Abstract:
Methods and apparatuses for using certificates using a positive list are provided. This involves a message, wherein the message includes a certificate for a device, the certificate has a signature for checking an authenticity of the certificate and a piece of admissibility information for ascertaining an admissibility of the certificate using a positive list, being taken as a basis for carrying out authorization for the device subject to the check and the ascertainment. The disclosed can be used in industrial or medical environments.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority to PCT Application No. PCT/EP2014/076868, having a filing date of Dec. 8, 2014, based off of German application No. DE 102014203766.2 having a filing date of Feb. 28, 2014, the entire contents of which are hereby incorporated by reference. 
     
    
     FIELD OF TECHNOLOGY 
       [0002]    The following relates to methods and devices for using certificates by means of a positive list. 
       BACKGROUND 
       [0003]    Malevolent attacks, also known as hacker attacks, of automation systems are increasing significantly in recent times. Therefore, specific digital certificates are used for devices such as production robots or control devices in order to be able to perform an authentication for these devices. This authentication guarantees, for example, that only positively authenticated devices can be operated in the automation system. Similarly, person-related digital certificates can also be used in the industrial environment, for example in order to release a maintenance access for a technician. 
         [0004]    According to known documents, “a digital certificate [ . . . ] is a digital data record which confirms particular characteristics of persons or objects and the authenticity and integrity of which can be checked by cryptographic methods. In particular, the digital certificate contains the data required for testing it. 
         [0005]    Furthermore, according to known documents, “an attribute certificate [ . . . ] is a digital certificate and constitutes the bond, digitally signed by a trustworthy authority, between certain digital information (attributes) and a further digital certificate thus attributed.” The known documents also states that “attribute certificates [ . . . ] are typically a feature of characteristics which either characterize the certificate itself or the person in greater detail. 
         [0006]    A further possibility of restricting a validity of digital certificates is known. It is proposed there, as part of an authentication routine, to check the digital certificate against a white list (or certificate white list). The white list, also called positive list, indicates whether the digital certificate to be authenticated may be authenticated by the unit to be authenticated or not. Thus, the authenticating unit can search the positive list for an entry which shows the digital certificate to be authenticated or a reference to it. If the entry is found, an authentication takes place, otherwise, it is stopped. 
         [0007]    One disadvantage from is that it is not clear whether an authentication or validity check, also called certificate validation, of a digital certificate takes place on the basis of a positive list or not. On the other hand, the authenticating unit can already perform an authentication of the device on the basis of the present certificate positively without checking the positive list although an additional check of the certificate by means of the positive list would be necessary, for example, because the device may only be operated within a predetermined environment. 
       SUMMARY 
       [0008]    An aspect relates to specifying methods and device which allows an increase in a security when using digital certificates. 
         [0009]    Embodiments of the invention relates to a method for generating a message, the message comprising a certificate of a device G and the certificate exhibiting a signature for a check of an authenticity of the certificate, characterized in that an item of permissibility information for determining a permissibility of the certificate by means of a positive list is added to the message. 
         [0010]    Embodiments of the invention exhibit the advantage that during an authorization of the device by means of the message, apart from the signature, it is also determined whether the certificate exists on the positive list. By this means, a security in the authorization of the device is increased by the fact that both the checking of the certificate by means of the signature and a determination of the permissibility must be performed. The “compulsion” to perform both the checking and the determination is controlled by the message and is thus not randomly dependent on whether a unit for authorization, apart from the checking of the signature of the certificate, also performs the determination of the certificate by means of the positive list. Thus it is avoided that the authorization is successful if, although the checking of the signature is positive, a determination by means of the positive list is omitted. In addition, the security of the authorization is also increased by the fact that it is obvious to the device with notification of the authorization that both the checking and the determination are performed and are positive. 
         [0011]    In one example, the message can have an addressee field, the certificate and the permissibility information. In another example, the message comprises certificate and the permissibility information. In addition, the permissibility information can be arranged separately of the certificate or as part of the certificate in the message. In the latter case, the message can also describe a new certificate. 
         [0012]    In a further development, an item of validity information is added to the permissibility information, the validity information having at least one of the following parameters which characterizes the positive list WL to be used in the determination of the permissibility:
       permissible issuer of the positive list;   maximum permissible age of the positive list;   application environment parameters AUP of the positive list;   reference REF of the positive list to be used.       
 
         [0017]    Using the permissibility information in this way further increases a security in the authorization of the device because the validity information restricts a number of positive lists which can be utilized for the determination. If necessary, there is no positive list for determination after the restriction so that an authorization fails or only an authorization of the device having a low security level is permitted. 
         [0018]    In an advantageous development of embodiments of the invention, a first application information item for performing a first application of the G is added to the permissibility information, wherein the first application information item, in the case of a positive authorization of the device on the basis (i) of a positive check of the authenticity of the signature and (ii) of a positive determination of the permissibility of the certificate by means of the positive list can be applied. By this means, the permissible modes of action, that is to say applications, permissible due to the positive authorization can be allocated to the device. Thus, the security is increased in that the first applications, i.e. first category of at least one application, are allocated to the device in dependence on the authorization. 
         [0019]    In an advantageous development of embodiments of the invention, a second application information item for performing a second application of the device is added to the permissibility information, wherein the second application information item can be applied in the case of a positive authorization of the device on the basis (i) of a positive check of the authenticity of the signature and (ii) of a negative determination of the permissibility of the certificate by means of the positive list. Thus, the security is increased by the fact that the second application, i.e. second category of at least one application, is allocated to the device in dependence on the check and the determination, wherein applications of a low security level can be considered as applications of the second category. 
         [0020]    In a development of embodiments of the invention, at least one of the following execution parameters is added to the permissibility information, wherein the respective execution parameter describes by means of which characteristic of the certificate the determination can be performed:
       serial number of the certificate;   issuer of the certificate;   fingerprint of the certificate;   fingerprint of the public key;   copy of the certificate PI5.       
 
         [0026]    By this means, the security can be enhanced further in the authorizing since the message can inform the unit performing the determination explicitly which of the executive parameters the unit should or may use for carrying out the determination. 
         [0027]    Embodiments of the invention also relate to a method for authorizing a device by means of a message, wherein the message can be generated in accordance with one of the steps described before, the device being authorized for applying a first category to at least one application if
       (a) the checking of the authenticity of the certificate is performed positively, and   (b) the determination of the permissibility of the certificate ZERT by means of the positive list is performed positively.       
 
         [0030]    Embodiments of the invention display the advantage that in the authorization of the device by means of the message, apart from the signature, it is also determined whether the certificate is present on the positive list. This increases a security in the authorization of the device by the fact that both the checking of the certificate by means of the signature and also a determination of the permissibility must be performed. The “compulsion” to perform both the checking and the determination is controlled by the message and is thus not coincidentally dependent on whether a unit for authorizing, apart from checking the signature of the certificate, also performs the determination of the certificate by means of the positive list. This prevents the authorization from being successful if, although the checking of the signature is positive, a determination by means of the positive list is omitted. In addition, the security of the authorization is also increased by the fact that the device, on being notified of the authorization, understands that both the checking and the determination are performed and are positive. 
         [0031]    Embodiments of the invention also relate to a method for authorizing a device by means of a message, particularly in accordance with the method described before, wherein the message VMSG can be generated in accordance with one of the steps described before, the device being authorized for applying the second category to at least one application if
       (a) the checking of the authenticity of the certificate is performed positively, and   (b) the determination of the permissibility of the certificate by means of the positive list is performed negatively.       
 
         [0034]    In this context, it is advantageous, apart from the advantages described before, that in the case of a negative determination, the authorization does not mandatorily fail but there is also the possibility of performing an authorization with a low security level, i.e. that the device may not perform any security-critical applications or participate in any security-critical applications. Thus, the device can perform, for example, updates but not participate itself in performing a production with other devices. 
         [0035]    In an advantageous development, the determination of the permissibility of the certificate is performed at least by means of one of the following executive parameters, the respective execution parameter reproducing a characteristic of the certificate:
       serial number of the certificate;   issuer of the certificate;   fingerprint of the certificate;   fingerprint of the public key;   copy of the certificate.       
 
         [0041]    By this means, the security in authorizing can be increased further since the message can explicitly inform the unit performing the determination which of the executive parameters the unit should or may use for carrying out the determination. 
         [0042]    In a development of embodiments of the invention, an item of validity information can be evaluated as part of the determination of the permissibility, the validity information exhibiting at least one of the following parameters which characterizes the positive list to be used in the determination of the permissibility:
       permissible issuer of the positive list;   maximum permissible age MAXG of the positive list;   application environment parameter (AUP) of the positive list;   reference REF of the positive list to be used.       
 
         [0047]    Using this type of permissibility information further increases a security in authorizing the device because a number of positive lists which can be utilized for the determination is restricted by the validity information. If necessary, there is no positive list available for determination after the restriction so that an authorization fails or only an authorization of the device with a low security level is permitted. 
         [0048]    Embodiments of the invention also relate to a message comprising a certificate of a device, wherein the certificate exhibits a signature for a check of an authenticity of the certificate ZERT and an item of permissibility information for determining a permissibility of the certificate by means of a positive list. In addition, the message can be configured in accordance with one of the steps for generating the message. 
         [0049]    The advantages of the message can be found in the respective statements shown above for generating the message. 
         [0050]    Embodiments of the invention also relate to a first device for generating a message, comprising
       a first unit for inserting a certificate of a device into the message, the certificate ZERT exhibiting a signature SIG for a check of an authenticity of the certificate,   a second unit for adding an item of permissibility information for determining a permissibility of the certificate by means of a positive list.       
 
         [0053]    The second unit can also be designed in such a manner that the permissibility information can be extended in accordance with one of the statements shown for generating the message. 
         [0054]    The advantages with respect to the first device are identical with the respective statements, shown above, for generating the message. 
         [0055]    In addition, embodiments of the invention also relates to a second device for authorizing a device by means of a message, wherein the message can be generated in accordance with one of the steps described before, comprising a third unit for checking an authenticity of a certificate of the message VMSG, a fourth unit for determining the permissibility of the certificate by means of the positive list, and a fifth unit for authorizing the device for applying a first category K 1  to at least one application if the check and the determination are in each case positive. 
         [0056]    Furthermore, the fifth unit can be designed for authorizing the device for applying a first category to at least one application if the check is positive and the determination is negative. 
         [0057]    Furthermore, the third unit, the fourth unit and the fifth unit can be designed in such a manner that at least one of the developments of the permissibility information can be executed in accordance with a method shown. 
         [0058]    The advantages with respect to the respective second device are identical with the respective statements shown above for authorizing the message. 
     
    
     
       BRIEF DESCRIPTION 
         [0059]    Some of the embodiments will be described in detail, with reference to the following figures, wherein like designations denote like members, wherein: 
           [0060]      FIG. 1  shows a transmission of a message from a device to a checking unit; 
           [0061]      FIG. 2  shows the structure of a message comprising a certificate and an item of permissibility information; 
           [0062]      FIG. 3  shows validity information as part of the permissibility information of the message; 
           [0063]      FIG. 4  shows a flow chart and first device for generating the message; 
           [0064]      FIG. 5  shows a flow chart and second device for authorizing a device by means of the message; and 
           [0065]      FIG. 6  shows a certificate coded in accordance with the ASN.1 Standard. 
       
    
    
       [0066]    Elements having the same function and mode of operation are provided with the same reference symbols in the figures. 
       DETAILED DESCRIPTION 
       [0067]    In a first exemplary embodiment of the invention, a defective pump is to be interchanged and authorized before being linked into the control communication of the waste water purification plant in an industrial plant for waste water purification. For this purpose, a service technician installs a new pump G instead of the defective pump. After the new pump, also called device G in that text which follows, has been connected to the power system, it generates a message VMSG, the message VMSG comprising a certificate of the pump G, see  FIGS. 1 and 2 . The certificate ZERT, in turn, has at least one signature SIG wherein, using the signature SIG, a check PROOF 1  of an authenticity or validity of the certificate ZERT can be carried out. 
         [0068]    In addition, the pump G supplements the message VMSG with an item of permissibility information ZINFO. The permissibility information ZINFO has the purpose that it is used to inform a checking unit Z that, apart from checking the signature SIG, a determination of a permissibility of the certificate ZERT by means of a positive list WL is to be performed. The permissibility information is preferably contained in the certificate of the pump G. However, it is also possible that the permissibility information is contained in another part of the message VMSG. 
         [0069]    The certificate of the pump G can be, for example, a device certificate issued by the manufacturer of the pump, a self-signed certificate of the pump G, or a certificate which has been issued for the pump by the operator of the waste water purification plant and configured on the pump G before its installation. It is also possible that on commissioning of the pump G, the pump first creates a certificate request message and sends it out in order to request a certificate for the pump G which is valid in the waste water purification plant. A certificate server of the waste water purification plant can thereupon provide a certificate, which comprises an item of permissibility information, for the pump G. This can be used thereupon, as described above, by the pump G for the communication with the checking unit Z. 
         [0070]      FIG. 2  shows the message VSMG by way of example. It has the signature SIG and one or more notes for the permissibility information ZINFO. In the first exemplary embodiment, the permissibility information only exhibits a flag signal FLG, the flag signal FLG indicating that the certificate ZERT, apart from the checking, should also be tested by means of the determination PROOF 2  of the permissibility of the certificate ZERT by means of the positive list WL. 
         [0071]    The positive list WL, also known as white list, represents a compilation of one or more entries, wherein a respective entry can be designed for a specific certificate. In general, the determination of the permissibility of the certificate by means of the positive list means that it is checked whether it is the certificate itself or a derived item of information of the certificate or an item of information which can be allocated to the certificate which is present in the positive list or not. If no entry for the certificate to be checked can be found in the positive list, the determination is negative, otherwise it is positive. The positive list WL can be provided for the checking unit Z by a higher-level entity and comprises in the present example a list of certificates of devices which can only be verified positively at all in the industrial plant, i.e. in this special environment. 
         [0072]    In the present first exemplary embodiment, the signature SIG of the certificate ZERT is checked as positive by means of the check PROOF 1  for authenticity of the certificate ZERT. The determination PROOF 2  of the permissibility of the certificate by means of the positive list WL shows that the certificate ZERT is deposited in the positive list WL and that the second check PROOF 2  is also positive. Since both the first check PROOF 1  and the second check PROOF 2  are positive, the pump G is released for use in the industrial plant. The pump G is subsequently informed of this by means of a response message RMSG. Thus, the pump G is authorized for applying a first category K 1  to applications. Thus, the pump can receive, e.g. from a control computer, control data in manipulation-protected manner, e.g. control commands for activating or deactivating the pump. In another example, the pump can provide, e.g., diagnostic data to a diagnostics server of the waste water purification plant in protected manner. 
         [0073]    Apart from the possibility of informing the checking unit Z by means of the flag signal FLG that both a check PROOF 1  and a determination PROOF 2  have to be performed, the checking unit Z can also be accompanied by validity information GI which prompts the checking unit Z to a verification of the validity of the positive list WL as part of the determination, see  FIG. 3 . For this purpose, the validity information GI can have, for example, one or more of the following parameters:
       Permissible issuer(s) ZULA of the positive list WL:   This indicates that in the determination of the permissibility of the certificate ZERT, only those positive lists WL may be used which have been generated by one or more issuers defined as permissible by the validity information, for example the certificate of the pump must be listed on a positive list of the Siemens company or on a positive list of the operator of the waste water purification plant.   Maximum permissible age MAXG of the positive list WL:   This determines how old the positive list WL forming the basis for the determination PROOF 2  is. For example, the maximum permissible age MAXG indicates a period of five weeks. One of a number of possible positive lists to be utilized for determination of the permissibility was already generated six weeks ago. This positive list is, therefore, no longer used as part of the determination since it is older than five months.   Application environment parameter AUP of the positive list WL:       
 
         [0079]    In this context, the message VMSG can indicate an item of information about the location of use or the environment of the device G. For example, an IP address of a particular domain was assigned to the pump G after connection to the power system, 
         [0080]    e.g. 192.168.180.x. The application environment parameter AUP is set to 192.168.180.x. By means of the checking unit Z, it is checked during the selection of one or more positive lists WL for the determination of permissibility whether the respective positive list is permitted for the respective application environment parameter AUP. For example, a first positive list is only permitted for an application environment parameter of 168.180.180.x and a second positive list is permitted for an application environment parameter 168.178.180.x. Thus, only the second positive list is used for testing the permissibility by the determination of permissibility. In general, the application environment parameter AUP describes one or more specific characteristics which describe a location of use of the device, of the pump Gin the present case, in greater detail. Apart from the IP address, this can also be temperature, air humidity, specific characteristics of further devices surrounding the device such as MAC addresses or IP addresses, or also information from radio data such as identification features of a wireless WLAN (WLAN Wireless Local Area Network), network or a GPS-based site information (GPS—Global Positioning System). 
         [0081]    In an extension of the first exemplary embodiment, a first application information item ANWI 1  for performing a first application APP 1  of the device G can also be added to the permissibility information ZINFO. This first application information item AUTH 1  indicates which application or applications APP 1  may be carried out by the device G if both the checking PROOF 1  and the determination PROOF 2  of the permissibility are positive. For example, the pump may also be operated in a critical area of the industrial plant in this case, e.g. in an area, in which the pump has to pump very hot and very cold media. Thus, it can be indicated with the aid of the specification of the first application APP 1  in which areas of the industrial plant the pump may be used. Thus, the permissibility of the certificate for the first application is determined. 
         [0082]    In a development of the example, the permissibility information ZINFO can be supplemented by a second application information item ANWI 2  for performing one or more second applications APP 2 . In this context, it is specified which tasks or applications the device is allowed to perform if the check PROOF 1  is positive and determination PROOF 2  of the permissibility was negative. This means that, although the signature of the certificate is valid, the certificate (or references to the certificate) is not accessible on any valid positive list of the checking unit Z. A possible second application APP 2  can be designed in this case in such a manner that the pump G in the industrial plant cannot be used. In another embodiment, only a non-critical task can be transferred to the pump G such as, for example, a use for pumping media in a non-critical temperature range, for example from 10 to 25° C. Furthermore, an embodiment of the second application could be performed in such a manner that the pump, although it is allowed to participate in a communication with one or more adjacent devices and the checking unit, is not allowed to pump a medium itself. 
         [0083]    Generating the message VMSG is explained in greater detail by means of  FIG. 4 . This shows four steps S 0 , . . . , S 3  which represent a flow chart for generation. Furthermore,  FIG. 4  also embodies a first device VOR 1  with a first unit M 1  and a second unit M 2  for performing the steps for generating the message. 
         [0084]    In a step S 0 , the flow chart starts. 
         [0085]    In a first step S 1 , implemented by the first unit M 1 , the certificate comprising at least the signature SIG is generated. 
         [0086]    In a second step S 2 , the permissibility information ZINFO is added to the message VMSG. This second step S 2  is carried out by the second unit M 2 . Adding the permissibility information ZINFO to the message VMSG can be effected, in particular, by adding the certificate which comprises the permissibility information to the message ZINFO. 
         [0087]    The flow chart according to  FIG. 2  is ended in a third step S 3 . 
         [0088]    In a further exemplary embodiment, specific steps for authorizing the pump by means of the message VMSG are to be explained in greater detail with the aid of  FIG. 5 .  FIG. 5  shows, on the one hand, a flow chart with the steps T 0  to T 10  and also a number of units M 3 , . . . , M 5  for performing the steps. The units embody a second device VOR 2 . 
         [0089]    The flow chart starts in step T 0 . 
         [0090]    In the first step T 1 , the second device V 2  receives the message VMSG. For the representation of  FIG. 5 , it is assumed that the message VMSG, apart from the certificate, also comprises the permissibility information ZINFO, the permissibility information comprising the validity information GI of the maximum permissible age type MAXG of the positive list WL. Preferably, the permissibility information ZINFO is coded in the certificate. However, it can also be coded as separate information in the message VMSG. In addition, the message VMSG additionally also exhibits the first and second application information items ANWI 1 , ANW 2 . The first and the second application information items ANWI 1 , ANW 2  can then be coded in each case in the certificate or they can be coded as separate information in the message VMSG. 
         [0091]    In a subsequent second step T 2 , the check PROOF 1  of the authenticity of the certificate is performed with the aid of the signature SIG of the certificate ZERT. A third unit M 3  implements the second step T 2  and a fifth unit M 5  implements the third step T 3 . 
         [0092]    In a third step T 3 , it is checked whether the check PROOF 1  is positive or negative. If it is negative, the third step T 3  on path N is left and subsequently a tenth step T 10  is carried out. If the check PROOF 1  was positive, the third step T 3  is left via the path J and subsequently a fourth step T 4  is carried out. 
         [0093]    In the fourth step T 4 , the validity information, represented by the maximum permissible age MAXG, is first used for selecting the positive list WL present for the determination of the permissibility. If no positive lists WL which fulfill the validity information GI in this respect are at hand for the checking unit Z, a first stage of the determination PROOF 2  is negative. Otherwise, this first stage is positive. 
         [0094]    In the case of a negative result of the first stage, a path N is traveled in a fifth step T 5  which ends in a ninth step T 9 . Otherwise, the fifth step T 5  conducts the flow chart via a path J to a sixth step T 6 . 
         [0095]    In a sixth step T 6 , it is determined as part of a second stage of the determination PROOF 2  whether the certificate, or a search value derived therefrom, can be found in the positive list WL. If there is an entry for the certificate or the derived search value in the positive list which relates to the certificate, the second stage of the determination is positive in the sixth step T 6 . Otherwise, the second stage is negative in the sixth step T 6 . 
         [0096]    In a subsequent seventh step T 7 , the second stage of the determination of the sixth step T 6  is analyzed. If this is negative, the seventh step is left via the path N and the flow chart continued in the ninth step T 9 . Otherwise, the flow chart leads via the path J from the seventh step to the eighth step T 8 . 
         [0097]    In a further embodiment of the invention, the message VMSG can be structured in such a manner that only the permissibility information ZINFO is formed in the form of a flag signal FLG, i.e. there is no validity information GI in the message VMSG. In this case, the determination PROOF 2  of the permissibility is only implemented by steps T 6 , T 7 . The fourth and fifth steps T 4 , T 5  are skipped in this process. A fourth unit implements the fourth and sixth step T 4 , T 6 , respectively, and the fifth unit M 5  implements the fifth and seventh step T 6 , F 7 , respectively. 
         [0098]    The flow chart is located in an eighth step T 8  if both the check PROOF 1  for authenticity of the certificate and the determination PROOF 2  with respect to a permissibility of the certificate by means of the positive list WL is in each case positive. In this case, the device, i.e. the pump G, is authorized in the eighth step T 8  to perform a first category K 1  of applications such as, for example, of the first application APP 1 . After conclusion of the application of the first category K 1  of applications, the eighth step is terminated by calling up the last step T 10 . The first category of applications can, but does not have to be, defined by the first application information item. Thus, it can be specified by default that the first category of applications represents a release of the device for operation. 
         [0099]    In the ninth step T 9 , the flow chart indicates that the check for authenticity of the certificate was positive. However, the determination of the permissibility of the certificate by means of the positive list is negative in this ninth step T 9 . Thus, in the ninth step, the pump can be authorized for a second category K 2  of applications. The second category of applications can be designed, for example, by the fact that no applications may be carried out and the pump is not permitted for use in the industrial plant. Alternatively, a second application APP 2  which, for example, is not security-critical, can be carried out by the pump in the ninth step T 9 . After conclusion of the ninth step T 9 , the flow chart is continued in the tenth step T 10 . 
         [0100]    In the tenth step T 10 , the flow chart of  FIG. 5  is terminated. 
         [0101]    The determination PROOF 2  with respect to the permissibility of the certificate can be performed by means of at least one of the following execution parameters APA of the certificate and of the positive list:
       Serial number of the certificate: by means of the serial number of the certificate which is contained in the message VMSG, the checking unit Z can locate the certificate in the positive list WL.   Issuer of the certificate: the checking unit Z can carry out performing the second check also in dependence on the issuer of the certificate. If, for example, an issuer of the certificate is not listed in the positive list, the second check PROOF 2  is negative.   Fingerprint of the certificate: fingerprint of the certificate is understood to mean that it is not the certificate per se but the certificate in a coded form, e.g. in hash coding, which is used for performing the determination of the permissibility. Thus, the hash value of the certificate can be obtained from the certificate of the message VMSG by the checking unit. Following this, the hash value is used for identifying an identically sounding hash value in the positive list. If the identically sounding hash value is not found, the determination is negative, otherwise it is positive.   Fingerprint of the public key in the signature: the procedure for this is analogous to the item “Fingerprint of the certificate”, only the public key of the signature being used for the determination instead of the entire certificate.   Copy of the certificate: the procedure is analogous to “Fingerprint of the certificate”, wherein, instead of a coded form of the certificate, the certificate can be used in plain text in this variant of embodiments of the invention. Thus, the certificate in plain text represents the index which is to be sought in the positive list.       
 
         [0107]    In a development of embodiments of the invention the message can also exhibit one of the aforementioned execution parameters APA. This informs the checking unit which one of the parameters is to be used for locating the certificate in the positive list. 
         [0108]      FIG. 6  shows a message with the certificate ZERT and the permissibility information ZINFO. The example according to  FIG. 6  represents the coding according to x.509 by means ASN.1 coding (ASN.1=Abstract Syntax Notation One) for a so-called identity certificate. The message according to  FIG. 6  is subdivided into the certificate area ZERT and into the area describing the permissibility information ZINFO. The permissibility information ZINFO also describes the indication of validity information GI of positive list REF to be used and permissible issuer ZULA of the positive list and execution parameters APA for performing the determination of the permissibility PROOF 2 . It is a special feature with regard to the execution parameters APA that the checking unit Z is accompanied by three options for performing the determination. Thus, the checking unit Z can perform the second check by means of the serial number, the fingerprint of the certificate or of the fingerprint of the public key. Instead of using an identity certificate, embodiments of the invention can also be used for an attribute certificate. In this context, the procedure is analogous to the representation in  FIG. 6 . 
         [0109]    A first device for generating the message is implemented by the first and second unit. The first and second unit, thus represent the checking unit Z. The second device for authorizing the device is implemented by the third, fourth and fifth unit means. 
         [0110]    The units shown in the description can be implemented in software, hardware or in a combination of software and hardware. In this context, individual steps of embodiments of the invention can be deposited in a machine-readable form in a memory, the memory being connected to a processor in such a manner that the processor can read out and process the machine-readable commands. Furthermore, the input and output interfaces for exchanging data to the processor or from the processor can be coupled with the processor. 
         [0111]    The invention and its developments have been explained by means of a number of examples. The invention is not restricted to these special exemplary embodiments. In addition, the exemplary embodiments and the developments can be combined in any way and manner. 
         [0112]    Although the present invention has been disclosed in the form of preferred embodiments and variations thereon, it will be understood that numerous additional modifications and variations could be made thereto without departing from the scope of the invention. 
         [0113]    For the sake of clarity, it is to be understood that the use of “a” or “an” throughout this application does not exclude a plurality, and “comprising” does not exclude other steps or elements.