Computer-implemented method, computer program product and communication system for processing data

Abstract

A computer-implemented method for processing data in a communication system having a device, a registration authority and a certificate authority is proposed. The method comprises the following steps: a) requesting a digital certificate for the device by means of a certificate signature request, b) providing the device-specific device attribute as a function of the request, c) performing a check on the certificate signature request of the device, d) encoding the specific device attribute into the requested digital certificate by the registration authority, and e) providing the device-specific device attribute for the device as a function of the certificate signature request. Obtaining a digital device certificate with the specific device attribute; e) if the check succeeds, performing, by the certificate authority, a signature of the digital device certificate with a private key of the certificate authority to issue a signed digital device certificate, f) providing the issued signed digital device certificate to the device, and g) checking the digital device certificate in accordance with the issued signed digital device certificate, and e) if the check succeeds, performing, by the certificate authority, a signature of the digital device certificate with the private key of the certificate authority to issue the signed digital device certificate. An access scheme for accessing a resource by the device is executed.

Description

TECHNICAL FIELD

[0001] The present invention relates to a computer-implemented method for processing data, a computer program product and a communication system. BACKGROUND

[0002] In "zero trust" access control, it is generally not only the authenticating user that is checked for other criteria and used in the access control decision. For example, it can be checked at the time of access whether the device is a company-managed device or whether the device has an up-to-date patch status. This means, however, that this information is determined and checked repeatedly at the time of access or authentication to an identity and access management server (IAM server). This results in a repeated checking and also in a relatively frequent determination and transmission of the information required for the access control decision in the process.

[0003] Generally, a user authenticates to an IAM access control system by means of a password, an authentication token or a digital certificate. In NIST SP 800-207 "Zero Trust Architecture" [1], the zero trust concept is described in general, wherein the use of dynamic access control policies is described in section 2.1: "4. Access to resources is determined by dynamic policy including the observable state of client identity, application / service, and the requesting asset and may include other behavioral and environmental attributes".

[0004] Furthermore, it is known from the prior art that in authentication certificates according to the X.509 standard, in addition to the identity information, authorization information can also be encoded. For this purpose, information about the role granted and the scope in which this role is allowed to exercise is encoded in the authentication certificate (see also [2], section III. F).

[0005] Furthermore, attribute certificates are also known, which are also referred to as authorization certificates [3]. SUMMARY

[0006] Against this background, it is the task of the present invention to improve access to resources.

[0007] According to a first aspect, a computer-implemented method for processing data in a communication system having a device, a registration authority and a certificate authority is presented. The method has the following steps: a) requesting a digital certificate for the device by means of a certificate signing request, b) providing device-specific device attributes in accordance with the request, c) checking the certificate signing request of the device by the registration authority, d) encoding the device-specific device attributes into the requested digital certificate by the registration authority to obtain a digital device certificate with the device-specific device attributes, e) if the check is successful, performing a signature of the digital device certificate by the certificate authority with a private key of the certificate authority to issue a signed digital device certificate, f) providing the issued signed digital device certificate to the device, and g) performing an access scheme for accessing a resource by the device in accordance with the issued signed digital device certificate.

[0008] By using the computer-implemented method according to the first aspect, the access control to a resource is improved by encoding the device-specific device attributes into the digital certificate.

[0009] The computer-implemented method according to the first aspect enables encoding of device-specific device attributes into the digital certificate when issuing the digital certificate, thereby obtaining a digital device certificate. Subsequently, the obtained digital device certificate is signed to issue a signed digital device certificate. This results in the inclusion of information (i.e. the device-specific device attributes) in the issued signed digital device certificate which indicates which device-specific device attributes (zero trust attributes) have already been determined when issuing the signed digital device certificate.

[0010] This has the technical effect that when the device accesses a resource or authenticates the device, the additional information required for a zero trust access control decision is provided by the used signed digital device certificate only. Thereby, it is not necessary to determine these device-specific device attributes again when authenticating or accessing a resource. Thus, by the used signed digital device certificate, the communication partner is provided with information which zero trust attributes have already been determined when issuing the signed digital device certificate and which zero trust attribute values have been checked in terms of content.

[0011] This has the advantage that it is no longer necessary to determine the device-specific device attributes when making an access control decision, which in turn reduces the computational overhead each time a resource is accessed and thus saves computational resources. Thus, the device-specific device attributes for the access check are determined more efficiently.

[0012] Another advantage is that the computer-implemented method according to the first aspect enables a simple zero trust migration for legacy communication protocols, which support certificate-based authentication, but no independent zero trust checks in addition thereto. Thereby, especially in industrial environments with mature OT (“Operational Technology”) communication protocols, which are protected via IPsec (“Internet Protocol Security”) or TLS / DTLS (“Transport Layer Security” / “Datagram Transport Layer Security”), the zero trust functionality can be added without changing the communication protocol itself.

[0013] Further, another advantage is that in offline communication scenarios, e.g. when performing a local remote service access to a control device (i.e. resource), similar to the IEC 62351-8 standard, zero trust information related to the access device or device for access can be provided to the control device via the used signed digital device certificate.

[0014] The computer-implemented method is especially a method in which a computer, a computer network or other programmable device is used and one or more features are implemented in whole or in part by means of a computer program.

[0015] The device is for example an IoT (English: Internet-of-Things) device, especially an industrial IoT device, a control device, a programmable logic controller, a machine tool, a production machine, a robot, a 3D printer for additive manufacturing, a remote input / output module (remote IO module) for decentralized coupling of sensors and actuators, an IoT gateway or a network device of an industrial communication network.

[0016] A registration authority is an entity within a public key infrastructure and serves as a registration authority for digital certificates.

[0017] A certificate authority is an organization in information security that issues digital certificates. Digital certificates are used to associate a specific public key with a person or organization. This association is certified by the certificate authority by means of its own digital sub-signature.

[0018] The digital certificate is especially an authentication certificate, preferably an X.509 standard certificate. In the issued signed digital device certificate, at least information about the zero trust status of the device itself is contained.

[0019] In particular, the request according to step a) can be performed preferably by the device at a certain point in time independent of the execution of the access scheme.

[0020] The certificate signing request is a digital application for creating a digitally signed digital identity certificate (also referred to as public key certificate) for the applicant's public key and identity information. In particular, the certificate signing request has the identity of the applicant (in particular the device) and the public key of the applicant.

[0021] Preferably, the registration authority checks the identity and the public key of the device upon examination of the certificate signing request. Preferably, the signature comprises applying the private key of the certificate authority to a hash value of the digital device certificate formed by means of a hash function.

[0022] The issued signed digital device certificate can also be referred to as zero trust certificate.

[0023] According to an embodiment, the providing according to step b) further comprises: performing a device scan by means of a scanning unit to determine the certain device attributes.

[0024] The device scan can also be referred to as "Active Attribute Discovery".

[0025] According to another embodiment, performing the device scan comprises performing a network scan on the device, querying the certain device attributes via the Open Platform Communication Unified Architecture or the Simple Network Management Protocol, and / or querying from a device management system storing the certain device attributes of the device.

[0026] According to another embodiment, the providing according to step b) comprises: transmitting the certain device attributes together with the certificate signing request to the registration authority according to the request.

[0027] In this embodiment, no device scan is performed. In this case the certain device attributes are transmitted together with the certificate signing request. The certain device attributes can in this case be transmitted together with the certificate signing request in the form of an attestation which is cryptographically protected by means of an attestation key. The certificate signing request can be transmitted cryptographically protected by means of a certificate request key which is constituted differently than the attestation key.

[0028] According to another embodiment, the certain device attributes have first zero trust attributes, wherein the performing according to step e) further comprises: checking by the registration authority the permissibility of a certain value of one of the first zero trust attributes.

[0029] In particular in step e), i.e. at the time of issuance, the specific value of the first zero trust attribute is checked by the registration authority for being permitted according to the first zero trust attribute contained in the specific device attribute. The specific device attribute can also be referred to as zero trust attribute, in particular as first zero trust attribute. The registration authority can perform the check independently or query another system, in particular a device management system or a device directory system, for checking the permissibility of the first zero trust attribute.

[0030] According to another embodiment, the specific device attribute comprises a first information indicating whether a device configuration compliance check was performed at the time of issuance of the signed digital device certificate according to step e), a second information indicating which specific device attributes were checked at the time of issuance of the signed digital device certificate according to step e), and / or a third information indicating information about determined attribute values of the specific device attribute.

[0031] Whether a device configuration compliance check was performed at the time of issuance of the signed digital device certificate according to step e) means in particular whether the device fulfills defined company compliance requirements, e.g. whether it is Enterprise-managed, whether the patch status is up-to-date, and / or whether a virus scanner is activated and equipped with the latest virus code.

[0032] The second information indicates in particular which specific device attributes were checked at the time of issuance of the signed digital device certificate according to step e), e.g. whether the specific device attribute “Enterprise-managed”, the specific device attribute “patch status up-to-date” and / or the specific device attribute “virus scanner activated” were checked.

[0033] The third information preferably indicates a status of a flag indicating whether the device is Enterprise-managed and possibly indicates a device management domain the device is in. The third information can also indicate a specific value of the specific device attribute, e.g. a determined value or version of the patch status and / or a determined version of the virus code.

[0034] According to another embodiment, the issued signed digital device certificate has a specific validity period, preferably of one day, several days or one week.

[0035] The specific validity period is chosen in particular to be short, because the zero trust attribute or zero trust information can change, so that the validity of the zero trust attribute is advantageously updated periodically.

[0036] According to another embodiment, the issued signed digital device certificate has a certificate extension, wherein the certificate extension has in a first extension field a reference to at least one attribute certificate in which additional device-specific device attributes are securely stored.

[0037] The certificate extension is in particular an information field which can provide additional information about the certificate. The certificate extension provides a possibility to extend the original X.509 standard for certificate information.

[0038] According to another embodiment, the issued signed digital device certificate has a further certificate extension, wherein the further certificate extension has in a second extension field a Root-of-Trust for at least one further attribute certificate, wherein the Root-of-Trust has a public key of a certificate authority.

[0039] By means of the Root-of-Trust in the further certificate extension, it is advantageously possible to directly confirm the validity of zero trust attributes / properties within the specific device attributes.

[0040] It is an advantage of this embodiment that the validity period of the attribute certificate (e.g. one day) can be much shorter than the validity period of the authentication certificate, which has a relatively long validity period, e.g. 1 or 2 years. Another advantage is that the attribute certificate can be issued by a different authority than the authentication certificate (digital certificate), thus facilitating an organizational separation of duties.

[0041] In this case, the reference in the further certificate extension contained in the issued signed digital device certificate does not refer in particular to a specific certificate (e.g. serial number and issuer), but to a symbolic name describing the attributes contained in the attribute certificate.

[0042] In addition, this embodiment has a further advantage over the prior art. According to this embodiment, the issued signed digital device certificate (e.g. authentication certificate) refers to one or more attribute certificates. In contrast, in the prior art, only the attribute certificate refers to the authentication certificate, or to the certificate "owner" specified by the common name (CN) of the certificate.

[0043] A public key and a private key are cryptographic keys used within a public key infrastructure.

[0044] The Root-of-Trust is in particular also referred to as trust anchor and is issued by a Root-CA. By means of the Root-CA, it is possible to perform a traceable check of the entire certificate chain from the Root-CA to the individual digital certificates issued within the PKI.

[0045] According to another embodiment, the communication system further has an access control device, wherein the access control device has a security rule decision point and a security rule enforcement point, wherein carrying out the access scheme according to step g) further has the following steps: gl) requesting by the device a permission of the device to access the resource, g2) checking by the security rule decision point the permission by applying predefined access rules to specific device properties of the issued signed digital device certificate to obtain a first access result, g3) allowing by the security rule enforcement point the device to access the resource if the first access result is positive or preventing by the security rule enforcement point the device to access the resource if the first access result is negative.

[0046] The access control device is in particular a device that specifies which device and when a device can or cannot access a resource.

[0047] The security rule decision point is in particular a PDP (English "Policy Decision Point"). The PDP is an entity that makes policy decisions.

[0048] The security rule enforcement point is in particular a PEP (English "Policy Enforcement Point"). The PEP is an entity that has an implementation for enforcing policy decisions made by the PDP.

[0049] The predefined access rules are rules for deciding on access to a resource.

[0050] According to another embodiment, the method, after the checking according to step g2), further has the following steps: h) re-checking by the security rule decision point the permission of the device to access the resource by applying predefined access rules to the specific device properties of the issued signed digital device certificate to obtain a second access result, when the device performs a security critical access to the resource or when the device authenticates to the access control device, i) re-providing the provided specific device properties, when the device performs a security critical access to the resource or when the device authenticates to the access control device, and / or j) re-checking by the security rule decision point the permission of the device to access the resource by applying predefined access rules to the re-provided specific device properties of the issued signed digital device certificate to obtain a third access result, when the device performs a security critical access to the resource or when the device authenticates to the access control device.

[0051] This advantageously implements a two-stage determination of zero trust attribute values in specific device properties: Some of the zero trust attribute values of the specific device properties, e.g. the first zero trust attribute, are determined already at issuance of the signed digital device certificate according to step e) and stored in the signed digital device certificate (first phase determination).

[0052] Other zero trust attribute values, e.g. the second zero trust attribute, are determined only at authentication or access of the device to the access control device (second phase determination).

[0053] This advantageously continues the two-phase determination of the zero trust attribute values of the specific device properties: In particular, steps h), i) and / or j) can also be performed at random points in time, e.g. stochastically.

[0054] According to another embodiment, step g1) further comprises: providing, upon request of the device or at further authentication of the device to the access control device, the specific device properties with the second zero trust attribute having the respective further specific value.

[0055] In this case, e.g. the second zero trust attribute is determined only at authentication or access of the device to the access control device (corresponding to the above-mentioned second phase determination). The specific device properties can also be referred to as zero trust attributes, in particular as second zero trust attributes.

[0056] According to another embodiment, the resource is configured as a service, in particular as an Internet of Things service, a configuration server or an onboarding server.

[0057] According to a second aspect, a computer program product is presented, comprising instructions which, when the program is executed by a computer, cause the computer to carry out the computer-implemented method according to the first aspect or an embodiment of the first aspect.

[0058] The computer program product, e.g. the computer program medium, can be provided or delivered, e.g. as a storage medium (e.g. a memory card, a USB stick, a CD-ROM, a DVD), or also in the form of a file downloaded from a server in a network. This can be done, e.g. in a wireless communication network by transmitting a corresponding file with the computer program product or computer program medium.

[0059] According to a third aspect, a communication system for processing data is presented, having a device, a first providing unit, a second providing unit, an executing unit, a registration authority and a certificate issuing authority, wherein the device is configured for requesting a digital certificate for the device by means of a certificate signing request, wherein the first providing unit is configured for providing device-specific device properties according to the request, wherein the registration authority is configured to perform a check on the certificate signing request of the device, wherein the registration authority is configured to encode the specific device property into the requested digital certificate to obtain a digital device certificate with the specific device property, wherein the certificate authority is configured to, if the check is successful, perform a signature on the digital device certificate with a private key of the certificate authority to issue a signed digital device certificate, wherein the second providing unit is configured to provide the issued signed digital device certificate to the device, wherein the performing unit is configured to perform an access scheme for accessing a resource by the device according to the issued signed digital device certificate.

[0060] The communication system is preferably configured as an automation system. The automation system can be an automation facility from the process industry, the chemical industry, the pharmaceutical industry, the petrochemical industry, or a facility from the food and beverage industry. This also includes all facilities from the manufacturing and production industry and, for example, facilities that produce all types of cars or goods. The automation system can also be an energy automation system, an energy transmission system, a power plant, an electrolysis cell, a building automation system, or a rail automation system.

[0061] The respective units, such as the scanning unit and / or the first providing unit, can be implemented in hardware and / or software. In a hardware implementation, the respective units can be configured as a device or part of a device, such as a computer or a microprocessor or a control computer of a vehicle. In a software implementation, the respective units can be configured as a computer program product, a function, a routine, a part of program code, or an executable object.

[0062] The technical effects and advantages described for the computer-implemented method according to the first aspect apply equally to the communication system of the third aspect. Furthermore, the embodiments and features described with respect to the computer-implemented method according to the first aspect also apply correspondingly to the communication system according to the third aspect.

[0063] Further possible implementations of the present application also include combinations of features or embodiments described previously or hereinafter not explicitly mentioned. Herein, the skilled person will also add individual aspects as improvements or supplements to the respective basic form of the present application.

[0064] Further advantageous configurations and aspects of the present application are subject matter of the dependent claims of the present application and of the embodiments described hereinafter. In the following, the present application will be explained in more detail according to preferred embodiments with reference to the enclosed drawings. Regardless of the grammatical gender of a specific term, any gender identity is included. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 a schematic block diagram of a communication system for processing data; and Figure 2 a schematic flow chart of a computer-implemented method for processing data.

[0066] In the drawings, same or functionally same elements are provided with the same reference signs, unless stated otherwise. DETAILED DESCRIPTION

[0067] Figure 1 A schematic block diagram of a communication system 100 for processing data is shown, which comprises a device 10, a first providing unit 50 (configured in two embodiments, see Figure 1 ), a second providing unit 60, an executing unit 70, a registration authority RA, a certificate authority CA, and a scanning unit 40. In Figure 1 , the registration authority RA and the certificate authority CA are arranged in a public key infrastructure PKI. Furthermore, in the following description of Figure 1 , the description of Figure 2 steps of a computer-implemented method for processing data in the communication system 100.

[0068] Figure 1 An implementation example is shown, in which a signed digital device certificate ZT-Cert is first issued for the device 10. Subsequently, the device 10 desires to access a resource 30 by means of the issued signed digital device certificate ZT-Cert. In Figure 1 , the resource 30 is configured as a service, in particular as an Internet of Things service. In an embodiment, the resource 30 can also be configured as a configuration server or an onboarding server.

[0069] In Figure 1 , the device 10 is first configured to request a digital certificate for the device 10 by means of a certificate signing request CSR (see step S10 in Figure 2 ).

[0070] Subsequently, the first providing unit 50 is configured to provide device-specific device attributes in accordance with the request (see step S20 in Figure 2 ).

[0071] Upon provision, the scanning unit 40 is configured to perform a device scan to determine the specific device attributes. Performing the device scan comprises a network scan of the device, querying the specific device attributes via an Open Platform Communication Unified Architecture or a Simple Network Management Protocol, and / or querying from a device management system in which the device-specific device attributes of the device 10 are stored (see Figure 1 , the scanning unit 40 is arranged within the first providing unit 50).

[0072] Alternatively, the providing can also be performed without the scanning unit 40. In this case, the first providing unit 50 is configured for transmitting the specific device properties together with a certificate signing request, CSR, to at least the registration authority, RA, upon request when providing the specific device properties (see Figure 1 the arrow from the device 10 via the first providing unit 50 to the registration authority, RA).

[0073] The specific device properties have a first information indicating whether a device configuration compliance check was performed when issuing the signed digital device certificate according to step S50 (see Figure 2 ), a second information indicating which specific device properties were checked when issuing the signed digital device certificate according to step S50, and / or a third information indicating information about the determined property values of the specific device properties.

[0074] Now, in Figure 1 the registration authority, RA, is configured for performing a check on the certificate signing request, CSR, of the device 10 (see step S30 in Figure 2 ).

[0075] Then, the registration authority, RA, is configured for encoding the specific device properties into the requested digital certificate to obtain a digital device certificate with specific device properties (see step S40 in Figure 2 ).

[0076] Then, the certificate authority, CA, is configured for performing a signature on the digital device certificate with the private key of the certificate authority, CA, to issue a signed digital device certificate ZT-Cert, if the check was successful and, in addition, the specific device properties have been encoded into the digital device certificate to be signed (see step S50 in Figure 2 ).

[0077] Further, the specific device properties have first zero trust properties (not shown). In the execution according to step S50, the registration authority, RA, is configured for checking the permission of the specific values of one of the first zero trust properties in this case.

[0078] Subsequently, the second providing unit 60 is configured for providing the issued signed digital device certificate ZT-Cert to the device 10 (see step S60 in Figure 2 ). In Figure 1 the issued signed digital device certificate ZT-Cert has a specific validity period of one day. In an embodiment, the specific validity period is a number of days or one week.

[0079] In Figure 1In particular, the issued signed digital device certificate ZT-Cert has a certificate extension. The certificate extension has in a first extension field a reference to at least one attribute certificate in which additional device 10 specific device attributes are securely stored. In an embodiment, the issued signed digital device certificate ZT-Cert has a further certificate extension. The further certificate extension has in a second extension field a trust root for at least one further attribute certificate, wherein the trust root has a public key of the certificate authority CA (not shown).

[0080] Thereafter, the execution unit 70 is configured for executing an access scheme for accessing the resource 30 by the device 10 in accordance with the issued signed digital device certificate ZT-Cert (see step S70 in Figure 2 ).

[0081] For checking the permission of the device 10 to access the resource 30 by executing the access scheme, Figure 1 The communication system 100 further has an access control apparatus 20 with a security rule decision point PDP and a security rule enforcement point PEP.

[0082] Executing the access scheme (see step S70 in Figure 2 ) by means of the execution unit 70 further comprises the following steps: First, the device 10 is configured for requesting a permission of the device 10 to access the resource 30 (see step S71 in Figure 2 ). Further, specific device attributes with second zero trust attributes having respective further specific values can also be provided upon request or when the device 10 is further authenticated to the access control apparatus 20 (see also step S71 in Figure 2 ).

[0083] Then, the security rule decision point PDP is configured for checking the permission by applying predefined access rules AP to the specific device attributes of the issued signed digital device certificate ZT-Cert to obtain a first access result (see step S72 in Figure 2 ). In other words, the security rule decision point PDP checks the specific device attributes. In an embodiment, the security rule decision point PDP is configured for determining further specific device attributes (zero trust attributes) required for the access permission.

[0084] If the first access result is positive, the security rule enforcement point PEP is configured for allowing the device 10 to access the resource 30 (see step S73 in Figure 2 ). If the first access result is negative, the security rule enforcement point PEP is configured for preventing the device 10 from accessing the resource 30 (see step S74 in Figure 2 ).

[0085] Further, after the check according to step S72, the security policy decision point PDP can be configured to perform a further action.

[0086] For example, upon a security critical access of the resource 30 by the device 10, or upon an authentication of the device 10 to the access control apparatus 20, the security policy decision point PDP is configured to recheck the permission of the device 10 to access the resource 30 by applying the predefined access policy AP to the specific device attribute of the issued signed digital device certificate, to obtain a second access result (see step S80 in Figure 2 ).

[0087] Subsequently, the first providing unit 50 is configured to re-provide the provided specific device attribute upon a security critical access of the resource 30 by the device 10, or upon an authentication of the device 10 to the access control apparatus 20 (see step S90 in Figure 2 ).

[0088] Further, upon a security critical access of the resource 30 by the device 10, or upon an authentication of the device 10 to the access control apparatus 20, the security policy decision point PDP is configured to recheck the permission of the device 10 to access the resource 30 by applying the predefined access policy AP to the re-provided specific device attribute of the issued signed digital device certificate, to obtain a third access result (see step S100 in Figure 2 ).

[0089] Figure 2 A schematic flow chart of a computer-implemented method for processing data is shown in a communication system 100 having a device 10, a registration authority RA and a certificate authority CA (see Figure 1 ) according to Figure 1 .

[0090] The respective method steps S10 - S70 of the computer-implemented method have been described above with reference to Figure 1 , so that for the sake of brevity, the method steps S10 - S70 are not described again. The same applies to the method steps S80 - S100, which are embodiments of the method steps S10 - S70 of the computer-implemented method, and thus are connected in Figure 2 with the method steps S10 - S70 by a corresponding dashed line having an arrow at one end. Likewise, the method steps S71 - S74, which are embodiments of the method step S70, are not described again in Figure 2 , since they have already been described in Figure 1 .

[0091] Although the invention has been described with reference to embodiments, it can be modified in various ways.

[0092] References: [1]https: / / nvlpubs.nist.gov / nistpubs / SpecialPublications / NIST.SP.800-207.pdf [2] Rainer Falk, Steffen Fries, Chai Bisale: "Role-based AccessControl in the Digital Grid - A Review of Requirements and Discussion ofSolution Approaches", International Journal on Advances in Security, vol 10 no3&4, year 2017, https: / / www.thinkmind.org / articles / sec_v10_n34_2017_8.pdf [3] https: / / en.wikipedia.org / wiki / Authorization_certificate.

Claims

1. A computer-implemented method for processing data in a communication system (100) having a device (10), a Registration Authority (RA), and a Certificate Authority (CA), the method comprising the following steps: a) Request (S10) a digital certificate for the device (10) using a Certificate Signing Request (CSR). b) Based on the request, provide (S20) the device-specific device attributes, c) The Registration Authority (RA) performs (S30) a check on the Certificate Signing Request (CSR) of the device (10). d) The Registration Authority (RA) encodes the specific device attribute (S40) into the requested digital certificate to obtain a digital device certificate having the specific device attribute. e) If the check is successful, the Certificate Authority (CA) performs (S50) signing on the digital device certificate using the CA's private key to issue a signed digital device certificate (ZT-Cert). f) Provide (S60) the issued signed digital device certificate (ZT-Cert) to the device (10), and g) Based on the issued signed digital device certificate (ZT-Cert), execute (S70) the access scheme for the device (10) to access the resource (30).

2. The method of claim 1, wherein, According to the provision in step b) (S20), it also includes: A device scan is performed using the scanning unit (40) to determine the specific device attributes.

3. The method of claim 2, wherein, Performing the device scan includes: performing a network scan on the device, querying the specific device attributes via the Open Platform Communication Unified Architecture or Simple Network Management Protocol, and / or querying from a device management system that stores the specific device attributes of the device (10).

4. The method of claim 1, wherein, The provision according to step b) (S20) includes: According to the request, the specific device attributes, along with the certificate signing request (CSR), are transmitted to at least the registration authority (RA).

5. The method according to any one of claims 1 to 4, characterized in that, The specific device attribute has a first zero-trust attribute, wherein the execution of step e) (S50) further includes: The permission of a specific value of one of the first zero-trust attributes is checked by the Registration Authority (RA).

6. The method according to any one of claims 1 to 5, characterized in that, The specific device attribute has: first information indicating whether a device configuration compliance check was performed when the signed digital device certificate was issued (S50) according to step e); second information indicating which specific device attributes were checked when the signed digital device certificate was issued (S50) according to step e); and / or third information indicating information about the determined attribute value of the specific device attribute.

7. The method according to any one of claims 1 to 6, characterized in that, The issued signed digital device certificate (ZT-Cert) has a specific validity period, preferably one day, several days, or one week.

8. The method according to any one of claims 1 to 7, characterized in that, The issued signed digital device certificate (ZT-Cert) has a certificate extension, wherein the certificate extension has a reference in a first extension field to at least one attribute certificate in which additional device-specific device attributes of the device (10) are securely stored.

9. The method according to any one of claims 1 to 8, characterized in that, The issued signed digital device certificate (ZT-Cert) has another certificate extension, wherein the other certificate extension has a root of trust for at least one additional attribute certificate in a second extension field, wherein the root of trust has the public key of the certificate authority (ZA).

10. The method according to any one of claims 1 to 9, characterized in that, The communication system (100) also has an access control device (20), which has a security rule decision point (PDP) and a security rule enforcement point (PEP), wherein executing the access scheme according to step g) (S70) further includes the following steps: g1) The device (10) requests (S71) permission from the device (10) to access the resource (30). g2) The security rule decision point (PDP) checks (S72) the permission by applying predefined access rules (AP) to the specific device attributes of the issued signed digital device certificate (ZT-Cert) to obtain a first access result. g3) If the first access result is positive, the security rule enforcement point (PEP) allows (S73) the device (10) to access the resource (30), or if the first access result is negative, the security rule enforcement point (PEP) blocks (S74) the device (10) from accessing the resource (30).

11. The method according to claim 10, characterized in that, After the check according to step g2) (S72), the method further includes the following steps: h) When the device (10) performs security-critical access to the resource (30), or when the device (10) authenticates with the access control device (20), the security rule decision point (PDP) re-examines (S80) the permission of the device (10) to access the resource (30) by applying the predefined access rule (AP) to the specific device attributes of the issued signed digital device certificate to obtain a second access result. i) When the device (10) makes security-critical access to the resource (30), or when the device (10) authenticates with the access control device (20), the specific device attributes that have been provided are re-provided (S90), and / or j) When the device (10) makes a security-critical access to the resource (30), or when the device (10) authenticates with the access control device (20), the security rule decision point (PDP) re-examines (S100) the permission of the device (10) to access the resource (30) by applying the predefined access rule (AP) to the specific device attributes of the reissued signed digital device certificate to obtain a third access result.

12. The method according to claim 10 or 11, characterized in that, Step g1)(S71) also includes: Upon the request or when the device (10) performs further authentication with the access control device (20), the specific device attribute with a second zero-trust attribute having a corresponding other specific value is provided.

13. The method according to any one of claims 1 to 12, characterized in that, The resources (30) are configured as services, particularly Internet of Things services, configuration servers, or online servers.

14. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 13.

15. A communication system (100) for processing data, comprising a device (10), a first providing unit (50), a second providing unit (60), an execution unit (70), a registration authority (RA), and a certificate authority (CA). The device (10) is configured to request a digital certificate for itself using a Certificate Signing Request (CSR). The first providing unit (50) is configured to provide device-specific attributes according to the request. The registration authority (RA) is configured to perform a check on the certificate signing request (CSR) of the device (10). The Registration Authority (RA) is configured to encode the specific device attributes into the requested digital certificate to obtain a digital device certificate having the specific device attributes. The Certificate Authority (ZA) is configured to, if the check is successful, sign the digital device certificate using the private key of the Certificate Authority (CA) to issue a signed digital device certificate (ZT-Cert). The second providing unit (60) is configured to provide the device (10) with an issued signed digital device certificate (ZT-Cert). The execution unit (70) is configured to execute an access scheme for the device (10) to access resources (30) based on the issued signed digital device certificate (ZT-Cert).

Images