WO2020120292A1

WO2020120292A1 - Method and system for a secure data transmission

Info

Publication number: WO2020120292A1
Application number: PCT/EP2019/083893
Authority: WO
Inventors: Razvan-Andrei Stoica; Jonathan BECHTOLD; Ivan Alexander MORALES SANDOVAL
Original assignee: WIOsense GmbH & Co. KG
Priority date: 2018-12-11
Filing date: 2019-12-05
Publication date: 2020-06-18
Also published as: DE102018009609A1

Abstract

A method for secure transmission of at least one data stream between two nodes A and B by exploiting a channel reciprocity, wherein at least one random first bit stream pattern is generated by node A and transmitted to node B, and wherein node B responds to the received first bit stream pattern by transmitting a second bit stream pattern to node A. The bidirectional interchange of the bit stream patterns between nodes A and B is performed at least once. To authorize the communicating nodes, test processes are performed between the nodes, with the transmission of the data between the nodes being authorized only if the at least one test process, preferably all test processes, is/are passed.

Description

Process and system for secure data transmission

Description:

The invention relates to a method for the secure transmission of at least one data stream between two nodes according to the preamble of claim 1. Furthermore, the invention relates to a corresponding system for performing the method according to claim 19.

The advancement of the Internet of Things is constantly leading to new applications in which wireless connections or networks are established between different devices in order to exchange data for the execution of certain tasks. Examples include: networking vehicles with vehicle-to-everything (V2X) communication, Industry 4.0, eHealth, smart home systems or device-to-device (D2D) communication.

A problem that concerns all operators and users of such connections or networks is a secure communication link for a secure data exchange between the devices / systems (nodes). Reports of vulnerable network nodes through simple but effective attacks by third parties regularly confirm this problem. A known solution to this security problem is to use a public key infrastructure (PKI) management system, which takes over the task of key management and distribution in the networks. However, the requirements for managing such networks often exceed the performance of the systems used. In addition, the use of PKI systems to provide a trusted central authority could be restricted to proprietary applications. These proprietary applications could limit the connectivity of the devices and therefore only work to a limited extent.

Another very active field of development is the local exchange of information between individual devices, such as car to telephone, telephone to near-field communication (NFC) - payment interface, smartwatch to heart monitor wear / e / pacemaker, etc. For these so-called peers -to-peer (P2P) connections, through which personal and sensitive as well as personal data are exchanged, authentication and authorization of the communicating devices should be ensured. This is especially true during the provision of cryptographic materials to ensure the integrity of the data.

In view of the increase in mobile devices and their connectivity to one another, the present invention is based on the task of creating a secure (on-the-fly, self-managed) P2P connection between several nodes (devices).

A method for solving this problem is described by the measures of claim 1. Accordingly, it is provided to create a method and a system for a collaborative, dynamic generation of symmetrical security keys over a wireless channel. In this generation procedure, security methods such as authentication, authorization and encryption are used jointly by exploiting the wireless channel reciprocity between any two communication nodes (node A and node B). The method and the system according to the invention offer a defense mechanism against attacks on a security key and against man-in-the-middle (MITM) attacks.

For this purpose, an uncorrelated spread of the dwindling wireless channel between the nodes is used as the first means of defense. The defense is particularly directed against a man-in-the-middle (MITM) attack and against a physical layer relaying station (RS) attack by unauthorized persons. The method complements the physical properties of the wireless channels with increased security against attacks by third parties. This supplement consists among other things in stochastic methods that are essential for the generation of security keys. The method according to the invention essentially consists of the following steps:

Generation of at least one random first bit stream pattern by node A and transmission of the first bit stream pattern to node B, with node B transmitting a second bit stream pattern to node A in response to the received first bit stream pattern,

The bidirectional exchange of bitstream patterns between nodes A and B is carried out at least once, preferably several times,

After each exchange of bitstream patterns, the nodes generate and quantize a key symbol from a linear combination of the transmitted bitstream pattern and the received bitstream pattern,

• Errors in the generation of the key symbols are corrected by information reconciliation,

• Authorization of the communicating nodes, preferably node A, by means of at least one, in particular four, test methods between the nodes, wherein the data transmission is only authorized if the at least one, preferably all, test methods pass.

Patterns are to be understood as randomly generated numbers that are represented as a bit stream. The pattern is transferred to a dimension of a signal. This dimension (property) can be, for example, a signal strength or a phase of the signal. This pattern is sent from the transmitter (node A) to the receiver (node B) over a wireless channel. With the transmission, the signal (pattern) changes or a channel modification of the bit stream takes place. From node B's point of view, this modified pattern is the received signal dimension; for example the signal strength. The channel modification or the change in the pattern can be based on the distance between the two nodes. In addition, the modification can also be caused by a frequency and / or by multipath propagation. Instead of the signal strength as a signal dimension, the phase of the signal or a combination of the two signal dimensions can also be used.

The invention can preferably provide that the random bit stream patterns for D2D communication are generated by generators which are implemented on the, preferably two, communicating nodes, an identical wireless channel being used for the communication. In the following, the wireless channel is treated as a complex, time-varying, realistic and dwindling multi-way model. This model takes into account signal modifications, i.e. changes in the pattern of the wirelessly transmitted signals. The signals or the modifications are shaped by the relative positioning of the communicating nodes with each other and their underlying physical environment:

During the exchange of the patterns between nodes A and B, the generation of the key is prepared (key bootstrapping procedure). The method provides that node A has an optimal entropy source that generates a non-public, random bitstream pattern. It can further be provided that a real random number generator (TRNG), a pseudo number generator (PRNG) and / or a linear feedback shift register (LFSR) are used. The generated non-public, random pattern is also displayed on a physical signal dimension, for example signal strength and / or phase, according to a selected modulation multiplex strategy M. The resulting signal is transmitted as a pattern wirelessly from node A to node B.

In the same way, signal processing is performed for node B to create its own public pattern. The randomly generated and non-public bitstream pattern is assumed.

It is envisaged that the generated public patterns of both node A and node B are transmitted wirelessly via public channels. However, this makes the transmission susceptible to information decorrelations by attackers who might try to steal the key generation protocol through MITM or RS attacks. However, the generated public bitstream patterns, which are sent wirelessly, are transformed by a channel transformation function, by which the patterns are folded in a unique way, for each individual P2P connection across all complex channel dimensions: path loss, phase / Delay and frequency / Doppler. (3)

(4)

Assuming the channel reciprocity of the communication links between nodes A and B, the physical environment that changes the exchanged patterns is the same and unique over the channel coherency period that characterizes the wireless medium between the two communicating nodes.

For the process of key generation, the signals or bitstream patterns received via a radio connection are extracted electrically for the extraction of the desired pattern features.

Essentially, these signals or bitstream patterns are sampled along a signal dimension, e.g. the signal strength and / or phase, in order to obtain the cumulative information of both the random patterns generated on the transmitter side and the channel transformation required for each communication link is unique to extract. The channel modifications of the patterns essentially consist of amplitude, phase and frequency effects which are transmitted to the patterns by the dynamic wireless environment. The proposed method detects the channel effects through bidirectional communication.

The signal dimensions, for example the signal strength and / or phase, can be measured by certain RF sensors and estimators. For example, the data acquisition and sampling process can record received signal strength (RSSI) or received phase estimate (RPE) for any carrier frequency (CF) emitted. The data collected in this way partially represent material for a key that is used in the method for key generation.

The complementary component of the key can consist of the unchanged sent bitstream pattern, which is available via the respective sending node. The key symbol is thus composed of a linear combination of the received and the pattern to be sent. In the case of quantization, the key symbol can be resolved into a bit stream / bit stream, which essentially represents the extracted information of the two independently generated bit stream patterns and the physically unique and reciprocal channels of the communication link. Thus, the signal dimensions, such as the signal strength, are measured and added to the signal dimension (signal strength) to be sent. This results in the key symbols, which are represented in a binary bit stream. This representation or transformation of the key symbols as bit streams is referred to here as quantization.

Node I _B + IAB + IA (6)

recv. samples

7 ß seen by l

Node B

, ~ recv. samples

7.4 seen by B

The above-mentioned material for key generation can be created in the style of the ping-pong principle during each communication step between nodes A and B. The key symbols are generated during each transmission. Each of these ping pongs occurs on one of several possible carrier frequencies (CF), so that several CF are transmitted, which are preferably all different. It is essential in this exchange that the order of the different, successive CFs is the same at both nodes.

A combination of these key symbols in a certain size is referred to here as a block. The key is generated with the smallest number of measurement rounds that are required for the required key length between nodes A and B. Additional requirements for additional, more complex feedback mechanisms are not necessary for this. The length of the quantized blocks depends on various parameters, such as, for example, on a reconciliation method used, the code length and / or the length of the keys required. The final key of the quantization phase is made up of the bits of the respective quantized blocks.

The key symbols are quantized in two steps. First, the individual, unchanged symbols are replaced by a linear relative quantizer with a Depth guided by I, which records the oscillations of the embedded patterns around their central baseline. The recording takes place over an interval which is determined by the minimum and maximum values of the sample values after the removal of outliers and invalid samples. The second part of the quantized bit stream is obtained by using a linear absolute quantizer with a depth w, from the first moment of a sampled W block of consecutive symbols. The last-mentioned bits are so-called anchor bits, which are based on the statistical distribution of the symbols in the W-block window. Its purpose is to anchor the key symbol's embedded information as the complement of the first quantized bits that record dynamic symbol information. The relative quantization of the preceding bits also takes place in relation to the mean value of the W block symbol samples. Finally, by-products of the bit stream from the W block of the symbol samples are passed through a "bit interleaver". The "bit interleaver" eliminates potential quantization errors that can occur in practice, which supports the reconciliation. The bits are mixed with each other so that the errors are evenly distributed. In addition, the aforementioned quantizers are supplemented by gray bit coding. This can minimize "intra-quantizer errors" of a similar symbol. The coding means that each subsequent quantization level differs by only one bit.

Accordingly, quantization consists of two parts, the relative and the absolute part. With relative quantization, the maximum and minimum values are measured within the block length and divided into uniform quantization levels. For the absolute part of the quantization, the average of the key symbols is calculated and quantized. The difference to the relative quantization lies in the setting of the interval. The maximum and minimum values are not measured dynamically, but are set in the protocol. The sizes of the quantization levels (and bit length) depend on the application-specific time required for key generation and the environmental conditions. The larger the levels, the longer the key generation takes, since the bit length per ping-pong exchange is smaller.

The remaining errors between the quantized symbols at nodes A and B are corrected by bitstream matching, namely by reconciliation, through public discussion. In this process, the public information gaps during the reconciliation are reduced by random extractors. These fuzzy extractors are based on linear block codes. The purpose of this signal processing is to extract or eliminate the general randomness of noisy information sources. In the method described here, such sources are considered to be the sequence of bits that are individually generated at nodes A and B by the quantized symbols. The random binary sources therefore have signal noise among one another, so that no exact similarity can be guaranteed during quantization.

In addition, the inherent randomness of the bit streams created by the independent patterns of the two communication nodes and by the channel itself is enhanced by the extractors. The error correction method is based on linear error correction codes with syndrome coding and decoding capabilities, which act as key bit generators and processors for matching on the two communicating nodes.

Reconciliation can ensure that the two nodes A and B have generated identical keys. This is made possible, among other things, by using the fuzzy extractor. This ensures that enough information about your own key is publicly transmitted so that the two nodes A and B can generate an identical key without a third party being able to generate the same key from the information.

The reconciliation can be adapted to any embodiment that is based on a compromise between available computing resources and a desirable key generation latency. The embodiments have powerful microprocessors which are intended to carry out the comparison on the entire key level. Instances that have only limited computing resources may have to perform key matching on a block basis with a length W.

To further increase security, in addition to a secure sketch (SS) generated by the extractor syndrome coding, the reconciliation could be applied to a scrambling coding of the publicly available SS, based on a rolling LFSR. This could be supplemented by bits that have already been generated and corrected. The key is adjusted in blocks. The block length is specified by the code word length of the error-correcting code used. For the realizations in which the reconciliation takes place only at the key level and only a public discussion is carried out, the SS contains several syndromes that are extracted from m-different permuted variants of the key. The m permutations of the key allow defective bits to be distributed between the blocks and therefore increase the probability of a successful correction of the bits. The erroneous bits are stored in the associated error vector by each of the permutations. The m error vectors are finally inverted with the respective permutation vector and superimposed on one another. The m-superimposed error vector indicates the incorrect bits in the original key constellation with greater reliability. The seed for generating the different permutations must be defined for both nodes and be identical. The SS is encrypted based on a synchronized LFSR bit in the transmission between the two nodes.

The embodiments that process the bit reconciliation block by block through multiple public discussions are only encrypted using synchronized LFSR bits and only during the first synchronization phase. Further reconciliations of encryption are supplemented by the previously corrected symmetrical bits, which in turn are encrypted with LFSR bits. The basic encryption process limits information gaps during the reconciliation phase and prevents passive MITM attacks on key extraction. The SS obtained in this way are referred to below as self-insured sketches (SS ² ).

The so-called variations of the SS and the methods with which the SS is encrypted, regardless of whether the reconciliation takes place through one or more public discussions, are referred to below as a self-insured sketch (SS ² ).

The OWF (one-way function), which is used in addition to SS ² when hashing the necessary additional public information, can be used as a reconsideration examiner. The check on the receiver side is carried out by means of simple volatile memory byte comparators between the public reconciliation information of the transmitter and the hash generated by the post-syndrome decoding and the error correction on the receiver node. This check represents a first test against a failed cooperative authentication between node A and node B. The bit streams that the OWF checks after Successful reconciliation ensures that node A and node B have been reconciled. In such a case, node A and node B are authenticated.

Successful collaborative authentication offers no security against RS attacks, in which the attacker changes the connection between the communication nodes by using a composite communication channel AE-EB, BE-EA instead of the regular links AB and BA. In order to solve this problem, the authentication carried out up to now has to be expanded by an authorization procedure. This procedure verifies the integrity of an authenticated party and detects eavesdroppers who carry out RS attacks on the communication link between the two devices.

After authentication, the symmetric bit streams obtained are encrypted to the final symmetric keys that are only known to nodes A and B. The key is used in the authorization process to secure communication and to prevent MITM attacks on the sensitive exchange of data. The key is used in the authorization process to secure communication and to prevent MITM attacks on the sensitive exchange of data. The authorization process consists of node A querying node B via the encrypted communication channel for its estimate of the features used in the key generation process and recorded during the reconciliation process. In addition, node A requests from node B a random set of measurement features that were recorded and buffered during the ping-pong data exchange using the key setup method.

For the authorization test procedure, the protocol specifies a time specification for each ping pong, which must not be exceeded when node B responds. This means that a time window is opened with the transmission of data and a response or a corresponding signal from the other node must take place within this defined time window. If the answer is not or not in time, the test is considered failed. In addition, a variance test is carried out at the end of each measurement round (ping-pong). The variance of the measurements or the received signals must be above an expected threshold. If these two tests are passed during the protocol, continue with the following correlation tests.

Node A then performs a normalized cross-correlation c_1 between its own calculated estimates during the reconciliation and those received from node B. If a correlation value exceeds a fixed threshold, an additional check is carried out.

The second authorization check consists of the normalized relative time series cross-correlation c_2 of the random set of feature measurements requested from node B and of sample samples from node A that generated the features. The result of the test is compared to an application-defined threshold. If the test successfully passes the convex combination of the two tests, the entire distributed correlation and authorization is recorded and normalized to the interval [0.1]. The authorization value is compared to a final threshold rho_A. This comparison ends the authorization process from node B through node A with a success or failure.

A preferred embodiment is explained below with reference to the drawing. In this show:

1 is a schematic representation of a transmission device,

2 shows a schematic illustration of a receiving device,

3 shows a schematic illustration of a public pattern generation,

4 shows a block diagram of a protocol for key generation, and

5 shows a representation of a message exchange during the key generation. 1 and 2 show highly schematic block diagrams of a transmitting device 10 and a receiving device 17. These devices 10, 17 are required by two authorized parties in order to communicate with one another and to generate a symmetrical key. The generation of the keys is based on the principle of channel reciprocity between the two wirelessly connected devices 10, 17.

To generate the symmetric keys, the authorized parties carry out a sequence of steps that are defined by a protocol:

1.) Detection of a channel: The transmission device 10 generates a random and non-public (private) bit stream pattern, which is represented as a physical signal. This signal is represented by a pattern generator 14, in particular an RF pattern generator. The bitstream pattern can be a physical signal with a specific or varying signal strength or phase that is transmitted over the air. The receiving device 17 samples the received signal of the transmitting device 10 by means of a sensor 20. A signal pickup 21 measures and accumulates the channel-modified bitstream pattern. This sequence is carried out by nodes A and B in several bidirectional communication steps.

2.) Quantization: After each communication step (according to 1.) a bit stream is generated by the two authorized parties, which is based on a linear combination between the received signal and the transmitted pattern. The resulting double key symbol consists of a bit stream which is relatively quantized, which is based on a measured minimum and maximum sample value and an bit stream which is quantized absolutely w times.

3.) Information balance / reconciliation: In this step the remaining errors in the provisional key are corrected. This is done through public discussion based on linear block codes and syndrome encoding / decoding techniques known in the art as fuzzy extractors. The techniques used and modified here are referred to as "SS ² ".

4.) Strengthening of data protection: In order to counter potential security gaps, which can be caused by the previous steps, extractors based on a secure hashing extract a symmetric key from the finally agreed keys of the previous reconciliation phase. This step ends the key generation phase.

5.) Authorization: The post-authentication comprises a series of tests in connection with the check whether the node B is an authorized node. During this step, node B sends to node A over a secure channel estimates of the properties of the key used in its generation.

The first authorization phase includes a time limit in which the response from node B must arrive at node A. These are determined in the course of the protocol and must not be exceeded. This phase also includes a variance test after each measurement round, in which the variance of the measurements must be above a certain threshold. If this first authorization phase has been passed, the second authorization phase is initiated at the end of the protocol.

The second authorization phase results from a convex combination of the normalized cross-correlation between the received and the self-measured features of the channel and the normalized relative time series of the cross-correlation between the transmitted patterns and the received patterns.

The authentication and authorization of this exemplary embodiment are initialized by the transfer of the initialization parameters from an interface 11 to a microcontroller 12. The initialization parameters initially have the key generation length.

Depending on the current step of key generation, a transmission device 13 is controlled by the micro-controller 12 in a conventional manner. In addition, while the channel is being scanned, a pattern generator 14 is activated to generate a pattern that is imaged by the transmitted signal. The pattern generator 14 is bypassed during the following communication steps (reconciliation and authorization).

However, in order to record and extract the reception pattern, a specific sensor 20, in particular an RF sensor, is used for scanning and querying a specific signal dimension, the sensor 20 being assigned directly to the interface 18 is. A signal pickup 21 extracts the required measurements and accumulates them over the entire step of channel scanning.

After scanning the channel or channels, the measured values recorded by the signal pickup 21 are transmitted to a microcontroller 22 in order to generate the key symbols. The sensor 20 and the signal pickup 21 are deactivated for the following steps of the method.

FIG. 3 shows a block diagram of the method for the dynamic generation of a public RF pattern. This method is also the basis of the pattern generator shown in FIG. 1.

The public RF pattern 27 is generated by a random number generator, preferably a pseudo random number generator (PRNG) 25, which ensures that no pattern is stored in a memory, but is generated directly on site. The generated value is then represented by a function generator 26 or a function, specifically to the applicable RF pattern 27. The RF pattern 27 is then used to modulate the signal dimensioning of the packets, the packets being exchanged between the devices that are trying establish a secure D2D communication connection.

Depending on the value generated by the pattern generator (FIG. 3), a large number or only one dimension of the signal can be changed. To achieve this freedom, an RF pattern multiplexer 28 generates the parameters to modulate each signal dimension independently. The multiplied pattern is then transmitted to a corresponding dimension modulator, which in the present exemplary embodiment is a power modulator 30, preferably a Tx signal power modulator and a phase shifter 31.

The modulator elements 30 and 31 are cascaded and are used to influence the output signals of a transmitter 29, in particular an RF transmitter. Due to the possibility of modulating or scanning such a signal dimension, various exemplary embodiments can include the following, but are not limited to these:

The Tx signal power modulator 30 and the phase shifter 31 are cascaded, The Tx power of the Tx signal power modulator 30 is the only modulated dimension, bypassing the phase shifter 31,

- The phase of the phase shifter 31 is the only modulated dimension, whereby the power modulator 30 is bypassed.

At least one element must be active for the acquisition of the channel. Both elements are normally bypassed in the following steps (reconciliation and authorization) of the protocol.

FIG. 4 shows a block diagram of the present exemplary embodiment, which comprises the authentications and the authorization. The scanning of the channels takes place essentially in two method steps 35 and 40. During step 35, components of the key are generated until the length of the key symbol recorded by the signal pickup has reached the key length requirement . Method step 36 comprises the use of a sensor, a quantizer and a comparator. Step 36 ensures that each bit stream generated during step 35 is symmetrical to its counterpart. Step 40 also ensures that the condition for the actual key symbol is met. In another exemplary embodiment, the tuning can be carried out within a method step 36 after a sufficiently large bit stream length has been generated.

As soon as the required key length has been reached, the aforementioned step of data protection is carried out by method step 36. This step ends the authentication step and initiates the authorization of node B as long as no error occurs.

During the authorization, a method step 38 is used to transmit the required sensitive data from node B to node A in encrypted form. If the authorization exists, method step 38 can also be used for future encrypted data transmissions. If the authorization is not passed, the protocol is aborted.

FIG. 5 shows an overview of the message chain from the key generation protocol. The protocol takes place on the server client \ Ne \ se. Both nodes A and B represent two legitimate parties trying to secure one Establish communication channel in a D2D communication system. In addition to the detailed message pairs, further auxiliary messages that are irrelevant to the secret key can be added. This is done in accordance with a specific embodiment of the invention.

The entire key generation process takes place via node A 41, in particular via a transceiver node A. Via node A 41, a series of requests are made from the beginning of the key generation procedure 42 to the exchange of components of the dynamically generated public patterns 54, 55 that serve to terminate and authorize communication between the parties. The inquiries mentioned are processed and managed by the node B 45, in particular a transceiver node B. The node B 45 is in constant expectation for further packets that are transmitted by the node A 41.

The method is initiated by a request 49 from node A 41 for key generation in accordance with step 42. This request contains the necessary information for node B 45 to set the key generation parameters and to reset the registers and variables used previously to their standard states.

The information transmitted may include, but is not limited to:

- bit length of the key,

Number of correct bits b (see arrow 46) per round,

Number of pattern exchanges before error correction 47.

As soon as the initialization requirements have been met by node B 45, an answer is sent to node A 41. This answer is a confirmation 48 of the key generation, which is only a repetition of query 42. The returned message can then be verified by node A 41 to ensure that node B has been initialized with the desired parameters to start the protocol. Each response from node B 45 must occur within a specified time limit in this protocol. Otherwise the protocol is aborted.

In the next step of the protocol, b bits (see arrow 46) are generated from the m exchanged components of the dynamically generated public pattern. That number may depend on a balance between latency and throughput enforced by processing capabilities of an embodiment of the invention and a length of the secret key currently being generated by the protocol.

The i-th exchange of the b-bit generation is started by node A 41, in which the Me component of its signal pattern is sent as a modulated request for measurement 43. The node-modified signal pattern is stored at node B 45 for later use during quantization and authorization 53. In response

44, a confirmation of the measurement is sent to node A 41, the response being modulated with the menu component of the signal pattern dynamically generated by node B 45. At the end of every i-th exchange, the variance test of the first authorization phase is carried out. The variance of the measurements must be above a certain threshold value, otherwise the protocol is terminated because an MITM attack has probably occurred. The ping-pong game described is repeated several times in order to generate enough data for b correct bits (see arrow 46). Each exchange is transmitted on a specific CF, whereby the CF order is or must be the same on both nodes.

Once nodes A 41 and B 45 have successfully acquired the dynamically generated signal patterns of the other nodes 45, 41 via the public wireless channel, the patterns on each side are quantized to generate b bits (see arrow 46). However, tolerances in the hardware can lead to irregularities in the moment of generation and measurement of the public signal pattern. The integrity of the bits must therefore also be checked if the method works well within a coherence time of the reciprocal communication channel.

The generated bits are then compared in a public discussion as a cooperative error correction 47 using error correction codes to detect and correct inconsistencies between the independently generated signal streams. For this purpose, node A 41 sends a secure query draft 51, which has its own SS ² plus the decomposed public information for node B.

45 contains to perform error correction on the bits generated by quantizing the acquired dynamically generated signal pattern from the channel.

After node B 45 has performed the error correction from its side, a new SS ^{2 is} calculated to take into account the few errors that the process does not could compensate. This SS ² is sent back to node A 41 as a secure request draft 52. By using the SS ² of node B 45, node A 41 is able to completely match the independently generated security keys.

After successfully generating a number of symmetric bits at both nodes, the entropy of the generated stream must be maximized for cryptographic purposes. This happens at the level of data protection enhancement that uses a synchronized cryptographic OWF that generates a unique stream of almost uniformly distributed bits that are used as security keys.

By using identical bit streams, which are generated on each side of the point-to-point communication link, as input for the cryptographic OWF, identical security keys are generated at both nodes 41 and 45. This step represents the end of the authentication procedure for the key generation protocol, with which the authorization is ready to start.

If authorization phase 53 is initiated and the protocol has not been terminated before, this means that the first authorization phase with the time specifications and variance tests was successfully passed. For the authorization procedure 53, the node A 41 initiates the exchange by sending an encrypted authorization request 54. The authorization request 54 is encrypted by the symmetrical keys that were generated during the previous authentications. The content of the key specifies what information must be provided to authorize the key. As soon as the node B 45 has collected the required data, the data is packaged and sent back as an encrypted authorization confirmation 55.

The node A 41 evaluates a correlation between randomly selected local and remotely measured features 56, which result from the confirmation 55. As soon as a value has been calculated from the correlation of the features 56, a key is authorized if a certain threshold value has been reached. Otherwise the communication is terminated because a low value is an indication that the devices are being attacked by an MITM.

_***** Reference symbol list:

Transmitter 36 Process step interface 37 Process step micro-controller 38 Process step transmitter device 39 Process step pattern generator 40 Process step interface 41 node A means 42 Process step receiver device 43 pattern

Interface 44 pattern

Transmitter 45 node B sensor 46 arrow

Signal pickup 47 Micro controller error correction 48 Interface confirmation 49 Request

Medium 50 Random number authorization, RNG 51 request

Function generator 52 request

RF pattern 53 authorization RF pattern multiplexer 54 request

Sender 55 confirmation power modulator 56 feature phase modulator

medium

Procedural step

Claims

Claims:

1. Method for the secure transmission of at least one data stream in an ad-boc network between two nodes A and B using a channel reciprocity, characterized by at least the following steps:

• Generation of at least one random first bit stream pattern by node A and transmission of the first bit stream pattern to node B, with node B transmitting a second bit stream pattern to node A in response to the received first bit stream pattern ,

The bidirectional exchange of the bit stream patterns between nodes A and B is carried out at least once, preferably several times,

· After each exchange of bitstream patterns, nodes A, B create a

Linear combination of the transmitted bitstream pattern and the received bitstream pattern generates and quantizes a key symbol,

for an authorization of the communicating nodes, preferably the node

B, at least one, in particular four, test methods are run between the nodes, the transmission of the data between the nodes being authorized only if the at least one, preferably all, test methods pass.

2019111903.DOC

2. The method according to claim 1, characterized in that random bit stream patterns for a D2D communication are generated by generators, which are implemented on the, preferably two, communicating nodes, an identical wireless channel being used for the communication.

3. The method according to claim 1 or 2, characterized in that the generated, non-public and random patterns on a physical signal dimension, in particular on a signal strength and / or a phase, according to a selected modulation multiplex strategy, are represented, the resulting signal as a pattern is transmitted wirelessly from node A to node B.

4. The method according to any one of the preceding claims, characterized in that the random first bit stream patterns are essentially sampled along a signal dimension, in particular the signal strength and / or the phase, in order to obtain cumulative information of both the random patterns generated on a transmitter side as well as the channel transformation, which is unique for each communication link.

5. The method according to any one of the preceding claims, characterized in that a carrier frequency (CF) is changed with each exchange of patterns during the scanning of a channel, wherein an order of the successive CF is determined and this order is the same for both nodes A and B. .

6. The method according to any one of the preceding claims, characterized in that the signal dimensions, in particular the signal strength and / or the phase, are measured by certain RF sensors and estimators, with the received signal strength (RSSI) or the data acquisition and sampling process received phase estimate (RPE) can be recorded for any carrier frequency (CF) emitted.

7. The method according to any one of the preceding claims, characterized in that a material for a key is generated by a linear combination of the sampled received information and the self-generated and available random pattern of the receiver, the received information on a channel-modified transmitted pattern and on a unique detachable communication link was established.

8. The method according to any one of the preceding claims, characterized in that, in the case of quantization, the key material is resolved into a bitstream / bitstream which essentially represents the extracted information of the two independently generated bitstream patterns and the physically unique and reciprocal channels of the communication link, whereby the key symbols are quantized in two steps, the individual, unchanged symbols first being passed through a linear relative quantizer with a depth of I and then the second part of the quantized bit stream obtained by using a linear absolute quantizer with a depth w is and with the relative quantization within a block length, a maximum and a minimum value is measured and divided into uniform quantization levels and an average of the key symbols is calculated and quantized in the absolute part of the quantization.

9. The method according to any one of the preceding claims, characterized in that remaining errors between the quantized symbols at nodes A and B are corrected by a bitstream comparison (reconciliation) by public discussion, preferably information gaps, in particular a loss of information, by Random extractors are limited and these extractors are based on linear block codes.

10. The method according to any one of the preceding claims, characterized in that the reconciliation ensures that the nodes A and B generate identical keys, which is preferably made possible by the use of a fuzzy extractor which ensures that sufficient Notes on your own key are publicly transmitted so that the two nodes A and B can generate an identical key without a third party being able to generate the same key from the notes.

11. The method according to any one of the preceding claims, characterized in that an OWF (one-way function), which is used in a hashing of the necessary supplementary public information in addition to an SS ² , is used as a reconciliation checker, the verification on the receiving end by means of simple volatile memory byte comparators between the sender's public reconciliation information and the recipient's hash generated by the post-syndrome docodering and the error correction.

12. The method according to any one of the preceding claims, characterized in that an authentication is extended by an authorization procedure in which an integrity of an authenticated party is verified and eavesdroppers are recognized which carry out MITM attacks on the communication link between the two devices.

13. The method according to any one of the preceding claims, characterized in that after authentication, the symmetrical bit streams are encrypted to the final symmetric keys, which are only known to nodes A and B, the key being used in the authorization process to secure the communication and to prevent MITM attacks on the sensitive exchange of data.

14. The method according to any one of the preceding claims, characterized in that during the authorization process, the node A from the node B via the encrypted communication channel queries its estimate of the features used in the key generation process and recorded during the reconciliation process, with node A from node B a random set of measurement features are queried, which were recorded and buffered during a ping-pong data exchange using the key setup method.

15. The method according to any one of the preceding claims, characterized in that each response, in particular the transmission of a pattern from node B to node A in response to a pattern of node A received from node B, must take place within a fixed time limit in order for the test is assessed as passed.

16. The method according to any one of the preceding claims, characterized in that after each exchange of patterns between the nodes A and B, a variance test is carried out on the measurements and the variance to pass the test must be below less than a certain threshold.

17. The method according to any one of the preceding claims, characterized in that node A performs a normalized cross-correlation c_1 between its own calculated estimates during the reconciliation and those received from node B, an additional one Check is carried out if, in particular, a correlation value exceeds or falls below an application-specific threshold value.

18. The method according to any one of the preceding claims, characterized in that a second authorization check is carried out, which consists in that in a normalized relative time series cross-correlation c_2 of the random set of feature measurements queried by node B and sample samples from node A, which the features generated, the result is compared to an application-defined threshold.

19. System for performing a method according to at least one of claims 1 to 18.