in the master subscriber (110). The invention also relates to methods for replacing a primary or secondary subscriber.

Description

The present invention relates, in a network, to a method for generating a secondary user key in a secondary user, for generating a primary key in a primary user, for replacing a primary user with a substitute primary user and for replacing a secondary user with a substitute secondary user, as well as a computing unit and a computer program for their Execution.

Background of the Invention

In networks with a large number of network participants, cryptographic methods and associated cryptographic or digital keys can be used in order to secure communication between network participants, for example. In this case, for example, encryption and/or signing of messages with which data are transmitted can be provided.

However, it is associated with a significant effort to equip the network subscribers with such keys in a secure manner initially when they are put into operation or at a later point in time when it should be necessary to replace a subscriber. The management of all keys in a network-external key management point is complex and error-prone.

Disclosure of Invention

According to the invention, a method for generating a secondary participant key in a secondary participant, for generating a main key in a main participant, for replacing a main participant with a substitute main participant and for replacing a secondary participant with a substitute secondary participant, in a network, as well as a computing unit and a computer program for their implementation with the Features of the independent claims proposed. Advantageous configurations are the subject of the dependent claims and the following description.

In the context of the invention, methods are presented in particular with which network participants of a network, in particular a closed network such as in a vehicle, initially during commissioning (e.g. in a manufacturer's plant) or at a later point in time, e.g. if a participant has to be replaced should be (e.g. in a workshop) equipped with keys for cryptographic purposes in a secure manner. The invention can be used particularly advantageously with network participants that have a security component such as a so-called “hardware security module” (hardware security module, HSM) or a so-called “secure hardware extension” (secure hardware extension, SHE). Such security modules can be implemented as a closed security area on a microcontroller. They usually contain a random number generator, a separate storage area for the secure storage of (cryptographic) digital keys and dedicated logic for encrypting data, e.g. according to the AES standard with a key length of 128 bits. Such a security module can usually also be equipped with digital keys using standardized methods, see e.g. "Specification of Secure Hardware Extensions", AUTOSAR FO R19-11, 2019.

One aspect of the invention relates to the generation of secondary subscriber keys by secondary subscribers in the network from a main key in the network in accordance with a secondary subscriber key generation rule. This significantly simplifies the generation of a large number of secondary subscriber keys.

The generation of the main key in the main subscriber can in turn be carried out particularly easily in accordance with a main key generation rule. This can particularly preferably be a random number method. For example, a random number of a predetermined size (e.g. 1024 bits) is generated as the master key. In order to enable the management of multiple networks by a (network-external) key management body (e.g. a "key management system", KMS), the master key and a network identifier for assigning the master key to a specific network are sent to the key management body and stored there. A key management point can thus be provided as the manager of the network, in which the network identifier and master key of each managed network are stored. For example, a chassis number or a vehicle identification number (VIN, vehicle identification number) can be used as the network identifier for a vehicle.

In general, the main or secondary subscriber key generation rule can in particular include a key derivation function (KDF). A key derivation function is a cryptographic operation that produces one or more other keys from one cryptographic key.

In order to trigger the generation of secondary subscriber keys, the master key expediently sent to one or more secondary participants in the network.

If, in addition, the main key of the network is known to the (network-external) key management point, the secondary subscriber keys do not have to be known there, since they can be generated again at any time in accordance with the secondary subscriber key generation rule. This drastically reduces the required storage space and administrative effort in the key management office.

A particularly high level of security is achieved if each secondary participant deletes the main key after the generation of the secondary participant key or keys. Then a compromise of the secondary subscriber does not lead to a compromise of the entire network or all subscribers. In particular, it is sufficient if the master key is only stored in one main participant of the network.

A further aspect of the invention relates to the exchange or replacement of network participants (main and secondary participants), e.g. in the event of a defect.

Replacing a secondary participant with a substitute secondary participant is expediently managed by the main participant, in which a master key of the network is stored. In particular, the main participant in the network sends an appropriate data record to the key management agency, the data record containing at least the network identifier. In addition, the data record can also contain a process identifier, which in particular allows the data record to be identified if it is later received again from the main participant. In a simple embodiment, the process identifier can be a random number generated by the main participant. The data record can also contain a secondary subscriber and/or substitute secondary subscriber identifier, in order in particular to prevent the data record from being misused to introduce foreign subscribers into the network. Such a (substitute) secondary subscriber identifier can be of quite general design and only characterize the type of (substitute) secondary subscriber, for example engine control unit, battery control unit, etc., or even more generally only the manufacturer. However, it can also be very specific and, for example, specifically identify the (substitute) secondary subscriber, for example by means of a serial number or the like.

The key management authority signs the data record with a private key and sends the signed data record back to the substitute secondary participant and optionally also to the main participant. In other words, the record and signature can be sent directly to the primary party, or via the backup secondary party. In the second case, a two-stage check can take place, so that the substitute secondary participant only sends the data record and signature to the main participant if the verification is successful.

In particular, if the verification by the substitute secondary participant is successful, it is possible for the substitute secondary participant to receive the master key, for example activated or the like.

The key management office can add a time stamp to the data record before signing it, for example to define a validity period and prevent subsequent misuse of the data record. For example, the participants can be configured in such a way that the signature is only accepted within a predetermined period of time depending on the timestamp.

In addition to pure signature verification, the verification can also include verification of the content of the data record, in particular whether the data record is also intended for the specific recipient. One, several or all data record contents (in particular network identifier, process identifier, secondary subscriber identifier, time stamp) can be used for this.

After successful verification of the data set, the main participant sends the main key to the substitute secondary participant, who can then derive one or more secondary participant keys from it, in particular according to the solution described above.

Replacing a main subscriber with a replacement main subscriber is expediently managed by an external entity or processing unit, for example a device at the manufacturer or in the workshop. According to a simple variant, the network identifier can be sent to the key management center, for example, which then sends back the master key that matches the network identifier, which is then stored in the substitute main subscriber, in particular together with the network identifier. A substitute main subscriber prepared in this way can then be introduced into the network. This means that an exchange can be carried out very easily.

In a variant with higher security, in which the main key in particular is not stored in the key management office or must be, instead of reusing the previous master key in the replacement main subscriber, this can be set up so that it generates a new master key and sends it to the secondary subscribers after it has been introduced into the network, so that they can then generate new secondary subscriber keys. In order to prove permission to send a new master key, the substitute main participant can send a data record containing the network identifier and a signature, from the key management office, of the data record to the secondary participants. He has expediently received this data record with signature beforehand and can also interpret this as permission to generate a master key.

Here, too, the data record can contain a main subscriber and/or substitute main subscriber identifier, in particular in order to prevent the data record from being misused to introduce foreign main subscribers into the network. Such a (substitute) main subscriber identifier can be very specific and, for example, specifically identify the (substitute) main subscriber, for example by means of a serial number or the like.

Here, too, the key management office can add a time stamp to the data record before signing it, for example to define a validity period and prevent subsequent misuse of the data record. For example, the participants can be configured in such a way that the signature is only accepted within a predetermined period of time depending on the timestamp.

The verification and the proof of permission can then, in addition to the pure verification of the signature, also include a verification of the content of the data record, in particular whether the data record also belongs to the specific substitute main participant. One, several or all data record contents (in particular network identifier, (substitute) main subscriber identifier, time stamp) can be used for this.

In order to be able to verify data records signed by the key management office, a matching public key is expediently stored in the corresponding subscriber (main, substitute main, secondary, substitute secondary subscriber). In particular, this can be stored immediately after production. Private and public keys form what is known as an asymmetric key pair.

Security is further increased if communication between participants to exchange the master key, in particular between the main participant and a (substitute) secondary participant or the key management office, only takes place in encrypted form. A session key to be used for this purpose can be negotiated using known methods, for example according to the Diffie-Hellman protocol.

A computing unit according to the invention, e.g. a control unit of a motor vehicle, is set up, in particular in terms of programming, to carry out a method according to the invention.

The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is advantageous because this causes particularly low costs, especially if an executing control device is also used for other tasks and is therefore available anyway. Suitable data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard drives, flash memories, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and refinements of the invention result from the description and the attached drawing.

The invention is shown schematically in the drawing using exemplary embodiments and is described below with reference to the drawing.

character list

• 1 Figure 12 shows a computing unit that can be used to implement a preferred embodiment of the invention.
• 2 shows schematically an initial generation of keys in a network having a main participant and several secondary participants.
• 3 shows schematically a replacement of a secondary participant by a substitute secondary participant.
• 4a shows schematically a replacement of a main participant by a substitute main participant according to a first embodiment.
• 4b shows schematically a replacement of a main participant by a substitute main participant according to a second embodiment.

embodiment(s) of the invention

The invention is explained using a network in a vehicle, but this is not to be understood as limiting.

Programmable control devices are used in machines and vehicles in order to control them or components thereof. For example, a motor vehicle can contain control units for engine control, for the brake system, and so on. The control units usually include at least one processor with one or more processor cores. Control software is executed in these processor cores (also referred to simply as host or host system), i.e. application programs stored in a memory are executed in order to achieve the control function of the control unit.

The control units of a vehicle or a machine can be networked with each other and often also with external computing units, i.e. connected for data communication. For security reasons, it is advisable to secure this communication cryptographically. In this case, for example, encryption and/or signing of messages with which data are transmitted can be provided. To implement cryptographic protection, control units can be equipped with a hardware security module (HSM) or a secure hardware extension (SHE). The HSM/SHE can be a dedicated processor or processor core that accesses its own data memory and program memory that other processor cores, i.e. processor cores of the host, cannot access. Subscriber keys can be stored in the data memory of the HSM.

1 FIG. 12 shows a computing unit 2 according to a preferred embodiment, which can be used to carry out a method according to the invention. The arithmetic unit 2 , for example a microcontroller, for example a control device, has a host system 4 and a hardware security module (HSM) 6 . It can also have an accelerator module 8, for example. The processing unit 2 also has an interface 10 which is used for data exchange with other processing units, for example via a connecting line 12 . The interface 10 can be any wireless or wired interface; it can be a serial or parallel interface, for example. Examples are in particular fieldbuses, for example a CAN bus (Controller Area Network), an Ethernet interface, an SPI interface (Serial Peripheral Interface), a WLAN interface (Wireless Local Area Network) or the like.

The host system 4, the HSM 6, the accelerator module 8 and the interface 10 are at least partially interconnected with connections or lines 14 for data exchange. These connections can be serial or parallel. Point-to-point connections and/or star connections and/or bus connections (similar to what is shown) are possible.

Furthermore, further components 16, e.g. a memory, can be contained in the computing unit, which can also be connected to the host system, the HSM, the accelerator module and the interface for data exchange.

The host system 4 and the HSM 6 each have at least one processor core in which programs are executed in order to implement the function of the host system or HSM. The processor cores of the host system and the HSM can be contained in different processor modules or in a common processor module, with the host system, i.e. in particular its processor cores, not having access to the HSM, in particular its processor cores. The host system 4 and the HSM 6 can include further elements, in particular a volatile (working) memory and/or a non-volatile memory, e.g. Flash.

The accelerator module 8 is designed as a hardware module and set up to perform cryptographic functions, with a key and data being loaded into the hardware module by a calling unit (host system and/or HSM), the hardware module then loading a correspondingly specified cryptographic function using the Key applied to the loaded data, and the result of this application of the cryptographic function can then be read by the calling unit and / or can be used in the hardware accelerator.

The host system 4, the HSM 6, the accelerator module 8, the interface 10 and optionally further components 16 can be at least partially integrated with one another, e.g. in a common chip (integrated circuit, IC).

In 2 a process is shown schematically in which a network 100, for example in a vehicle, is initially equipped with keys during production, for example at a manufacturer 20. A corresponding tool 22 is used by the manufacturer 20 for this purpose.

In particular, the network 100 includes a main participant 110 and a large number of secondary participants 120. It should be emphasized that a distinction between the main participant and the secondary participant is made essentially on the basis of the functionality relating to the key distribution or key storage and is not related to the actual function of the participant in the vehicle .

In the present example, the tool 22 initiates key generation by means of a command 101 to the main participant 110 . The main subscriber then generates a master key 102 in accordance with a master key generation rule and stores this in particular in a secure memory area. A network identifier 103, for example in the form of a chassis number or VIN, and a public key 104 of a key management office 30 can also be stored there. The key management office 30 contains, among other things, a private key 34 that matches the public key 104.

The main key generation specification can in particular be a random number method, with a random number having a predetermined size being generated as the main key.

The master key 102 is transmitted to the plurality of secondary participants 120 in a step 105 . This transmission preferably takes place in an encrypted manner using known methods. In addition to the master key, the network identifier 103 can also be transmitted. The public key 104 of the key management office 30 can also be stored in the secondary participants.

Each of the large number of secondary subscribers 120 then generates one or more secondary subscriber keys 106 in accordance with a secondary subscriber key generation rule and stores these and, if necessary, the network identifier 103 in a (preferably secure) memory area. This completes the key generation process within network 100.

Depending on the configuration of the invention, i.e. in particular whether all master keys are stored in a central key management office at the manufacturer or not, the master key 102 and the network identifier 103 can also be transmitted to the key management office 30 in an optional step 107, in particular via the tool 22, and be stored there. In particular, this allows a very simple subsequent exchange of main participants, especially in the event of a defect.

In 3 is now shown schematically how a substitute secondary subscriber 120 'can be introduced into the network. Such an exchange method is carried out in particular in a workshop 23 using a corresponding tool 24, for example a so-called tester. The substitute secondary participant can be called at any time within the in 3 described method can also be introduced physically into the network 100.

The exchange begins, for example, with a corresponding request 301, which the tool 24 transmits to the main participant 110. In response to this, the main participant 110 generates a process identifier, for example also a random number, and transmits this together with the network identifier to the tool 24 in a step 302. However, the network identifier can also only be added to the data set by the tool 24.

In a step 303, the data set is then transmitted to the key management point 30, which adds a time stamp to the data set and digitally signs it with its private key 34.

A digital signature procedure can be based on an asymmetric cryptographic system in which a sender calculates a value for a digital message (i.e. for any data) using a secret signature key (the so-called "private key" or private key), which is called the digital signature will. This value allows anyone to use the public verification key (the so-called "public key" or public key) to check the non-repudiation of authorship and integrity of the message.

Such a digital signature method usually includes three functions or routines: key generation, signature calculation (sign) and signature verification (verify). The key generation usually creates an asymmetric key pair consisting of a private and public key. The sign routine usually calculates a digital signature when entering a message using the private key, while the verify routine usually checks whether the message belongs to the signature or not when entering a message and a digital signature using the public key.

The record with the signature is then sent to the tool 24 in a step 304 and from there transmitted to the substitute secondary subscriber 120' in a step 305.

According to a first variant 306a, the substitute secondary participant 120 transmits the data record with signature to the main participant 110 after successful verification. According to an alternative variant 306b, the data record can also be transmitted directly from the tool 24 to the main participant 110.

In any case, the main participant 110 also verifies the data record and, in a step 308, if the verification is successful, transmits the main key 102 to the substitute secondary participant 120′, which, as described, can derive its participant key 106 from it.

According to a preferred step 307, before the master key is transmitted, in step 308 a session key is negotiated to enable encrypted transmission of the master key, for example in accordance with a known Diffie-Hellmann method. With regard to the scope and content of the verification, reference is made to the general description above.

In the 4a and 4b different variants are shown regarding an exchange of a main participant, once for the case that the main key is stored in the central key management center at the manufacturer ( 4a) and once for the case that the master key is not stored in the manufacturer's central key management office ( 4b) .

In 4a a first exemplary embodiment for replacing a main participant with a substitute main participant 110' is shown. This exchange can be divided into a part located at the manufacturer 20 and a part located in the workshop 23 . The exchange is triggered in particular by a tool 22 , with the network identifier 103 and optionally a substitute main subscriber identifier being transmitted to the key management point 30 for this purpose in a step 401 .

In a step 402, the key management point 30 transmits the master key that matches the network identifier, possibly together with the network identifier, back to the tool 22, which in turn transmits it in a step 403 to the substitute main subscriber 110'. Then the master key 102, network identifier 103 and, as is usual here, the public key 104 of the key management office 30 are stored in the substitute main subscriber 110'. The replacement main subscriber 110' can then be taken to the workshop and installed there in the network 100, for example the vehicle.

In 4b an alternative embodiment is shown, in which, in contrast to 4a in step 402', a data record with a signature, but not the master key, is transmitted from the key management point 30 to the tool 22. In a step 403, the data set with a signature is sent to the substitute secondary subscriber 110'. For the content and details of the data set, reference is made to the general description above.

The substitute main participant 110′ then verifies the transmitted data set and, if successful, generates a (new) main key 102′ in accordance with a main key generation specification (for example a random number generation method).

Substitute main participant 110' is then reintroduced into the network and in step 404 transmits the data record with signature to the plurality of secondary participants 120. If the secondary participants 120 successfully verify the data record, substitute main participant 110' transmits the new main key in step 406 102' to the secondary participants 120, who derive their secondary participant keys 106' from this in the manner described. Preferably, before the transmission of the master key 102' in step 406—as above—a session key for an encrypted transmission is negotiated in a step 405.

Claims (17)

Method for generating a secondary subscriber key (106) in a secondary subscriber of a network (100), with the following steps performed by the secondary subscriber (120): receiving a master key (102) of the network (100), Generating the secondary subscriber key (106) from the main key (102) in accordance with a secondary subscriber key generation rule, storing the secondary subscriber key (106) in the secondary subscriber (120). procedure after claim 1 , additionally comprising the step performed by the secondary subscriber (120): deleting the master key (102) after generating the secondary subscriber key (106). procedure after claim 1 or 2 , additionally with the steps performed by the secondary participant (120): negotiating a session key before receiving the master key (102), receiving the master key encrypted with the session key (102), decrypting the master key encrypted with the session key (102). Method for generating a master key (102) in a main participant (110) of a network (100), with the following steps performed by the main participant (110): generating a master key (102) in accordance with a master key generation rule; Sending the master key (102) and a network identifier (103) to a key management center (30), storing the master key (102) and the network identifier (103) in the master subscriber (110). procedure after claim 4 , additionally comprising the step of: sending the master key (102) to at least one secondary participant (120) in the network. Method for replacing a main participant (110) of a network (100) with a replacement main participant (110'), wherein a main key (102) of the network (100) is stored in the main participant (110), with the steps: Sending a network identifier (103) to a key management center (30), receiving a master key (102) associated with the network identifier from the key management center (30), storing the master key (102) and the network identifier (103) in the substitute principal. Method for replacing a main participant (110) of a network (100) with a replacement main participant (110'), wherein a main key (102) of the network (100) is stored in the main participant (110), with the steps: Sending a network identifier (103) to a key management center (30), receiving a data record associated with the network identifier and a signature of the data record from the key management authority (30), Generating a master key (102) in accordance with a master key generation rule by the substitute main subscriber (110'), storing the master key (102) and the network identifier (103) in the substitute principal (110'). procedure after claim 7 , additionally with the step: sending the master key (102) and/or the data record and the signature to at least one secondary participant (120) in the network. procedure after claim 7 or 8th , wherein the data record contains a main subscriber and/or substitute main subscriber identifier and/or a time stamp added by the key management office (30). Method for replacing a secondary subscriber (120) of a network (100) with a replacement secondary subscriber (120'), with the steps: Sending, by a main participant (110) of the network (100), in which a master key (102) of the network (100) is stored, a data record containing a network identifier (103) to a key management office (30), Signing, by the key management authority (30), the data record with a key management authority-specific private key (34), receiving, by the surrogate slave (120'), the record and the signature, verifying, by the backup secondary subscriber (120'), the record and, if successful, taking a secondary subscriber action, Receiving, by the main participant (110), the record and the signature, verifying, by the master party (110), the record and, if successful, sending, by the master party (110), the master key (102) to the backup slave (120'). procedure after claim 10 wherein the record sent by the primary party (110) further includes an event identifier and/or a backup secondary party identifier and/or a secondary party identifier. procedure after claim 10 or 11 , additionally with the step: Extending, through the key management office (30), the data set by a time stamp before signing. Procedure according to one of Claims 10 until 12 , wherein the surrogate secondary participant action comprises sending, by the surrogate secondary participant (120'), the record and the signature to the primary participant (110) and/or allowing the surrogate secondary participant (120') to receive the master key (102), and /or wherein the secondary participant action comprises the steps performed by the secondary participant (120): negotiating a session key with the primary participant (110) prior to receiving the primary key (102), receiving the primary key (102) encrypted with the session key, decrypting the primary key with the session key encrypted master key (102). Method according to one of the preceding claims, with the step: storing a public key (104) of the key management office (30) in the subscriber. Processing unit (110, 120, 110', 120') which is set up to carry out all subscriber-specific method steps of a method according to one of the preceding claims. Computer program that causes a processing unit to perform all participant-specific method steps of a method according to one of Claims 1 until 14 to be performed when it is executed on the computing unit. Machine-readable storage medium with a computer program stored on it Claim 16 .

Images