Method for logging in authorized users to equipment, particularly equipment for power plants, and power plants equipped with the equipment

Abstract

The present application relates to a method for logging a user 14 into a device 10 by a service gateway 12, where the access authorization of the user 14 for the device 10 is stored in the service gateway 12, the method comprising the steps of authenticating the user 14 at the service gateway 12, sending a device access request by the user 14 to the service gateway 12 specifying an identifier of the device 10, and comparing the device secret stored in the service gateway 12 with a copy of the device secret stored in the device 10 via the SRP protocol, the comparison being performed via a data connection between an access device 16 of the user 14 and the service gateway 12 and a data connection between the access device 16 and the device 10. If the comparison is successful, a session key is agreed between the device 10 and the service gateway 12. The present application further relates to a power plant.

Description

[Technical Field]

[0001] The present application relates to a method for logging in authorized users to equipment, in particular equipment for power plants, and to power plants. [Background technology]

[0002] The power plant may have a communications interface that allows remote access to the power plant's equipment via a data connection (e.g., via the Internet). This type of data connection may be used, for example, by a power plant service technician to, for example, perform remote maintenance of the power plant.

[0003] The SRP protocol (SRP: Secure Remote Password) is an authentication and key agreement method for authenticating peers. The peers agree on a session key that protects the communication session between them. The session key itself is never transmitted between the peers.

[0004] Document DE102006007793B3 discloses an access method for a user in which authentication of the user is performed via a detour to a gateway which, once authentication is complete, forwards the user to the target device. Document DE10 2019 131 745 A1 further shows a method for setting up a secure connection between a microcontroller and a network computer using digital certificates. Summary of the Invention

[0005] The object of the present invention is to secure access, in particular remote access, via a data connection to equipment, in particular equipment for power plants.

[0006] This object is achieved by a method having the features of patent claim 1 and by a power plant having the features of patent claim 15. Preferred embodiments are set out in the dependent patent claims.

[0007] In a method for allowing an authorized user to log into equipment, particularly equipment for a power plant, by a service gateway, the user's access authorization for the equipment is stored in the service gateway. authenticating the user at the service gateway; sending a device access request by a user to a service gateway by specifying an identifier of the device; and comparing the device secret stored on the service gateway with a copy of the device secret stored on the device via the SRP protocol. The comparison is performed via a data connection between the user's access device and the service gateway, and via a data connection between the user's access device and the device. If the comparison is successful, a session key is agreed between the device and the service gateway via the SRP protocol, and the user is logged in to the device.

[0008] In contrast to the method using the SRP protocol, which has exactly two communication parties, this method is implemented here using three communication parties (the device, the service gateway, and the user's access device).

[0009] This method allows a person (e.g., a service technician) to be provided with tamper-proof access to a device by logging in to a service gateway where the device is registered, preferably together with a number of other devices. This can be done without the need to perform an individual authentication of the user directly on the device, for example using device-specific login data. It is even possible to perform the method without a direct connection between the service gateway and the device. Multiple devices can be registered to the service gateway. No data is exchanged here that subsequently authorizes or facilitates access to the device by unauthorized users.

[0010] In the case of equipment for a power plant, the equipment may be, for example, a controller or an inverter of the power plant, and the service gateway may be provided by the power plant operator and / or by the manufacturer of the controller or inverter and / or by a service provider that provides, for example, remote maintenance.

[0011] In particular, it can prevent manipulation by variants of the following attacks, among others: - Interception of data communications. -Tampering with transmitted data. Repeated playback of recorded data. -Simulation of false identities of communication partners using collected data. · Misuse any data collected by users, even during permitted use.

[0012] The SRP protocol allows for the secure agreement (in particular, the common generation) of a session key after the serving gateway provides proof of possession of the device secret to a device that possesses a copy of the device secret. The serving gateway can be at least unilaterally authenticated on the device by this proof of possession of the device secret. It is conceivable, but not required, for the device to provide the serving gateway with proof of possession of a copy of the device secret. Instead, only the request and the response to the request are exchanged for comparison, which at least allows the device to recognize that the serving gateway possesses the device secret. Here, it is not possible to infer the device secret or its copy from the exchanged information.

[0013] Furthermore, neither the agreed session key nor any part of it is transmitted during session key agreement. Instead, only information indicating how the session key is generated is exchanged for session key agreement, for example by referencing the contents of the device secret or a copy thereof. The session key is then generated independently and with the same result at the device and the service gateway. Proof of possession of the secret and session key agreement can be performed sequentially or together.

[0014] Preferably, the device secret exists only once in the service gateway. It is used to generate a (preferably device-specific) copy of the device secret that is then stored in the device. As a result, using the SRP protocol, no one can impersonate the service gateway with respect to the device, even if the copy is compromised. The copy of the device secret is uniquely generated from the device secret by a mathematical method, and the device secret cannot be derived from the copy of the device secret using known mathematical methods. Nevertheless, using the SRP protocol, the owner of the copy can check whether the communicating party also possesses the device secret that generated the copy, without the owner of the copy himself having to know this device secret. However, it does not exclude that the copy is an exact replica of the device secret, even though this makes the method less secure.

[0015] Preferably, the session key forms the basis of symmetric encryption, where the session key is used for both encryption and decryption. Other ways of using the session key to secure the session between the device and the service gateway are possible as well.

[0016] It is also conceivable that the session key contains information about the scope of the user's access authorization. Access via the agreed session key can then be restricted according to the access authorization information contained therein. This allows for the management of user authorizations on the device via the service gateway. The information can then be integrated into the session key negotiated using the SRP protocol, for example, by negotiating session keys for various user authorization models, but only the session key that matches the user's access authorization is sent from the service gateway to the user. Alternatively, it is of course possible to manage user authorizations on the device itself.

[0017] The device, the service gateway, and the user's access device are preferably located at locations remote from each other, so that the user's remote access to the device can be provided by using the service gateway.

[0018] However, for added security, it may be necessary to establish a data connection between the user and the device via a connection that has a highly spatially limited range (e.g., via a wireless link such as Near Field Communication (NFC), Bluetooth, or Zigbee).

[0019] In one embodiment, the method also comprises: transmitting a session key from the serving gateway to the user's access device, preferably via an encrypted and authenticated communication connection, as long as the user's authorization is stored in the serving gateway; and the user accessing the device using the session key. Thus, once authorization and authentication is complete, the session key is sent from the service gateway to the user's access device. Further communication then takes place directly between the user's access device and the device using the session key.

[0020] The authorization of a user at the service gateway can be defined, for example, based on the characteristics of the user's access device (in particular the device's serial number, further characteristics of the device type). A new user or a new access device can be registered at the service gateway and access rights can be granted, for example, to the device, for example according to the Four-Eyes Principle.

[0021] In one embodiment of the method, the user determines the identifier of the device by querying the device via a data connection between the user's access device and the device.

[0022] In one embodiment of the method, the device secret is stored in a database of the service gateway. A copy of the device secret can be generated during manufacturing of the device, the copy of the device secret can be stored on the device, and the device secret itself can be stored in the database of the service gateway. Alternatively or additionally, a copy of the device secret can be generated from a device secret stored in the service gateway during a software update of the device, the copy of the device secret can be stored on the device, and the device secret itself can be stored in the service gateway, in particular in the database of the service gateway.

[0023] In one embodiment, authentication of a user at a service gateway includes a check to determine whether the number of access requests made within a given period of time exceeds a maximum number. Alternatively or additionally, authentication of a user at a service gateway includes two-factor authentication of the user. User logins and all activity at the device and / or service gateway during authentication and authorization can be recorded and monitored. The number of user authentications allowed on a device can be limited with reference to a time segment (e.g., day, month, year).

[0024] In one embodiment of the method, the data connection between the user's access device and the service gateway and / or the data connection between the user's access device and the device is set up via an encrypted and authenticated TLS connection using a cipher suite that ensures Perfect Forward Secrecy, thereby further increasing the security of the method.

[0025] In one embodiment of the method, the equipment is a power plant equipment, in particular a power plant controller and / or inverter. For this type of equipment, following successful login of the user to the equipment, the method comprises: reading historical data of power generation of the power plant; reading the parameters of the power generation of the power plant; and / or The step of changing a parameter of the power generation of the power plant is included.

[0026] In one embodiment of the method, the parameters are modified in response to historical data, which allows, for example, the parameters to be adjusted in response to local conditions at the power plant that are derived from the historical data.

[0027] In one embodiment of the method, the parameters are changed in response to data received from the equipment via a data connection between the user's access equipment and the equipment, allowing the parameters to be adjusted externally, for example, by a power plant operator.

[0028] In one embodiment of the method, the historical data is transmitted from the equipment over a data connection between the user's access equipment and the equipment, so that, for example, a power plant operator can centrally consolidate the historical data.

[0029] The power plant includes equipment having a copy of an equipment secret stored therein, the copy of the equipment secret having been generated using the equipment secret of the equipment, the equipment being configured and designed to be able to compare the copy of the equipment secret stored on the equipment with a remotely stored equipment secret via an SRP protocol, and the equipment being designed to allow a user to log in to the equipment via the SRP protocol if the comparison is successful. [Brief explanation of the drawings]

[0030] The present invention will now be described with reference to the drawings.

[0031] [Figure 1] 1 illustrates one embodiment of a method for an authorized user to access a device. [Figure 2] 1 shows a schematic diagram of a communication link between communication parties for implementing an access method; DETAILED DESCRIPTION OF THE INVENTION

[0032] Using reference numbers from Figure 2, an exemplary embodiment of a method for logging an authorized user 14 into a device 10 is shown in Figure 1. The method is performed by a service gateway 12 in which the user's 14 access authorization for the device 10 is stored. The method includes: S1) authenticating a user 14 at a service gateway 12; S2) A step in which the user 14 specifies an identifier of the device 10 and transmits a device access request to the service gateway 12; S3) Comparing the device secret stored in the service gateway 12 with a copy of the device secret generated using the device secret and stored in the device 10 via the SRP protocol, the comparison being performed via a data connection between the access device 16 of the user 14 and the service gateway 12 and a data connection between the access device 16 of the user 14 and the device 10.

[0033] Following a successful comparison (path "+"), steps S4) and S5) are executed. S4) A session key is agreed between the device 10 and the service gateway 12. S5) The user 14 logs into the device 10 via the SRP protocol.

[0034] According to the SRP protocol, the device secret or a copy of the device secret is not transmitted over the data connection, and only test queries are exchanged and answered between the device 10 and the service gateway 12. This corresponds to the so-called "zero-knowledge method."

[0035] The device secret can be stored, for example, in the database DB of the service gateway 12. A copy of the device secret can be generated during the manufacture of the device 10, and the copy of the device secret can be stored in the device 10, and the device secret itself can be stored in the database DB of the service gateway. Alternatively or additionally, a copy of the device secret can be generated from the device secret during a software update of the device 10, and the copy of the device secret can be stored in the device 10, and the device secret itself can be stored in the service gateway 12 (particularly in the database DB of the service gateway 12). The device secret can be generated individually for each device and stored in the database DB, or the same device secret is stored in the database DB and used for multiple devices or all devices. If the same device secret is used for multiple devices, the generation of the copy of the device secret can instead be individualized.

[0036] Equipment 10, service gateway 12, and user 14 are shown in Figure 2. User 14 establishes a data connection (e.g., via the Internet) through access equipment 16. Equipment 10 is part of a power plant 20 operated by an operator. Person 18 (which may be, for example, the operator of power plant 20 or the owner of the power plant) grants user 14 access (i.e., authorization) to equipment 10 by action 1. User 14 thus becomes an authorized user 14.

[0037] Authentication (preferably two-factor authentication) of the user 14 on the service gateway 12 is performed in operation 2. The login data (i.e., authentication) is checked by the service gateway 12 in operation 3, and in case of approval, positive feedback is sent to the access device 16 of the user 14. Thus, step S1) of FIG. 1 may include operations 1, 2, and 3.

[0038] In operation 4, the user 14 requests access to the device 10 from the service gateway 12. The device 10 can be identified, for example, based on its serial number. The service gateway 12 checks the authorization of the user 14 to access the device 10. Operation 4 therefore corresponds to step S2) in FIG. 1.

[0039] In operation 4a, the service gateway 12 requests the device secret 12 in the database DB (eg, using the device serial number 10). In operation 4b, the device secret is returned from the database DB to the service gateway 12.

[0040] In operation 5, the service gateway 12 is authenticated on the device 10 using the SRP protocol. The device secret is now checked, i.e. a check is performed on the device based on its copy of the device secret to determine whether the device secret is present on the service gateway 12. As shown in Figure 2, the authentication is performed via two-stage communication: from the service gateway 12 to the access device 16 and from the access device 16 to the device 10. Operation 5 therefore corresponds to step S3) in Figure 1.

[0041] In the case of approval, a session key is negotiated in operation 6. As shown in Figure 2, this negotiation takes place via a two-stage communication from the device 10 to the access device 16 and from the access device 16 to the service gateway 12. The session key is calculated simultaneously in the device and in the service gateway. The session key is not transmitted. Thus, operation 6 corresponds to step S4) in Figure 1.

[0042] In operation 7, the session key is transmitted to the access device 16 of the user 14. Operation 8 indicates further communication directly between the access device 16 of the user 14 and the device 10 using the session key. Thus, step S5) of FIG. 1 may include operation 7 and operation 8. [Explanation of symbols]

[0043] 1, 2, 3, 4, 4a, 4b, 5, 6, 7, 8 operations 10 equipment 12 Service Gateway 14 users 16 Access Equipment 18 people 20 Power Plant DB Database S1, S2, S3, S4, S5 method steps

Claims

1. A method for logging an authorized user (14) into equipment (10), in particular equipment (20) for a power plant (10), by a service gateway (12), wherein the access authorization of the user (14) to the equipment (10) is stored in the service gateway (12), comprising: authenticating the user (14) at the service gateway (12); sending a device access request by the user (14) to the service gateway (12) specifying an identifier of the device (10); comparing a device secret stored in the service gateway (12) with a copy of the device secret generated using the device secret and stored in the device (10) via an SRP protocol, the comparison being performed via a data connection between an access device (16) of the user (14) and the service gateway (12) and a data connection between the access device (16) of the user (14) and the device (10); If the comparison is successful, a session key is agreed between the device (10) and the service gateway (12) via the SRP protocol; The method wherein the user (14) logs into the device (10).

2. transmitting said session key from said Service Gateway (12) to said access device (16) of said user (14) as long as said user's (14) authorization is stored in said Service Gateway (12); and b) the user accessing the device using the session key.

3. 3. The method of claim 1, wherein the user determines the identifier of the device by querying the device via the data connection between the access device of the user and the device.

4. 3. The method according to claim 1, wherein transmission of the agreed session key between the service gateway (12) and the device (10) is avoided.

5. 3. The method of claim 1, wherein the copy of the device secret is generated during manufacturing of the device and stored on the device, and the device secret is stored in a database of the service gateway.

6. 3. The method according to claim 1, wherein the copy of the device secret is generated from a newly generated device secret at the service gateway during a software update of the device, the copy of the newly generated device secret being stored in the device, and the newly generated device secret itself being stored in the service gateway.

7. 3. The method of claim 1, wherein the authentication of the user (14) includes a check to determine whether the number of access requests made within a given period of time exceeds a maximum number.

8. The method of claim 1 or 2, wherein the authentication of the user at the service gateway includes two-factor authentication of the user.

9. 3. The method of claim 1, wherein the data connection between the access device of the user and the service gateway and / or the data connection between the access device of the user and the device is established via an encrypted and authenticated TLS connection using a cipher suite that ensures Perfect Forward Secrecy.

10. The method of claim 1 or 2, wherein the equipment (10) is equipment (10) for a power plant (20).

11. Following successful login of the user (14) to the device (10), the method comprises: reading historical data of the power generation amount of the power plant (20); reading the parameters of the power generation of said power plant (20); and / or The method of claim 10, comprising modifying the parameters of the power generation of the power plant (20).

12. The method of claim 11 , wherein the parameters are changed in response to the historical data.

13. 12. The method of claim 11, wherein the parameters are changed in response to data received from the device via the data connection between the access device of the user and the device.

14. 12. The method of claim 11, wherein the historical data is transmitted from the device (10) via the data connection between the access device (16) of the user (14) and the device (10).

Images