EP2949111A1

EP2949111A1 - Ip adress determination

Info

Publication number: EP2949111A1
Application number: EP14715558.4A
Authority: EP
Inventors: Rainer Falk; Reinhard Frank; Matthias Scheffel; Matthias Seifert
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2013-04-15
Filing date: 2014-03-24
Publication date: 2015-12-02
Also published as: WO2014170091A1; DE102013206686A1

Abstract

The invention relates to methods and systems for determining an address part (9, 19, 9a, 19b, 19c) for a network node (1, 11) in a deterministic manner, comprising the steps: - assigning a unique name (2, 2a, 12, 12b, 12c) to a network node (1, 11) or a group of network nodes (1, 11) in a project planning; and - determining the address part (9, 19, 9a, 19b, 19c) in a deterministic manner independently of the unique name (2, 2a, 12, 12b, 12c) by means of a transformal function ((7a, 17b, 17c).

Description

description

IP Address Determination The present invention relates to the technical field of determining addresses for a network node.

When using IP communication, an end device must be assigned an address. With Internet Protocol version 6 (IPv6), there are a variety of ways to determine or assign an IP address for a node.

In automation environments, it is essential to ensure controlled, deterministic network communication. This applies in particular to safety-critical or real-time critical communication. The proj ectierungs - or configuration effort should be low. Manual configuration of IP addresses therefore requires a great deal of effort and represents a source of error.

An IPv6 node can designate an address itself (Address Autoconfiguration) or it can be assigned an address from a DHCPv6 server (see RFC4291). However, DHCP creates a single point of failure with the required DHCP server. In addition, the safety detection becomes more complex because the correct behavior of the DHCP address assignment must be ensured.

The IPv6 address consists of a network part and an interface part. While the network part is dictated by the network currently used, the interface part is unique to a specific host. The network part is generally made known by a router with a Router Advertisement message in the network segment.

The self-configuration of an IP address consists essentially of the following variants: The address is manually configured by an administrator.

The address is determined by the host itself. The address of an interface can be determined based on the MAC address of the interface. This has the disadvantage that the address depends on the hardware, ie may not yet be available at the time of configuration and changes when the device is replaced. The address can alternatively be determined randomly (Privacy Address). This represents a non-determinism that is undesirable in a safety-critical environment. The address is stored as a fingerprint (hash value) dependent on a cryptographic key (CGA,

cryptographically generated address), a nonce and a network prefix. Again, there is a non-deterministic address assignment by the nonce.

In 6to4 (IPv6 tunneling) according to RFC3056 and 6RD (IPv6 Rapid Deployment) according to RFC5569 is known to integrate the IPv4 address into an IPv6 address in whole or in part.

In the NAT64 address translation to RFC6052 (NAT: network address translation), it is known to algorithmically determine the IPv6 address assigned to an IPv4 address during address translation. This has the advantage that the NAT gateway does not have to manage any address translation tables. Here is the

IPv4 address completely or partially built into an IPv6 address.

There is a need for a deterministic, easy-to-use determination of a network address, in particular an IPv6 address. The present invention has for its object to meet this need.

This object is achieved by the solutions described in the independent claims. Advantageous embodiments of the invention are specified in further claims. According to one aspect, a method for the deterministic determination of an address part for a network node is proposed. For this purpose, a unique name for the network node or for a group of network nodes is assigned in a configuration. The address part is determined in a deterministic manner depending on the unique name by means of a derivative function.

According to a further aspect, a system for deterministic determination of an address part of a network node is proposed. The system comprises a determination means. The determination means is adapted to determine the address part in a deterministic manner depending on a unique name of the network node or a group of network nodes assigned in a configuration by means of a derivation function.

A network node can manifest itself in many ways. For example, a network node may be, for example, a device, a device, a system, an interface, a terminal, or a host.

The invention will be explained in more detail with reference to the drawing, for example. Showing:

Figure 1 shows the basic structure of an IPv6 address;

Figure 2 is a block diagram of a system according to an embodiment of the invention;

Figure 3 is a block diagram of a system according to another embodiment of the invention.

Figure 1 shows the basic structure of an IPv6 address 90 in three levels of detail. The IPv6 address 90 has a length of 128 bits. The address 90 is generally structured, ie it has a plurality of logical areas 91, 92, 93, 94, 95. These can, for example, be a subnetwork by means of a Specify a subnet prefix 91 and an interface by means of an interface identifier 92 (also called interface ID 92). In turn, the subnet prefix may be divided into a routing prefix 94 (preferably a global routing prefix) and a subnet ID 95. Similarly, areas 93 may be provided which identify the type of address (eg global or locally valid address). The limits of the fields are basically not fixed, but can be selected appropriately (see, for example, RFC 6177, which describes that the length of the global routing prefix 94 and the resulting subnet ID 95 can vary). The limits are "only intended", ie in an IPv6 data packet, the 128 bits of the send address and destination address are encoded, but not the position of the boundaries.This is through configuration information, such as a network prefix information provided by a router in the network. known.

FIG. 2 shows a system 1 designed as network node 1 for the deterministic determination of an address part 9a of an IPv6 address 9 of a network node 1 according to a preferred embodiment of the invention. The system 1 comprises a determination means 8, which is adapted to determine the address part 9a in a deterministic manner depending on a unique designation assigned name 2a of the network node 1 or a group of network nodes 1 by means of an algorithmic derivation function 7a. For the purposes of this embodiment, "algorithmic derivative function" means a function which does not have to be stored in the form of a table, but rather a function which can preferably be described analytically, for example by means of a mathematical formula However, according to an alternative embodiment, the derivative function is not algorithmically, but is deposited as a table in the determining means 8.

According to a preferred embodiment of the method for the deterministic determination of an address part for a network node, a unique name is used in the configuration 2a assigned to the network node 1. Subsequently, the address part 9a is determined algorithmically in a deterministic manner depending on the unique name 2a by means of the derivative function 7a. The unique name 2a can be part of further input data 2 for the derivation function 7a, from which the address part 9a is determined.

FIG. 2 thus illustrates the principle of preferred embodiments, according to which at least one part (deterministically derived address 9a) is determined by means of a derivation function (AF) 7a (English also called derivation function 7a) as a function of at least one derivation parameter AP. Not shown is that the upper part of the IPv6 address e.g. can be fixed or through a router

Advertisement Message can be advertised as Network Prefix.

FIG. 2 shows a system 1 designed as network node 1 for the deterministic determination of an address part 9a of an IPv6 address 9 of a network node 1 according to a preferred embodiment of the invention. The system 1 comprises a determination means 8, which is adapted to determine the address part 9a in a deterministic manner depending on a unique designation assigned name 2a of the network node 1 or a group of network nodes 1 by means of an algorithmic derivation function 7a.

The derivation function 7a is preferably configured in such a way that the unique name 2a can be determined unambiguously from the address part 9a. Preferably, the address part 9a and / or the IP address 9 can be determined in a one-way manner as a function of the unique name 2a by means of the derivation function 7a. According to a preferred embodiment of the method for the deterministic determination of an address part for a network node, a unique name 2a for the network node 1 is assigned in the configuration. Then the ad- resister 9a determined algorithmically in a deterministic manner depending on the unique name 2a by means of the derivative function 7a. FIG. 3 shows an exemplary embodiment in which two subarrays 19b, 19c of an IPv6 address are respectively determined deterministically by means of a derivation function (AF) 17b, 17c (English also called derivation function 17b, 17c). Here, a device-specific address part 19c (deterministically derived address 19c) is derived from a device identifier (HID) 12c. From a plant identifier (AID) 12b, a plant network prefix portion (Plant Network ID) 19b is determined deterministically. The Plant Network ID 19b can be permanently configured, for example, on the target device, or it can be made known by a router as Router Advertisement in the network.

FIG. 3 shows a preferred embodiment of a system 11 designed as network node 11 for the deterministic algorithmic determination of address parts 19a, 19b of an IPv6 address 19 of the network node 11. The system 11 comprises a determination means 18 which is adapted to determine the address part 19b to be deterministic Depending on the unique assigned in a project name 12b of the network node 11 or a group of network nodes 11 by means of an algorithmic derivation function 17b to determine. In addition, the determination means 18 is adapted to determine the address part 19c in a deterministic manner depending on the unique name 12c of the network node 11 or a group of network nodes 11 allocated in the configuration by means of an algorithmic derivation function 17c. The derivation functions 17b, 17c are each preferably designed in such a way that the unique names 12b, 12c can be determined unambiguously from the address part 19b, 19c. In this case, the address part 19b is preferably clearly determinable depending on the unique name 12b by means of the derivation function 17b. Likewise, preferably the address part 19c can be determined in a one-way manner as a function of the unique name 12c by means of the derivation function 17c. Preferably, the determining means 18 is configured such that the unique names 12b, 12c can be uniquely determined from the IPv6 address 19. Input data 12 includes or consists of the unique names 12a, 12b. From the input data 12, 12a and / or 12b, the determining means 18 determines the address 19 and / or at least one address part 19a, 19b.

According to preferred embodiments, the unique name is a textual name, preferably a host name (HID), a project identifier, a facility identifier (PID), an identifier of a service such as a URL and / or a lane ID a redundant network.

According to preferred embodiments, the derivative function 7a, 17b, 17c is the identity function, a hash function such as CRC, a cryptographic hash function such as MD5, SHA-1, SHA256 or a key derivation function such as e.g. HMAC.

According to preferred embodiments, the deterministic manner determined address part 9, 19, 9a, 19b, 19c at least part of a complete 128-bit IPv6 address and is used for unique connection between the project, configured node, network, node interface and used IPv6 address , According to preferred embodiments, the network nodes 1, 11 are assigned a plurality of addresses of the same protocol, wherein the plurality of addresses have a same deterministically derived address part. For example, the network node 1 or 11 can be assigned several IPv6 addresses that differ in their respective network part. An IPv6 address consists of a prefix needed for the delivery route and an interface identifier used to identify the network node. According to preferred embodiments, a separate communication processor serves as a network interface, which determines the address part 9, 19, 9a, 19b, 19c in a deterministic manner. In this case, the address part 9, 19, 9a, 19b, 19c is preferably determined as a function of HID, PID of a control unit assigned to the communication processor. An interface identifier of an insertion slot or another mounting position of the network node 1, 11 may also depend on the control device. Preferably, the determining means 8 comprises the communication processor.

According to preferred embodiments, a configuration tool 3 performs a check to prevent names 2, 2a, 12, 12b, 12c from being duplicated. Also, such a test can be implemented via a multicast service implemented distributed on each device or other network nodes 1, 11 itself. In this case, a network node 1, 11, in the context of

Check recognizes as wrongly configured, the address part 9, 19, 9a, 19b, 19c redefine, for example, by falling back on a random address share and registered for review in a system. Likewise, a device identifier may have a counter value or a freely selectable value, so that address conflicts are automatically resolved by selecting an alternate address, eg, by incrementing the device counter. According to preferred embodiments, a check is performed on a network message using a device certificate containing the unique name 2, 2a, 12, 12b, 12c of the network node 1, 11. The check checks whether the network node 1, 11 may actually use the address part 9, 19, 9a, 19b, 19c. Preferably, the address part 9, 19, 9a, 19b, 19c is deterministically derived and verified from identifiers confirmed in the certificate, or information about a permissible IPv6 address can be found in the device certificate. cat and the address part 9, 19, 9a, 19b, 19c is determined deterministically at the device certificate output.

According to preferred embodiments, in the configuration, a group of network nodes is defined by setting a group name 2, 2a, 12, 12b, 12c. From the group name 2, 2a, 12, 12b, 12c, at least part of a multicast address range is derived. According to preferred embodiments, a deterministic determination of an IPv6 address part is performed depending on a configurable identifier.

According to preferred embodiments of the invention, unique names are assigned in application protocols for automation or in the configuration node. A name may e.g. be a textual name. In addition, a particular project or facility often has an identifier. It is now proposed according to preferred embodiments of the invention to determine the IPv6 address at least partially dependent on a textual, configurable host name (HID) by means of a derivation function. As a derivative function, the identity function, a hash function like CRC, a cryptographic hash function like MD5, SHA-1,

SHA256 or a key derivation function such as HMAC can be used. This deterministically derived address is at least part of the complete 128-bit IPv6 address and serves to uniquely link the project, the projected node, the network, the node interface and the IPv6 address used. In addition, according to preferred embodiments, the derivation function must also be able to display the configured information reversely from an IPv6 subaddress.

With IPv6, an interface is generally assigned several IPv6 addresses (eg link local, unique local address ULA, unique global), which differ in the network part. In a preferred variant, these multiple IPv6 addresses of an interface have the same deterministically derived address parameter. In one variant, a project identifier or a plant identifier (PID) is used as the derivation parameter. In another variant, the derivation parameter used is an identifier of a service, eg a URL.

In another variant, the derivative parameter used is a lane ID of a multi-channel, i. redundant network used.

In a variant, a separate communication processor is provided as a network interface. Here, the network address used can be determined as a function of HID, PID of the control unit assigned to the communication processor. Furthermore, an interface identifier can depend on the slot or the mounting position with respect to the control unit. This has the advantage that the IPv6 address remains unchanged even if a communication processor is replaced.

Furthermore, a configuration tool can carry out a check, or this check can be implemented via a multicast service implemented distributed on each device itself, so that no names (HID, PID) are assigned twice. This ensures that not network addresses are assigned twice. This check can also be applied to the derived addresses to ensure that no "random" identical network addresses are configured (although this is statistically very unlikely with a suitable derivation function) In another variant, a device identifier can have a counter value or a freely selectable value, so that address conflicts can be resolved automatically by selecting an alternative address, eg by incrementing a device counter. For a network logon, especially for IEEE 802.1x using a device certificate, the device certificate containing the device name can be used to verify that this device is allowed to use the IPv6 address. For this purpose, it is not necessary to explicitly encode the permissible IP address in the device certificate, since the IP address can be derived deterministically from identifiers (HID and / or PID) confirmed in the certificate and can thus be checked. This simplifies the management of digital certificates. In another variant, the digital device certificate contains information about permissible IPv6 addresses. However, when the certificate is issued, the entry can be determined deterministically depending on the device name. As a result, the effort is reduced in this case.

In accordance with preferred embodiments of the invention, at least a portion of an IPv6 address is derived deterministically. Possible input parameters for the derivative function include:

• Host identifier (for example, a host name assigned during the configuration)

· Machine Identifier (if, for example, several machines, such as a robot, are installed).

• Projection identifier (for example, project name, which is defined during configuration, version status, project subdivision)

· A network ID as a logical identifier for a subnet (eg "network segment DMZ") The type or intended use of the network can also be used (eg Safety, 50159-Closed, Realtime, Diagnostics, EnterpriselT, SCADA, Field-level ).

· It can also be a location information of the network

be encoded (eg "Stellwerk Bonn", "section 358") • URL of a service, eg an http server, a web service, or an OPC UA service.

• Lane ID (channel of a multi-channel, redundant communication transmission)

· A role (for example, configured device or dynamically unconfigured added device, maintenance device, automation device, control device, sensor, actuator, network device such as router, switch).

• A configuration state (unconfigured, configured)

Examples of derivative functions AF are:

• Identity function

• CRC

XOR (e.g., bytewise, 16-bit, 32-bit)

• MD5, SHA-1, SHA256

• HMAC, AES-CBC-MAC (with parameter and purpose "Railway IPv6 - Derivation" as further textual derivation parameter)

The output can be shortened, e.g. on 32 bits, 48 bits, 64 bits.

The derivation which at least partially determines the determination of an IP address according to embodiments of the invention may be applied differently:

• When autoconfiguring an IPv6 address by a host. Here, in one variant, a known Duplicate Address Detection (DAD) check can be made to avoid double use of an IPv6 address. In the case of an address conflict, e.g. an error message can be provided, or it can be determined by updating a counter field of the IPv6 address a next address with the information contained accordingly. Again, a DAD test can now be done. This can then be repeated until a free address is obtained.

• During plug-and-work autoconfiguration of device configuration settings, the associated configuration information can be automatically selected based on the IPv6 address or, in the case of ambiguity, a pre-selection of candidate configurations may be offered to a user for selection.

• A multicast address range can be created that includes all devices of a configuration or a subarea of the configuration.

• When determining an IPv6 address to be configured during configuration.

• When checking the address of a network access in accordance with IEEE 802.1x (Port-based Access Control).

• When matching a device name contained in the device certificate with the IPv6 address used by a device.

• Entry of an IPv6 address information of a device during certificate issue / issuance.

The address information may e.g. via a configuration memory module (ID plug, USB stick, SD card), via a local configuration interface (eg RS-232, USB), via a device management system or / and by downloading configuration data.

When installing or replacing a component using "plug-and-work", an "anonymous",

unconfigured initial state of the component.

The component can now form an IPv6 address, which encodes as information that the component is unproj ected, i. (still) has no IPv6 address derived from configuration data. Using this initial address, the component can load configuration data from a configuration server as part of a plug-and-work process (for example, via HTTP, FTP, SCP, etc.). After loading the configuration data, the component can then form an IPv6 address, which is derived from the configuration data.

In another variant, the IPv6 address of a device that depends on the configuration data is determined by a configuration onsserver and the target component via DHCPv6.

Application domains are, in particular, different automation environments

• Rail automation, interlocking

• Factory automation

• process automation

• Building automation

· Power grid automation

IPv6 communication can be implemented at the field level, in a control room, in a SCADA system or similar. occur. The following advantages result from preferred embodiments of the invention:

The IP address does not have to be manually configured or configured because it is determined automatically, deterministically, depending on the configuration data that is already known and required. As a result, the effort for the configuration or configuration is reduced. Errors and inconsistencies are avoided. There are no automatic address allocation mechanisms that could lead to unforeseen behavior. In particular, this would make safety proof more complex and thus lead to increased expenditure. A device replacement, e.g. with a defective device, leads to an identical network configuration, since not the MAC

Address in the IPv6 address. The address information is already determined deterministically during configuration, although the MAC addresses of the devices used are not yet known at this time.

The IPv6 address contains information ("handle", "link") that can be used to determine the configuration data assigned to the device. This can be used in a troubleshooting or a Data communication directly a reference to the assigned configuration data are automatically produced.

Claims

claims

Method for the deterministic determination of an address part (9, 19, 9a, 19b, 19c) for a network node (1, 11), comprising the method steps:

- Assigning a unique name (2, 2a, 12, 12b, 12c) for a network node (1, 11) or a group of network nodes (1, 11) in a configuration;

Determining the address part (9, 19, 9a, 19b, 19c) in a deterministic manner as a function of the unique name (2, 2a,

12, 12b, 12c) by means of a derivative function (7a, 17b, 17c).

2. The method of claim 1, wherein the address part (9, 19, 9a, 19b, 19c) algorithmically in a deterministic manner depending on the unique name (2, 2a, 12, 12b, 12c) by means of the derivative function (7a, 17b, 17c ) is determined.

3. The method according to any one of the preceding claims, wherein the address part (9, 19, 9a, 19b, 19c) from an IP address, preferably from an IPv6 address is included.

4. The method according to any one of the preceding claims, wherein the unique name (2, 2a, 12, 12b, 12c) in a unique manner from the address part (9, 19, 9a, 19b, 19c) can be determined.

5. The method according to any one of the preceding claims, wherein the unique name is a textual name, preferably a host name (HID), a proj ect - identifier, a plant identifier (PID), an identifier of a service such as a URL, and / or a lane ID of a redundant network.

6. The method according to any one of the preceding claims, wherein the derivation function (7a, 17b, 17c) the identity function, a hash function such as CRC, a cryptographic Hash function such as MD5, SHA-1, SHA256 or a key derivation function such as HMAC.

7. The method according to any one of the preceding claims, wherein the determined deterministic address part (9, 19, 9a, 19b, 19c) is at least part of a complete 128-bit IPv6 address and for unique connection between project, configured node, network , Node interface and used IPv6 address.

8. The method according to any one of the preceding claims, wherein the network node (1, 11) a plurality of addresses thereof

Protocol, for example, multiple IPv6 addresses are assigned, which differ in their respective network part, wherein the plurality of addresses preferably have a same deterministically derived address part.

9. The method according to any one of the preceding claims, wherein a separate communication processor serves as a network interface, which determines the address part (9, 19, 9a, 19b, 19c) in a deterministic manner, wherein the address part (9, 19, 9a, 19b, 19c) is preferably determined depending on HID and / or PID of the communication processor associated control unit, and / or preferably an interface identifier of a slot or other mounting position of the network node (1, 11) with respect to the control unit depend.

10. The method according to any one of the preceding claims, wherein a configuration tool (3) performs a check to prevent names (2, 2a, 12, 12b, 12c) are awarded twice, or distributed such a test implemented via a multicast service is performed on each network node (1, 11) itself.

11. The method of claim 10, wherein a network node

(1, 11), which identifies itself as being incorrectly configured in the course of the examination, redirects the address part (9, 19, 9a, 19b, 19c). is correct, for example, by falling back on a random address portion and registering for verification in a system, or, for example, by a device identifier having a counter value or a freely selectable value, so that address conflicts can be selected by selecting an alternate address, eg by incrementing the device counter, be resolved automatically.

12. The method according to any one of the preceding claims, wherein in a network application using a device certificate containing the unique name (2, 2a, 12, 12b, 12c) of the network node (1, 11), a check is made whether the Network node (1, 11) may actually use the address part (9, 19, 9a, 19b, 19c), wherein preferably the address part (9, 19, 9a, 19b, 19c) is deterministically derived and verified in identifiers confirmed by the certificate, or wherein preferably in the device certificate information about a permissible IPv6 address is included and the output of the device certificate, the address part (9, 19, 9a, 19b, 19c) is determined deterministically.

13. The method according to any one of the preceding claims, wherein in the configuration, the group of network nodes is defined by a group name is determined, and from the group name (2, 2a, 12, 12b, 12c) at least a part of a multicast address range is derived ,

14. System (1, 11) for the deterministic determination of a

Address part (9, 19, 9a, 19b, 19c) of a network node (1, 11) comprising a determination means (8) which is adapted, the address part (9, 19, 9a, 19b, 19c) in a deterministic manner depending on one unambiguous names (2, 2a, 12, 12b, 12c) of the network node (1, 11) or of a group of network nodes (1, 11) assigned in a project designation by means of a derivation function (7a, 17b, 17c).

15. System according to claim 14, wherein the network node (1,

11) includes the system and / or the system is.

A system according to claim 14 or 15, wherein the determining means (8) is adapted to algorithmically determine the address part (9, 19, 9a, 19b, 19c) in a deterministic manner depending on the unique name (2, 2a, 12, 12b, 12c ) by means of the derivative function (7a, 17b, 17c).

A system according to any one of claims 14 to 16, wherein the address part (9, 19, 9a, 19b, 19c) is comprised of an IP address, preferably an IPv6 address.

18. System according to any one of claims 14 to 17, wherein the unique name (2, 2a, 12, 12b, 12c) in an unambiguous manner from the address part (9, 19, 9a, 19b, 19c) can be determined.

19. The system according to any one of claims 14 to 18, wherein the unique name is a textual name, preferably a host name (HID), a proj ect - identifier, a plant identifier (PID), an identifier of a service such as a URL , and / or a lane ID of a redundant network.

A system according to any one of claims 14 to 19, wherein the deriving function (7a, 17b, 17c) comprises the identity function, a hash function such as CRC, a cryptographic hash function such as MD5, SHA-1, SHA256 or a key derivation function such as e.g. HMAC is.

The system of any one of claims 14 to 20, wherein said deterministically determined address portion (9, 19, 9a, 19b, 19c) is at least a portion of a complete 128-bit IPv6 address and for unique binding between project, configured node , Network, node interface and used IPv6 address.

22. The system according to any one of claims 14 to 21, wherein the network node (1, 11) a plurality of addresses of the same protocol, for example, a plurality of IPv6 addresses are assigned, which differ in their respective network part, wherein the plurality of addresses preferably have a same deterministically derived address portion.

23. System according to any one of claims 14 to 22, wherein a separate communication processor serves as a network interface, which determines the address part (9, 19, 9a, 19b, 19c) in a deterministic manner, wherein the address part (9, 19, 9a, 19b, 19c) is preferably determined as a function of the HID and / or PID of a control unit assigned to the communication processor, and / or wherein preferably an interface identifier of an insertion slot or another mounting position of the network node (1, 11) with respect to the control unit.

24. System according to one of claims 14 to 23, comprising a project planning tool (3), which is adapted to make a check to prevent names (2, 2a, 12, 12b, 12c) are assigned twice, or that is adapted to carry out such testing via a multicast service implemented distributed on each network node (1, 11) itself.

25. The system of claim 24, wherein the engineering tool

(3) is adapted to re-determine the address part (9, 19, 9a, 19b, 19c) if the check reveals that the network node is configured incorrectly, wherein the configuration tool is preferably adapted to cause a network node (1 , 11) falls back to a random address portion and registered for verification in a system, or for example by a device identifier has a counter value or a freely selectable value, so that address conflicts by selecting an alternative address, eg by counting up the device counter, is automatically resolved.

26. A system according to any one of claims 14 to 25, adapted in a network login using a device certificate containing the unique name (2, 2a, 12, 12b, 12c) of the network node (1, 11). check whether the network node (1, 11) may actually use the address part (9, 19, 9a, 19b, 19c), preferably the address part (9, 19, 9a, 19b, 19c) deterministically from identifiers confirmed in the certificate - is conductive and verifiable, or preferably wherein the device certificate includes information about a permissible IPv6 address and the output of the device certificate, the address part (9, 19, 9a, 19b, 19c) is determined deterministically.

27. System according to any one of claims 14 to 26, wherein the

System is adapted to define the group in the configuration by a group name is set, and from the group name (2, 2a, 12, 12b, 12c) at least part of a multicast address range is derivable.