Siemens Aktiengesellschaft

Siemens Gamesa Renewable Energy A/s

David Von Oheimb

Rainer Falk

Steffen Fries

Hendrik Brockhaus

Uwe Blöcher

Michael Munzert

Jens-Uwe Bußer

Provided is a method for validating a predetermined digital certificate having a validation device, wherein the validation device stores approval information that specifies which digital certificates of a plurality of digital certificates are permissible digital certificates, and wherein the validation device further stores trust information which indicates a trust level of the permissible digital certificates. The method includes determining, while taking account of the approval information, whether the predetermined digital certificate is permissible for the planned use under the current conditions; and if it is determined that the predetermined digital certificate is permissible, determining the trust level of the predetermined digital certificate by taking into consideration the trust information for the planned use and the current conditions, is provided. A trust level can be determined for a digital certificate which indicates how trustworthy the digital certificate is for a planned use under the current conditions.

Method and validation device for validating a digital certificate

There is a need for coupling, for example within an automation area, particularly critical subareas with less critical subareas of the automation area. The invention relates to a method and a network filtering device for filtering a data packet between a first network and a second network. According to the invention, a data packet is checked several times in parallel by means of a multiplier and a plurality of filtering devices.

Filtering a data packet by means of a network filtering device

Provided is a method for an authorized issuing of an authentication token for a device, including requesting an authentication token for the device by sending a request message and at least one authentication parameter to an authorization apparatus, verifying authenticity of the request message using the authentication parameter, verifying authorization for the request by comparing information on the device obtained with the request message in the authorization apparatus with context information for the device stored in a database, and on success of the verification of the authenticity and of the authorization, authorizing the issuing of the requested authentication token.

Authorization apparatus and method for an authorized issuing of an authentication token for a device

Systems and methods for characterizing a client apparatus on at least one server apparatus are provided. A first certificate is received in the event of a first request for a connection set-up from a server apparatus in a client apparatus. One or more predefined certificate parameters of the first certificate are stored as a set of characterization parameters in the client apparatus. Each further certificate from a server apparatus is checked that is received in the client apparatus in the event of a request for a further connection set-up, against the stored characterization parameter set. A request for a further connection set-up is accepted only if all of the predefined certificate parameters of the further certificate match all characterization parameters of the characterization parameter set.

Characterizing a client apparatus on at least one server apparatus

The invention relates to a method for monitoring a security network interface unit (), for example a firewall, which receives a stream of data packets via a first interface (), checks said data stream with respect to filtering rules, and outputs said data stream to a second interface (). The method has the steps of duplicating and outputting the data stream to the second interface (), checking the output data stream for inadmissible data traffic, transmitting a warning message to the security network interface unit if inadmissible data traffic is detected in the data stream, and restricting the data stream by means of the security network interface unit if the warning message is received in the security network interface unit (). The device or the system according to the invention comprises units which are designed to carry out the aforementioned method.

Growing community of inventors

Heimstetten, Germany

David Von Oheimb