WO2020126923A1

WO2020126923A1 - Method for communication between machine tools in a network

Info

Publication number: WO2020126923A1
Application number: PCT/EP2019/085122
Authority: WO
Inventors: Sebastian Berning; Cankal ALTUN
Original assignee: Robert Bosch Gmbh
Priority date: 2018-12-20
Filing date: 2019-12-13
Publication date: 2020-06-25
Also published as: DE102018222464A1

Abstract

The invention relates to a method for communication between machine tools in a network using asymmetrical cryptography, in particular using a public key infrastructure. In at least one method step (58a), a data packet is encrypted and/or decrypted by means of at least one communication unit (22a; 22b; 22c; 22d; 22e) and/or at least one control and/or regulating unit (24a; 24b; 24c; 24d; 24e), in particular using at least one cryptoprocessor (26a; 26b; 26c; 26d; 26e), of at least one machine tool (12a; 12b; 12c; 12d; 12e) via a public key function (82a; 82b; 82c; 82d; 82e) and/or a private key function (84a; 84b; 84c; 84d; 84e), in particular a key function which is specific to the machine tool, during a data transmission and/or authentication of the at least one machine tool (12a; 12b; 12c; 12d; 12e) by means of a server unit (18a; 18b; 18c; 18d; 18e), at least one additional machine tool (12a; 12b; 12c; 12d; 12e), and/or at least one external unit (34a; 34b; 34c; 34d; 34e) via a network unit (20a; 20b; 20c; 20d; 20e).

Description

description

Process for the communication of machine tools in a network

State of the art

In US 2017/0364360 A1, a method for communicating machine tools using asymmetric cryptography has already been proposed.

Disclosure of the invention

The invention relates to a method for communicating machine tools in a network using asymmetric cryptography, in particular using a public key infrastructure.

It is proposed that in at least one method step in the case of data transmission and / or authentication of at least one machine tool via a network unit with a server unit, at least one further machine tool and / or at least one external unit, a data packet by means of at least one communication unit and / or at least one control and / or regulating unit, in particular by means of at least one crypto processor, the machine tool is encrypted and / or decrypted via a public key function and / or private key function that is specific to machine tools.

The method is preferably set up to secure the communication of the machine tools in the network, in particular against external and / or unauthorized interference. Under "asymmetric cryptography" in particular an encryption method for communicating the data between two identities can be understood, each identity having different information for encryption and / or decryption of the data. A “public key infrastructure” is to be understood in particular as an encryption method that is based on asymmetric cryptography, where at least one private key and at least one public key exist for an identity set up as the recipient of data, and the public key is set up to encrypt data and the private key is set up to decrypt the data encrypted with the public key. “Furnished” should be understood to mean, in particular, specially programmed, specially designed and / or specially equipped. The fact that an object is set up for a specific function should in particular be understood to mean that the object fulfills and / or carries out this specific function in at least one application and / or operating state. For example, the machine tool is authenticated in at least one procedural step, in particular when the machine tool is started up, when a machine tool is used with a locking and / or theft protection function, when a tool monitoring function of the machine tool is used, with a user account management of the machine tool or The like. Preferably the network is as an intranet as an Internet, as a Bluetooth, VLC, NFC, LAN, USB, WPAN, WUSB, Powerline, CAN bus and / or another a network known to a person skilled in the art or the like. The network unit is preferably designed, for example, as a router, as a modem, as a LAN switch, as a gateway or the like. The communication, in particular authentication and / or data transmission, of the machine tool with the server unit and / or the further machine tool is preferably managed via the server unit. Authentication and / or data transmission of the machine tool by / to the server unit preferably takes place / takes place via a connection of the machine tool to the server unit via the network unit. However, it is also conceivable for authentication and / or data transmission of the machine tool to take place directly through / to the server unit. A “control and / or regulating unit” is to be understood in particular as a unit with at least one control electronics. “Control electronics” should in particular be understood to mean a unit with a processor unit and with a memory unit and with an operating program stored in the memory unit. A “crypto processor” is to be understood in particular as a unit which comprises at least one microprocessor and which is set up to perform basic functions of data communication secured by cryptography, in particular, for example, authentication, cryptographic algorithms, and management of cryptology keys and / or network protocols or the like. The control and / or regulating unit and / or the crypto processor are / are at least essentially designed to be tamper-proof. The fact that an electronic unit, in particular the control and / or regulating unit and / or the crypto processor, is “at least essentially tamper-proof” is to be understood in particular to mean that the unit is designed such that an unauthorized, in particular physical and / or digital intervention to change at least one operating parameter of the unit, in particular a programming command and / or a command parameter of the control and / or regulating unit and / or the crypto processor, is at least made more difficult. Preferably, the control and / or regulating unit and / or the crypto processor has permanently assigned interfaces to other components, at least making it difficult to connect an external device.

The public and / or private key function is / is preferably designed as, in particular digital, information which is set up to parameterize a cryptographic algorithm. The public and / or private key function is / is particularly preferably designed as a bit sequence. In at least one method step, the public and / or private key function of the machine tool is preferably assigned by means of the server unit. The public key function is preferably set up to encrypt the data packet. The private key function is preferably set up to decrypt a data packet encrypted by means of the correspondingly configured public key function. The data packet is preferably decrypted using a component, in particular the control and / or regulating unit, the machine tool or the server unit, to which the private and public key function is assigned. The data packet to be encrypted and / or decrypted is advantageously designed as an authentication query, as a tool-specific and / or operationally system-relevant file or the like. In at least one method step, the machine tool is particularly preferably authenticated by means of the communication unit and / or the control and / or regulating unit, in particular by means of the crypto processor, the machine tool before data transmission. The server unit preferably comprises at least one monitoring function which is set up to detect a device, in particular the machine tool, in the network and / or to check the network periodically or continuously for devices, in particular machine tools. The devices, in particular the machine tool, are preferably authenticated as a function of a reference time interval over which the detected machine tool is located in the network. An authentication request is preferably sent to the machine tool by means of the server unit, in particular via the network unit, if the reference time interval is exceeded due to a length of stay of the machine tool in the network. It is conceivable that in at least one method step the authentication request of the server unit is issued to a user of the machine tool, in particular via an output unit of the machine tool. During or after successful authentication of the machine tool in the network, a user is preferably given an optical, haptic and / or acoustic signal via the output unit.

The embodiment of the method according to the invention enables advantageously secure communication between a number of machine tools and / or a machine tool and a server unit. An advantageously high degree of flexibility can be made possible, in particular since secure communication can take place independently of the transmission channels used. An advantageous high Ge secrecy of a data packet can be made possible by the configuration according to the invention. An advantageous precise and simple assignment of machine tools in the network can take place. Furthermore, it is proposed that in at least one method step of the machine tool using the server unit, exactly one machine tool-specific parameter, the public key function and the private key self-function are assigned and transmitted, the machine tool-specific parameter, the public key function and the private key self-function in at least one be stored in a storage unit of the machine tool. The machine tool-specific parameter is preferably designed as a bit sequence, as a number sequence, as a word sequence or the like. It is also conceivable that the machine tool-specific parameter is designed as a combination of at least one word sequence and at least one number sequence or the like. The public key function is advantageously assigned to the tool-specific parameter by means of the server unit and stored in the server unit, in particular a storage unit of the server unit. In at least one method step, when the data packet is encrypted by means of the control and / or regulating unit, in particular the crypto processor, the data packet is signed with the machine tool-specific parameter. In the signature of the data packet, the machine tool-specific parameter is preferably added to the, in particular encrypted, data packet by means of the control and / or regulating unit. Particularly preferably, in at least one method step, the server unit transmits a further public key function of the server unit to the machine tool and stores it in the memory unit of the machine tool. In at least one method step, a data packet is preferably encrypted by means of the control and / or regulating unit, in particular the crypto processor, via the further public key function and, in particular via the network unit, transmitted to the server unit. Advantageously, the further public key function of the server unit is transmitted to the machine tool, the network unit and / or the further machine tool before or during an authentication of the machine tool and / or the further machine tool by the server unit in the network. The machine tool-specific parameter, the public key function and the private key function are preferably assigned and / or transmitted by means of the server unit during or after a manufacturing process of the machine tool. The public key function of the machine tool is preferably carried out before or during an authentication of the machine tool by the server unit in the network to the server unit, the network unit and / or the other machine tool transmitted. The inventive design of the method allows an advantageously precise and simple assignment of data packets and machine tools in the network. Advantageously, secure communication can be achieved by the configuration according to the invention, in particular since data packets can be encrypted and / or decrypted specifically for machine tools.

In addition, it is proposed that in at least one method step, at least one digital certificate is generated by means of the server unit and / or the external unit, which includes at least one machine tool-specific parameter, the public key function, the private key function and / or at least user information and in the storage unit the machine tool is deposited. The machine tool is preferably authenticated in at least one method step by means of the server unit by checking the digital certificate, at least one component of the digital certificate being compared by means of the server unit with at least one reference value of the component stored in the server unit. The digital certificate is preferably designed as a bit sequence, as a data record or the like. It is conceivable that the digital certificate, in particular in the case of authentication, is encrypted and / or decrypted by means of the server unit and / or the machine tool using a cryptographic key function, in particular the server unit. Alternatively or additionally, it is conceivable that a plurality of digital certificates are stored in the storage unit of the machine tool in at least one method step, in particular for authentication of the machine tool with a plurality of server units, network units, other machine tools and / or external units, in particular for Communication of the machine tool with units in a variety of networks. The digital certificate is preferably generated by means of the server unit and / or the external unit during or after a manufacturing process of the machine tool or during or before authentication of the machine tool by the server unit in the network. The inventive design of the method enables advantageously simple and fast authentication in a network become. An advantageously low computing effort in the network, in particular the server unit and / or the machine tool, can be achieved, since in particular only the digital certificate is checked for authentication.

It is further proposed that in at least one method step, at least one digital marker is created by means of the machine tool, the server unit and / or the external unit, which is configured to at least one user and / or at least one external unit via the communication unit and / or to verify the control and / or regulating unit, in particular the crypto processor, for at least one application with the machine tool and / or the server unit. The digital marker is preferably checked by the machine tool and / or the server unit in at least one method step before the machine tool and / or the server unit is used by a user and / or an external unit. An input request to make the digital marker available is preferably output via the machine tool, in particular the output unit of the machine tool, and / or the server unit before use. In particular, the input request takes place via at least one haptic, acoustic and / or optical signal, the output unit of the machine tool and / or an output unit of the server unit. The digital marker is advantageously designed as a bit sequence, as a number sequence, as a word sequence or the like. It is conceivable that the digital marker, in particular the digital marker of a user, is stored in an external storage unit. The digital marker is preferably created before or during a first application by a user and / or an external unit with the machine tool. The digital marker stored in the external memory unit is preferably created and the digital marker is checked via the machine tool and / or the server unit via at least one interface of the machine tool and / or the server unit. The interface of the machine tool and / or the server unit is particularly preferably at least essentially tamper-proof. The external storage unit is advantageously at least essentially tamper-proof. The inventive design of the method can an advantageously simple and secure identity check can be achieved, in particular since only the previously generated digital marker can be checked for use of the machine tool and / or the server unit. An advantageously high level of security can be made possible, in particular since unauthorized use of machine tools can advantageously be avoided.

Furthermore, it is proposed that the data transmission and / or the authentication of the machine tool with the network unit, the server unit and / or the further machine tool via the communication unit and / or the control and / or regulating unit, in particular the crypto processor at least one encryption protocol based on Transport Layer Security (TLS) is secured. In particular, the encryption protocol is designed as TLS 1.3 and / or as another, in particular more current version of a Transport Layer Security (TLS) protocol known to a person skilled in the art. The authentication and / or the data transmission of the machine tool is particularly preferably carried out in at least one method step by the network unit, the server unit and / or the further machine tool by means of the encryption protocol based on Transport Layer Security (TLS) and a previous check of a digital certificate of the machine tool , the network unit, the server unit and / or the other machine tool. The inventive configuration of the method enables advantageously secure authentication and / or data transmission in the network. The inventive configuration advantageously allows so-called “man-in-the-middle attacks” to be advantageously avoided.

In addition, it is proposed that in at least one method step via the communication unit and / or the control and / or regulating unit, in particular the crypto processor, at least one authentication of at least one user and / or the external unit with the machine tool, the network unit and / or the server unit takes place as challenge-response authentication. In the case of challenge response authentication, the user and / or the external unit is preferably given a task which must be answered for authentication by means of at least one piece of information. The task is advantageously output by means of at least one acoustic, haptic and / or optical signal via the output unit of the machine tool. It is also conceivable that the task is output via the server unit. The information is preferably designed as predefined, in particular secret, information. Advantageously, in at least one method step, in particular before authentication, the information to the user and / or the external unit, in particular encrypted, is output and / or transmitted. Alternatively or additionally, it is conceivable that the task is determined by means of the server unit using at least one statistical method, the information in particular being based on a logical principle and / or a general knowledge of a user. The inventive design of the method enables advantageously simple and fast authentication in the network.

It is further proposed that in at least one method step for authentication of at least one tool accessory unit, in particular when the tool accessory unit is connected to the machine tool, by means of the communication unit, the control and / or regulating unit, in particular the crypto processor, and / or the Server unit, in particular automatically, at least one digital certificate of the tool accessory unit is checked. The authentication of the tool accessory unit is preferably carried out by the server unit before, during or after fastening and / or connecting the tool accessory unit to the machine tool. In particular, the tool accessory unit is designed as a rechargeable battery, as a diagnostic tool, as a vacuum cleaner unit, as a lamp and / or another tool accessory unit for the machine tool known to a person skilled in the art. Preferably, the digital certificate of the tool accessory unit is stored in a memory unit of the machine tool in at least one method step, in particular during a production of the machine tool and / or an authentication of the machine tool in the network by the server unit. When the tool accessories are authenticated by the server unit, at least one electrical and / or electronic signal, in particular a data packet, is preferably sent to the server unit. Preferably, at least all machine tools and tool accessories are in the server unit, in particular the sensor unit of the server unit Network monitored. When authenticating the tool accessory unit, at least one point in time of the authentication is preferably stored in the server unit and arranged in a register of the server unit, in particular in terms of time, type of tool accessory, according to relevance or the like. In particular, the register can be called up by a user via the communication unit of the machine tool and / or an operating unit of the server unit. The configuration of the method according to the invention enables advantageously precise monitoring of the machine tools in the network. An advantageously high level of security can be achieved, in particular since an influence by unauthenticated accessory units on the machine tool can be partially avoided. The configuration of the invention enables monitoring of the tool accessories.

Furthermore, it is proposed that encrypted operating system-related data are transmitted to the machine tool in at least one method step via the network unit and / or the server unit, in particular by means of the public key function, which data are transmitted by means of the communication unit and / or the control and / or regulating unit , in particular the crypto processor, in particular by means of the private key function, decrypted and processed with at least one computing unit of the machine tool. The operating system-related data are preferably designed as an operating system update, as a change in operating parameters or the like. The decrypted operating system-related data is preferably processed in a passive and / or inactive state of the machine tool, in particular while a motor of the machine tool is deactivated. The encrypted operating system-related data is preferably transmitted by the server unit to all machine tools in the network, in particular in particular at least essentially at the same time. The fact that events, in particular data transmissions, take place “at least essentially at the same time” is to be understood in particular to mean that the events, in particular in each case a start time of the events, are offset in time by at most 60 s, preferably at most 30 s, particularly preferably at most 10 s take place from each other.

However, it is also conceivable that the encrypted operating system-related data upon successful authentication of the machine tool by the Server unit are transferred to the machine tool. It is preferably carried out in at least one method step of transmitting security copies of the operating system of the machine tool, in particular via the network unit, to the server unit, the security copies of the operating system being encrypted via the control and / or regulating unit of the machine tool by means of the further public key function . The encrypted backup copies of the operating system of the machine tool are preferably decrypted via the further control and / or regulating unit of the server unit by means of the further private key function. It is conceivable that the decrypted backup copies of the operating system are checked for at least one unauthorized manipulation of the machine tool in at least one process step by means of a comparison of reference system data of the operating system via the further control and / or regulating unit of the server unit. When an unauthorized manipulation of the machine tool is detected, a haptic, acoustic and / or optical signal is preferably output to a user and / or an electrical and / or electronic signal is output to an external unit and / or the machine tool, in particular to one Deactivation of the machine tool. As an alternative or in addition, if an unauthorized manipulation of the machine tool is detected, the machine tool is excluded, in particular temporarily, from the network, authentication and data transmission of the machine tool with other units in the network being prevented. The inventive design of the method enables an advantageously simple and secure transmission of system updates. Advantageously, secure communication in the network can be made possible, in particular since the operating system of the machine tool can be updated via a secure connection.

In addition, it is proposed that in at least one method step, at least one further public key function, in particular the further key function described above, is output to the machine tool and / or the network unit by means of the server unit, with, in particular in at least one further method step, for data transmission and / or authentication of the machine tool and / or the network unit with the server at least one data packet is encrypted by means of the further public key function and is decrypted by the server unit by means of at least one further private key function. In at least one method step, user-related and / or application-related data packets of the machine tool are preferably transmitted in encrypted form to the server unit by means of the control and / or regulating unit, in particular periodically or continuously. In at least one method step, data packets to be transmitted from the machine tool and / or the network unit to the server unit are signed by means of the control and / or regulating unit of the machine tool with the digital certificate, in particular the machine tool-specific parameter, of the machine tool. Preferably, the network-related data packets encrypted in at least one method with the further public key function are transmitted from the network unit to the server unit. The inventive design of the method allows advantageously secure authentication and / or data transmission to be achieved by the server unit.

It is further proposed that in at least one method step in the data transmission and / or authentication of the machine tool, the, in particular encrypted, data packet is identified with at least one, in particular the, machine tool-specific parameter described above, wherein, in particular in at least one further method step, the Data packet is decrypted via the server unit by means of at least one of the tool-specific parameters, in particular the public key function described above. In at least one method step, the server unit preferably assigns the digital certificate of the machine tool to the machine tool-specific parameter and stores it in the server unit. However, it is also conceivable that the machine tool-specific parameter and / or the public key function are assigned by means of the server unit using the digital certificate. The machine tool-specific parameter, the public key function and / or the digital certificate are advantageously stored on an at least essentially tamper-proof memory unit of the server unit. Alternatively or additionally, it is conceivable that the server unit, periodically or continuously, signed and / or by means of tool-specific parameters the further public key function can be accessed by the network unit. The network unit is preferably set up to differentiate and sort data packets depending on a signature and / or an encryption type. The inventive design of the method enables an advantageously fast decryption of a transmitted data packet. An advantageously simple assignment of the tool-specific data can take place.

In addition, a system for communication of machine tools in a network by means of asymmetric cryptography, in particular by means of at least one public key infrastructure, in particular according to a method according to the invention, with at least one machine tool according to the invention, with at least one server unit and with at least one network unit is provided beat. The network unit is preferably set up to enable communication for authentication and / or data transmission between the machine tool and the server unit. It is conceivable, in particular if the machine tool is at a distance from the server unit within a connection range of a type of communication in the network, that the machine tool and the server unit communicate directly with one another. The system preferably comprises a large number of machine tools. The system preferably comprises at least one tool accessory, which is in particular of modular design. The tool accessory unit is advantageously set up for at least one application with the machine tool, in particular the machine tool and / or the server unit being set up to authenticate the tool accessory unit before use with the machine tool. The system preferably has exactly one public and exactly one private key function for each machine tool and each server unit of the system. The server unit is preferably designed, for example, as a cloud server, as a blockchain, as a local server, as an intranet server or the like. Particularly preferably, the server unit comprises at least one further control and / or regulating unit, in particular a further crypto processor, for encrypting and decrypting data packets. The further control and / or control unit, in particular the further crypto processor, is preferably at least essentially tamper-proof. Preferably the other one Control and / or regulating unit has at least one storage unit. Particularly preferably, at least one component of the storage unit is designed as a non-volatile data memory. Public key functions of all machine tools of the system and a further public key function and a further private key function of the server unit are preferably stored in the storage unit. The server unit is preferably set up to transmit the further public key function, in particular during or before authentication of the machine tool to the network unit and / or to, in particular a communication unit, the machine tool. Advantageously secure communication between the machine tool and the server unit can be achieved by the configuration of the system according to the invention. An advantageously high functionality of the machine tool can be achieved, in particular since the machine tool can be securely networked with an Internet and / or an intranet.

Furthermore, a machine tool for communication in a network by means of asymmetric cryptography, in particular by means of at least one public key infrastructure, in particular according to a method according to the invention, is proposed, the machine tool having at least one communication unit for, in particular wireless, transmission of electronic data and comprises at least one control and / or regulating unit connected to the communication unit for evaluating and / or processing transmitted and / or transmitted data. It is conceivable that the control and / or regulating unit comprises at least one crypto circuit, in particular the crypto circuit comprising the crypto processor. The crypto circuit is preferably designed as a circuit board which has at least one electrical line, a storage unit, an authenticator and / or further components which seem useful to a person skilled in the art for encrypting and / or decrypting data. The crypto circuit is preferably at least essentially tamper-proof. In particular, the control and / or regulating unit has at least one memory unit which has at least one component which is designed as a non-volatile data memory. The control and / or regulating unit preferably comprises at least one housing unit which is set up to control and / or regulate, in particular to protect the crypto circuit and / or the crypto processor from physical unauthorized influences. The housing unit preferably at least substantially completely encloses the crypto circuit and / or the crypto processor. The housing unit is preferably at least essentially captively connected to a component of the control and / or regulating unit, in particular the crypto circuit and / or the crypto processor. The fact that a unit, in particular the housing unit, is connected to another unit, in particular the component of the control and / or regulating unit “at least essentially in a captive manner” should in particular be understood to mean that the unit only with the aid of Cutting tools, such as a saw, in particular a mechanical saw, etc., chemical release agents, such as solvents, etc. and / or a unit-specific tool can be separated from the further unit. The machine tool preferably comprises at least one interface, which is designed to connect the machine tool to a tool accessory unit. The communication unit and / or the control and / or regulating unit, in particular the crypto processor, is preferably set up to verify the tool accessory unit for at least one application with the machine tool and / or the server unit. The machine tool advantageously has at least one input unit for interaction with a user and / or an external unit. The machine tool preferably has at least the output unit for outputting at least one piece of information, in particular an acoustic, optical and / or haptic signal. The output unit is preferably set up to signal at least one input request and / or to output operating information of the machine tool to a user. The input unit can be formed in one piece with the output unit, in particular in the case of a configuration of the input unit as a touch-sensitive display or the like. The configuration according to the invention enables advantageously secure communication with a server unit and / or another machine tool. The inventive design of the machine tool can advantageously achieve a high level of functionality, in particular since the machine tool can be linked via a secure connection to the Internet or an intranet. It can be advantageous to closely monitor the Machine tools are made possible, especially when used within a system and / or in a network.

Furthermore, it is proposed that the control and / or regulating unit be set up to decrypt or encrypt transmitted and / or transmitted data. The control and / or regulating unit is preferably set up to encrypt the data to be transmitted by means of a further public key function of a transmitter unit, in particular the server unit. The control and / or regulating unit is preferably set up to decrypt data transmitted in particular via the communication unit by means of a private key function of the machine tool. The private key function and the public key function are advantageously stored on the storage unit of the machine tool. Advantageously secure communication can be achieved by the inventive design of the machine tool. An advantageously high level of safety can be achieved, in particular since control of the machine tool by unauthorized influences can advantageously be avoided.

The method according to the invention, the system according to the invention and / or the machine tool according to the invention should / should not be limited to the application and embodiment described above. In particular, the method according to the invention, the system according to the invention and / or the machine tool according to the invention can have a number which differs from a number of individual elements, components and units as well as method steps mentioned in order to fulfill a function described here. In addition, in the value ranges specified in this disclosure, values lying within the stated limits are also to be considered disclosed and can be used as desired.

drawing

Further advantages result from the following description of the drawing. Five exemplary embodiments of the invention are shown in the drawing. The drawing, the description and the claims contain numerous features in Combination. The person skilled in the art will expediently also consider the features individually and combine them into useful further combinations.

Show it:

1 is a schematic representation of a system according to the invention for communication of machine tools in a network with a machine tool according to the invention for carrying out a method according to the invention,

Fig. 2 shows a further schematic representation of the invention

System with an allocation of the cryptographic elements,

3 is a schematic representation of the machine tool according to the invention,

4 shows a schematic representation of a sequence of the method according to the invention,

5 is a schematic representation of a first alternative embodiment of a system according to the invention with a machine tool according to the invention for carrying out a method according to the invention,

6 shows a schematic representation of a second alternative design of a system according to the invention with a machine tool according to the invention for carrying out a method according to the invention,

Fig. 7 is a schematic representation of a third alternative configuration of a system according to the invention with a machine tool according to the invention for carrying out a method according to the invention and

8 is a schematic representation of a fourth alternative embodiment of a system according to the invention with a machine tool according to the invention for carrying out a method according to the invention. Description of the embodiments

FIG. 1 shows a system 10a for the communication of machine tools 12a, 14a in a network 16a by means of asymmetric cryptography, in particular by means of at least one public key infrastructure. The system 10a comprises a machine tool 12a, a server unit 18a and a network unit 20a. The machine tool 12a has a communication unit 22a and a control and / or regulating unit 24a, which comprises a crypto processor 26a. The server unit 18a has a further control and / or regulating unit 28a, which comprises a further crypto processor 30a. The machine tool 12a, the network unit 20a and the server unit 18a are preferably wired and / or wirelessly connected to one another via the network 16a. Authentication and / or data transmission from and / or with machine tool 12a, server unit 18a and / or another machine tool 14a of system 10a preferably takes place via network unit 20a. It is conceivable that, in particular if the distance between the machine tool 12a and the server unit 18a and / or the further machine tool 14a is small, the authentication and / or the data transmission takes place directly. The system 10a preferably comprises at least one tool accessory unit 32a which interacts in particular with the machine tool 12a for use. FIG. 1 shows a tool accessory unit 32a designed as a rechargeable battery. However, other configurations of the tool accessory unit 32a are also conceivable. The machine tool 12a, the server unit 18a and / or an external unit 34a is preferably set up to generate a digital marker 36a, the digital marker 36a being set up to, in particular, a user 38a and / or the control and / or regulating unit 24a to verify the crypto processor 26a, the machine tool 12a for at least one application with the machine tool 12a and / or the server unit 18a. The digital marker 36a is stored on an external storage unit 40a, which in particular is designed to be non-volatile and tamper-proof.

FIG. 2 shows a schematic representation of the system 10a with an allocation of the cryptographic elements, in particular key functions 82a, 84a, 86a, 88a, 90a, 92a, digital certificates 94a, 96a, 98a and a digital marker 100a. Public key functions 82a, 86a, 90a of the machine tool 12a, the server unit 18a and the further machine tool 14a are preferably stored in a memory unit of the server unit 18a, the machine tool 12a and the further machine tool 14a. A private key function 84a of the machine tool 12a is preferably only stored in a memory unit 55a of the machine tool 12a. A private key function 88a of the server unit 18a is advantageously only stored in the memory unit of the server unit 18a. A private key function 92a of the further machine tool 14a is preferably only stored in the storage unit 55a of the further machine tool 14a. The digital marker 100a is preferably stored on the external storage unit 40a and stored in the storage units of the machine tool 12a and the server unit 18a, in particular for verification of an application with the machine tool 12a and / or the server unit 18a by a user 38a and / or an external unit 34a. Digital certificates 94a, 96a of the machine tool 12a and the further machine tool 14a, in particular for authentication with the server unit 18a, the network unit 20a and / or that of the machine tool 12a and / or the further machine tool 14a, are preferably on the storage units of the server unit 18a Machine tool 12a and the other machine tool 14a and a storage unit of the network unit 20a. The tool accessory unit 32a has another digital certificate 98a, in particular for authentication with the machine tool 12a and / or the server unit 18a, in particular via the network 16a. The other digital certificate 98a is stored in particular in the storage units of the machine tool 12a, the network unit 20a and the server unit 18a. It is also conceivable that the tool accessory unit 32a can be connected and / or used with a multiplicity of machine tools 12a, 14a of the system 10a, in particular the further machine tool 14a, the other digital certificate 98a being stored in the memory unit of the further machine tool 14a is. The machine tool 12a and the other machine tool 14a each have a machine tool-specific parameter 102a, 104a, which are stored in the memory unit 55a of the machine tool 12a and the other machine tool 14a. In front- The machine tool-specific parameters 102a, 104a are at least stored in the memory unit of the server unit 18a, in particular for the unambiguous assignment of the machine tools 12a, 14a, in particular the data of machine tools 12a, 14a, in the system 10a.

FIG. 3 shows the machine tool 12a for communication in the network 16a using asymmetric cryptography, in particular using at least one public key infrastructure. The communication unit 22a of the machine tool 12a is set up for, in particular wireless, transmission of electronic data. The machine tool 12a includes a motor 42a for driving a tool of the machine tool 12a. The control and / or regulating unit 24a of the machine tool 12a is connected to the communication unit 22a and, in particular, is set up for evaluating and / or processing transmitted and / or transmitted data. The control and / or regulating unit 24a comprises a crypto circuit 44a and a crypto processor 26a. The control and / or regulating unit 24a, in particular the crypto processor 26a, is preferably set up to decrypt or encrypt transmitted and / or transmitted data. The control and / or regulating unit 24a comprises a housing unit 46a, which at least essentially completely encloses the crypto circuit 44a. The control and / or regulating unit 24a is preferably set up to control and / or regulate at least the motor 42a of the machine tool 12a, in particular as a function of a user control. The machine tool 12a comprises an output unit 48a designed as a display for outputting at least one piece of information, in particular an acoustic, optical and / or haptic signal, in particular for transmitting operating information of the machine tool 12a to a user 38a and / or for signaling an input request.

However, other configurations of the output unit 48a are also conceivable. The machine tool 12a comprises an input unit 50a designed as a control panel for interaction with a user 38a and / or an external unit 34a. However, other configurations of the input unit 50a are also conceivable. Alternatively or additionally, it is conceivable that the input unit 50a and the output unit 48a are formed in one piece. The output unit 48a and the input unit 50a are connected to the control and / or regulating unit 24a. The control and / or regulating unit 24a is preferably set up to to control and / or control the output unit 48a and the input unit 50a, in particular as a function of an operating parameter of the machine tool 12a and / or a communication with the server unit 18a, the network unit 20a and / or the further machine tool 14a via the communication unit 22a regulate. The machine tool 12a comprises an operating unit 52a for operating the machine tool 12a by a user 38a, in particular in an application of the machine tool 12a. The machine tool 12a has an interface 54a, which is set up in particular to connect the machine tool 12a to the external storage unit 40a, in particular to verify a user 38a and / or an external unit 34a by means of the digital marker 36a. The interface 54a is preferably at least partially designed as a USB port. However, other configurations of the interface 54a are also conceivable. FIG. 3 shows the machine tool 12a together with the tool accessory unit 32a designed as a rechargeable battery, which is connected to the machine tool 12a in particular via a further interface (not shown in FIG. 3). The control and / or regulating unit 24a comprises a storage unit 55a, which in particular is designed to be non-volatile and tamper-proof. It is conceivable that the storage unit 55a is arranged on the crypto circuit 44a.

FIG. 4 shows a sequence of a method 56a for the communication of machine tools 12a, 14a in a network 16a by means of asymmetric cryptography, in particular by means of a public key infrastructure. In at least one method step 58a of method 56a, in the case of data transmission and / or authentication of at least one machine tool 12a via a network unit 20a with a server unit 18a, at least one further machine tool 14a and / or at least one external unit 34a, a data packet is generated by means of at least one communication unit 22a and / or at least one control and / or regulating unit 24a, in particular by means of at least one crypto processor 26a, the machine tool 12a via a, in particular machine tool-specific, public key function 82a and / or private key function 84a, and / or decrypted. In at least one further method step 60a of method 56a, the machine tool 12a is provided with exactly one machine tool-specific parameter 102a, the public key function 82a and the private one by means of the server unit 18a Assigned and transmitting key function 84a, the machine tool-specific parameter 102a, the public key function 82a and the private key function 84a being stored in at least one storage unit 55a of the machine tool 12a. In at least one further method step 62a of method 56a, at least one digital certificate 94a is generated by means of the server unit 18a and / or the external unit 34a, which includes at least one machine tool-specific parameter 102a, the public key function 82a, the private key function 84a and / or at least includes user information and is stored in the storage unit 55a of the machine tool 12a. In at least one further method step 64a of method 56a, at least one digital marker 100a is created by means of machine tool 12a, server unit 18a and / or external unit 34a, which is designed to at least one user 38a and / or at least one external unit 34a via the communication unit 22a and / or the control and / or regulating unit 24a, in particular the crypto processor 26a, for at least one application with the machine tool 12a and / or the server unit 18a. In at least one process step 66a of method 56a, the data transmission and / or authentication of machine tool 12a with network unit 20a, server unit 18a and / or further machine tool 12a is preferably carried out via communication unit 22a and / or the control and / or control unit 24a, in particular crypto processor 26a, is secured by means of at least one encryption protocol based on Transport Layer Security (TLS). In at least one further method step 68a of method 56a, at least one user 38a and / or external unit 34a is authenticated via the communication unit 22a and / or the control and / or regulating unit 24a, in particular the crypto processor 26a with the machine tool 12a, the network unit 20a and / or the server unit 18a as challenge-response authentication. In at least one further method step 70a of method 56a, at least one tool accessory unit 32a is authenticated, in particular when the tool accessory unit 32a is connected to the machine tool 12a, by means of the communication unit 22a, the control and / or regulating unit 24a, in particular the crypto - Processor 26a and / or server unit 18a, in particular automatically, checks at least one digital certificate 98a of tool accessory unit 32a. In at least one In a further method step 72a of the method 56a, encrypted operating system-related data are transmitted to the machine tool 12a via the network unit 20a and / or the server unit 18a, in particular by means of the public key function 82a, which data is transmitted using the communication unit 22a and / or the control and / / or control unit 24a, in particular the crypto processor 26a, in particular by means of the private key function 84a, are decrypted and processed with at least one computing unit of the machine tool 12a. In at least one further method step 74a of method 56a, at least one further public key function 86a is output to machine tool 12a and / or network unit 20a by means of server unit 18a. In at least one further method step 76a of method 56a, for data transmission and / or authentication of machine tool 12a and / or network unit 20a with server unit 18a, at least one data packet is encrypted by means of the further public key function 86a and by means of at least one further private key function 88a Server unit 18a decrypted. In at least one further method step 78a of method 56a, during data transmission and / or authentication of machine tool 12a, the, in particular encrypted, data packet is identified with at least one machine tool-specific parameter 102a. In at least one further method step 80a of method 56a, the data packet is decrypted via the server unit 18a by means of at least one public key function 92a assigned to the tool-specific parameter 102a.

5 to 8 show further exemplary embodiments of the invention. The following descriptions and the drawings are essentially limited to the differences between the exemplary embodiments, with respect to components with the same designation, in particular with regard to components with the same reference numerals, in principle also to the drawings and / or the description of the other exemplary embodiments, in particular FIG. 1 to 4, can be referenced. To distinguish the exemplary embodiments, the letter a is placed after the reference numerals of the exemplary embodiment in FIGS. 1 to 4. In the embodiments of Figures 5 to 8, the letter a is replaced by the letters b to e. FIG. 5 shows a first alternative embodiment of a system 10b for the communication of machine tools 12b in a network 16b by means of asymmetric cryptography, in particular by means of at least one public key infrastructure. The system 10b shown in FIG. 5 has an at least essentially analogous configuration to the system 10a described in the description of FIGS. 1 to 4, so that with regard to one configuration of the system 10b shown in FIG writing of Figures 1 to 4 can be referenced. In contrast to the system 10a described in the description of FIGS. 1 to 4, the system 10b shown in FIG. 5 has two further server units 106b, 108b, which are set up with a server unit 18b, the machine tool 12b and a tool accessory unit 32b to communicate. It is conceivable that communication in the network 16b of the system 10b takes place via network units 20b, which are not shown in FIG. 5, however. The two further server units 106b, 108b each have a public key function 112b, 116b and a private key function 114b, 118b, the public key functions 112b, 116b of the further server units 106b, 108b at least in storage units of the server unit 18b, the machine tool 12b Tool accessories 32b are stored. One of the further server units 108b is preferably set up to authenticate the machine tool 12a, in particular an application of the machine tool 12b, and / or to enable communication with the machine tool 12b. A digital certificate 94b of the machine tool 12b is preferably stored in a memory unit of a further server unit 108b. The other of the further server units 106b is advantageously set up to authenticate the tool accessory unit 32a, in particular an application of the tool accessory unit 32a with the machine tool 12b, and / or to enable communication with the tool accessory unit 32b. A digital certificate 110b of the tool accessory unit 32b is preferably stored in a storage unit of the further server unit 106b. The tool accessory unit 32b has a further digital certificate 98b, in particular for authenticating the tool accessory unit 32b with the machine tool 12b. The server unit 18b is particularly preferably designed to authenticate the further server units 106b, 108b, in particular in the network 16b, and / or authentication certificates to the others Distribute and / or assign server units 106b, 108b. It is preferably carried out in at least one method step during data transmission and / or authentication of the machine tool 12b via a network unit 20b with a server unit 18b, 108b, at least one further machine tool 14b (not shown in FIG. 5) and / or at least one external unit 34b (not shown in FIG. 5) encryption and / or decryption of a data packet by means of at least one communication unit 22b (not shown in FIG. 5) and / or at least one control and / or regulating unit 24b (not shown in FIG. 5), in particular by means of at least one crypto processor 26b (not shown in FIG. 5), the machine tool 12b via a, particularly machine tool-specific, public key function 82b and / or private key function 84b (not shown in FIG. 5).

FIG. 6 shows a second alternative embodiment of a system 10c for the communication of machine tools 12c in a network 16c by means of asymmetric cryptography, in particular by means of at least one public key infrastructure. The system 10c shown in FIG. 6 has an at least essentially analogous configuration to the system 10a described in the description of FIGS. 1 to 4, so that with respect to one configuration of the system 10c shown in FIG writing of Figures 1 to 4 can be referenced. In contrast to the system 10a described in the description of FIGS. 1 to 4, the system 10c shown in FIG. 6 has two further server units 106c, 108c which are set up to send certificates authenticated by the server unit 18c to the machine tool 12c and at least one To distribute and / or transmit tool accessory unit 32c. One of the further server units 108c is preferably set up to distribute and / or transmit certificates authenticated by the server unit 18c to the machine tool 12c, in particular the other of the two further server units 106c being set up to authenticate certificates authenticated by the server unit 18c to distribute and / or transmit the tool accessory unit 32c. The server unit 18c has a further public key function 86c and a further private key function 88c, in particular for encrypting and / or decrypting data packets that exist between the server unit 18c and the two further server units 106c, 108c are transmitted. The tool accessory unit 32c has a further digital certificate 98c, in particular for authenticating the tool accessory unit 32c with the machine tool 12c. Preferably, in at least one method step, data transmission and / or authentication of the machine tool 12c takes place via a network unit 20c (not shown in FIG. 6) with a server unit 18c, 108c, at least one further machine tool 14c (not shown in FIG. 6) and / or at least one external unit 34c (not shown in FIG. 6) an encryption and / or decryption of a data packet by means of at least one communication unit 22c (not shown in FIG. 6) and / or at least one control and / or regulating unit 24c (in FIG 6 not shown), in particular by means of at least one crypto processor 26c (not shown in FIG. 6), of the machine tool 12c via a, in particular machine tool-specific, public key function 82c and / or private key function 84c (not shown in FIG. 6).

FIG. 7 shows a third alternative embodiment of a system 10d for the communication of machine tools 12d in a network 16d by means of asymmetric cryptography, in particular by means of at least one public key infrastructure. The system 10d shown in FIG. 7 has an at least essentially analogous configuration to the system 10a described in the description of FIGS. 1 to 4, so that with regard to an embodiment of the system 10d shown in FIG writing of Figures 1 to 4 can be referenced. In contrast to the system 10a described in the description of FIGS. 1 to 4, the system 10d shown in FIG. 7 has a server unit 18d which comprises a further control and / or regulating unit 28d. The further control and / or regulating unit 28d has a database 120d, in which in particular a machine tool-specific parameter 102d of the machine tool 12d, a public key function 82d of the machine tool 12d and a private key function 84d of the machine tool 12d are stored. The database is preferably set up to assign the public key function 82d and the private key function 84d to the machine tool 12d by means of the tool-specific characteristic variable 102d, in particular to select the public key function 82d to encrypt one to the Machine tool 12d data packet to be transmitted. Authentication and / or data transmission in the network 16d of the system 10d advantageously takes place independently of digital certificates. Preferably, in at least one method step, data transmission and / or authentication of the machine tool 12d takes place via a network unit 20d (not shown in FIG. 7) with a server unit 18d, at least one further machine tool 14d (not shown in FIG. 7) and / or at least one external unit 34d (not shown in FIG. 7) encryption and / or decryption of a data packet by means of at least one communication unit 22d and / or at least one control and / or regulating unit 24d, in particular by means of at least one crypto processor 26d (in 7 not shown), the machine tool 12d via a, in particular machine tool-specific, public key function 82d and / or private key function 84d.

FIG. 8 shows a fourth alternative embodiment of a system 10e for communication of machine tools 12e in a network 16e by means of asymmetric cryptography, in particular by means of at least one public key infrastructure. The system 10e shown in FIG. 8 has an at least essentially analogous configuration to the system 10d described in the description of FIG. 7, so that with regard to an embodiment of the system 10e shown in FIG. 8, it is at least essentially based on the description of Figure 7 can be referenced. In contrast to the system 10d described in the description of FIG. 7, the system 10e shown in FIG. 8 has a server unit 18e which comprises a further control and / or regulating unit 28e. The further control and / or regulating unit 28e has a database 120e, in which a tool-specific parameter 102e of the machine tool 12e is stored. In particular, the database 120e is set up to assign a data packet transmitted by the machine tool 12e, in particular encrypted by means of a further public key function 86e, during decryption by means of a further private key function 88e of the machine tool 12e. Authentication and / or data transmission in the network 16e of the system 10e preferably takes place only via data packets encrypted and / or decrypted by means of the further public key function 86e and the further private key function 88e. Authentication is preferred and / or a data transmission in the network 16e of the system 10e independently of the key functions 82e, 84e which are different from the further public key function 86e and the further private key function 88e,

90e, 92e (not shown in Figure 8). In at least one method step, data transmission and / or authentication of the machine tool 12d preferably takes place via a network unit 20d (not shown in FIG. 8) with a server unit 18d, at least one further machine tool 14d (not shown in FIG. 8) and / or at least an external unit 34d (not shown in FIG. 8) an encryption and / or decryption of a data packet by means of at least one communication unit 22d and / or at least one control and / or regulating unit 24d, in particular by means of at least one crypto processor 26d (in 8 not shown), the machine tool 12d via a, in particular machine tool-specific, public key function 82d and / or private key function 84d (not shown in FIG. 8).

Claims

Expectations

1. Method for communication of machine tools in a network by means of asymmetric cryptography, in particular by means of a public key infrastructure, characterized in that in at least one method step (58a) during data transmission and / or authentication of at least one machine tool (12a; 12b; 12c; 12d; 12e) via a network unit (20a; 20b; 20c; 20d; 20e) with a server unit (18a; 18b; 18c; 18d; 18e), at least one further machine tool (12a; 12b; 12c; 12d; 12e) and / or at least one external unit (34a; 34b; 34c; 34d; 34e) a data packet by means of at least one communication unit (22a; 22b; 22c; 22d; 22e) and / or at least one control and / or regulating unit ( 24a; 24b; 24c; 24d; 24e), in particular by means of at least one crypto processor (26a; 26b; 26c; 26d; 26e), the machine tool (12a; 12b; 12c; 12d; 12e) via one, in particular tool key-specific, public key function (82a; 82b; 82c; 82 d; 82e) and / or private key function (84a; 84b; 84c; 84d; 84e) is encrypted and / or decrypted.

2. The method according to claim 1, characterized in that in at least one method step (60) of the machine tool (12a; 12b; 12c; 12d; 12e) by means of the server unit (18a; 18b; 18c; 18d; 18e) exactly one machine tool-specific parameter (102a; 102d; 102e), the public key function (82a; 82b; 82c; 82d; 82e) and the private key function (84a; 84b; 84c; 84d; 84e) are assigned and transmitted, whereby the machine tool-specific parameter (102a; 102d; 102e), the public key function (82a; 82b; 82c; 82d; 82e) and the private key function (84a; 84b; 84c; 84d; 84e) in at least one memory unit of the machine tool (12a; 12b; 12c; 12d ; 12e) are stored.

3. The method according to claim 1 or 2, characterized in that in at least one method step (62) by means of the server unit (18a; 18b; 18c; 18d; 18e) and / or the external unit (34a; 34b; 34c; 34d; 34e) at least one digital certificate (94a; 94b; 94c; 94d; 94e) is generated, which is at least one machine tool-specific parameter (102a; 102d; 102e), the public key function (82a; 82b; 82c; 82d; 82e), the private key function (84a; 84b; 84c; 84d; 84e) and / or comprises at least user information and is stored in the storage unit (55a; 55b;

55c; 55d; 55e) of the machine tool (12a; 12b; 12c; 12d; 12e) is stored.

4. The method according to any one of the preceding claims, characterized in that in at least one method step (64) by means of the machine tool (12a; 12b; 12c; 12d; 12e), the server unit (18a; 18b; 18c; 18d; 18e) and / or the external unit (34a; 34b; 34c; 34d; 34e) at least one digital marker (100a; 100b; 100c; lOOd; lOOe) is created, which is set up to at least one user (38a; 38b; 38c ; 38d; 38e) and / or at least one external unit (34a; 34b; 34c; 34d; 34e) via the communication unit (22a; 22b; 22c; 22d; 22e) and / or the control and / or regulating unit (24a; 24b; 24c; 24d; 24e), in particular the crypto processor (26a; 26b; 26c; 26d; 26e), for at least one application with the machine tool (12a; 12b; 12c; 12d; 12e) and / or the server unit (18a; 18b; 18c; 18d; 18e).

5. The method according to any one of the preceding claims, characterized in that the data transmission and / or the authentication of the machine tool (12a; 12b; 12c; 12d; 12e) with the network unit (20a; 20b; 20c; 20d; 20e), the server unit (18a; 18b; 18c; 18d; 18e) and / or the further machine tool (12a; 12b; 12c; 12d; 12e) via the communication unit (22a; 22b; 22c; 22d; 22e) and / or the control and / / or control unit (24a; 24b; 24c; 24d; 24e), in particular the crypto processor (26a; 26b; 26c; 26d; 26e), is secured by means of at least one encryption protocol based on Transport Layer Security (TLS).

6. The method according to any one of the preceding claims, characterized in that in at least one method step (68) via the communication unit (22a; 22b; 22c; 22d; 22e) and / or the control and / or regulating unit (24a; 24b; 24c; 24d; 24e), in particular the crypto processor (26a; 26b; 26c; 26d; 26e), at least one authentication (38a; 38b; 38c; 38d; 38e) and / or the external unit (34a ; 34b; 34c; 34d; 34e) with the machine tool (12a; 12b; 12c; 12d; 12e), the network unit (20a; 20b; 20c; 20d; 20e) and / or the server unit (18a; 18b; 18c; 18d; 18e) as challenge-response authentication.

7. The method according to any one of the preceding claims, characterized in that in at least one method step (70) for authentication of at least one tool accessory unit (32a; 32b; 32c; 32d; 32e), in particular when the tool accessory unit (32a; 32b) is connected ; 32c; 32d; 32e) with the machine tool (12a; 12b; 12c; 12d; 12e), by means of the communication unit (22a; 22b; 22c; 22d; 22e), the control and / or regulating unit (24a; 24b; 24c ; 24d; 24e), in particular the crypto processor (26a; 26b; 26c; 26d; 26e), and / or the server unit (18a; 18b; 18c; 18d; 18e), in particular automatically, at least one digital certificate ( 98a; 98b; 98c; 98d; 98e) of the tool accessory unit (32a; 32b; 32c; 32d; 32e) is checked.

8. The method according to any one of the preceding claims, characterized in that in at least one method step (72) via the network unit (20a; 20b; 20c; 20d; 20e) and / or the server unit (18a; 18b; 18c; 18d; 18e ), in particular by means of the public key function (82a; 82b; 82c; 82d; 82e), encrypted operating system-related data are transmitted to the machine tool (12a; 12b; 12c; 12d; 12e), which are transmitted by means of the communication unit (22a; 22b; 22c; 22d; 22e) and / or that of the control and / or regulating unit (24a; 24b; 24c; 24d; 24e), in particular the crypto processor (26a; 26b; 26c; 26d; 26e), in particular by means of the private key function (84a; 84b; 84c; 84d; 84e), decrypted and processed with at least one computing unit of the machine tool (12a; 12b; 12c; 12d; 12e).

9. The method according to any one of the preceding claims, characterized in that in at least one method step (74) by means of the server unit (18a; 18b; 18c; 18d; 18e) at least one further public key function (86a; 86b; 86c; 86d; 86e ) to the machine tool (12a; 12b; 12c; 12d; 12e) and / or the network unit (20a; 20b; 20c;

20d; 20e) is output, whereby, in particular in at least one further method step (76), for data transmission and / or authentication of the machine tool (12a; 12b; 12c; 12d; 12e) and / or the network unit (20a; 20b; 20c; 20d; 20e) with the server unit (18a; 18b; 18c; 18d; 18e) at least one data packet is encrypted using the further public key function (86a; 86b; 86c; 86d; 86e) and by means of at least one further private key function (88a ; 88b; 88c; 88d; 88e) is decrypted by the server unit (18a; 18b; 18c; 18d; 18e).

10. The method according to any one of the preceding claims, characterized in that in at least one method step (78) in the data transmission and / or authentication of the machine tool (12a; 12b; 12c; 12d; 12e) the, in particular encrypted, data packet with at least one machine tool-specific parameter (102a; 102d; 102e) is identified, with, in particular in at least one further method step (80), the data packet via the server unit (18a; 18b; 18c; 18d; 18e) using at least one of the tool-specific parameter ( 102a; 102d; 102e) associated public key function (82a; 82b; 82c; 82d; 82e) is decrypted.

11. System for communication of machine tools in a network by means of asymmetric cryptography, in particular by means of at least one public key infrastructure, in particular according to a method according to one of claims 1 to 8, with at least one machine tool (12a; 12b; 12c; 12d; 12e), with at least one server unit (18a; 18b; 18c; 18d; 18e) and with at least one network unit (20a; 20b; 20c; 20d; 20e).

12. Machine tool for communication in a network using asymmetric cryptography, in particular using at least one public key Infrastructure, in particular according to a method according to one of claims 1 to 8, with at least one communication unit (22a; 22b;

22c; 22d; 22e) for, in particular wireless, transmission of electronic data and with at least one control and / or regulating unit (24a; 22a; 22b; 22c; 22d; 22e) connected to the communication unit (22a;

24b; 24c; 24d; 24e) for evaluating and / or processing transmitted and / or transmitted data, characterized in that the control and / or regulating unit (24a; 24b; 24c; 24d; 24e) is set up for this purpose, transmitted and / or decrypt or encrypt data to be transmitted.