Putting digital certificate into service

Abstract

To provide a method for putting a digital certificate of a field device into service on a terminal.SOLUTION: The method comprises: sending an inquiry for transmitting a digital certificate to a field device (1) by way of a terminal (2); receiving the inquiry for transmitting the digital certificate by the field device (1) and in response to receiving the inquiry for transmitting the digital certificate, sending executable certificate data via the field device (1) to the terminal (2), where the executable certificate data comprise executable instructions and the digital certificate; receiving the executable certificate data by the terminal (2); and, after the executable certificate data have been received by the terminal (2), executing the executable certificate data by the terminal (2), as a consequence of which the digital certificate is installed on the terminal (2).SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a method for terminal activation of a digital certificate of a field device. In another aspect of the invention, a field device usable while performing the method is proposed. Furthermore, a computer-implemented method for running on the field device is proposed. [Background technology]

[0002] Field devices are widely used in process automation technology to acquire and / or influence process variables. Examples of such field devices include fill level gauges, point level gauges, and pressure gauges, each equipped with a sensor that acquires a corresponding process variable, such as level, point level, or pressure. Such field devices are typically intended for applications in areas such as flood forecasting, inventory control, and other decentralized, distributed measurement tasks. Known field devices of the aforementioned type enable the transmission of measurements, allowing a higher-level unit to perform predetermined actions based on the determined measurements. For example, if a level gauge measurement exceeds a limit, an inlet can be closed or an outlet can be opened based on the measurement.

[0003] To enable remote operation, configuration, or inspection, field devices can provide access via a network connection. For example, a field device can be equipped with a web server application. The latter can provide a user interface that can be accessed, for example, via the HTTP protocol. HTTP stands for Hypertext Transfer Protocol. This allows users to remotely configure the device or obtain measured values, for example, using a web browser. Users can connect to field devices via a terminal, such as a personal computer.

[0004] For security reasons, encrypted communication between field devices and terminals is preferred. The use of digital certificates is often possible. Digital certificates can be used to verify that the remote station with which the terminal is communicating is in fact a field device. For this purpose, known methods based on public key cryptography can be used. For example, secure communication can be established via the HTTPS protocol. HTTPS stands for Hypertext Transfer Protocol Secure. Summary of the Invention [Problem to be solved by the invention]

[0005] However, communication via the HTTPS protocol assumes that the terminal can check the digital certificate of the field device. For example, if the digital certificate is stored in the terminal, it can compare the correspondence before communicating with the field device. To do this, a digital certificate must be installed on the terminal by an expert. If a user wants to access a field device using their terminal, they must first install the digital certificate. To do this, for example, they may download the digital certificate from the field device over an insecure connection and install the digital certificate on the terminal. The terminal's communication with the field device can be via the HTTPS protocol. However, installing the digital certificate is relatively complicated and may require technical expertise.

[0006] It is therefore an object of the present invention to provide a simplified method for terminal activation of a digital certificate of a field device. Another object of the present invention is to provide a field device usable with said method. A further object of the present invention is to provide a computer-implemented method running on such a field device. [Means for solving the problem]

[0007] The above-mentioned object is achieved by a method according to claim 1, a field device according to claim 14, and a computer-implemented method according to claim 15. The dependent claims relate to optional embodiments of the invention. It should be noted that the features recited in the independent and dependent claims may be combined in any way that is technically reasonable. This applies across the boundaries of the claim categories, even if a claim does not refer to other claims. This description, particularly together with the drawings, characterizes and specifies the invention. The features contained in this description may likewise be combined as necessary, if technically feasible.

[0008] A first aspect of the present invention is a method for activating a digital certificate of a field device in a terminal, the digital certificate being assigned to the field device and used to verify the authenticity of the field device during communication with the field device via a secure data transfer protocol. The method includes: transmitting, via the terminal, a query to the field device requesting transmission of the digital certificate; and receiving, via the terminal, the query to transmit the digital certificate. In response to receiving the query to transmit the digital certificate, executable certificate data, the executable certificate data including executable instructions and a digital certificate, is transmitted to the terminal via the field device. The executable certificate data is then received by the terminal. The executable certificate data is executed by the terminal, thereby installing the digital certificate in the terminal. As a result, operation of the digital certificate is activated in the terminal.

[0009] The digital certificate is installed at the terminal by executing the executable certificate data. This simplifies the installation of the digital certificate for the user of the terminal. In the framework of the method of the present invention, the terminal first requests the transmission of a digital certificate. This may involve, for example, a request to download the digital certificate. According to the present invention, the download can be performed via a website provided by the field device. According to the present invention, a web server application that allows configuration of the field device can be operated on the field device. According to the present invention, the web server application is suitable for providing data via the HTTP protocol and the HTTPS protocol. More generally, the web server application is suitable for providing data via an insecure data transfer protocol and a secure data transfer protocol.

[0010] According to the present invention, the terminal may not make a query to transmit the digital certificate via the HTTP protocol. For example, the query may be transmitted via the FTP protocol, in which case the query becomes an FTP query. Subsequently, the field device transmits executable certificate data to the terminal. For example, this is preferably achieved by a download process via the FTP protocol, and an FTP application of the field device transmits the executable certificate data to the terminal.

[0011] The executable certificate data is executed on the terminal. By executing the executable certificate data, the digital certificate is installed on the terminal. The installation process performed in this framework may have very different characteristics depending on the operating system of the terminal. For example, according to the present invention, to activate or install the digital certificate on the terminal, it is possible to copy the certificate to a specific folder on the terminal, make specific registry settings on the terminal, make specific program and / or system settings on the terminal, and perform other steps as necessary.

[0012] In some embodiments, the installation process may require interaction with the user of the terminal. For example, the user of the terminal may be required to confirm the installation process, or portions of the installation process, via input on the terminal. Furthermore, the user may be required to input specific data to install the digital certificate. Even if interaction with the user of the terminal is required, installing the digital certificate using the executable certificate data is preferred because it significantly simplifies the installation process compared to manually installing the digital certificate. After installation is complete, the certificate is preferably immediately usable, e.g., directly on the terminal via a web browser application. However, in a possible variation of the present invention, the user may subsequently need to make one or more adjustments to the terminal to ultimately enable the digital certificate on the terminal. For example, the terminal may be a personal computer, laptop, tablet PC, smartphone, or other computer.

[0013] In implementing the method, it is preferable that at least one piece of information related to the operating system of the terminal is transmitted from the terminal to the field device, the field device receives the at least one piece of information related to the operating system of the terminal, and the executable certificate data transmitted by the field device to the terminal is adapted to the operating system of the terminal. Depending on the operating system of the terminal, various steps may be required to install the digital certificate on the terminal. Specifically, executable instructions executable in a first operating system may not necessarily be executable in a second operating system. The executable certificate data adapted to the operating system of the terminal is preferably regarded as executable certificate data executable on the terminal, and the digital certificate is installed on the terminal upon execution.

[0014] Additionally, differences may exist between various operating system versions, and therefore the characteristics of the executable certificate data must vary depending on the version of the operating system used. For example, information about the operating system can be sent to the field device by making a selection in the user interface of the field device. For example, the terminal's operating system and / or operating system version can be selected from a drop-down list displayed in the user interface provided by the field device. According to the present invention, the field device can also extract information about at least one operating system from a data field that the terminal's web browser transmits in communication with the field device's web server. For example, a so-called user agent field can be evaluated, which contains information about the web browser and the operating system used and is transmitted from the terminal to the field device according to the HTTP protocol.

[0015] Specifically, the at least one piece of information may include an operating system type (e.g., Windows, MacOS, GNU / Linux). The at least one piece of information may also include, as needed, a subtype of the operating system, a version number of the operating system, or other data characterizing the operating system. In response to the at least one piece of information, the field device transmits to the terminal the executable certificate data appropriate for the terminal or its operating system. Consequently, the method can be implemented with different operating system types and versions.

[0016] Advantageously, in response to receiving the at least one piece of information about the operating system of the terminal, the field device selects the executable certificate data to be transmitted to the terminal from a data memory of the field device based on the at least one piece of information. For example, the field device can keep available multiple variations of the executable certificate data. For example, depending on the type and / or version of the operating system, the appropriate variation of the executable certificate data matching the terminal is loaded from the data memory and transmitted to the terminal.

[0017] In the present invention, the field device may be configured to receive the executable certificate data from a remote station and store the latter. The field device can store the received executable certificate data, for example, in its internal data memory. The executable certificate data is then available for later use. Preferably, the field device receives multiple variations of the executable certificate data and stores the latter. In principle, the remote station can be any device capable of communicating with the field device using the field device's network interface. Preferably, the remote station is an update server, for example, an update server provided by the field device's manufacturer. However, it may also be any other server, computer, or similar entity. The executable certificate data is preferably encrypted by the remote station and transmitted to the field device. It is particularly preferred that the field device authenticates the remote station in advance to ensure a sufficient level of security.

[0018] In response to receiving the at least one information item related to the operating system of the terminal, the field device generates executable certificate data so that the digital certificate is suitable for installation on the operating system of the terminal. According to this variant of the present invention, the field device does not access the stored executable certificate data, but generates the latter as needed. Specifically, generating may be understood to mean that the digital certificate is appropriately combined with the executable instructions. According to this variant of the present invention, the executable instructions can be generated or adjusted so that the digital certificate is suitable for installation on the operating system of the terminal. This may be particularly useful considering the different characteristics of operating system variations, since it is not always possible to keep all necessary variations of the executable certificate data available in the data memory of the field device. In this case, the field device can generate the executable certificate data depending on the operating system of the terminal. According to the present invention, the field device can store the generated executable certificate data for further use at a later date. The generation of the executable certificate data is considered to exist even if an existing program pattern of the executable certificate data is simply adjusted, for example, by changing a stored installation path, adjusting a version number, an identifier, or other adjustments.

[0019] Preferably, when implementing the method, the field device receives the digital certificate from the remote station, the executable certificate data is generated by the field device, and the executable certificate data is stored by the field device. According to this embodiment, the field device receives only the digital certificate from the remote station. This requires the field device to generate the executable certificate data. According to the present invention, this can be done by combining the digital certificate with the executable instructions.

[0020] According to another advantageous embodiment of the invention, the executable certificate data is included in an executable file. As a result, a single executable file can be provided to the user, who only needs to run the latter. In this case, the user does not need to manipulate or download multiple files, for example, from the field device. Alternatively, the executable instructions and the digital certificate may be stored in some other type of file rather than an executable file. According to the invention, the data can be stored in a container file, in particular a compressed container file, for example a ZIP archive, which constitutes the executable certificate data.

[0021] According to one possible variant of the invention, the file is an executable binary file. For example, an executable .EXE or .MSI file can be provided for a Windows operating system. Other examples of executable binary files are ELF format files for GNU / Linux operating systems and Mach-O format files for macOS operating systems. The binary file can contain both the executable instructions and the digital certificate.

[0022] Alternatively, the file may be a script file. Script files are characterized by being executed by an interpreter. Examples include PowerShell scripts in Windows and Shell scripts in Linux and macOS. In principle, script files can be obtained as easily as binary files, and therefore in most cases have no drawbacks in terms of user friendliness. However, script files have the advantage that they can be generated or modified relatively easily, since binary code usually does not need to be generated or modified. As a result, they are particularly suitable for generation via the field device. The script file may include the executable instructions (preferably executable script lines) as well as the digital certificate (preferably with the executable instructions embedded in the form of accessible text data).

[0023] When executing the executable certificate data, the terminal preferably at least generates a user query to switch the terminal to administrator mode if the terminal is not in administrator mode, and switches the terminal to the administrator mode and copies the digital certificate to a certificate memory of the terminal if a user input is made to the terminal in response to the user query and the input authorizes switching to the administrator mode. If the terminal is already in the administrator mode, it is only necessary to copy the digital certificate to the certificate memory of the terminal.

[0024] To be able to install the digital certificate, the operating system must be in the administrator mode. The administrator mode has a broader range of privileges. In particular, this may involve privileges required to change system and / or operating system settings. In many cases, the digital certificate cannot be installed without administrator privileges. The above procedure is preferably performed to first generate a user inquiry to switch to the administrator mode if the operating system is not in the administrator mode. In this case, for example, the user of the terminal is prompted to switch to the administrator mode so that the executable certificate data can be executed. For example, a prompt for entering an administrator password can be displayed to the user.

[0025] After switching to the administrator mode, the digital certificate is installed. This is preferably done by copying the digital certificate to the certificate memory of the operating system. This may, for example, involve a file path for storing the operating system's digital certificate. An application on the terminal, such as a web browser, accesses the file path and reads the digital certificate installed in the operating system. If the operating system is already in the administrator mode, no user prompting for switching to the administrator mode is necessary, and the digital certificate is preferably copied directly to the certificate memory. Within the framework of the method according to the invention, the executable certificate data may also include additional instructions, for example, for outputting information to the user of the terminal or for requesting from the user information necessary to install the digital certificate on the terminal.

[0026] Preferably, after the digital certificate is installed in the terminal, the terminal transmits an inquiry to the field device to establish a connection via the secure data transfer protocol, the field device receives the inquiry to establish a connection via the secure data transfer protocol, the field device transmits authentication data to the terminal, the terminal verifies the authentication data based on the digital certificate, and if the verification is successful, the terminal and the field device communicate via the secure data transfer protocol. After the digital certificate is installed in the terminal, communication can be performed between the terminal and the field device via the secure data transfer protocol.

[0027] To initiate the communication process, the terminal sends a query to the field device to establish a corresponding secure connection. The field device then sends the authentication data to the terminal. For example, the authentication data may include the digital certificate and other data that allows authentication of the field device based on the digital certificate stored on the terminal. For example, authentication may be based on a cryptographic key and / or a cryptographic signature.

[0028] According to an advantageous embodiment of the invention, the secure transfer protocol is the HTTPS protocol. The HTTPS protocol is an Internet communication protocol that allows for encrypted data transmission and also allows for authentication of the communication participants. However, the secure transfer protocol may also be any other data transfer protocol that allows both encryption and authentication. Preferably, the digital certificate is a digital certificate according to the X.509 standard. The X.509 standard is an ITU-T standard for generating digital certificates. However, according to the invention, it is also possible to use different digital certificates.

[0029] Another aspect of the present invention is a field device including a sensor for acquiring measurement values, a network interface, and a data processing device, the data processing device enabling the field device to operate using the network interface via a secure data transfer protocol, the data processing device being further configured to receive a query from a terminal to transmit, using the network interface, a digital certificate assigned to the field device and provided for verifying authenticity of the field device during communication with the field device via the secure data transfer protocol, the data processing device being further configured, in response to receiving the query to transmit the digital certificate, to the terminal via the network interface, executable certificate data, the executable certificate data including executable instructions and a digital certificate.

[0030] As a result, the field device according to the present invention can be used in combination with the method described above. The field device may have all the features already described above for the field device. According to the present invention, the field device may be suitable for measuring fill levels, point levels, pressure, or other measured values. For example, the network interface may be an Ethernet interface or a WLAN interface. However, other network interfaces, such as a two-wire interface, may also be used. The option for operating the field device via the network interface is preferably implemented by a web server application installed on the field device. The latter preferably provides options for configuring the field device and / or retrieving the field device data. According to the present invention, a user interface of the field device accessible via a web browser can be provided for this purpose. According to the present invention, the data processing device may be a microcontroller, an embedded computer, or another computer or other computing unit of the field device. Preferably, the data processing device is connected to the sensor and / or the network interface of the field device. According to the present invention, the field device may have a data memory, which is preferably connected to the data processing device.

[0031] According to an advantageous embodiment of the present invention, the field device can receive at least one information item related to the operating system of the terminal via a network interface of the field device, and the data processing device can be configured to prompt the field device via the network interface to transmit executable certificate data compatible with the operating system of the terminal to the terminal.

[0032] According to an advantageous embodiment, the field device, in response to receiving the at least one information item relating to the operating system of the terminal, selects from a data memory of the field device the executable certificate data to be sent to the terminal based on the at least one information item for sending to the terminal. According to the invention, this can be performed by a data processing device.

[0033] The field device may be further configured to receive the executable certificate data from a remote station via the network interface. In particular, the data processing device may be configured to store the executable certificate data received from the remote station in a data memory of the field device. Furthermore, it is advantageous if the field device is configured to generate executable certificate data in response to receiving the at least one information item related to the operating system of the terminal, so that the certificate is suitable for installation in the operating system of the terminal. The certificate data is preferably generated by a data processing device of the field device.

[0034] Preferably, the field device is configured to receive the digital certificate via the network interface, in particular to generate executable certificate data by the data processing device of the field device, and to store the executable certificate data in the data memory of the field device. The executable certificate data according to the present invention may be included in an executable file, which of course is an executable binary file or a script file according to an embodiment of the present invention.

[0035] The field device may be further configured to receive the inquiry for establishing a connection via the secure data transfer protocol. This is preferably performed via the network interface of the field device. The field device may be configured to transmit authentication data to the terminal in response to receiving the inquiry. Thereafter, if the authentication data is successfully verified by the terminal, communication can be performed between the terminal and the field device via the secure data transfer protocol. According to the present invention, the secure data transfer protocol may be the HTTPS protocol. According to the present invention, the digital certificate may be an X.509 certificate.

[0036] Another aspect of the present invention proposes a computer-implemented method executed in a field device having a network interface. The computer-implemented method is configured to receive, from a terminal, a query to transmit, using the network interface, at least a digital certificate assigned to the field device and provided for verifying the authenticity of the field device during communication with the field device via the secure data transfer protocol, and in response to receiving the query to transmit the digital certificate, initiate transmission of executable certificate data, the executable certificate data including executable instructions and the digital certificate, to the terminal via the network interface. The method is preferably implemented by the data processing device of the field device. According to the present invention, the computer-implemented method can be implemented with any modifications to achieve the functions of the field device described above. [Brief explanation of the drawings]

[0037] Examples of the invention will now be described with reference to the following drawings. [Figure 1]FIG. 1 is a schematic diagram of a field device and a terminal. [Figure 2] FIG. 2 is a sequence diagram for starting operation of a digital certificate of a field device on a terminal. [Figure 3] FIG. 3 is a schematic diagram of executable certificate data. DETAILED DESCRIPTION OF THE INVENTION

[0038] FIG. 1 is a schematic diagram of a field device 1 and a terminal 2. The field device 1 has a sensor 3 that measures pressure. The sensor 3 is connected to a data processing unit 4 that can store and evaluate the measurements taken by the sensor 3. The data processing unit 4 is a powerful microcontroller running a web server application. The data processing unit 4 is further connected to a network interface 5 of the field device 1. The web server application provides a user interface for the field device 1. The terminal 2 can access the user interface via a network connection 6, which allows the field device 1 to be configured. The field device 1 further comprises a data memory 7 connected to the data processing unit 4 of the field device 1.

[0039] 2 is a sequence diagram for starting operation of the digital certificate of the field device 1 on the terminal 2. In the first step, the terminal 2 sends a certificate query 8 to transmit the digital certificate to the field device 1 via a network connection. The certificate query 8 is triggered when the user of the terminal 2 presses a field for downloading the certificate in a user interface provided by the field device 1 via a network interface. If the user selects an operating system for the terminal 2 in advance in the user interface of the field device 1, the certificate query 8 also includes information related to the operating system.

[0040] After receiving the certificate query 8 and the information about the operating system of the terminal 2, the data processing unit of the field device 1 generates executable certificate data. The executable certificate data includes executable instructions as well as the digital certificate of the terminal 2. The field device 1 generates the executable instructions in a manner suitable for execution on the terminal 2. For this purpose, the information about the operating system of the terminal 2 is evaluated. To generate the executable certificate data, the digital certificate is read from the data memory of the field device 1. The field device 1 initiates an instruction transmission 9, and the executable certificate data is sent to the terminal 2. The certificate query 8 and the instruction transmission 9 are performed via the HTTP protocol.

[0041] The terminal 2 receives the executable certificate data. The user starts executing the executable certificate data on the terminal 2, which results in the installation of the digital certificate on the terminal 2. In this process, the digital certificate is copied to the certificate memory of the terminal 2. This allows an HTTPS connection to be established between the field device 1 and the terminal 2. To do this, the terminal 2 makes a connection inquiry 10 to the field device 1, which starts initialization of the HTTPS protocol. After receiving the connection inquiry 10, the field device 1 starts certificate transmission 11 to the terminal 2, and the field device 1 sends the digital certificate to the terminal 2. In this way, the field device 2 compares the digital certificate stored in its certificate memory with the acquired digital certificate to verify the digital certificate. This authenticates the field device 1. Steps not described here follow, and the initialization of the HTTPS protocol is completed. Encrypted communication is then performed between the field device 1 and the terminal 2 via the HTTPS protocol.

[0042] Figure 3 is a schematic diagram of executable certificate data 12. The executable certificate data 12 consists of a script file containing a digital certificate 13. In addition to the digital certificate 13, the script file also contains executable instructions 14. When the executable certificate data 12 is obtained at a terminal, the executable instructions 14 are executed, which causes the digital certificate 13 to be copied into the terminal's certificate memory. Reference Symbol List

[0043] 1 Field Device 2. Terminal 3 sensors 4 Data Processing Device 5 Network Interface 6 Network Connection 7 Data Memory 8 Certificate Inquiry 9. Sending instructions 10 Connection inquiry 11 Sending the certificate 12 Executable Certificate Data 13 Digital Certificates 14 Executable Instructions

Claims

1. 1. A method for activating a digital certificate (13) of a field device (1) in a terminal (2), the digital certificate (13) being assigned to the field device (1) and serving to verify the authenticity of the field device (1) during communication with the field device (1) via a secure data transfer protocol, the method comprising: sending a query to the field device (1) via the terminal (2) requesting the transmission of the digital certificate (13); receiving a query by said field device (1) to transmit said digital certificate (13); transmitting executable certificate data (12) to the terminal (2) via the field device (1) in response to receiving a query to transmit the digital certificate (13), the executable certificate data (12) including executable instructions (14) and the digital certificate (13); receiving the executable certificate data (12) at the terminal (2); After the executable certificate data (12) is received by the terminal (2), executing the executable certificate data (12) on the terminal (2) and installing the digital certificate (13) on the terminal (2) as a result.

2. 10. The method of claim 1, The method further comprises: transmitting at least one piece of information relating to an operating system of the terminal (2) from the terminal (2) to the field device (1); The field device (1) receives the at least one piece of information relating to an operating system of the terminal (2), the executable certificate data (12) transmitted by the field device (1) to the terminal (2) is adapted to the operating system of the terminal (2); It is characterized by:

3. 3. The method of claim 2, In response to receiving the at least one piece of information related to the operating system of the terminal, the field device (1) selects the executable certificate data (12) to be transmitted to the terminal (2) from a data memory (7) of the field device (1) based on the at least one piece of information for transmission to the terminal (2). It is characterized by:

4. 10. A method according to claim 1, comprising: The method further comprises: said field device (1) receiving said executable certificate data (12) from a remote station; The field device (1) stores the executable certificate data (12). It is characterized by:

5. 3. The method of claim 2, the field device (1) generates executable certificate data (12) in response to receiving the at least one information related to the operating system of the terminal (2), such that the certificate (13) is suitable for installation on the operating system of the terminal (2); It is characterized by:

6. 10. The method of claim 1 or 2, or claim 5, The method further comprises: said field device (1) receiving said digital certificate (13) from a remote station; The field device (1) generates the executable certificate data (12); The field device (1) stores the executable certificate data (12). It is characterized by:

7. 10. A method according to claim 1, comprising: The executable certificate data (12) is contained in an executable file. It is characterized by:

8. 8. The method of claim 7, the file is an executable binary file, It is characterized by:

9. 8. The method of claim 7, The file is a script file. It is characterized by:

10. 10. A method according to claim 1, comprising: The terminal (2) executes the executable certificate data (12) by at least If the terminal (2) is not in administrator mode, a query to a user is generated to switch the terminal (2) to administrator mode, and if the user inputs into the terminal (2) in response to the query to the user, and the input permits switching to the administrator mode, Switch the terminal (2) to the administrator mode, copying said digital certificate (13) into a certificate memory of said terminal (2); copying said digital certificate (13) to a certificate memory of said terminal (2) if said terminal (2) is already in said administrator mode; It is characterized by:

11. 10. A method according to claim 1, comprising: The method further comprises: After the digital certificate (13) is installed in the terminal (2), the terminal (2) sends an inquiry to the field device (1) to establish a connection via the secure data transfer protocol; the field device (1) receiving the inquiry for establishing a connection via the secure data transfer protocol; The field device (1) transmits authentication data to the terminal (2); the terminal (2) verifies the authentication data based on the digital certificate (13); If the verification is successful, the terminal (2) and the field device (1) communicate via a secure data transfer protocol. It is characterized by:

12. 10. A method according to claim 1, comprising: The secure data transfer protocol is the HTTPS protocol. It is characterized by:

13. 10. A method according to claim 1, comprising: The digital certificate (13) is an X.509 certificate. It is characterized by:

14. A field device (1) comprising a sensor (3) for acquiring measurements, a network interface (5) and a data processing device (4), the data processing device (4) enabling the field device (1) to be operated using the network interface (5) via a secure data transfer protocol, the data processing device (4) further comprising: receiving a query from a terminal (2) using the network interface (5) to transmit a digital certificate (13) assigned to the field device (1) and provided for verifying authenticity of the field device (1) during communication with the field device (1) via the secure data transfer protocol; and configured to, in response to receiving a query to transmit the digital certificate (13), transmit executable certificate data (12) to the terminal (2) via the network interface (5), the executable certificate data (12) including executable instructions (14) and the digital certificate (13). It is characterized by:

15. A computer-implemented method executed in a field device (1) having a network interface (5), comprising: receiving a query from a terminal (2) using the network interface (5) to transmit a digital certificate (13) assigned to the field device (1) and provided for verifying authenticity of the field device (1) during communication with the field device (1) via the secure data transfer protocol; and in response to receiving a query to transmit the digital certificate (13), transmitting executable certificate data (12) to the terminal (2) via the network interface (5), the executable certificate data (12) including executable instructions (14) and the digital certificate (13). It is characterized by:

Images