Method for enabling secure data communication

Abstract

The invention relates to a method for enabling secure data communication between a first computing unit and a second computing unit of a machine system, in which a master key is used and the first computing unit is assigned an identification string, the master key being stored or stored in the second computing unit, the method comprising: by means of a third computing unit, transmitting the identification string to the third computing unit; determining a plurality of data keys according to the master key and the identification string; storing the plurality of data keys in a first computing unit; embedding the first computing unit in the machine system; transmitting the identification character string from the first computing unit to the second computing unit; determining, in the second computing unit, the plurality of data keys according to the master key and the transmitted identification string; selecting one of the plurality of data keys according to a predetermined selection rule in the first calculation unit and the second calculation unit; and using the selected data key to perform encrypted secure data communication between the first and second computing units.

Description

Technical Field

[0001] The invention relates to a method for implementing a secure data communication between a first and a second computing unit of a machine system. Background Art

[0002] In the case of bus systems used in machines, such as motor vehicles, for transmitting data, such as CAN bus systems (CAN: Controller Area Network), the messages sent are usually not subject to security mechanisms, i.e. the messages and the data to be transmitted therewith can be falsified. For example, in a motor vehicle, the nitrogen oxide values ​​transmitted to the control device of the motor vehicle can be manipulated in an exhaust gas sensor system in order to save urea. Although the control device of the machine can have a high computing power, the computing power of the sensors or their control units can be very limited, so that more complex encryption methods are not practical, especially for key exchange in view of the computing time requirements. Summary of the invention

[0003] According to the invention, a method for implementing secure data communication between a first and a second computing unit of a machine system is proposed, having the features of the independent patent claim. Advantageous embodiments are the subject matter of the dependent claims and the subsequent description. The method is in particular computer-implemented.

[0004] According to the invention, a plurality of data keys are determined based on or as a function of a master key and an identification string of a first computing unit and are stored in the first computing unit, wherein the master key is stored or stored in a second computing unit. The first computing unit is embedded in the machine system and transmits the identification string to the second computing unit, which determines the plurality of data keys based on the master key and the transmitted identification string. One of the data keys is selected from the two computing units according to a predetermined selection rule and is used for encrypted secure data communication. This is expedient because, in this way, secure data communication with a second computing unit (e.g. a control device) can be realized for a first computing unit (e.g. a sensor) whose computing resources are insufficient to realize more complex encryption methods, especially in view of time boundary conditions.

[0005] The term "computing unit" or "computing system" shall generally mean a unit (e.g. a microcontroller, a computer, a server, etc.) having at least one processing unit and a communication interface and possibly at least one memory (volatile and / or non-volatile). The at least one processing unit is set up to execute a computer program that can be encoded in software and / or hardware and can, for example, include one or more of a processor with one or more computing cores, an integrated circuit (such as an FPGA (Field Programmable Gate Array)) or an ASIC (Application-Specific Integrated Circuit), a hardware accelerator for cryptographic functions, etc.

[0006] For example, the first computing unit may be a sensor or its control unit, and the second computing unit may be a control device of the machine system.

[0007] A symmetric encryption method can be implemented using the data keys (i.e. each of the plurality of data keys and, if necessary, other data keys determined based on this using an algorithm). In the cryptographically secure data communication between the first and second computing units, a symmetric encryption method is correspondingly used in particular. The plurality of data keys and the master key are secret keys, i.e., they should be kept secret outside of their use according to the invention.

[0008] When determining the plurality of data keys by the third computing unit and when determining the plurality of data keys in the second computing unit, for example, a key derivation function is used, wherein the key derivation function is in particular the same key derivation function in the second computing unit and in the third computing unit.

[0009] According to a possible design, before the first computing unit is embedded in the machine system, the plurality of data keys are stored in the first computing unit. For example, this can be achieved by generating these data keys at the supplier of the first computing unit and storing these data keys in the first computing unit. Then, the first computing unit can be embedded in the machine system at the manufacturer of the first computing unit.

[0010] According to another possible design, the method includes: in the first and second computing units, updating the selection of one of the plurality of data keys according to a predetermined selection rule; and using the updated selected data key in the encrypted secure data communication. By performing the update during use, for example, replay attacks can be prevented.

[0011] The selection may be updated in the order of the plurality of data keys, or the selection rule may include updating the selection in the order of the plurality of data keys. The updating of the selection may be performed after a predetermined period of time and / or in response to the occurrence of at least one predetermined event and / or at least one predetermined point in time.

[0012] The selection rule may in particular include: when the selection is updated, a data key from the plurality of data keys that has not been used is selected respectively. It may further be provided that: if no data key from the plurality of data keys that has not been used remains when the selection is updated, a new data key is determined by means of an algorithm based on the last selected data key, and the new data key is used as the updated selected data key. Correspondingly, other data keys that have not been used may be determined during operation.

[0013] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings.

[0014] The invention is schematically illustrated in the drawings based on exemplary embodiments and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1A and Figure 1B A method for implementing secure data communication between a first computing unit and a second computing unit of a machine system according to an exemplary embodiment of the present invention is illustrated. DETAILED DESCRIPTION

[0016] Figure 1A and Figure 1B A method for implementing a secure data communication between a first computing unit 2 and a second computing unit 4 of a machine system 1 according to an exemplary embodiment of the present invention is illustrated. Figure 1A involves the configuration of the system, and Figure 1B Involving the use of this system.

[0017] In the final use, data (referred to as data to be transmitted) should be transmitted from (at least) a first computing unit 2 to a second computing unit 4, both of which are embedded in a machine system 1 (e.g. a vehicle, or a mobile working machine or other machine or facility). The first computing unit 2 is in particular a computing unit with relatively few computing resources, i.e., a computing unit that has computing resources sufficient to perform relatively simple cryptographic methods, such as encrypting or signing data using symmetric cryptographic methods (e.g. AES for encryption or generating message authentication codes (MAC)), but has too few computing resources (in particular computing power and / or memory) to perform more complex cryptographic methods (e.g., there is no dedicated hardware accelerator for cryptographic methods), which for example include signing data using asymmetric cryptographic methods (especially when timing is taken into account). For example, the first computing unit may have a processor with only one computing core and may have only a small amount of memory.

[0018] The second computing unit 4 is in particular a computing unit with relatively more computing resources, i.e., it has computing resources sufficient to execute more complex encryption methods. For example, the second computing unit may have: a microcontroller or a processor with multiple computing cores; and a hardware accelerator for encryption methods; and relatively more storage space. For example, the first computing unit may be a sensor or its control unit (microcontroller) used in a machine system 1, such as a motor vehicle, or may be included in such a sensor, and the second computing unit may be a control device of the machine system 1, such as an engine control device of a motor vehicle. Then, the data to be transmitted are in particular measurement data measured by the sensor.

[0019] refer to Figure 1A In step 200, a master key 10 can first be provided, in particular it can be generated by means of a suitable method. The master key 10 should be a key suitable for the encryption method, i.e. an arbitrary, sufficiently long string that can only be guessed by trying all possible strings (so-called brute force attack), in particular a random or pseudo-random string. Step 200 can be performed, for example, by a computing unit referred to as fourth computing unit 8. The fourth computing unit 8 can be, for example, a computer or server system at the manufacturer of the machine system 1 (so-called OEM: original equipment manufacturer).

[0020] Furthermore, at step 210 , the master key 10 may be stored in the second computing unit, for example during programming of the second computing unit.

[0021] In step 220, the master key 10 is transmitted to a computing unit referred to as the third computing unit 6. The third computing unit 6 may be, for example, a computer or server system at a supplier that produces a component (such as a sensor) to be embedded in the machine system 1, which component includes the first computing unit 2. It is also conceivable that the third computing unit 6 and the fourth computing unit 8 are the same computing unit, for example when the manufacturer of the machine system itself produces the component to be embedded.

[0022] In step 230, multiple data keys 121, 122, ..., 12N are determined based on the master key 10 and the identification string 14 of the first computing unit 2. Therefore, the data key set 12 is determined. In step 230, a key derivation function (KDF) can be used for this purpose. Known key derivation functions are, for example, PBKDF2 (RFC 2898, RFC8018), bcrypt or scrypt. In principle, the key derivation function can be regarded as a function that maps an input string to an output string. The input string for the first data key of the multiple data keys is, for example, formed by the master key 10 and the identification string 14 (for example, by joining them to each other), wherein the output string forms the first data key of the multiple data keys. Other data keys can be determined by recursive application, for example, in such a way that the output string or the corresponding data key is used as the input string of the key derivation function (or at least as a part thereof) in order to determine the next data key as the output string. Alternatively (or additionally), an input string for each of the plurality of data keys (or a portion of the plurality of data keys) is formed, for example, by joining them together, for example from the master key 10, the identification string 14 and the count string (which corresponds to the different data keys), etc. Then, the data keys 121, 122, ..., 12N are the corresponding output strings. The key derivation function can be formed, for example, by means of a cryptographic hash function H.

[0023] These data keys 121, 122, ..., 12N are cryptographic keys that can be used in symmetric encryption methods, such as symmetric cryptographic encryption methods and message authentication methods. In encryption methods, these data keys 121, 122, ..., 12N can be used to encrypt data and decrypt the data encrypted thereby. Suitable symmetric cryptographic encryption methods are, for example, AES (Advanced Encryption Standard), DES (Data Encryption Standard), Triple-DES, Blowfish, etc. In message authentication methods, for example, a message authentication code (English: Message Authentication Code, MAC) can be generated thereby.

[0024] The identification string 14 may be known, for example, and may be read from the first computing unit 2 or may be generated in step 240, for example as a random string. The identification string 14 may include, for example, one or more of the following: product ID, part number, production date, production time (respectively related to the first computing unit 2 or the component in which the first computing unit is used), random number, random string, iteration counter. Preferably, the identification string 14 is uniquely or one-to-one assigned to the first computing unit 2, i.e., different identification strings are assigned to different computing units in the plurality of first computing units.

[0025] In step 250, the plurality of data keys 121, 122, ..., 12N or the data key set 12 is stored in the first computing unit 2. Likewise, if the identification string 14 is not already stored in the first computing unit 2, it can be stored there.

[0026] In step 260, the second computing unit 4 can be embedded in the machine system 1. Alternatively, the second computing unit can already be embedded there, so that the above-described storage of the master key 10 takes place in the already embedded state of the second computing unit.

[0027] In step 270 , the first computing unit 2 is embedded in the machine system 1 .

[0028] exist Figure 1A The process shown on the left takes place in particular at the manufacturer of the machine system 1. The process shown on the right takes place in particular at a supplier who produces the second computing unit 2 or a component including the second computing unit 2 to be embedded in the machine system 1 and / or supplies it to the manufacturer of the machine system 1 in a configured manner.

[0029] In relation to secure data communication in the machine system 1 during its operation Figure 1B In Figure 1A The starting point is the state obtained at the end of the process shown in . Thus, the starting point is a machine system 1 comprising a first computing unit 2 and a second computing unit 4, wherein a plurality of data keys 121, 122, ..., 12N (or a set of data keys 12) and an identification string 14 are stored in the first computing unit 2, and a master key 10 is stored in the second computing unit 4. It is also assumed that the first and second computing units are connected to one another for data communication by means of a serial or parallel data communication network, for example via Ethernet or a fieldbus, such as a CAN bus (CAN: Controller Area Network).

[0030] In step 310, the identification string 14 is transmitted from the first computing unit 2 to the second computing unit 4, which can be done, for example, in response to a corresponding request (identification request) from the second computing unit 4 to the first computing unit 2 in step 300, or can also be done at another time, in particular in response to another event (such as a restart or reinitialization of the machine system). After step 310, the identification string 14 is also present or stored in the second computing unit 4.

[0031] In step 320, in the second computing unit 4, a plurality of data keys are determined from the master key 10 and the identification string 14. Here, the same key derivation function is used, so that the same data key is obtained, which is used by the third computing unit 6 in step 230. Correspondingly, the plurality of data keys 121, 122, ..., 12N or the data key set 12 is also determined in the second computing unit 4 and is therefore present or stored in the second computing unit 4.

[0032] In step 332, in the first computing unit 2, a data key 12A is selected from the plurality of data keys 121, 122, ..., 12N using a predetermined selection rule. Similarly, in step 334, in the second computing unit 4, the data key 12A is selected from the plurality of data keys 121, 122, ..., 12N using the same predetermined selection rule. The selection is performed based on the data key sets stored in the respective computing units. Since the same selection rule is used, the same data key 12A is selected from the respective data key sets 12 in the two computing units. The selection rule may, for example, include: performing the selection according to the time point of the selection and / or according to at least one predetermined event; and / or first selecting the first data key from the plurality of data keys 121, 122, ..., 12N according to the order of the plurality of data keys 121, 122, ..., 12N, and updating it later (see steps 350, 352, 354 below). The selection rule is, for example, implemented as a selection algorithm.

[0033] Typically, algorithms (such as the selection rules or selection algorithms mentioned above and other algorithms mentioned in this application) can be implemented with the aid of corresponding computer programs or computer program modules, which are stored in corresponding computing units and executed to implement the corresponding algorithms.

[0034] In step 340, the selected data key 12A is used for cryptographically secure data communication between the first computing unit 2 and the second computing unit 4. Thus, the corresponding communication algorithms 342, 344 in the two computing units 2, 4 comprise cryptographic algorithms using the selected data key 12A.

[0035] In step 350, an update of the selected data key is initiated in the first computing unit 2 and in the second computing unit 4. To this end, an update algorithm can be provided or implemented in each of the two computing units 2, 4, which updates the key in the respective computing unit. For example, an update algorithm 352 in the first computing unit 2 and an update algorithm 354 in the second computing unit 4. The two update algorithms 352, 354 are identical, so that the update 350 is initiated at the same point in time in the two computing units 2, 4. After the update, cryptographically secure data communication is performed using the updated selected data key.

[0036] The two updating algorithms 352, 354 (or the updating algorithms, since the two updating algorithms are identical) are in particular configured to: identify the expiration of a predetermined time period and / or the occurrence of at least one predetermined event and / or the occurrence of at least one predetermined point in time; and initiate the updating 350 in response to the identification. That is, the updating 350 of the selection is performed after a predetermined time period and / or in response to the occurrence of at least one predetermined event and / or in response to the occurrence of at least one predetermined point in time. The at least one predetermined event may, for example, include one or more of the following: the startup of the machine system 1 or the first and second computing units 2, 4; an incorrect additional message for authentication / verification; an external trigger signal; a specific state of the machine system (e.g., an error event, an error state, operating hours, vehicle mileage, etc.).

[0037] Alternatively, an update algorithm may be implemented or provided only in one of the two computing units 2, 4, which updates the algorithm not only in the computing unit providing the update algorithm but also in the other computing unit, for example, by an update signal. For example, an update algorithm may be provided in the second computing unit 4, which updates the algorithm in the second computing unit 4 and initiates the update in the first computing unit 2 (for example, by transmitting an update signal); or an update algorithm may be provided in the first computing unit 2, which updates the algorithm in the first computing unit 2 and initiates the update in the second computing unit 4 (for example, by transmitting an update signal).

[0038] In the case of the update, the predetermined selection rule can be reused, i.e., steps 332, 334 are performed again in the two computing units. The selection rule can, for example, include: selecting the corresponding next data key (related to the last selected data key) from the plurality of data keys 121, 122, ..., 12N according to the order of the plurality of data keys 121, 122, ..., 12N. Alternatively or additionally, the selection rule can include: performing the selection according to the identified event and / or the identified time point (which event or time point caused the update).

[0039] The selection rule may in particular include the following: when updating, a data key is selected which has not been previously selected, i.e. which has not yet been used for cryptographically secure data communications. If there are no more data keys which have not yet been selected, i.e. if each of the plurality of data keys has already been selected once, it may be provided (within the framework of the predetermined selection rule) that all or at least a subset of the plurality of data keys 121, 122, ..., 12N are reactivated for the selection (and to some extent, so to speak, starting from scratch), or a new data key is calculated by means of an algorithm from the last selected data key 12A, which new data key is used as the updated selected data key 12A.

Claims

1. A method for implementing secure data communication between a first computing unit (2) and a second computing unit (4) of a machine system (1), in, Using a master key (10), which is stored or is stored in the second computing unit (4), and assigning an identification string (14) to the first computing unit (2), the method comprises: Determining a plurality of data keys (121, 122, ..., 12N) based on the master key (10) and the identification string (14) by a third computing unit (6); storing (250) the plurality of data keys in the first computing unit; embedding (270) the first computing unit (2) in the machine system (1); transmitting (310) the identification string (14) from the first computing unit (2) to the second computing unit (4); In the second computing unit (4), the plurality of data keys (121, 122, ..., 12N) are determined (320) based on the master key (10) and the transmitted identification string (14); In the first computing unit and the second computing unit, one of the multiple data keys (121, 122, ..., 12N) is selected (332, 334) according to a predetermined selection rule; and the selected data key (12A) is used (342, 344) to perform encrypted secure data communication (340) between the first computing unit and the second computing unit.

2. The method according to claim 1, in, Prior to embedding (270) the first computing unit (2) in the machine system (1), the plurality of data keys (121, 122, . . . , 12N) are stored (250) in the first computing unit (2).

3. The method according to any one of the preceding claims, further comprising: include: In the first and second computing units (2, 4), the selection (332, 334) of one of the plurality of data keys (121, 122, ..., 12N) is updated (350) according to the predetermined selection rule; and the updated selected data key (12A) is used in the encrypted secure data communication (340).

4. The method according to claim 3, in, The selection rule includes performing the updating of the selection in an order of the plurality of data keys (350).

5. The method according to any one of claims 3 or 4, in, said updating (350) of said selection is performed after a predetermined period of time; and / or wherein, The updating (350) of the selection is performed in response to the occurrence of at least one predetermined event and / or at least one predetermined point in time.

6. The method according to any one of claims 3 to 5, in, The selection rule comprises: when the selection is updated (350), respectively selecting unused data keys from the plurality of data keys (121, 122, ..., 12N).

7. The method according to claim 6, in, If, when the selection is updated, no unused data keys remain among the multiple data keys (121, 122, ..., 12N), a new data key is determined based on the last selected data key with the aid of an algorithm, and the new data key is used as the updated selected data key (12A).

8. The method according to any one of the preceding claims, in, The same key derivation function is used when determining a plurality of data keys (121, 122, . . . , 12N) by the third computing unit (6) and when determining the plurality of data keys (121, 122, . . . , 12N) in the second computing unit.

9. The method according to any one of the preceding claims, in, Each of the plurality of data keys (121, 122, ..., 12N) is suitable for implementing a symmetric encryption method.

10. The method according to any one of the preceding claims, in, In the cryptographically secure data communication (340) between the first computing unit and the second computing unit, a symmetric encryption method is used.

11. The method according to any one of the preceding claims, in, The first computing unit (2) is a sensor or a control unit thereof.

12. The method according to any one of the preceding claims, in, The second computing unit (4) is a control device of the machine system (1).

13. The method according to any one of the preceding claims, further comprising: include: The master key (10) is stored (210) in the second computing unit (4).

14. The method according to any one of the preceding claims, further comprising: include: The master key (10) is generated (200) by a fourth computing unit (8).

15. The method according to any one of the preceding claims, further comprising: include: The identification string (14) is generated (240).

Images