Device and method for securing a negotiation of at least one cryptographic key between units
View Patent ↗A private key and a public key are provided during manufacture of a device and are stored in the device. At least one cryptographic key is subsequently negotiated, the negotiation being security-protected as a function of the generated private key and/or the public key. This method can find application in building automation.
1. A method for protecting negotiation of at least one cryptographic key to secure communication between devices, comprising:
storing a private key and a public key on each of the devices, during at least one of manufacture of each device and prior to being put into operation, the private key and the public key being provided for each device;
storing key pairs, each key pair including the private key and the public key for one of the devices, on a device management station;
creating at least one security certificate using a function of at least one of the public keys to allow an authentication check for at least one of the devices; and
negotiating the at least one cryptographic key between at least two of the devices, after the devices have been put into operation, as a function of the stored private key and the stored public key by the device management station.
2. The method as claimed in claim 1 , wherein said negotiating the at least one cryptographic key is conducted in accordance with a network protocol.
3. The method as claimed in claim 2 , wherein the network protocol implements at least one cryptographic method.
4. The method as claimed in claim 3 , wherein said negotiating is conducted at least partly by a building automation and control network protocol.
5. The method as claimed in claim 4 , wherein said negotiating includes at least one message exchange directly or indirectly between the devices.
6. The method as claimed in claim 5 , wherein the at least one message exchange is realized by at least one wireless or wired network.
7. The method as claimed in claim 6 , wherein said creating the at least one security certificate uses a function of at least one of the public keys.
8. The method as claimed in claim 7 , wherein at least one of the public keys, private keys and cryptographic keys has at least one of a timestamp, an access authorization indicator, an alphanumeric character string, a numeric value and key data.
9. The method as claimed in claim 8 , wherein said providing of the private key and the public key are performed by a key server.
10. A system for securing communication between devices by protecting negotiation of at least one cryptographic key to secure communication between the devices, comprising:
a device management station storing at least one security certificate using a function of at least one of the public keys to allow an authentication check and key pairs, each including a private key and a public key for one of the devices, and
each device having
a data storage facility;
a first computing entity of the device storing the private key and the public key of the device in the data storage facility, during at least one of manufacture of the device and prior to the device being put into operation, the private key and the public key being provided for the device; and
a second computing entity negotiating the at least one cryptographic key with another of the devices after the devices have been put into operation, as a function of the private key and the public key of the device as stored in one of the key pairs by the device management station.
11. The system as claimed in claim 10 , further comprising a key server providing the private key and the public key to the first computing entity of each of the devices.
12. A nontransitory computer readable medium embodying instructions that when executed by at least one processor perform a method of securing communication between devices by protecting negotiation of at least one cryptographic key between the devices, said method comprising:
storing a private key and a public key on each of the devices, during at least one of manufacture of each device and prior to being put into operation, the private key and the public key being provided for each device;
storing key pairs, each key pair including the private key and the public key for one of the devices, on a device management station;
creating at least one security certificate using a function of at least one of the public keys to allow an authentication check for at least one of the devices; and
negotiating the at least one cryptographic key between at least two of the devices, after the devices have been put into operation, as a function of the stored private key and the stored public key by the device management station.
13. The nontransitory computer readable medium as claimed in claim 12 , wherein said negotiating is conducted at least partly by a building automation and control network protocol.
14. The nontransitory computer readable medium as claimed in claim 13 , wherein at least one of the public keys, private keys and cryptographic keys has at least one of a timestamp, an access authorization indicator, an alphanumeric character string, a numeric value and key data.