WO2017064010A1

WO2017064010A1 - Method for generating a secret code in in a network

Info

Publication number: WO2017064010A1
Application number: PCT/EP2016/074225
Authority: WO
Inventors: Florian Hartwich; Timo Lothspeich; Franz Bailer; Christian Horst; Arthur Mutter; Andreas Mueller
Original assignee: Robert Bosch Gmbh
Priority date: 2015-10-15
Filing date: 2016-10-10
Publication date: 2017-04-20
Also published as: DE102015220014A1

Abstract

The invention relates to a method for generating a secret code in a network (20), said network (20) having at least one first and one second subscriber (21, 22) with a common transmission channel (30) between at least the first and the second subscriber (21, 22) and an administrator (23). A secret code between the first and the second subscriber (21, 22) is obtained according to a method for generating a secret code based on a superimposition of dominant and recessive signals when they are initiated (C1.3) by the administrator (23).

Description

Description title

Method for generating a secret in a network

The present invention relates to a method for generating a secret in a network with at least two subscribers, as well as a network, a computing unit and a computer program for its implementation.

State of the art

In the subsequently published DE 10 2015 207 220 A1, the Applicant has proposed a method for generating a secret or key in a network, which uses a superimposition of signals of two subscribers on a common transmission medium. In this case, the network has at least a first and a second subscriber and a transmission channel between at least the first and the second subscriber. The first and second subscribers may each provide at least a first value and a second value to the transmission channel. The first subscriber and the second subscriber initiate a first subscriber value sequence or a second subscriber value sequence for transmission to the transmission channel which is largely synchronous with one another. On the basis of information about the first subscriber value sequence or the second subscriber value sequence and on the basis of an overlay value sequence resulting from a superposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel, the first subscriber or the second subscriber generate a shared secret or a common key.

Disclosure of the invention According to the invention, a method for generating a secret in a network with at least two subscribers, as well as a network, a computing unit and a computer program for carrying it out with the features of the independent patent claims are proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

In the context of the invention, methods are described in which by initiating a with two participants (eg, a control unit, a sensor or an actuator, in particular a motor vehicle, an industrial plant, a home automation network, etc.) in data transmitting connection standing administrator (eg higher-level control device o. Ä.) A common secret between the two participants of a network with a common transmission channel between at least the two participants is established. The administrator does not necessarily have to be different from the participants. Rather, some or all administration steps can also be performed by one of the participants.

The invention allows a defined sequence of secret generation even in real environments with numerous participants with possibly different hierarchy levels.

With the invention, it is possible to establish a shared secret between two different subscribers of a network, which can be used in particular for generating a symmetric cryptographic key. However, such a shared secret can in principle also be used for purposes other than cryptographic keys in the strict sense, e.g. as a one-time pad.

Preferably, a method for generating a secret based on a superimposition of dominant and recessive signals, for example, according to DE 10 2015 207 220 A1 is used, wherein the network at least a first and a second subscriber and a transmission channel between at least the first and the second subscriber having. The first and second subscribers may each provide at least a first value and a second value to the transmission channel. The first subscriber or the second subscriber initiate a first subscriber value sequence or a second subscriber value sequence for transmission to the transmission channel which is largely synchronous with one another. On the basis of information about the first subscriber value sequence or the second subscriber value sequence and on the basis of an overlay value sequence resulting from a superposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel, the first subscriber or the second subscriber generate a shared secret.

Particularly advantageously, the method can be used in a network in which there is a dominant value (physically: a dominant signal), which prevails when only one subscriber applies it to the transmission medium, and a recessive value (physically: a recessive signal ), which only results on the transmission medium if both or all participants transmit a recessive value. Because of the clearly defined overlay rules, the subscribers of such a network can derive from the resulting overlay value sequences particularly easily information for the generation of the secret.

Alternatively, the transmission of a recessive value of at least one of the subscribers can also be replaced by the fact that at this point the value sequence or, as one of the at least two possible values, nothing is transmitted.

The invention provides an approach for generating symmetric, cryptographic keys between two nodes by exploiting properties of the physical layer. The approach is particularly suitable for wireline and optical communication systems, provided that these 'on-off-keying' or a bitwise bus Support arbitration (eg CAN, TTCAN, CAN-FD, LIN, l ² C). But also in wireless, (radio based) communication systems, preferably with a very short distance between transmitter and receiver and a possible direct line of sight, the approach can be used. In principle, all communication systems that enable a distinction between dominant and recessive signals (as described above) are suitable for use. The methods described herein can be used in a variety of wireless, wired and optical communication systems. Of particular interest is the approach described here for the machine-to-machine communication, that is for the transmission of data between different sensors, actuators, etc., which generally have only very limited resources and may not be manageable with reasonable effort manually Field can be configured.

Further application possibilities are, for example, in home and building automation, telemedicine, car-to-x systems or industrial automation technology. Of particular interest is the use in future miniature sensors with radio interface as well as in all application areas of the CAN bus, i. in particular vehicle networking or automation technology.

An inventive participant, e.g. a control device, a sensor or an actuator, in particular a motor vehicle, an industrial plant, a home automation network, etc., is, in particular programmatically, configured to perform a method according to the invention.

Also, the implementation of the method in the form of a computer program is advantageous because this causes very low costs, especially if an executive controller is still used for other tasks and therefore already exists. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical memories, such as e.g. Hard drives, flash memory, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings. The invention is illustrated schematically by means of embodiments in the drawing and will be described below with reference to the drawing. Brief description of the drawings

Figure 1 shows schematically the structure of an exemplary, underlying communication system. Figure 2 shows schematically a linear bus as an example of an underlying communication system.

FIG. 3 schematically shows the sequence of a first preferred method for secret generation between two subscribers of a network.

FIG. 4 schematically shows the sequence of a second preferred method for secret generation between two subscribers of a network.

FIG. 5 schematically shows the sequence of a third preferred method for secret generation between two subscribers of a network.

FIG. 6 schematically shows the sequence of a fourth preferred method for secret generation between two subscribers of a network. FIG. 7 schematically shows the sequence of an exemplary method for encrypted communication between two subscribers of a network.

Figure 8 shows a preferred embodiment of a circuit arrangement which can be advantageously used for the invention.

Embodiment (s) of the invention

In the following, an arrangement is considered, as it is shown abstractly in FIG. Different participants 1, 2 and 3 can talk about such a shared shared medium 10 communicate with each other.

In an advantageous embodiment of the invention, this shared transmission medium corresponds to a linear bus (wired or optical) 30, as illustrated by way of example in FIG. A network 20 in FIG. 2 consists of precisely this linear bus 30 as a shared transmission medium (for example as a wired transmission channel), subscribers or nodes 21, 22 and 23 as well as (optional) bus terminations 31 and 32.

In the following, communication between the various nodes 21, 22 and 23 is assumed to be characterized by the distinction between dominant and recessive values. In this example, the possible values are bits '0' and '1'. In this case, a dominant bit (for example, the logical bit Ό ') may quasi supersede a simultaneously transmitted recessive bit (e.g., the logical bit Ύ).

Taking advantage of these characteristics of the transmission method of the communication system, a key generation between two subscribers of a corresponding network can now take place in that the subscribers detect a superimposition of bit sequences of the two subscribers on the transmission medium and from this information share information about the self-transmitted bit sequence (symmetric), generate secret key.

The transmission of values of different subscribers must have overlapping periods (ie be largely synchronous within the meaning of this application), so that a superposition of the individual signals of a signal sequence on the transmission medium takes place, in particular so that the signal corresponding to the n-th logical value or bit of the first subscriber with the signal corresponding to the n-th logical value or bit of the second subscriber at least partially superimposed. This overlay should be sufficiently long for the participants to be able to record the overlay or determine the corresponding overlay value. The superimposition value can be determined by arbitration mechanisms or by physical signal superposition. By arbitration mechanism is meant, for example, the case that a subscriber has applied a recessive level, but detects a dominant level on the bus and thus omits the further transmission.

From the resulting value sequence of the overlay (i.e., overlay value sequence) and its own value sequence (i.e., subscriber value sequence), the subscribers can then generate a key that is secret to an outside attacker. The reason for this is that the outside attacker, who can, for example, listen to the effective overall signals present on the shared transmission medium, only sees the superimposition of the value sequences, but does not have the information about the individual value sequences of the participants. Thus, the participants have more information that they can use against the attacker to generate a secret key.

An exemplary, particularly preferred realization is explained below with reference to FIGS. 3 to 6, in which different preferred variants of a method according to the invention for generating a secret between the two subscribers 21 and 22 ("Alice" and "Bob") in the network 20 under administration or administration of the acting as an administrator participant 23 ("Carol") are shown.

One or both subscribers 21 and 23 may, for carrying out the invention, have in particular a circuit arrangement 100 connected to a network or communication system embodied here as CAN bus 1, as shown in FIG. The illustrated CAN bus is a two-wire bus with two CAN-H (high) and CAN-L (low) lines. One

CAN bus with only one line is also possible. However, the invention can also be used for other communication systems that allow transmission of dominant and recessive signals. This is especially true for LIN or I ² C based communication systems. The circuit arrangement 100 is physically connected to the CAN bus 1 via a bus driver module or a transceiver module 90. The circuit arrangement 100 furthermore has a central processing unit embodied as a microprocessor 10, a network interface module designed here as a CAN controller 20, a security module 30, a transmitting and receiving module 40, a multiplexer or distributor module 50, a communication system ( Host IF (interface)) 60 and a security communication system (Secure IF) 70, for example in the form of an on-chip bus system or a crossbar.

The components 10 - 50 and communication systems 60 and 70 may also be part of a microcontroller 90, which is indicated in FIG. 1 by a dashed line.

The transceiver module 40 is configured to generate CAN frames for the purpose of secret network communication, to generate a shared secret between a subscriber including the circuitry 100 and another subscriber based on a random string representing the transmission Receiving and receiving module 40, in particular bitwise, receives from the security module 30.

The transmitting and receiving module 40 is configured here to transfer the CAN frames via connections Tx to the multiplexer module 50, which is connected to the bus driver module 90.

The CAN controller 20 is configured to generate CAN frames or messages for the purpose of non-secret-generating network communication and to transfer them to the multiplexer block 50 via connections Tx.

In contrast to the CAN controller 20, the transmitting and receiving module 40 is expediently configured to optionally cancel a transmission. omission if a bit other than CAN is read back from the CAN bus 1, as the transmitting and receiving module 40 has sent.

By appropriate (fixed or switchable) configuration of the multiplexer module 50, an optional connection of the CAN controller 20 and / or the transmitting and receiving module 40 to the bus driver module 90 can be made. In a simple embodiment, it may be a link in which the CAN controller 20 and the transmitting and receiving module 40 receive simultaneously, the receiving direction is thus linked in parallel, and can also send both, the transmission direction is therefore also linked in parallel. If desired, a signal flow control can be provided which prevents simultaneous transmission.

From the CAN controller 20 runs an optional trigger line to the transmitting and receiving module 40. This is used so that the CAN controller 20 can output a corresponding trigger signal to the transmitting and receiving module 40 when he requesting a secret generation message on the CAN bus 1 detects. Alternatively, the transmitting and receiving module is set up to listen to the normal communication on the CAN bus 1 and interpret the messages themselves suitable. Thus, upon detection of a message requesting a secret generation, the send and receive module 40 may itself start the secret generation. The trigger line can be omitted in this embodiment. In a preferred embodiment, the trigger signal is output from the central processing unit or the security module via its own trigger line or preferably via the communication system (host IF or secure IF).

For a conventional transmission process, the central processing unit 10 writes the payload (in particular the identifier, the determination whether this frame is a data or remote transmission request frame, the specification of how many data bytes are to be sent and the data bytes to be sent) in the Transmit data buffer of the CAN controller 20, which then prepares for transmission on the bus 1 and transmits the entire frame to the transceiver block 90, which is responsible for the direct bus connection. That is, the CAN controller 20 relieves the central processing unit 10 of all data transfer work, since it independently takes over the compilation of the message, the calculation of the CRC sum, the access to the bus (the bus arbitration), the transmission of the frame and the error check.

Secret generation can now be e.g. be triggered by receiving a message requesting a secret generation.

According to a preferred embodiment of the invention, the security module 30 is configured to generate a random bit sequence as a character string by means of a preferably non-deterministic random number generator and to transmit it bit by bit to the transmitting and receiving module 40.

The transmitting and receiving module 40 accepts the individual bit values of the bit sequence as the first sub-value sequence and inverts it to generate a second sub-value sequence. Subsequently, a subscriber value sequence for the transmission to the CAN bus 1 is generated from the first partial value sequence and the second partial value sequence in accordance with a design specification. According to a particularly preferred design rule, one bit each of the first partial value sequence and the associated inverted bit of the second partial value sequence are combined into bit pairs and transmitted immediately one after the other.

When superimposed with a bit pair of a second user, this results in the resulting overlay bit pair consisting of two dominant bits ('00' in CAN) if the bits of the two users are different and the overlay bit pair is identical to the bit pair, if the bits of the respective first partial value sequence of the two subscribers are identical. The overlay bit pairs are read back in the embodiment shown by the transmitting and receiving module 40. Alternatively, reading back via the CAN controller 20 is also possible.

The overlay bit pairs can be transmitted to the security module 30 (eg, by the send and receive module 40 or the CAN controller 20) and evaluated there. Alternatively, the transmitting and receiving module 40 be set up for evaluation. In particular, the evaluation includes checking the number of recessive bits in each overlay bit pair (and, in the case of the transmit and receive module 40, returning it to the security module 30). The number can be 0 or 1, in the variant described here 0 means that the bit of the other user differs from the bit of the bit sequence just transmitted, and 1 means that the bit of the other user is identical to the one just transmitted Bit of the bit string is.

In this way, the security module 30 can determine the subscriber value sequence of the second subscriber and then, in particular according to the initially referenced DE 10 2015 207 220 A1, generate a shared secret with the second subscriber.

In FIGS. 3 to 6, the administration steps of the subscriber 23 are respectively shown in the left-hand column of the figure and the steps executed by the two subscribers 21, 22 are shown in the right-hand column of the FIGURE. Participants 21 and 22 execute their respective identically named steps simultaneously or substantially simultaneously (possibly with a slight jitter). Information exchanged between the administrator on the one hand and the two participants on the other hand is also shown between the columns.

In a first administration step C1.1, subscriber 23 sends to subscriber 21 and subscriber 22 a request that they should establish a shared secret:

This step can be realized, for example, via a request message that is sent via the shared communication medium. The request message can be generated in a sequence control (for example within a microprocessor or within an optionally present security module and sent to a component for transmission.

This component can be, for example, a conventional network interface module (eg CAN controller) or a transceiver module that is specific to the secret generation. These It is expedient for components to communicate with a bus driver module which handles the physical communication.

Alternatively, the component for transmission can also have a computing unit and be designed or set up to generate the prompt message itself.

It should be noted that it is not necessary to use the shared communication medium to transmit the request message or to use the same delivery option for subscriber 21 and subscriber 22.

In an administration step C1.2, subscriber 23 receives a feedback from both subscriber 21 and subscriber 22 that they are ready to establish the shared secret:

This step may, for example, be realized via a return message received via the shared communication medium. The feedback message can be received via the component for transmission and (if necessary) via a suitable subscriber-internal interface to a computing unit (eg microprocessor or security module). Alternatively, the component for transmission can also have a computing unit.

It should be noted that it is not necessary to use the shared communication medium to transmit the return message or to use the same transmission option for subscriber 21 and subscriber 22. It is also not necessary to use the communication medium used in step C1.1.

Preferably, in this step C1.2, an abort criterion is implemented in order to abort the process, for example if the return message is too long ("timeout") or if an abort message is received instead of the return message (C1.5). In an administration step C1 .3, the procedure for generating the key is initiated in the two subscribers. This can be realized via an initiation message. With regard to the transmission of this initiation message, that already applies to the request message and the confirmation message.

In an optional administration step C1.4, subscriber 23 receives a completion message which indicates the successful completion of the secret generation by subscriber 21 and subscriber 22. Then the process ends.

In an optional administration step C1.5, instead of the reply message, subscriber 23 receives no message ("timeout") or an abort message from subscriber 21 and / or subscriber 22 that the establishment of the shared secret has been aborted (i.e., unsuccessful). Then the process ends. In addition, subscribers 21 and 22 can be informed of the cancellation.

In the following, the steps performed by subscriber 21 and subscriber 22 will be explained, the temporal order of which results from the figures.

In a first step A & B1.1, participants 21 and participants 22 of participant 23 receive the request that they should establish a shared secret.

This step can - as explained, be realized via the request message. The request message can be received via the component for transmission and (if necessary) via a suitable subscriber-internal interface to a computing unit (eg microprocessor or security module). Alternatively, the component for transmission could also have a computing unit. In a step A & B1.2, participants 21 and participants 22 first check whether they themselves are affected by the request. If they are not affected, the process ends.

A suitable interpretation of the request from step A & B1.1 can take place in a computing unit. This can be implemented in the microprocessor, in the security module or in the component for transmission. For this purpose, the message may need to be forwarded by the component for transmission to the arithmetic unit via a corresponding subscriber-internal interface (for example Host IF or Secure IF).

In an optional step A & B 1.3, preparatory tasks are performed by participant 21 and participant 22.

In this step, if necessary, additional configurations / settings (for example for the component for transmission) can be carried out and / or, for example, additional information (for example random bit string) can be generated and / or provided. In an advantageous implementation, the random bit string is generated by the security module and made available for transmission via a suitable interface (eg secure IF) of the component. Alternatively, it is also conceivable that the random bit string is generated by the microprocessor or the component for transmission itself.

In a step A & B1.4, it is confirmed to subscriber 23 that subscriber 21 and subscriber 22 are ready to generate the shared secret.

This step can - as explained - be realized via the feedback message. The feedback message may be generated in a sequencer (eg within a microprocessor or within an optionally existing security module and sent to a component for transmission.) These components expediently communicate with a bus driver module that handles the physical communication. Alternatively, the component for transmission can also have a computing unit and be designed or set up to generate the feedback message itself.

In a step A & B1.5, the method for generating the key in subscriber 21 and subscriber 22 is initiated. This can be done - as explained - by the kick-off message from participant 23. For the receipt of the kick-off message that already applies to the request message and feedback message applies. If the initiation message is received by a network interface module as a component for transmission, the network interface module can forward a subscriber-initiated initiation message ("trigger signal") to a transmitting and receiving module. Alternatively, the initiation message can be forwarded to a suitable arithmetic unit (for example microprocessor or security module) which interprets the initiation message and then, in turn, transmits the information about the abutment to the send and receive module via a suitable subscriber-internal interface (host IF or secure IF).

Preferably, an abort criterion is implemented in this step in order, for example, to abort the process if the abortion is too long ("timeout") after the request (A & B1.6).

In an optional step A & B1.6, subscriber 21 and subscriber 22 receive no message ("timeout") or subscriber 21 and / or subscriber 22 inform subscriber 23 that the establishment of the shared secret has been aborted (for any reason) instead of the initiate message (ie was not successful). Then the process ends.

In an optional step A & B1.7, it is possible to wait for the expiration of a (possibly previously configured) waiting time before proceeding to step A & B1.8. The waiting process can be implemented in particular in the transmitting and receiving module. The waiting time may be, for example, in the form of a time unit (relative: "wait for x seconds" - or absolutely: "wait until y: z o'clock") or, for example, be given in the form of a number of received messages. The waiting period may be subscriber 21 and subscriber 22 be different. The waiting time can be used to ensure that the two messages are started at exactly the same time. In step A & B1.8, the network communication between subscriber 21 and subscriber required for generating a shared secret based on a method for generating a secret based on a superposition of dominant and recessive signals, preferably according to already referenced DE 10 2015 207 220 A1, becomes necessary 22 settled. These include, among other things, the transmission of subscriber value sequences packaged in one or more messages as a secret-relevant portion of the data used to generate the secret and the reading back of an overlay value sequence. A refinement of the method for secret generation between the users based on a superimposition of dominant and recessive signals provides that the first subscriber value sequence and the second subscriber value sequence each have a first partial value sequence and a second partial value sequence, the second partial value sequence being derived from the first partial value sequence by inverting ie exchanging first values for second values and exchanging second values for first values. The first partial value sequence and the second partial value sequence can be transmitted one after the other. Alternatively, a preferred method is proposed, in which the values of the first and the second partial value sequences are sorted into a subscriber value sequence, whereby at least one value of the second partial value sequence has already been transmitted before all values of the first partial value sequence have been transmitted. This makes it possible, already during transmission of the subscriber value sequence and receiving the overlay value sequence with the evaluation and Geheimbzw. Key generation to start. The solution will continue to be independent of buffer or cache memory sizes, as not complete partial value sequences must be stored before the evaluation and secret generation can be started. The transmission of the message is carried out by the component for transmission and is preferably such that, despite a (at least partial) superposition, nevertheless a message corresponding to the communication protocol used during the normal communication results without error on the channel. For this particularly preferred steps are as substeps

A & B1 .8.1, A & B1.8.2, A & B1.8.3 and A & B1 .8.4.

In sub-step A & B1.8.1, a check is made as to whether the arbitration phase is lost and the transmission must be stopped. In particular, with the CAN bus 1 in addition to the participants 21, 22 and 23 may be connected to other participants who want to perform a communication. For arbitration, i. Access negotiation, the CAN's own methods are expediently used, wherein an access request of the participants 21 and 22 may also be less prioritized than an access request of another participant and is therefore unsuccessful. If the transmission has to be stopped, you can try again to list the step group A & B1.8 (then possibly with or without step A & B1 .7) or (for example after a predetermined number of unsuccessful attempts) to abort the process in step A & B1 .6 become.

If the arbitration phase has been won, protocol-compliant network messages are generated and transmitted in steps A & B1 .8.2, A & B1 .8.3 and A & B1 .8.4. To this end, it is expedient to send the secret-relevant portion (and optionally also non-secret-relevant portions) of the data generating the secret generation in the payload and to generate headers and footers, if present, in such a way that a message is generated by non-participating subscribers protocol compliant message is detected.

In step A & B1.8.2 necessary stuffing or stuffing bits are inserted into the payload data to be transmitted. For example, in a CAN transmission after five equal bits, an inverse bit is inserted as a stuffing bit to interrupt a monotone sequence. This is to prevent the transmission between transmitter and receiver from drifting apart (eg due to slightly different clock signals of the involved ICs or communication participants).

In step A & B1 .8.3, a checksum for the CAN message is calculated. In this case, the checksum is preferably calculated on the basis of the overlay bits, so that uninvolved subscribers do not detect a faulty transmission.

In step A & B1.8.4, a check for possible errors (for example, a CRC error) can take place.

The secret relevant portion of the secret generation data is optionally configured in advance (or generated internally in the transmitting and receiving module for transmission) or during transmission by a control unit (eg microprocessor, security module or within the transmitting and receiving module) (generated and ).

Also conceivable is a combination of the aforementioned possibilities, that is partly configured in advance and partly during the transmission (generated and) predetermined.

The signal generated on the shared communication channel is read back from the component for transmission. This information is needed to calculate the shared secret. For this purpose, the message read back (or at least the part relevant to the calculation of the shared secret) must, if appropriate, be forwarded via a suitable interface (for example Host IF or Secure IF) to a module which is designed to calculate the shared secret. In addition, the module must be aware of the random bit string used for sending. Preferably, the shared secret is calculated by a security module. Alternatively, however, the microprocessor or the transmitting and receiving module can be designed to calculate the shared secret. Finally, in a step A & B1.9, the shared secret is calculated by both the subscriber 21 and the subscriber 22 based on the network communication performed in the step group A & B1.8.

Preferably, the shared secret is calculated based on the respective subscriber value success and the overlay value sequence. Preferably, the shared secret is calculated by the security module in the subscriber. Alternatively, however, the microprocessor or the transmitting and receiving module can also be designed and set up to calculate the shared secret.

In an optional step A & B 1.10, subscribers 21 and subscribers 22 indicate by sending a completion message that the secret generation has been successfully completed. In particular, the completion message may contain a value indicating the length of the (already) established shared secret. The length of the (already) established common secret can be determined beforehand in step A & B1 .9.

Subsequently, the method according to FIG. 3 ends.

Due to the random nature of methods relevant here for generating a secret, it can not be guaranteed that with a single execution of the disclosed procedure according to FIG. 3, a sufficiently long (= sufficient number of bits) common secret is generated.

In step A & B1.9, there is information about the length of the already established shared secret and can thus be determined independently by user 21 and user 22. If the already established common secret does not correspond to the intended / desired length, it is possible, by repeating corresponding steps, to create common secrets of any length. Possible alternatives are shown in FIGS. 4 to 7. FIG. 4 shows that step A & B 1.10 is modified such that the completion message contains the value that provides information about the length of the (already) established shared secret, without simultaneously reporting the successful completion of the secret generation. Subsequently, the method is continued after step A & B1 .2. Step C1 .4 is modified to indicate, based on the value contained in the completion message, which provides information about the length of the (already) established shared secret, whether the procedure is terminated (with a sufficiently long secret) or with the step C1.2 is continued (if the secret is insufficient).

FIG. 5 shows a modification of FIG. 4, wherein the feedback in step A & B1.4 is skipped, since the involved parties are already known about the impact at this time. Step C1 .4 is modified such that, if the secret is not sufficiently long, step C1.2 is continued. Since a feedback according to step A & B1 .4 does not occur here, step C1.2 is modified so that it does not wait for the response. In order nevertheless to obtain a termination criterion, step C1.2 is preferably modified to check how many times this step has already been run through and to compare the number with an abort threshold, at the time of which it branches to the abort step C1 .5.

FIG. 6 shows a modification of FIG. 4, with both the feedback in step A & B1 .4 and the triggering message and its handling being skipped in steps A & B1 .5, A & B1.6, since the affected parties at this point in time are affected the kick-off are already known. In this embodiment, step C1 .4 is modified to wait for a successful completion message. Under the condition that a burst-like behavior (ie a stringing together of messages) is used to establish arbitrarily long shared secrets, there is a further optimized sequence in which the participant 21 and participant 22 only have to perform selected steps and no administrative tasks ( for example, performed by participants 23). The burst-like behavior can be constructed in such a way that no participant other than subscriber 21 and subscriber 22 can secure access to the channel (for example by falling below a possible inter-frame gap to be observed in the protocol specification). In this case, the repetition of the arbitration step A & B1 .8.1 omitted. If the bursty behavior can be interrupted, the arbitration step A & B1 .8.1 must be carried out in accordance with the recovery of the bus access.

After a sufficiently long shared secret has been established, subscribers 21 and subscribers 22 can derive therefrom a symmetric cryptographic key, which it may then have to be validated by the communication partners. Once the cryptographic key is established, it can be used to execute cryptographic primitives (for example, to maintain confidentiality, verify authenticity, or ensure data integrity).

An exemplary procedure for this will be described below with reference to FIG. In a first step A | B1 .1, the raw data to be encrypted is generated by one of the participating subscribers. It may be, for example, sensor data or command data. The raw data is generated at the application level (eg, typically within the microprocessor or possibly in the security module or other entity).

In an optional step A | B1 .2, if the module that generated the raw data is not in possession of the symmetric key, the raw data is passed to a component in possession of the symmetric key. Preferably, the module in possession of the symmetric key is the security module. Optionally, instructions may be passed that identify which cryptographic primitive (s) should be applied to the raw data In a step A | B1 .3, the cryptographic primitives are calculated or cryptographic information (for example encrypted raw data or a message authentication code) is generated.

In a step A | B1 .4, the raw data and / or the cryptographic information for transmission via the shared communication medium are forwarded to the component for transmission (preferably the CAN controller or alternatively the transmitting and receiving module). The forwarding may, under certain circumstances, take place directly from the security module or from the security module via the microprocessor location.

In a step A | B1 .5, the raw data and / or the cryptographic information is sent via the shared medium.

To receive a message with cryptographic information, the procedure must be used in reverse order to decrypt and / or verify correctness.

It should be understood that the description of the preferred embodiments of the invention is provided to illustrate the invention, and that in a particular implementation, existing steps may be augmented by additional configurations or error handling steps, or additional intermediate steps may be incorporated with configurations and error handling.

It should also be noted that it is also possible to distribute selected steps of the described processes to other subscribers (for example, subscriber 23 could share the administrative task with a fourth, previously unnamed subscriber) or be shared among themselves. In particular, it is also possible that the participants, who should establish a common cryptographic secret (participants 21 and 22), additionally assume administrative tasks. As a result, if necessary, an alternative sequence comes about, so that the communication medium experiences a lower utilization. If, for example, subscriber 21 takes over the administrative step C1.3 In this case, only subscriber 22 would have to provide feedback to subscriber 21, whereby subscriber 21 can internally provide feedback to the corresponding module, without, for example, charging the shared communication channel, whereas in the process illustrated in FIG Also participants 22 have to give feedback to participants 23. If subscribers 21 and / or subscribers 22 take over administrative steps, this can consequently lead to subscribers 21 and subscribers 22 having to implement a different procedure and no longer, as shown in FIGS. 3 to 8, the same procedure.

Claims

claims

1 . Method for generating a secret in a network (20), wherein the network (20) has at least a first and a second subscriber (21, 22) with a common transmission channel (30) between at least the first and the second subscriber (21, 22). and an administrator (23),

wherein a secret is obtained between the first and second subscribers (21, 22) according to a method of generating a secret based on a superposition of dominant and recessive signals, if initiated by the administrator (23) (C1.3).

The method of claim 1, wherein the administrator (23) sends an initiate message to initiate the secret generation.

The method of claim 1 or 2, wherein the administrator (23) initiates the secret generation after receiving feedback from the first and second participants (21, 22) that they are ready for secret generation (C1 .2) ,

4. The method of claim 3, wherein the feedback takes place in the form of a feedback message.

A method according to any preceding claim, wherein the administrator (23), before initiating the generation of the secret, prompts the first and second subscribers (C1, 22) to establish a shared secret.

6. The method of claim 5, wherein the request is in the form of a request message.

Method according to claim 5 or 6, wherein the first and / or the second participant (21, 22) check in response to the request whether they themselves are affected by the request (A & B1 .2).

8. The method of claim 5, 6 or 7, wherein the first and / or the second participant (21, 22) in response to the request the administrator (23) an existing readiness eschewed (A & B1.4).

9. The method of claim 1, wherein the first and second participants indicate the successful completion of the secret generation (A & B1.10).

The method of any one of the preceding claims, wherein the first and second participants (21, 22) repeat the secret generation until the combination of all generated secrets has a predetermined length.

1 1. Method according to one of the preceding claims, wherein the first

and / or the second participant (21, 22) from which between the first and the second participant (21, 22) generate a cryptographic key.

12. The method according to any one of the preceding claims, wherein the first participant (21) and the second participant (22) each have at least a first

Value and a second value to the common transmission channel (30) between the first and the second subscriber (21, 22), wherein for secret generation the first subscriber (21) has a first subscriber value sequence and the second subscriber (22) has a second subscriber value sequence to each other largely synchronous transmission on the

Transmission channel (30) cause and wherein the first subscriber (21) the secret based on information about the first subscriber value sequence and on the basis of a superimposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel (30) resulting overlay value sequence and the second subscriber (22) generate the secret based on information about the second subscriber value sequence and on the basis of the overlay value sequence.

13. The method of claim 12, wherein a state corresponding to the first value is established on the transmission channel (30) if both the first and the second user (21, 22) cause a transmission of the first value via the transmission channel (30), and a state corresponding to the second value is established when the first or second subscribers (21, 22) or both initiate transmission of the second value over the transmission channel.

14. The method of claim 12, wherein the first subscriber value sequence and the second subscriber value sequence each have a first partial value sequence and a second partial value sequence, wherein the second partial value sequence results from the first partial value sequence by swapping first values to second values and second values to first values Values are exchanged.

15. The method according to claim 14, wherein the transmission of at least one value of the second partial value sequence is already initiated on the transmission channel (30) before the transmission of all values of the first partial value sequence on the transmission channel has been initiated.

16. Network (20) having at least a first and a second subscriber (21, 22, 23) and a transmission channel (30) via which the first can communicate with the second subscriber (21, 22, 23), the network ( 20) comprises means to perform all the steps of a method according to any one of the preceding claims.

17 arithmetic unit, which is configured to perform as a participant or administrator (21, 22, 23) on a network (20) according to claim 16 all participant-specific or administrator-specific steps of a method according to one of claims 1 to 15.

A computer program that causes a computing unit to perform a method according to any one of claims 1 to 15 when executed on the computing unit.

19. A machine-readable storage medium with a computer program stored thereon according to claim 18.