Method and system for authorizing communication of network nodes

Abstract

A method and system for authorizing a communication (e.g. a data connection) of a network node (e.g. an IoT device) of a communication network (e.g. an IP network), wherein the communication of the network node is authorized only if the geographical location of the network node and the location of a defined (authenticated) mobile communication terminal (e.g. a smartphone) substantially coincide.

Description

Technical Field

[0001] The invention relates to a method and a system for authorizing communications of a network node of a communication network. Furthermore, the invention relates to a network node of a communication network. Background Art

[0002] The networking of objects and devices with each other and with the Internet is increasingly penetrating everyday life in private and industrial environments. In the so-called Internet of Things, Internet-enabled devices (so-called IoT devices) form a network in which they communicate with each other or with the Internet via suitable communication connections (e.g. WLAN).

[0003] Many IoT devices available on the market have little to no security mechanisms and partially contain various vulnerabilities and are therefore potentially dangerous to their users and third parties. Currently, the number of malicious attacks on Internet-based systems, devices and applications is rising sharply.

[0004] It is known to use proprietary interfaces for installed devices by utilizing manufacturer tools, such as via a service interface. In addition, it is known to use certificates in order to ensure secure data transmission between IoT devices and / or a center or service unit.

[0005] Proprietary interfaces are inflexible and require additional tools on the user side. Credentials can be stolen from authentication servers via hacker attacks and misused. This is often not known to operators or users of the IoT infrastructure. Summary of the invention

[0006] It is therefore an object of the present invention to provide a method and a system for user-friendly and secure access to IoT devices.

[0007] The task is solved by a method for authorizing the communication (e.g. data connection, for example for downloading or uploading data) of a network node (e.g. IoT device) of a communication network (e.g. IP network), wherein the authorization of the communication of the network node is performed only when the geographical location of the network node and the location of a defined, advantageously authenticated mobile communication terminal device (e.g. smart phone) are substantially consistent. The communication includes, for example, receiving or sending data, files, signals, instructions, parameters to other network nodes, to a panel, to the cloud or to a mobile communication terminal device. The network node (e.g. IoT device) is authorized to perform communication (e.g. firmware update or update of operating parameters of the IoT device) only when the defined mobile communication terminal device (e.g. mobile communication terminal device from a set of authenticated mobile communication terminal devices) is geographically located at a defined maximum distance to the corresponding network node. The defined maximum distance can be, for example, 5m, in particular 3m. Advantageously, the authorization of the network node for communication is performed only after the user of the authenticated mobile communication terminal device is identified. Advantageously, the identification of the user is performed at the defined maximum distance to the network node. The user can be identified biometrically (eg fingerprint), via PIN entry or PKI (Public Key Infrastructure). The geographical location of the network node can be stored in the network node, for example in a memory area of ​​the network node.

[0008] Advantageously, in addition to checking the consistency of the geographical location of the network node and the mobile communication terminal device, authorization of the network node for communication is additionally performed by further authorizing the network node (e.g., by being released by a control center, other nodes in the network, or by the registration of the device in the IP network itself (through corresponding access authorization)). This two-factor authentication or two-factor authorization provides a high degree of security for access to the network node. In the case of two-factor authentication or two-factor authorization, the first authentication or authorization is advantageously performed by IP access itself (virtual component). The second authentication or authorization is performed via a physical component (checking the consistency of the geographical location / location of the device). Only when the first and second authentications or authorizations are performed can data transmission be activated for the network node. Advantageously, physical access to the network node (e.g., IoT devices in a building) is protected by an access control system (Zutrittskontrollsystem). This would mean three-factor authentication or three-factor authorization.

[0009] Advantageously, the method according to the invention is used for the installation and / or maintenance of network nodes in buildings or within building automation. The network nodes can be, for example, IoT devices, or hazard and / or fire detectors, controllers for sensors and / or actuators, regulating drives or bus users of an installation bus, such as a KNX bus.

[0010] A first advantageous embodiment of the invention is that the positions of the network nodes are stored in a building model on a server, and the positions of the mobile communication terminals are determined via a position determination system. Advantageously, the position determination system is an indoor position determination system. The indoor position determination system can be based on WLAN technology (when using WiFi access points) or on Bluetooth technology (e.g. BLE). In principle, however, satellite-supported position determination systems (e.g. GPS) can also be used.

[0011] Advantageously, the network nodes and the server are located in the same network (e.g. an IP network based on IPv4 or IPv6). Advantageously, the building model is a building information model (BIM). In the building information model (BIM) are stored all relevant data of the building and its installed infrastructure (heating, ventilation, air conditioning, security, fire protection, etc.). Thus, in the building information model (BIM) are stored, for example, information about the fire detectors installed in the building (type, manufacturer, year of manufacture, location, etc.). The building information model (BIM) can be based, for example, on IFC (Industry Foundation Classes).

[0012] Another advantageous embodiment of the invention is that the position check is performed on the server. The server can extract the position of the network node from the building information model (BIM). The building information model (BIM) can be stored in a database to which the server can access. Advantageously, the building information model (BIM) is located in an in-memory database (e.g. Hana).

[0013] If the geographical location of the network node is stored in a storage area of ​​the network node (e.g. a flash memory), the server can also query the geographical location of the network node from the network node itself. Advantageously, the server and the network node are located in the same network. However, the server can also be located in a cloud infrastructure and communicate with the network node and with a mobile communication device (e.g. a smartphone) via a suitable communication mechanism (e.g. radio). Advantageously, the server and the mobile communication device are trusted devices.

[0014] Another advantageous embodiment of the invention is that the network node is configured to perform a position check in the network node or by the network node. The geographical location of the network node is stored in a storage area (e.g., flash memory) of the network node. If the network node comprises suitable and sufficient processing logic (or comprises computing power) and a suitable communication mechanism (e.g., radio), a comparison of the position of the network node with the position of the mobile communication terminal device can be performed in the network node or by the network node. Advantageously, the network node and the mobile communication device are trusted devices.

[0015] Another advantageous design of the present invention is that the mobile communication terminal device is configured to perform a position check in the mobile communication terminal device. The geographical location of the network node can be stored in the network node (for example, in the corresponding memory of the network node) and / or in the building information model (BIM), and the server can access the building information model. Via a suitable communication mechanism (for example, radio), the mobile communication terminal device obtains the geographical location of the network node and compares the geographical location with its own geographical location. Current mobile communication terminal devices (for example, smart phones) are configured so that they can determine their corresponding geographical location. This can be done, for example, via a satellite-supported position determination system (for example, GPS) and / or an indoor position determination system installed in a building (for example, WLAN, Bluetooth (especially low-power Bluetooth (BLE), iBeacons). If the location of the mobile communication terminal device is consistent with the location of the network node, the mobile communication terminal device can transmit authorization for communication (for example, firmware upload) to the network node (for example, permission signal, approval message). Advantageously, the network node, the mobile communication terminal device and the server are trusted devices.

[0016] Another advantageous design of the present invention is that the mobile communication terminal device is configured to check the location so that the location of the network node and the mobile communication terminal device is checked via an NFC connection between the network node and the mobile communication terminal device. Near Field Communication (NFC) between the mobile communication terminal device and the network node can be established, for example, via RFID (radio frequency identification) or by Bluetooth. Near Field Communication requires that the two devices to be connected are close to each other in space (e.g., 2-3m). If the mobile communication terminal device and the network node have installed an NFC connection with each other, this can be regarded as evidence that their respective geographical locations are basically consistent (e.g., a distance of 2-3m).

[0017] Another advantageous embodiment of the invention is that the position of the network node and the position of the mobile communication terminal are substantially identical during the duration of the communication. This also increases the security of access to the network node and the security of communication with the network node. For example, the mobile communication terminal must be substantially in the vicinity of the network node (e.g. at a distance of 2-3 m) during the entire duration of the firmware update.

[0018] Another advantageous embodiment of the present invention is that the mobile communication terminal device obtains authentication, i.e. authentication of authorization, by an authentication server (e.g. a trusted server). The authentication server can, for example, create a digital certificate via a suitable asymmetric encryption method and transmit the certificate to the mobile communication terminal device. Advantageously, the digital certificate is valid only in a certain time period and / or for a limited number of authorizations and / or for a limited network node (e.g. a network node in a certain building area (e.g. a certain room)). This further increases the security of access to the network node and the security of communication with the network node.

[0019] Another advantageous embodiment of the present invention is that write access to the memory of the authorized network node is allowed only after authorization. The write access can be performed, for example, via other network nodes, via a mobile communication terminal or via a server. Advantageously, the server is located in the cloud infrastructure and is configured accordingly for communicating with the network nodes.

[0020] The task is also solved by a system for authorizing the communication (e.g. data connection) of a network node (e.g. IoT device) of a communication network (e.g. IP network), wherein the network node is configured to authorize the communication of the network node only when the geographical location of the network node and the location of a defined (advantageously authenticated) mobile communication terminal device (e.g. smart phone) are substantially consistent. Communication, for example, includes receiving or sending data, files, signals, instructions, parameters to other network nodes, to a panel, to the cloud or to a mobile communication terminal device. The network node (e.g. IoT device) is authorized to perform communication (e.g. firmware update) only when the defined mobile communication terminal device (e.g. a mobile communication terminal device from a set of authenticated mobile communication terminal devices) is geographically located at a defined maximum distance to the corresponding network node. The defined maximum distance can be, for example, a distance of 5m, especially 3m. Advantageously, authorization of the network node for communication is performed only after the user of the authenticated mobile communication terminal device is identified. Advantageously, identification of the user is performed at the defined maximum distance to the network node. The user can be identified biometrically (eg fingerprint), via PIN entry or PKI (Public Key Infrastructure).The geographical location of the network node can be stored in the network node, for example in a memory area of ​​the network node.

[0021] Advantageously, in addition to checking the consistency of the geographical location of the network node and the mobile communication terminal device, authorization of the network node for communication is performed by further authorizing the network node (for example, by release by a control center or other nodes in the network). This two-factor authentication or two-factor authorization provides a high degree of security for accessing the network node. In the case of two-factor authentication or two-factor authorization, the first authentication or authorization is advantageously performed by IP access itself (virtual component). The second authentication or authorization is performed via a physical component (checking the consistency of the geographical location / location of the device). Only when the first and second authentications or authorizations are performed can data transmission be activated for the network node. Physical access to network nodes (such as IoT devices in buildings) is advantageously protected by an access control system. This will mean three-factor authentication or three-factor authorization and improve security. The system can be implemented by an infrastructure that is originally located in a building.

[0022] A network node can be, for example, an IoT device or a hazard detector and / or a fire detector, a controller for a sensor and / or an actuator, or a bus user of an installation bus, for example a KNX bus.

[0023] Another advantageous design of the present invention is that the system further comprises:

[0024] A server, on which a building model (BIM) with the locations of network nodes is stored; and a location determination system for determining the location of a mobile communication terminal device. The server is advantageously a network-capable (e.g. IP network, Internet) database server, which can be accessed by a client. The building model (BIM, Building Information Model) is located, for example, in a memory database (e.g. Hana) of the server. The location determination system can be, for example, a satellite-supported location determination system and / or an indoor location determination system (e.g. iBeacons). Mobile communication terminal devices (e.g. smartphones) are currently configured to determine their geographical location in cooperation with the location determination system.

[0025] Another advantageous embodiment of the invention is that the network node and / or the server and / or the mobile communication terminal is configured to check the position. Depending on the application or the available infrastructure, a corresponding system can thus be implemented flexibly.

[0026] Another advantageous embodiment of the present invention is that after authorization, the network node is configured to allow write access to the memory of the authorized network node (for example, via other network nodes, a server or via a mobile communication terminal). The server is advantageously located in a cloud infrastructure and is correspondingly configured for communication with the network node.

[0027] In addition, the task is solved by a network node of a communication network (e.g. an IP network), wherein the network node is configured so that the network node can only perform communication when the position of the network node and the position of a defined (authenticated) mobile communication terminal device (e.g. a smartphone) are substantially identical (e.g. a distance of 3-5 m). The correspondingly configured network node has a high degree of protection against unauthorized access. The network node can be, for example, an IoT device or a hazard detector and / or a fire detector, a controller for a sensor and / or an actuator, or a bus user of an installation bus (e.g. a KNX bus).

[0028] Another advantageous embodiment of the invention is that the network node is an IoT device. IoT devices (IoT stands for Internet of Things) are physical and / or virtual objects that are connected to each other and / or to the Internet. IoT devices can have different performances depending on the equipment (hardware, software, processor, memory).

[0029] Another advantageous embodiment of the present invention is that after authorization, the network node is configured to allow write access to the memory of the authorized network node (e.g. via other network nodes, via a server or via a mobile communication terminal). This ensures a high degree of protection against hacker attacks or man-in-the-middle attacks (MITM attacks) on the network node. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The invention and advantageous embodiments of the invention are explained by way of example with reference to the following figures.

[0031] Figure 1 A first exemplary system for authorizing communication of network nodes of a communication network is shown,

[0032] Figure 2 A second exemplary system is shown for authorizing communications of network nodes of a communication network, and

[0033] Figure 3 An exemplary flow chart of a method for authorizing communication of a network node of a communication network is shown. DETAILED DESCRIPTION

[0034] In order to be able to use IoT devices (e.g. internet-enabled devices) in an organization, they must meet minimum security standards. These devices must have an update function and the manufacturer must provide an update process. If the IoT solution (solution about the Internet of Things) comes with inadequate patch management or no patch management (bug elimination), vulnerabilities cannot be eliminated. Instead, security holes must be shielded in other ways. This can become very expensive and can also lead to the whole concept of using IoT devices to the point of absurdity.

[0035] The invention relates in particular to secure / authorized access to safety-relevant devices installed in buildings, such as smoke detectors, alarm devices, adjustment drives for flue dampers, fire extinguishing valves, etc. This impedes technological progress because data security is compromised.

[0036] With the spread and introduction of IoT technology also in the building industry, there is an increased security risk of manipulating the installed safety-related infrastructure. Thus, the deliberate triggering of a false alarm can lead to the evacuation of a hotel, which has negative consequences for the hotel and for the hotel guests, such as accidents in a panic. This can lead in particular to ransom demands. The purpose of use can also be compromised by unverifiable changes to the equipment (suppressing the alarm triggering of a smoke detector).

[0037] Figure 1 A first exemplary system is shown for authorizing communication (e.g., data connection, data exchange, downloading or uploading of data or parameters) of network nodes IoT1-IoT4 (e.g., IoT devices) of a communication network IP2 (e.g., an IP network), wherein the network nodes IoT1-IoT4 are configured to only authorize communication (e.g., data connection, data exchange, downloading or uploading of data or parameters) when the geographical locations of the network nodes IoT1-IoT4 are POS BIM The authorization of the communication of the network nodes IoT1-IoT4 is only carried out when the position POS of a defined (advantageously authenticated) mobile communication terminal device SMART (e.g. a smartphone) is substantially coincidental. The network nodes IoT1-IoT4 can communicate with other network nodes IoT1-IoT4 or devices (e.g. a mobile communication terminal device) only when the mobile communication terminal device SMART (e.g. a smartphone, tablet, PDA (personal digital assistant)) is located nearby (e.g. at a distance of maximum 3-5m, in particular at a distance of maximum 3m).

[0038] The communication network IP2 is, for example, an IP network based on the IP protocol (Internet Protocol, such as IPv4 or IPv6).

[0039] The network nodes IoT1 - IoT4 are advantageously Internet-capable IoT devices. In a building, these are, for example, correspondingly configured hazard detectors or fire detectors, or correspondingly configured operating and monitoring stations PANEL.

[0040] Advantageously, according to Figure 1 The exemplary system includes a server BIM server on which a location POS having a network node is stored. BIM Building model (BIM model); and position determination system IPS, used to determine the position POS of mobile communication terminal equipment SMART.

[0041] The server (BIM server) is a correspondingly configured computer with corresponding hardware and software (processor, memory, interfaces, communication mechanisms (eg radio)). The building model (BIM model) is stored, for example, in a database DB1 to which the server (BIM server) can access.

[0042] The position determination system IPS may be a satellite supported position determination system (eg GPS) and / or an indoor position determination system, eg based on WLAN or Bluetooth BT.

[0043] The comparison of the position of the network node IoT1-IoT4 and the position of the mobile communication terminal device can be performed by the network node IoT1-IoT4, by the server (BIM server) or by the mobile communication terminal device SMART. For this purpose, the network node IoT1-IoT4, the server (BIM server) and the mobile communication terminal device SMART are equipped with corresponding processing logic.

[0044] Advantageously, the network nodes IoT1-IoT4 are configured so that after authorization, write access to the memory M (e.g. flash memory) of the authorized network node is possible. The write access can be performed, for example, via other network nodes of the IP network IP2 and / or via the mobile communication terminal device SMART and / or via a server (BIM server). The write access can be, for example, a firmware update or an update of operating parameters of the IoT device.

[0045] In accordance with Figure 1 In the exemplary system, the network nodes IoT1-IoT4 and PANEL are configured to be able to communicate only when the position POS of the network nodes IoT1-IoT4 is BIMThe network nodes can communicate only when the position POS of a defined (advantageously authenticated) mobile communication terminal device SMART (e.g. a smartphone) is substantially consistent, i.e. only when the two devices are located in close proximity (e.g. within a maximum distance of 3-5 m). Advantageously, the network nodes IoT1-IoT4, PANEL are IoT devices connected to other devices or to the Internet via an IP connection IP2.

[0046] In accordance with Figure 1 In the exemplary system of , the IoT device IoT1 obtains authorization GRANT for communication (eg firmware update FW) only when the mobile communication terminal device SMART is located in the spatial vicinity of the device IoT1 (eg within a distance of 5m, especially 3m). Figure 1 In the illustration, the vicinity of the space is indicated by a dotted line, and the mobile communication terminal device SMART and the IoT device IoT1 are located within the dotted line.

[0047] In accordance with Figure 1 In the diagram, the position determination system IPS is formed by positioning beacons PB1-PB2, which respectively emit their corresponding identification ID1-ID4. The corresponding ID1-ID4 is detected by the mobile communication terminal device SMART, for example via a Bluetooth BT connection (advantageously BLE, Bluetooth Low Energy). Based on the corresponding identification ID1-ID4 received by the mobile communication terminal device SMART, the mobile communication terminal device SMART determines its corresponding geographical location POS. The identification ID1-ID4 can also directly contain the geographical location position of the corresponding beacon PB1-PB4.

[0048] The mobile communication terminal device SMART includes a corresponding application APP for position determination and firmware FW, which is to be uploaded to the device IoT 1. A user (eg, a commissioning engineer or a maintenance technician) can perform corresponding operation inputs on the display DIS of the mobile communication terminal device SMART.

[0049] The mobile communication terminal SMART sends a request REQ for an update of the corresponding device IoTn via the corresponding IP connection IP1 (Internet Protocol connection) to the cloud service application CSA implemented by the cloud infrastructure CLOUD. The cloud service application CSA receives the request REQ, the geographical location POS of the mobile communication terminal SMART and the firmware FW to be loaded onto the corresponding device IoTn.

[0050] The cloud service application CSA will request REQ POS(IoTn)The BIM server accesses the database DB1 with the building model (BIM) and provides the cloud service application CSA with the location POS of the corresponding device IoTn. BIM .

[0051] The cloud service application CSA combines the location POS of the mobile communication terminal device SMART with the location POS of the corresponding device IoTn provided by the BIM server. BIM For comparison, the firmware update FW should be performed on the device. If the two locations are basically consistent, the cloud service application CSA will give the approval or authorization GRANT for communication to the corresponding device IoTn via the IP connection IP2. The cloud service application CSA can access the IP network of the IP connection IP2 via the gateway GW, or it can also directly access the corresponding IoT devices IoT1-IoT4.

[0052] Firmware updates FW or firmware uploads can be performed by the cloud infrastructure CLOUD via IP connection IP2 in the corresponding IoT devices IoT1-IoT4 (in accordance with Figure 1 In the exemplary illustration of the present invention, the communication is performed on the IoT device IoT1) or by the mobile communication terminal device SMART, for example, via an NFC connection (Near Field Communication) between the mobile communication terminal device SMART and the IoT device IoT1 on the IoT device IoT1. The NFC connection (Near Field Communication) between the mobile communication terminal device SMART and the IoT device IoT1 can be performed, for example, via Bluetooth or RFID (Radio Frequency Identification).

[0053] The cloud service application CSA and the BIM server may be physically implemented in a computer.The IP connections IP1 , IP2 are advantageously radio-based connections (eg WLAN).

[0054] In accordance with Figure 1 In the exemplary illustration of , the IoT device IoT1 is a fire detector, which is connected to other devices IoT1-IoT4 via detector lines ML with a corresponding control station or fire alarm center (Brandmeldezentrale) PANEL (e.g. FS20 center). Alarm messages AL can therefore be forwarded from the devices IoT1-IoT4 to the center PANEL via the detector lines ML.

[0055] Figure 2A second exemplary system is shown for authorizing communication (e.g., data connection, data exchange, downloading or uploading of data or parameters) of network nodes IoT1-IoT4 (e.g., IoT devices) of a communication network (e.g., an IP network), wherein the network nodes IoT1-IoT4 are configured to only authorize communication (e.g., data connection, data exchange, downloading or uploading of data or parameters) when the geographic location POS of the network nodes IoT1-IoT4 is POS. BIM Position POS with a defined (advantageously authenticated) mobile communication terminal SMART (eg smartphone) IPS The authorization for communication of the network nodes IoT1-IoT4 is only carried out when they are substantially consistent. The network nodes IoT1-IoT4 can only communicate with other network nodes IoT1-IoT4 or devices (e.g. mobile communication terminals) when a mobile communication terminal SMART (e.g. smartphone, tablet, PDA (personal digital assistant)) is nearby (e.g. at a distance of up to 5m, in particular up to 3m).

[0056] The communication network is, for example, an IP network based on the IP protocol (Internet Protocol, such as IPv4 or IPv6).

[0057] The network nodes IoT1 - IoT4 are advantageously Internet-capable IoT devices. In a building, these are, for example, correspondingly configured hazard detectors or fire detectors, or correspondingly configured operating and monitoring stations PANEL.

[0058] Advantageously, according to Figure 2 The exemplary system includes a server BIM server on which a location POS having a network node is stored. BIM Building model (BIM model); and location determination system IPS, used to determine the location of mobile communication terminal equipment SMART POS IPS .

[0059] The server (BIM server) is a correspondingly configured computer with corresponding hardware and software (processor, memory, interfaces, communication mechanisms (e.g. radio)). The building model (BIM model) is stored, for example, in a database DB1 to which the server (BIM server) can access. The building model (BIM model) is saved and stored in a suitable notation or a suitable format, for example IFC (Industry Foundation Classes).

[0060] The position determination system IPS may be a satellite supported position determination system (eg GPS) and / or an indoor position determination system, eg based on WLAN or Bluetooth BT.

[0061] The comparison of the position of the network node IoT1-IoT4 and the position of the mobile communication terminal device can be performed by the network node IoT1-IoT4, by the server (BIM server) or by the mobile communication terminal device SMART. For this purpose, the network node IoT1-IoT4, the server (BIM server) and the mobile communication terminal device SMART are equipped with corresponding processing logic.

[0062] Advantageously, the network nodes IoT1-IoT4 are configured so that, after authorization, write access to the memory M of the authorized network node is possible. The write access can be performed, for example, via other network nodes of the IP network and / or via the mobile communication terminal device SMART and / or via a server (BIM server). The write access can be, for example, a firmware update or an update of operating parameters of the IoT device. The memory M can be, for example, a flash memory.

[0063] In accordance with Figure 2 In the exemplary system, the network nodes IoT1-IoT4 and PANEL are configured to be able to communicate only when the position POS of the network nodes IoT1-IoT4 is BIM and a defined (advantageously authenticated) position POS of a mobile communication terminal SMART (eg a smartphone) IPS The network nodes can communicate only when they are substantially identical, i.e. only when the two devices are located in close proximity (e.g. within a distance of a maximum of 5 m, in particular a maximum of 3 m). Advantageously, the network nodes IoT1-IoT4, PANEL are IoT devices connected to other devices or to the Internet via an IP connection (connection based on the Internet Protocol).

[0064] In accordance with Figure 2 In the exemplary system of , the IoT device IoT1 obtains authorization GRANT for communication (eg firmware update FW) only when the mobile communication terminal device SMART is located in the spatial vicinity of the device IoT1 (eg within a distance of 5m, especially 3m). Figure 2 In the illustration, the vicinity of the space is indicated by a dotted line, and the mobile communication terminal device SMART and the IoT device IoT1 are located within the dotted line.

[0065] In accordance with Figure 2In the illustration of , the position determination system IPS is formed by positioning beacons PB1-PB2, which respectively emit their respective identification ID1-ID4. The respective ID1-ID4 is detected by the mobile communication terminal device SMART, for example via a Bluetooth BT connection (advantageously BLE, Bluetooth Low Energy). Based on the respective identification ID1-ID4 received by the mobile communication terminal device SMART, the mobile communication terminal device SMART determines its respective geographical location POS IPS The identification ID1-ID4 may also directly contain the geographical location of the corresponding beacon PB1-PB4.

[0066] The mobile communication terminal device SMART comprises a corresponding application APP for receiving the corresponding identifications *ID1 - *ID4 of the corresponding beacons PB1 - PB4. Advantageously, the corresponding identifications *ID1 - *ID4 are suitably encrypted.

[0067] Furthermore, the firmware FW to be uploaded (Upload, Update) to the device IoT1 is located on the mobile communication terminal device SMART. The user (eg, a commissioning engineer or maintenance technician) can perform corresponding operation inputs on the display DIS of the mobile communication terminal device SMART.

[0068] The mobile communication terminal device SMART sends a request (Request) REQ for an update of the corresponding device IoTn (REQ for UPDATE (IoTn)) via the corresponding IP connection IP1 (Internet Protocol connection) to the cloud service application CSA, which is implemented by the cloud infrastructure CLOUD. The cloud service application CSA receives the request REQ and the firmware FW, which is to be loaded onto the corresponding device IoTn.

[0069] In accordance with Figure 2 In an exemplary system of , a mobile communication terminal device SMART sends a corresponding identification *IDn of a corresponding beacon PB1-BP4 to an IPS server, which is located in the geographical vicinity of the beacon and the IPS server is also located in the cloud infrastructure CLOUD. Advantageously, the identification *IDn is transmitted in an encrypted manner to the IPS server, where it is decrypted for further processing. The identification *IDn can be encrypted, for example, by an asymmetric encryption algorithm.

[0070] The IPS server can access the location information of the corresponding positioning beacons PB1-PB4, that is, the map MAP of the installation location. Via the corresponding identification *IDn, the IPS server can determine the location of the corresponding beacon PB1-PB4 and provide it to the cloud service application CSA. Advantageously, the map MAP is located in the database DB2 in a suitable format.

[0071] The cloud service application CSA will request REQ POS(IoTn) The BIM server accesses the database DB with the building model (BIM) and provides the cloud service application CSA with the location POS of the corresponding device IoTn. BIM .

[0072] Cloud service application CSA will be the location of mobile communication terminal equipment SMART POS IPS The location of the corresponding IoT device POS provided by the BIM server BIM For comparison, a firmware update FW should be performed on the device. If the two locations are substantially consistent, the cloud service application CSA gives approval or authorization GRANT for communication to the corresponding device IoTn via the IP connection IP2. The cloud service application CSA can access the IP network of the IP connection IP2 via the gateway GW, or can also directly access the corresponding IoT devices IoT1-IoT4.

[0073] Firmware updates FW or firmware uploads can be performed by the cloud infrastructure CLOUD via IP connection IP2 in the corresponding IoT devices IoT1-IoT4 (in accordance with Figure 2 In the exemplary illustration of the present invention, the NFC connection (Near Field Communication) between the mobile communication terminal device SMART and the IoT device IoT1 can be carried out, for example, via Bluetooth or RFID (Radio Frequency Identification).

[0074] The cloud service application CSA, the BIM server and the IPS server may be physically implemented in a computer.The IP connections IP1 , IP2 are advantageously radio-based connections (eg WLAN).

[0075] In accordance with Figure 2In the exemplary illustration of , the IoT device IoT1 is a fire detector, which is connected to other devices IoT1-IoT4 via detector lines ML with a corresponding control station or fire alarm center PANEL (e.g. FS20 center). Alarm messages AL can therefore be forwarded from the devices IoT1-IoT4 to the center PANEL via the detector lines ML.

[0076] About the basis Figure 1 and Figure 2 It should be noted that the components of the cloud infrastructure CLOUD are essentially different components, but these components can be implemented or realized in a computer (such as a cloud server). The BIM server, CSA (cloud service application) and IPS server are essentially different components or modules. They can be implemented and realized on a (single) computer or on a (also distributed) computer system. The databases DB1 and DB2 can be implemented as memory databases (such as Hana), respectively, for example, whereby particularly fast access times are possible, which enables fast authorization and therefore also, for example, fast firmware updates.

[0077] Figure 3 An exemplary flow chart of a method for authorizing communication (e.g. data connection, sending or receiving data) of a network node (e.g. IoT device) of a communication network (e.g. IP network) is shown, wherein authorization for communication of the network node is only performed if the geographical location of the network node and the location of a defined (authenticated) mobile communication terminal device (e.g. smartphone) substantially coincide.

[0078] Advantageously, the positions of the network nodes are stored in a building model on the server, and the position of the mobile communication terminal is determined via a position determination system, for example an indoor position determination system.

[0079] The checking and comparison of the positions can be performed on a server, but can also be performed on a network node or a mobile communication terminal (eg a smartphone).

[0080] Advantageously, the mobile communication terminal is configured such that the location of the network node and the mobile communication terminal is checked via an NFC connection (eg RFID, Bluetooth) between the network node and the mobile communication terminal.

[0081] Advantageously, during the duration of the communication, the position of the network node and the position of the mobile communication terminal substantially coincide.

[0082] Advantageously, the mobile communication terminal receives an authentication (token, certificate; in fact authentication of authorization) from an authentication server, advantageously a trusted server.

[0083] Advantageously, write access to a memory (eg, a flash memory) of an authorized network node is permitted only after authorization has taken place. Write access can be performed, for example, via other network nodes or via a mobile communication terminal.

[0084] In principle, the inventive method is based on the following method steps:

[0085] (VS1) comparing the geographical location of the network node with the location of a defined (authenticated) mobile communication terminal device; and

[0086] (VS2) Authorization of communication of a network node (eg IoT device), wherein communication of the network node is authorized only if the geographical location of the network node and the location of a defined (authenticated) mobile communication terminal (eg smartphone) substantially coincide.

[0087] The method steps can be implemented by means of infrastructure that is already present in the building anyway.

[0088] To protect the IoT infrastructure (Internet of Things), it is well known that a comprehensive security strategy is needed. This strategy must cover the following areas: protecting data in the cloud, protecting the integrity of data when transmitted over the public Internet, and securely provisioning devices. Each layer makes its own contribution to the security of the total infrastructure, and these contributions are interdependent and complementary.

[0089] The most serious attacks on the IoT infrastructure itself begin with direct technical access to the data of IoT devices on-site in the direct environment of the respective IoT devices.

[0090] The invention prevents in particular direct data technology access to IoT devices from the outside.

[0091] According to the invention, data technology access to the IoT device (directly or via a server or a center) is only performed if the location of the device in the building in the BIM (which stands for Building Information Modeling) coincides with the location of an authorized service technician in the building or with the location of the service technician's smartphone. For this purpose, the installation location of the device in the BIM is compared with the location of the service technician's smartphone, for example via an IPS (Indoor Positioning System). If spatial proximity is determined, access is released so that, for example, external data can be stored in a secure storage area in the IoT device. The external data can be transmitted directly by the smartphone or preferably via a server or via the cloud to the secure storage area of ​​the IoT device.

[0092] To further increase security, the ID code emitted by the location beacon is transmitted to the IPS server in the cloud in an encrypted manner, such as by means of a rolling code. As a result, the current position in the building cannot be determined directly by the smartphone itself, but only by the IPS server. "Spoofing" of the position in the building is therefore impossible.

[0093] By means of the method according to the invention, an increased degree of security is possible for access to secure storage areas of IoT devices. In addition to the virtual component (IP access), a physical component (location) is required in order to activate data transfer. In addition, physical access to the device can be further protected by an access control system.

[0094] This way, it is not possible to manipulate the installed IoT devices in case of a hacker attack on the IoT cloud server (with BIM data).

[0095] Furthermore, even in the case of a direct hacking attack on the IoT device, manipulation is not possible, since write access is only possible via the release of the cloud server, such as by the cloud server itself.

[0096] By means of the method according to the invention and secure access to the cloud server (eg PKI login), it will no longer be necessary to enter passwords or to carry out complex configurations in the future.

[0097] The method according to the invention and the system according to the invention for authorizing the communication of a network node of a communication network are particularly suitable for applications with high security requirements. Therefore, the method according to the invention and the system according to the invention are particularly suitable for commissioning and maintenance or testing of IoT devices with high security requirements or in environments with high security requirements or with sensitive infrastructures (for example in banks, prisons, protection areas, military facilities, disaster relief organizations, nuclear facilities, power plants). IoT devices can be, for example, fire detectors or hazard detectors connected to the Internet or an intranet.

[0098] A method and system for authorizing a communication (e.g. a data connection) of a network node (e.g. an IoT device) of a communication network (e.g. an IP network), wherein the communication of the network node is authorized only if the geographical location of the network node and the location of a defined (authenticated) mobile communication terminal (e.g. a smartphone) substantially coincide.

[0099] Reference numerals

[0100] IPS Position Determination System

[0101] BIM building model

[0102] POS, POS BIM , POSIPS Location data

[0103] REQ Request

[0104] DB1, DB2 databases

[0105] FW Firmware

[0106] GRANT authorization

[0107] CLOUD Cloud Infrastructure

[0108] CSA Cloud Service Application

[0109] GW Gateway

[0110] IoT1-IoT4 IoT devices

[0111] PANEL Control and operation panel

[0112] ML Detector Line

[0113] AL Alert

[0114] BAT Battery Pack

[0115] M Memory

[0116] SMART mobile communication terminal equipment

[0117] DIS Display

[0118] APP

[0119] IP1, IP2 IP connection

[0120] BT Bluetooth connection

[0121] PB1-PB4 Locator Beacon

[0122] ID1-ID4 Identification (ID)

[0123] *IDl-*ID4, *IDn Identification (ID)

[0124] MAP

[0125] VS1, VS1 Method Steps

Claims

1. A method for authorizing communication of a network node of a communication network, wherein the network node is an IoT device, wherein communication with the network node is authorized only if the geographical location of the network node and the location of a defined mobile communication terminal device substantially coincide, wherein the positions of the network nodes are stored in a building model on a server, and wherein the position of the mobile communication terminal is determined via a position determination system, wherein the comparison between the position of the network node in the building model and the position of the mobile communication terminal is performed by the network node, by the server or by the mobile communication terminal, The network node is authorized to communicate with other network nodes or the defined mobile communication terminal only if the defined mobile communication terminal is geographically located at a maximum distance of 3 m from the network node. 2 . The method according to claim 1 , wherein the server is configured to perform a check on the server of the location of the network node and the location of the mobile communication terminal. 3 . The method according to claim 1 , wherein the network node is configured to check the position of the network node and the position of the mobile communication terminal in or via the network node. 4 .

4. The method according to claim 1 or 2, wherein the mobile communication terminal device is configured to perform a check of the location of the network node and the location of the mobile communication terminal device in the mobile communication terminal device.

5. The method according to claim 1 or 2, wherein the mobile communication terminal device is configured to verify the location of the network node and the location of the mobile communication terminal device, so that the verification of the location of the network node and the location of the mobile communication terminal device is performed via an NFC connection between the network node and the mobile communication terminal device.

6. The method according to claim 1 or 2, wherein the position of the network node and the position of the mobile communication terminal substantially coincide during the duration of the communication.

7. The method according to claim 1 or 2, wherein the mobile communication terminal device obtains authentication through an authentication server.

8. The method according to claim 1 or 2, wherein write access to the memory of the authorized network node is permitted only after authorization has been performed.

9. A system for authorizing communication of a network node of a communication network, wherein the system comprises the network node, wherein the network node is an IoT device, wherein the network node is configured to authorize communication with the network node only when the geographical location of the network node and the location of a defined mobile communication terminal device substantially coincide, The system further comprises: a server on which a building model having locations of the network nodes is stored; and A location determination system, used to determine the location of the mobile communication terminal device, wherein the comparison between the position of the network node in the building model and the position of the mobile communication terminal is performed by the network node, by the server or by the mobile communication terminal, The network node is authorized to communicate with other network nodes or the defined mobile communication terminal only if the defined mobile communication terminal is geographically located at a maximum distance of 3 m from the network node.

10. The system according to claim 9, wherein the network node and / or the mobile communication terminal device is configured to check the location of the network node and the location of the mobile communication terminal device.

11. The system according to claim 9, wherein the server is configured to verify the location of the network node and the location of the mobile communication terminal device.

12. The system according to claim 9, wherein: After authorization has occurred, the network node is configured to allow write access to the memory of the network node.

13. A network node of a communication network, the network node comprising a memory, a processing logic and a communication device, the network node being an IoT device, wherein the network node is configured to perform communication via the communication device only when a location of the network node is substantially consistent with a location of a defined mobile communication terminal device, wherein the positions of the network nodes are stored in a building model on a server, and wherein the position of the mobile communication terminal is determined via a position determination system, wherein the comparison between the position of the network node in the building model and the position of the mobile communication terminal device is performed by the network node, The network node is authorized to communicate with other network nodes or the defined mobile communication terminal only if the defined mobile communication terminal is geographically located at a maximum distance of 3 m from the network node.

14. The network node according to claim 13, wherein: After authorization has occurred, the network node is configured to allow write access to the memory of the network node.

Images