Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W84/00—Network topologies
  • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
  • H04W84/10—Small scale networks; Flat hierarchical networks
  • H04W84/12—WLAN [Wireless Local Area Networks]
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/44—Program or device authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/102—Entity profiles
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
  • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
  • H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/069—Authentication using certificates or pre-shared keys
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/08—Access security
  • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol

Definitions

• the invention relates to the efficient, reliable and convenient integration of a device, in particular a domestic appliance, in a local area network (LAN).
• LAN local area network
• This document deals with the technical task of enabling a particularly convenient, reliable and secure integration of a LAN-compatible device into a LAN.
• a (possibly computer-implemented) method for integrating a device into a local area network (LAN), in particular into a wireless LAN is described.
• the device can in particular be a domestic appliance, for example an oven, a refrigerator, a stove, a dishwasher, a washing machine, a dryer, a food processor, a coffee machine, etc.
• the device can include a communication module that is designed to establish a wired and / or wireless LAN connection (in particular in accordance with IEEE 802.11) to an access point.
• the method can be carried out by a (first) access point.
• the device has a certificate that was derived from a device reference certificate.
• the certificate can be derived from the device reference certificate along a device certificate chain via one or more intermediate certificates.
• the device reference certificate of a specific entity e.g. the manufacturer of the device. Different certificates can then be generated from the device reference certificate for different devices of the entity and made available on the respective device.
• the certificate can be stored in each case on a storage unit, in particular on a Trusted Platform Module (TPM) or another storage solution assessed as secure, of the respective device.
• TPM Trusted Platform Module
• the device can be designed to determine the device certificate chain from the device certificate, and / or the device can be set up to provide the device certificate chain in whole or in part.
• the device certificate chain can be stored on the device, for example.
• the reference certificate of an entity can be the root certificate of the entity or a certificate derived from the root certificate of the entity.
• the term “device reference certificate” of a device is understood to mean the reference certificate of an entity from which the certificate of the device (i.e. the certificate that is stored on the device and / or that was assigned to the device) was derived.
• the device reference certificate is thus a specific reference certificate of a specific entity (in particular the specific entity to which the device is assigned).
• the method comprises checking whether the certificate of the device matches at least one reference certificate that is available at a first access point to a first (W) LAN.
• it can be checked on the basis of the certificate of the device whether the device reference certificate (ie the reference certificate from which the certificate of the device was derived) is available at the first access point, in particular whether the device reference certificate is on a storage unit, for example on a TPM or another storage solution rated as secure, the first access point is stored.
• a list with one or more reference certificates can be available.
• This list can, for example, be provided in the first access point when the first access point is established.
• the list with one or more reference certificates can be stored on a storage unit, in particular on a TPM, of the first access point. It can then be checked in an efficient and reliable manner whether the device reference certificate is in the list with one or more Reference certificates is included or not and / or whether the certificate of the device was derived from one of the reference certificates in the list (along a reference chain).
• the method further comprises integrating the device into the first (W) LAN if it is determined that the certificate of the device was derived from at least one reference certificate available at the first access point.
• the device can be integrated into the first LAN if, in particular only if, it is determined that the device reference certificate (ie the reference certificate from which the device certificate was derived) is included in the list with one or more reference certificates is, or if, in particular only if, it is determined that the device reference certificate is available at the access point, or if, in particular only if it is determined that the certificate of the device is from one available at the first access point Reference certificate was derived (and valid in terms of information security).
• the process enables a device to be integrated into a (W) LAN in an efficient, convenient and secure manner.
• the integration can take place automatically without a user having to enter access data (such as a pre-shared key (PSK)) to the LAN.
• the integration can, for example, take place automatically when the device is started up.
• the method can include determining one or more network units for which the device is authorized to access via the first LAN.
• the one or more network units can be arranged in a wide area network (WAN) outside the first LAN (e.g. on the Internet).
• the one or more network units can be included in the list stored on the first access point.
• the one or more network units can be operated or provided by the entity to which the device reference certificate is assigned.
• the integration of the device into the first LAN can be restricted to access to the one or more network units.
• the first access point can have the effect that the device can only access the one or more network units and otherwise no further access Components of the first LAN or to other components of the WAN. In this way, the security of the (automatic) integration of the device can be further increased.
• the method can include providing a communication connection between the device and the one or more network units via the first access point, in particular via a router of the first access point.
• the communication connection can then be used, for example, for remote maintenance of the device (based on the one or more network units). It can thus be made possible for a manufacturer of devices to access devices in an efficient and reliable manner (since the devices automatically connect to the one or more network units (e.g. servers) of the manufacturer).
• a list with one or more reference certificates can be available, in particular stored, at the first access point.
• the list can display at least one network unit for which devices that have a certificate that matches the respective reference certificate have access authorization. This enables different entities to access the devices of the respective entity in an efficient and secure manner.
• the method can include determining the device certificate chain between the certificate of the device and the device reference certificate, the device certificate chain indicating one or more intermediate certificates between the certificate of the device and the device reference certificate.
• the device certificate chain can be sent in whole or in part, e.g. from the device to the first access point and received by the first access point. It can then be checked in a particularly efficient and precise manner on the basis of the device certificate chain whether the certificate of the device matches at least one reference certificate that is available at the first access point to the first LAN.
• the first access point can be any access point in whose reception range the device is located. For example, in an urban environment, the first access point can be operated by a neighbor of the user of the device.
• the first access point allows a first (temporary and / or restricted) Access to a LAN and above it to a WAN can be made possible. For full access to a LAN and / or to a WAN, it may be necessary that the device is (automatically) connected to a second access point (e.g. to an access point of the user).
• the method can include determining at least one network unit for which the device is authorized to access via the first LAN.
• the network unit can display at least one second access point to a second LAN.
• This information can, for example, be stored in a user account of the user of the device on the network unit.
• the access data to the second access point can be stored in the user account (e.g. the PSK to the second access point).
• a communication connection can then be established between the device and the network unit via the first access point in order to enable the device to obtain the access data for the second access point from the network unit.
• Automatic “reassignment” of the device from the first LAN to a second LAN can then be made possible, in particular in order to give the device within the second LAN unrestricted access to a LAN and / or to the WAN (for example the Internet) enable.
• the convenience for the user can be further increased through the automatic integration into a second LAN.
• the integration into the second LAN can be carried out, for example, to enable the user to control the device remotely (e.g. with a user device, e.g. a smartphone belonging to the user, which is integrated into the second LAN).
• the device can be checked whether the device is to be remotely controlled by a user device.
• the LAN into which the user device is integrated can then be determined.
• the device can then be automatically integrated into the second LAN in order to enable remote control of the device by the user device.
• These method steps can be carried out, for example, by an access point and / or by the device.
• a (possibly computer-implemented) method for integrating a device into a LAN is described. The method can be carried out by the device.
• the device has a certificate (for example on a TPM) that was derived from a device reference certificate.
• the method comprises identifying a first access point for a first LAN at which a reference certificate is available which matches the certificate of the device, in particular which corresponds to the device reference certificate.
• a suitable first access point which has the appropriate reference certificate.
• the search for a suitable first access point can be initiated automatically by the device (without user interaction), e.g. when the device is started up for the first time.
• the method also includes integrating the device into the first LAN via the first access point.
• the device can connect to the first access point.
• the access point can then enable (possibly restricted) access to the first LAN and / or to the WAN. This enables convenient and secure access of the device to a LAN and / or to a WAN.
• the method includes accessing a network entity through the first access point.
• the network unit (as already explained above) can display at least one second access point to a second LAN.
• Access data e.g. a PSK
• PSK PSK
• the device can then (automatically) be integrated into the second LAN (and into the WAN via the second access point) using the access data to the second access point.
• the device can (automatically) be logged off from the first access point.
• This enables (possibly full) access to a second LAN (for example to the user's LAN) and via this to the WAN in a particularly convenient and secure manner.
• the method can include setting up a communication connection to a network unit via the first access point.
• the method can include the carrying out of a maintenance measure on the device by the network unit accessing the device via the first access point. It can thus be made possible for an entity (for example the manufacturer of the device) to carry out maintenance measures in an efficient and secure manner.
• an access point (ie a device) to a LAN is described, the access point being set up to check whether a certificate of a device that is to be integrated into the LAN matches a reference certificate attached to the Access point is available.
• the access point is also set up to integrate the device into the LAN if it is determined that the certificate of the device matches a reference certificate available at the access point.
• the access point can be set up to allow at least restricted access to a WAN (e.g. to a restricted list of network units (e.g. servers and / or URLs (Uniform Resource Locator)).
• the resources that a device with a specific certificate of an entity is allowed to use in the LAN and / or in the WAN can be stored on the access point and / or be permanently linked to a respective reference certificate on further routing components of the LAN.
• This means that access can be automatically restricted based on the device's association with an entity. For example, a household appliance can only be authorized to establish a connection with just a single server on the Internet, e.g. the backend of the manufacturer of the household appliance.
• a user or a network administrator can be shown an overview of which reference certificates are available on an access point. Furthermore, the linked authorizations (URLs, servers, protocol variants and the like) can be displayed in this representation.
• the user or administrator can be given the option of downloading, installing, deleting, activating and / or deactivating certain reference certificates (from certain entities) via the user interface. With the deactivation or removal of a reference certificate, any authorization of all devices currently connected to the access point (which are assigned to the deleted reference certificate) typically expires immediately. In particular, the connection to the LAN for these devices can be interrupted.
• a device which has a certificate that was derived from a device reference certificate.
• the device is set up to identify a first access point for a first LAN at which a reference certificate is available which matches the certificate of the device, in particular which corresponds to the device reference certificate.
• the device is further configured, in response to this, to bring about an integration into the first LAN via the first access point.
• FIG. 1 shows a block diagram of a system for integrating a device into a LAN
• FIG. 2a shows an exemplary certificate list
• FIG. 2b shows an exemplary certificate chain
• FIGS. 3a and 3b are flow charts of exemplary methods for integrating a device into a LAN.
• FIG. 1 shows an exemplary system 100 with a LAN-compatible device 130.
• the system 100 comprises a first access point 110 (eg a router) to a first (W) LAN 111 and a second access point 120 (eg a router) to a second (W) LAN 121.
• the device 130 can comprise a communication module 132 which enables the device 130 to be connected to the first LAN 111 (for a first LAN connection 112) and / or to the second LAN 121 (for a second LAN connection 122).
• the device 130 can have a control module 131, which is designed to control actions of the device 130.
• the access points 110, 120 can each be set up to set up a communication connection 113, 123 to a network unit 102 (e.g. with a server, e.g. in a cloud) in a wide area network, WAN, (e.g. the Internet).
• the LANs 111, 121 can include, in particular be, wireless LANs (WLAN).
• This document describes a method in which a network device 130 automatically receives, possibly full, network access and at least one access to a remote network unit 102 (e.g. to a network unit 102 of a manufacturer of the device 130).
• a network access set up automatically in this way can be used by the network unit 102 to provide one or more services, such as a firmware update of the device 130, for example.
• This can, if necessary, be set up and / or offered automatically without interaction with the user, e.g. when the device 130 is started up for the first time (possibly only with the consent of the user).
• auxiliary LAN 111 e.g. via the LAN 111 of a neighbor.
• the auxiliary access point 110 can be limited to enabling the connection of the device 130 to the network unit 102.
• the device 130 can be linked to one or more user accounts of the user (on the network unit 102) via a method such as the OAUTH (Open Authorization) Device Grant.
• the device 130 can optionally also receive access information to the network infrastructure, in particular to the access point 120, of the user.
• the device 130 can be integrated into the LAN 121 of the user. The previously possibly isolated and / or restricted ok
• (W) LAN access via the auxiliary access point 110 can thereby be converted to unrestricted access by the device 130 via a second access point 120.
• the device 130 is then a full-fledged, authenticated network device in the (W) LAN 121 of the user.
• a method is thus described with which a network-capable device 130 can be initially integrated into an (auxiliary) network 111, if necessary without interaction with a user, and automatically receives one or more authorizations for a specific resource 102, for example on a specific computer on the Internet. In particular, it can be conveyed to a user which device 130 has access to which resource 102.
• An entity e.g. the manufacturer of a device 130 or the WIFI Alliance, can provide an infrastructure for private keys through which certificates are issued.
• the certificates issued preferably correspond to a common standard, e.g. x.509. Certificates can then be stored (suitably coded) on the components involved, in particular on one or more devices 130 and on one or more access points 110, 120.
• Private keys can be stored securely on so-called Trusted Platform Modules (TPM) and, if necessary, can be generated on the respective TPMs.
• TPM Trusted Platform Modules
• the PKI Public Key Intrastructure
• All other certificates can be derived from the root certificate via one or more intermediate certificates (possibly also multi-level).
• a certificate tree can be created which is one-to-one for the devices 130 of the respective group, and the leaves of which are specific subtrees (for example "Factory 1", "Factory 2"). , ...) can be assigned.
• the certificate tree of an entity (for example a manufacturer) can have a root certificate from which all certificates of the group of devices 130 of the entity are derived.
• the certificates and / or intermediate certificates can be created with suitable metadata, by means of which, for example, information on the respective issuing entity of the respective certificate is provided.
• the validity of a certificate can be checked at any time using suitable protocols and / or services such as OCSP (Online Certificate Status Protocolj-Responding and / or OCSP-Stapling. Furthermore, the exchange of certificates in different network devices 130 can be carried out using suitable, possibly standardized Methods to be implemented.
• suitable protocols and / or services such as OCSP (Online Certificate Status Protocolj-Responding and / or OCSP-Stapling.
• OCSP Online Certificate Status Protocolj-Responding and / or OCSP-Stapling.
• the exchange of certificates in different network devices 130 can be carried out using suitable, possibly standardized Methods to be implemented.
• a network device 130 can be provided with a digital identity and with at least one certificate, for example during manufacture.
• the certificate can be signed by one of the intermediate certificates of the corresponding subtree of the certificate tree and securely stored in the device together with the private key within a suitable memory (e.g. a TPM).
• the certificate chain can be stored in the device 130 up to the root certificate or up to a reference certificate derived from the root certificate and can, for example, be transmitted to an access point 110, 120 when establishing a connection, or can be transferred to the access point 110, 120 via another mechanism be made known.
• the Internet address under which the respective root certificate can be called up can also be stored in the certificate of the device 130.
• the root certificate or the reference certificate derived from the root certificate for a group of devices 130 can be provided in one or more access points or routers 110, 120.
• the manufacturers or the WIFI Alliance participating in the system 100 can transmit copies of their respective root certificates (or reference certificates derived therefrom) to the access points or routers 110, 120 in a suitable manner. Similar to the certificate store of a web browser, an access point 110, 120 thus receives information about
• Trust relationships which, if necessary, can already be established when the access point 110, 120 is established.
• 2a shows an exemplary list 200 with one or more master or reference certificates 201 for corresponding one or more entities (eg manufacturer).
• entities eg manufacturer
• at least one network unit 102 for example at least one Internet server
• the one or more network units 102 can be listed within the list 200 in a field 202 for access rights.
• the certificate chain 210 shows an exemplary certificate chain 210 with one or more intermediate certificates 212 between the device reference certificate 211 of an entity and the certificate 213 of the device 130.
• the certificate chain 210 can be stored on the device 130. All intermediate certificates 212 and the device certificate 213 are derived sequentially from the device reference certificate 211.
• the device reference certificate 211 of an entity e.g. a device manufacturer
• different device certificates 213 for different devices 130 can be derived from the reference certificate 211 and / or from an intermediate certificate 212.
• a device 130 can, if necessary, begin using a suitable method, for example the Device Provisioning Protocol (DPP), to search for a suitable access point 110 in which the root or reference certificate 201, 211 is stored for the certificate 213 of the device 130.
• DPP Device Provisioning Protocol
• the exact procedure is specified by the protocol used in each case.
• a secure LAN connection 112 to the access point 110 can be established with the aid of the public key and the respective certificate chain 210 can be transmitted.
• the certificate chain 210 provided has a sufficient depth to enable the access point 110 to be able to assign the certificate chain 210 provided by the device 130 to an internally existing root certificate 201. If the certificate chain 210 could be successfully assigned, at least one resource 102 can then be released for the device 130.
• Device 130 can be provisioned with dynamically determined data from higher protocol layers.
• the authorization required for this can be provided, for example, by a shared secret (which, however, requires the previous exchange of the secret, eg a password).
• an access authorization can be granted automatically (without prior exchange of a secret). In this way, a connection can be set up in a particularly convenient and efficient manner. In particular, after the device 130 has been switched on, the connection 112 to the access point 110 can be set up automatically, and the access point 110 then automatically grants access to higher-level protocols and / or access to one or more specific routing destinations 102.
• a network device 130 from a manufacturer known to the access point 110 can be automatically activated for (at least or precisely) one network unit 102 explicitly specified in the master or reference certificate 201, 211, for example. No user interaction is required for access to the network unit 102.
• access to other resources for example the local internal network 110 and / or other destinations / endpoints in the Internet, can be prevented.
• 211 it can be recorded which one or more Internet addresses (“domain names”) the devices 130 of a specific root certification authority or a specific entity should have access to. Access can then be restricted by the access point 110 to the explicitly specified Internet addresses. Data traffic originating from a device 130 to other addresses or via other protocols can then be automatically discarded by the access point 110.
• domain names the devices 130 of a specific root certification authority or a specific entity should have access to.
• Access can then be restricted by the access point 110 to the explicitly specified Internet addresses.
• Data traffic originating from a device 130 to other addresses or via other protocols can then be automatically discarded by the access point 110.
• the data traffic of the device 130 can be automatically blocked by the access point 110.
• the user can a selection is offered as to whether the device 130 concerned should be authorized manually.
• the device 130 can make a selection for the preferred access point 110, 120 using a suitable method (e.g. depending on the respective highest signal strength and / or the highest data rate) meeting. In this case, it may also be possible to select an access point 110, 120 that is not operated by the user (but, for example, by a neighbor).
• a suitable method e.g. depending on the respective highest signal strength and / or the highest data rate
• a subsequent integration into a further second LAN 121 can take place (e.g. to enable unrestricted integration and / or unrestricted access).
• the second LAN 121 can be the LAN operated by the user.
• WPS Wi-Fi Protected Setup
• the WIFI password can be entered and / or any other method such as captive portal and soft access point can be used.
• the user can be provided with a user account on the network unit 102, in which, for example, the access point 120 of the user is registered.
• An access point assignment including the access data of the one or more network devices 130 of the user to a specific access point 120 can be managed in the user account. It can thereby be made possible to integrate a device 130, which is initially connected to the network unit 102 via an external access point 110, into the user account.
• the OAUTH Device Grant method for example, can be used for this purpose.
• the network unit 102 can select a suitable access point 120 for the device 130 (eg depending on the signal strength of the possible access points 120 observed by the network device 130).
• the access data required for access to the selected access point 120 can then be transmitted to the network device 130.
• the device 130 can then automatically connect to the access point 120.
• it can be made possible for a user to configure an access point 110, 120 manually (via a user interface).
• a user can access an access point 110, 120 via a user device 140 (for example a smartphone or a computer) (for example via a LAN connection 124) in order to obtain the list 200 with one or more root or reference certificates 201, 211 and / or with entries 202 for the access rights to one or more network units 102.
• a user device 140 for example a smartphone or a computer
• a LAN connection 124 for example via a LAN connection
• An access point 110, 120 can, for example, provide the user with an overview (e.g. via the user interface), e.g. with the following information and / or with the following options:
• the one or more installed root or reference certificates 201 can be displayed;
• One or more parameters for each root or reference certificate 201 or the necessary authorizations for this can be displayed, e.g .: end point (s) 102 in the Internet, data rate, services, protocols, required resources, etc .;
• a status per network device 130 can be displayed, eg connection active, current data rate, accumulated data volume, services used (“manufacturer backend”, “time server”, 7), error states (“master or reference certificate expired”,. ..); and or
• a general setting can be made, such as a notification setting when a new device 130 has connected using the method described or wishes to establish a connection.
• This information can optionally be retrievable in the local network 111, 121 via methods and protocols, for example uPNP or HTTP, and can optionally be evaluated and changed by suitable agents, mobile devices 140, web browsers or the like.
• the measures described in this document can enable a user of a device 130 to integrate the device 130 into a LAN 111, 121 in a particularly convenient and secure manner and, if necessary, to connect it to a network unit 102 in a WAN (e.g. for maintenance activities , for a firmware update, etc.).
• FIG. 3a shows a flowchart of an exemplary method 300 for integrating a device 130, in particular a domestic appliance, for example a food processor, an oven, a washing machine, a stove, a refrigerator, a dishwasher, a dryer, etc., into a local area network (LAN) 111, and possibly over it in a WAN.
• the method 300 can be carried out by an access point 110 (in particular by a router) to a LAN 111.
• the access point 110 can be designed to provide a wireless LAN (WLAN).
• WLAN wireless LAN
• the device 130 can have a certificate 213 which was derived from a device reference certificate 211.
• the certificate 213 of the device 130 can have been generated from the device reference certificate 211 via a certificate chain 210 (with one or more intermediate certificates 212).
• the device 130 can be designed to provide the certificate chain 210.
• the certificate 213 of the device and the certificate chain 210 that may be kept available can be stored on a Trusted Platform Module (TPM) of the device 130.
• TPM Trusted Platform Module
• the method 300 comprises checking 301 whether the certificate 213 of the device 130 matches at least one reference certificate 201 that is available at a first access point 110 to a first LAN 111. In particular, it can be checked whether the device reference certificate 211 of the entity (ie the reference certificate 201, 211 from which the certificate 213 of the device 130 was derived) is available at the first access point 110.
• a list 200 with one or more reference certificates 201 can be stored on a storage unit, in particular on a TPM, of the first access point 110.
• At least one network unit 102 can be specified for each reference certificate 201 (as list entry 202), for which access via the first access point 110 is enabled if the device 130 has a certificate 213 that matches the respective reference certificate 201.
• Access points 110 in particular routers can thus be provided which enable automatic (limited) LAN and possibly Internet access for selected devices 130.
• the method 300 further includes integrating 302 the device 130 into the first LAN 111 if (possibly only if) it is determined that the certificate 213 of the device 130 matches at least one reference certificate 201 available at the first access point 110.
• the integration 302 can take place automatically without the user of the device 130 having to make an entry. Convenient and secure access to a LAN 111 and / or to a network unit 102 in a WAN can thus be made possible.
• FIG. 3b shows a flowchart of an exemplary method 310 for integrating a device 130 into a LAN 111, 121 and / or into a WAN.
• the method 310 can be carried out by the device 130 in a complementary manner to the method 300.
• the device 130 has a certificate 213 which was derived from a device reference certificate 211 of an entity.
• the method 310 comprises the identification 311 of a first access point 110 for a first LAN 111 at which a reference certificate 201 of an entity is available which matches the certificate 213 of the device 130, in particular which corresponds to the device reference certificate 211.
• the device 130 can, if necessary, contact several different access points 110, 120.
• the certificate 213 of the device 130 (in particular the certificate chain 210 of the device 130) can then be sent to the respective access point 110, 120.
• the respective access point 110, 120 can then check whether the reference certificate 201 that matches the certificate 213 (in particular the device reference certificate 211) is available on the respective access point 110, 120.
• the process of identifying 311 a suitable access point 110 can be initiated automatically by the device 130 (without input by the user), for example when the device 130 is started up.
• the method 310 further comprises integrating 312 the device 130 into the first LAN 111 via the (identified) first access point 110. This enables convenient and secure access to a LAN 111 (in particular a WLAN).

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• Theoretical Computer Science (AREA)
• Power Engineering (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Software Systems (AREA)
• Mobile Radio Communication Systems (AREA)
• Small-Scale Networks (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=76250294

Family Applications (1)

Country Status (5)

Family Cites Families (11)

• 2020
  • 2020-06-04 DE DE102020207033.4A patent/DE102020207033B4/de active Active
• 2021
  • 2021-05-25 CN CN202180040167.9A patent/CN115769203A/zh active Pending
  • 2021-05-25 WO PCT/EP2021/063792 patent/WO2021244890A1/de unknown
  • 2021-05-25 US US18/007,591 patent/US20230198976A1/en active Pending
  • 2021-05-25 EP EP21729436.2A patent/EP4162378A1/de active Pending

Also Published As

Similar Documents

Legal Events