Siemens Aktiengesellschaft

Fabrizio De Santis

Hans Aschauer

Rainer Falk

Steffen Fries

Christian Peter Feist

Daniel Schneider

Markus Dichtl

Johannes Zwanzger

Pascale Böffgen

Andreas Furch

Aliza Maftun

Thomas Zeschg

Tolga Sel

Antonio Vaira

Malek Safieh

Florian Wilde

Various embodiments of the teachings herein include a method for arranging a shared cryptographic key with a communication partner. The method may include: selecting a first point of a first elliptic curve; sending the first point to the communication partner using a public channel; receiving a second point of the first elliptic curve from the communication partner; and determining the shared key using a non-trivial, inverse shared mapping of the second point with respect to a shared isomorphic mapping of a second elliptic curve onto the first elliptic curve.

Method for arranging a shared cryptographic key and method for encrypted communication, computer program product and device

Various embodiments of the teachings herein include a method for onboarding an IoT device () of a manufacturer, in a manner secure against quantum computer attacks, in an infrastructure of a customer by means of a first server () of a manufacturer domain of the manufacturer and a second server () of a customer domain of the customer. In some embodiments, three authenticated and encrypted communication channels and a key encapsulation method are used to provide a device certificate of the customer domain for the IoT device on the IoT device.

Method and system for onboarding an IoT device

A method for securely starting device software is provided, in particular an operating system, of an electronic device, wherein a plurality of successive software modules which contain software code are run by the device. The method has the steps of: a) running the first software module, b) loading the subsequent software module using the preceding software module, c) checking the software code of the subsequent software module and identifying security features using an identification scheme, d) evaluating the identified security features using a security, e) running the subsequent software module if the evaluation results in a value of trustworthiness that lies above a specified threshold, and f) running steps b) to e) for each of the subsequent software modules.

Method for securely starting device software, in particular an operating system, of an electronic device

A method for granting access to objects by entities in a computerized system includes: providing an access control list (ACL) specifying for each object access rights to the objects of the computerized system; assigning a capability requirement information to at least one of the objects in the ACL; assigning a capability information to at least one entity of the entities in the computerized system; requesting access to an object by an entity; checking if the requesting entity has an access right in accordance with the ACL; and granting access to the requested object by the requesting entity only when the capability information assigned to the requesting entity matches with the capability requirement information assigned to the requested object. The combination of an ACL based access to files with capabilities improves the security of the system.

Method for granting access to objects in a computerized system, computer program product, and field device

The disclosure relates to a method and a device for authenticating an FPGA configuration. The method includes at least partly reading the configuration of a FPGA by the FPGA itself and calculating a first checksum using the read configuration. The method further includes providing an authentication response which confirms that the FPGA configuration is authentic when the first checksum matches a specified checksum, wherein the reading, calculating, and providing are carried out in an obfuscated manner. The authentication response confirming that the FPGA configuration is authentic is not provided or is only provided with a very low degree of probability when the first checksum and the specified checksum do not match. In this regard, an FPGA may check its own configuration.

Method and device for authenticating an FPGA configuration

A signing system for validating stateful hash-based digital signatures includes a signing device, a logging device and a verifying device, wherein each signing device is configured to receive data, generate a hash-based digital signature including a one-time signature, generate a one-time public key, send the generated one-time public key, send the hash-based digital signature, the verifying device is configured to generate a validation one-time public key, send the validation one-time public key, and the logging device is configured to store the generated one-time public key, receive a validation one-time public key, compare the validation one-time public key with all one-time public keys, provide a validation feedback signal, if the validation one-time public key coincides with exactly one stored one-time private key, and provide a warning feedback signal, if the validation one-time public key does not coincide with exactly one stored one-time private key.

Signing system for validating stateful hash-based digital signatures

Methods and devices are provided for establishing secure communication between the devices without relying on local time information. According to the methods, a client device, which is going to establish the secure communication to a server device, is provided by the server device with a proof of its integrity. The proof of integrity of the server device is issued by a trusted third party (TTP) to which both devices have a trust relation.

Establishing secure communication without local time information

An issuing device is configured to: respond to a challenge request by transmitting a challenge; and respond to a certification request including a public key and ownership information thereof by issuing a digital certificate certifying the ownership information. The ownership information includes counterparty identity information relating to a ledger of a distributed database. The digital certificate is issued if it is successfully verified that a valid response to the challenge has been posted to the ledger of the distributed database and is associated therein with the counterparty identity information of the certification request. The digital certificate facilitates proofing that an owner of a public key is a given counterparty to a blockchain ledger. Also, a corresponding requesting device and corresponding methods and computer program products for issuing and requesting a digital certificate are disclosed.

Growing community of inventors

Munich, Germany

Fabrizio De Santis