Device and method for protecting a security module from manipulation attempts in a field device

1. A protection device for protecting a security module from manipulation attempts in a field device, the protection device comprising:

a controller configured for controlling the field device;

a security module;

a manipulation sensor for detecting whether a manipulation attempt is carried out on said field device;

a hardware interface unit functionally connected between said controller and said security module, said manipulation sensor passing signals to said interface unit and said interface unit configured for checking to independently determine whether the manipulation attempt has been detected by said manipulation sensor and for taking suitable safeguarding measures in response to determining that the manipulation attempt has been detected, said interface unit configured for enabling said controller to access cryptographic key data made available in said security module when said interface unit has not determined that the manipulation attempt has been detected by said manipulation sensor, said interface unit configured for blocking communication between said controller and said security module in order to prevent access to the cryptographic key data when said interface unit has determined that the manipulation attempt has been detected by said manipulation sensor, said manipulation sensor connected to said interface unit and configured for indicating the manipulation attempt to said interface unit; and

a power supply unit connected to said interface unit and configured for at least temporarily supplying said interface unit with electric power at least until said interface unit has completed the suitable safeguarding measures in response to determining that the manipulation attempt has been detected in order to thereby protect confidentiality of the cryptographic key data made available in said security module, said controller being powered by another power supply unit.

2. The device according to claim 1 , wherein said security module and said interface unit are embedded in a manipulation-protected environment.

3. The device according to claim 2 , wherein said manipulation sensor defines a first manipulation sensor, and further comprising:

a second manipulation sensor connected to said interface unit, embedded in the manipulation-protected environment, and configured for detecting manipulation attempts on the manipulation-protected environment and for indicating the manipulation attempts to the interface unit.

4. The device according to claim 3 , further comprising:

an input/output unit connected to said controller and configured for providing an external communication of said controller;

a third manipulation sensor connected to said input/output unit and configured for detecting manipulation attempts on the field device and for indicating the manipulation attempts to said controller; and

a memory unit connected to said controller and configured for storing data used in said controller.

5. The device according to claim 1 , further comprising:

an input/output unit connected to said controller and configured for providing an external communication of said controller;

a manipulation sensor connected to said input/output unit and configured for detecting manipulation attempts on the field device and for indicating the manipulation attempts to said controller; and

a memory unit connected to said controller and configured for storing data used in said controller.

6. The device according to claim 1 , wherein said interface unit is a programmable logic device.

7. A method of protecting a security module from manipulation attempts in a field device, the method which comprises:

providing a field device with a protection device;

providing the protection device with a controller configured for controlling the field device, a security module, a manipulation sensor, a hardware interface unit, a power supply unit, and a further power supply unit, wherein the protection device protects the security module from manipulation attempts;

sending a request, by the controller in the field device for cryptographic key data of the security module, to the interface unit;

detecting, with the manipulation sensor, whether a manipulation attempt is carried out on the field device and passing signals to said interface unit to indicate the manipulation attempt;

checking in the interface unit to independently determine whether a manipulation attempt on the field device has been detected;

in the interface unit, taking suitable safeguarding measures in response to determining that the manipulation attempt has been detected, wherein the safeguarding measures include blocking communication between the controller and the security module in order to prevent a transmission of the cryptographic key data in the security module to the controller by the interface unit;

when no manipulation attempt has been detected, transmitting the cryptographic key data of the security module to the controller by the interface unit; and

at least temporarily powering the interface unit by e-Re the power supply unit at least until the interface unit has completed the suitable safeguarding measures in response to determining that the manipulation attempt has been detected in order to thereby protect confidentiality of the cryptographic key data in the security module, and powering the controller by the further power supply unit.

8. The method according to claim 7 , which further comprises erasing the cryptographic key data in the security module by the interface unit if a manipulation attempt has been detected.

9. The method according to claim 7 , wherein the step of sending the request includes authenticating the controller to the security module.

10. The method according to claim 9 , wherein the step of inhibiting the transmission includes preventing the authentication of the controller to the security module by the interface unit.

11. The method according to claim 7 , wherein the step of inhibiting the transmission includes blocking, by the interface unit, a communication of the controller with the security module.

12. The method according to claim 7 , wherein the step of checking, carried out in the interface unit, to determine whether a manipulation attempt on the field device has been detected comprises evaluating a manipulation sensor connected to the interface unit.

13. The method according to claim 7 , which further comprises:

at least temporarily supplying the interface unit with electric power from the one power supply unit if the other power supply unit supplying power to the controller has been interrupted or if the controller has been switched to inactive state.

14. A field device, comprising a protection device for protecting a security module from manipulation attempts in a field device, the protection device comprising:

a controller configured for controlling the field device;

a security module;

a manipulation sensor for detecting whether a manipulation attempt is carried out on said field device;

a hardware interface unit functionally connected between said controller and said security module, said manipulation sensor passing signals to said interface unit and said interface unit configured for checking to independently determine whether the manipulation attempt has been detected by said manipulation sensor and for taking suitable safeguarding measures in response to determining that the manipulation attempt has been detected, said interface unit configured for enabling said controller to access cryptographic key data made available in said security module when said interface unit has not determined that the manipulation attempt has been detected by said manipulation sensor, said interface unit configured for blocking communication between said controller and said security module in order to prevent access to the cryptographic key data when said interface unit has determined that the manipulation attempt has been detected by said manipulation sensor, said manipulation sensor connected to said interface unit and configured for indicating the manipulation attempt to said interface unit; and

a power supply unit connected to said interface unit and configured for at least temporarily supplying said interface unit with electric power at least until said interface unit has completed the suitable safeguarding measures in response to determining that the manipulation attempt has been detected in order to thereby protect confidentiality of the cryptographic key data made available in said security module, said controller being powered by another power supply unit.

15. The device according to claim 1 , wherein said manipulation sensor is directly connected to said interface unit.

16. The method according to claim 7 , which further comprises directly connecting the manipulation sensor to the interface unit.

17. The field device according to claim 14 , wherein said manipulation sensor is directly connected to said interface unit.

18. The method according to claim 7 , which further comprises communicating externally from the field device with an input/output unit, wherein the field device includes the input/output unit, the controller, the security module, and the interface unit.