METHOD FOR TAMPER-PROOF DATA TRANSFER

Description

[0001] The invention relates to a method for tamper-proof data transmission. The transmission takes place to a plurality of recipients.

[0002] The security of data transmission between communication partners is becoming increasingly important in times of cybercrime. Especially in the energy sector, and especially in communication between systems that feed energy into or extract energy from a power grid, tamper-proof data transmission is crucial to ensuring the reliable operation of the power grid. One component designed to protect against tampering is the use of encryption algorithms, which ensure that only authorized participants can create data packets or decrypt their contents.

[0003] A well-known variant of manipulation, which is also applicable to uncompromised, encrypted data communication, involves intercepting data packets exchanged between communication partners and resending them at a later time, especially in large numbers. This type of manipulation is known as a replay attack. If the receiving communication partner fails to recognize that this data packet is a duplicate and takes its content, especially an instruction contained therein, seriously or executes it, an unauthorized party can exploit this to manipulate the communication partners and, for example, cause a power grid failure in the energy supply sector.

[0004] To prevent this manipulation technique, encrypted data packets are often provided with a section that records the time at which the data packet was created. By comparing the data packet with the receiver's internal clock, it can be determined that the data packet is outdated. Outdated data packets are then simply ignored. However, this requires that all communication partners have sufficiently synchronized clocks. If synchronization is lost, this data transmission method fails.

[0005] For example, US 2018 / 0089918 A1 discloses a method for protecting a request to open a car door using a remote key against replay attacks. The receiver acknowledges receipt of a valid request with a response. If the remote key does not receive a response, a request is generated to synchronize a counter included in the opening request. Further protective measures against replay attacks in networks located within an automobile are described in document EP 3 264 718 A1.

[0006] Document US 2012 / 0066764 A1 deals with a method for securing a Zigbee network against replay attacks by integrating and analyzing a counter into the communication data packets. Packets that are outdated in terms of the counter reading are discarded.

[0007] Especially when using broadcast or multicast protocols, where a data packet is sent simultaneously to a large number of recipients, ensuring synchronization represents a significant additional effort and requires a central instance as a trusted timekeeper. Furthermore, manipulation by retransmitting intercepted data packets with the aim of achieving multiple acceptance by a recipient is still possible if a receiver clock, the central instance, or the transmission path between the central instance and the recipient is tamperable. If the central instance fails or is unavailable, data communication may also collapse partially or completely.

[0008] It is therefore an object of this invention to make data communication, in which a data packet is addressed to many recipients, tamper-proof against a re-sending of data packets at a later time, without the need for synchronization via a central instance.

[0009] This object is achieved by a method having the features of independent claim 1. Preferred embodiments of the invention are described in the dependent claims.

[0010] A method according to the invention for tamper-proof data transmission between a plurality of communication partners having a synchronization means comprises sending encrypted data packets by one of the communication partners as sender using broadcast / multicast protocols to the remaining communication partners as receivers, wherein each data packet has an authentication section, an information section, and an image of the sender's synchronization means. When receiving, decrypting, and authenticating the data packet by the receivers, using the authentication section and the image of the synchronization means, a distinction is made between a first case in which authentication - regardless of the image of the synchronization means - is unsuccessful, a second case in which authentication is successful, and in which an identical data packet, at least in the sense of being identical,that both data packets have the same image of the synchronization means, which was already received at an earlier point in time, a third case in which authentication is successful and the image of the synchronization means has a predetermined synchronicity with the synchronization means of the respective recipient, and a fourth case in which authentication is successful and the image of the synchronization means does not have a predetermined synchronicity with the synchronization means of the respective recipient. The data packet is processed in the receiver depending on the differentiated case, whereby only in the third case is the information section adopted, and in the fourth case, the receiver sends a response packet, at least in encrypted form, to the sender and, using the broadcast / multicast protocols, to a plurality of the other communication partners as recipients.which contains an authentication section and a request to synchronize the synchronization means using an image of the receiver's synchronization means, wherein the plurality of communication partners follow the request after successful decryption and verification.

[0011] In the first case, the data packet is discarded by the recipient. This protects against an attack by an unauthorized sender attempting to send a self-created data packet to the recipient.

[0012] The second case safeguards against an attack by promptly resending an intercepted data packet, ensuring that a data packet is only accepted once by each recipient. Even if, due to the peculiarities of the broadcast / multicast protocol, a data packet is delivered multiple times to a recipient via different paths, this ensures that this data packet is only accepted once. To detect this case, the recipient can store identification information, such as a hash value, of the previously accepted data packets and compare this with identification information of a newly received data packet to be verified.The stored identification information can be discarded if it is ensured that upon subsequent reception of a corresponding data packet, a predetermined synchronization with the respective recipient's synchronization means would no longer be detected. For this purpose, the image of the synchronization means contained in the data packet can also be stored within the identification information, and the stored identification information can then be discarded if a predetermined synchronization of this stored image with the then-current synchronization means of the respective recipient is no longer present. In this way, only a limited number of pieces of identification information need to be retained to check the second case.

[0013] The fourth case safeguards against an attack by subsequently retransmitting an intercepted data packet in which the identification information or data records have already been deleted at the recipient's location. At the same time, the inventive response to the fourth case by sending the response packet leads to the detection of any resulting asynchrony between the communication partners' synchronization devices, and measures are taken to restore synchronization. Therefore, it is advantageous for the communication partners to update their synchronization devices to the image of the synchronization device contained therein upon receipt of the response packet.The update can be made dependent on the result of a comparison between the current status of the own synchronization means and the image of the synchronization means contained in the response packet, for example to prevent an update to an older status.

[0014] The situation in which a new, authorized communication partner is to be included in the broadcast / multicast communication, which is initially not yet synchronized, is also used to establish synchronization by means of the fourth case. The new, not yet synchronized communication partner causes the receivers to send a response packet when it first attempts to send a data packet. With the help of this response packet, the new, not yet synchronized communication partner receives an image of a sufficiently synchronous synchronization medium and can synchronize itself.

[0015] Only in the third case is the data packet accepted and the information section adopted.

[0016] The authentication section can contain an identification of the sender or simply be a section that can be used to verify proper encryption of the data packet, i.e., that the sender was in possession of an authorized key. Other authentication methods are also conceivable.

[0017] In an advantageous embodiment, the synchronization means can have a counter. In this case, the image can be a counter reading. Generally, an image is understood to be a documentation of a state of the synchronization means at a given point in time. Checking the synchronicity of synchronization means in this case involves comparing the counter readings. The counter reading can be incremented when an encrypted data packet is sent and / or at predetermined time intervals. Advantageously, the receivers also increment their synchronization means when accepting the information section of a data packet, at least in the third case, so that the sender and receiver remain synchronized during successful communication.

[0018] In one embodiment of the invention, the information section comprises a command that is executed by the respective receiver upon receipt of the information section. Alternatively or additionally, the information section comprises a configuration parameter that the respective receiver uses to change an operating configuration upon receipt of the information section. In power generation plants, the information section can, for example, contain, as a command, an absolute or relative active or reactive power to be fed in, a power reserve to be maintained, or information about an operating mode.

[0019] In the following, the invention is described in more detail with the aid of figures, of which Fig. 1 shows an unmanipulated sequence of communication paths according to the method according to the invention, and Fig. 2 shows a sequence of communication paths according to the method according to the invention in the context of a manipulation attempt by retransmitting an intercepted data packet.

[0020] In Fig. 1 a sequence of communication paths between a sender S and a plurality of receivers E via a broadcast / multicast protocol is shown. The sender S generates a data packet DP, encrypts it and sends it encrypted to the receiver E. The data packet DP has at least an authentication section, an information section and an image of the synchronization means of the sender S. Further content is conceivable. The information section can, for example, contain data, parameters, executable code or instructions that are intended for execution at the receiver E. The authentication section contains information that a receiver E can use to check the authorization of the sender S to communicate via the data packet DP. In the simplest case, the authentication section includes information that can be used to check the successful decryption of the data packet DP.However, it may also contain information that reveals the identity or an address at which the sender S can be contacted.

[0021] After receipt, the receivers E decrypt the received data packet DP and check it, distinguishing between at least four different cases C1 to C4.

[0022] In the first case C1, receiver E determined that the content of the decrypted data packet DP is invalid or decryption is not possible. Invalid content can be content that does not adhere to an agreed format or content that contains an authentication section with an unauthorized sender S. In this case, the data packet DP is discarded (trash can V).

[0023] In the second case C2, receiver E determined that it had already received an identical data packet DP. To do so, receiver E can compare the received data packet DP with all data packets it received at least within a period in which their reception times exhibit a predetermined synchronization with the current status of receiver E's synchronization medium. Instead of the entire data packet DP, receiver E can also determine only an identification stamp, for example, a hash value, and store it with the status of the synchronization medium at the time of receipt. For reasons of efficiency, the check for the existence of the second case C2 can also take place before the decryption of the data packet DP. In this way, it is possible to respond appropriately to the frequent sending of a data packet within a short period of time, for example, in the context of a DoS (Denial of Service) attack.However, multiple delivery of a data packet is also possible within the framework of a tamper-free transmission via the broadcast / multicast protocol and is not necessarily a sign of tampering.

[0024] When checking whether the third case C3 or the fourth case C4 applies, the decrypted data packet DP is first authenticated. After successful authentication, the image of the synchronization means is taken from the data packet DP and compared with the current status of the synchronization means of the receiver E. If it is determined that there is sufficient synchronism between both synchronization means, the third case C3 is recognized, otherwise the fourth case C4 is recognized. For example, in the case of a simple counter as the synchronization means, synchronism can be determined by subtracting. If the difference remains below a predetermined maximum value, sufficient synchronization is determined. Other ways of determining synchronization, in particular when using other synchronization means, are known to the person skilled in the art and are intended to be covered by the scope of protection of this intellectual property right.

[0025] Only if the third case C3 is identified, the information section is adopted and appropriately evaluated, i.e. the information contained is used as intended.

[0026] In the fourth case, the data packet DP is discarded (trash can V), as in the first and second cases. In addition, in the fourth case, the receiver E generates a response packet AP containing an authentication section and a request to synchronize the synchronization means using an image of the receiver E's synchronization means. This response packet AP is sent back encrypted by the receiver E at least to the original sender S. This response packet AP can also be sent to a large number of communication partners via the broadcast / multicast protocol, enabling all of these communication partners to update their synchronization means appropriately as needed.

[0027] The order in which the cases are tested is irrelevant, although it is recommended to perform the test for the second case early, ideally before decrypting the data packet DP, in order to save computing capacity in the event of a repeated replay attack.

[0028] The evaluation of the response packet AP at the communication partner can be performed in the same way as the evaluation of the data packet DP described above. After successful decryption and verification, the communication partners follow the contained request to synchronize the synchronization medium using an image of the synchronization medium of the receiver E, if necessary, provided that the contained image is more recent than their own synchronization medium.

[0029] By sending a response packet AP in the fourth case, it is easy to ensure that lost synchronization among the communication partners is restored, or that a newly added communication partner can be easily synchronized with the other communication partners. This does not require a central instance that, for example, specifies a universal time with which the communication partners' clocks are synchronized.

[0030] As long as it can be ensured that the encryption used has not been compromised, it is not possible for unauthorized communication partners to analyze the contents of the sent data packets, nor to change their content and send modified data packets to the communication partners without them being able to easily detect the change and discard these data packets.

[0031] A sequence of attempts to manipulate communication between communication partners is shown schematically in Fig. 2 shown. Here, a man in the middle M intercepts a data packet DP generated by the sender S and later resends a copy DP' of this intercepted data packet DP to one or more receivers E. This later sent data packet DP' is evaluated by the receivers in the same way as the original data packet DP.

[0032] In the event that the original data packet DP has already properly reached the recipient(s) E, the later sent data packet DP' is discarded in any case, either because it reaches the recipient E shortly after the original data packet DP and is therefore treated as a duplicate of an already received data packet DP according to the second case C2, or because, due to a significantly later reception time, the synchronization means contained therein no longer has sufficient synchronism with the synchronization means of the recipient E and is therefore discarded according to the fourth case C4.

[0033] In the case that the original data packet DP has not reached the receiver E at all or has not yet reached it, the intercepted data packet DP', provided it contains a sufficiently synchronous image of the synchronization means, can be safely treated according to the third case C3, since it is identical to the original, in this case unreceived, data packet DP. Otherwise, it is discarded according to the fourth case C4.

[0034] This means that under no circumstances is a data packet accepted a second time, making the communication process tamper-proof against replay attacks.

[0035] A desired side effect of the response packet AP generated in the fourth case C4 is that, in particular, a repeated manipulation attempt can be noticed in this way by both the sender S and the receiver E, because such a response packet is generated even though there may be no lost synchrony between the communication partners.

[0036] In order not to burden the communication by a repeated replay attack through frequent sending of response packets, the number of response packets AP sent per time unit by a receiver E in the fourth case C4, in particular to the same communication partner, can be limited.

Claims

1. Method for tamper-proof data transmission between a plurality of communication partners, the communication partners each having a synchronisation means, comprising the steps of: - transmitting of encrypted data packets (DP) by one of the communication partners as sender (S) by means of broadcast / multicast protocols to the remaining communication partners as receivers (E), each data packet (DP) comprising an authentication section, an information section and an image of the synchronisation means of the sender (S), - receiving, decrypting and authenticating the data packet (DP) by the receivers (E) using the authentication section and the image of the synchronisation means, the receivers (E) distinguishing between a first case in which authentication is unsuccessful, a second case in which authentication is successful, and in which an identical data packet has already been received at an earlier time, a third case in which authentication is successful and the image of the synchronisation means has a predetermined synchronicity with the synchronisation means of the respective receiver (E), and a fourth case in which authentication is successful and the image of the synchronisation means has no predetermined synchronicity with the synchronisation means of the respective recipient (E), - processing the data packet (DP) in the recipient (E) depending on the different case, wherein the information section is only accepted in the third case, and wherein in the fourth case, the receiver (E) sends a response packet (AP) to the sender (S), at least in encrypted form, by means of the broadcast / multicast protocols to a plurality of the remaining communication partners as receivers, which packet contains an authentication section and a request for synchronisation of the synchronisation means using an image of the synchronisation means of the receiver (E), wherein the plurality of communication partners comply with the request after successful decryption and verification.

2. The method according to claim 1, wherein the synchronisation means comprises a counter, and wherein a check for synchronism of synchronisation means comprises a comparison of the counter readings.

3. The method according to claim 2, wherein the counter is incremented when an encrypted data packet is sent.

4. Method according to claim 2 or 3, wherein the counter of the receiver is incremented at least in the third case.

5. Method according to any of claims 2 to 4, wherein the counters of the communication partners are additionally incremented at predetermined time intervals.

6. Method according to any of the preceding claims, wherein the information section comprises a command which is executed by the respective receiver (E) when the information section is accepted.

7. Method according to any of the preceding claims, wherein the information section comprises a configuration parameter with which the respective receiver (E) changes an operating configuration when the information section is accepted.

8. Method according to any of the preceding claims, wherein the communication partners update their synchronisation means to the image of the synchronisation means contained in the response packet (AP) upon receipt of the response packet (AP).