Method and system for secure data transmission with a VPN box

• US 11,171,922 B2
• Filed: 09/05/2011
• Issued: 11/09/2021
• Est. Priority Date: 09/30/2010
• Status: Active Grant

• Current Assignee: Siemens Mobility GmbH (Siemens AG)
• Original Assignee: Siemens Mobility GmbH (Siemens AG)
• Inventors: Falk, Rainer, Fries, Steffen
• Primary Examiner(s): Dhruv, Darshan I
• Application Number:
  US13/877,263
• Publication Number:
  US 20130191907A1
• Time in Patent Office: 3,718 Days
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 19/4185 characterised by the network communication
• CPC Class Codes: G05B 2219/31198 VPN virtual private networks
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

A VPN box is connected upstream of a field device. The VPN box uses a secret cryptographic key of the field device for authentication when setting up a VPN tunnel and/or when setting up a cryptographically protected communication link.

Claims

1. A method for secure data transmission between a first communication device and a second communication device, the method which comprises:

assigning a Virtual Private Network (VPN) box, for setting up and operating a Virtual Private Network (VPN) link between the first and second communication devices, to at least one assigned communication device selected from the group consisting of the first communication device and the second communication device, wherein the VPN box is located in the link between the first and second communication devices;

obtaining, by the VPN box, a secret key of the assigned communication device during the setup of the VPN link, wherein the secret key is stored on the assigned communication device and is obtained and used by the box for the setup of the VPN link; and

setting up, by the box, a session key for the VPN link based on the secret key, and securely transmitting data via the VPN link.

2. The method according to claim 1, which comprises reading the secret key via a physically protected communication link between the assigned communication device and the VPN box.

3. The method according to claim 1, which comprises:

using the secret key by the box to decrypt a further key stored on the VPN box; and

setting up the session key on the basis of the decrypted further key.

11. The method according to claim 1, which comprises:

reading the secret key out of the assigned communication device while setting up the VPN link.

4. A method for secure data transmission between a first communication device and a second communication device, the method which comprises:

assigning a Virtual Private Network (VPN) box, for setting up and operating a Virtual Private Network (VPN) link between the first and second communication devices, to at least one assigned communication device selected from the group consisting of the first communication device and the second communication device, wherein the VPN box is located in the link between the first and second communication devices;

authenticating, with the VPN box, the assigned communication device;

with the VPN box, obtaining a key assigned to the authenticated communication device;

setting up, with the VPN box, a session key for the VPN link based on the assigned key, wherein the session key is stored on the assigned communication device and is obtained and used by the box for the setup of the VPN link; and

securely transmitting data via the VPN link.

9. The method according to claim 4, wherein a Certificate Authority is integrated in the VPN box.

10. The method according to claim 4, wherein a Certificate Authority is integrated in a communication device selected from the group consisting of the first communication device and the second communication device.

12. The method according to claim 4, which comprises:

reading the key out of the assigned communication device.

5. A system for secure data transmission, comprising:

a first communication device and a second communication device forming communication partners for the secure data transmission;

a Virtual Private Network (VPN) box including a storage memory, said VPN box assigned to at least one of said first and second communication devices, said VPN box for setting up and operating a Virtual Private Network (VPN) link between said first and second communication devices, said VPN box located in the link between said first and second communication devices;

said VPN box being configured to obtain a secret key of the assigned communication device during a setup of the VPN link, wherein the secret key is stored on said assigned communication device and is obtained and used by said box for the setup of the VPN link;

said VPN box being configured to set up a session key for the VPN link based on the secret key;

wherein the data is securely transmitted via the VPN link.

13. The system according to claim 5, wherein:

said box is configured to read the secret key out of the assigned communication device during the setup of the VPN link.

6. A system for secure data transmission, comprising:

a first communication device and a second communication device forming communication partners for the secure data transmission;

a Virtual Private Network (VPN) box including a storage memory, said VPN box assigned to at least one of said first and second communication devices for setting up and operating a Virtual Private Network (VPN) link between said first and second communication devices, said VPN box located in the link between said first and second communication devices;

said VPN box being configured to obtain a key, wherein the key is stored on said assigned communication device and is obtained and used by said box for the setup of the VPN link;

said VPN box being configured to set up a session key for the VPN link based on the key;

wherein the data is securely transmitted via the VPN link.

7. The system according to claim 6, further comprising a Certificate Authority integrated in said VPN box.

8. The system according to claim 6, further comprising a Certificate Authority integrated in a communication device selected from the group consisting of said first communication device and said second communication device.

14. The system according to claim 6, wherein:

said box is configured to read the key out of the assigned communication device.