Siemens Aktiengesellschaft

Robert Burkle Gmbh

Siemens It Solutions and Services Gmbh

Markus Heintel

Rainer Falk

Kai Fischer

Hans Aschauer

Steffen Fries

Wolfgang Klasen

Axel Pfau

Johannes Zwanzger

Georg Trummer

Dominik Merli

Franz Sperl

Daniela Friedrich

Wolfgang Renz

Daniel Schneider

Norbert Damm

Christian Peter Feist

Dagmar Beyer

Stefan Pyka

Anton Sebastian Huber

Amine Mohamed Houyou

Andreas Furch

Joachim Koppers

Tolga Sel

Gerhard Dölker

Bernhard Quendt

Niranjana Papagudi Subrahmanyam

Gökçe Aydos

Omar Belhachemi

Gerhard D&ouml;lker

Tobias Schreck

Bernd Armbruster

Sascha Lämmle

Erich Schmider

Christian Hiob

Dolker Gerhard

Provided is a device unit, including a module, which can configure the device unit with an operating state from among different operating states during the start-up process and/or during ongoing operation of the device unit, wherein a first protected operating state of the different operating states is designed to allow the execution of at least one operating process which can be predefined and to optionally protect the operating process by means of defined cryptographic means, wherein at least one second operating state of the different operating states is designed to deactivate the first protected operating state and to allow at least one other changeable operating process and to optionally protect the operating process by means of specifiable cryptographic means.

Device unit suitable for operation in a protected and/or open operating state and associated method

Provided is a method for transmitting data packets over a network from a sender to a receiver via a communication link consisting of at least one transmission section, via which the data packet is transmitted from a sender node to a receiver node, the method having the following steps for at least one transmission section: first security information, which includes information about a cryptographic protective function used in the transmission of the data packet via an adjacent transmission section, is assigned to the data packet by the sender node, the data packet having the assigned security information is transmitted to the receiver node of the transmission section, the security information is checked in the receiver node against a preset guideline, and at least one measure is provided in accordance with the result of the check.

Method for transmitting data packets

Keystream generators for secure data transmission, the keystream generators being operated in counter mode, against repeated or improper generation of an already generated keystream and to protect the data transmission against repeated use of a keystream, so-called reuse are provided. The keystream generator is operated, with respect to realization options, selectively in one of two operating modes, an encryption operating mode and a decryption operating mode. In the encryption operating mode, a keystream generated on the basis of a first control data set is used to encrypt data, in particular payload data, to form cipher-data, the product of ciphered data or payload data. In the decryption operating mode, a keystream generated on the basis of a second control data set is used to decrypt the cipher-data. The keystream is output only if the generation of the keystream from the encryption of a counter value of the keystream generator operated in counter mode with a block cipher key is error-free.

Method for operating keystream generators for secure data transmission, the keystream generators being operated in counter mode, keystream generator having counter mode operation for secure data transmission, and computer program product for keystream generation

Provided is a method for producing a product by a machine tool, wherein the control information and/or production data of a machine tool, such as a milling machine, injection molding machine, welding robot, laser cutter or 3D printer, is protected or cryptographically encrypted such that unauthorized copying or modifying is prevented, including the steps: producing product by the machine tool taking into consideration control information which controls the production of the product; generating production data by the machine tool during production of the product, wherein the production data describes the production of the product; providing protection information to the machine tool, which indicates which of the production data is to be protected, and defines a protection method for the production data which is protected; and protecting that production data which, according to the protection information, is to be protected, by the protection method defined by the protection information.

Method for protecting the production data for producing a product

The invention relates to a communication network having at least one network element (NE), via which data associated with the communication are conducted. The method comprises the following steps: securing, by means of a first cryptographic security function, the data (D) that are transferred from at least one first communication device (PLC) to at least one second communication device (PLC), providing a second cryptographic security function, which secures, between a communication device and a network element, messages that are conducted from the first communication device to the at least second communication device via the at least one network element and that contain the data, providing a checking function by means of the at least one network element, which checking function checks the authenticity and/or integrity of the messages on the basis of the second security function, continuing () or stopping () the communication in accordance with the result of the check () by the checking function, wherein, if the communication is continued, the data remain secured by means of the first security function until the data are received by the at least second communication device.

Securing communication within a communication network using multiple security functions

A method for achieving a security function for a security control device for controlling a device or an installation, including: a) providing at least one first partial secret that is stored in a basic control device, b) providing at least one second partial secret that is stored in a security module, c) combining the at least one first and second partial secret to form an overall secret, required to achieve the security function, within the time period in which the basic control device interacts with the security module via the first and second coupling interfaces, and d) disguising the combined overall secret outside the time period.

Methods and apparatuses for achieving a security function, in particular in the environment of a device and/or installation controller

In a method for protecting security-relevant data in a cache memory, a copy of this security-relevant data from a general memory is stored in the cache memory, and the method includes stipulating obfuscation parameters, determining a first cache set address from a memory address of the general memory at which the security-relevant data are stored, generating a first modified cache set address for a first cache set with a generation function using the obfuscation parameters and the first cache set address, and storing the copy of the security-relevant data using the first modified cache set address in a first cache line of the first cache set.

Method for protecting security-relevant data in a cache memory

Provided is a method for achieving a security function for a security control device for controlling a device or an installation, including: a basic control device, and a security module and having the following steps of a) providing at least one first partial secret which is stored in the basic control device, b) providing at least one second partial secret which is stored in the security module, c) combining the at least one first partial secret and the at least one second partial secret in order to achieve the security function, wherein the at least one first partial secret is broken down into sections of a predefinable size and the set of sections is gradually combined with the at least second partial secret by means of a calculation rule, which can be processed within a predefinable period during the execution of the calculation rule according to the size and set.

A method to an associated computer program product, to a production unit, and to an arrangement for examining a consistency between reference data of a production object and data of a digital twin of the production object, wherein two separate communication channels are used.

Examining a consistency between reference data of a production object and data of a digital twin of the production object

A method and device are provided for use in a network including at least one existing device. At least one virtual sub-network is established within the network and a certain trust level is assigned to the at least one virtual sub-network. The device is assigned a first trust level. The device receives a token correlated with the assigned first trust level. The device is permitted into the at least one virtual subnet upon presentation of that token if the first trust level corresponds or includes the certain trust level.

Device for use in a network

Provided is a method and an arrangement for enabling a processing step for an object that is to be processed, wherein an availability result, which indicates an availability of the processing step, is determined for the processing step on the basis of rules.

Enabling a processing step for an object to be processed

A retrieval device for secure retrieval of optical information for a first device from a light source of a second device includes, a housing made from at least one material which is opaque for the light emitted from the light source. The housing is arranged to contain the light from at least a part of the light source. The retrieval device includes an attachment adapted to detachably attach the housing to the second device, a light receiver arranged to receive optical information from the light source, said light receiver located inside the housing, and a connector arranged to transfer an optical and/or electrical signal from the light receiver to the first device.

Retrieval device for authentication information, system and method for secure authentication

A modular security control device for controlling an apparatus or an installation includes a basic control apparatus which is configured such that an apparatus or an installation which is at least connectable to the basic control apparatus is at least controllable via a sequence of a control program in the basic control apparatus, and includes a security module which is configured to provide or perform a cryptographic functionality for the basic control apparatus, where the security module is connected to the basic control apparatus by a data connection via a data interface, the basic control apparatus is configured to interact with the security module to achieve a security function of the security control device, and where the basic control apparatus is configured to query an identity and/or authenticity of the security module.

Modular security control device

Provided is a method for the secure, computer-aided execution of program instructions of an application, including the following method steps. The method includes a step of switching on a learning mode of an execution environment. The method includes a further step of performing the application in the execution environment while the learning mode is switched on, wherein program instructions of the application are performed for a selected predetermined application scenario and the execution environment assigns a first application scenario-specific validity information to the performed program instructions. The method includes a step of switching on a working mode of the execution environment, wherein, in the working mode, the execution environment checks the first validity information of the program instructions, and wherein the execution environment executes the program instructions as a function of their validity information.

Method and execution environment for the secure execution of program instructions

The most important data in a first memory of a data processing system are stored in a limited second data memory given upon a transfer thereof. The demarcation between important (and still storable) data on the one hand and less important (and therefore no longer storable) data is made dependent on the available storage volume (SV) of the target data memory. This achieves that an optimal amount of the most important data can be stored on the target data memory.

Growing community of inventors

Munich, Germany

Markus Heintel