WO2017064009A1

WO2017064009A1 - Method and apparatus for refreshing a first joint secret, in particular a symmetrical cryptographic key, between a first node and a second node of a communication system

Info

Publication number: WO2017064009A1
Application number: PCT/EP2016/074224
Authority: WO
Inventors: Timo Lothspeich; Andreas Mueller
Original assignee: Robert Bosch Gmbh
Priority date: 2015-10-15
Filing date: 2016-10-10
Publication date: 2017-04-20
Also published as: DE102015219989A1

Abstract

The invention relates to a method (20) for renewing or refreshing a first secret shared between a first node and a second node of a communication system, characterized by the following features: the first node recognizes a predetermined trigger event (21), the first node obtains (22) a secret bit sequence jointly with the second node, the first node combines (23) the first secret with the bit sequence to produce a second secret, and the first node replaces (24) the first secret by the second secret.

Description

description

title

A method and apparatus for refreshing a shared secret, in particular a symmetric cryptographic key, between a first node and a second node of a communication system

The present invention relates to a method for renewal or

Refreshing a shared secret, especially one

symmetric cryptographic key, between a first node and a second node of a communication system. The present invention also relates to a corresponding device

corresponding computer program and a corresponding

Storage medium. The two nodes or subscribers communicate via a shared transmission medium. Here are logical bit sequences - or more generally: value sequences - by appropriate

Transferring transmission as signals or signal sequences physically.

The underlying communication system can, for. B. be a CAN bus. This provides for a transmission of dominant and recessive bits or correspondingly dominant and recessive signals, whereby a dominant signal or bit of a participant of the network intersperses against recessive signals or bits of other participants. A state corresponding to the recessive signal is established on the transmission medium only if all participants actively involved provide a recessive signal for transmission or if all participants transmitting simultaneously transmit a recessive signal level. State of the art

Secure communication between different devices is becoming increasingly important in an increasingly networked world, and is present in many

Areas of application are an essential prerequisite for the acceptance and thus the economic success of the corresponding applications. This includes - depending on the application - different protection goals, such as

for example, the confidentiality of the data to be transmitted, the mutual authentication of the nodes involved or the assurance of data integrity.

To achieve these protection goals are usually appropriate

Cryptographic methods are used, which can generally be subdivided into two different categories: on the one hand, symmetrical methods in which the sender and receiver have the same cryptographic key, and on the other asymmetrical methods in which the sender assigns the

transferring data with the public - d. H. also known to a potential attacker - key of the recipient is encrypted, but the decryption can only be done with the associated private key, which ideally is known only to the recipient.

One of the disadvantages of asymmetric methods is that they usually have a very high computational complexity. Thus, they are only conditionally for resource-constrained nodes such. As sensors, actuators o. Ä., Which usually have only a relatively low computing power and low memory and energy-efficient work, for example due to battery operation or the use of the so-called "energy harvesting." In addition, there is often only a limited range to

Data transfer available, which makes the exchange of asymmetric keys with lengths of 2048 bits or even more unattractive.

For symmetric methods, on the other hand, it must be ensured that both the receiver and the sender have the same cryptographic key feature. The associated key management generally represents a very demanding task. In the area of mobile telephony, for example, keys are inserted into a mobile telephone with the aid of SIM cards, and the associated network can then assign the unique identifier of a SIM card to the corresponding key. In the case of a wireless local area network (WLAN), on the other hand, a manual input of the keys to be used - usually by the input of a password - often occurs when the network is set up. Such

However, key management quickly becomes very time-consuming and impractical if you have a very large number of nodes, for example in a sensor network or other machine-to-machine

Communication systems, eg. B. CAN-based vehicle networks. In addition, a change of the keys to be used - for example in the context of a regular recalculation or "re-keying" - often not possible at all or only with great effort.

DE 10 2012 215326 AI describes a suitable for such a re-keying method for generating a cryptographic key in a network with a first network element, a second network element and a network node, wherein the first network element via a first transmission channel and the second network element via a second transmission channel can communicate with the network node. The

Method comprises on the side of the first network element a step of determining a first channel information with respect to the first

Transmission channel based on one of the network node

a transmitted first pilot signal and a step of obtaining the symmetric cryptographic key using the first channel information and combined channel information information, wherein the combined channel information includes a second pilot signal transmitted from the network node to the network node and one of the network node second network element to the network node transmitted third pilot signal certain combination of transmission characteristics of the first and the second

Represents transmission channel. Disclosure of the invention

The invention provides a method for renewing or refreshing one between a first node and a second node of a

A shared secret communication system, a corresponding apparatus, a corresponding computer program, and a corresponding storage medium according to the independent claims.

An advantage of this solution is its particular suitability for symmetric cryptosystems. The inventive method is characterized in particular by an extremely low complexity and ease of implementation in practical systems, in particular in vehicle or

Automation networks. In addition, a scalable security can be realized flexibly.

This makes it possible, depending on the specific security requirements of an application or a controller flexible the life of a shared secret, in particular a symmetrical

cryptographic key, set and appropriate to refresh if necessary. The regular renewal or refreshment of keys makes it difficult u. a. various attacks - eg. For example, plaintext attacks, side channel attacks, etc. - and can lead to the realization of a perfect forward

Secrecy (PFS).

The invention is suitable for many wired

Communication systems, especially in vehicle and automation networks such as CAN, TTCAN, CAN FD and LIN, but also for other bus systems such. B. I ² C or certain wireless communication systems. Accordingly, there are numerous potential applications in practice. The measures listed in the dependent claims advantageous refinements and improvements of the independent claim basic idea are possible.

Brief description of the drawings

Embodiments of the invention are illustrated in the drawings and explained in more detail in the following description. It shows:

1 shows an advantageous arrangement based on a linear bus (eg CAN) with an already established common secret, in particular a symmetric cryptographic key K, between a first and a second node.

2 shows the flowchart of a method according to an embodiment of the invention.

FIG. 3 shows the arrangement under consideration after the successful refreshing of the shared secrets, in particular symmetric cryptographic keys, between the first and second nodes.

Embodiments of the invention

It is considered an arrangement according to Figure 1, in which a first node 11, a second node 12 and a third node 13 and a fourth node 14, which are not required for the actual process, via a shared transmission medium 10 - here a linear Bus - can communicate with each other. The nodes could be, for example, control units in a vehicle which communicate with one another via a CAN, TT-CAN, CAN-FD or LIN bus. To secure the communication between the first node 11 and the second node 12, they already have a first shared secret A ', in particular a symmetric cryptographic key. It does not matter how this first shared secret K has been established. This could, for example. using the method described below, but also with alternative key establishment mechanisms - e.g. B. a Diffie-Hellman key exchange - or by means of a manual introduction of the

corresponding secret K in the first node 11 or the

second node 12.

The first secret K should now be suitably refreshed to limit its life and thus increase the level of security that can be achieved. This should be done in such a way that the other subscribers - here: the third node 13 and the fourth node 14 - who also have access to the shared transmission medium 10, do not know the new secret - in the following: second secret Jf _R - without further ado (can). The basic procedure according to the invention for this purpose is designed as shown in FIG. 2:

The refresh phase is triggered by a specific trigger event 21. Here, various trigger events 21 are conceivable, such. B. event-based triggers, z. B. when starting or stopping a vehicle, time-based triggers, z. Recurring after X days, hours or months, and communication-based triggers, e.g. B. after F frames or a certain volume of data have been backed up with the first secret K. Also considered is the detection of a state currently lower

Utilization of the communication channel. For example, it could be detected by a specific message pattern that the overall system -. B. vehicle - is in a state in which only a small

Utilization of the communication medium is expected.

After the occurrence of the trigger event 21 starts one of the two nodes 11, 12 - without restriction of generality z. B. the

first node 11 - at the next possible time - z. Example, if otherwise no communication takes place on the transmission medium 10 - the following procedure for establishing a shared secret between the first node 11 and the second node 12. This can, for example, by the sending of a special message or a special one

Message headers done.

Both the first node 11 and the second node 12 generate locally in a first substep - d. H. internal and independent - a bit sequence or bit string. The bit sequence is preferably in each case as a random or pseudo-random bit sequence, for example with the aid of a suitable random number generator or (cryptographically secure)

Pseudo-random number generator generated. For example, the first node 11 could be the bit string

and the second node 12 the bit string

S ₂ = (1,0,0,1, 0,0,0,1,1,0,1, 1, Ο ', Ι, Ο, Ο, 1, 0,, 1).

In a second substep, the first node 11 and the

second nodes 12 to each other largely synchronously their respective generated bit sequences on the shared transmission medium 10 using the transmission method with dominant and recessive bits or transmission states. Different possibilities for synchronizing the corresponding transmissions are conceivable. Thus, for example, either the first node 11 or the second node 12 could first send a suitable synchronization message to the respective other node and then start the transmission of the actual bit sequences after a certain period of time following the complete transmission of this message. Equally, however, it is also conceivable that only one suitable header (header) is transmitted by one of the two nodes - e.g. B. a CAN header consisting of Arbitrierungsfeld and control field - and during the associated Nutzdatenphase then both nodes 11, 12 at the same time transmit their generated bit sequences largely synchronously. In a Variant of the procedure, the bit sequences of the first node 11 or the second node 12 generated in the first sub-step can also be applied to several

Messages are transmitted distributed, for example, if this requires the Maximai sizes of the corresponding messages. In this variant too, the transmission of the correspondingly large number of bit sequences of the respective other node 12, 11 distributed in accordance with corresponding large messages takes place largely synchronously.

On the shared transmission medium 10, the two overlap

Bitsequences or the associated transmission states / signal levels then, due to the previously required property of the system with the

Distinguishing between dominant and recessive bits / transmission states, the individual bits of the first node 11 and the second node 12 result in an overlay. More specifically, A and B transmit signals modulated in accordance with their bit sequences which overlap to form an overall signal on the transmission medium. The total signal can then be converted by means of a suitable demodulation again into a (logical) bit sequence, which (in error-free case) for CAN just corresponds to the logical AND operation of the single bit sequences of A and B. This results in the

Transmission channel a corresponding overlay, which could also detect the listening third node 13, for example. The AND operation applies, for example, to CAN, because the dominant level is assigned a logical "0" and the recessive level is assigned a logical "1". For other communication systems, this association may be different or higher

Transmission methods give a different superposition.

As an example of a superposition bit string for the above local bit strings, the following effective bit sequence could result on the transmission channel:

Both the first node 11 and the second node 12 detect the effective superimposed bit sequences on the shared during the transmission of their bit sequences of the second substep in a parallel third substep Transmission medium 10. For the example of the CAN bus, this is usually done in conventional systems during the arbitration phase anyway, until a node loses the arbitration (higher CAN-ID) and stops sending. Among other things, the method presented here differs from the arbitration in that a node which sends a logical "1" and reads back a logical "0" from the channel does not stop sending. IDs but randomly generated bit sequences are transmitted and that these are transmitted both non-inverted and inverted In a fourth sub-step, both the first node 11 and the second node 12 likewise transmit their initials largely synchronously again

Bit sequences, but this time inverted. The synchronization of

corresponding transmissions can be realized again exactly in the same way as described above. On the shared

Communication medium, the two sequences are then back together

ANDed. The first node 11 and the second node 12 again determine the effective, superposed bit sequences _e g on the shared transmission medium 10. For the first node 11, the inverted bit sequence 5 _L = (1,04,1,0,04,0 , 0,0,1,1,04,0,0,14,0,1) and for the second node 12 the inverted bit sequence

= (044.0444,0,0,1,0,0,1,044,04,0,0). Thus, nodes 11, 12 would detect the following effective, superimposed bit sequence on the channel: ⁵ eff = $ 1 ^A ^ 2 = (0,0,1,0,0,0,1,0,0, 0,0,0 , 0,0,0,0,0, 1,0,0)

Both the first node 11 and the second node 12 determine during the transmission of their now inverted bit sequences then again the effective, superimposed bit sequences on the shared transmission medium 10. At this time, therefore, the first node 11, the second node 12 as well as a possible attacker -. B. the third node 13 -, the

Communication on the shared transmission medium 10 listens, the effective, superimposed bit sequences S _efi and S _e ' _S. In contrast to the attacker or third node 13, however, the first node 11 still knows its initially generated, local bit sequence and the second node 12 has its initially generated, local bit sequence. However, the first node 11 in turn does not know the initially generated, local bit sequence of the second node 12 and the second node 12 does not know the initially generated, local bit sequence of the first node 11. The detection of the overlay bit sequence again takes place during the transmission in a fifth sub-step.

As an alternative to this exemplary embodiment variant, the first node 11 and the second node 12 can also send their inverted, local bit sequence directly with or directly after their original, local bit sequence, ie. H. the fourth sub-step and the fifth sub-step take place with second and third sub-steps. The original and the inverted bit sequence can be transmitted in a message, but also in separate messages as part bit sequences. In a preferred embodiment, the first node A and the second node B may alternately transmit within a message a randomly generated bit and thereafter the correspondingly inverted bit. For example, instead of the original local bit string (0,0,1), the bit string (0,1,0,1,1,0) would be sent. The term "overlay phase" is to be understood in a broad sense, which definitely includes the case that in each phase only superimposed bit sequences of length 1, the two

Overlay phases in total, however, be repeated in an appropriate number. Furthermore, in addition to the bitwise alternating transmission of original and inverted bits, numerous other variants are conceivable without departing from the scope of the invention.

In a sixth sub-step, the first node 11 and the second node 12 now each locally - ie internally - the effective, superposed bit sequences 5 _eS and 5 ^, in particular with a logical ODE R function. The For example, the OR operation applies to CAN because the dominant level is assigned a logical "0" and the recessive level is assigned a logical "1". For other communication systems, this assignment may be different or, in the case of higher-value transmission methods, result in a different superimposition.

In the above example, the following combination would result in this way: s _sts = s _eE VS ^ _f = (ο, ο, ι, ο, ο, ο, ι, ι, ΐΑθ, ο, ο, ο, ο, ο, ο, ι, ι, ο)

The individual bits in the result from the OR operation

Bit sequence 5 _s now indicate whether the corresponding bits of 5 ₁ and 5 _{2 are} identical or different. The bit '1' in S _ges indicates that the bit is identical at the corresponding position in SA and SB, whereas the bit '0' indicates that the bit is at the corresponding position in SA and SB

is different. The first node 11 and the second node 12 are then deleted in a seventh sub-step based on the bit sequence obtained from the OR operation in their original, initial

Bit sequences All bits that are identical in both sequences. This consequently leads to correspondingly shortened bit sequences

S _lv = (0,1,0,1,1,1,0,0,1,0,1,1,0,0) and 5 _2ψ = (1,0,1,0,0,0,1 , 1,0,1,0,04,1).

The resulting, shortened bit sequences S _lf and S _2v are now just inverse to each other. Thus, the inversion of its truncated bit sequence allows the first node 11 and the second node 12 to determine exactly the truncated bit sequence already present in the other node 12, 11.

In one or more rounds, a predetermined number / of common secret bits is thus established by means of a public discussion at the first node 11 and second node 12, which is referred to below as bit sequence 5. It should be noted that the number of secret bits that can be generated in the above-explained basic procedure 22 may vary each round. Accordingly, enough rounds must be passed to obtain at least / common secret bits. Should the number of secret bits actually generated be greater than /, then In turn, various options conceivable: The obtained bit string is shortened to exactly / bits, z. By deleting single bits or, more generally, by means of a suitable function which maps the obtained bit string to a shortened bit string of length /, or it becomes simple with the actual extracted bit string of an exceeding length

further worked, even if this length can be different each time. Regardless of the option selected, the resulting bit string will be in

Further always referred to as Γ.

The first node 11 and the second node 12 combine (23) the first secret with the newly generated bit string T in a suitable manner and then obtain a refreshed second secret KR, for which the following relationship applies:

K _R = f (K, T)

In the simplest case z. For example, the contravalence f (K _r Τ ^' ) = Κ Τ, which can be implemented by a so-called XOR gate, is an option if K and Γ have the same length. A contravalence is true if and only if both of the statements associated with it have different truth values, that is, if either one or the other is true, but not both are true at the same time or both are false at the same time. Another advantageous realization would be z. The following: ftK, T) = h (K \ T)

It describes a cryptological hash function - z. For example, the function SHA-3 - standardized by the National Institute of Standards and Technology in the USA - and KI Γ the concatenation of the first secret K with Γ. Optionally, the first node 11 and the second node 12 finally ensure that the second secret K is actually the same on both sides. Due to practical effects - eg. As measuring errors, noise, etc. - or active attacks by other participants, it may in principle occur, namely that the newly generated bit string T and thus also the second

Secret K _{s are} not identical for the first node 11 and

second node 12 and thus can not be used meaningfully. For this purpose, the first node 11, the second node 12 or both the first node 11 and the second node 12 calculate a suitable characteristic value of the second secret K _s , which is then exchanged. In an advantageous implementation, such a characteristic value could be, for example, a shortened hash value of the second secret Jf _H. If this characteristic does not match, then in turn have different options, eg. For example, the procedure for

Mystery refreshment to repeat. If after L repetitions still no successful refreshing be possible, then one can

appropriate warning will be issued in case of a

Vehicle network, for example, a corresponding indication to the driver of the vehicle or the workshop or the manufacturer. According to an alternative possibility, the first secret K is used as a fallback solution.

Upon successful completion of the secret refreshment, the second secret K _{s will be used} to secure communication between the

first node 11 and second node 12 are used. This results in the arrangement according to FIG. 3.

As an alternative to the previously described method 20, the following are

Realizations for re-keying the secrets K of the first node 11 and the second node 12 conceivable:

The first node 11 and the second node 12 establish upon triggering of a trigger event 21 a completely new second secret Jf _H using the basic method described above, ie in particular the combination of the newly generated bits with the first secret K (step 23) is omitted ,

The first node 11 or the second node 12 first generates locally a random second secret fi _R. This second secret fi _R is then first using the - established according to the basic procedure 22 described above Secret K encrypted transfer. From then on either the directly transmitted second secret K _{s is} used or this second one

Secret ff _H is linked to the first secret K analogously to step 23 of method 20 described above and then used in the following as a basis for cryptographic methods.

This method 20 may be implemented, for example, in software or hardware or in a hybrid of software and hardware, for example in one

Be implemented control unit.

Claims

claims

A method (20) for renewal or refreshment of a between a

first node (11) and a second node (12) of a communication system (10 - 14) shared first secret (Α '), characterized by the following features:

the first node (11) detects a predetermined trigger event (21),

- the first node (11) wins (22) together with the

second node (12) a secret bit sequence,

the first node (11) combines (23) the first secret (K) with the

Bit sequence to a second secret (Α '^) and

- the first node (11) replaces (24) the first secret (K) with the second secret (A'R).

Method (20) according to claim 1,

characterized by the following features:

- The winning (22) of the bit string comprises a repeated addition of the bit string and

- The completion of the bit sequence is repeated as long as the bit sequence falls below a predetermined length.

Method (20) according to claim 2,

characterized by the following feature:

if the bit sequence obtained exceeds the length, the bit sequence is shortened to length, in particular by deleting individual bits of the bit sequence. Method (20) according to claim 2 or 3,

characterized by the following features:

- the first secret (K) has the length of the bit sequence and

- The combining (23) comprises a local XOR operation of the first secret (K) with the bit sequence.

Method (20) according to one of claims 1 to 4,

characterized by the following feature:

- The combining (23) takes place by a cryptological hash function, such as SHA-3, on a concatenation of the first

Secret (K) and the bit sequence is applied.

Method (20) according to one of claims 1 to 5,

characterized by the following features:

the first node (11) calculates a characteristic value, in particular a hash value, if necessary shortened, of the second secret (Kg) and

- Before replacing (24) of the first secret (K), the first node (11) compensates the characteristic value with the second node (12).

Method (20) according to claim 6,

characterized in that

if the characteristic does not match,

- obtaining (22) the bit sequence and combining (23) to the

second secret (A ^' R) are repeated and

- after a predetermined number of repetitions one

corresponding warning is issued.

A computer program configured to perform the method (20) of any one of claims 1 to 7.

Machine-readable storage medium on which the computer program

Claim 8 is stored. Apparatus (11, 12, 13, 14) arranged to carry out the method (20) according to any one of claims 1 to 7.