METHOD FOR CONTROLLING A DEVICE, METHOD FOR SENDING OPERATING DATA OF A DEVICE, COMMUNICATION DEVICE FOR USE IN SUCH METHOD, COMPUTER PROGRAM, COMPUTER-READY MEDIUM AND DATA CARRIER SIGNAL

Description

[0001] The invention relates to a method for controlling a device, a method for sending operating data of a device, a communication device for use in such methods, a computer program, a computer-readable medium and a data carrier signal.

[0002] The Internet of Things (IoT) is gaining increasing importance, particularly in industrial applications, and is also referred to as the Industrial Internet of Things (IIoT). The technical implementation of the IoT is usually achieved using IoT or IIoT platforms, which enable the information and communication technology networking of participants implemented through hardware and / or software. For example, a machine operator or other user can remotely control and / or monitor the operation of a machine, such as a lathe, CNC machine, printing press, or bottling machine, via the internet using a smartphone or laptop.Other examples of IIoT participants, i.e., facilities that can be networked via IIoT platforms, include flexible manufacturing cells, flexible manufacturing systems, flexible or rigid transfer lines, power plants, hydroelectric power plants, wind turbines, solar power plants, photovoltaic power plants, sewage treatment plants, blast furnaces, steelworks, foundries, rolling mills, oil refineries and aluminum smelters, as well as cloud-hosted applications such as databases and / or enterprise resource planning systems, or "ERP systems" for short.

[0003] The object of the invention is to provide the information and communication technology networking required for IoT and, in particular, IIoT platforms and

[0004] To make data transmission more secure and / or easier.

[0005] EP3 125 200 A2 discloses the receipt of a digital key and, in the case of successful verification of the digital key, the execution of an action in accordance with the digital key. The action could be opening a door to deliver packages. The digital key contains authorization information (e.g., LockID, ActionID) and verification information (e.g., cryptographic signature).

[0006] US 2016 / 224048 A1 discloses a secure industrial control system comprising an action originator, an action authenticator, and an industrial element / controller (e.g., power supply). The action authenticator signs / encrypts an action request, and the industrial element / controller verifies a signed action request and / or decrypts an encrypted action request.

[0007] US 2020 / 106743 A1 discloses the protection of an IoT system by inserting one or more security devices. A security device monitors and detects unauthorized control commands from unauthorized sources within the IoT system.

[0008] EP 3 958 071 A1 discloses that an edge device of an automation system (e.g., a production or manufacturing plant) transmits usage data to a cloud system. The edge device optionally signs and encrypts the usage data.

[0009] US 2018 / 183769 A1 discloses that a gateway receives a monitoring signal (i.e., a parameter) from a local controller, encrypts and signs the monitoring signal, and provides the digital signature to a server.

[0010] Against this background, the invention proposes the subject matter of the independent claims. Advantageous embodiments of the invention are described in the dependent claims.

[0011] According to a first aspect, the invention proposes a method for controlling a device, wherein a communication device is or becomes connected to the facility; in step S1, the communication device receives plaintext and a signature from a sending device; in step S2, the communication device verifies a first identifier associated with the sending device and a first encryption key using a valid first certificate and terminates the procedure if the result of this verification is negative; in step S3, the communication device verifies the received signature and the received plaintext using the first encryption key and terminates the procedure if the result of this verification is negative; in step S4, the communication device checks whether a control instruction for the facility is contained in the plaintext and terminates the procedure if the result of this check is negative;In step S5, the communication device checks whether an authorization for the control instruction is assigned to the first encryption key and / or the first identifier, and terminates the procedure if the result of this check is negative; in step S6, the communication device generates a control command for the device using the control instruction contained in the recovered plaintext; and in step S7, the communication device sends the control command to the device, thereby controlling the device.

[0012] The method proposed in accordance with this aspect, which is also referred to as the control method within the scope of the present invention, enables secure information and communication technology networking and data transmission between the sending device and the facility. Furthermore, this data transmission can be carried out without the need for a virtual private network (VPN) without compromising the security of the data transmission. A VPN is associated with significant technical effort in terms of the required hardware and software.

[0013] The facility and the sending device can be configured in any way required and each may include, for example, at least one measuring device, at least one machine, at least one computer, at least one production plant, at least one technical system and / or at least one of the aforementioned IIoT participants.

[0014] The described procedure according to any of the aspects can, for example, be carried out by a device. A device, in particular a computer, which, for example, performs or is capable of performing a procedure or one or more steps of one of the described procedures, or has means for performing them, can comprise at least one processor and at least one memory in which instructions are stored which, when executed by the at least one processor, cause the device to perform at least the specified steps. The device can, for example, comprise the setup and / or the communication device. For example, the setup and the communication device can be physically or virtually separate units of the device.

[0015] Within the scope of the present invention, the term "signature" refers to a data record, a value, a number, or a string, whereas the term "signature file" refers to a file that contains at least one signature and optionally includes a metadata area containing further data, in particular metadata. Such signatures are described, for example, in the Wikipedia article "Digital signature".

[0016] Within the scope of the present invention, the term "key" means a data record, value, number, or string, whereas the term "key file" means a file containing at least one key and optionally a metadata area containing further data, in particular metadata. This applies analogously to the terms "encryption key" and "encryption key file" as well as "decryption key" and "decryption key file." If, for example, an encryption key and a decryption key are designed according to the RSA cryptosystem, then each of these keys is a data record comprising a pair of numbers. Each key, encryption key, and decryption key, as well as each key file, encryption key file, and decryption key file, can be designed in any way required, for example, according to the standards for asymmetric cryptography, abbreviated as "PKCS."

[0017] Within the scope of the present invention, the term "certificate" means a digital certificate that is designed, for example, according to standards of the ITU-T or the IETF.

[0018] Receiving in step S1 can be done in any way required, for example, by the sending device sending a file containing the plaintext and a signature file containing the signature, or just a signature file containing the signature and the plaintext as metadata, to the communication device. This transmission is demonstrated using a VPN.

[0019] The verification in step S3 can be carried out in any way required, for example by checking, using the first encryption key, whether the received signature matches the received plaintext.

[0020] In an exemplary embodiment of the invention, it is determined that the sending device a plaintext containing a control instruction for the device, has signed or is signing using a zeroth decryption key corresponding to the zeroth encryption key, thereby generating or generating the signature, and has sent or is sending the plaintext and the signature to the communication device.

[0021] According to a second aspect, the invention proposes a method for controlling a device, wherein a communication device is or becomes connected to the facility; in step S8 the communication device receives a ciphertext and a signature from a sending device, the ciphertext being an encrypted plaintext; in step S9 the communication device verifies a first identifier associated with the sending device and a first cipher key using a valid first certificate and terminates the procedure if the result of this verification is negative; in step S10 the communication device decrypts the received ciphertext using a second decryption key associated with the communication device, thereby restoring the plaintext;In step S11, the communication device verifies the received signature and ciphertext or the received signature and recovered plaintext using the first encryption key and terminates the procedure if the result of this verification is negative; in step S12, the communication device checks whether a control instruction for the facility is contained in the plaintext and terminates the procedure if the result of this check is negative; in step S13, the communication device checks whether an authorization for the control instruction is associated with the first encryption key and / or the first identifier and terminates the procedure if the result of this check is negative; in step S14, the communication device generates a control command for the facility using the control instruction contained in the recovered plaintext;and in step S15 the communication device sends the control command to the device, thereby controlling the device.

[0022] The method proposed in accordance with this aspect, which is also referred to as the control method within the scope of the present invention, enables secure information and communication technology networking and data transmission between the sending device and the facility. Furthermore, the use of a VPN for this data transmission can be dispensed with without compromising the security of the data transmission.

[0023] Receiving in step S8 can be done in any way required, for example, by the sending device sending a file containing the ciphertext and a signature file containing the signature, or just a signature file containing the signature and the ciphertext as metadata, to the communication device. This transmission is demonstrated using a VPN.

[0024] The verification in steps S2 and S9 can be carried out in any way required, for example by checking, using the first certificate, whether the first encryption key matches the first identifier, and / or by using at least one additional valid certificate.

[0025] The verification in step S11 can be carried out in any way required, for example by checking, using the first encryption key, whether the received signature matches the received ciphertext or the recovered plaintext.

[0026] The generation in steps S6 and S14 can be done in any way required, for example using a lookup table and / or a database.

[0027] In an exemplary embodiment of the invention, it is determined that the sending device a plaintext containing a control instruction for the device, encrypted or encrypted using a second cipher key corresponding to the second decryption key, thereby producing or generating the ciphertext; signed or signed the plaintext or the ciphertext using a first decryption key corresponding to the first cipher key, thereby producing or generating the signature; and sent or sent the ciphertext and the signature to the communication device.

[0028] In an exemplary embodiment of the invention, it is determined that the first encryption key is or will be stored in the communication device; and / or the first encryption key is contained in the plaintext and / or in a signature file containing the signature and the communication device extracts the first encryption key from the plaintext and / or from the signature file; and / or the communication device has received or will receive the first encryption key, in particular by downloading it from a key server.

[0029] The first encryption key is included as an example in a metadata area of ​​the signature file, and then the communication device extracts the first encryption key from the metadata area.

[0030] In an exemplary embodiment of the invention, it is determined that the check according to step S5 or S13 is carried out by the communication device checking whether the authorization is contained in the first encryption key, in particular in a metadata area of ​​the first encryption key, and / or is assigned to the first encryption key and / or the first identifier in a configuration file.

[0031] In an exemplary embodiment of the invention, it is determined that in step S16 the communication device checks whether the configuration file has been signed using a valid second certificate and terminates the process if the result of this check is negative.

[0032] The verification in step S16 can be carried out in any way required, for example by using at least one additional valid certificate.

[0033] In an exemplary embodiment of the invention, it is determined that the sending according to step S7 or S15 includes that the communication device The control command is encrypted using a third encryption key assigned to the facility, and the encrypted control command is sent to the facility.

[0034] This increases the security of data transmission between the sending device and the facility.

[0035] In an exemplary embodiment of the invention, it is determined that the device decrypts the received encrypted control command using a third decryption key that corresponds to the third encryption key, thereby restoring the control command.

[0036] In an exemplary embodiment of the invention, it is determined that the sending according to step S7 or S15 includes that the communication device The control command is signed using the second decryption key or a fourth decryption key assigned to the communication device, thereby generating a signature, and the control command and signature are sent to the device.

[0037] This increases the security of data transmission between the sending device and the facility.

[0038] The fourth decryption key can be designed in any way required, for example, different from the second decryption key or the same as the second decryption key.

[0039] In an exemplary embodiment of the invention, it is provided that the device verifies the received control command and the received signature using the second encryption key or a fourth encryption key that corresponds to the fourth decryption key, and terminates the process if the result of this verification is negative.

[0040] This verification can be carried out in any way required, for example by using the second or fourth encryption key to check whether the received signature matches the received control command.

[0041] The fourth encryption key can be designed in any way required, for example, different from the second encryption key or the same as the second encryption key.

[0042] In an exemplary embodiment of the invention, it is determined that the sending according to step S7 or S15 includes that the communication device encrypts the control command using a third encryption key assigned to the device, signs the control command or the encrypted control command using the second decryption key or a fourth decryption key assigned to the communication device, thereby creating a signature, and sends the encrypted control command and the signature to the device.

[0043] This increases the security of data transmission between the sending device and the facility.

[0044] In an exemplary embodiment of the invention, it is determined that the device decrypts the received encrypted control command using a third decryption key corresponding to the third encryption key, thereby restoring the control command, and verifies the received encrypted control command and the received signature or the restored control command and the received signature using the second encryption key or a fourth encryption key corresponding to the fourth decryption key, and terminates the procedure if the result of this verification is negative.

[0045] This verification can be carried out in any way required, for example by checking, using the second or fourth encryption key, whether the received signature matches the received encrypted control command or the recovered control command.

[0046] In an exemplary embodiment of the invention, it is determined that In step S17 the communication device receives firmware for the communication device or reads it from a storage medium; and in step S18 the communication device checks whether the received firmware has been signed using a valid third-party certificate, and terminates the procedure if the result of this check is negative, and installs the firmware.

[0047] This enables a secure over-the-air update.

[0048] The firmware can be contained, for example, in an email, message, or file sent to the communication device. The storage medium can be of any type, as required, and may include, for example, cloud storage, a USB mass storage device, a CD, DVD, or Blu-ray disc.

[0049] The verification in step S18 can be carried out in any way required, for example by using at least one additional valid certificate.

[0050] In an exemplary embodiment of the invention, it is determined that the communication device includes at least one computer; and at least one of the steps S1 to S18 is performed using the computer and / or the first encryption key, the third encryption key, the first identifier and / or the configuration file is stored in the computer.

[0051] In an exemplary embodiment of the invention, it is determined that the communication device includes at least one security module; and at least one of the steps S1 to S18 is performed using the security module and / or the first certificate, the second certificate, the third certificate, the second decryption key and / or the fourth decryption key is stored in the security module.

[0052] In an exemplary embodiment of the invention, it is determined that The communication device comprises at least one computer and at least one security module connected to the computer; data is transferred from the computer to the security module and from the security module to the computer; and this transfer of data is protected by a transmission protection implemented by software and / or hardware, which prevents the reading and / or modification of the transferred data and / or ensures that only the computer can control this transfer of data and / or that this transfer of data can only take place with the help of a password that is stored exclusively in the computer.

[0053] In an exemplary embodiment of the invention, it is determined that the security module has write protection implemented by software and / or hardware that prevents the modification of the first certificate, the second certificate, the second decryption key and / or the fourth decryption key stored in the security module; and / or the security module has read protection implemented by software and / or hardware that prevents the reading of the second decryption key and / or the fourth decryption key stored in the security module.

[0054] In an exemplary embodiment of the invention, it is determined that, prior to step S1 or S8, an encrypted data connection is established between the sending device and the communication device in a step S19 according to an encryption protocol.

[0055] The encryption protocol can be configured in any way required, for example according to TLS, WPA3, IPsec or the Signal protocol.

[0056] In an exemplary embodiment of the invention, it is determined that the device includes a communication interface that is or will be connected to the communication device or a first communication interface of the communication device; and / or the communication device includes a first communication interface that is or will be connected to the device or a communication interface of the device, and / or a second communication interface that is or will be connected to the sending device or a communication interface of the sending device; and / or the sending device includes a communication interface that is or will be connected to the communication device or a second communication interface of the communication device.

[0057] Each communication interface can be configured in any way required, for example as a radio interface, infrared interface, USB interface, Ethernet interface, or as a wired or fiber optic interface.

[0058] In an exemplary embodiment of the invention, it is specified that the sending device has generated or generates the plaintext.

[0059] In an exemplary embodiment of the invention, it is specified that the control instruction and / or the control command relates to the sending of operating data of the device to the or a sending device or to the or a receiving device.

[0060] The operational data of the facility may, for example, relate to a subunit of the facility, such as a measuring device, a machine, a computer, a production plant, a technical system and / or one of the aforementioned IIoT participants.

[0061] In an exemplary embodiment of the invention, it is determined that the control instruction and / or control command concerns the sending of operational data of the facility to the or a sending device or to the or a receiving device; and after step S7 or S15, a procedure is executed which is designed like one of the sending procedures proposed according to the seventh or eighth aspect.

[0062] According to a third aspect, the invention proposes a communication device, in particular for use in a method designed like one of the control methods proposed according to the first aspect, or for at least partial implementation of such a method, comprising Means for carrying out such a procedure or for carrying out the steps of such a procedure; or comprising a means for carrying out step S1 which is or can be connected to the sending device; a means for carrying out step S2; a means for carrying out step S3; a means for carrying out step S4; a means for carrying out step S5; a means for carrying out step S6; and a means for carrying out step S7 which is or can be connected to the device.

[0063] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the sending device and the facility. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0064] Within the scope of the present invention, an expression of the type "an object for an activity" means in particular that the object serves the activity, is suitable for the activity, and / or is designed, adapted, conceived, or configured in such a way that it performs or is capable of performing the activity. For example, the expression "a means for carrying out step S1" means in particular that the means serves the purpose of carrying out step S1, is suitable for carrying out step S1, and / or is designed, adapted, conceived, or configured in such a way that it carries out or is capable of carrying out step S1.

[0065] According to a fourth aspect, the invention proposes a communication device, in particular for use in a method designed like one of the control methods proposed according to the second aspect, or for at least partial implementation of such a method, comprising Means for carrying out such a procedure or for carrying out the steps of such a procedure; or comprising a means for carrying out step S8 which is or can be connected to the sending device; a means for carrying out step S9; a means for carrying out step S10; a means for carrying out step S11; a means for carrying out step S12; a means for carrying out step S13; a means for carrying out step S14; and a means for carrying out step S15 which is or can be connected to the device.

[0066] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the sending device and the facility. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0067] The communication device proposed according to this aspect can be designed in any way required, for example by additionally including a means for performing step S1 which is or can be connected to the sending device; and a means for performing step S3.

[0068] In an exemplary embodiment of the invention, it is determined that the communication device comprises a means for performing step S16.

[0069] In an exemplary embodiment of the invention, it is determined that the communication device comprises a means of performing step S17; and a means of performing step S18.

[0070] According to a fifth aspect, the invention proposes a communication device, in particular for use in a method designed like one of the control methods proposed according to the first aspect, or for at least partial implementation of such a method, comprising at least one computer that is or can be connected to the sending device and the installation; and at least one security module that is connected to the computer; wherein the first encryption key and the first identifier are stored in the computer; the first certificate is stored in the security module; the computer is configured to perform step S1;The computer and the security module are trained to perform step S2, wherein this performance is carried out either by the security module transmitting the first certificate to the computer, and the computer checking whether the first certificate is valid and whether the first encryption key is assigned to the first identifier in that certificate, and terminating the procedure if the result of this check is negative, or by the computer transmitting the first encryption key and the first identifier to the security module, and the security module checking whether the first certificate is valid and whether the first encryption key is assigned to the first identifier in that certificate, and terminating the procedure if the result of this check is negative; the computer is trained to perform steps S3, S4, S5, S6, and S7.

[0071] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the sending device and the facility. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0072] Within the scope of the present invention, an expression of the type "an object is trained for an activity" means, in particular, that the object serves the activity, is suitable for the activity, and / or is trained, adapted, designed, or configured in such a way that it performs or is capable of performing the activity. For example, the expression "the computer is trained to perform step S1" means, in particular, that the computer serves the purpose of performing step S1, is suitable for performing step S1, and / or is trained, adapted, designed, or configured in such a way that it performs or is capable of performing step S1.

[0073] The communication device proposed according to this aspect may be designed in any way required, for example like one of the communication devices proposed according to the third aspect and / or in such a way that it does not include an additional computer or at least one additional security module.

[0074] According to a sixth aspect, the invention proposes a communication device, in particular for use in a method designed like one of the control methods proposed according to the second aspect, or for at least partially implementing such a method, comprising at least one computer that is or can be connected to the sending device and the installation; and at least one security module that is connected to the computer; wherein the first encryption key and the first identifier are stored in the computer; the first certificate and the second decryption key are stored in the security module; the computer is configured to perform step S8;the computer and the security module are configured to perform step S9, wherein this performance is carried out either by the security module transmitting the first certificate to the computer, and the computer checking whether the first certificate is valid and whether the first encryption key is assigned to the first identifier in that certificate, and terminating the procedure if the result of this check is negative, or by the computer transmitting the first encryption key and the first identifier to the security module, and the security module checking whether the first certificate is valid and whether the first encryption key is assigned to the first identifier in that certificate, and terminating the procedure if the result of this check is negative;The computer and the security module are configured to perform step S10, wherein this execution is carried out by the computer transmitting the ciphertext to the security module, the security module decrypting the ciphertext using the second decryption key, thereby recovering the plaintext, and the security module transmitting the recovered plaintext back to the computer; the computer is configured to perform steps S11, S12, S13, S14, and S15.

[0075] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the sending device and the facility. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0076] The communication device proposed according to this aspect may be configured in any way required, for example as one of the communication devices proposed according to the fourth aspect and / or such that it does not include an additional computer or at least one additional computer and / or does not include an additional security module or at least one additional security module, and / or such that the computer is configured to perform steps S1 and S3.

[0077] In an exemplary embodiment of the invention, it is determined that the configuration file is stored in the computer; the second certificate is stored in the security module; and the computer and the security module are configured to perform step S16, wherein this performance is carried out either by the security module transferring the second certificate to the computer, and the computer checking whether the second certificate is valid and whether the configuration file has been signed using the second certificate, and aborting the procedure if the result of this check is negative, or by the computer transferring the configuration file to the security module, and the security module checking whether the second certificate is valid and whether the configuration file has been signed using the second certificate, and aborting the procedure if the result of this check is negative.

[0078] In an exemplary embodiment of the invention, it is determined that the third encryption key is stored in the computer; and the computer is configured to perform step S7 or S15, performing this by the computer encrypting the control command using the third encryption key, and the computer sending the encrypted control command to the facility.

[0079] In an exemplary embodiment of the invention, it is determined that the second decryption key and / or the fourth decryption key is stored in the security module; and the computer and the security module are configured to perform step S7 or S15, wherein this performance is carried out by the computer transmitting the control command to the security module, the security module signing the control command using the second decryption key and / or the fourth decryption key, thereby generating a signature, the security module transmitting the signature to the computer, and the computer sending the control command and the signature to the facility.

[0080] In an exemplary embodiment of the invention, it is determined that the third encryption key is stored in the computer; the second decryption key and / or the fourth decryption key is stored in the security module; and the computer and the security module are configured to perform step S7 or S15, wherein this performance is carried out by the computer encrypting the control command using the third encryption key, the computer transmitting the control command or the encrypted control command to the security module, the security module signing the control command or the encrypted control command using the second decryption key and / or the fourth decryption key, thereby generating a signature, the security module transmitting the signature to the computer, and the computer sending the encrypted control command and the signature to the facility.

[0081] In an exemplary embodiment of the invention, it is determined that the third certificate is stored in the security module; the computer is trained to perform step S17; and the computer and the security module are trained to perform step S18, wherein this performance is carried out either by the security module transferring the third certificate to the computer, the computer checking whether the third certificate is valid and whether the firmware has been signed using the third certificate, and terminating the procedure if the result of this check is negative, and the computer installing the firmware, or by the computer transferring the firmware to the security module, the security module checking whether the third certificate is valid and whether the firmware has been signed using the third certificate, and the computer terminating the procedure if the result of this check is negative, and the computer installing the firmware.

[0082] This enables a secure over-the-air update.

[0083] In an exemplary embodiment of the invention, it is determined that the transfer of data from the computer to the security module and from the security module to the computer is protected by a transmission protection implemented by software and / or hardware, which prevents the reading and / or modification of the transferred data and / or ensures that only the computer can control this transfer of data and / or that this transfer of data can only take place with the help of a password that is stored exclusively in the computer.

[0084] In an exemplary embodiment of the invention, it is determined that the security module has write protection implemented by software and / or hardware that prevents the modification of the first certificate, the second certificate, the second decryption key and / or the fourth decryption key stored in the security module; and / or the security module has read protection implemented by software and / or hardware that prevents the reading of the second decryption key and / or the fourth decryption key stored in the security module.

[0085] In an exemplary embodiment of the invention, it is specified that the computer is configured to perform step S19.

[0086] In an exemplary embodiment of the invention, it is determined that the communication device comprises a first communication interface that can be connected to the device or a communication interface of the device; and / or a second communication interface that can be connected to the sending device or a communication interface of the sending device.

[0087] According to a seventh aspect, the invention proposes a method for sending operating data from a device to a receiver device, wherein a communication device is or becomes connected to the facility; in step B1 the communication device receives the operational data from the facility; in step B2 the communication device verifies a second identifier assigned to the receiving device and a fifth encryption key using a valid fourth certificate and terminates the procedure if the result of this verification is negative; in step B3 the communication device checks whether authorization to receive the operational data is assigned to the fifth encryption key and / or the second identifier and terminates the procedure if the result of this check is negative;and in step B4, the communication device signs the operational data using a sixth decryption key assigned to the communication device, thereby generating a signature, and sends the operational data and the signature to the receiving device.

[0088] The method proposed in accordance with this aspect, which is also referred to as the transmission method within the scope of the present invention, enables secure information and communication technology networking and data transmission between the device and the receiver. Furthermore, the use of a VPN for this data transmission can be dispensed with without compromising the security of the data transmission.

[0089] The receiving device can be designed in any way as required and may, for example, include at least one measuring device, at least one machine, at least one computer, at least one production plant, at least one technical system and / or at least one of the aforementioned IIoT participants and / or form the sending device.

[0090] The transmission in step B4 can be carried out in any way required, for example, by the communication device sending a file containing the operational data and a signature file containing the signature, or just a signature file containing the signature and the operational data as metadata, to the receiving device. This transmission is demonstrated, for example, via a VPN.

[0091] According to an eighth aspect, the invention proposes a method for sending operating data from a device to a receiver device, wherein a communication device is or becomes connected to the facility; in step B5 the communication device receives the operational data from the facility; in step B6 the communication device verifies a second identifier assigned to the receiving device and a fifth encryption key using a valid fourth certificate and terminates the procedure if the result of this verification is negative; in step B7 the communication device checks whether authorization to receive the operational data is assigned to the fifth encryption key and / or the second identifier and terminates the procedure if the result of this check is negative; and in step B8 the communication device encrypts the operational data using the fifth encryption key;the operational data or the encrypted operational data is signed using a sixth decryption key assigned to the communication device, thereby generating a signature; and the encrypted operational data and the signature are sent to the receiving device.

[0092] The method proposed in accordance with this aspect, which is also referred to as the transmission method within the scope of the present invention, enables secure information and communication technology networking and data transmission between the device and the receiver. Furthermore, the use of a VPN for this data transmission can be dispensed with without compromising the security of the data transmission.

[0093] The transmission in step B8 can be carried out in any way required, for example, by the communication device sending a file containing the encrypted operational data and a signature file containing the signature, or simply a signature file containing the signature and the encrypted operational data as metadata, to the receiving device. This transmission is demonstrated using a VPN.

[0094] The verification in steps B2 and B6 can be carried out in any way required, for example by using the fourth certificate to check whether the fifth encryption key matches the second identifier, and / or by using at least one additional valid certificate.

[0095] The sixth decryption key can be designed in any way required, for example, different from the second and / or fourth decryption key or the same as the second and / or fourth decryption key.

[0096] In an exemplary embodiment of the invention, it is determined that the device the operational data is encrypted using a sixth encryption key that corresponds to the sixth decryption key, or a seventh encryption key that is assigned to the communication device, and the encrypted operational data is sent to the communication device.

[0097] The seventh encryption key can be designed in any way required, for example, different from the second and / or the fourth and / or the sixth encryption key, or the same as the second and / or the fourth and / or the sixth encryption key.

[0098] In an exemplary embodiment of the invention, it is determined that in step B9 the communication device decrypts the received encrypted operating data using the sixth decryption key or a seventh decryption key that corresponds to the seventh encryption key, thereby restoring the operating data.

[0099] The seventh decryption key can be designed in any way required, for example, different from the second and / or the fourth and / or the sixth decryption key or the same as the second and / or the fourth and / or the sixth decryption key.

[0100] In an exemplary embodiment of the invention, it is determined that the device The operational data is signed using an eighth decryption key assigned to the facility, thereby generating a signature, and the operational data and the signature are sent to the communication device.

[0101] In an exemplary embodiment of the invention, it is determined that in step B10 the communication device verifies the received operating data and the received signature using an eighth encryption key that corresponds to the eighth decryption key and terminates the process if the result of this verification is negative.

[0102] The verification in step B10 can be carried out in any way required, for example by using the eighth encryption key to check whether the received signature matches the received operational data.

[0103] In an exemplary embodiment of the invention, it is determined that the device the operational data is encrypted using a sixth encryption key that corresponds to the sixth decryption key, or a seventh encryption key that is assigned to the communication device, the operational data or the encrypted operational data is signed using an eighth decryption key that is assigned to the device, thereby generating a signature, and the encrypted operational data and the signature are sent to the communication device.

[0104] In an exemplary embodiment of the invention, it is determined that in step B11 the communication device decrypts the received encrypted operational data using the sixth decryption key or a seventh decryption key corresponding to the seventh encryption key, thereby restoring the operational data, and verifies the received encrypted operational data and the received signature or the restored operational data and the received signature using an eighth encryption key corresponding to the eighth decryption key, and terminates the procedure if the result of this verification is negative.

[0105] The verification in step B11 can be carried out in any way required, for example by checking, using the first encryption key, whether the received signature matches the received encrypted operational data or the recovered operational data.

[0106] In an exemplary embodiment of the invention, it is determined that, prior to sending according to step B4 or B8, an encrypted data connection is established between the communication device and the receiver device in a step B12 according to an encryption protocol.

[0107] In an exemplary embodiment of the invention, it is determined that prior to step B1 or B5, a procedure designed like one of the control procedures proposed according to the first or second aspect is executed; and the control instruction and / or control command concerns the sending of operational data of the facility to the receiving device or to the sending device.

[0108] In an exemplary embodiment of the invention, it is determined that at least one of the encryption keys is a public key of a key pair of an asymmetric cryptosystem and the respective decryption key is a private key of this key pair; or at least one of the encryption keys and the respective decryption key are the same.

[0109] According to a ninth aspect, the invention proposes a communication device, in particular for use in a method designed like one of the transmission methods proposed according to the seventh aspect, or for at least partially implementing such a method, comprising Means for carrying out such a procedure or for carrying out the steps of such a procedure; or comprising a means for carrying out step B1 which is or can be connected to the apparatus; a means for carrying out step B2; a means for carrying out step B3; and a means for carrying out step B4 which can be connected to the receiving apparatus.

[0110] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the facility and the receiving device. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0111] According to a tenth aspect, the invention proposes a communication device, in particular for use in a method designed like one of the transmission methods proposed according to the eighth aspect, or for at least partially implementing such a method, comprising Means for carrying out such a procedure or for carrying out the steps of such a procedure; or comprising a means for carrying out step B5 which is or can be connected to the apparatus; a means for carrying out step B6; a means for carrying out step B7; and a means for carrying out step B8 which is or can be connected to the receiving apparatus.

[0112] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the facility and the receiving device. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0113] The communication device proposed according to this aspect may be designed in any way required, for example by additionally including a means for carrying out step B4 which is or can be connected to the receiver device.

[0114] According to an eleventh aspect, the invention proposes a communication device, in particular for use in a method designed like one of the transmission methods proposed according to the seventh aspect, or for at least partially implementing such a method, comprising at least one computer that is or can be connected to the device and the receiver; and at least one security module that is connected to the computer; wherein the fifth encryption key and the second identifier are stored in the computer; the fourth certificate is stored in the security module; the second, fourth, sixth and / or seventh decryption keys are stored in the security module; the computer is configured to perform step B1;the computer and the security module are trained to perform step B2, wherein this performance is carried out either by the security module transmitting the fourth certificate to the computer, and the computer checking whether the fourth certificate is valid and whether the fifth encryption key is assigned to the second identifier in that certificate, and terminating the procedure if the result of this check is negative, or by the computer transmitting the fifth encryption key and the second identifier to the security module, and the security module checking whether the fourth certificate is valid and whether the fifth encryption key is assigned to the second identifier in that certificate, and terminating the procedure if the result of this check is negative; the computer is trained to perform step B3;and the computer and the security module are configured to perform step B4, wherein this performance is carried out by the computer transmitting the operational data to the security module, the security module signing the operational data using the second, fourth, sixth and / or seventh decryption key, thereby generating a signature, the security module transmitting the signature to the computer, and the computer sending the operational data and the signature to the receiving device.

[0115] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the facility and the receiving device. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0116] According to a twelfth aspect, the invention proposes a communication device, in particular for use in a method designed like one of the transmission methods proposed according to the second aspect, or for at least partially implementing such a method, comprising at least one computer that is or can be connected to the device and the receiver; and at least one security module that is connected to the computer; wherein the fifth encryption key and the second identifier are stored in the computer; the fourth certificate is stored in the security module; the second, fourth, sixth and / or seventh decryption keys are stored in the security module; the computer is configured to perform step B5;the computer and the security module are trained to perform step B6, wherein this performance is carried out either by the security module transmitting the fourth certificate to the computer, and the computer checking whether the fourth certificate is valid and whether the fifth encryption key is assigned to the second identifier in that certificate, and terminating the procedure if the result of this check is negative, or by the computer transmitting the fifth encryption key and the second identifier to the security module, and the security module checking whether the fourth certificate is valid and whether the fifth encryption key is assigned to the second identifier in that certificate, and terminating the procedure if the result of this check is negative; the computer is trained to perform step B7;and the computer and the security module are configured to perform step B8, wherein this performance is carried out by the computer encrypting the operational data using the fifth encryption key, the computer transmitting the operational data or the encrypted operational data to the security module, the security module signing the operational data or the encrypted operational data using the second, fourth, sixth and / or seventh decryption key, thereby generating a signature, the security module transmitting the signature to the computer, and the computer sending the encrypted operational data and the signature to the receiving device.

[0117] The communication device proposed in accordance with this aspect enables secure information and communication technology networking and data transmission between the facility and the receiving device. Furthermore, the use of a VPN for this data transmission can be avoided without compromising the security of the data transmission.

[0118] According to a thirteenth aspect, the invention proposes a computer program comprising instructions which, when executed by a computer or a

[0119] Communication devices configured like any of the communication devices proposed in accordance with the third, fourth, fifth, sixth, ninth, tenth, eleventh or twelfth aspect cause this computer or communication device to execute a procedure configured like any of the control procedures proposed in accordance with the first aspect, a procedure configured like any of the control procedures proposed in accordance with the second aspect, a procedure configured like any of the transmission procedures proposed in accordance with the seventh aspect, and / or a procedure configured like any of the transmission procedures proposed in accordance with the eighth aspect.

[0120] According to a fourteenth aspect, the invention proposes a computer-readable medium, on which a computer program configured like one of the computer programs proposed in accordance with the thirteenth aspect is stored; and / or comprising instructions which, when executed by a computer or a communication device configured like one of the communication devices proposed in accordance with the third, fourth, fifth, sixth, ninth, tenth, eleventh or twelfth aspect, cause that computer or communication device to execute a procedure configured like one of the control procedures proposed in accordance with the first aspect, a procedure configured like one of the control procedures proposed in accordance with the second aspect, a procedure configured like one of the transmission procedures proposed in accordance with the seventh aspect, and / or a procedure configured like one of the transmission procedures proposed in accordance with the eighth aspect.

[0121] The computer-readable medium can, as required, be designed, for example, to include at least one computer-readable storage medium and / or at least one computer-readable data carrier.

[0122] According to a fifteenth aspect, the invention proposes a data carrier signal that transmits the computer program, which is designed like one of the computer programs proposed according to the thirteenth aspect.

[0123] According to a sixteenth aspect, the invention proposes a method for setting up a communication device, wherein In step E1, the owner of the device generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, the public key being the third encryption key and the private key being the third decryption key; in step E2, the owner issues the first certificate for the first encryption key and sends it to the communication device; in step E3, the first certificate is stored in a first memory area of ​​the communication device, in particular the security module; in step E4, write protection is activated for the first memory area;In step E5, the communication device, in particular the security module, generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, wherein the public key forms the second encryption key and the private key forms the second decryption key; in step E6, the second decryption key is stored in a second memory area of ​​the communication device, in particular the security module; in step E7, write protection and read protection are activated for the second memory area; in step E8, the communication device, in particular the security module, generates a certificate signing request for the second encryption key using the second decryption key; in step E9, the communication device, in particular the computer, sends the certificate signing request to the holder;In step E10, the holder signs the certificate signing request using the third decryption key, thereby issuing a fifth certificate for the second encryption key, and sends the fifth certificate to the communication device;In step E11, either the fifth certificate is stored in a third memory area of ​​the communication device, in particular the security module, and the communication device, in particular the security module, verifies the fifth certificate using the first certificate and terminates the procedure if the result of this verification is negative, or the communication device, in particular the computer, verifies the fifth certificate using the first certificate and terminates the procedure if the result of this verification is negative, and the fifth certificate is stored in a third memory area of ​​the communication device, in particular the security module; in step E12, write protection is activated for the third memory area.

[0124] The method proposed in accordance with this aspect, which is also referred to as the setup method within the scope of the present invention, enables the owner to set up the communication device simply, safely and reliably, without the need for any other party to be involved.

[0125] The communication device can be designed in any way required, for example, like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect.

[0126] The verification in step E11 can be carried out in any way required, for example by using at least one additional valid certificate.

[0127] According to a seventeenth aspect, the invention proposes a method for setting up a communication device, wherein In step E13, the owner of the device generates a key pair consisting of a public key and a private key by applying an asymmetric cryptosystem, where the public key forms the third encryption key and the private key forms the third decryption key; in step E14, the owner issues the first certificate for the first encryption key and sends it to the communication device; in step E15, a manufacturer of the device generates a key pair consisting of a public key and a private key by applying an asymmetric cryptosystem.wherein the public key forms a ninth encryption key and the private key a ninth decryption key; in step E16 the manufacturer issues a sixth certificate for the first encryption key and sends it to the communication device; in step E17 the first certificate and the sixth certificate are stored in a first memory area of ​​the communication device, in particular the security module; in step E18 write protection is activated for the first memory area; in step E19 the communication device, in particular the security module, generates a key pair with a public key and a private key by applying an asymmetric cryptosystem,wherein the public key forms the second encryption key and the private key forms the second decryption key; in step E20 the second decryption key is stored in a second memory area of ​​the communication device, in particular the security module; in step E21 write protection and read protection are activated for the second memory area; in step E22 the communication device, in particular the security module, generates a certificate signing request for the second encryption key using the second decryption key; in step E23 the communication device, in particular the computer, sends the certificate signing request to the holder; in step E24 the holder signs the certificate signing request using the third decryption key, thereby issuing a fifth certificate for the second encryption key,and sends the fifth certificate to the communication device; in step E25, the communication device, in particular the computer, sends the certificate signing request to the manufacturer; in step E26, the manufacturer signs the certificate signing request using the ninth decryption key, thereby issuing a seventh certificate for the second encryption key, and sends the seventh certificate to the communication device; in step E27, either the fifth certificate and the seventh certificate are stored in a third memory area of ​​the communication device, in particular the security module, and the communication device, in particular the security module, verifies the fifth certificate using the first certificate and terminates the procedure if the result of this verification is negative.and the seventh certificate is verified using the sixth certificate and the procedure is terminated if the result of this verification is negative, or the communication device, in particular the computer, verifies the fifth certificate using the first certificate and terminates the procedure if the result of this verification is negative, verifies the seventh certificate using the sixth certificate and terminates the procedure if the result of this verification is negative, and the fifth and seventh certificates are stored in a third memory area of ​​the communication device, in particular the security module; in step E28, write protection is activated for the third memory area.

[0128] The method proposed in accordance with this aspect, which is also referred to as the setup method within the scope of the present invention, enables a simple, safe and reliable setup of the communication device by the owner and the manufacturer without the need for any other party to be involved.

[0129] The communication device can be designed in any way required, for example, like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect.

[0130] Each verification in step E27 can be performed in any way required, for example by using at least one additional valid certificate.

[0131] In an exemplary embodiment of the invention, it is determined that In step E29, the holder checks whether the first certificate stored in the first memory area is unchanged and terminates the procedure if the result of this check is negative; and / or in step E30, the manufacturer checks whether the sixth certificate stored in the first memory area is unchanged and terminates the procedure if the result of this check is negative; and / or in step E31, the holder verifies the certificate signing request and the fifth certificate stored in the third memory area using the third encryption key and terminates the procedure if the result of this verification is negative;and / or in step E32, the manufacturer verifies the certificate signing request and the seventh certificate stored in the third memory area using the ninth encryption key and terminates the procedure if the result of this verification is negative; and / or in step E33, the holder checks whether the second decryption key stored in the second memory area was generated by the security module and terminates the procedure if the result of this check is negative; and / or in step E34, the manufacturer checks whether the second decryption key stored in the second memory area was generated by the security module and terminates the procedure if the result of this check is negative.

[0132] The verification in step E31 can be carried out in any way as required, for example by checking, using the third encryption key, whether the fifth certificate matches the certificate signing request and has been signed with the third decryption key.

[0133] The verification in step E32 can be carried out in any way as required, for example by checking, using the ninth encryption key, whether the seventh certificate matches the certificate signing request and has been signed with the ninth decryption key.

[0134] According to an eighteenth aspect, the invention proposes a method for setting up a communication device, wherein In step F1, the owner of the device generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, where the public key forms the third encryption key and the private key the third decryption key; in step F2, the owner issues the fourth certificate for the fifth encryption key and sends it to the communication device; in step F3, the fourth certificate is stored in a fourth memory area of ​​the communication device or security module; in step F4, write protection is activated for the fourth memory area;In step F5, the communication device or security module generates a key pair consisting of a public key and a private key by applying an asymmetric cryptosystem, where the public key forms the second encryption key and the private key forms the second decryption key; in step F6, the second decryption key is stored in a second memory area of ​​the communication device or security module; in step F7, write protection and read protection are activated for the second memory area; in step F8, the communication device or security module generates a certificate signing request for the second encryption key using the second decryption key; in step F9, the communication device or computer sends the certificate signing request to the holder;In step F10, the certificate holder signs the certificate signing request using the third decryption key, thereby issuing a fifth certificate for the second encryption key, and sends the fifth certificate to the communication device; in step F11, either the fifth certificate is stored in a third memory area of ​​the communication device or security module, and the communication device or security module verifies the fifth certificate using the fourth certificate and terminates the procedure if the result of this verification is negative, or the communication device or computer verifies the fifth certificate using the fourth certificate and terminates the procedure if the result of this verification is negative, and the fifth certificate is stored in a third memory area of ​​the communication device or security module;In one step, pressing F12 activates write protection for the third memory area.

[0135] The method proposed in accordance with this aspect, which is also referred to as the setup method within the scope of the present invention, enables the owner to set up the communication device simply, safely and reliably, without the need for any other party to be involved.

[0136] The communication device can be designed in any way required, for example, like one of the communication devices proposed according to the ninth, tenth, eleventh or twelfth aspect.

[0137] The verification in step F11 can be done in any way required, for example by using at least one additional valid certificate.

[0138] According to a nineteenth aspect, the invention proposes a method for setting up a communication device, wherein In step F13, the owner of the device generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, where the public key forms the third encryption key and the private key forms the third decryption key; in step F14, the owner issues the fourth certificate for the fifth encryption key and sends it to the communication device; in step F15, a manufacturer of the device generates a key pair with a public key and a private key by applying an asymmetric cryptosystem.where the public key forms a ninth encryption key and the private key forms a ninth decryption key; in step F16, the manufacturer issues an eighth certificate for the fifth encryption key and sends it to the communication device; in step F17, the fourth and eighth certificates are stored in a fourth memory area of ​​the communication device or security module; in step F18, write protection is activated for the fourth memory area; in step F19, the communication device or security module generates a key pair with a public key and a private key by applying an asymmetric cryptosystem,wherein the public key forms the second encryption key and the private key forms the second decryption key; in step F20, the second decryption key is stored in a second memory area of ​​the communication device or security module; in step F21, write protection and read protection are enabled for the second memory area; in step F22, the communication device or security module generates a certificate signing request for the second encryption key using the second decryption key; in step F23, the communication device or computer sends the certificate signing request to the holder; in step F24, the holder signs the certificate signing request using the third decryption key, thereby issuing a fifth certificate for the second encryption key,and sends the fifth certificate to the communication device; in step F25, the communication device or computer sends the certificate signing request to the manufacturer; in step F26, the manufacturer signs the certificate signing request using the ninth decryption key, thereby issuing a seventh certificate for the second encryption key, and sends the seventh certificate to the communication device; in step F27, either the fifth certificate and the seventh certificate are stored in a third memory area of ​​the communication device or security module, and the communication device or security module verifies the fifth certificate using the fourth certificate and terminates the procedure if the result of this verification is negative, and verifies the seventh certificate using the eighth certificate and terminates the procedure.if the result of this verification is negative, or the communication device or computer verifies the fifth certificate using the fourth certificate and terminates the procedure if the result of this verification is negative, verifies the seventh certificate using the eighth certificate and terminates the procedure if the result of this verification is negative, and the fifth and seventh certificates are stored in a third memory area of ​​the communication device or security module; in step F28, write protection is enabled for the third memory area.

[0139] The method proposed in accordance with this aspect, which is also referred to as the setup method within the scope of the present invention, enables a simple, safe and reliable setup of the communication device by the owner and the manufacturer without the need for any other party to be involved.

[0140] The communication device can be designed in any way required, for example, like one of the communication devices proposed according to the ninth, tenth, eleventh or twelfth aspect.

[0141] Each verification in step F27 can be performed in any way required, for example by using at least one additional valid certificate.

[0142] In an exemplary embodiment of the invention, it is determined that In step F29, the holder checks whether the fourth certificate, stored in the fourth memory area, is unchanged and terminates the procedure if the result of this check is negative; and / or in step F30, the manufacturer checks whether the eighth certificate, stored in the fourth memory area, is unchanged and terminates the procedure if the result of this check is negative; and / or in step F31, the holder verifies the certificate signing request and the fifth certificate, stored in the third memory area, using the third encryption key and terminates the procedure if the result of this verification is negative;and / or in step F32, the manufacturer verifies the certificate signing request and the seventh certificate stored in the third memory area using the ninth encryption key and terminates the procedure if the result of this verification is negative; and / or in step F33, the holder checks whether the second decryption key stored in the second memory area was generated by the security module and terminates the procedure if the result of this check is negative; and / or in step F34, the manufacturer checks whether the second decryption key stored in the second memory area was generated by the security module and terminates the procedure if the result of this check is negative.

[0143] The verification in step F31 can be carried out in any way as required, for example by checking, using the third encryption key, whether the fifth certificate matches the certificate signing request and has been signed with the third decryption key.

[0144] The verification in step E32 can be carried out in any way as required, for example by checking, using the ninth encryption key, whether the seventh certificate matches the certificate signing request and has been signed with the ninth decryption key.

[0145] According to a twentieth aspect, the invention proposes a system comprising at least one sending device; at least one device; and at least one communication device configured like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect, and connected to the at least one sending device and the at least one device.

[0146] The system may, as required, for example, include no additional or at least one additional sending device, no additional or at least one additional facility and / or no additional or at least one additional communication device configured like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect and connected to at least one of the sending devices and at least one of the facilities.

[0147] According to a twenty-first aspect, the invention proposes a system comprising at least one receiving device; at least one device; and at least one communication device configured like one of the communication devices proposed according to the ninth, tenth, eleventh or twelfth aspect, and connected to the at least one receiving device and the at least one device.

[0148] In one exemplary embodiment of this aspect, it is determined that the system comprises at least one sending device; at least one of the communication devices is designed like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect and is connected to the at least one sending device.

[0149] The system may, for example, not include an additional or at least one additional receiver device, an additional or at least one additional device, an additional or at least one additional transmitter device and / or an additional or at least one additional communication device configured like one of the communication devices proposed according to the ninth, tenth, eleventh or twelfth aspect and connected to at least one of the receiver devices and at least one of the devices, and optionally configured like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect and / or connected to at least one of the transmitter devices.

[0150] In an exemplary embodiment of the invention, it is determined that the system comprises at least one sending device; at least one communication device designed like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect and connected to at least one sending device.

[0151] For example, the system may not include an additional or at least one additional sending device and / or an additional or at least one additional communication device designed like one of the communication devices proposed according to the third, fourth, fifth or sixth aspect and connected to at least one of the sending devices.

[0152] Each device, each sending device, and each receiving device can be configured in any way required and may each include, for example, at least one measuring device, at least one machine, at least one computer, at least one production plant, at least one technical system, and / or at least one of the aforementioned IIoT participants. Each sending device can, for example, be one of the receiving devices, and each receiving device can, for example, be one of the sending devices.

[0153] Each identifier can be configured in any way required and may include, for example, an email address, serial number and / or employee number.

[0154] Each certificate can be structured in any way required, for example as a root certificate or intermediate certificate and / or as a public key certificate or attribute certificate. A certificate is valid, in particular, if it has neither been revoked nor expired.

[0155] Each computer can be configured in any way required, for example, as a single-board computer and / or such that it and at least one of the security modules are integrated into a system-on-a-chip (SoC), permanently connected, soldered onto a common circuit board, sealed together, and / or potted together. Each security module can be configured in any way required, for example, according to the FIPS 140-2 standard, according to Arm Ltd.'s TrustZone technology, like a YubiKey, and / or such that it includes at least one YubiKey.

[0156] Each transmission protection, each write protection and each read protection can be implemented in any way required, for example according to the FIPS 140-2 standard, according to Arm Ltd.'s TrustZone technology, according to Yubico Ltd.'s Secure Channel specification and / or as implemented in a YubiKey, and / or by including bus encryption, a challenge-response procedure and / or an asymmetric cryptosystem, and / or by inextricably connecting the respective computer and the respective security module, soldering them onto a common circuit board, sealing them individually or together and / or potting them together.

[0157] Each sealing process can be carried out, for example, by connecting the computer and the security module to a common circuit board or other component via their own separate seals, or by connecting them to each other via a common seal. Each seal can be designed as needed, for example, as an adhesive label, thread-locking lacquer, or sealing lacquer. Each potting process can be carried out, for example, using a casting resin that connects and / or encloses the computer and the security module as completely as possible.

[0158] Any asymmetric cryptosystem can be designed in any way required, for example according to the RSA cryptosystem, the Elgamal cryptosystem, or the ECC cryptosystem.

[0159] Each proposed method can be combined with at least one of the other proposed methods and / or can be designed in any way required, for example as a computer-implemented method.

[0160] Each proposed communication device may be combined with at least one of the other proposed communication devices and / or may be configured as required in any way, for example, by being a computer or comprising at least one computer and / or by being configured to at least partially execute at least one of the proposed methods.

[0161] Each proposed system can be combined with at least one of the other proposed systems.

[0162] The explanations relating to one aspect of the invention, in particular to individual features of that aspect, also apply analogously to the other aspects of the invention.

[0163] In the following, embodiments of the invention are explained in more detail by way of example with reference to the accompanying drawings. The individual features resulting therefrom are not limited to the individual embodiments, but can be combined with individual features described above and / or with individual features of other embodiments. The details in the drawings are to be interpreted as illustrative only, not as limiting. The reference numerals contained in the claims are not intended to limit the scope of protection of the invention in any way, but merely refer to the embodiments shown in the drawings.

[0164] The drawings show in FIG. 1 a block diagram of a first embodiment of a system, wherein the system comprises a sending device, a device and a first embodiment of a communication device for use in a control method for controlling the device; FIG. 2 a first embodiment of a control method for controlling a device, in particular the device made of FIG. 1 FIG. 3 a second embodiment of the control method for controlling a device, in particular the device made of FIG. 1FIG. 4 a block diagram of a second embodiment of a system, wherein the system comprises a receiver device, a device and a second embodiment of a communication device for use in a transmission method for sending operating data of the device to the receiver device; FIG. 5 a first embodiment of a transmission method for sending operating data of a device to a receiver device, in particular the device made of FIG. 4 to the receiver device; FIG. 6 a second embodiment of the transmission method for sending operating data from a device to a receiver device, in particular the device made of FIG. 4 to the receiver device; FIG. 7 a first embodiment of a setup method for setting up a communication device, in particular the communication device made of FIG. 1FIG. 8 a second embodiment of the setup method for setting up a communication device, in particular the communication device made of FIG. 1 FIG. 9 a third embodiment of a setup method for setting up a communication device, in particular the communication device made of FIG. 4 ; and FIG. 10 a fourth embodiment of the setup method for setting up a communication device, in particular the communication device made of FIG. 4 .

[0165] In FIG. 1 A first embodiment of a system 100 is schematically shown, comprising a technical device 10, a communication device 12 designed according to a first embodiment, and a sending device 14.

[0166] The setup 10 includes, for example, a CNC machine 26 and a communication interface 20, which is connected to the CNC machine 26 and forms, for example, a USB interface.

[0167] The sending device 14 is exemplified as a laptop and includes a communication interface 24, which is exemplified as a radio interface.

[0168] The communication device 12 comprises a computer 16, a security module 18 (example being a hardware security module), a first communication interface 22' (example being a USB interface corresponding to communication interface 20), and a second communication interface 22" (example being a radio interface corresponding to communication interface 24). The computer 16 is connected to the security module 18 and the communication interfaces 22' and 22". The first communication interface 22' is connected to communication interface 20. The second communication interface 22" is connected to communication interface 24.

[0169] In FIG. 2 A first embodiment of a control method for controlling a device is schematically shown, wherein this embodiment exemplifies the device 10 from FIG. 1The device 10, the communication device 12, and the transmitter device 14 are designed to perform this control procedure.

[0170] In step S0, the communication device 12 is connected to the device 10 using the communication interfaces 22', 20 and to the sending device 14 using the communication interface 22", 24.

[0171] In step S1, which follows step S0, the communication device 12 receives a plaintext and a signature from the sending device 14 with the help of the computer 16.

[0172] In step S2, which follows step S1, the communication device 12, with the aid of computer 16 and security module 18, verifies the first identifier ID1, which is assigned to the sending device 14 and stored in computer 16, using the valid first certificate Z1, which is stored in security module 18. Computer 16 terminates the procedure if the result of this verification is negative.

[0173] In step S3, which follows step S2, the communication device 12, with the aid of computer 16, verifies the received signature and the received plaintext using the first encryption key CS1, which is stored in computer 16. Computer 16 terminates the procedure if the result of this verification is negative.

[0174] In step S4, which follows step S3, the communication device 12 uses computer 16 to check whether a control instruction for the device 10 is contained in the plaintext. Computer 16 terminates the procedure if the result of this check is negative.

[0175] In step S5, which follows step S4, the communication device 12, with the aid of computer 16, checks whether authorization for the control instruction is assigned to the first encryption key CS1 and the first identifier ID1. Computer 16 terminates the procedure if the result of this check is negative.

[0176] In step S6, which follows step S5, the communication device, with the aid of computer 16, generates a control command for the device 10 using the control instruction contained in the recovered plaintext.

[0177] In step S7, which follows step S6, the communication device 12 sends the control command to the device 10 with the help of the computer 16, thereby controlling the device 10.

[0178] In FIG. 3 A second embodiment of the control method for controlling a device is schematically depicted, which is similar to the first embodiment, so that the differences will be explained in more detail below. The device 10, the communication device 12, and the sending device 14 are designed such that they can execute this control method.

[0179] In step S8, which follows step S0, the communication device 12 receives a ciphertext and a signature from the sending device 14 with the help of the computer 16 instead of a plaintext, where the ciphertext represents an encrypted plaintext.

[0180] In step S9, which follows step S8, the communication device 12, with the aid of computer 16 and security module 18, verifies the second identifier ID2, which is assigned to the sending device 14 and stored in computer 16 and is equivalent to the first identifier ID1, and the ninth encryption key CS9, which is stored in computer 16, using the valid eighth certificate Z8, which is stored in security module 18 and is equivalent to the first certificate Z1. Computer 16 terminates the procedure if the result of this verification is negative.

[0181] In step S10, which follows step S9, the communication device 12, with the help of the computer 16 and the security module 18, decrypts the received ciphertext using the second decryption key DC2, which is assigned to the communication device 12 and stored in the security module 18, thereby restoring the plaintext.

[0182] In step S11, which follows step S10, the communication device 12, with the aid of computer 16, verifies the received signature and, instead of the received plaintext, the received ciphertext using the first encryption key CS1, which is stored in computer 16. Computer 16 terminates the procedure if the result of this verification is negative.

[0183] A step S12 following step S11 corresponds to step S4. A step S13 following step S12 corresponds to step S5. A step S14 following step S13 corresponds to step S6. A step S15 following step S14 corresponds to step S7.

[0184] In FIG. 4 A second embodiment of system 100 is shown schematically. This embodiment is similar to the first embodiment, so the differences will be explained in more detail below. In this embodiment, system 100 comprises a receiver device 14' instead of the transmitter device 14, and the communication device 12 is designed according to a second embodiment that is similar to the first embodiment, so the differences will be explained in more detail below.

[0185] The receiver device 14' is exemplified as a laptop and includes a communication interface 24', which is exemplified as a radio interface.

[0186] The second communication interface 22" serves as an example of a radio interface corresponding to the communication interface 24'. The second communication interface 22" is connected to the communication interface 24'.

[0187] In FIG. 5 A first embodiment of a transmission method for sending operating data from a device to a receiver device is schematically shown, wherein this embodiment exemplarily transmits operating data from the device 10 FIG. 4 with the aid of the communication device 12 to the receiver device 14' from FIG. 4 can be sent. The device 10, the communication device 12 and the receiver device 14' are designed to perform this transmission procedure.

[0188] In step B0, the communication device 12 is connected to the device 10 using the communication interfaces 22', 20 and to the receiver device 14' using the communication interface 22", 24'.

[0189] In step B1, which follows step B0, the communication device 12 receives the operating data from the facility 10 with the help of the computer 16.

[0190] In step B2, which follows step B1, the communication device 12, with the aid of computer 16 and security module 18, verifies the second identifier ID2, which is assigned to the receiver device 14' and stored in computer 16, and the fifth encryption key CS5, which is stored in computer 16, using the valid fourth certificate Z4, which is stored in security module 18. Computer 16 terminates the procedure if the result of this verification is negative.

[0191] In step B3, which follows step B2, the communication device 12 uses computer 16 to check whether authorization to receive the operational data is assigned to the fifth encryption key CS5 and the second identifier ID2. Computer 16 terminates the procedure if the result of this check is negative.

[0192] In step B4, which follows step B3, the communication device 12 signs the operating data using the sixth decryption key assigned to the communication device 12 and stored in the security module 18, thereby generating a signature. The communication device 12 then sends the operating data and the signature to the receiver device 14' using the computer 16.

[0193] In FIG. 1A second embodiment of the transmission method for sending operating data from a device to a receiver device is schematically illustrated. This embodiment is similar to the first embodiment, so the differences will be explained in more detail below. The device 10, the communication device 12, and the receiver device 14' are designed to execute this transmission method.

[0194] A step B5 following step B0 corresponds to step B1. A step B6 following step B5 corresponds to step B2. A step B7 following step B6 corresponds to step B3.

[0195] In step B8, which follows step B7, the communication device 12, with the aid of computer 16, encrypts the operational data using the fifth encryption key CS5. Then, with the aid of security module 18, the communication device 12 signs the encrypted operational data instead of the operational data itself, using the sixth decryption key assigned to the communication device 12 and stored in security module 18, thereby generating a signature. Finally, with the aid of computer 16, the communication device 12 sends the encrypted operational data and the signature to the receiving device 14' instead of the operational data.

[0196] In FIG. 7 A first embodiment of a setup method for setting up a communication device is schematically shown, wherein the communication device 12 is exemplified by this embodiment. FIG. 1 can be set up.

[0197] In step E1, the owner of facility 10 generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, where the public key forms the third encryption key CS3 and the private key forms the third decryption key DS3.

[0198] In step E2, which follows step E1, the holder issues the first certificate Z1 for the first encryption key CS1 and sends it to the communication device 12.

[0199] In step E3, which follows step E2, computer 16 stores the first certificate Z1 in a first memory area of ​​security module 18.

[0200] In step E4, which follows step E3, computer 16 activates write protection for the first memory area.

[0201] In step E5, which follows step E4, the security module 18 generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, where the public key forms the second encryption key CS2 and the private key forms the second decryption key DS2.

[0202] In step E6, which follows step E5, the security module 18 stores the second decryption key DS2 in a second memory area of ​​the security module 18.

[0203] In step E7, which follows step E6, the security module 18 or the computer 16 activates write protection and read protection for the second memory area.

[0204] In step E8, which follows step E7, the security module 18 generates a certificate signing request for the second encryption key CS2 using the second decryption key DS2.

[0205] In step E9, which follows step E8, computer 16 sends the certificate signing request to the owner.

[0206] In step E10, which follows step E9, the holder signs the certificate signing request using the third decryption key DS3, thereby issuing a fifth certificate Z5 for the second encryption key CS2, and sends the fifth certificate Z5 to the communication device 12.

[0207] In step E11, which follows step E10, computer 16 stores the fifth certificate Z5 in a third memory area of ​​security module 18. Then, security module 18 verifies the fifth certificate Z5 using the first certificate Z1 and terminates the procedure if the result of this verification is negative.

[0208] In an alternative step E11, computer 16 verifies the fifth certificate Z5 using the first certificate Z1 and aborts the procedure if the result of this verification is negative. Computer 16 then stores the fifth certificate Z5 in a third memory area of ​​security module 18.

[0209] In step E12, which follows step E11, the security module 18 or the computer 16 activates write protection for the third memory area.

[0210] The communication device 12 is now set up and can be used in the tax procedures. FIG. 2 and FIG. 3 be used.

[0211] In FIG. 8 A second embodiment of the setup procedure for setting up a communication device is schematically illustrated, which is similar to the first embodiment, so that the differences will be explained in more detail below.

[0212] Step E13 corresponds to step E1. Step E14, which follows step E13, corresponds to step E2.

[0213] In step E15, which follows step E14, a manufacturer of facility 10 generates a key pair with a public key and a private key by applying an asymmetric cryptosystem, where the public key forms a ninth encryption key CS9 and the private key forms a ninth decryption key DS9.

[0214] In step E16, which follows step E15, the manufacturer issues a sixth certificate Z6 for the first encryption key CS1 and sends it to the communication device 12.

[0215] In step E17, which follows step E16, computer 16 stores the first certificate Z1 and the sixth certificate Z6 in a first memory area of ​​security module 18.

[0216] Step E18, following step E17, corresponds to step E4. Step E19, following step E18, corresponds to step E5. Step E20, following step E19, corresponds to step E6. Step E21, following step E20, corresponds to step E7. Step E22, following step E21, corresponds to step E8. Step E23, following step E22, corresponds to step E9. Step E24, following step E23, corresponds to step E10. In step E25, following step E24, computer 16 sends the certificate signing request to the manufacturer.

[0217] In step E26, which follows step E25, the manufacturer signs the certificate signing request using the ninth decryption key DS9, thereby issuing a seventh certificate Z7 for the second encryption key CS2, and sends the seventh certificate Z7 to the communication device 12.

[0218] In step E1, which follows step E0, computer 16 stores the fifth certificate Z5 and the seventh certificate Z7 in a third memory area of ​​security module 18. Security module 18 then verifies the fifth certificate Z5 using the first certificate Z1 and terminates the procedure if the result of this verification is negative. Security module 18 also verifies the seventh certificate Z7 using the sixth certificate Z6 and terminates the procedure if the result of this verification is negative.

[0219] In an alternative step E1, computer 16 verifies the fifth certificate Z5 using the first certificate Z1 and aborts the procedure if the result of this verification is negative. Computer 16 also verifies the seventh certificate Z7 using the sixth certificate Z6 and aborts the procedure if the result of this verification is negative. Then, computer 16 stores the fifth certificate Z5 and the seventh certificate Z7 in a third memory area of ​​security module 18.

[0220] A step E2 that follows step E1 is equivalent to step E12.

[0221] The communication device 12 is now set up and can be used in the tax procedures. FIG. 2 and FIG. 3 The following exemplary steps are used to verify the installed communication device 12 by both the owner and the manufacturer.

[0222] In step E3, which follows step E2, the holder checks whether the first certificate Z1, which is stored in the first memory area, is unchanged and terminates the procedure if the result of this check is negative.

[0223] In step E4, which follows step E3, the manufacturer checks whether the sixth certificate Z6, which is stored in the first memory area, is unchanged and terminates the procedure if the result of this check is negative.

[0224] In step E5, which follows step E4, the holder verifies the certificate signing request and the fifth certificate Z5, which is stored in the third storage area, using the third encryption key CS3, and terminates the procedure if the result of this verification is negative.

[0225] In step E32, which follows step E31, the manufacturer verifies the certificate signing request and the seventh certificate Z7, which is stored in the third memory area, using the ninth encryption key CS9, and terminates the procedure if the result of this verification is negative.

[0226] In step E33, which follows step E32, the owner checks whether the second decryption key DS2, which is stored in the second memory area, was generated by the security module 18, and terminates the procedure if the result of this check is negative.

[0227] In step E34, which follows step E33, the manufacturer checks whether the second decryption key DS2, which is stored in the second memory area, has been generated by the security module 18 and terminates the procedure if the result of this check is negative.

[0228] The installed communication device 12 has now been checked by both the owner and the manufacturer.

[0229] In FIG. 9 A third embodiment of a setup method for setting up a communication device is schematically illustrated, with this embodiment exemplified by the communication device 12 from FIG. 4 This embodiment can be set up. This embodiment is similar to the first embodiment, so the differences will be explained in more detail below.

[0230] One step F1 corresponds to step E1.

[0231] In step F2, which follows step F1, the holder issues the fourth certificate Z4 for the fifth encryption key CS5 and sends it to the communication device 12.

[0232] In step F3, which follows step F2, computer 16 stores the fourth certificate Z4 in a fourth memory area of ​​security module 18.

[0233] In step F4, which follows step F3, the computer 16 activates write protection for the fourth memory area.

[0234] A step F5 following step F4 corresponds to step E5. A step F6 following step F5 corresponds to step E6. A step F7 following step F6 corresponds to step E7. A step F8 following step F7 corresponds to step E8. A step F9 following step F8 corresponds to step E9. A step F10 following step F9 corresponds to step E10.

[0235] In step F11, which follows step F10, computer 16 stores the fifth certificate Z5 in a third memory area of ​​security module 18. Then, security module 18 verifies the fifth certificate Z5 using the fourth certificate Z4 and terminates the procedure if the result of this verification is negative.

[0236] In an alternative step F11, computer 16 verifies the fifth certificate Z5 using the fourth certificate Z4 and aborts the procedure if the result of this verification is negative. Computer 16 then stores the fifth certificate Z5 in a third memory area of ​​security module 18.

[0237] A step F12 that follows step F11 is equivalent to step E12.

[0238] The communication device 12 is now set up and can be used in the transmission procedures. FIG. 5 and FIG. 6 be used.

[0239] In FIG. 10 A fourth embodiment of the setup procedure for setting up a communication device is schematically illustrated, which is similar to the third embodiment, so that the differences will be explained in more detail below.

[0240] Step F13 corresponds to step F1. Step F14, which follows step F13, corresponds to step F2. Step F15, which follows step F14, corresponds to step E15.

[0241] In step F16, which follows step F15, the manufacturer issues an eighth certificate Z8 for the fifth encryption key CS5 and sends it to the communication device 12.

[0242] In step F17, which follows step F16, computer 16 stores the fourth certificate Z4 and the eighth certificate Z8 in a fourth memory area of ​​security module 18.

[0243] A step F18 following step F17 corresponds to step F4. A step F19 following step F18 corresponds to step F5. A step F20 following step F19 corresponds to step F6. A step F21 following step F20 corresponds to step F7. A step F22 following step F21 corresponds to step F8. A step F23 following step F22 corresponds to step F9. A step F24 following step F23 corresponds to step F10. A step F25 following step F24 corresponds to step E25. A step F26 following step F25 corresponds to step E26.

[0244] In step F27, which follows step F26, computer 16 stores the fifth certificate Z5 and the seventh certificate Z7 in a third memory area of ​​security module 18. Security module 18 then verifies the fifth certificate Z5 using the fourth certificate Z4 and terminates the procedure if the result of this verification is negative. Security module 18 also verifies the seventh certificate Z7 using the eighth certificate Z8 and terminates the procedure if the result of this verification is negative.

[0245] In an alternative step F27, computer 16 verifies the fifth certificate Z5 using the fourth certificate Z4 and terminates the procedure if the result of this verification is negative. Computer 16 also verifies the seventh certificate Z7 using the eighth certificate Z8 and terminates the procedure if the result of this verification is negative. Then, computer 16 stores the fifth certificate Z5 and the seventh certificate Z7 in a third memory area of ​​the communication device 12 or the security module 18.

[0246] A step F28 that follows step F27 is equivalent to step F12.

[0247] The communication device 12 is now set up and can be used in the transmission procedures. FIG. 5 and FIG. 6 The following exemplary steps are used to verify the installed communication device 12 by both the owner and the manufacturer.

[0248] In step F29, which follows step F28, the holder checks whether the fourth certificate Z4, which is stored in the fourth memory area, is unchanged and terminates the procedure if the result of this check is negative.

[0249] In step F30, which follows step F29, the manufacturer checks whether the eighth certificate Z6, which is stored in the fourth memory area, is unchanged and aborts the procedure if the result of this check is negative.

[0250] A step F31 following step F30 corresponds to step E31. A step F32 following step F31 corresponds to step E32. A step F33 following step F32 corresponds to step E33. A step F34 following step F33 corresponds to step E34.

[0251] The installed communication device 12 has now been checked by both the owner and the manufacturer.

[0252] Furthermore, any of the procedures, processes, and actions described or illustrated herein can be implemented in a general-purpose or specialized processor using executable instructions (for example, a computer program) and stored on a computer-readable storage medium (e.g., hard disk, memory, or the like) for execution by such a processor. References to "computer-readable storage medium" are to be understood as including specialized circuits such as FPGAs, ASICs, signal processing devices, and other equipment.

[0253] The expression "A and / or B" encompasses one of the following three scenarios: (i) A, (ii) B, (iii) and B. The expression "A and / or B" has the same meaning as "at least one of A or B" and "at least one of A and B." Furthermore, the article "a" is not to be understood as "one," meaning that the use of the expression "an element" does not preclude the presence of other elements. The term "encompassing" is to be understood in an open sense, meaning that an object that "includes an element A" may also include other elements besides element A. Reference symbol list

[0254] 10 Device 12 Communication device 14 / 14' Sender device / Receiver device 16 Computer of 12 18 Security module of 12 20 Communication interface of 10 22' / 22" First / Second communication interface of 12 24 Communication interface of 14 26 Machine of 10 CS1 / DS1 First encryption key / decryption key of 14 CS2 / DS2 Second encryption key / decryption key of 12 CS3 / DS3 Third encryption key / decryption key of the holder of 10 CS4 / DS4 Fourth encryption key / decryption key of 12 CS5 / DS5 Fifth encryption key / decryption key of 14' CS6 / DS6 Sixth encryption key / decryption key of 12 CS7 / DS7 Seventh encryption key / decryption key of 12 CS8 / DS8 eighth encryption / decryption key of 10 CS9 / DS9 ninth manufacturer's encryption / decryption key of 10 ID1 first identifier of 14 ID2 second identifier of 14 ID3 third identifier of 10 Z1 first certificate for CS1(Issued by the holder of 10) Z2 Second certificate for the configuration file (Issued by the holder and / or manufacturer of 10) Z3 Third certificate for the firmware (Issued by the holder and / or manufacturer of 10 and / or by the manufacturer of 12) Z4 Fourth certificate for CS5 (Issued by the holder of 10) Z5 Fifth certificate for CS2 (Issued by the holder of 10) Z6 Sixth certificate for CS1 (Issued by the manufacturer of 10) Z7 Seventh certificate for CS2 (Issued by the manufacturer of 10) Z8 Eighth certificate for CS5 (Issued by the manufacturer of 10)

Claims

1. Method for controlling a apparatus (10), wherein - a communication device (12) is connected to the apparatus (10); - in a stepS1, the communication device (12) receives plaintext and a signature from a sender device (14); - in a stepS2 , the communication device (12) verifies a first identifier (ID1) associated with the sender device (14) and a first encryption key (CS1) using a valid first certificate (Z1), wherein the verification is performed by using the first certificate (Z1) to check whether the first encryption key (CS1) matches the first identifier (ID1), and terminating the method if the result of this verification is negative, wherein the first certificate (Z1) is stored in a security module (18) comprised in the communication device (12); - in a stepS3 , the communication device (12) verifies the received signature and the received plaintext using the first encryption key (CS1) and terminates the method if the result of this verification is negative; - in a stepS4 , the communication device (12) checks whether a control instruction for the apparatus (10) is contained in the plaintext and terminates the method if the result of this check is negative; - in one stepS5 the communication device (12) checks whether an authorisation for the control instruction is associated with the first encryption key (CS1) and with the first identifier (ID1), and aborts the method if the result of this check is negative; - in a stepS6 , the communication device (12) generates a control command for the apparatus (10) using the control instruction contained in the recovered plaintext; and - in a stepS7 , the communication device (12) sends the control command to the apparatus (10), whereby the apparatus (10) is controlled.

2. Method for controlling a apparatus (10), wherein - a communication device (12) is connected to the apparatus (10); - in a stepS8 , the communication device (12) receives a ciphertext and a signature from a sender device (14), wherein the ciphertext represents an encrypted plaintext; - in a stepS9 , the communication device (12) verifies a first identifier (ID1) associated with the sender device (14) and a first encryption key (CS1) using a valid first certificate (Z1), wherein the verification is performed by checking, using the first certificate (Z1), whether the first encryption key (CS1) matches the first identifier (ID1), and terminates the method if the result of this verification is negative, wherein the first certificate (Z1) is stored in a security module (18) comprised in the communication device (12); - in a stepS10, the communication device (12) decrypts the received ciphertext using a second decryption key (DS2) associated with the communication device (12), whereby the plaintext is restored; - in a stepS11, the communication device (12) verifies the received signature and the received ciphertext or the received signature and the restored plaintext using the first encryption key (CS1) and terminates the method if the result of this verification is negative; - in a stepS12 , the communication device (12) checks whether a control instruction for the apparatus (10) is contained in the plaintext and terminates the method if the result of this check is negative; - in a stepS13 , the communication device (12) checks whether an authorisation for the control instruction is associated with the first encryption key (CS1) and with the first identifier (ID1) and terminates the method if the result of this check is negative; - in a stepS14 , the communication device (12) generates a control command for the apparatus (10) using the control instruction contained in the recovered plaintext; and - in a stepS15 , the communication device (12) sends the control command to the apparatus (10), whereby the apparatus (10) is controlled.

3. Method according to claim 1 or2 , wherein - the first encryption key (CS1) is or is being stored in the communication device (12); and / or - the first encryption key (CS1) is contained in the plain text and / or in a signature file containing the signature, and the communication device (12) extracts the first encryption key (CS1) from the plain text and / or from the signature file; and / or - the communication device (12) has received or receives the first encryption key (CS1), in particular by download from a key server.

4. Method according to one or more of claims 1 to3 , - wherein the checking according to step S5 or S13 is performed by the communication device (12) checking whether the authorisation is contained in the first encryption key (CS1) and / or is associated, in a configuration file, with the first encryption key (CS1) and / or with the first identifier (ID1) and / or - wherein in a stepS16 the communication device (12) checks whether the configuration file has been signed using a valid second certificate (Z2) and terminates the method if the result of this check is negative.

5. Method according to one or more of claims 1 to 4, wherein - the sending according to step S7 or S15 comprises that the communication device (12) - encrypts the control command using a third encryption key (CS3) associated with the apparatus (10), and - sends the encrypted control command to the apparatus (10); - or the sending according to step S7 or S15 comprises that the communication device (12) - signs the control command using the second decryption key (DS2) or a fourth decryption key (DS4) associated with the communication device (12), whereby a signature is generated, and - sends the control command and the signature to the apparatus (10); - or the sending according to step S7 or S15 comprises that the communication device (12) - encrypts the control command using a third encryption key (CS3) associated with the apparatus (10), - signs the control command or the encrypted control command using the second decryption key (DS2) or a fourth decryption key (DS4) associated with the communication device (12), whereby a signature is generated, and - sends the encrypted control command and the signature to the apparatus (10).

6. Method according to one or more of claims 1 to 5, wherein - the communication device (12) comprises a computer (16) in which the first encryption key (CS1), the third encryption key (CS3), the first identifier (ID1) and / or the configuration file are stored; and / or - the second certificate (Z2), the second decryption key (DS2) and / or the fourth decryption key (DS4) are also stored in the security module (18) and / or - the communication device (12) comprises - a computer (16), and - the security module (18) is connected to the computer (16); - data is transferred from the computer (16) to the security module (18) and from the security module (18) to the computer (16); and - this transfer of data is protected by software and / or hardware protection that prevents the transferred data from being read and / or modified and / or ensures that only the computer (16) can control this transfer of data and / or that this transfer of data can only take place with the aid of a password that is stored exclusively in the computer (16) and / or - the security module (18) has write protection implemented by software and / or hardware which prevents modification of the first certificate (Z1) stored in the security module (18), of the second certificate (Z2) stored in the security module (18), of the second decryption key (DS2) stored in the security module (18) and / or of the fourth decryption key (DS4) stored in the security module (18); and / or - the security module (18) has read protection implemented by software and / or hardware, which prevents the second decryption key (DS2) stored in the security module (18) and / or the fourth decryption key (DS4) stored in the security module (18) from being read.

7. Method according to one or more of claims 1 to 6, wherein the control instruction and / or control command relates to sending operating data from the apparatus (10) to the sending device (14) or to a receiving device (14').

8. Method for sending operating data from a apparatus (10) to a receiving device (14'), wherein - a communication device (12) is connected to the apparatus (10); - in a stepB1, the communication device (12) receives the operating data from the apparatus (10); - in a stepB2, the communication device (12) verifies a second identifier (ID2) associated with the receiving device (14') and a fifth encryption key (CS5) using a valid fourth certificate (Z4), wherein the verification is performed by checking, using the fourth certificate (Z4), whether the fifth encryption key (CS5) matches the second identifier (ID2), and terminating the method if the result of this verification is negative, wherein the fourth certificate (Z4) is stored in a security module (18) comprised in the communication device (12); - in a stepB3 , the communication device (12) checks whether an authorization to receive the operating data is associated with the fifth encryption key (CS5) and to the second identifier (ID2), and the method is terminated if the result of this check is negative; and - in a stepB4 , the communication device (12) - signs the operating data using a sixth decryption key (DS6) associated with the communication device (12), thereby generating a signature, and - sends the operating data and the signature to the receiving device (14').

9. Method for sending operating data from an apparatus (10) to a receiving device (14'), wherein - a communication device (12) is connected to the apparatus (10); - in a stepB5, the communication device (12) receives the operating data from the apparatus (10); - in a stepB6 , the communication device (12) verifies a second identifier (ID2) associated with the receiving device (14') and a fifth encryption key (CS5) using a valid fourth certificate (Z4), wherein the verification is performed by checking, using the fourth certificate (Z4), whether the fifth encryption key (CS5) matches the second identifier (ID2), and terminates the method if the result of this verification is negative, wherein the fourth certificate (Z4) is stored in a security module (18) comprised in the communication device (12); - in a stepB7, the communication device (12) checks whether an authorization to receive the operating data is associated with the fifth encryption key (CS5) and with the second identifier (ID2), and the method is terminated if the result of this check is negative; and - in a stepB8, the communication device (12) - encrypts the operating data using the fifth encryption key (CS5), - signs the operating data or the encrypted operating data using a sixth decryption key (DS6) associated with the communication device (12), whereby a signature is generated, and - sending the encrypted operating data and the signature to the receiving device (14').

10. Method according to claim 8 or 9, wherein - in a stepB9 , the communication device (12) decrypts the received encrypted operating data using the sixth decryption key (DS6) or a seventh decryption key (DS7) corresponding to the seventh encryption key (CS7), thereby restoring the operating data; - in a stepB10 , the communication device (12) verifies the received operating data and the received signature using an eighth encryption key (CS8) corresponding to the eighth decryption key (DS8) and terminates the method if the result of this verification is negative; and - in a stepB11, the communication device (12) - decrypts the received encrypted operating data using the sixth decryption key (DS6) or a seventh decryption key (DS7) corresponding to the seventh encryption key (CS7), whereby the operating data is restored, and - verifies the received encrypted operating data and the received signature or the restored operating data and the received signature using an eighth encryption key (CS8) corresponding to the eighth decryption key (DS8), and terminates the method if the result of this verification is negative.

11. Method according to claim 7, wherein after step S7 or S15, a method according to one or more of claims 8 to 9 is performed.

12. Communication device (12) comprising - means for executing a method according to one or more of claims 1 and 3 to 7; - means for executing a method according to one or more of claims 2 to 7; - means for executing a method according to one or more of claims 8 and 10; and / or - means for executing a method according to one or more of claims 9 to 10.

13. Computer program comprising instructions which, when executed by a computer (16) or by a communication device (12) according to claim 12, cause the computer (16) or the communication device (12) to perform a method according to one or more of claims 1 and 3 to7, a method according to one or more of claims 2 to 7, a method according to one or more of claims 8 and 10, and / or a method according to one or more of claims 9 to 10.

14. Computer-readable medium - on which the computer program according to claim 13 is stored; and / or - which comprises instructions which, when executed by a computer (16) or a communication device (12) according to claim 12, cause this computer (16) or this communication device (12) to perform a method according to one or more of claims 1 and 3 to 7, a method according to one or more of claims 2 to 7, a method according to one or more of claims 8 and 10, and / or a method according to one or more of claims 9 to 10.

15. Data carrier signal that transmits the computer program according to claim 14.