Secure efficient registration of industrial intelligent electronic devices

1. A method for registering an intelligent electronic device with a certification authority, the intelligent electronic device being adapted for controlling a power electric device and being an embedded controller of a power electric device, the method comprising:

enrolling a configuration tool at the certification authority;

generating a one-time password for the intelligent electronic device and storing the one-time password in the certification authority and in the configuration tool, wherein the configuration tool requests a configuration certificate from the certification authority, the configuration tool authenticates itself at the certification authority with the configuration certificate, and the one-time password is encrypted with the configuration certificate of the configuration tool;

connecting to the intelligent electronic device with the configuration tool, wherein the configuration tool authenticates at the intelligent electronic device;

sending the one-time password from the configuration tool to the intelligent electronic device, wherein the one-time password is included in configuration data sent to the intelligent electronic device, wherein the configuration data furthermore includes at least one of an address of the certification authority and/or a root certificate of the certification authority;

enrolling the intelligent electronic device at the certification authority with the one-time password and registering the intelligent electronic device with the certification authority, wherein the one-time password is included into RA/CA registration data created by the intelligent electronic device from the configuration data;

receiving a device certificate from the certification authority in the intelligent electronic device.

2. The method of claim 1 , further comprising:

requesting an authentication from a user of the configuration tool and authorising the user by the certification authority for the configuration tool.

3. The method of claim 1 ,

wherein the one-time password is requested online via a secure communication connection;

wherein the one-time password is requested via a TLS and/or HTTPS connection.

4. The method of claim 1 ,

wherein the configuration tool authenticates at the intelligent electronic device with a user password;

wherein the user password for the authentication of the configuration tool at the intelligent electronic device is a standard password used for more than one intelligent electronic device.

5. The method of claim 1 ,

wherein the configuration tool is connected with the intelligent electronic device via a secure communication connection;

wherein the one-time password is sent from the configuration tool to the intelligent electronic device via a TLS and/or HTTPS connection.

6. The method of claim 1 ,

wherein enrolling the intelligent electronic device with the certification authority is based on the Simple Certificate Enrolment Protocol or the Enrollment over Secure Transport protocol.

7. The method of claim 1 , further comprising:

providing the configuration tool with a list of intelligent electronic devices;

generating different one-time passwords for the intelligent electronic devices in the list;

enrolling every intelligent electronic device from the list at the certification authority with its one-time password.

8. A non-transitory computer readable medium containing a computer program, which is adapted for performing a method for registering an intelligent electronic device with a certification authority, the intelligent electronic device being adapted for controlling a power electric device and being an embedded controller of a power electric device, the method comprising:

enrolling a configuration tool at the certification authority;

generating a one-time password for the intelligent electronic device and storing the one-time password in the certification authority and in the configuration tool, wherein the configuration tool requests a configuration certificate from the certification authority, the configuration tool authenticates itself at the certification authority with the configuration certificate, and the one-time password is encrypted with the configuration certificate of the configuration tool;

connecting to the intelligent electronic device with the configuration tool, wherein the configuration tool authenticates at the intelligent electronic device;

sending the one-time password from the configuration tool to the intelligent electronic device, wherein the one-time password is included in configuration data sent to the intelligent electronic device wherein the configuration data furthermore includes at least one of an address of the certification authority and/or a root certificate of the certification authority;

enrolling the intelligent electronic device at the certification authority with the one-time password and registering the intelligent electronic device with the certification authority, wherein the one-time password is included into RA/CA registration data created by the intelligent electronic device from the configuration data;

receiving a device certificate from the certification authority in the intelligent electronic device.

9. A system for registering intelligent electronic devices with a certification authority, the system comprising:

a configuration tool; and

a plurality of intelligent electronic devices being adapted for controlling power electric devices and being embedded controllers of the power electric devices;

wherein the configuration tool is adapted for:

enrolling at the certification authority for requesting a one-time password for each of the intelligent electronic devices from the certification authority or for providing a one-time password for each of the intelligent electronic devices to the certification authority, wherein the configuration tool requests a configuration certificate from the certification authority, the configuration tool authenticates itself at the certification authority with the configuration certificate, and the one-time password is encrypted with the configuration certificate of the configuration tool;

connecting to each of the intelligent electronic devices and authenticating at the respective intelligent electronic device; and

sending the respective one-time password to the respective intelligent electronic device, wherein the one-time password is included in configuration data sent to the intelligent electronic device wherein the configuration data furthermore includes at least one of an address of the certification authority and/or a root certificate of the certification authority;

wherein each intelligent electronic device is adapted for:

enrolling at the certification authority with the one-time password, wherein the one-time password is included into RA/CA registration data created by the intelligent electronic device from the configuration data; and

receiving a device certificate from the certification authority.

10. The system of claim 9 ,

wherein the configuration tool, the intelligent electronic devices and the certification authority are interconnected via a data communication network.

11. The method of claim 7 , further comprising:

requesting an authentication from a user of the configuration tool and authorising the user by the certification authority for the configuration tool.

12. The method of claim 11 ,

wherein the one-time password is requested online via a secure communication connection;

wherein the one-time password is requested via a TLS and/or HTTPS connection;

wherein the configuration tool authenticates at the intelligent electronic device with a user password;

wherein the user password for the authentication of the configuration tool at the intelligent electronic device is a standard password used for more than one intelligent electronic device.

13. The method of claim 12 , further comprising:

providing the configuration tool with a list of intelligent electronic devices;

generating different one-time passwords for the intelligent electronic devices in the list;

enrolling every intelligent electronic device from the list at the certification authority with its one-time password.

14. The method of claim 13 ,

wherein the configuration tool is connected with the intelligent electronic device via a secure communication connection;

wherein the one-time password is sent from the configuration tool to the intelligent electronic device via a TLS and/or HTTPS connection;

wherein the one-time password is included in configuration data sent to the intelligent electronic device;

wherein the configuration data furthermore include at least one of an address of the certification authority and/or a root certificate of the certification authority;

wherein enrolling the intelligent electronic device with the certification authority is based on the Simple Certificate Enrolment Protocol or the Enrollment over Secure Transport protocol.