Method and apparatus for checking the conformity of a communication device

Abstract

In order to provide a method for checking the conformity of a communication device (A) to a communication protocol (KP), said method being more efficient than the known prior art, a device model (GM) of a specified model class for describing the communication device (A) is determined from a specified sequence of excitation signals (AS) for exciting the communication device (A) and from a captured sequence of response signals (RS) of the communication device (A), a specification model (SM) of the same model class for describing the communication protocol (KP) is determined from a specification of the communication protocol (KP), and a degree of conformity (KG) for describing the conformity of the communication device (A) to the communication protocol (KP) is ascertained by comparing the specification model (SM) with the device model (GM).

Description

[0001] Method and apparatus for conformity testing of a communication device

[0002] The present invention relates to a method for testing the conformity of a communication device with a communication protocol, comprising the steps

[0003] - Specifying a sequence of excitation signals corresponding to the communication protocol,

[0004] - transmitting the sequence of excitation signals to the communication device via a communication medium, so that the communication device emits a sequence of response signals via the communication medium in response to the sequence of response signals,

[0005] - Detecting the sequence of response signals emitted by the communication device.

[0006] Furthermore, the invention relates to a device for testing the conformity of a communication device with a communication protocol, comprising

[0007] - a computing unit for specifying a sequence of excitation signals corresponding to the communication protocol,

[0008] - an adapter connected to the computing unit for transmitting the sequence of excitation signals to the communication device via a communication medium, so that the communication device emits a sequence of response signals via the communication medium in response to the sequence of response signals, for detecting the sequence of response signals emitted by the communication device, and for transmitting the detected sequence of response signals to the computing unit.

[0009] Due to the openness, diversity, complexity, and range of modern communication devices, the development, standardization, and description of standardized communication protocols is of great importance. In particular, to ensure secure and robust communication between different communication devices, especially between communication devices from different manufacturers, increasingly complex and comprehensive communication protocols are being developed and specified. For example, the NFC communication protocol defined in ISO / IEC 14443-3 for NFC applications ("near-field communication") is one use case among many others.

[0010] On the one hand, communication protocols and their specifications must be taken into account when designing and implementing communication devices. On the other hand, it is necessary to comprehensively test the conformity of finished communication devices with the relevant communication protocols. For such tests, which are referred to in the relevant literature as "conformity testing" or "conformity checking," various approaches are known from the prior art, e.g., from EP 1 063 828 B1, WO 1998 / 012852 A1, or DE 10 2021 209 493 A1.

[0011] What the cited approaches have in common is that a large number of sometimes heterogeneous test scenarios must always be processed in order to make a well-founded judgment about the conformity of a communication device with a given communication protocol. This is particularly pronounced in modern and security-critical applications, such as NFC bank cards, NFC passports, or NFC car keys. Due to the scope and heterogeneity of the test scenarios to be implemented, it has previously been necessary in many practical cases to provide comprehensive manual support for conformity tests, e.g., by a trained operator or test technician who initiates tests related to the respective test scenarios, adapts test setups appropriately, and manages and evaluates recorded measurement data.The obvious disadvantage is that this type of testing, combined with increasingly complex testing tasks and a growing number of communication devices to be tested, results in high effort and costs, high error probabilities, and overall poor scalability. The current state of the art does not offer any approaches that would enable comprehensive and, in particular, automated conformity testing, especially in the area of ​​NFC communication, which is relevant in current practice.

[0012] It is therefore an object of the present invention to provide a method for comprehensively testing the conformity of a communication device with a communication protocol, in particular for testing the conformity of an N FC communication device with an NFC communication protocol, which is more efficient than the known prior art.

[0013] This object is achieved for a method mentioned at the outset and for a device mentioned at the outset by the features of the characterising elements of the independent claims.

[0014] According to the invention, during the method for testing the conformity of a communication device with a communication protocol, a device model of a predetermined model class for describing the communication device is determined from the predetermined sequence of excitation signals, preferably a sequence of communication words specified in the communication protocol, and from the detected sequence of response signals; a specification model of the same model class for describing the communication protocol is determined from a specification of the communication protocol; and a degree of conformity for describing the conformity of the communication device with the communication protocol is determined by comparing the specification model with the device model. In this way, the invention realizes a whole series of advantageous effects for conformity testing.The invention thus makes it possible to represent specifications of communication protocols using models, which significantly simplifies the comparison of a device with a communication protocol. A key reason for this is that the comparison of models of the same model class is a topic that has already been extensively researched in the relevant scientific literature. The comparison between a device and a specification of a protocol is thus raised to a completely different level, specifically to the level of comparing models, which was previously not possible. Above all, due to the fact that comparing devices with specifications that can sometimes be hundreds of pages long is often complex and difficult to manage, the inventive idea of ​​also representing a specification with a model and subsequently only comparing models represents a decisive advantage in practice.

[0015] A particularly advantageous embodiment of the present invention results from the choice of the class of finite-state machines as the model class, so that the specification model and the device model, for example, can each be determined as a finite-state machine, preferably as a Moore automaton or a Mealy automaton. The particular advantage of choosing this specific model class arises, on the one hand, from the fact that communication protocols can be particularly well represented by finite-state machines, and, on the other hand, from the fact that the determination of such models, known in the literature as automata learning, is also a widely researched field.A number of efficient algorithms are available for creating such models, such as the Classical L*(L*-C) algorithm, the Direct Hypothesis Construction (DHC) algorithm, the Spanning Tree, Discrimination Tree, the Discriminator Tree (TTT) algorithm, the Kearns / Vazirani (KV) algorithm, or the Adaptive Discrimination Tree (ADT) algorithm, which can be used advantageously within the scope of the invention.

[0016] A further advantageous embodiment of the present invention is achieved by specifying a second sequence of excitation signals corresponding to the communication protocol based on the degree of conformity in order to stimulate the communication device for conformity testing once again. This makes it possible to confirm a degree of conformity determined in a first pass, or to re-stimulate certain areas of a communication device under test, or to expand a model, thereby increasing, in particular, the reliability and validity of a statement regarding conformity.

[0017] In order to compare the specification model with the device model, in a further advantageous embodiment of the invention, a sequence of comparison excitation signals can be specified with which the specification model and the device model are excited, and in order to determine the degree of conformity, a comparison can be carried out between a sequence of specification response signals generated by the specification model in response to the sequence of comparison excitation signals and a sequence of model response signals generated by the device model in response to the sequence of comparison excitation signals.In this way, the comparison of a specification model with a device model can sometimes be carried out particularly efficiently, since specific types of excitation signals exist for different model classes. These allow the creation of a comprehensive and detailed representation of a model even with only a brief excitation time, thus enabling a fast, yet comprehensive and detailed comparison. In the field of finite-state machines, well-known methods also exist for this purpose, e.g., conformance checking, such as the bisimulation method or the trace equivalence method.

[0018] A further, particularly advantageous embodiment of the invention results from checking whether the device model matches the communication device before comparing the specification model with the device model, wherein a degree of match between the device model and the communication device is determined, the comparison of the specification model with the device model is carried out when the degree of match reaches a predetermined match threshold, or a further sequence of excitation signals corresponding to the communication protocol is specified in order to excite the communication device once more for the conformity test and to determine a further device model if the degree of match does not reach the predetermined match threshold.In this way, a further increase in efficiency and reliability can be achieved in many cases relevant to practice, since the usually comprehensive comparisons between the specification model and the device model are only carried out once it has been ensured that the device model actually describes the communication device to be tested sufficiently accurately and reliably.

[0019] In a further advantageous embodiment, the computing unit according to the invention can have a learning unit and a mapping unit in order to divide the method steps according to the invention efficiently and in a hardware-optimized manner between the learning unit and a mapping unit.

[0020] The present invention will be explained in more detail below with reference to Figures 1 to 6, which illustrate exemplary, schematic, and non-limiting advantageous embodiments of the invention. Figure 1 shows an exemplary NFC communication system.

[0021] Fig.2 a device for the practical implementation of the invention,

[0022] Fig.3a, 3b two exemplary models in the form of a finite automaton,

[0023] Fig.4 a coupling plan for comparing two models,

[0024] Fig.5 two different, similarly behaving finite automata,

[0025] Fig.6 is a flow chart according to the invention.

[0026] As an important practical example in which the present invention can be advantageously applied, Fig. 1 shows an exemplary NFC communication system with two NFC communication devices communicating with each other, specifically an NFC car key A and an NFC-enabled automobile B, whose car doors can be opened and closed contactlessly using the NFC car key A. For the purpose of opening and closing automobile doors, the NFC car key A is stimulated with excitation signals AS, which usually correspond to a sequence of communication words KW defined in a communication protocol KP, and emits response signals RS in response to the excitation signals AS, which are transmitted to the automobile B.At this point, it should be noted with regard to the NFC communication system under consideration that the application of the invention is by no means limited to NFC communication and can generally be used in the field of RFID communication, as well as in other areas of communication technology, such as mobile communications in general, Bluetooth communication, and technologies such as WPAN, WLAN, etc.

[0027] NFC ("Near-Field Communication") is a widely used communication standard that allows passive communication devices, in particular, to communicate contactlessly with other NFC communication devices located nearby while consuming very little power. To ensure a correctly behaving NFC communication system, the ISO / IEC 1444 standard must be observed in particular. Since NFC is well known from the state of the art and from relevant literature, e.g., from JP 6076521 B2, US 9231 662 B2, US 9497578 B2, etc., NFC-specific implementation details will not be discussed in detail here.

[0028] As mentioned earlier, in communication systems S such as the one shown in Fig. 1, it is crucial to ensure that the communication system S, and thus, as a direct consequence, its components, behave according to a given standard, i.e., according to a given communication protocol KP or a given norm. In the case of the system shown in Fig. 1, consisting of an NFC car key A and an NFC-enabled automobile B, a non-standard-compliant design would entail a multitude of security risks, e.g., the possibility for third parties to gain access to the automobile B or to intercept sensitive data. Since NFC communication is also used outside of the example shown in Fig. 1, in often security-critical chip systems such as bank cards, passports, access systems, etc., which are also typically implemented on weak hardware, a correct, standard-compliant implementation, as well as assurance that the implementation has been carried out according to the standard, is crucial. Especially when communication devices A and B are purchased from third-party providers, it is essential to verify whether the third-party device behaves according to a required standard. As also previously stated, the current state of the art does not offer any approaches to perform such checks efficiently and reproducibly in an automated manner, i.e., avoiding manual assistance.

[0029] The present invention closes this gap, as explained below with reference to Fig. 2, where the NFC car key from Fig. 1 is subjected to a conformity test as communication device A. A communication device A to be tested is also referred to in this context as a device-under-test ("DuT"), system-under-test ("SuT"), device-under-learning ("DuL"), or system-under-learning ("SuL").

[0030] Specifically, Fig. 2 shows a device 1 for testing the conformity of a communication device A, in this case the aforementioned NFC car key A, with a communication protocol KP. The device 1 has a computing unit 2 for specifying a sequence of excitation signals AS corresponding to the communication protocol KP, as well as an adapter 3, which is communicatively connected to the computing unit 2, preferably via a so-called socket connection, for transmitting the sequence of excitation signals AS to the communication device A via a communication medium KM. As in the case shown in Fig. 1, the communication device A emits a sequence of response signals RS via the communication medium KM in response to the sequence of response signals AS.In addition to the ability to transmit excitation signals AS, the adapter 3 is also designed to measure the sequence of response signals RS emitted by the communication device A and to transmit them back to the computing unit 2.

[0031] Possible implementations of a computing unit 2 include microprocessor-based hardware, such as microcontrollers and integrated circuits (ASICs, FPGAs). Various implementation options also exist for the adapter 3 in question, but NFC-capable RFID compact devices, such as the Proxmark3 NFC reader / writer manufactured by Proxmark, have proven particularly advantageous. Such, as well as alternative, implementation variants of an adapter 3 are well known to a person skilled in the field of modern communications technology, so further details will not be discussed here. In the present case of an NFC application, the electromagnetic field acts as the communication medium KM, via which the aforementioned sequence of excitation signals AS is transmitted to the communication device A.In other applications, however, cables or optical fibers could also be used as the communication medium KM.

[0032] According to the invention, the computing unit 2 is designed for the purpose of a conformity test to determine a device model GM of a predetermined model class for describing the communication device A from the predetermined sequence of excitation signals AS and from the detected sequence of response signals RS, to determine a specification model SM of the same model class for describing the communication protocol KP from a specification of the communication protocol KP, and to determine a degree of conformity KG for describing the conformity of the communication device A with the communication protocol KP by comparing the specification model SM with the device model GM.

[0033] The inventive approach is based on the idea that, in order to comply with a standard, a communication device, A, must exhibit behavior defined in that standard. For example, the ISO 14443-3 standard describes expected behavior within the context of the so-called NFC handshake, from which, on the one hand, required responses to inputs and, on the other hand, in particular, a model description of the standard can be derived. Within the scope of the invention, it was recognized in this context that a model can be created from such a specification, which can be compared with a model of a communication device A to be tested for the purpose of a conformity test.According to the above statements, the present invention combines methods of model identification with methods of communication technology as well as with methods of embedded systems in order to provide an efficient and, in particular, largely automatable method for conformity testing.

[0034] The degree of conformity KG according to the invention can, for example, be a scalar within the scope of the invention, which describes, for example, in percent, the extent to which the communication device A to be tested corresponds to the communication protocol KP, i.e., is compliant with it. The degree of conformity KG can also represent a simple yes / no answer, which informs about whether or not conformity with the communication protocol KP exists. The degree of conformity KG can, in particular with more comprehensive communication protocols KP and communication devices KG, also be a more comprehensive protocol of the result of the conformity test, in which it is described in detail, for example, in which areas a learned device model GM has deviations from a specification model SM, and where, as a consequence, there is a need for improvement. In versions with more comprehensive degrees of conformity KG, the degree of conformity KG can, for example,be a vector which, for example, describes deviations for different states described in a communication protocol KP or different attributes described in a communication protocol KP, for example again with a yes-no answer, or with a more fine-grained description of a degree of deviation with respect to a corresponding attribute.

[0035] As mentioned, the described inventive procedure allows the provision of a largely automated toolchain for testing protocol conformity of a communication protocol implemented in a system under test. Compared to prior art methods, the inventive method is more comprehensive, yet can still be processed efficiently. In particular, the fact that a model of the same model class is selected for both the communication device A and the communication protocol KP, and that within the scope of the invention, for example, a model class can initially be specified only for the device model GM, and only then can the model class for the specification model GM be derived, significantly simplifies the handling and implementation of the invention in practice.

[0036] A particularly advantageous implementation of the invention results from the use of finite state machines as specification models SM and / or device models GM. As is well known, finite state machines are a fundamental concept in computer science and typically represent systems as a set of states, transitions between these states (state changes), and functions of these states and / or state changes to generate output signals from the finite state machine. A widely used type of state machine is the Mealy and Moore automata, which are well known in the relevant literature and can also be used particularly advantageously as a model class within the scope of this invention. Formally, a Mealy automaton can be defined as

[0037] M = Q, Z, Q, θ, A, q0), where Q is a set of states, Z is an input alphabet, Q is an output alphabet (which may or may not be identical to the input alphabet), θ is a transition function for changing states (<θ: Q xz -^Q), A is an output function (A: Q xz —> Q), and q0 is an initial state. The transition and output functions can be merged (<θ xz —>Q x Q). A representation and discussion of Mealy automata, as they may arise within the scope of the invention, follows below with reference to Figures 3 and 5.

[0038] The state of the art offers various approaches for determining specification models (SMs) and device models (GMs) implemented as finite state machines. In an advantageous manner, a specification model (SM) and / or device model (GM) implemented as a finite state machine can be determined, in particular, using a method of automata learning well-known in the relevant literature, such as the Classical L*(L*-C) algorithm, the Direct Hypothesis Construction (DHC) algorithm, the Spanning Tree, Discrimination Tree, Discriminator Tree (TTT) algorithm, the Kearns / Vazirani (KV) algorithm, or the Adaptive Discrimination Tree (ADT) algorithm, etc.

[0039] Typically, such algorithms use a so-called "minimally adequate teacher," who is theoretically assumed to have perfect knowledge of a communication device A to be described by means of a model, and a learner (hereinafter learning unit 21), who assumes the task of model identification and, for this purpose, is allowed to ask the teacher questions about the communication device A. In the embodiment according to Fig. 2, the teacher 31 is indicated as a combination of the adapter 3 already described and a mapping unit 22 provided in the computing unit 2.

[0040] The idea behind this approach is that a learning algorithm implemented at an abstract level in a learning unit 21 (in practice, implementations using the Java library “LearnLib” have proven advantageous) formulates abstract questions for the purpose of model identification, which are translated by the mapping unit 22 to the level of the adapter 3. The combination of the mapping unit 22 and the adapter 3 then stimulates the communication device A in the manner described and consequently correctly answers all questions posed by the learning unit 21 for model identification, since essentially only the real behavior of the communication device A is returned to the learning unit 21. The relationships mentioned are well known in the relevant literature, in particular from “Learning Regular Sets from Queries and Counterexamples,” Dana Angluin, 1987, Information and Computation 75, 2 (Nov.1987), 87-106, or from Automata Learning: A Categorical Perspective, Bart Jacobs and Alexandra Silva, 2014, In Horizons of the Mind. A Tribute to Prakash Panangaden: Essays Dedicated to Prakash Panangaden on the Occasion of His 60th Birthday, Springer International Publishing, Cham, 384-406, or from Automata Learning with On-the-Fly Direct Hypothesis Construction, Maik Merten, Falk Howar, Bernhard Steffen, and Tiziana Margaria. 2012, In Leveraging Applications of Formal Methods, Verification, and Validation, Vol. 336. Springer Berlin Heidelberg, Berlin, Heidelberg, 248-260, so that further details are omitted here with reference to the specialist literature.

[0041] Two exemplary models in the form of finite Mealy automata, which were identified in the context of an application of the invention, are shown in Figures 3a and 3b. Figure 3a shows a device model GM in the form of a Mealy automaton to represent the N FC car key considered in Figures 1 and 2, and Figure 3b shows a specification model SM, also in the form of a Mealy automaton, to represent the ISO / IEC standard.

[0042] 14443-3. In a known manner, the nodes SO, S1, S2, ... in these state models represent states that can be assumed by the model. Switching between these states SO, S1, S2, .. is possible via edges represented by arrows. In order to realize a transition, an excitation signal AS in the form of a command tO, t1, t2, ... must be transmitted to the model in a known manner. The models shown in Fig. 3a and Fig. 3b are, as mentioned, Mealy automatons, where output signals yO, y1, y2, ... are generated in the course of the transition in a known manner. In the present case of the NFC car key, the states S0, S1, S2, ... can be states such as "IDLE", "READY" or "ACTIVE", the commands tO, t1, t2, ... can be commands such as "WAKE UP (=WUPA)", "SELECT" etc., and the output signals yO, y1, y2, ... can represent output signals yO, y1, y2,... such as "ACKNOWLEDGE (=ACK)" or "NOT ACKNOWLEDGE (=NACK)".These relationships are also well known to an expert in the field of automata learning.

[0043] In order to practically implement the above-mentioned comparison of the specification model SM with the device model GM, a sequence of comparison excitation signals AS can be specified in an advantageous manner, as shown in Fig. 4, with which the specification model SM and the device model GM are excited, and to determine the degree of conformity KG, a comparison of a sequence of specification response signals S-RS generated by the specification model SM in response to the sequence of comparison excitation signals AS with a sequence of model response signals M-RS generated by the device model SM in response to the sequence of comparison excitation signals AS.

[0044] If finite state machines are used as the specification model SM and the device model GM, a number of well-known approaches can be used for a comparison, such as the state-of-the-art methods of conformance checking, bisimulation, or trace equivalence. "Simulation" in this context means that one machine can completely reproduce the behavior of another machine, while bisimulation means that this relationship exists bidirectionally. Trace equivalence, on the other hand, compares the sequence of the respective outputs of the machines to be compared (trace corresponds to the sequence of outputs), and is often expressed as

[0045] Trace (GM) = Trace (SM) for short. The comparison shown in Fig. 4 therefore checks for trace equivalence. In connection with the aforementioned Java library LearnLib, reference should be made to the so-called mCRL2 tool, which allows the comparisons under consideration to be carried out particularly easily and efficiently. In addition to the mCRL2 tool, several other tools exist that can be used for this purpose, such as TVT (Tampere Verification Tool), LTSA (Labelled Transition System Analyser), CHISIGMA, TAPAS, etc. With regard to the aforementioned comparison between the specification model SM and the device model GM, it should be noted that, within the scope of the invention, this comparison focuses on the question of whether the models behave in the same way, and not whether they are identical in their design and structure.In order to conclude that a communication device A complies with a standard, not all states of two compared models necessarily have to be identical; it is sufficient that the behavior of the models is identical, i.e., that they respond to an identical stimulus with identical output signals. Fig. 5a and Fig. 5b show simple examples of a three-state automaton (Fig. 5a) and a behaviorally equivalent (minimal) two-state automaton (Fig. 5b), such as Fig. 3a and Fig. 3b with states S0, S1, S2, transitions t11, t12, and outputs y1, y12. In particular, the realization that it is sufficient to compare the input-output behavior of two models for conformity testing, and that it is precisely not necessary to compare often complex internal structures, enables significant efficiency improvements compared to methods known from the state of the art.

[0046] A further, particularly advantageous embodiment of the present invention results from the fact that, using the conformity level KG, a second sequence of excitation signals AS corresponding to the communication protocol KP is specified in order to stimulate the communication device A once again for conformity testing. In this way, a number of advantages are realized, for example, that a conformity level KG determined in a first run is confirmed, or that a renewed excitation occurs in order to deliberately stimulate certain areas of the communication device A again, or to expand a model, whereby in particular the reliability and validity of a statement regarding conformity can sometimes be significantly increased. Typically, the same algorithm (see above, automata learning such as the L*C algorithm, etc.) is used to generate a second sequence of excitation signals AS corresponding to the communication protocol KP.) uses, as in the generation of the first sequence of excitation signals AS corresponding to the communication protocol KP, so that the algorithm used is decisive for the specific type of excitation signals AS generated.

[0047] Fig. 6 finally shows a flowchart for the practical implementation of the invention, in which a further important extension of the present invention is evident. In steps I and II, the previously discussed steps "stimulating the communication device A" (step I) and "determining a device model GM and a specification model SM" (step II) are carried out. Building on this, the flowchart shown in Fig. 6 provides in step III that, before comparing the specification model SM with the device model GM in step IV, a conformity test of the device model GM is carried out, whereby a degree of conformity UG of the device model GM with the communication device A is determined.For this purpose, for example, an attribute of the device model can be checked whose design is known a priori for the device, such as a reaction to a specific stimulus, in order to fundamentally check in a first step whether the device model is at least fundamentally correct. The comparison of the specification model SM with the device model GM is only carried out when the degree of agreement UG reaches a predetermined agreement threshold US checked in the intermediate step IIla. The actual agreement threshold US can, similar to the previously discussed degree of conformity KG, for example, only be the value 1, so that a 0 / 1 or yes-no answer is checked. However, as before, a more detailed analysis can also be carried out, which may require, for example, setting a agreement threshold US between 0 and 1, e.g. 0.8.If the compliance threshold US is not reached, a further sequence of excitation signals AS corresponding to the communication protocol KP is used to excite the communication device A for conformance testing at least once more in step I and to identify another device model GM in step II. Since the specification model SM typically does not change during such loops, a further identification of a specification model SM can of course be omitted when repeating step II.

[0048] With regard to the flowchart shown, it should be noted that, as explained in detail above, after the comparison of the device model GM with the specification model SM has been completed, it is necessary to return to step I again and generate a further sequence of excitation signals AS corresponding to the communication protocol KP. Such a further iteration is, as mentioned, optional, and for this reason is only shown in dashed lines in Fig. 6. However, a further run through the steps shown can be advantageous in a variety of scenarios, e.g., if deviations between the device model GM and the specification model SM have been identified and are to be verified, or if models are to be extended, etc. This procedure can also uncover weaknesses or errors in an underlying learning process.

Claims

Patent claims 1 . Method for testing the conformity of a communication device (A) with a communication protocol (KP), comprising the steps - Specifying a sequence of excitation signals (AS) corresponding to the communication protocol (KP), - transmitting the sequence of excitation signals (AS) to the communication device (A) via a communication medium (KM), so that the communication device (A) emits a sequence of response signals (RS) via the communication medium (KM) in response to the sequence of response signals (AS), - Detecting the sequence of response signals (RS) emitted by the communication device (A), characterized in that a device model (GM) of a predetermined model class for describing the communication device (A) is determined from the predetermined sequence of excitation signals (AS) and from the detected sequence of response signals (RS), that a specification model (SM) of the same model class for describing the communication protocol (KP) is determined from a specification of the communication protocol (KP), and that a degree of conformity (KG) for describing the conformity of the communication device (A) with the communication protocol (KP) is determined by means of a comparison of the specification model (SM) with the device model (GM).

2. Method according to claim 1, characterized in that a class of finite state machines is selected as the model class and that the specification model (SM) and the device model (GM) are each determined as a finite state machine, preferably as a Moore automaton or as a Mealy automaton.

3. The method according to claim 2, characterized in that the device model (GM) is determined by means of an automata learning method, such as the Classical L*(L*-C) algorithm, the Direct Hypothesis Construction (DHC) algorithm, the Spanning Tree Discrimination Tree Discriminator Tree (TTT) algorithm, the Kearns A / azirani (KV) algorithm, or the Adaptive Discrimination Tree (ADT) algorithm.

4. Method according to claim 2 or 3, characterized in that the specification model (SM) is determined by means of an automata learning method, such as the Classical L*(L*-C) algorithm, the Direct Hypothesis Construction (DHC) algorithm, the Spanning Tree Discrimination Tree Discriminator Tree (TTT) algorithm, the Kearns / Vazirani (KV) algorithm, or the Adaptive Discrimination Tree (ADT) algorithm 5. Method according to one of the preceding claims, characterized in that by means of the degree of conformity (KG) a second sequence of excitation signals (AS) corresponding to the communication protocol (KP) is specified in order to stimulate the communication device (A) to perform a conformity check once again.

6. Method according to one of the preceding claims, characterized in that for comparing the specification model (SM) with the device model (GM) a sequence of comparison excitation signals (V-AS) is specified, with which the specification model (SM) and the device model (GM) are excited, and in that for determining the degree of conformity (KG) a comparison is carried out between a sequence of specification response signals (S-RS) generated by the specification model (SM) in response to the sequence of comparison excitation signals (V-AS) and a sequence of model response signals (M-RS) generated by the device model (SM) in response to the sequence of comparison excitation signals (V-AS).

7. Method according to one of the preceding claims, characterized in that the specification model (SM) and the device model (GM) are compared by means of a conformance checking method, such as the bisimulation method or the trace equivalence method.

8. Method according to one of the preceding claims, characterized in that before the comparison of the specification model (SM) with the device model (GM), a match between the device model (GM) and the communication device (A) is checked, wherein a degree of match (UG) of the device model (GM) with the communication device (KG) is determined, that the comparison of the specification model (SM) with the device model (GM) is carried out when the degree of match (UG) reaches a predetermined match threshold (US), or that a further sequence of excitation signals (AS) corresponding to the communication protocol (KP) is specified in order to excite the communication device (A) once more for the conformity test and to determine a further device model (GM) if the degree of match (UG) does not reach the predetermined match threshold (US).

9. Method according to one of the preceding claims, characterized in that an NFC communication device is checked as the communication device (KG), preferably an NFC bank card, an NFC passport, an NFC car key or an NFC-capable mobile device, and in that an NFC communication protocol, preferably an NFC communication protocol specified by the ISO / IEC 14443 standard, is used as the communication protocol (KP).

10. Method according to one of claims 1 to 8, characterized in that a cable-based, bus-based or wireless communication device is tested as the communication device (KG).

11. Method according to one of the preceding claims, characterized in that the predetermined sequence of excitation signals (AS) corresponds to a sequence of communication words (KW) specified in the communication protocol (KP).

12. Device (1) for testing the conformity of a communication device (A) with a communication protocol (KP), comprising - a computing unit (2) for specifying a sequence of excitation signals (AS) corresponding to the communication protocol (KP), - an adapter (3) connected to the computing unit (2) for transmitting the sequence of excitation signals (AS) via a communication medium (KM) to the communication device (A), so that the communication device (A) emits a sequence of response signals (RS) via the communication medium (KM) in response to the sequence of response signals (AS), for detecting the sequence of response signals (RS) emitted by the communication device (A), and for transmitting the detected sequence of response signals (RS) to the computing unit (2), characterized in that the computing unit (2) is further designed to determine a device model (GM) of a predetermined model class for describing the communication device (A) from the predetermined sequence of excitation signals (AS) and from the detected sequence of response signals (RS),to determine a specification model (SM) of the same model class for describing the communication protocol (KP) from a specification of the communication protocol (KP), and to determine a conformity level (KG) for describing the conformity of the communication device (A) with the communication protocol (KP) by comparing the specification model (SM) with the device model (GM).

13. Device (1) according to claim 12, characterized in that the computing unit (2) is further designed to specify a second sequence of excitation signals (AS) corresponding to the communication protocol (KP) to the adapter (3) based on the determined degree of conformity (KG) in order to stimulate the communication device (A) to perform a conformity check at least once more.

14. Device (1) according to claim 12 or 13, characterized in that the computing unit (2) has a learning unit (21) and a mapping unit (22).

Images