Method and System for Secure Data Transmission with a VPN Box

• US 20130191907A1
• Filed: 09/05/2011
• Published: 07/25/2013
• Est. Priority Date: 09/30/2010
• Status: Active Grant

• Current Assignee: Siemens Mobility GmbH (Siemens AG)
• Original Assignee: Siemens AG
• Inventors: Falk, Rainer, Fries, Steffen
• Granted Patent: US 11,171,922 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 19/4185 characterised by the network communication
• CPC Class Codes: G05B 2219/31198 VPN virtual private networks
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

A VPN box is connected upstream of a field device. The VPN box uses a secret cryptographic key of the field device for authentication when setting up a VPN tunnel and/or when setting up a cryptographically protected communication link.

Claims

1-6. -6. (canceled)

7. :

A method for secure data transmission between a first communication device and a second communication device, the method which comprises;

assigning a box for setting up and operating a Virtual Private Network (VPN) link to at least one of the first and second communication devices;

determining, with the box, a secret key of the respectively assigned communication device while setting up the VPN link;

setting up, with the box, a session key for the VPN link on a basis of the secret key; and

securely transmitting data via the VPN link.

8. :

The method according to claim 7, which comprises determining the secret key via a physically protected communication link between the assigned communication device and the box.

9. :

The method according to claim 7, which comprises;

using the secret key by the box to decrypt a further key stored on the box; and

setting up the session key on the basis of the decrypted further key.

10. :

A method for secure data transmission between a first communication device and a second communication device, the method which comprises;

assigning a box for setting up and operating a Virtual Private Network (VPN) link to at least one of the first and second communication devices;

authenticating, with the box, the respectively assigned communication device;

determining, with the box, a key assigned to the authenticated communication device;

setting up, with the box, a session key for the VPN link on a basis of the assigned key; and

securely transmitting data via the VPN link.

11. :

A system for secure data transmission, comprising;

a first communication device and a second communication device forming communication partners for the secure data transmission;

a box assigned to at least one of said first and second communication devices for setting up and operating a Virtual Private Network (VPN) link;

said box being configured to determine a secret key of the assigned communication device during a setup of the VPN link;

said box being configured to set up a session key for the VPN link on a basis of the secret key;

wherein the data is securely transmitted via the VPN link.

12. :

A system for secure data transmission, comprising;

a first communication device and a second communication device forming communication partners for the secure data transmission;

a box assigned to at least one of said first and second communication devices for setting up and operating a Virtual Private Network (VPN) link;

said box being configured to authenticate the respectively assigned communication device;

said box being configured to determine a key assigned to the authenticated communication device;

said box being configured to set up a session key for the VPN link on a basis of the assigned key;

wherein the data is securely transmitted via the VPN link.