Method and device for securely transmitting data
Cryptographic methods are used at the application level, unlike known methods using point-to-point connections that can only be sufficiently secured at the transport level. Integrity protection and confidentiality protection of data are implemented at the application level for use in network technology.
1. A method for secure transmission of data, comprising:
providing, by a programmed hardware processor, data connections from different start components via at least one intermediate component to a common target component, in each case, at least one of the different start components, the at least one intermediate component and the common target component are in an automation network;
grouping together, by the programmed hardware processor and carried out by at least one message exchange at the application layer, intermediate components, dependent upon an item of cryptographic information, to form a grouped intermediate component; and
transmitting, by the programmed hardware processor, the data by an extended manufacturing-message-specification protocol from the different start components via the grouped intermediate component to the common target component.
2. The method as claimed in claim 1 , wherein the at least one message exchange is carried out between at least two of the different start components, the intermediate components and the common target components.
3. The method as claimed in claim 2 , wherein the at least one message exchange implements at least one symmetrical cryptographic method and asymmetrical cryptographic method.
4. The method as claimed in claim 3 , wherein the at least one message exchange is carried out according to at least one of a Shared Key process, an http-Digest Authentication process, a Challenge-Response process, a Keyed Hash process, a Hash Function, a Diffie-Hellman process and a digital signature process.
5. The method as claimed in claim 4 , wherein at least one exchanged message includes a reference to at least one of an item of Nonce Information, a random number, a pseudo-random number, a command, an identity of a sender, an identity of a receiver, a time stamp and a sequence number.
6. The method as claimed in claim 5 , wherein at least one exchanged message contains the cryptographic information.
7. The method as claimed in claim 6 , wherein at least one exchanged message contains a checksum.
8. The method as claimed in claim 7 , wherein the at least one message exchange is carried out dependent on an encryption protocol.
9. The method as claimed in claim 8 , wherein said grouping together of the intermediate components is carried out by at least one of a routing operation, an allocation of network addresses, an application of a session protocol, the establishment of a secure data connection, transmission of a command, transmission of an item of cryptographic information and transmission of a confirmation message.
10. A device for secure transmission of data related to an automation network, comprising:
a programmed hardware processor configured to
provide data connections from different start components via at least one intermediate component in each case, to a common target component, at least one of the different start components, the at least one intermediate component and the common target component being part of the automation network;
group together the intermediate components, dependent upon an item of cryptographic information, to one intermediate component, the grouping carried out by at least one message exchange at the application layer; and
transmit the data, by an extended manufacturing-message-specification protocol, from the start components via the grouped together intermediate components to the common target component.
11. A non-transitory computer readable medium embodying instructions that when executed by a processor perform a method comprising:
providing data connections from different start components via at least one intermediate component to a common target component, in each case, at least one of the different start components, the at least one intermediate component and the common target component being part of an automation network;
grouping together intermediate components, dependent upon an item of cryptographic information, to form a grouped intermediate component, the grouping carried out by at least one message exchange at the application layer; and
transmitting the data, by an extended manufacturing-message-specification protocol, from the start components via the grouped intermediate component to the common target component.