Method and System for Transmitting Control Data in a Manner that is Secured Against Manipulation

• US 20130132730A1
• Filed: 07/22/2011
• Published: 05/23/2013
• Est. Priority Date: 08/03/2010
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Falk, Rainer
• Granted Patent: US 9,252,956 B2
• Time in Patent Office: Days
• US Class Current: 713/181
• CPC Class Codes: H04L 12/4616 LAN interconnection over a LAN backbone
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

A method and system for detecting manipulation when control data are transmitted from a first control unit to a second control unit via a network, which includes generating integrity check information data for the control data transmitted by the first control unit via an integrity check generating unit on the transmitter side, calculating a cryptographic checksum for the integrity check information data generated on the transmitter side via the integrity check generating unit, transmitting the integrity check information data and the cryptographic checksum to an integrity check verifying unit that verifies the cryptographic checksum on the receiver side, generating integrity check information data on the receiver side for the control data received by the second control unit using the integrity check verifying unit, and comparing the integrity check information data and the integrity check information data with the cryptographic checksum to detect the manipulation of the transmitted control data.

Claims

1-15. -15. (canceled)

16. A method for recognizing manipulation during transmission of control data from a first control unit to a second control unit via a network, the comprising the steps of:

(a) generating integrity check information data on a transmitter side for the control data transmitted by the first control unit by an integrity check generating unit;

(b) calculating a cryptographic checksum for the integrity check information data generated on the transmitter side by the integrity check generating unit using a cryptographic key;

(c) transmitting the integrity check information data generated on the transmitter side and the corresponding cryptographic checksum calculated by the integrity check generating unit to an integrity check verifying unit which verifies the cryptographic checksum on a receiver side using the cryptographic key;

(e) generation integrity check information data on the receiver side for the control data received by the second control unit using the integrity check verifying unit; and

(f) comparing the integrity check information data generated on the receiver side by the integrity check verifying unit and the integrity check information data generated on the transmitter side and received together to cryptographic checksum which is verified by the integrity check verifying unit to detect manipulation of the transmitted control data.

21. The method as claimed in claim 16, wherein the integrity check information data is generated at regular time intervals by the integrity check generating unit.

22. The method as claimed in claim 16, wherein the control data is transmitted via one of a wireless and a wire-bound transmission network in real time.

23. The method as claimed in claim 16, wherein the cryptographic checksum calculated by the integrity check generating unit is transmitted together with the integrity check information data generated on the transmitter side via one of the transmission network for the control data and a separate communication connection from the first control unit to the second control unit.

24. The method as claimed in claim 16, wherein, on recognizing a manipulation arising during transmission of the control data from the first control unit to the second control unit, the integrity check verifying unit generates an alarm signal and transmits the alarm signal to the second control unit.

25. The method as claimed in claim 24, wherein, after reception of the alarm signal by the integrity check verifying unit, the second control unit switches to an operationally secure state.

26. A data transmission system for transmitting control data from a first control unit to a second control unit via a network, comprising:

(a) at least one integrity check generating unit configured to generate integrity check information data on a transmitter side for the control data transmitted by the first control unit and calculate a cryptographic checksum for the integrity check information data generated using a cryptographic key; and

(b) at least one integrity check verifying unit configured to receive the integrity check information data generated by the integrity check generating unit on the transmitter side, receive an associated calculated cryptographic checksum and verify the cryptographic checksum using the cryptographic key;

wherein the integrity check verifying unit generates the integrity check information data for the control data received by the second control unit on the receiver side and compares the integrity check information data generated on the receiver side with the integrity check information data received and generated on the transmitter side together with the verified cryptographic checksum to recognize manipulation of the transmitted control data.

27. The data transmission system as claimed in claim 26, wherein the first control unit is connected to a first control network comprising a first gateway, the second control unit being connected to a second control network comprising a second gateway, the first and second gateways of the first and second control networks being connected to one another via a transmission network.

28. The data transmission system as claimed in claim 27, wherein at least one of the first control network, the second control network and the transmission network is an Ethernet, in particular a Profinet.

29. The data transmission system as claimed in claim 28, wherein Ethernet is a Profinet.

30. The data transmission system as claimed in claim 26, wherein the first and second control units each comprises sensors, actuators and a control computer.

31. The data transmission system as claimed in claim 27, wherein the first and second control units each comprises sensors, actuators and a control computer.

32. The data transmission system as claimed in claim 26, wherein the network is a vehicle network, in particular a train network, an energy control network or an automation control network, in particular a process control network or a production control network.

33. The data transmission system as claimed in claim 27, wherein the network is one of a train network, an energy control network and an automation control network, and wherein the automation control network is one of a process control network and a production control network.

34. The data transmission system as claimed in claim 27, wherein the network is one of a train network, an energy control network and an automation control network, and wherein the automation control network is one of a process control network and a production control network.

35. The data transmission system as claimed in claim 30, wherein the network is one of a train network, an energy control network and an automation control network, and wherein the automation control network is one of a process control network and a production control network.

36. The data transmission system as claimed in claim 27, wherein the integrity check generating unit is integrated into the first gateway of the first control network and the integrity check verifying unit is integrated into the second gateway of the second control network.