Siemens Aktiengesellschaft

Siemens Mobility Gmbh

Unify Gmbh & Co. Kg

Continental Automotive Gmbh

Nokia Siemens Networks Gmbh & Co. Kg

Siemens Enterprise Communications Gmbh & Co. Kg

Siemens Aktiengesell Schaft

Siemens Energy Global Gmbh & Co. Kg

Rainer Falk

Steffen Fries

Florian Kohlmayer

Hans Aschauer

Martin Wimmer

Christian Peter Feist

Kai Fischer

Markus Heintel

Michael Bahr

Dirk Kröselberg

Parag Sudhir Mogre

Wolfgang Klasen

Hermann Seuschek

Axel Pfau

Uwe Blöcher

Daniel Schneider

Johannes Zwanzger

Hans-Joachim Hof

Matthias Seifert

Andreas Köpf

Christian Günther

Stefan Seltzsam

Dominik Merli

Egon Schulz

Hendrik Brockhaus

Jens-Uwe Bußer

Georg Trummer

Fabrizio De Santis

David Von Oheimb

Markus Martin Dillinger

Jijun Luo

Christian Bauer

Wen Wei Tang

Leandro Pfleger De Aguiar

Maximilian Riegel

Joachim Walewski

Michal Skubacz

Omer Metel

Jens-Uwe Busser

Thomas Zeschg

Aliza Maftun

Stefan Pyka

Heiko Patzlaff

Andreas Furch

Volker Fusenig

Jens Reinert

Franz Sperl

Günther Horn

Anton Sebastian Huber

Eiman Bushra Mohyeldin

David Hingos

Ralf Beyer

Tolga Sel

Franz Stadler

Joachim Koppers

Ulrike Meyer

Daniela Friedrich

Andreas Mucha

Florian Wilde

Malek Safieh

Christina Otto

Felix Nagel

Christian Winter

Niranjana Papagudi Subrahmanyam

Omar Belhachemi

Bernhard Quendt

Milos Svoboda

Roland Dietz

Carsten Sattler

Thomas Falk

Guido Stephan

Parag Mogre

Wen Tang

Sebastian Ries

A method for authenticating a communication partner on a device is provided, in which method, in addition to a physical device implementation, there is at least one virtual device implementation allocated to the device, the method having the following steps: —receiving an access authorization of a communication partner in one first of these two device implementations, —checking, by the first device implementation, the access authorization and —if the access authorization is deemed permissible, providing an authorization verification from the first device implementation to the communication partner, and —permitting an access to the second device implementation of these two device implementations by the communication partner by the authorization verification.

Authenticating a communication partner on a device

Provided is a method for configuring a security module with at least one derived key, having the following steps: providing a key; deriving a further key from the provided key or from a key previously derived from the provided key, wherein the further key is derived by using an alterable digital fingerprint as key derivation parameter, which is formed on the basis of a measurable current runtime configuration of a runtime environment communicating with the security module.

Method for configuring a security module with at least one derived key

Various embodiments of the teachings herein include a method for onboarding an IoT device () of a manufacturer, in a manner secure against quantum computer attacks, in an infrastructure of a customer by means of a first server () of a manufacturer domain of the manufacturer and a second server () of a customer domain of the customer. In some embodiments, three authenticated and encrypted communication channels and a key encapsulation method are used to provide a device certificate of the customer domain for the IoT device on the IoT device.

Method and system for onboarding an IoT device

A transmission device for transmitting data between a first network and a second includes: a first unidirectional transmission unit which is coupled to the first network and is configured to exclusively receive data transmitted from the first network to the transmission device, a second unidirectional transmission unit which is coupled to the second network and is configured to exclusively send data from the transmission device to the second network, and an identification unit which is located between the first unidirectional unit and the second unidirectional unit and which is configured to receive the data received by the first unidirectional transmission unit and to identify anomalies in the received data. The provided transmission device achieves the reliable, optimized identification of anomalies in the first network and increases security in the identification unit against manipulation and against attacks or intrusion attempts from the second network.

Transmission device for transmitting data

A transmission device for transmitting data between a first network and a second network is provided. The transmission device includes a first network port for coupling to the first network and a second network port for coupling to the second network, and the transmission device further includes: a first detection unit which is connected to the first network port and is configured to receive data transmitted by the first network via the first network port and to detect anomalies with respect to the received data, and a second detection unit which is connected to the second network port and is configured to receive data transmitted by the second network via the second network port and to detect anomalies with respect to the received data. The provided transmission device leads to an optimized detection of anomalies in the first and the second network, thereby increasing security during data transmission between the first and the second network.

Transmission device for transmitting data and detecting anomalies

A method for granting access to objects by entities in a computerized system includes: providing an access control list (ACL) specifying for each object access rights to the objects of the computerized system; assigning a capability requirement information to at least one of the objects in the ACL; assigning a capability information to at least one entity of the entities in the computerized system; requesting access to an object by an entity; checking if the requesting entity has an access right in accordance with the ACL; and granting access to the requested object by the requesting entity only when the capability information assigned to the requesting entity matches with the capability requirement information assigned to the requested object. The combination of an ACL based access to files with capabilities improves the security of the system.

Method for granting access to objects in a computerized system, computer program product, and field device

Various embodiments of the teachings herein include a method for issuing a cryptographically protected certificate of authenticity for a user comprising: providing a public user key; providing a public client key for a client, the public client key assigned to the user; forming a request including the public user key, wherein the public user key is protected with the aid of a private client key assigned to the provided public client key; and issuing a cryptographically protected certificate of authenticity containing the public user key and identifying the client. The cryptographically protected certificate of authenticity contains or references a cryptographic client identifier formed depending at least in part on the public client key.

Method for issuing a cryptographically protected certificate of authenticity for a user

Incoming and outgoing communication of a hardware-application component is monitored and controlled at runtime of the hardware-application component. In this way, a kind of firewall is provided for ensuring secure and un-altered operation of a hardware-application performing security-critical functionalities on a field-programmable gate array. The hardware-application component may interact with other components directly and/or via an on-chip bus. The monitoring of incoming and/or outgoing communication is particularly advantageous when using third party hardware-applications or software applications, i.e., applications developed by untrusted parties. Another advantage is the possibility of monitoring and controlling all the communication between hardware-applications, hardware- and software applications, hardware-applications and peripherals, IO controllers, etc. It is beneficial especially in case a hardware-application is compromised and tries to compromise the rest of the embedded device, or in case a corrupted software application tries to compromise the associated hardware-application at runtime.

Method and configurable hardware module for monitoring a hardware-application

Provided is a method for generating a data stream, the transmitter of which is authenticated. The method includes calculating at least one first item of authentication information, wherein the at least one first item of authentication information is generated from a first item of validation information in each case using a cryptographic one-way function. The method includes storing the at least one first item of authentication information in a first data element of the data stream in each case. The method includes transmitting the particular first data element to at least one receiver. The method includes storing the particular first item of validation information in a second data element of the data stream in each case. The method includes transmitting the particular second data element to the at least one receiver.

Method and apparatuses for authenticating a data stream

A method for key management in a field-programmable integrated part of an integrated circuit is disclosed herein. According to the method, a hardware configuration for the field-programmable integrated part is loaded into the field-programmable integrated part. The hardware configuration includes a key derivation functionality. Further, using the key derivation functionality, a cryptographic key is derived based on information provided in the field-programmable integrated part.

Key management in an integrated circuit

Provided is a method for configuring a wireless connection between a mobile wireless terminal and a mobile wireless network, in which the mobile wireless network contains at least one first subnetwork, which is accessible with a credential of at least a first type, and contains at least one second subnetwork, which is accessible with a credential of at least a second type, and a first wireless connection to a first subnetwork and a second wireless connection to a second subnetwork have different wireless transmission parameters. In the event of a request for access by the mobile wireless terminal to a selected subnetwork—a predetermined credential is determined for the request for access to the selected subnetwork, the type of the predetermined credential is determined, and—at least one wireless transmission parameter is selected and activated depending on the determined type of the predetermined credential.

Method for configuring a radio connection

A block formation device and to a node device for a distributed database system, each having a unit for receiving a timing clock pulse from a time source and determining time slices of prescribed length on the basis of the timing clock pulse is provided. The block formation device is configured to select transactions to be confirmed precisely once within a respective time slice from unconfirmed transactions provided in the database system, to form an unconfirmed block from the selected unconfirmed transactions and to provide the unconfirmed block in the database system. The node device is configured to store a chain of confirmed blocks representing a transaction log of the database system; and, within a respective time slice, to confirm precisely one from unconfirmed blocks provided in the database system in the time slice precisely once and to add it to the chain of confirmed blocks.

Block formation device and block formation method, node device and block confirmation method

A method reconfigures an IoT device which is connectable to a cloud backend. The method includes: storing an access code that is input locally in the cloud backend and storing the access code or check information formed on the basis thereof on the IoT device. The method further includes reconfiguring the IoT device, requesting the access code from the cloud backend, inputting the requested access code on a local configuration interface of the IoT device or on an input device connected to the local configuration interface of the IoT device, and comparing the input access code against the access code stored on the IoT device, or the check information formed on the basis thereof. The IoT device is enabled for reconfiguration upon a positive comparison of the input access code against the access code stored, or the check information formed on the basis thereof.

Protected resetting of an IoT device

Provided is a method and a system for the tamper-proof storage of information about object-related measures which are contained as transactions in transaction blocks that are interlinked in a transaction block chain of the object to which the measures relate, the transaction block chain being stored in an object data memory allocated to the object.

Method and apparatus for tamper-proof storage of information in respect of object-related measures

Provided is a network adapter for unidirectional transmission of a user data stream to a bidirectional network interface, the network adapter including: a first connection unit which is physically connected to a bidirectional network interface of a first device; a second connection unit which is physically connected to a bidirectional network interface of a second device; and a terminating unit which has at least one bit transmission module and which is designed to establish a bidirectional data link to the network interface of the first device, to receive the user data stream from the first device exclusively in a unidirectional fashion via the data link, and not to send a user data stream to the first device.

Network adapter for unidirectional transfer of data

Growing community of inventors

Poing, Germany

Rainer Falk