Method of controlling access

• US 20040073791A1
• Filed: 09/08/2003
• Published: 04/15/2004
• Est. Priority Date: 09/16/2000
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Vollmer, Vasco, Hofmann, Matthias
• Granted Patent: US 7,644,269 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 12/2805 Home Audio Video Interoperability [HAVI] networks
• CPC Class Codes: H04L 12/40078 Bus configuration home automation networks H04L12/2803; arrangements for maintenance or administration H04L41/00
• CPC Class Codes: H04L 12/40117 Interconnection of audio or video/imaging devices home automation networks H04L12/2803; bitstream network arrangements specially adapted for distribution of digital video signals H04N7/24
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

To control access to elements within a bus system or network, an external device (100) identifies itself with a bus manager or network manager (300) via a device-specific identifier. After authentication on the basis of a digital key, access is granted to the external device in accordance with its membership in a certain class of elements of the bus system or network.

Claims

1. A method of controlling access to elements within a bus system or network, comprising the following steps:

an external device (100), which wishes to establish a communication link with the bus system or network, is identified by a device-specific identifier to a bus manager or network manager (300), and the device-specific identifier itself or a data record allocated to it contains information regarding the membership of the device in a certain class;

authentication of the external device (100) is performed on the basis of a digital key;

after authentication, the external device (100) is granted access to elements of the bus system or network in accordance with its class membership.

2. The method as recited in claim 1,

wherein for the access, the external device (100) logs in at a gateway (200) using a log-in message which is transmitted, particularly together with the device identifier, to the bus manager or network manager (300).

3. The method as recited in claim 2,

wherein a device class identifier is also transmitted in addition to the device-specific identifier.

4. The method as recited in one of claims 1 through 3,

wherein a joint key agreement is reached between the external device (100) and the bus manager or network manager (300), in particular through the exchange of parameters such as primary numbers, random numbers and the operations performed on them.

5. The method as recited in claim 4,

wherein the Diffie-Hellmann method is used for the joint key agreement.

6. The method as recited in one of claims 1 through 5,

wherein after the joint key agreement between the external device (100) and the bus manager or network manager (300), authentication is performed according to the challenge-response procedure.

7. The method as recited in one of claims 2 through 6,

wherein the gateway (100) is set up to perform signal conversions according to the ISO/OSI layer model at least in the physical layer and/or higher layers.

8. The method as recited in one of claims 2 through 7,

wherein the gateway (200) is set up to have a firewall functionality (201).

9. The method as recited in claim 8,

wherein the authentication is used to ascertain which resources of the bus system or network may be used and/or controlled by the external device (100) and in what manner this may be done.

10. The method as recited in one of claims 8 or 9,

wherein the bus manager or network manager (300) configures the firewall functionality (201) on the basis of the access authorization determined by it, so that the firewall functionality enables or blocks resources of the bus system or the network according to the access authorization thus determined.

11. The method as recited in claim 10,

wherein the enabling or blocking is performed on the basis of the source address or the destination address of a data packet.

12. The method as recited in claim 10,

wherein the firewall functionality (201) filters certain commands of the external device (100) according to the access authorization determined.

13. The method as recited in one of claims 1 through 12,

wherein the access authorization is negotiated between the external device (100) and the bus manager or network manager (300).

14. The method as recited in one of claims 1 through 13,

wherein instead of or in addition to an external device (100), an external bus system or network establishes a communication link with the bus system or network to gain access to elements of the bus system or network.