WO2008098529A1 - Method for activating functions of a field device, and electric field device - Google Patents

Abstract

The invention relates to a method for activating functions of a field device (40, 41), wherein licensing data (LI) present in an internal data storage unit of a first field device (40) is transmitted from the first field device to a second field device (41) for issuing the functions to be activated. In order to configure such a method so that the transmission is enabled at a comparatively low expense with high security against spying or unauthorized copying of the licensing data (LI), the licensing data (LI) is encrypted and transmitted to the second field device (41) together with coding information (KI). The invention further relates to an accordingly equipped electric field device (40, 41).

Description

description

Method for activating functions of a field device and electric field device

The invention relates to a method for activating functions of a field device, in which in an internal data memory of a first field device present license data are transmitted from the first field device to a second field device, wherein the license data indicate the unlocked functions of the respective field device such that at in internal Memory of the respective field device present license data, the corresponding functions of the respective field device are enabled. The invention also relates to a correspondingly configured electric field device.

Electrical field devices (often referred to as "Intelligent Electronic Devices" - IEDs) are commonly used in automation systems to control and monitor automated processes such as electrical power supply networks for transmitting and distributing electrical energy, and field devices are also used in industrial manufacturing processes, chemical or process manufacturing - And conversion processes and distribution processes used for water or gas.

In the case of electrical power transmission and distribution, the automated process is an electrical power grid with its primary components, such as generators, inverters, transformers, and electrical power transmission lines. The automation system for the electrical energy supply network has in this case, on the one hand electrical control devices, in cooperation with a ward control room or a Netzsteuerleitarte make functions for controlling the electrical power grid (for example, to turn on and off of circuit breakers for activating generators). On the other hand, the automation system in this case also includes electrical protection devices that perform a monitoring of the status of the electrical power supply network to comply with predetermined operating parameters. In the event that the status of the electrical power grid is outside an allowable operating range, such protection devices automatically take countermeasures, such as switching off certain faulty sections of the electrical energy supply network before. Further field devices used in the automation of electrical energy supply networks are, for example, power quality devices which monitor the electrical energy quality of the electrical energy transmitted by the electrical energy supply network.

Nowadays, electric field devices of this type usually comprise a housing with operating and display elements as well as connections and interfaces for communicating data into or out of the field device. Within the housing usually device assemblies are included, which have at least one data processing device in the form of, for example, a microcontroller, which controls the tasks and functions of the electric field device. For this purpose, the data processing device usually uses a device software specially tailored to the functions of the electric field device, which contains the necessary databases, settings, instructions and commands which are necessary for carrying out the desired functions of the electric field device. Recently, the manufacturers of electric field devices have increasingly begun to offer universal electric welders, which can be tailored by measures in the device software especially to the requirements in the desired field of application, so that no corresponding large number of electrical field devices different functional equipment must be produced and kept , For this purpose, such universal electric welders have a device software that already includes all possible functions for the device. Depending on the intended use of the field device, these functions can be enabled or disabled in the device software. For this purpose, the device software cooperates with so-called license data, which specify which device functions are to be enabled and which are to be blocked. Without such license data, all device functions are in the locked state, it can only be provided that some basic functions of the field device, which are necessary for setting up the license data in the field device (such as the control of interfaces of the field device, copy and Memory functions, as well as the display of information on an optionally existing display device of the field device), are enabled.

Since the selling price of such a universal field device usually depends on the number and complexity of the enabled functions, it may well be in the interest of the purchaser of the field device not to have the full range of functions enabled, but only those functions that the electric field device in his Operational area must actually perform.

When buying an electric field device, the buyer specifies the desired device functions and receives from the manufacturer of the electric field device in addition to the electric field device, a license file with corresponding license data indicating the functions to be released.

The fact that such universal field devices are now generally suitable for being able to fulfill all possible tasks depending on the enabled functions considerably facilitates the production and storage of the field devices, since it is not necessary to generate and maintain a plurality of special field devices of different equipment , This is especially for the provision of replacement field devices for replacement defective. Field devices are an advantage.

However, the activation of functions of such a universal field device by means of license data also entails the risk of improper use of the license data for unauthorized upgrading of multiple universal field devices to the scope of functions specified by the license data. On the one hand, for example, the license data could be spied on in order to derive from it a scheme for the own creation of license data for arbitrary functional compilations. On the other hand, with freely accessible license data, a buyer could purchase several cheap field devices with limited functionality and only one expensive field device with full functionality and copy the license data of the expensive field device and distribute them to the low-priced field devices in order to enhance their full functionality. Since the manufacturer of the field devices consequently has a legitimate interest in that the license data is not spied on and that no unauthorized copies of the license data are made, the license data is usually stored in a non-readable storage area of the field device or bound to the specific field device (for example, they only have for exactly one serial number validity). To this In this way, unauthorized upgrading of lower-functional electric field devices by spying on the license data or simply copying the license data of the full-featured field device can be prevented.

However, field devices are often used in areas where no communication with the manufacturer of the field device is possible. In such areas, it has been associated with difficulties to provide a replacement field device same functional scope for a defective field device of an automation system in a short time. Usually, in such a case, the operator of the automation system must establish a communication link with the manufacturer of the field device in order to obtain from this a new license file with license data for enabling corresponding functions of the replacement field device. As already mentioned, this is not possible in all areas, so that in this case the license data is processed in a comparatively slow way, e.g. on a data medium by post, must be conveyed. If the license data are in principle a sequence of alphanumeric characters, this could also be passed on by telephone, but this method is highly susceptible to errors, especially with longer character strings.

Therefore, there is usually the only way to fast

Replacing the defective field device is to transfer the license data from the defective field device to the replacement field device. Thus, no unnecessarily long failures of the automation system must be accepted. However, unsecured transmission of the license data from the defective field device to the replacement field device offers the possibility of malicious spying or copying of the license data. In order to enable a secure transmission of license data from one field device to another field device, German patent application DE 103-53 499 A1 proposes the use of a so-called "dongle." Such a dongle is a component in which data is available that is from This data can only be read by a corresponding data processing device which is set up to read the dongle If such a dongle is connected to a corresponding interface of the data processing device of a field device, the data processing device can store license data stored in the dongle In the event of a device defect, the dongle may be disconnected from the defective field device and connected to an intact replacement field device The data processing device of the intact replacement field device may then access the license data in the dongle en and enable the corresponding functions of the replacement field device, while the functions are locked in the defective device in the absence of the dongle. In such an approach, the presence of a corresponding dongle and a dedicated interface on the field devices is always required.

The invention is based on the object, the transmission of license data from a first to a second field device for

Enable the functions of the second electric field device with comparatively little effort with high security against spying or unauthorized copying the license data to allow.

This object is achieved by a method of the type mentioned, in which the following steps are performed: Generating key information in the first field device;

Generating a key using the key information; - encrypting the license data in the first field device using the key;

Storing the encrypted license data and at least part of the key information in an external data memory; - Deleting the license data from the internal data memory of the first field device while blocking the functions of the first field device;

- transferring the encrypted license data and the part of the key information stored in the external data memory from the external data memory to the internal data memory of the second field device;

Generating the key in the second field device using the part of the key information;

- decrypt the encrypted license data using the key;

- Activation of functions of the second field device using the license data.

An advantage of the method according to the invention is that the transfer of the license data from a first field device to a second field device requires little effort, ie no special hardware such as a _. Dongle is necessary. It is rather any external data storage, such as a common USB stick, sufficient. At the same time, the security against spying and unauthorized copying of the license data is advantageously increased by virtue of the fact that the license data are transmitted in encrypted form and thus are not readily readable. With the license data, key information is transferred from the first to the second field. device with which the second field device ^' can determine the key for decrypting the license data. At the same time, the license data is deleted on the first field device so that it can no longer perform the device functions, since these are now locked.

Some advantageous further developments indicate possibilities to further increase the security against spying and unauthorized copying of the license data.

Thus, according to an advantageous embodiment of the method according to the invention, prior to generating the key information in the first field device, the second field device generates a key base information and stores it in its internal data memory and in the external data memory and the first field device stores the key using the key information and the key base information is generated. In this way, a key for encrypting the license data can be used, which is known only to the two field devices, between which the license data is transmitted.

The complexity of the method and thus the security against tampering can alternatively be further increased by the fact that, prior to generating the key information in the first field device, the second field device generates a key base information and stores it in its internal data memory and in the external data memory the first field device generates the key information using the key base information.

It is also considered advantageous if the second field device stores the key using the key information transmitted with the external data memory and the key information in generates key base information available to the internal data memory of the second field device.

In order to further protect the license data against unauthorized intervention, it may further be provided that the key base information is generated by the second field device using a first secret information, wherein the first secret information is stored in the second field device, and the key information and the key generated by the first field device using a second secret information, wherein the second secret information is stored in the first field device. As secret information advantageously random numbers can be used, which have been generated in the second and the first field device. Depending on the desired security standard, the first and / or second secret information in the respective field device can also be stored in specially protected, for example externally non-readable, data memories.

In order to additionally ensure the method according to the invention that the data present on the external data memory is changed in order to gain knowledge about the key used and to spy out the license data, it is provided according to a further advantageous embodiment of the method according to the invention, that the respective field device on the external data storage and test data are stored, which have been generated using the data to be stored on the external data memory.

Advantageously, it is provided in this context that when transferring data from the external data memory into the internal data memory of the respective field device, the Test data are respectively checked to see whether they match the data available in the external data memory and further processing of the data transferred to the internal data memory takes place only if the test result is positive.

In order to protect the test data particularly well against external manipulation, according to a further advantageous embodiment of the method according to the invention, it may be provided in this context that the test data are also generated using code data known to both field devices, the code data being stored in the respective field device are, and the verification of the test data using the code data is made. The code data can be stored, for example, in a data memory of the respective field device that can not be read out externally.

Finally, in order to prevent multiple same test data are also used in the same content of the remaining data stored on the external data memory data, it is further provided according to an advantageous embodiment in this connection that the test data a generated as a ^'random number are also in use in the respective field device Safety number are generated, the safety number is additionally stored on the external data memory and the verification of the test data using the safety number is made.

The above-mentioned object is also achieved by an electric field device having a data processing device which is set up to perform a method according to one of the previously described embodiments in cooperation with a further electric field device. For a more detailed explanation, the invention will be explained in more detail below with reference to exemplary embodiments. Show this

1 shows a schematic representation of an electric field device with unlockable functions,

FIG. 2 shows a schematic front view of two electrical field devices, between which license data can be transmitted by means of an external data memory,

FIG. 3 shows a first exemplary embodiment of a method for activating functions of an electric field device,

FIG. 4 shows a second exemplary embodiment of a method for activating functions of an electric field device,

FIG. 5 shows a third exemplary embodiment of a method for activating functions of an electric field device,

Figure 6 shows a fourth embodiment of a method for unlocking functions of an electric

Field device,

FIG. 7 a schematic representation of an external data memory with data and test data stored thereon,

8 shows a further schematic representation of an external data memory with data and test data stored thereon and 9 shows a third schematic representation of an external data memory with data and test data stored thereon.

FIG. 1 very schematically shows an electric field device 10. The electric field device 10 has a data processing device 11, which includes a computing device, not shown, such as a microprocessor and also not shown data memory. Via an interface 12, the data processing device 11 has the possibility of exchanging data with external devices, such as external data memories.

The electric field device 10 is connected in a manner not shown with an automated process from which it can, for example, via measurement inputs data and to which it outputs via control outputs commands that cause, for example, an electrical circuit breaker of an electrical energy supply network to open or close its switch contacts , In a manner not shown again, the field device 10 may furthermore have the possibility of establishing a communication connection with other electrical field devices or hierarchically higher-level control devices, such as, for example, a station or network control center. Such a communication connection can take place, for example, via wired communication buses.

The electric field device 10 is suitable for carrying out predetermined functions via a device software. In order to illustrate this situation, FIG. 1 schematically illustrates a functional scope 13 of the electric field device 10 which is intended to comprise seven exemplary individual functions 14a to 14g. Of course, the number of possible functions of the electric field device 10 not set to seven functions; Rather, any number of functions in the functional scope 13 of the electric field device 10 can be present.

In order to be able to maintain as few individual field device rows as possible with different functional scope, field device manufacturers have recently - as already explained - increasingly offered to offer field devices which include the complete functional scope of a universal field device with respect to their hardware and software equipment. In order nevertheless to be able to provide the customer with field devices tailored to his specific applications, the functions available in the device software can be enabled or disabled depending on the field of application of the electric field device. From the combination of the respective enabled functions of the electric field device then results in a specially tailored to the requirements of the customer electric field device in which the unneeded functions are locked accordingly. When selling such field devices, the device price is usually determined as a function of the number and complexity of the enabled device functions.

The definition of which of the device functions is disabled and which are enabled is determined via license data present in the electric field device in a memory area that can not be read from the outside. For example, the field device 10 shown in FIG. 1 contains license data 15, which only the data processing device 11 of the field device 10 can access. On the basis of the license data 15, the data processing device 11 determines which of the device functions 14a to 14g should be released from the functional scope 13 of the electric field device 10. In the example according to Figure 1, the device functions 14b, 14c and 14f unlocked, which is indicated by an open lock, while the other device functions 14a, 14d, 14e and 14g are locked, which is indicated by a closed lock. If the field device 10 is, for example, an electrical protection device for monitoring electrical power supply lines, then the enabled functions may be, for example, a function for executing a distance protection algorithm, a function for automatic reclosing of a circuit breaker after an occurring fault, and a fault Function to locate a fault, while the disabled device functions may be, for example, a function to perform a differential protection algorithm, an overcurrent time protection function, a motor protection function, and a transformer protection function. In this way, by using the license data, a universal protection device with a variety of possible protection functions is adapted to the scope of protection of a distance protection device. Due to its smaller range of functions, such a dance protection device can be sold comparatively cheaper than an electrical protection device in which all protective functions are enabled.

Frequently, electric field devices are used in areas in which no communication connection between the operator of the electric field device and the manufacturer of the electric field device can be ensured. If a defect occurs in a field device in such a region, so that the field device must be replaced, it must be ensured that a replacement field device with the same functional scope can be provided in the shortest possible time. The provision of a corresponding field device is simplified by the fact that the replacement field device by its hardware and software equipment already has the ability to perform all device functions of a field device. However, these device functions are still locked in the raw state of the field device. For activation, corresponding license data must be transmitted to the replacement field device in order to inform the data processing device of the replacement field device which device functions are to be unlocked. Since no communication connection between the operator of the electric field device and the manufacturer of the electric field device who could provide such license data is available in the addressed areas, it makes sense to provide the necessary license data from the defective electric field device to the replacement field device transferred to.

In this context, FIG. 2 shows a first field device 20 and a second field device 21, wherein it should be assumed that the first field device 20 has a defect, so that it has to be replaced by the second field device 21 as a replacement field device. As already mentioned, the second field device 21 basically has the same hardware and software equipment as the first field device 20. The device functions of the second field device 21 alone must be enabled according to the device functions present in the field device 20.

A defect in the first field device 20 will usually not affect all functions, in particular not a limited basic functionality, so that the data processing device of the first field device 20 still has the possibility to read the license data from the non-readable memory area and to an external one Data storage 22, such as a USB stick to transfer. Instead of a USB stick can also any other external data storage such as floppy disks, optical storage media, flash memory cards, and external hard drives are used. For this purpose, the first field device must have a corresponding interface 23, for example a USB interface. From the external data memory 22, the license data can then be transmitted to the second field device 21. This has a corresponding interface 24. In the raw state of the second field device-that is to say for functions not yet enabled-a base functionality is likewise already ensured, so that a transfer of the license data into a non-readable data memory of the second electric field device 21 is possible and, according to the thus acquired license data, an activation of the respective one Device functions can be done.

Since during a transfer of the license data from the first field device 20 to the second field device 21, the license data are temporarily unprotected on the external data memory 22, the security must be ensured here that the license data can not be spied on or copied from the external data storage without authorization, changed and can be transmitted to other field devices located in the raw state, so as to produce without authorization a large number of electrical field devices with correspondingly enabled device functions. Some embodiments of methods to ensure the necessary security, are explained in more detail with reference to the following figures 3 to 6.

A first embodiment of such a method for

Transfer of license data from the first electric field device to a second electric field device for enabling the functions of the second field device will be explained with reference to FIG. FIG. 3 shows a highly schematic one first electric field device 40, a _. second electric field device 41 and an external data memory 42 in the form of a USB stick used for transmitting the license data from the first field device 40 to the second field device 41. The first field device 40 initially has valid license data that determine the scope of its enabled functions. The second field device is initially not in possession of the necessary license data. The license data from the first field device 40 are to be transmitted to the second field device 41 in order to be used there for the activation of functions.

The method for securely transmitting the license data proceeds as follows: In the first field device 40, a key information KI is generated in a step 33a. Using this key information KI, the data processing device of the first field device 40 generates in a next step 33b a key that can be used to encrypt digital data using encryption methods known per se. Any algorithms can be used to generate the key from the key information KI. If the key information KI is, for example, an arbitrary number, then the key can be generated therefrom according to a predetermined algorithm, for example a cross-sum. The key information KI may alternatively also indicate, for example, a sequence number in a key table additionally stored in the electric field device 40, on the basis of which the data processing device of the first field device 40 selects a specific key from the key table.

In a further step 33c, the license data LI previously stored in a non-readable memory area 34 of the first field device 40 are stored using the previously generated license data LI. key encrypted so that now encrypted license data is available. The encrypted license data as well as at least part of the key information KI generated in step 33a are transferred to the external data memory 42 as indicated by an arrow 36. In addition, the license data LI are deleted from the non-readable memory area 34 of the first field device 40, so that there are no more license data in this and the data processing device of the first field device 40 now blocks all device functions.

The encrypted license data and the key information KI are now present on the external data memory 42. However, a decryption of the license data is not possible outside of a corresponding field device, since the algorithm is unknown, as from the key information KI the key to be used to decrypt the license data can be generated.

The external data memory 42 is now disconnected from the first field device 40 and connected to an interface of the second field device 41. In a following step indicated by a further arrow 37, the encrypted license data and the part of the key information KI present on the external data memory are transmitted to the second field device 41.

The data processing device of the second field device 41 generates the key necessary for decrypting the encrypted license data from the key information KI in a following step 38a. For this purpose, the second field device 41 must also know the algorithm of how to derive the key from the key information KI. In a next step 38b, the encrypted license data is decrypted using the key generated in the second field device 41, and the thus decrypted license data is stored in a memory area 39 that can not be read out from the outside. Since license data are now available in the second field device 41, the data processing device can use this license data to enable the device functions of the second field device 41. Since it is the same license data that was previously stored in the first field device 40, the same device functions that were previously enabled in the first field device 40 are also released. In this way, a replacement field device is thus provided by the second field device 41, which offers the same functional scope as the exchanged first field device 40.

The method just described makes it possible to transmit the license data in encrypted form from the first field device 40 to the second field device 41, so that spying on the license data by external access to the external data memory 42 is prevented. However, since each receiving

Field device must know the algorithm, as the key for decrypting the license data is generated from the key information KI, is not completely prevented by this method that using the key information and the encrypted license data inadmissible other field devices than that second field device 41 are extended to the appropriate range of functions.

For this reason, with a further exemplary embodiment, which will be explained below with reference to FIG. 4, a possibility is indicated of how only the two field devices, between which the license data are transmitted, know the key for decrypting the license data. In FIG 4, a first field device 40, a second field device 41 and an external data memory 42 are again shown.

In a first step 43a, a key base information BI is first generated by means of the data processing device of the second electric field device 41. This key base information BI is stored on the external data memory 42 as indicated by an arrow 44a. The external data memory 42 is now separated from the second field device 41 and connected to the first field device 40. As indicated by an arrow 44b, the key base information BI is then transferred to the internal memory of the first field device 40. The data processing device of the first field device 40 now generates a key information item KI in a further step 45a, as already explained with reference to FIG. In a subsequent step 45b, the key is generated using this key information and the key base information BI generated in the second field device 41. The algorithm for generating the key in step 45b consequently uses both the key information KI and the key base information BI, so that the key is thus a function of both the key information KI and the key base information BI. For example, it can be provided here that the cross sum of the key information KI is formed to generate the key, and then this checksum is exponentiated with the key base information. Any other links are also conceivable.

Using the key thus generated, the license data LI previously stored in a non-readable memory area 46 of the first field device 40 are encrypted in a further step 45c. The encrypted license data and at least a part of the key information KI become transmit the external data memory 42, as indicated by arrow 47a. By separating the external data memory 42a from the first field device 40 and reconnecting it to the second field device 41, the encrypted license data and the present part of the key information KI are transmitted to the second field device 41, as indicated by an arrow 47b. The license data is then deleted from the first field device 30.

In a following step 48, the key for decrypting the license data is generated using the present part of the key information KI and the key base information BI already present in the second field device 41. In a further step 48b, the encrypted license data is decrypted using this key and stored in a non-readable memory area 49 of the second field device 41.

Since the license data has now been transferred to the second field device 41, the functions of the second field device 41 can be released in accordance with the license data.

In the method described in connection with FIG. 4, the particular advantage resides in the fact that the key base information is transmitted first

BI from the second field device 41 to the first field device 40, so to speak agree the two field devices to a key to be used, since the key is generated in each case using information that has been generated partly in the first field device 40, partly in the second field device 41 ,

The encrypted license data and the key information KI can therefore not be transmitted to any number of further field devices, because in these other field devices the key base information BI, which is used to generate the key It is not necessary to decrypt the license data.

FIG. 5 shows an alternative embodiment of a method in which functions of the second field device are released by transferring the license data from a first field device to a second field device. The method according to FIG. 5 largely corresponds to the method already explained for FIG. 4, for which reason the same reference numerals have been used in FIGS. 4 and 5 to designate corresponding method steps and components.

The method according to FIG. 5 differs from the method according to FIG. 4 only in that the key information KI is generated in the first field device 40 using the key base information BI that has been generated in the second field device 41, and the key only is generated using the key information KI (ie not the key base information BI). However, since the key information KI also depends on the key base information BI, the key base information also indirectly enters into the key formation. Since the key information KI depends on the key base information BI, the key in the second field device 41 can therefore be derived with knowledge of the key information KI and the key base information BI. The further method steps correspond to those of the method explained for FIG. 4, so that reference is made to the explanation of FIG. 4 at this point.

Finally, FIG. 6 shows a further exemplary embodiment in which the security against spying and unauthorized copying of the license data is increased even further by additional method steps. Since the method according to 6 largely corresponds to the method according to FIG. 5, again corresponding method steps and components in FIGS. 5 and 6 have been designated by the same reference numerals.

First, in a step 60, a first secret information RNl, for example a random number, is generated. In a subsequent step 61, the key base information BI is now generated using this first secret information RN1. In the first electric field device 40, a second secret information RN2, for example a second random number, is generated in a step 62. Using the second secret information RN2. In a subsequent step 63, the key information KI is generated, wherein the key information KI is also generated using the key base information BI. The secret information RNl is known only to the second field device 41 and the second secret information RN2 to the first field device 40 only. They are preferably not readily readable from the outside stored in a secure memory area of the respective field device. Depending on the required security standard, however, the secret information RN1 and RN2 can also be stored in normal memory areas without access protection.

In the first field device 40, the key for encrypting the license data LI is generated in a step 64 using the key information KI dependent on the key base information BI and the second secret information RN2. The encrypted license data and at least part of the key information KI are then transmitted to the second field device 41; the license data is deleted from the first field device 40. Finally, in a step 65 in the second field device 41, the key to decrypt. the receiving license data using both the key information KI, and the key base information BI and the first secret information RNl formed.

Because the secret information RN1 and RN2 are known exclusively to the respective field devices 40 and 41 and are stored in these preferably in non-readable memory areas, the security against unauthorized use of the encrypted license data is increased still further, since field devices other than the second field device 41 may not know the first secret information RNl for generating the key.

The method according to FIG. 6 will be explained in more detail below using the example of the so-called Diffie-Hellman key exchange method.

In the second field device 41, according to step 60, a random number a is formed as secret information RN1. In addition, according to step 61 in the second field device 41 as key base information BI a prime number p, a primitive root g and a value A according to

A = g ^a mod p

where "mod" stands for the mathematical operation "Modulo". The key base information BI in this case thus consists of three separate numbers, namely the prime number p, the primitive root g and the value A. Since the value A has been formed using the first secret information RN1 in the form of the random number a, the Schlüsselbasisin- formation BI was thus generated using the first secret information RNl. , ^•

The key base information BI is transferred to the external data memory 42 in step 44a, so that now the prime number p, the primitive root g and the value A are present in the external data memory. The external data memory 42 is now separated from the second field device 41 and connected to the first field device 40. In step 44b, the key base information BI is transferred to an internal memory of the first field device 40. In addition, in the first field device 40, according to step 62, a random number b is generated as second secret information RN2.

In step 63, the key information KI from the key base information BI by taking over the prime number p and the value A and by forming a further value B according to

B = g ^b mod p

wherein the key base information BI in the form of the prime number p and the primitive root g and, on the other hand, the second secret information RN2 in the form of the random number b are used to form the further value B.

In step 64, the key K is then according to

K = A ^b mod p

generated. In this case, the key information KI (prime number p and value A) derived from the basic information BI and, on the other hand, the second secret information RN2 in the form of the added information are consequently generated on the one hand to generate the key K. case number b is used. In step 45c, the license data LI is encrypted with the key K thus generated.

In step 47a, the encrypted license data and a part of the key information KI, namely the value B, are transferred to the external data memory 42. The secret information RN2 in the form of the random number b is not transmitted. The external data memory 42 is disconnected from the first field device 40 and reconnected to the second field device 41, so that in step 47b the encrypted license data and the part of the key information KI are transferred in the form of the value B to an internal data memory of the second field device 41 can be.

In step 65, the key K is now according to

K = B ^a mod p

For this purpose, the transmitted part of the key information KI in the form of the value B, the first secret information RN1 in the form of the random number a and the key base information BI in the form of the prime number p are used. The key K can be generated without knowing the secret information RM2 in the form of the random number b generated in the first field device 40, since for the key K the relationship

K = B ^a mod p = A ^b mod p

applies. With the key thus calculated, the encrypted license data can be decrypted in step 48b so that it can be transferred to the non-readable memory area 49 in the second field device 41 in order to be used for the activation of the corresponding functions. In the method just described, the key K used is a key which is valid only for this one-time transaction of the license data and is known only to the field devices 40 and 41, so that even if the contents of the external data store are not copied without authorization, the information obtained therefrom is not available Preparing further field devices can be used with correspondingly enabled functions. Also, since the license data is encrypted with a key unknown outside the field devices 40 and 41, they can not be spied. The method described in connection with FIG. 6 thus represents a very high degree of security against unauthorized generation of further field devices with enabled functions.

However, the method is not yet sufficiently secure against a so-called "man-in-the-middle attack" protected in which the existing data on the external data storage is changed and transferred after the change to the corresponding other of the two field devices to in this way to get to know the keys used by the field devices.

In order to protect the method against such an attack, it must be ensured that the data present on the external data store pass unchanged from one field device to another, so that in fact only that information which has been written from a field device to the external data memory is communicated in unchanged form to the other field device.

This extension of the method described above will be explained in more detail below with reference to FIGS 7 to 9. For this purpose, FIG. 7 shows a first exemplary embodiment with which, by using test data, it is ensured that There is no manipulation of the data on the external data store. FIG. 7 shows an external data memory 70 in the form of a USB stick in whose memory area 71, by way of example, key information 72 and encrypted license data 73 are stored. In principle, instead of the key information 72 and the encrypted license data, other data may also be present on the external data memory, such as the key base information BI.

In addition to the key information 72 and the encrypted license data 73, check data "CHK" 74 generated by a field device using the key information 72 and the license data 73 is stored on the storage area 71 of the external data memory 70. For this purpose, a special algorithm such as a so-called hash value formation has been used.

If the external data memory 70 is connected to the other field device, then this field device checks whether the test data 74 corresponds to the further stored data, that is to say the key information 72 and the license data 73. For this purpose, the other field device must know the algorithm for forming the test data. If the key information 72 or the license data 73 has been changed after being written to the external data memory 70 by the first field device, the check data 74 no longer matches the encrypted license data 73 and the key information 72. In such a case the other field device detects the present discrepancy and does not accept the data on the external data store as valid. The transmission method is canceled in this case. FIG. 8 shows a further exemplary embodiment in which the security of the test data against manipulation is increased even further. On the external data memory 70, in turn, the key information 72 and the encrypted license data 73 are stored in the memory area 71. The test data 80 have now been generated, on the one hand, using the data stored on the external data memory 70, that is to say the key information 72 and the encrypted license data 73. On the other hand, code data "CODE" 81, which are known to all electric field devices but are stored in protected or non-readable memory areas, so that the knowledge of the code data can not escape to the outside, was used to generate the test data 80 in that, even if the algorithm is known, according to which the test data are generated from the data 72 and 73 stored on the external data memory 70, the test data 80 can not nevertheless be generated outside of a field device since knowledge of the code data 81 is lacking ,

Finally, FIG. 9 shows a further exemplary embodiment for test data formation. In this case, the test data are formed in accordance with the explanation for FIG. 8 using the key information 72, the encrypted license data 73 and the code data 81 known to the field devices. In addition, in the field device which writes the data to the external data memory 70, a safety number "SEC" 90 is formed, which is advantageously a newly formed random number for each transmission data memory 70 is stored. ^"the test data 91 are thus formed in this case using the security number 90, is so ensured that even with multiple transmitting the same key information 72 and dersel- In the case of encrypted license data, the check data 91 are constantly being changed due to the change in the security number 90 with each transaction.

By using the test data according to one of the embodiments of FIGS. 7, 8 or 9, the security against spying and unauthorized copying of the license data can be further increased.

Claims

claims 1. A method for enabling functions of a field device (41), in which in an internal data memory of a first field device (40) present license data (LI) from the first field device (40) to a second field device (41) are transmitted, the license data (LI) specify the functions of the respective field device (40, 41) to be enabled such that the corresponding functions of the respective field device (40, 41) are present in the case of license data (LI) present in an internal memory of the respective field device (40, 41) ), characterized by the following steps: generating key information (KI) in the first field device (40); Generating a key using the key information (KI); - encrypting the license data (LI) in the first field device (40) using the key; - storing the encrypted license data and at least part of the key information (KI) in an external data memory (42); - deleting the license data (LI) from the internal data memory of the first field device (40) while blocking the functions of the first field device (40); - transferring the encrypted license data and the part of the key information (KI) stored in the external data memory (42) from the external data memory (42) to the internal data memory of the second field device (41); - generating the key in the second field device (41) using the part of the key information (KI); - decrypting the encrypted license data using the key; - Unlocking functions of the second field device (41) using the license data (LI). 2. Method according to claim 1, characterized in that - Before generating the key information (KI) in the first field device (40), the second field device (41) generates a key base information (BI) and stores it in its internal data memory and in the external data memory (42) and - The first field device (40) generates the key using the key information (KI) and the key base information (BI). 3. The method of claim 1, wherein a - Before generating the key information (KI) in the first field device (40), the second field device (41) generates a key base information (BI) and stores them in its internal data memory and in the external data memory (42) and - The first field device (40) generates the key information (KI) using the key base information (BI). 4. The method according to claim 2 or 3, characterized in that a - The second field device (41) generates the key using the with the external data memory (42) transmitted key information (KI) and in the internal data memory of the second field device (41) existing key base information (BI). 5. The method according to claim 4, characterized in that the key base information (BI) from the second field device (41) using first secret information (RNl) is generated, wherein the first secret information (RNl) is stored in the second field device (41), and - the key information (KI) and the key from the first field device (40) using a second secret information (RN2) wherein the second secret information (RN2) is stored in the first field device (40). 6. The method according to claim 5, characterized in that a as the first and the second secret information (RN1, RN2) random numbers are used, which have been generated in the second and the first field device (41,40). 7. Method according to one of the preceding claims, characterized in that Test data (91), which have been generated using the data (72, 73) to be stored on the external data memory (42), are also stored by the respective field device (40, 41) on the external data memory (42). 8. The method according to claim 7, characterized in that - when transferring data from the external data memory (42) the test data (91) are respectively checked in the internal data memory of the respective field device (40, 41) to see whether they match the data (72, 73) present in the external data memory (42); the data transferred to the internal data memory is only performed if the test result is positive. 9. The method according to claim 7 or 8, characterized in that the test data (91) are also generated using code data (81) known to both field devices (40, 41), wherein the code data (81) are stored in the respective field device (40, 41), and - checking the test data ( 91) using the code data (81). 10. The method according to claim 9, wherein: the test data are also generated using a random number generated in the respective field device as a random number, - the safety number (90) is additionally stored on the external data memory (42) and - the verification of the test data (91) is also performed using the safety number (90). 11. An electric field device (40, 41) having a data processing device which is set up to carry out a method according to one of claims 1 to 10 in cooperation with a further electric field device (40, 41).