Method for securely transmitting time-critical data in communication system and communication system

Abstract

The invention relates to the secure transmission of time-critical data in a communication system comprising: a plurality of local networks (101-104), in which data is transmitted by means of exchange; at least one network (200) superimposed with respect to the local network, in which network data is transmitted by means of routing; and a gateway system (300) for coupling the communication system to at least one unsecure external network (400). Network layer communications via the superimposed network are only authorized between the authenticated system components. The switches (201-205) respectively authenticate the connected terminal devices (111-114, 121-122, 131-133, 141-142) and distribute the terminal devices to a physical or logical local network according to the identities of the corresponding terminal devices. Secure layer communications within the local network are implicitly authorized based on the allocation of the respective terminal devices to the same local network. Communication between terminal devices of different local networks or with terminal devices in an unsecure external network over layers 3 to 7 of the OSI is authorized by means of zero-trust agents (100, 130, 140), each of which is assigned to a local network.

Description

Technical Field

[0001] The invention relates to a method for securely transmitting time-critical data within a communication system, in particular within a communication system of an industrial automation system, and to a communication system which is suitable or designed to carry out the method according to the invention. Background Art

[0002] Industrial automation systems usually include a large number of automation devices that are interconnected via an industrial communication network and are used to control, regulate or monitor facilities, machines or devices within the scope of production or process automation. Due to the time-critical framework conditions in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, real-time Ethernet or time-sensitive networks (TSN) are mainly used for communication between automation devices. In particular, control services or applications can be automatically and load-dependently distributed to currently available servers or virtual machines of the industrial automation system.

[0003] A method for checking datagrams transmitted in an industrial automation system having a plurality of automation units is known from WO 2019 / 042915 A1, wherein the datagrams to be checked from the automation units are transmitted to the firewall system via corresponding firewall interfaces for checking and there are checked in a rule-based manner. The firewall system is formed by at least one virtual machine provided in a data processing system comprising a plurality of computer units. In order to transmit the datagrams to be checked, a security layer tunnel is constructed between the corresponding firewall interface and the firewall system. The datagrams to be checked and at least the datagrams that have been successfully checked are transmitted in the corresponding security layer tunnel.

[0004] WO 2020 / 182627 A1 describes a method for monitoring the integrity of an industrial cyber-physical system, wherein measurement data detected by means of different sensors of the cyber-physical system or control data determined for different actuators of the cyber-physical system are provided or acquired. In addition, at least one measurement data association parameter between the measurement data detected by means of different sensors or at least one control data association parameter between the control data determined for different actuators is determined. At least one measurement data association parameter is compared with a measurement data association reference or at least one control data association parameter is compared with a control data association reference. Based on the comparison, the integrity of the cyber-physical system to be monitored is evaluated.

[0005] WO 2020 / 212051 A1 relates to an industrial automation device, comprising a monitoring unit for checking and monitoring the integrity state of the industrial automation device. In addition, at least one device component is provided, which communicates with the monitoring unit via a communication connection without any reaction. Here, the communication that can be made without reaction includes providing at least one device component parameter from the device component to the monitoring unit. The monitoring unit is configured to record and process the provided device component parameters of the device components of the industrial automation device in order to check and monitor the integrity state of the industrial automation device. In addition, the monitoring unit is configured to record or provide the integrity state of the industrial automation device as a result of the processed device component parameters of the device components of the industrial automation device. In addition, the monitoring unit is provided as a trustworthy device component in the industrial automation device in a manner that is tamper-proofed by an anti-tampering protection device.

[0006] From an earlier European patent application with application number 21176125.9 a method for securely granting access to data or data within a communication system is known, the communication system being divided into a plurality of security zones, each of which comprises a plurality of devices that are physically or logically connected to one another. Selected devices assigned to the same security zone exchange unprotected data with one another and implicitly authorize access to data or resources. A gateway component or a check instance assigned to the respective security zone requests identification and access rights to grant access to data or resources provided by at least selected devices of the security zone to an external device outside the security zone or a user there, and checks the device according to a security policy. In the event that the identification and access rights are successfully authenticated, a protected connection is established between at least selected devices of different security zones with the aid of the respective gateway components for transmitting data or accessing resources.

[0007] The zero trust concept proposes that users or devices, regardless of their respective location or environment, are authenticated relative to a communication partner or when accessing protected resources, so that after successful authentication, they can, for example, access the desired data or application. In industrial automation systems, the problem with the application of the zero trust concept is that not every user or every device is able to perform authentication, especially from an economic point of view. In principle, confidentiality and data integrity must be ensured when transmitting data within an industrial automation system or in a box superimposed system, for example, when transmitting an order to a machine or transmitting the production data of a machine to a superimposed system. In general, the requirements apply to the communication relationship between IT systems (Information Technology) and OT systems (Operational Technology).

[0008] In the communication networks of industrial automation systems, in addition to data security, deterministic data transmission and processing must also be guaranteed. In industrial automation systems, deterministic behavior is particularly necessary to ensure functional safety. However, mutual authentication of communication partners set up according to the zero trust concept makes deterministic data transmission and processing more difficult.

[0009] In industrial automation systems, granular segmentation of communication networks is common, wherein for reasons of availability, the OSI layer 2 network segments are kept as small as possible. In this way, possible errors can be isolated more easily. In addition, granular segmentation helps to limit possible communication relationships (e.g., communication relationships with unprotected or only weakly protected data transmission) to a minimum. However, this requirement conflicts with communication requirements, especially between IT systems and OT systems. Therefore, perimeter-based security concepts with a large number of cell protection firewalls are not a satisfactory solution. Summary of the invention

[0010] The invention is therefore based on the object of creating a method for securely transmitting time-critical data within a communication system, which method ensures data security and determinism at the same time, in particular in industrial automation systems, and of specifying a device suitable for engineering the implementation of the method.

[0011] According to the invention, this object is achieved by a method having the features specified in claim 1 and by a communication system having the features specified in claim 15. Advantageous developments of the invention are specified in the dependent patent claims.

[0012] According to the method for securely transmitting time-critical data within a communication system, the communication system includes a plurality of local networks in which data is transmitted by means of switching; at least one network superimposed relative to the local networks in which data is transmitted by means of routing; and a gateway system for connecting the communication system to at least one insecure external network. Network layer communication (OSI third layer communication) via the superimposed network is authorized only between authenticated system components. In this case, the switch authenticates the connected terminal devices respectively and assigns the terminal devices to a physical or logical local network according to the identity of the corresponding terminal devices. Based on the association of the corresponding terminal devices with the same local network, the security layer communication is implicitly authorized within the local network. Advantageously, the superimposed network is connected to the local network and the gateway system, wherein the logical local network includes terminal devices assigned to different physical local networks.

[0013] Preferably, the local networks form broadcast domains respectively, and the switches respectively include datagram filter components, which filter data flows between the terminal devices connected to the corresponding switches and the terminal devices included in other local networks. In particular, the datagram filter components filter data flows according to filtering rules or security policies preset for the corresponding terminal devices. Security policies (Security Policy, also known as security policies) are usually technical documents or organizational documents used to implement and realize existing security requirements in companies or institutions. The core component is to ensure the integrity, confidentiality, availability or authenticity of information to be protected. The security policy of the datagram filter component or firewall determines, for example, how to perform specific configuration, which access rights are granted, how to log or which defensive measures the datagram filter component or firewall takes in attack scenarios. The security policy can exist in particular as a configuration file, an XML file or a device configuration that can be directly machine-evaluated. It is also feasible that the security policy exists in text form, and the text form is evaluated by means of a method based on artificial intelligence or machine learning. In addition, it is feasible that the security policy can also exist in a graphical form, and the graphical form is evaluated by means of an image processing method or a pattern recognition method.

[0014] According to the present invention, communication between terminal devices in different local networks or with terminal devices in an unsecured external network on OSI layers 3 to 7 is authorized with the aid of a zero-trust agent, which is respectively assigned to a local network. Here, the terminal device is authenticated for each session via the zero-trust agent of the corresponding local network assigned to the terminal device. For this purpose, a zero-trust agent is provided for each physical local network and / or a zero-trust agent instance is provided for each logical local network in the gateway system.

[0015] With the aid of the present invention, a zero trust concept can be implemented, in particular for communication relationships between IT systems and OT systems, taking into account deterministic requirements in OSI layer 2 communication networks. To this end, according to the present invention, a protection concept is proposed, which includes a first protection level, which handles communication relationships on OSI layer 2 taking into account deterministic requirements, and a second protection level, which involves OSI layers 3 to 7 and is provided with the use of a zero trust concept. The two-level protection concept ensures deterministic OSI layer 2 communication between automation devices and simultaneously achieves a significantly increased protection level.

[0016] According to a preferred design of the present invention, the switch obtains the IP address and device name of the respectively connected terminal devices, and transmits the operating status information and / or access control lists of the terminal devices including the IP address and device name to the monitoring device included in the gateway system. The monitoring device checks whether there are abnormalities in the operating information and / or the access control list based on the reference information. In the case of an abnormality, the monitoring device sends a warning to the corresponding switch and / or initiates control measures for the corresponding terminal device to solve the problem. The operating information or access control list advantageously includes the authentication method, certificate or location of the corresponding terminal device used by the corresponding terminal device. In addition, the control measures for the corresponding terminal device can include moving the terminal device to an isolated network environment. In particular, it is to block all ports of the terminal device that is used to overload the communication system in order to disconnect it from the communication system.

[0017] The gateway system preferably includes a decision-making component designed as a policy decision point for controlling the security layer communication by applying a terminal device-specific security policy. The decision-making component in turn includes a security policy database, in which information about approved terminal devices, the roles of the respective terminal devices and the terminal device authentication requirements are stored. In addition, the switches advantageously include an integrated implementation component designed as a policy execution point, which is used to control the security layer communication. The implementation components are respectively connected to the decision-making component and respectively implement the access rights or restrictions preset by the decision-making component according to the security policy. In this way, the effective and reliable implementation of the access rights or restrictions preset according to the security policy is ensured.

[0018] According to another advantageous embodiment of the present invention, the implementation component implements access rights or restrictions on terminal devices connected to a switch in which the corresponding implementation component is integrated. Here, the content of the security policy database is preset in an administrative manner and / or by means of an intent-based network system. This enables flexible implementation of security policies in industrial automation systems, especially in existing automation devices that do not have their own authentication functions or can only be retrofitted with authentication functions that are disproportionately expensive.

[0019] Preferably, a security layer tunnel between local networks is constructed via a superimposed network with the aid of a switch as a tunnel endpoint. Here, the switch forms a tunnel endpoint. The data frames sent in the security layer tunnel are respectively encapsulated into tunnel data frames. Preferably, the encapsulation into the tunnel data and / or the decapsulation of the tunnel data are performed in a hardware-implemented manner. In this way, deterministic data transmission is ensured even in logical local networks distributed over multiple physical local networks. The tunnel data frame is in particular a VXLAN frame or a frame for OSI layer 2 tunnel transmission of a data frame. In addition, the switch advantageously encrypts the security layer communication via a security layer tunnel based on IEEE802.11AE (MACSec). This enables the use of widespread and certified technical principles to achieve secure and high-performance communications on OSI layer 2.

[0020] The communication system according to the invention for the secure transmission of time-critical data is intended to carry out the method according to the aforementioned embodiments and comprises: a plurality of local networks for data transmission by means of switching; at least one network superimposed relative to the local networks for data transmission by means of routing; and a gateway system for connecting the communication system to at least one unsecure external network. The superimposed networks are designed and configured so that network layer communications via the superimposed networks are only authorized between authenticated system components. Furthermore, the local networks each comprise at least one switch, which is designed and configured so that each connected terminal device is authenticated and assigned to a physical or logical local network according to the corresponding terminal device identity.

[0021] The local networks of the communication system according to the present invention are respectively designed and configured for implicitly authorizing security layer communications within the local network based on the association of the corresponding terminal devices with the same local network. Therefore, the terminal devices are respectively designed and configured for authorization of communications between terminal devices in different local networks or with terminal devices in an insecure external network on OSI layers 3 to 7 with the aid of a zero trust agent, which is respectively assigned to the local network. In addition, the zero trust agent is respectively designed and configured for authenticating the terminal device for each session via the zero trust agent of the corresponding local network assigned to the terminal device. Here, in the gateway system, a zero trust agent is respectively provided for each physical local network or a zero trust agent instance is respectively provided for each logical local network. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The invention is explained in more detail using an embodiment according to the attached drawings.

[0023] Figure 1 An arrangement is shown having a communication system for secure transmission of time-critical data and an insecure external network,

[0024] Figure 2 Shown in Figure 1 A schematic diagram of an apparatus for securely transmitting time-critical data is shown. DETAILED DESCRIPTION

[0025] Figure 1 The device shown in the figure includes a communication system, which has: a plurality of local networks 101-104 for data transmission by means of switching; a network 200 for data transmission by means of routing superimposed on the local networks 101-104 and a gateway system 300 for connecting the communication system to an unsecured external network 400. The local networks 101-104 respectively form a broadcast domain. The superimposed network 200 is connected to the local networks 101-104 and the gateway system 300. Here, the logical local networks 101-102 can include terminal devices 111-114, 121-122 assigned to different physical local networks.

[0026] For example, the terminal devices 111-112 of the first logical local network 101 are connected to the first switch 201, and the first switch is connected to the second switch 202 via the superimposed network 200, wherein the terminal devices 113-114 of the first logical local network 101 are connected to the second switch. Figure 2 The safety layer communication (OSI layer 2) is performed by means of the safety layer tunnel 11. In this case, the switches 201-202 form tunnel endpoints, and the data frames transmitted in the safety layer tunnel 11 are respectively encapsulated in tunnel data frames.

[0027] The terminal device 121 of the second logical network 102 is also connected to the second switch 202, and the second logical network also includes a terminal device 122 connected to the third switch 203. The terminal device 122 is in turn connected to the peripheral device 123. In the current embodiment, the third switch 203 is connected to the superimposed network 200 via a 5G mobile radio router 231. In a corresponding manner used for the first logical local network 101, according to Figure 2 Communication is performed between the second switch 202 and the third switch 203 within the second logical local network 102 by means of the security layer tunnel 12. In this case, the switches 202-203 form tunnel endpoints, and data frames transmitted within the security layer tunnel 12 are respectively encapsulated into tunnel data frames.

[0028] The terminals 131-133 connected to the fourth switch 204 are assigned to the common physical local network 103. The fifth switch 205 is assigned to the physical local network 104, which is comprised of a series machine having a plurality of automation components formed by terminals 141-142 and peripheral devices 143. In this case, the peripheral device 143 is connected to the terminal 142.

[0029] The terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 are in particular physical or virtual hosts that can provide data or resources to other hosts. The data or resources can be allocated to services or control and monitoring applications of industrial automation systems, for example, which are examples of time-critical services or applications.

[0030] In the present embodiment, the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 implement the functions of a control device (e.g., a programmable logic controller) or a field device (e.g., a sensor or actuator) of an industrial automation system. Here, the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 are used to exchange control and measurement variables with a machine or device controlled by the control device. In particular, the control device is configured to create suitable control variables from the detected measurement variables.

[0031] Alternatively or additionally, the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 respectively implement an operating and monitoring station for visualizing process data or measured and controlled variables processed or detected by the control device or other automation device. In particular, the operating and monitoring station can be used to display the values ​​of the closed-loop control circuit and to change the closed-loop control parameters or programs.

[0032] In the current embodiment, the gateway system 300 particularly includes a switch 301 connected to the superimposed network 200, a router 302 connected to the switch 301 and an unsecured external network 400, and an intent-based network system 303. With the help of all switches 201-205, 301, a security layer tunnel to the gateway system 300 can be established via the superimposed network 200 or a security layer tunnel can be established between different local networks 101-105.

[0033] In a manner corresponding to the two logical local networks 101-102, switches 201-205, 301 form tunnel endpoints for security layer communications via the superimposed network 200 to the gateway system 300 or security layer communications between different local networks 101-104. Here, data frames sent in the security layer tunnel are respectively encapsulated into tunnel data frames. The encapsulation or decapsulation of tunnel data is preferably implemented by hardware, in particular for performance reasons to ensure deterministic transmission of data when using a security layer tunnel. The tunnel data frame can be, for example, a VXLAN frame according to IETF RFC 7348 or a frame of an OSI layer 2 tunnel for data frames. Switches 201-205, 301 encrypt the security layer communication via the security layer tunnel based on IEEE802.1AE (MACSec).

[0034] The switches 201-205 include datagram filter components, respectively, which filter data flows between the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 connected to the corresponding switches 201-205 and the terminal devices or peripheral devices included in other local networks. The datagram filter components filter data flows according to filtering rules or according to security policies preset for the corresponding terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143.

[0035] It is important that network layer communication (OSI layer 3) via the superimposed network 200 is only authorized between authenticated system components. In particular, for this purpose the switches 201-205 authenticate the connected terminal devices or their peripheral devices 111-114, 121-123, 131-133, 141-143, respectively, and assign them to a physical or logical local network 101-104 according to the corresponding terminal device identity or peripheral device identity. Due to the assignment of the corresponding terminal devices or their peripheral devices 111-114, 121-123, 131-133, 141-143 to the same local network 101-104, the security layer communication within the local network 101-104 is implicitly authorized.

[0036] The communication 21-22 on OSI layers 3 to 7 between the terminals or peripheral devices 111-114, 121-123, 131-133, 141-143 of different local networks 101-104 or the communication on OSI layers 3 to 7 with the terminals or peripheral devices 411 in the unsecured external network 400 is authorized by means of zero trust agents 100, 130, 140, which are respectively assigned to the local network. In the present exemplary embodiment, the communication 21-22, 31 takes place via the router 302 of the gateway system 300. For the communication 31 with the terminals or peripheral devices 411 in the unsecured external network 400, this also takes place additionally via the router 401 of the unsecured external network 400.

[0037] For communication 21-22, 31 on OSI layers 3 to 7, the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 are authenticated for each session via a zero trust agent 100, 130, 140 assigned to their respective local network 101-104. In this case, a zero trust agent 130, 140 assigned to the physical local network 103-104 is provided, and a zero trust agent instance 100 is provided in the gateway system 300 for the logical local network 101-102. In addition, a zero trust agent instance 100 is provided for the terminal device or peripheral device 411 in the unsecured external network 400. The authentication of the terminal device or peripheral device 111-114, 121-123, 131-133, 141-143 can usually be performed, for example, by means of a device address (IP, MAC) or a device certificate.

[0038] In the current embodiment, the switches 201-205 create the IP addresses and device names of the connected corresponding terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143. The switches 201-205 send the operation status information or access control list including the IP addresses and device names of the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 to the monitoring device 312 included by the gateway system 300. The monitoring device 312 preferably includes a policy information point (PIP) and checks the operation information or access control list with reference information for abnormalities. In the case of abnormalities, the monitoring device 312 sends a warning to the corresponding switch 201-205, alternatively or additionally, the monitoring device 312 initiates control measures for the corresponding terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143 to solve the problem. The operating information or access control list includes in particular the authentication method, certificate or location of the corresponding terminal or peripheral device 111-114, 121-123, 131-133, 141-143 used by the corresponding terminal or peripheral device 111-114, 121-123, 131-133, 141-143. The control measures initiated by the monitoring device 312 for the corresponding terminal or peripheral device 111-114, 121-123, 131-133, 141-143 can, for example, include moving the terminal or peripheral device 111-114, 121-123, 131-133, 141-143 into an isolated network environment, in particular by blocking all ports for the corresponding terminal or peripheral device 111-114, 121-123, 131-133, 141-143. In this way, terminal devices or peripheral devices 111 - 114 , 121 - 123 , 131 - 133 , 141 - 143 which place an excessive load on the communication system can be disconnected from the communication system.

[0039] In addition, in the current embodiment, the gateway system 300 includes a decision component 311 designed as a policy decision point (L2PDP) for controlling security layer communications by using a security policy specific to a terminal device or a peripheral device. For communications 21-22, 31 on OSI layers 3-7 or with an unsecured external network 400, a separate policy decision point 313 (OT / ITPDP) and a policy execution point 320 (OT / IT PEP) assigned to the policy decision point 313 are provided.

[0040] The decision-making component 311 includes a security policy database in which information about permitted terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143, the roles of the corresponding terminal devices or peripheral devices, and the authentication requirements of the terminal devices or peripheral devices is stored. In contrast, the switches 201-204, 301 each include an integrated implementation component 210, 220, 230, 240, 310 designed as a policy enforcement point (L2 PEP) for controlling security layer communication. In the tandem machine, this implementation component is integrated into the security gateway 251 of the tandem machine, via which the switch 205 of the tandem machine is connected to the superimposed network 200. In addition, the security gateway 251 of the tandem machine includes a functional unit for converting communication network addresses (network address translation NAT), because the communication network addresses of the automation components of the tandem machine are managed or preset completely autonomously in the tandem machine.

[0041] The implementation components 210, 220, 230, 240, 310 or the security gateway 251 are functionally connected to the decision component 311 and implement the access rights or restrictions preset by the decision component 311 according to the security policy. In particular, the implementation components 210, 220, 230, 240 implement the access rights or restrictions on the terminal devices or peripheral devices 111-114, 121-123, 131-133, 141-143, which are directly or indirectly connected to the switches 201-204, and the corresponding implementation components 210, 220, 230, 240 are integrated into the switches. The security gateway 251 of the tandem machine implements the access rights or restrictions on the terminal devices or peripheral devices 141-143 included by the tandem machine. The communication between the decision making component 311 on the one hand and the implementation component 210, 220, 230, 240 or the security gateway 251 on the other hand is preferably carried out according to the RADIUS or DIAMETER protocol.

[0042] The content of the security policy database of the decision component 311 can be preset administratively by user intervention or automatically by means of the intent-based network system 303. In a corresponding manner, the content of the security policy database of the policy decision point 313 can also be preset for communications 21-22, 31 on OSI layers 3 to 7 or with an unsecured external network 400.

Claims

1. A method for securely transmitting time-critical data within a communication system, wherein: - the communication system comprises: a plurality of local networks (101-104) in which data is transmitted by means of switching; at least one network (200) superimposed relative to the local networks in which data is transmitted by means of routing; and a gateway system (300) for connecting the communication system to at least one unsecured external network (400), - network layer communications via said overlaid network are authorized only between authenticated system components, - switches (201-205) authenticate connected terminal devices (111-114, 121-122, 131-133, 141-142) respectively and assign said terminal devices to physical or logical local networks according to the corresponding terminal device identities, - implicit authorization of security layer communication within said local network due to the assignment of the respective said terminal device to the same local network, - authorizing communication between terminal devices in different local networks and / or with terminal devices in an unsecured external network on OSI layers 3 to 7 by means of a zero trust agent (100, 130, 140) which is respectively assigned to a local network, - Authenticating the terminal device for each session via the zero trust agent assigned to the corresponding local network of the terminal device, a zero trust agent (130, 140) is provided in the network for each physical local network (103-104) and / or a zero trust agent instance (100) is provided in the gateway system for each logical local network (101-102).

2. The method according to claim 1, wherein: The local networks respectively form broadcast domains, and wherein the switches each include a datagram filter component that filters data flows between terminal devices connected to the corresponding switch and from terminal devices included in other local networks.

3. The method according to claim 2, wherein: The datagram filter components filter the data streams according to filtering rules and / or security policies preset for corresponding terminal devices.

4. The method according to any one of claims 1 to 3, wherein: The switches (201-205) create IP addresses and device names of the respectively connected terminal devices, and the switches transmit operating status information and / or access control lists of the terminal devices including the IP addresses and the device names to a monitoring device (312) included in the gateway system (300), wherein the monitoring device checks the operating information and / or access control lists for abnormalities with the help of reference information, and in the event of abnormalities, sends warnings to the corresponding switches and / or initiates control measures for the corresponding terminal devices to solve the problems.

5. The method according to claim 4, wherein: The operation information and / or the access control list include an authentication method and / or a certificate used by the corresponding terminal device and / or a location of the corresponding terminal device.

6. The method according to any one of claims 4 or 5, wherein: The control measures for the corresponding terminal devices include moving the terminal devices to an isolated network environment.

7. The method according to any one of claims 1 to 6, wherein: The gateway system comprises a decision component (311) implemented as a policy decision point, the decision component being used to control the security layer communication by using a terminal device-specific security policy, wherein the decision component comprises a security policy database, in which information about approved terminal devices, roles of corresponding terminal devices and terminal device authentication requirements is stored, wherein the switches (201-204) each comprise an integrated implementation component (210, 220, 230, 240) implemented as a policy execution point, the implementation component being used to control the security layer communication, wherein the implementation components are respectively connected to the decision components, and wherein the implementation components respectively execute access rights and / or restrictions preset by the decision components according to the security policy.

8. The method according to claim 7, wherein: The enforcement component implements access rights and / or restrictions with respect to terminal devices connected to the switch, and the corresponding enforcement component is integrated into the switch.

9. The method according to any one of claims 7 or 8, wherein: The content of the security policy database is preset in an administrative manner and / or by means of an intent-based networking system (303).

10. The method according to any one of claims 1 to 9, wherein: A security layer tunnel is constructed between the local networks through the superimposed network by means of the switch, wherein the switch forms a tunnel endpoint and wherein data frames transmitted within the security layer tunnel are respectively encapsulated into tunnel data frames.

11. The method according to claim 10, wherein: The encapsulation and / or decapsulation of tunnel data is performed by hardware.

12. The method according to any one of claims 10 or 11, wherein: The tunnel data frame is a VXLAN frame or a frame of an OSI layer 2 tunnel for a data frame.

13. The method according to any one of claims 10 to 12, wherein: The switch encrypts the security layer communication via the security layer tunnel based on IEEE802.1AE and MACSec respectively.

14. The method according to any one of claims 1 to 13, wherein: The superimposed network (200) is connected to the local networks (101-104) and the gateway system (30), wherein the logical local networks (101-102) include terminal devices (111-114, 121-122) assigned to different physical local networks.

15. A communication system for securely transmitting time-critical data, wherein: - the communication system comprises: a plurality of local networks (101-104) for data transmission by means of switching; at least one network (200) superimposed on the local networks, the superimposed network being for data transmission by means of routing; and a gateway system (300) for connecting the communication system to at least one unsecured external network (400), - the overlaid network is designed and configured to authorize network layer communications via the overlaid network only between authenticated system components, - the local networks (101-104) each comprise at least one switch (201-205), which is designed and configured to authenticate connected terminal devices (111-114, 121-122, 131-133, 141-142) and to assign the terminal devices to a physical or logical local network according to the corresponding terminal device identity, the local networks are each designed and configured for implicit authorization of security layer communications within the local networks due to the assignment of the respective terminal devices to the same local network, - the terminal devices are each designed and configured to authorize communication between terminal devices in different local networks and / or with terminal devices in an unsecured external network at OSI layers 3 to 7 by means of a zero trust agent (100, 130, 140), the zero trust agent being respectively assigned to the local network, -The zero trust agent is designed and configured to authenticate the terminal device for each session via the zero trust agent assigned to the corresponding local network of the terminal device, wherein a zero trust agent (130, 140) is provided in the network for each physical local network (103-104) and / or a zero trust agent instance (100) is provided in the gateway system for each logical local network (101-102).

Images