Siemens Aktiengesellschaft

Siemens Mobility Gmbh

Unify Gmbh & Co. Kg

Continental Automotive Gmbh

Nokia Siemens Networks Gmbh & Co. Kg

Siemens Enterprise Communications Gmbh & Co. Kg

Siemens Aktiengesell Schaft

Siemens Energy Global Gmbh & Co. Kg

Rainer Falk

Steffen Fries

Florian Kohlmayer

Hans Aschauer

Martin Wimmer

Christian Peter Feist

Kai Fischer

Markus Heintel

Michael Bahr

Dirk Kröselberg

Parag Sudhir Mogre

Wolfgang Klasen

Hermann Seuschek

Axel Pfau

Uwe Blöcher

Hans-Joachim Hof

Matthias Seifert

Johannes Zwanzger

Andreas Köpf

Christian Günther

Aliza Maftun

Stefan Seltzsam

Dominik Merli

Thomas Zeschg

Egon Schulz

Hendrik Brockhaus

Jens-Uwe Bußer

Georg Trummer

Heiko Patzlaff

David Von Oheimb

Stefan Pyka

Volker Fusenig

Franz Sperl

Jens Reinert

Markus Martin Dillinger

Jijun Luo

Christian Bauer

Wen Wei Tang

Leandro Pfleger De Aguiar

Maximilian Riegel

Joachim Walewski

Omer Metel

Günther Horn

Fabrizio De Santis

Eiman Bushra Mohyeldin

David Hingos

Anton Sebastian Huber

Ralf Beyer

Joachim Koppers

Franz Stadler

Andreas Furch

Tolga Sel

Ulrike Meyer

Daniela Friedrich

Andreas Mucha

Christian Winter

Christina Otto

Niranjana Papagudi Subrahmanyam

Felix Nagel

Omar Belhachemi

Milos Svoboda

Guido Stephan

Thomas Falk

Carsten Sattler

Roland Dietz

Bernhard Quendt

A transmission device for transmitting data between a first network and a second includes: a first unidirectional transmission unit which is coupled to the first network and is configured to exclusively receive data transmitted from the first network to the transmission device, a second unidirectional transmission unit which is coupled to the second network and is configured to exclusively send data from the transmission device to the second network, and an identification unit which is located between the first unidirectional unit and the second unidirectional unit and which is configured to receive the data received by the first unidirectional transmission unit and to identify anomalies in the received data. The provided transmission device achieves the reliable, optimized identification of anomalies in the first network and increases security in the identification unit against manipulation and against attacks or intrusion attempts from the second network.

Transmission device for transmitting data

A transmission device for transmitting data between a first network and a second network is provided. The transmission device includes a first network port for coupling to the first network and a second network port for coupling to the second network, and the transmission device further includes: a first detection unit which is connected to the first network port and is configured to receive data transmitted by the first network via the first network port and to detect anomalies with respect to the received data, and a second detection unit which is connected to the second network port and is configured to receive data transmitted by the second network via the second network port and to detect anomalies with respect to the received data. The provided transmission device leads to an optimized detection of anomalies in the first and the second network, thereby increasing security during data transmission between the first and the second network.

Transmission device for transmitting data and detecting anomalies

A method for granting access to objects by entities in a computerized system includes: providing an access control list (ACL) specifying for each object access rights to the objects of the computerized system; assigning a capability requirement information to at least one of the objects in the ACL; assigning a capability information to at least one entity of the entities in the computerized system; requesting access to an object by an entity; checking if the requesting entity has an access right in accordance with the ACL; and granting access to the requested object by the requesting entity only when the capability information assigned to the requesting entity matches with the capability requirement information assigned to the requested object. The combination of an ACL based access to files with capabilities improves the security of the system.

Method for granting access to objects in a computerized system, computer program product, and field device

Various embodiments of the teachings herein include a method for issuing a cryptographically protected certificate of authenticity for a user comprising: providing a public user key; providing a public client key for a client, the public client key assigned to the user; forming a request including the public user key, wherein the public user key is protected with the aid of a private client key assigned to the provided public client key; and issuing a cryptographically protected certificate of authenticity containing the public user key and identifying the client. The cryptographically protected certificate of authenticity contains or references a cryptographic client identifier formed depending at least in part on the public client key.

Method for issuing a cryptographically protected certificate of authenticity for a user

Incoming and outgoing communication of a hardware-application component is monitored and controlled at runtime of the hardware-application component. In this way, a kind of firewall is provided for ensuring secure and un-altered operation of a hardware-application performing security-critical functionalities on a field-programmable gate array. The hardware-application component may interact with other components directly and/or via an on-chip bus. The monitoring of incoming and/or outgoing communication is particularly advantageous when using third party hardware-applications or software applications, i.e., applications developed by untrusted parties. Another advantage is the possibility of monitoring and controlling all the communication between hardware-applications, hardware- and software applications, hardware-applications and peripherals, IO controllers, etc. It is beneficial especially in case a hardware-application is compromised and tries to compromise the rest of the embedded device, or in case a corrupted software application tries to compromise the associated hardware-application at runtime.

Method and configurable hardware module for monitoring a hardware-application

Provided is a method for generating a data stream, the transmitter of which is authenticated. The method includes calculating at least one first item of authentication information, wherein the at least one first item of authentication information is generated from a first item of validation information in each case using a cryptographic one-way function. The method includes storing the at least one first item of authentication information in a first data element of the data stream in each case. The method includes transmitting the particular first data element to at least one receiver. The method includes storing the particular first item of validation information in a second data element of the data stream in each case. The method includes transmitting the particular second data element to the at least one receiver.

Method and apparatuses for authenticating a data stream

A method for key management in a field-programmable integrated part of an integrated circuit is disclosed herein. According to the method, a hardware configuration for the field-programmable integrated part is loaded into the field-programmable integrated part. The hardware configuration includes a key derivation functionality. Further, using the key derivation functionality, a cryptographic key is derived based on information provided in the field-programmable integrated part.

Key management in an integrated circuit

Provided is a method for configuring a wireless connection between a mobile wireless terminal and a mobile wireless network, in which the mobile wireless network contains at least one first subnetwork, which is accessible with a credential of at least a first type, and contains at least one second subnetwork, which is accessible with a credential of at least a second type, and a first wireless connection to a first subnetwork and a second wireless connection to a second subnetwork have different wireless transmission parameters. In the event of a request for access by the mobile wireless terminal to a selected subnetwork—a predetermined credential is determined for the request for access to the selected subnetwork, the type of the predetermined credential is determined, and—at least one wireless transmission parameter is selected and activated depending on the determined type of the predetermined credential.

Method for configuring a radio connection

A block formation device and to a node device for a distributed database system, each having a unit for receiving a timing clock pulse from a time source and determining time slices of prescribed length on the basis of the timing clock pulse is provided. The block formation device is configured to select transactions to be confirmed precisely once within a respective time slice from unconfirmed transactions provided in the database system, to form an unconfirmed block from the selected unconfirmed transactions and to provide the unconfirmed block in the database system. The node device is configured to store a chain of confirmed blocks representing a transaction log of the database system; and, within a respective time slice, to confirm precisely one from unconfirmed blocks provided in the database system in the time slice precisely once and to add it to the chain of confirmed blocks.

Block formation device and block formation method, node device and block confirmation method

A method reconfigures an IoT device which is connectable to a cloud backend. The method includes: storing an access code that is input locally in the cloud backend and storing the access code or check information formed on the basis thereof on the IoT device. The method further includes reconfiguring the IoT device, requesting the access code from the cloud backend, inputting the requested access code on a local configuration interface of the IoT device or on an input device connected to the local configuration interface of the IoT device, and comparing the input access code against the access code stored on the IoT device, or the check information formed on the basis thereof. The IoT device is enabled for reconfiguration upon a positive comparison of the input access code against the access code stored, or the check information formed on the basis thereof.

Protected resetting of an IoT device

Provided is a method and a system for the tamper-proof storage of information about object-related measures which are contained as transactions in transaction blocks that are interlinked in a transaction block chain of the object to which the measures relate, the transaction block chain being stored in an object data memory allocated to the object.

Method and apparatus for tamper-proof storage of information in respect of object-related measures

Provided is a network adapter for unidirectional transmission of a user data stream to a bidirectional network interface, the network adapter including: a first connection unit which is physically connected to a bidirectional network interface of a first device; a second connection unit which is physically connected to a bidirectional network interface of a second device; and a terminating unit which has at least one bit transmission module and which is designed to establish a bidirectional data link to the network interface of the first device, to receive the user data stream from the first device exclusively in a unidirectional fashion via the data link, and not to send a user data stream to the first device.

Network adapter for unidirectional transfer of data

Provided is a device unit, including a module, which can configure the device unit with an operating state from among different operating states during the start-up process and/or during ongoing operation of the device unit, wherein a first protected operating state of the different operating states is designed to allow the execution of at least one operating process which can be predefined and to optionally protect the operating process by means of defined cryptographic means, wherein at least one second operating state of the different operating states is designed to deactivate the first protected operating state and to allow at least one other changeable operating process and to optionally protect the operating process by means of specifiable cryptographic means.

Device unit suitable for operation in a protected and/or open operating state and associated method

Provided a method for setting up an authorization verification for a first device, for example a field device in an automation system, wherein the first device is configured by configuration data transmitted to the first device from a configuration module that is detachably connected to the first device and, for example, is implemented in the form of an SD card or a USB stick, having: detection of a connection of a configuration module to the first device, reading configuration module-specific device information from the configuration module, requesting configuration module-specific authorization verification for the configuration model-specific device information from the first device in an authorization device, and storing the requested configuration module-specific authorization verification on a security storage unit of the first device.

Method for setting up authorization verification for a first device

The invention relates to a computer-implemented method for connecting a network component to a network, in particular a mobile communications network, with an extended network access identifier. The method involves a receiving of the extended network access identifier from the network component via a network access server, wherein the extended network access identifier comprises at least one network access restriction for connecting the network component to the network. The method also involves a receiving of a requested user access profile from a user profile server via the network access server, wherein the user access profile comprises access authorisations for connecting the network component to the network. The network component is authenticated in the network via the network access server, if the received extended network access identifier fulfills thre access authorisations of the received user access profile. Then the network connection of the network component to the network via the network access server is configured by means of the access authorisations of the user access profile once the network component is authenticated. There is also a determining of the network restriction received with the extended network access identifier via the network access server, and a verifying of the configured network connection of the network component to the network via the network access server based on the determined network access restriction. Then the network component is connected to the network via the network access server, once the configured network connection is verified and the configured network connection fulfills the determined network access restrictions.

Computer-implemented method and network access server for connecting a network component to a network with an extended network access identifier

Growing community of inventors

Poing, Germany

Rainer Falk