Method and system for producing a secure communication channel for terminals

• US 10,243,745 B2
• Filed: 07/26/2016
• Issued: 03/26/2019
• Est. Priority Date: 07/28/2015
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Fries, Steffen, Schafheutle, Marcus
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/219,786
• Publication Number:
  US 20170033931A1
• Time in Patent Office: 973 Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A method, system, backend, terminal, and computer program product are disclosed for producing a secure communication channel for a terminal, the method having the following method steps. A first method step for setting up a secure communication channel between a communication partner and a backend by a communication protocol. A second method step for producing a communication channel between the communication partner and the terminal. A third method step for transmitting the channel binding information. A fourth method step for storing the channel binding information on the terminal. A fifth method step for creating a data structure and a first digital signature across the data structure y. A sixth method step for sending the data structure and the digital signature from the backend to the terminal. A seventh method step for checking authenticity of the data structure.

Claims

1. A system having:

a backend having

a first cryptography device;

a production device for creating a data structure and a first digital signature across the data structure using the first cryptography device and a first private key, the first digital signature being able to be checked using a public key;

a first communication device which is programmed by a first processor

to send the data structure and the first digital signature to a terminal;

to set up a secure communication channel to a communication partner by a communication protocol using the first cryptography device, an item of channel binding information respectively being stipulated by the communication protocol for the backend and for the communication partner;

the communication partner having

a second cryptography device;

a second communication device which is programmed by a second processor

to set up the secure communication channel to the backend using the second cryptography device,

to set up a communication channel to the terminal, and

to send the channel binding information to the terminal;

the terminal having

a third communication device which is programmed by a third processor

to set up the communication channel to the communication partner,

to receive the channel binding information and/or the data structure and/or the first digital signature and/or the public key, wherein the public key being made available to the terminal at an earlier time, the earlier time being, the manufacturing time of the terminal, the public key being protected, from being changed on the terminal;

a checking device for checking authenticity of the data structure by a checking algorithm using the first digital signature and the public key;

a memory for storing the channel binding information and/or the data structure and/or the first digital signature and/or the public key, wherein the first private key being a secret which is known to the backend, the secret being known, exclusively to the backend.

2. The system as claimed in claim 1, the system being a virtualized system.