Method for constructing a decentralised data communication structure within a system having a plurality of components

Abstract

A method for constructing a decentralised data communication structure within a system having a plurality of components (K), wherein each component contains a private key (PrK), an associated public key (PuK), a secret secured against read-out (SCR), and certificate information (CU) that is unsigned in the initial state and contains the public key (PuK), comprises the steps of: - establishing a registering component (rK) of the plurality of components (K), wherein the establishment comprises storing a list of validation entries, - constructing a tamper-proof channel between the registering component (rK) and a first component (K1) of the other components (aK), and - authenticating the first component (K1) at the registering component (rK) and authenticating the first component (K1) by means of the list of validation entries via the tamper-proof channel. The authentication comprises signing the unsigned certificate information (CU) of the first component (K1) by the registering component (rK) via the tamper-proof channel. A system, in particular an energy generation plant, having a plurality of components (K) is designed to carry out the method.

Description

[0001] METHOD FOR CONSTRUCTING A DECENTRALIZED DATA COMMUNICATION STRUCTURE WITHIN A SYSTEM WITH A PLURALITY OF COMPONENTS

[0002] Description

[0003] The invention relates to a method for establishing a decentralized data communication structure within a system having a plurality of components, as well as to a system having a plurality of components which is configured to carry out the method.

[0004] To protect critical infrastructure, especially systems for generating energy and feeding it into a public grid, from cyberattacks, high security requirements must be met. Therefore, the connection of such systems to a data network must be reduced to the functionally necessary level or eliminated entirely. Nevertheless, the components of such a system must be able to communicate with each other in a tamper-proof and secure manner, even if a cyberattack might only be possible via direct access to one of the components or to the communication link between components, which can only be carried out on-site. Methods have been developed for this purpose that rely on the existence of pre-signed certificates on the system components.However, the installation of a system that provides the prerequisites for executing such procedures is complex, as it requires the distribution of these certificates to each of the components in a secure manner, preferably during the production of the component, otherwise through a direct data connection with each of the components of the already installed system.

[0005] In particular, the use of components from multiple manufacturers in one system is made more difficult due to the lack of existing standards.

[0006] Document US 2021 / 0184864 A1 discloses a method for establishing a certificate infrastructure in a system with mixed signing protocols. Different digital certificates are generated for the different protocols. Furthermore, document WO 2013 / 123548 A2 also describes a method for providing keys for secure communication between two users in a decentralized network and an application for sharing information between users via a shared data store.

[0007] Other methods rely on the components signing their certificates themselves.

[0008] These methods are easy to implement, but have the significant disadvantage that they do not allow for secure verification of the device's identity by other communication partners. While communication between two devices can be encrypted in this way, proper mutual authentication of the communication participants is not possible. This makes it possible for an unauthorized third party ("man-in-the-middle") to interrupt and intercept the communication between two devices.

[0009] Accordingly, it is the object of this invention to provide a method for setting up a decentralized data communication structure within a system having a plurality of components, which method can be implemented safely and with little effort, and which allows the use of efficient and proven standard communication protocols within the decentralized data communication structure.

[0010] This object is achieved by a method having the features of independent claim 1. Preferred embodiments of the method and systems configured to carry out the method are the subject of the dependent claims.

[0011] In a system with a plurality of components, wherein each component of the system has a private key, an associated public key, a secret secured against reading out, and, in the initial state, unsigned certificate information containing the public key, a method according to the invention for establishing a decentralized data communication structure within the system comprises setting up a registering component of the plurality of components, establishing a tamper-proof channel between the registering component and a first component of the other components, authenticating the first component with the registering component, and authenticating the first component by means of the list of entries via the tamper-proof channel.Authentication involves the registering component signing the unsigned certificate information of the first component over the tamper-proof channel. Configuration involves storing a list of validation entries.

[0012] In the context of this invention, the term validation entry is understood to mean an entry that was generated from the respective device-specific secrets of the plurality of components and allows a verification of knowledge of the device-specific secrets without their transmission. The validation entry can contain the secret itself or consist of it; however, it is advantageous if the validation entry only contains a data set calculated using the secret, from which the secret itself cannot be deduced. The validation entry can, for example, contain a "salted" hash value of the secret. However, the validation entry can also contain a nonce or a plurality of nonces (randomly generated data sets) and, for each nonce, an associated hash value as the expected response, which was determined from a combination of the nonce and the secret.If there are multiple nonces, to increase cybersecurity, it can be specified that each nonce is used only once or is only used again after the other nonces have been used.

[0013] In an advantageous embodiment, signing can involve transmitting the public key of the registering component via the tamper-proof channel. If the public key is only transmitted during signing, the security of the data communication structure against cyberattacks can be increased because the public key is only transmitted to authenticated components.

[0014] The setup of a registering component of the plurality of components can, for example, be performed by an installer as an authorized party via an encrypted and tamper-proof data connection. The validation entries can be generated by the installer entering the serial numbers of the components to be included in the decentralized data communication structure into a terminal device, and this terminal device then identifies and transmits the validation entries to be transmitted to the registering component. Identification can be performed via a database stored locally on the terminal device or by retrieving the validation entries for the serial numbers from a remotely stored database. The other components of the system do not need to be in operation or accessible via a data connection at this time.

[0015] Establishing a tamper-proof channel between the registering component and a first component of the system can be achieved using a preshared key. It is conceivable for the authorized party to connect to the first component via an encrypted and tamper-proof data connection and transmit the preshared key, for example, the public key of the registering component, in this way. It is also conceivable for the preshared key to be stored during production, together with the device-specific secret, in a memory area specially protected against readout. In addition to protecting against tampering with the transmitted data, the channel can also be encrypted and / or secured against unauthorized retransmission (so-called replay attacks).

[0016] The authentication of a component in response to the authentication can be performed via the tamper-proof channel by the first component transmitting the unsigned certificate information to the registering component. Furthermore, the authentication includes a check to determine whether a secret corresponding to the validation entry contained in the list for this component is stored on the first component. During this check, the secret should remain on the first component and not be transferred. This can be done, for example, by the registering component transmitting a first data set in the form of a nonce stored in the validation entry to the first component, which calculates a hash value of a combination of the first data set and the stored secret, and transmitting this hash value back to the registering component as the second data set.Only if the second data record matches the expected response of the validation entry associated with the first data record will the signed certificate information be signed and retransmitted. Signing can be performed by encrypting the unsigned certificate information, a portion of it, or a data record calculated from it, such as a hash value, with the private key of the registering component. Each component can then verify the trustworthiness of the signed certificate information using the public key of the registering component. During signing, the registering component can also add additional information to the certificate information. In particular, a validity period or other validity criteria that must be met for the signed certificate to be classified as trustworthy can be added.

[0017] The unsigned certificate information may contain additional components in addition to the public key of the associated component, for example information for establishing a data connection with the associated component such as a domain name or an IP address.

[0018] Authentication can be performed for each component of the system to obtain certificate information signed by the registering component. After authentication, the component can use the signed certificate information to prove its trustworthiness to other components of the system. A session key can then be agreed upon using known protocols with the other components that provide certificate information signed by the registering component to establish a secure communication channel. The communication channel can be secured, in particular, by symmetric encryption via the session key. The protocol used can be a TLS protocol. This allows high data transfer rates to be achieved with minimal effort.

[0019] The trustworthiness of signed certificate information can be verified in a known way using the public key of the registering component. This key can be retrieved from the registering component at any time and can also be transmitted over an unsecured communication channel without compromising the integrity of the communication structure.

[0020] In a further aspect of the invention, a system comprising a plurality of components having the features described above is configured to carry out the method according to the invention. Advantageously, one component of the plurality of components has an interface for logging in a system user, wherein the interface is configured to set up one component as the registering component and to store the list of validation entries of the other components of the system. The interface can preferably be an interface for wired communication, for example a LAN interface, to which a terminal device of the system user can be connected. In an advantageous embodiment, the system has a generator, a consumer, a converter, or a storage device for electrical energy. The system is preferably configured to exchange electrical power with an energy transmission network.

[0021] Preferably, the system has no data connection with any instance outside the system, for example, no internet connection. This makes it impossible for the system to access data from outside, particularly through a cyberattack. Alternatively, only one of the components is equipped with such a data connection. This component can be specially secured against cyberattacks and, for example, be accessible only from selected instances or via a specially secured connection.

[0022] In the following, the invention is illustrated by means of figures, of which

[0023] Fig. 1 shows a data structure of a component of a system according to the invention,

[0024] Fig. 2 is a flowchart of a method according to the invention,

[0025] Fig. 3 shows a partial step of the flow chart from Fig. 2, and

[0026] Fig. 4 shows a system according to the invention after carrying out the method according to the invention.

[0027] Fig. 1 shows a data structure of a component K of a system that is designed to create a decentralized data communication structure. The component K has an interface IN for data communication with other components. Furthermore, the component K comprises a processor PR and a memory MEM, which provide essential functions of the component. In addition to a key pair formed by a private key PrK and a corresponding public key PuK for encrypting and decrypting data, the component K has a secret SCR in a memory area that is secured against external readout. The private key PrK can also be stored in the memory area that is secured against external readout.The key pair can be generated and stored during component production, for example, or the component can generate the key pair using randomly generated data during commissioning or based on a command received via the IN interface. The secret is preferably generated during component production, and a copy of the secret is stored in a database at the component manufacturer. Alternatively, the secret can be determined from the component's serial number, be legibly affixed to the component, or be included in the documentation supplied with the component.

[0028] In addition, component K includes an initially unsigned certificate CU containing a copy of component K's public key PuK, which is indicated by the key symbol in the certificate CU. The certificate CU can contain further information, for example, an address at which component K can be accessed via the interface IN. A system is formed by a plurality of components K with such a structure, between which a decentralized data communication structure is to be established, secured against external access or manipulation. The system can be a power generation plant connected to a power grid.

[0029] In a method shown in Fig. 2 for setting up a decentralized data communication structure within a system with a plurality of components, a first step S1 comprises setting up a registering component of the plurality of components. In principle, any of the components of the system can be selected as the registering component. The setting up can be carried out by an installer as part of the system commissioning. The setting up comprises storing a list of validation entries in the memory of the registering component, which defines which authentications from other components of the system are accepted by the registering component. The list of validation entries can be generated from a list of device-specific secrets, whereby the device secrets can be enclosed with the device in printed form or printed on the nameplate.To generate the validation entries, it may be necessary to query the manufacturer's database for the secret associated with the respective device. The selection of a component as the registering component can be stored in the registering component's memory. In a second step S2, another component can then establish a tamper-proof channel with the registering component. This can be achieved using known methods such as the Diffie-Hellman method. This does not yet require proof of trust between the communication partners.

[0030] In a third step, the other component authenticates itself with the registering component. This is broken down in more detail in Fig. 3. To do this, in a first sub-step S3.1, the other component transmits its initially unsigned certificate to the registering component. The registering component checks the authorization of the other component using the validation entries. For example, the check in a second sub-step S3.2 can comprise sending an entry from the validation entries from the registering component to the other component, which calculates a response from the entry and the secret stored with the other component and sends it back to the registering component in a third sub-step S3.3. If the response is correct in a fourth sub-step S3.4 matches an entry in the list of validation entries assigned to the expected response, the registering component authenticates the other component in a fifth sub-step S3.5; otherwise, it refuses authentication in a sixth sub-step S3.6. Authentication comprises signing the unsigned certificate information of the other component using the private key of the registering component and returning the signed certificate via the secure channel. Preferably, the public key of the registering component is also sent with the return, which allows for later verification of the trustworthiness of the certificate. Alternatively, the public key can also be transmitted at a different time, in particular after mutual authentication of both communication partners.This ensures that the public key of the registering component actually originates from it.

[0031] In this way, each of the other components can then authenticate itself with the registering component one after the other and thus receive a certificate signed by the registering component. Therefore, the method can be terminated when it is determined in a fourth step S4 that all components of the system have been successfully authenticated. This ensures that each component of the system subsequently has a certificate signed by the registering component and the public key of the registering component. Using this information, it can agree on a session key with each other component of the system using known protocols, such as the TLS (Transport Layer Security) protocol, and thus establish a secure and trustworthy data connection.It is also impossible for external components to establish such a connection with system components or to interfere with them unnoticed, since a foreign component cannot achieve authentication by the registering component because it does not possess a secret matching the list of validation entries. The decentralized data communication structure established using the method according to the invention is therefore a closed structure.

[0032] If necessary, the process can be repeated at any time to rule out a suspected compromise. This simply requires the registering component to generate a new key pair—i.e., a new private and public key—and replace the old public key in the system with the newly generated public key. The other components can then recognize that their certificates require reauthentication and initiate this process with the registering component.

[0033] It's also easy to add additional components to the system later by adding a validation entry for the new component to the list of validation entries. This allows the additional component to successfully authenticate with the registering component.

[0034] Fig. 4 shows a system according to the inventive method. Both a registering component rK and a number of other components aK are configured to communicate with each other via a bus BUS and are also connected to it via an interface IN. This can be a wired or wireless connection, for example, a radio connection. After the inventive method has been implemented, each component has a certificate CS signed by the registering component rK. This is indicated by the symbol of the public key of the registering component rK in the signed certificate CS. The registering component rK has a self-signed certificate CS. The other components of the system, such as the processor PR, the memory MEM, the own key pair PrK, PuK, and the secret SCR, correspond to the components of the same name in Fig. 1.

[0035] By providing a first component's own certificate to a second, different component of the system as the desired communication partner, the second component can receive the first component's public key and verify its trustworthiness using known procedures, as well as send its own signed certificate back as a response for contact. The first component can then verify this certificate for trustworthiness in the same way. After successful mutual assurance of trustworthiness, a temporary key for secure communication can easily be agreed upon using the public keys. The communication method can be, for example, the TLS method or an SSL (Secure Socket Layer) method, which enables high data rates and low computing effort for the processors (PR) of the communication partners involved, while maintaining a high level of cybersecurity.

[0036] List of reference symbols

[0037] K, K1 , K2, aK component rK registering component

[0038] PrK private key

[0039] PuK public key

[0040] CU unsigned certificate

[0041] CS signed certificate

[0042] PR Processor

[0043] MEM memory

[0044] SCR Device-specific secret

[0045] S1 - S4 step

[0046] S3.1 - S3.6 Step

Claims

Patent claims 1. A method for establishing a decentralized data communication structure within a system having a plurality of components (K), each component containing a private key (PrK), an associated public key (PuK), a secret secured against reading (SCR) and, in the initial state, unsigned certificate information (CU) containing the public key (PuK), comprising: - setting up a registering component (rK) of the plurality of components (K), wherein the setting up comprises storing a list of validation entries, - Establishing a tamper-proof channel between the registering component (rK) and a first component (K1) of the other components (aK), and - Authenticating the first component (K1) with the registering component (rK) and authenticating the first component (K1) by means of the list of validation entries via the tamper-proof channel, wherein the authentication comprises signing the unsigned certificate information (CU) of the first component (K1) by the registering component (rK) via the tamper-proof channel.

2. The method according to claim 1, wherein the signing comprises a transmission of the public key (PuK) of the registering component (rK) via the tamper-proof channel.

3. Method according to one of the preceding claims, further comprising: - Establishing a tamper-proof channel between the registering component (RK) and a second component (K2) of the other components (aK), and - Authenticating the second component (K2) with the registering component (rK) and authenticating the second component (K2) by means of the list of entries via the tamper-proof channel, wherein the authentication comprises signing the unsigned certificate information (CU) of the second component (K2) by the registering component (rK) via the tamper-proof channel.

4. The method according to claim 3, further comprising establishing a secure communication channel between the first component (K1) and the second component (K2) by exchanging the signed certificate information of the first and the second component and transmitting a certificate signed by means of one of the signed certificate information encrypted session key for the secure communication channel.

5. The method of claim 4, wherein the secure communication channel comprises symmetric encryption over the transmitted session key.

6. The method of claim 4 or 5, wherein the secure communication channel uses a TLS protocol.

7. The method according to any one of claims 4 to 6, wherein establishing the secure communication channel comprises querying the registering component (rK) for its public key (PuK) and verifying the signed certificate information using the queried public key (PuK).

8. Method according to one of the preceding claims, wherein the signing of the unsigned certificate information (CU) comprises signing with a time-limited validity.

9. System with a plurality of components (K), arranged to carry out the method according to one of the preceding claims.

10. The system of claim 9, wherein one component of the plurality of components has an interface for logging in a system user, the interface being configured to set up the one component as a registering component and to store the list of validation entries.

11. System according to claim 9 or 10, wherein one of the components comprises a generator, a consumer, a converter or a storage device for electrical energy.

12. System according to one of claims 9 to 11, wherein the system has no data connection with an entity outside the system.

13. System according to one of claims 9 to 11, wherein exactly one of the components (K) has a data connection with an instance outside the system.

Images