WO2017064075A1

WO2017064075A1 - Circuit arrangement for generating a secret or key in a network

Info

Publication number: WO2017064075A1
Application number: PCT/EP2016/074368
Authority: WO
Inventors: Florian Hartwich; Timo Lothspeich; Franz Bailer; Christian Horst; Arthur Mutter; Andreas Mueller
Original assignee: Robert Bosch Gmbh
Priority date: 2015-10-15
Filing date: 2016-10-11
Publication date: 2017-04-20
Also published as: DE102015220057A1

Abstract

A circuit arrangement, particularly a microcontroller, is presented. In this case, the circuit arrangement comprises at least one communication module for the communication of the circuit arrangement as a first network subscriber with at least one second network subscriber via a transmission channel, particularly a bus connection. The circuit arrangement has at least one further module for generating a secret that is shared with the second network subscriber for key generation. In this case, the circuit arrangement is set up to use the further module to prompt a transmission of a first value sequence on the transmission channel at least in part in sync with a transmission of a second value sequence by the second network subscriber and to ascertain the secret for the key generation on the basis of the first value sequence and on the basis of the value sequence that results on the transmission channel during the synchronous transmission of the first value sequence and the second value sequence.

Description

description

Circuit arrangement for generating a secret or key in a network

Technical area

The present invention relates to a circuit arrangement for the generation of a cryptographic secret in a network, which can be used in particular for the generation of a common, secret key in two participants of the network. Point-to-point connections are also usually counted as networks and should also be addressed here with this term. The two participants communicate via a shared transmission medium. In this case, logical bit sequences (or, more generally, value sequences) are transmitted physically by means of corresponding transmission methods as signals or signal sequences. The underlying communication system may e.g. be a CAN bus. This provides for transmission of dominant and recessive bits or correspondingly dominant and recessive signals, whereby a dominant signal or bit of a participant of the network intersperses against recessive signals or bits.

A state corresponding to the recessive signal adjusts itself to the transmission medium only if all participants involved provide a recessive signal for transmission or if all participants transmitting at the same time transmit a recessive signal level.

State of the art

Secure communication between different devices is becoming more and more important in an increasingly networked world and is an essential prerequisite for the acceptance and thus economic success of the corresponding applications in many areas of application. This includes various protection goals, depending on the application maintaining the confidentiality of the data to be transferred, mutual authentication of the nodes involved, or ensuring data integrity. In order to achieve these protection goals, suitable cryptographic methods are usually used, which can generally be subdivided into two different categories: first, symmetric methods, in which the sender and receiver have the same cryptographic key, and, on the other hand, asymmetrical methods in which the sender uses the data to be transmitted is encrypted with the public (ie possibly also known to a potential attacker) key of the recipient, but the decryption can be done only with the associated private key, which is ideally known only to the recipient.

One of the disadvantages of asymmetric methods is that they usually have a very high computational complexity. Thus, they are only conditionally for resource constrained nodes, such as e.g. Sensors, actuators, or similar, suitable, which usually have only a relatively low computing power and low memory and energy-efficient work, for example due to battery operation or the use of energy harvesting. In addition, there is often limited bandwidth available for data transmission, making the replacement of asymmetric keys with lengths of 2048 bits or even more unattractive.

For symmetric methods, however, it must be ensured that both the receiver and the transmitter have the same key. The associated key management generally represents a very demanding task. In the area of mobile telephony, for example, keys are inserted into a mobile telephone with the aid of SIM cards, and the associated network can then assign the corresponding key to the unique identifier of a SIM card. In the case of wireless LANs, on the other hand, a manual entry of the keys to be used (usually by entering a password) usually takes place when setting up a network. However, such key management quickly becomes very complex and impractical if one has a very large number of nodes, for example in a sensor network or other machine-to-machine communication systems, eg also CAN-based vehicle networks. In addition, changing the keys to be used is often not possible or only possible with great effort. In current procedures, the keys are usually stored centrally. testifies. The assignment to individual ECUs takes place in a secure environment z. B. in the factory of the vehicle manufacturer. There, the keys are also activated.

Method for securing sensor data against tampering and ensuring transaction authentication, e.g. in a motor vehicle network, by means of common encryption methods, e.g. in the DE

102009002396 AI and in DE 102009045133 AI discloses.

For some time now, the term "physical layer security" has been used to investigate and develop novel approaches that can be used to automatically generate keys for symmetric algorithms based on physical properties of the transmission channels between the nodes involved, using reciprocity and the inherent However, in the case of wired or optical systems in particular, this approach is often only suitable to a limited extent since corresponding channels usually have only a very limited temporal variability and an attacker can draw conclusions about the channel parameters between the transmitter and the receiver relatively well, for example by means of modeling Such methods for secured communication in a distributed system based on channel characteristics of the connected units are not previously published in, for example, US Pat DE Applicants DE 10 2014 208975 AI and DE 10 2014 209042 AI described.

The non-prepublished DE 10 2015 207220 AI discloses a method for generating a shared secret or a secret symmetric key by means of public discussion between two communication participants.

Disclosure of the invention

The invention is based on a circuit arrangement which has a communication module for communication via a transmission channel as well as a further module which, in order to support the generation of a shared secret between the network participant, comprises Circuitry and another network participant is set up. The secret is thereby generated by a (largely) synchronous transmission of a subscriber value sequence on a common transmission channel between the network subscribers and on the basis of the transmitted subscriber value sequences and the determined superimposition on the transmission channel. The further module supports the generation of the secret, in particular it causes the (largely) synchronous transmission.

The hardware realization of the method in a circuit arrangement by using a communication module and the additional module provided specifically for this method enables a reliable and largely tamper-proof implementation while maintaining the necessary latency times.

The advantageous combination possibilities shown between the communication module (s) and the other modules enable the developer, when implementing the described methods in a circuit arrangement, to weigh the following points: resource expenditure, flexibility and modularity.

An integrated variant of the communication module and the further module has e.g. a low resource requirement. The modularity and flexibility of this solution speak in favor of an alternative combination of separate circuit components for the communication module and the further module. The further module can be combined with different types of communication modules. A combination of the further module with a plurality of communication modules may be particularly advantageous in systems in which the negotiation of a key takes place only rarely and takes little time. There, the other module can be used as a shared resource. Different combinations or assignments between communication modules and the other modules can therefore be realized. An assignment can be a temporary, logical assignment, but also a temporary or fixed circuit connection.

An advantageous, because easy to implement implementation of the presented circuit arrangements and methods is for CAN, TTCAN, CAN FD, LIN the I2C bus systems with dominant and recessive bus levels possible. The communication modules then include corresponding communication controller functionality, eg a CAN controller or a LIN controller. Particularly advantageous is a shutdown of the other module when it is not needed, or under certain operating conditions of the system in which the circuit is used, for example, outside as safely defined system states.

The underlying methods for generating a secret or a cryptographic key do not require any manual intervention and thus enable the automated establishment of secure communication relationships between two nodes. In addition, the methods have a very low complexity, in particular with regard to the required hardware design, such as e.g. the required memory resources and computing power, and they are associated with a low energy and time requirements. In addition, the methods offer very high key generation rates with a very low probability of error.

The methods assume that participants in a network communicate with each other via a communication channel. In particular, they transfer logical sequences of values (in the case of binary logic, bit sequences) with the aid of physical signals on the transmission channel. Even if possible superimpositions take place on the transmission channel through the signals, that is to say on the physical level, in the description below the logical level is primarily considered. Thus, the transferred, logical value sequences as well as their logical overlay are considered.

Subscribers of the network can thus give first signals (for example associated with logical bit "1") and second signals (associated, for example, with logical bit "0") to the communication channel and detect resulting signals on the communication channel. If two subscribers now transmit (largely) one signal sequence at a time, the subscribers can detect the resulting overlay on the communication channel. The effective, from the (largely) simultaneous transmission two (independent) signals resulting signal on the communication channel can in turn be assigned to one (or more) specific logical value (or values). The transmission must be largely synchronous in that a superimposition of the individual signals of a signal sequence on the transmission medium takes place, in particular, that the signal corresponding to the n-th logical value or bit of the first subscriber with the signal corresponding to the n-th logical Value or bit of the second participant at least partially superimposed. This overlay should be sufficiently long for the participants to be able to record the overlay or determine the corresponding overlay value.

The superimposition can be determined by arbitration mechanisms or by physical signal superposition. By arbitration mechanism is meant, for example, the case that a node wants to apply a recessive level, but detects a dominant level on the bus and thus omits the transmission. In this case, there is no physical interference between two signals, but only the dominant signal is seen on the transmission channel.

From the resulting value sequence of the overlay and its own value sequence, the participants can then generate a key that is secret to an outside attacker. The reason for this is that the outside attacker, who can listen to the effective overall signals applied to the shared transmission medium, sees only the superimposition of the value sequences, but does not have the information about the individual value sequences of the participants. Thus, the participants have more information that they can use against the attacker to generate a secret key.

The described methods can be implemented particularly well in a CAN, TTCAN or CAN FD bus system. Here, a recessive bus level is replaced by a dominant bus level. The superimposition of values or signals of the participants thus follows defined rules, which tion of information from the superimposed value or signal and the value or signal transmitted by them. The methods are also well suited for other communication systems such as LIN and I2C.

While the method has been described for two subscribers in a network, even a subscriber of a network can already derive a secret key from his own signal sequence and from an overlay of this with the signal sequence of a second subscriber. A network or subscriber to a network is set up to do this by having electronic memory and computational resources to perform the steps of a corresponding method. Also stored on a storage medium of such a user or on the distributed storage resources of a network may be a computer program configured to perform all the steps of a corresponding method when executed in the subscriber or in the network.

drawings

The invention is described in more detail below with reference to the accompanying drawings and to exemplary embodiments. Show

1 schematically shows the structure of an exemplary, underlying communication system,

2 schematically shows a linear bus as an example of an underlying communication system,

3 is a schematic illustration of exemplary signal sequences of two subscribers of a network and a resulting subsequence value sequence on a transmission channel between the subscribers,

4 schematically shows the sequence of an exemplary method for generating a key between two subscribers of a network, 5 shows an exemplary communication module as part of a circuit arrangement,

6 shows an exemplary module for generating a secret or key exchange (further module) as part of a circuit arrangement,

7 shows a detail of an exemplary circuit arrangement with an integration of a communication module and a module for generating a secret or for key exchange (further module) in a circuit part,

8 shows a detail of an exemplary circuit arrangement with a communication module and a module for generating a secret or for key exchange (further module) in separate circuit parts and in each case

9 shows a detail of an exemplary circuit arrangement with several communication modules and a module assigned to these communication modules for generating a secret or for key exchange (further module) in separate circuit parts in each case.

DESCRIPTION OF THE EXEMPLARY EMBODIMENTS The present invention relates to a circuit arrangement, in particular an integrated circuit, e.g. B. a microcontroller, as a network participant. The circuit arrangement is set up to carry out a method for generating a shared secret or (secret) symmetric cryptographic key between two nodes of a communication system (subscriber of a network). The network participants communicate with each other with the support of the circuit via a shared medium (transmission channel of the network).

The generation or negotiation of the cryptographic keys is based on a public data exchange between the two subscribers. in the case of a possible listening third party as attacker it is not possible or very difficult to draw conclusions about the generated keys. It is thus possible to fully automatically and securely establish corresponding symmetrical cryptographic keys between two different subscribers of a network in order to then construct specific ones based on them

Security functions, such as a data encryption or a message authentication to realize. As will be described in detail, a common secret is first established for this, which can be used to generate the key. However, such a shared secret can in principle also be used for purposes other than cryptographic keys in the strict sense, e.g. as a one-time pad.

Such a key generation is possible for a multiplicity of wired or wireless as well as optical networks or communication systems, in particular also those in which the various subscribers communicate with each other via a linear bus and the media access to this bus takes place by means of a bitwise bus arbitration , This principle represents, for example, the basis of the widespread CAN bus. Possible fields of application of the invention accordingly include, in particular, CAN-based vehicle networks and CAN-based networks in automation technology.

With the described approach, automatically symmetric cryptographic keys can be generated in one, or in particular between two nodes of a network. This generation takes place by exploiting properties of the corresponding transfer layer. Unlike the usual approaches of "physical layer security" but not physical parameters of the transmission channel such as transmission strength are evaluated .. Rather, there is a public data exchange between the nodes involved, thanks to the characteristics of the communication system and / or the modulation method used a possible listening attacker no, or no sufficient conclusions on the negotiated key allows. The following is an arrangement as shown in FIG. 1 in the abstract. Different subscribers 2, 3 and 4 can communicate with one another via a so-called shared transmission medium C, shared medium 10. In an advantageous embodiment of the invention, this divided transmission medium corresponds to a linear bus (wired or optical) 30, as shown by way of example in FIG The network 20 in Figure 2 consists of this linear bus 30 as a shared transmission medium (e.g., a wireline transmission channel), nodes 21, 22 and 23, and (optional) bus terminations 31 and 32.

In the following, communication between the various nodes 21, 22 and 23 is assumed to be characterized by the distinction between dominant and recessive values. In this example, the possible values are the bits "0" and "1". In this case, a dominant bit (e.g., the logical bit '0') may quasi supersede a concurrently transmitted recessive bit (e.g., the logical bit '1').

An example of such a transmission method is the so-called on-off-keying (on-off-keying amplitude shift keying), in which exactly two transmission states are distinguished: in the first case (value, Οη ', or "0") If a signal is transmitted, for example in the form of a simple carrier signal, in the other case (value 'Off' or '1') no signal is transmitted. The state 'η' is dominant while the state 'Off' is recessive. Another example of a corresponding communication system, this

Supports discrimination of dominant and recessive bits is a (wired or optical) system based on a bitwise bus arbitration, as used for example in the CAN bus. The basic idea here is also that if, for example, two nodes want to transmit a signal at the same time and one node transmits a '1', whereas the second node transmits a '0' which 'gains''0' (ie the dominant bit) This means that the signal level that can be measured on the bus corresponds to a logical '0'. In CAN, this mechanism is used in particular for resolving possible collisions, whereby priority messages (ie messages with an earlier, dominant signal level) predominantly overflow - Each node, while transmitting its CAN identifier, monitors the signal level on the bus bit by bit at the same time. If the node itself transmits a recessive bit but a dominant bit is detected on the bus, the corresponding node aborts its transmission attempt in favor of the higher priority message (with the earlier dominant bit).

The distinction between dominant and recessive bits makes it possible to interpret the shared transmission medium as a kind of binary operator that combines the various input bits (= all bits transmitted simultaneously) using a logical AND function.

FIG. 3 shows, for example, how a subscriber 1 (T1) keeps the bit sequence 0, 1, 1, 0, 1 ready for transmission between the times t0 and t5 via the transmission channel. Subscriber 2 (T2) keeps the bit sequence 0, 1, 0, 1, 1 ready for transmission between times t0 and t5 via the transmission channel. With the above-described characteristics of the communication system and assuming that the bit level "0" in this example is the dominant bit, the bit string 0, 1, 0, 0, 1 will be seen on the bus (B) Only between times t1 and t2 and between t4 and t5, both subscriber 1 (T1) and subscriber 2 (T2) provide a recessive bit "1", so that only in this case does the logical AND operation result in a bit level of " 1 "on the bus (B) results.

Taking advantage of these characteristics of the transmission method of the communication system, a key generation between two subscribers of a corresponding network can now take place in that the subscribers detect a superimposition of bit sequences of the two subscribers on the transmission medium and from this information share information about the self-transmitted bit sequence (symmetric), generate secret key.

An exemplary, particularly preferred implementation will be explained below with reference to FIG. 4. The process for generating a symmetric key pair is started in step 41 by one of the two nodes involved in this example (subscriber 1 and subscriber 2). This can be done, for example, by sending a special message or a special message header.

Both Subscriber 1 and Subscriber 2 initially generate a bit sequence locally (i.e., internally and independently) in step 42. Preferably, this bit sequence is at least twice, in particular at least three times as long as the common key desired as a result of the method. The bit sequence is preferably generated in each case as a random or pseudo-random bit sequence, for example with the aid of a suitable random number generator or pseudo random number generator.

Example of local bit sequences of length 20 bits:

Generated bit sequence of participant 1:

Su = 01001101110010110010

'Generated bit sequence of subscriber 2:

S _T2 = 10010001101101001011

In a step 43, subscriber 1 and subscriber 2 transmit (largely) synchronously their respectively generated bit sequences over the divided transmission medium (using the transmission method with dominant and recessive bits, as already explained above). Different possibilities for synchronizing the corresponding transmissions are conceivable. Thus, for example, either subscriber 1 or subscriber 2 could first send a suitable synchronization message to the respective other node and then start the transmission of the actual bit sequences after a certain period of time following the complete transmission of this message. Equally, however, it is also conceivable that only one suitable message header is transmitted by one of the two nodes (eg a CAN header consisting of arbitration field and control field) and during the associated payload phase then both nodes simultaneously (largely) transmit their generated bit sequences synchronously , In a variant of the method, the bit sequences of a subscriber generated in step 42 can also be displayed in step 43 several messages can be transmitted distributed, for example, if this requires the (maximum) sizes of the corresponding messages. In this variant too, the transmission of the correspondingly large number of correspondingly large messages distributed bit sequences of the other subscriber takes place again (largely) synchronously.

On the shared transmission medium, the two bit sequences then overlap, whereby due to the previously required property of the system with the distinction of dominant and recessive bits, the individual bits of subscriber 1 and subscriber 2 result in an overlay, in the example mentioned de facto AND-linked. This results in a corresponding overlay on the transmission channel, which could detect, for example, a listening third party.

Example of an overlay bit sequence for the above local bit sequences:

• Effective bit sequence on the transmission channel:

Seft = Su AND S _T2 = 00000001100000000010

Both subscriber 1 and subscriber 2 detect during the transmission of their bit sequences of step 43 in a parallel step 44, the effective (overlaid) bit sequences S _e ff on the shared transmission medium. For the example of the CAN bus, this is usually done in conventional systems during the arbitration phase anyway.

This is likewise possible for systems with "η-off-keying" (wireless, wired or optical). In this case, the practical feasibility benefits in particular from the fact that in such a system the state 'η' is dominant and the state 'Off' is recessive (as already explained above). Consequently, even without measurement, a node knows that the effective state is dominant on the shared medium if the node itself has sent a dominant bit, but if a node has sent a recessive bit, it does not know the state on the shared transmission medium first Further, however, in this case, he can determine by a suitable measurement what it looks like, because, in this case, the node does not send anything, so there are no problems with so-called self-interference, especially in the case of wireless Systems would otherwise require a complex echo cancellation.

In a next step 45, both subscriber 1 and subscriber 2 also again (largely) synchronously transmit their initial bit sequences STI and ST2, but this time inverted. The synchronization of the corresponding transmissions can again be realized exactly in the same way as described above. On the shared communication medium, the two sequences are then ANDed together again. Subscribers 1 and 2 in turn determine the effective, superimposed bit sequences S _e ff on the shared transmission medium.

Example of the above bit sequences:

Inverted bit sequence of participant 1:

Sn = 10110010001101001101

Inverted bit sequence of participant 2:

S _T2 '= 01101110010010110100

'Effective, overlaid bit sequence on the channel:

Seff '= Sn AND S _T2 ' = 00100010000000000100

Both subscriber 1 and subscriber 2 determine during the transmission of their now inverted bit sequences then again the effective, superimposed bit sequences on the shared transmission medium. At this time, both nodes (subscriber 1 and subscriber 2), as well as a possible attacker (eg subscriber 3) who overhears the communication on the shared transmission medium, thus know the effective, superimposed bit sequences S _e ff and Seff '. In contrast to the attacker or third participant, however, participant 1 still knows his initially generated, local bit sequence STI and participant 2 his initially generated, local bit sequence ST2. However, subscriber 1 in turn does not know the initially generated, local bit sequence of subscriber 2 and subscriber 2 does not know the initially generated, local bit sequence of subscriber 1. The detection of the overlay bit sequence again takes place during the transmission in step 46.

As an alternative to this exemplary embodiment, subscriber 1 and subscriber 2 can also use their inverted, local bit sequence directly with or directly after their own Sending steps 45 and 46 in steps 43 and 44. The original and the inverted bit sequences can be transmitted in a message as well as in separate messages as partial bit sequences.

In step 47, subscriber 1 and subscriber 2 now respectively locally (ie internally) link the effective, superposed bit sequences (S _e ff and S _e ff '), in particular with a logical OR function.

Example of the above bit sequences:

S _g = Seff it Seff OR '= 00100011100000000110

The individual bits in the bit sequence (Sges) resulting from the OR operation now indicate whether the corresponding bits of STI and ST2 are identical or different. For example, if the nth bit within S _tot is a '0', it means that the nth bit within STI is inverse to the corresponding bit within ST2. Likewise, if the nth bit within Sges is a '1', the corresponding bits within STI and ST2 are identical.

Subscriber 1 and subscriber 2 then cancel in step 48 based on the bit sequence S _ges obtained from the OR operation in their original, initial bit sequences STI and ST2 all bits which are identical in both sequences. This consequently leads to correspondingly shortened bit sequences.

Example of the above bit sequences:

Abbreviated bit sequence of participant 1:

Sn, v = 01011100101100

Abbreviated bit sequence of participant 2:

S _T2 , v = 10100011010011

The resulting, shortened bit sequences STI.V and ST2, V are now just inverse to each other. Thus, by inversion of its shortened bit sequence, one of the two subscribers can determine exactly the shortened bit sequence that already exists in the other subscriber. The thus shared, shortened bit sequence is now processed locally by participant 1 and participant 2 in step 49 in a suitable manner in order to generate the actual desired key of the desired length N. Again, there are a variety of ways that this treatment can be done. One possibility is the selection of N

Bits from the common, truncated bit sequence, where it must be clearly defined which N bits to take, e.g. by simply selecting the first N bits of the sequence. It is also possible to calculate a hash function via the shared, shortened bit sequence which provides a hash of length N. In general, the rendering can be done with any linear and nonlinear function that returns a N bit length bit sequence when applied to the co-present truncated bit sequence. The mechanism of key generation from the common truncated bit sequence is preferably identical in both subscribers 1 and 2 and is performed accordingly in the same way.

Following the key generation, it may still be possible to verify that the keys generated by subscribers 1 and 2 are actually identical. For this purpose, for example, a checksum could be calculated using the generated keys and exchanged between subscribers 1 and 2. If both checksums are not identical, then obviously something has failed. In this case, the described method for key generation could be repeated.

In a preferred variant of the method for generating a key, in a number of passes, a whole series of resulting shortened bit sequences, which are each present in the case of subscribers 1 and 2, can be generated, which are then combined into a single large sequence before the actual key is derived therefrom , If necessary, this can also be done adaptively. If, for example, the length of the common, shortened bit sequence is, for example, shorter than the desired key length N after a single pass through the described procedure, then one could, for example, generate further bits before the actual key derivation. Finally, the generated symmetric key pair can be used by subscriber 1 and subscriber 2 in conjunction with established (symmetric) cryptographic methods, such as ciphers for data encryption.

A potential attacker (eg subscriber 3) can listen to the public data transmission between subscriber 1 and subscriber 2 and thus gain knowledge of the effective, superposed bit sequences (S _e ff and S _e ff ') as described. The attacker then only knows which bits in the locally generated bit sequences of nodes 1 and 2 are identical and which are not. In addition, with the identical bits, the attacker can even determine whether it is a '1' or a '0'. For a complete knowledge of the resulting, shortened bit sequence (and thus the basis for key generation), however, he lacks the information about the non-identical bits. In order to further aggravate possible attacks for the attacker, in a preferred variant the bit values identical in the original, locally generated bit sequences of the users 1 and 2 are additionally deleted. This means that participant 3 has only information that is not used for key generation. Although he knows that correspondingly shortened bit sequences emerge from the different between the local bit sequences of the participants 1 and 2 participants bits. However, he does not know which bits have been sent by subscriber 1 and subscriber 2 respectively.

In addition to the information about the superimposed overall bit sequence, subscriber 1 and subscriber 2 also have the information about the locally generated bit sequence transmitted by them in each case. The fact that the keys generated in subscribers 1 and 2 remain secret as a basis despite the public data transmission results from this information advantage over a subscriber 3 following only the public data transmission.

FIG. 5 shows a communication module or protocol module. In this exemplary embodiment, this is a so-called CAN protocol controller module or else a short CAN module. For a CAN bus system, for example, a CAN communication module based on a CAN controller IP Module of Robert Bosch GmbH such as M_CAN, C_CAN or D_CAN or for a LIN bus system a LIN communication module based on a LIN communication controller IP module of Robert Bosch GmbH as C_LIN be used. FIG. 5 shows a CAN module 50 based on the M_CAN-IP.

A CAN core 51 executes the communication according to a particular CAN protocol version, e.g. Version 2.0 A, B and ISO 11898-1 and can also support CAN FD. With the connections 503 and 504, the logical CAN transmit or CAN receive connections are designated. The synchronization block 52 synchronizes signals between the two existing clock domains. The module-internal clock is designated 59. Configuration and control block 55 can be used to set CAN core-related configuration and control bits. Block 56 is for interrupt control and the generation of receive and transmit timestamps. The interface 58 serves as a generic slave interface for the possible connection of the CAN

Module with many different CPU types via the connection 501. The interface 57 serves as a generic master interface access to a message memory, in particular a RAM, via the connection 502. The block 53 corresponds to a Tx handler or send manager, which the Message transfer from an external message store to the CAN core controls. Up to 32 transmit buffers can be configured for transmission. Transmit timestamps are stored with corresponding message IDs. The blocks 531 and 532 in the send manager correspond to a control and configuration block and a send prioritization block, respectively. The Rx handler 54 controls the transmission of received ones

Messages from CAN Core to external message storage. It supports the storage of up to 128 messages. A reception time stamp is stored with each message. The communication module thus comprises a central circuit part (here

CAN Core 51) for the protocol-controlled control of communication between a host CPU and an external message memory as well as for protocol-based reception and transmission of messages via the communication system (here via the connections 503 and 504). An interface (here master interface 57 and the connection 502) is the module with the external Message store connected. Via another interface (here slave interface 58 and the connection 501), the module is connected to the host CPU. It can be implemented as a stand-alone unit, as part of an ASIC or with an FPGA.

The connection to the physical layer can be supported by additional transceiver hardware. Several communication modules can share an external message store. In Fig. 6, a module 60 is shown, which in a circuit arrangement of a

Subscriber on a network can support this subscriber in the generation of a shared secret with other network subscribers (hereinafter also referred to as "further module") .The module 60 can thereby provide data or messages to the bus 600, which in a preferred embodiment implemented as a CAN bus.

In this case, the module 60 has a block 64 for configuring the module via an interface 604, in particular for protocol-specific configurations such as baud rate, IDs, etc. Furthermore, it comprises a block 63 (eg a register) in which a character string, in particular a random number or

Pseudo-random number can be stored, in particular received via an interface 603. Block 62 denotes a trigger module, which can be made in a preferred embodiment via the interface 602 to a trigger signal. Alternatively, the trigger module can trigger a trigger signal independently. The module also has transmitters such as the

Block 61 shown transmit buffer memory (Tx buffer), which can give messages or data on the bus 600 via an interface 601.

The main mode of operation of the module is that, depending on a configuration (indicated by the connection 605 between configuration block 64 and transmission means 61), a random number or pseudo-random number from block 63 is given via connection 606 to the transmission means 61 and via the interface 601 to the CAN Bus 600 is output. This process is triggered (either already the transmission of the number from block 63 to block 61 or at least the transmission of the number from block 61 to bus 600). in particular by a triggering signal through the trigger module 62 via the connection 607 to the transmitting means 61.

In preferred embodiments of the module 60, the latter can also have a memory 65 (in particular a RAM) in which one or more random numbers or pseudorandom numbers are stored, which are output via the transmission means 61 as a function of the trigger signal. These random numbers can also be generated by an optional random number generator (in particular a TRNG) in the module 60.

Furthermore, in a preferred embodiment, the module 60 can also have receiving means 67, in particular receiving buffer memory 67, which can receive messages or data from the bus 600 via an interface 612. Via an interface 613 between receiving means 67 and trigger block 62, a trigger signal for transmitting data can also be triggered in this embodiment depending on received data. For example, it can be recognized that a random number sequence for secret generation is placed on the bus by another network subscriber (eg via a corresponding message ID) and then the trigger is made by the trigger block 62, that this subscriber also uses the module 60 to carry out a random number sequence (largely) synchronously with the transmission of the random number sequence by the other network participant on the bus.

In an optional block 68 error states of the module 60 can be stored and these are also reported via an interface 608 to external or retrieved from external.

In a further preferred embodiment, the module 60 may also have a circuit part 69 for dynamic message generation. The latter can receive a random number or pseudorandom number via an interface 609 and, depending on this, generate a message and forward it to the transmission means 61 via the connection 610. The message is intended for largely synchronous transmission of random numbers with another network participant in order to generate a shared secret between the network participants as described above. In a circuit arrangement (in particular a microcontroller), which is intended to support the above-described methods for secret or key generation between network users, at least one communication module as described with reference to FIG. 5 and at least one further module as shown in FIG. 6 described included. There are various possibilities for this, which allow to optimize the circuit arrangement in various respects. In a first preferred embodiment of such a circuit arrangement, the communication module and the further module are integrated in a circuit part. This is shown by way of example in FIG. 7. Communication module and another module are integrated here in the circuit part 70 of the circuit arrangement. In particular, the functions described above for the further module are additionally integrated in a communication module or protocol module.

The communication module with additional functions 70 is connected via a connection 72 to a host interface 71 to the host (computing unit of the circuit arrangement or host CPU of the microcontroller) and via receiving or transmitting interface 74 or 75 to a bus system. Interface 73 denotes a secure interface, e.g. to a

Hardware security module of the circuit arrangement or of the microcontroller.

FIG. 8 shows an alternative advantageous embodiment of the combination of a communication module with another module for secret generation in a circuit arrangement. Here, a communication module 810 and another module 820 are combined as separate circuit parts. They each have a connection 801 or 802 to the host interface 800. The communication module has a transmission interface 812 and a reception interface 811, the further module via a transmission interface 822 and a reception interface 823. In a block Rx / Tx control 830 of the circuit For example, the receive interfaces 811 and 823 may be merged together. This may in particular mean that the received signals are divided from a common receiving line, for example by Time Division Multiplex. Preferably, a duplication takes place for the received signal, so that the same received signal is transmitted via the connection 811 to the communication module 810 and via the connection 823 to the further module 820 becomes. In block Rx / Tx control 830, the transmit interfaces 812 and 822 may also be merged. In preferred embodiments, the communication module 810 may configure the further module 820 via a connection 814. Via a connection 815, the communication module 810 may also trigger the further module 820 also to initiate the subscriber sequence for

Giving secret generation on the transmission channel.

FIG. 9 shows three communication modules 910, 920, 930 as well as a further module 990. The receive and transmit interface 991 of the further module is via a mux / demux block 980 receive / transmit controls (Rx / Tx

Controls) 940, 950, 960 assigned. Each of these controllers 940, 950 and 960 is in turn also each assigned to a receive and transmit interface 911, 921 and 931 of the communication modules 910, 920 and 930, respectively. The communication modules 910, 920, 930 and the further module 990 are connected to the host interface 900 via connections 912, 922, 932 and 992, respectively. Similar to that described with reference to FIG. 8, the communication modules 910, 920 and 930, respectively, can configure and trigger the further module 990 via configuration and trigger connections 915, 925 and 935, respectively. For this purpose, the configuration and trigger connections 915, 925 and 935 via multiplexer MUX and connections 901 and 902 are assigned to the further module 990. The assignment between

Communication module 910, 920 or 930 and further module 990 via these multiplexers MUX or the mux / demux block 980 is controlled via the allocation controller 970 and via the connections 971, 972 and 981, respectively. The control is done e.g. from a central processing unit of the circuit arrangement, e.g. a CPU of a microcontroller. Alternatively, the assignment could also be requested by one of the communication modules themselves, an arbiter then allocates the further module.

If required, the exemplary assignment 1: 3 from FIG. 9 can also be used to assign a different number n> 1 of communication modules to a further module with appropriate scaling. Corresponding circuit arrangements can then have 1 further module and n assigned communication modules. The number of further modules is also scalable, so m> l further modules could be flexibly assigned to n> 1 communication modules. As a further special case, several other modules could also be assigned to a communication module. In this case, a further module can then preferably request a communication module, an arbiter makes the allocation. This configuration of another module with multiple communication modules could be useful, for example, in a design in which a circuit arrangement such as a microcontroller has multiple communication interfaces that are used only for negotiating new keys. The keys obtained could be used for communication via further communication interfaces. This is possible because the negotiation of a key is rare and the negotiation and the active circuit itself only take a little time. If such an assignment of a further module to a plurality of communication modules is realized, then this further module can also contain, for example, configuration registers which can likewise be used for configurations of the communication modules.

RX / TX Control

Two mutually associated modules (communication module and further module) must be able to send and receive messages on the same transmission channel or bus. To ensure this, there are several alternatives. a) Merge Tx signals: The two Tx signals are merged (bus emulation by simple AND operation). The resulting (linked) Tx signal is fed to the transceiver. Thus, the communication module and the further module have simultaneous access to the bus. The big advantage here is that both modules are always connected to the bus and can arbitrate against each other (eg CAN bus arbitration). b) Time division multiplexing Tx signals: The two Tx signals are connected in time multiplex on the transceiver. In order for the modules to be able to react to events (eg errors) on the bus, it makes sense to also multiplex the Rx signals synchronously with the Tx signals (ie to connect to the transceiver or not). So that a currently disconnected from the bus communication module or further module shows no misconduct (eg, because it wants to send a message) are additional measures are necessary, eg the module should be able to be put into a standby state via software or hardware. c) Each module has its own transceiver: both modules have their own dedicated transceiver. The transceiver of the communication module and the transceiver of the other module are connected to the same bus.

Configuration of another module

The further module partly participates in the bus communication. Therefore, it also requires bus protocol-specific settings as well as the communication module. For the configuration of the further module there are different alternatives. These can be freely combined with the various assignment combinations described above between the communication module and the further module. a) The further module contains configuration registers for the protocol-specific settings. This allows a modular, simple design. The complexity of the configuration is shifted to the software. b) The further module receives the settings from the assigned communication module. For this purpose, a wiring of the configuration signals may be sufficient. This possibility is shown in FIGS. 8 and 9 as an option. If the further module is assigned to several communication modules, e.g. a multiplexer can be used to select the appropriate configuration signals. An advantage of this variant is that the further module is always configured the same as the assigned communication module, this avoids configuration errors.

Triggering of another module

For the method for generating a shared secret, the further module can be triggered by another network subscriber via the common communication connection or the common bus. This allows the other modules of the respective network participants their Transfer messages with the subscriber value sequences (largely) synchronously on the communication link. Triggering takes place, for example, by sending a special trigger message or implicitly by sending the message with the subscriber value sequence (in this case, the message ID can then act as a trigger, for example).

Alternatives for triggering another module a) The further module triggers itself or is executed by software, i. e.g. via a host computing unit of the circuitry, e.g. triggered a host CPU of a microcontroller. b) The further module is triggered by the assigned communication module. This requires a trigger line from the communication module to the other module. If the further module is assigned to several communication modules, e.g. a multiplexer can be used to select the appropriate trigger line. This possibility is shown in FIGS. 8 and 9 as an option.

Minimizing the risk of misconduct

The further module is usually only required if the special (synchronously transmitted) messages for the secret generation are to be exchanged. In order to minimize the risk for the system by a misconduct of the further module, the further module can be switched off whenever it is not needed. In a particularly safe variant, the further module should always be switched on only when the overall system (eg a car with a communication network) is in a non-critical operating state (eg in the case of the car "engine off" and / or "speed V = 0) or V <X "with a given maximum speed X or communication network below a certain load threshold).

Claims

claims

1. Circuit arrangement, in particular microcontroller, comprising at least one communication module (910, 50) for communication of the circuit arrangement as the first network participant (21) with at least one second network participant (22) via a transmission channel (30), in particular a bus connection, characterized in that Circuit arrangement has at least one further module (990, 60) for generating a secret associated with the second network participant (22) for a key generation, wherein the circuit arrangement is set up to transmit a first one by means of the further module (990, 60) Value sequence on the transmission channel (30) at least substantially in synchronism with a transmission of a second value sequence by the second network subscriber (22) and the secret for the key generation on the basis of the first value sequence and on the basis of the transmission channel (30) in the synchronous transmission d he first value sequence and the second value sequence to determine the resulting value sequence.

2. Circuit arrangement according to claim 1, characterized in that the communication module (910, 50) comprises a LIN controller or a CAN controller.

3. Circuit arrangement according to claim 1, characterized in that the communication channel (30) is part of a CAN, TTCAN, CAN FD, LIN or I2C bus system, that the first and the second value sequence can each have first values and second values and that the first value is a recessive bus level and that the second value is a dominant bus level.

4. Circuit arrangement according to one of the preceding claims, characterized in that the communication module (50) and the further module (60) in a common circuit part (70) are integrated.

5. Circuit arrangement according to one of claims 1 or 2, characterized in that the at least one communication module (50, 810) and the at least one further module (60, 820) are implemented in separate circuit parts and that in each case one of the communication modules (50, 810) is associated with one of the further modules (60, 820).

6. Circuit arrangement according to one of claims 1 or 2, characterized in that the at least one communication module (50) and the at least one further module (60) are realized in separate circuit parts and that in each case a plurality of further modules (60) a communication module (50). assigned.

7. Circuit arrangement according to one of claims 1 or 2, characterized in that the at least one communication module (910, 920, 930, 50) and the at least one further module (990, 60) are realized in separate circuit parts and that in each case a further module (60, 990) is associated with a plurality of communication modules (50, 910, 920, 930).

8. Circuit arrangement according to one of claims 1 or 2, characterized in that the at least one communication module (50) and the at least one further module (60) are realized in separate circuit parts and that in each case a plurality of further modules (60) a plurality of communication modules (50). assigned.

9. Circuit arrangement according to one of the preceding claims, characterized in that the at least one further module (60) comprises a separate transceiver.

10. Circuit arrangement according to one of the preceding claims, characterized in that the at least one further module (60) shares a transceiver with the communication module (50).

11. Circuit arrangement according to claim 10, characterized in that transmission signals of the further module (820, 60) and transmission signals of the communication module (810, 50) are brought together.

12. Circuit arrangement according to claim 10, characterized in that for transmission signals of the further module (60) and transmission signals of the communication onsmoduls (50) a time-multiplexing is performed.

13. Circuit arrangement according to one of the preceding claims, characterized in that the further module (60) has a configuration register (63).

14. Circuit arrangement according to one of the preceding claims, characterized in that the further module (60) via at least one configuration register of the communication module (50) is configurable.

15. Circuit arrangement according to one of the preceding claims, characterized in that the further module (60) is adapted to determine a start time for the transmission of the first value sequence itself and to start the transmission accordingly.

16. Circuit arrangement according to one of the preceding claims, characterized in that the communication module (50) is adapted to determine a start time for the transmission of the first value sequence and trigger the transmission by the further module accordingly.

17. Circuit arrangement according to one of the preceding claims, characterized in that the circuit arrangement, in particular via a central processing unit or via the communication module (50), is adapted to effect a shutdown of the further module (60) for periods for which no key generation are provided.

18. A method for generating a secret or a key in a network, wherein the network comprises at least a first subscriber and a second subscriber with a common transmission channel between at least the first subscriber. 21) and the second subscriber (22), wherein the first subscriber (21) and the second subscriber (22) have at least one circuit arrangement with at least one communication module (50) for communication via the transmission channel (30). and at least one further module (60), wherein the first participant

(21) a first value (1) and a second value (0) and the second subscriber

(22) can give at least the first value (1) and the second value (0) to the transmission channel (30), wherein the first subscriber (21) a first subscriber value sequence and the second subscriber (22) a second subscriber value sequence respectively via the at least a further module (60) of their circuit arrangement for largely synchronous transmission on the transmission channel (30) cause and wherein the first subscriber (21) based on information about the first subscriber value sequence and on the basis of a superposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel (30) resulting superposition value sequence and the second subscriber (22) based on information about the second subscriber value sequence and on the basis of the superposition of the first subscriber value sequence with the second subscriber value sequence on the transmission channel (30) resulting overlapping value sequence each have a common secret or generate a shared key.

A computer program adapted to perform the steps of the method of claim 18.

20. An electronic storage medium on which a computer program according to claim 19 is stored.