Abstract:
A method, a first device, and a switching center are described. A first device is authenticated by a switching center inside a network taking into account the use of additional (e.g., virtual) network interfaces. A device uses certificates to transfer additional MAC addresses for authentication. As a result, a device having a plurality of MAC addresses gains access to a network from a plurality of MAC addresses in a one-off authentication process.

Description:
RELATED APPLICATIONS 
     This application claims the benefit of German Patent Application No. DE 102012215167.2, filed Aug. 27, 2012. The entire contents of the priority document are hereby incorporated herein by reference. 
     TECHNICAL FIELD 
     The present teachings relate generally to a method, a first device, and a switching center for authenticating a first device by a switching center inside a network. 
     BACKGROUND 
     To gain access to a physical network, devices are authenticated by a superordinate entity. Authentication may be carried out with the IEEE 802.1X standard. Authentication may be carried out by an IEEE 802.1X-enabled switch, and the devices may be connected to the port of the IEEE 802.1X-enabled switch. The devices are identified by a Media Access Control address (MAC) address. As soon as a switch detects an unknown MAC address at a port or a physical connection has been interrupted, the associated device is re-authenticated, or the device is re-authenticated by the switch. 
     Virtualization solutions may be used not only in a server environment but also in the client area, thereby resulting in a client device having virtual interfaces with additional MAC addresses in addition to the physical network interfaces. 
     IEEE 802.1X-enabled switches that support multi-host authentication are known. Only the first access operation is authenticated. All other devices or virtual network interfaces connected to the same port of the switch may not be additionally authenticated. 
     IEEE 802.1X-enabled switches that support multi-domain authentication are also known. Each device or each network interface—including virtual network interfaces—is re-authenticated since virtual MAC addresses that may be seen in the physical network are unknown to the switch. 
     Similarly, in the automation environment, profinet devices may have a device-specific MAC address in addition to a MAC address for each network interface. 
     SUMMARY AND DESCRIPTION 
     The scope of the present invention is defined solely by the appended claims, and is not affected to any degree by the statements within this summary. 
     The present embodiments may obviate one or more of the drawbacks or limitations in the related art. For example, in some embodiments, a simplified authentication process inside networks is provided. The simplified authentication process takes into account the use of additional network interfaces. 
     The advantages described herein may be achieved by one or more individual embodiments of the present teachings. 
     In accordance with the present teachings, a method for authenticating a first device by a switching center inside a network has the following acts: 
     The first device transmits a first identifier to the switching center in an identity region of a data structure. The first device transmits at least one additional identifier to the switching center in an extended identity region of the data structure. The switching center authenticates the first device based on the transmitted first identifier and the transmitted additional identifier. 
     Devices that are authenticated by the switching center according to the above-described method further indicate the network interfaces that are also to be authenticated. Therefore, the first device inside the network is authenticated only once based on the first device&#39;s physical network interface. At the same time, the first device indicates the additional network interfaces that are also to be authenticated. 
     Thus, other devices or their virtual network interfaces that are connected to the same port of the switch may be authenticated as desired. Authentication is carried out for each device in a one-off authentication process wherein access to a network from a plurality of network interfaces is authorized. 
     In some embodiments, the first device transmits a first media access control address belonging to a physical network interface as the first identifier, and transmits an additional media access control address belonging to a virtual network interface or a second media access control address belonging to the physical network interface as the additional identifier. 
     The network interfaces may be specified by the MAC addresses. Therefore, both a MAC address belonging to a virtual network interface and a second MAC address that is assigned to a physical network interface in addition to the first MAC address may be concomitantly included in the authentication process. 
     In some embodiments, the data structure is in the form of a certificate wherein at least one additional media access control address is indicated in the extended identity region with the aid of a placeholder. 
     An entry with a placeholder may be used in a certificate to indicate a certain range of addresses for which authentication is to be carried out. For example, identification may be carried out for all addresses with a given ending if, through the use of a placeholder in the front part of the address, the front part of the address is not specified. However, the first three bytes of a total of six bytes may also remain fixed, for example, as the manufacturer identifier. The additional three bytes that may be freely selected by the manufacturer may be varied for additional MAC addresses. The last byte may contain a device version and a multiplicity of device versions may be included using a placeholder. A placeholder may include devices from a given build year and onward. 
     In some embodiments, at least one additional media access control address is produced by replacing a manufacturer identifier inside the media access control address by a mask. 
     A MAC address structure may be provided wherein virtual MAC addresses are produced by overwriting the manufacturer identification number in the first three bytes of the six bytes of the MAC address. The last three bytes are specific to the physical network card and are used as the basis for identification. Individual bytes of the MAC address (e.g., the manufacturer bytes) may be overwritten during configuration by a mask. 
     In some embodiments, the data structure is in the form of a certificate, wherein an Internet protocol address that corresponds to an additional media access control address is transmitted as the additional identifier in the extended identity region. 
     If a MAC address is part of an Internet protocol version 6 address (IPv6 address), an IP address may be indicated in the certificate as an additional identifier for each additional virtual network interface. 
     In some embodiments, the data structure is in the form of a device certificate or an attribute certificate. 
     By using a device certificate (e.g., an X.509 device certificate) according to the RFC 5280 standard, all alternative identities that are transmitted as the additional identifier may be indicated in an extended identifier. Thus, an assignment to the device that is authenticated using the device certificate is immediately given. 
     If the additional identifier is transmitted in the extended identity region of an attribute certificate, a certificate may be issued during production of the device. The MAC address is stored in the certificate, and the MAC address is subsequently supplemented with additional virtual addresses during operation of the device regardless of whether or how many addresses are required. Thus, production and subsequent use may be effectively separated. 
     In some embodiments, the data structure is in the form of a device certificate or an attribute certificate that is protected from manipulation by the signature of a trusted certification authority. 
     A high standard of security may be provided when authenticating virtual network interfaces or physical network interfaces and their respective addresses. 
     In some embodiments, at least one second device inside the network is authenticated by the switching center using above-described acts in accordance with the present teachings. 
     If there are two or more devices in a network that are authenticated for the purpose of accessing the network, the authentication method is carried out separately for each device inside the network. An authentication method is carried out for each physical device or each physical network interface. 
     In some embodiments, the first device is granted access to the network by the switching center after the first device has been successfully authenticated by the switching center. Thus, a device may access the network via a network interface only when an authentication method in accordance with the present teachings has previously been run through and the device has been authenticated. 
     In some embodiments, the second device is granted access to the network by the switching center after the second device has been successfully authenticated by the switching center. 
     The authorization act that grants the device being authorized access to the network is carried out for each device. A device is granted access to the network using a plurality of network interfaces or addresses in a one-off authentication process without multiple authentications. Separate authentication and corresponding separate authorization of the devices are carried out if the devices are connected in series. As a result, security standards may be preserved that prescribe separate authentication and authorization for each device. 
     In some embodiments, a first device for authentication inside a network is provided. The first device communicates a first identifier to a switching center in an identity region of a data structure. The first device transmits at least one additional identifier to the switching center in an extended identity region of the data structure. 
     In some embodiments a switching center is provided. The switching center authenticates a first device based on a first identifier transmitted by the first device and at least one additional identifier transmitted by the first device. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  shows a schematic illustration of an exemplary arrangement of components, and exemplary acts in a method in accordance with the present teachings; 
         FIG. 2  shows a schematic illustration of an exemplary data structure in accordance with the present teachings. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  shows a first device  100  and a second device  200  connected in series in a network  400  of an industrial automation installation. The first device  100  and the second device  200  are connected to a common port of a switching center that is implemented, for example, by a switch  300 . In such a linear topology, both the first device  100  and the second device  200  may be authenticated separately. 
     In a first act S 1 , the first device  100  attempts to access the network  400  with a first media access control address (MAC address)  111  that specifies a physical network interface of the first device  100 . The first MAC address  111  has not yet been authenticated at the switch  300 , and the switch  300  transmits a request for authentication in a second act S 2 . The first device  100  transmits a first identifier to the switch  300  in a third act S 3  in an identity region  510  of a data structure that may be implemented by a certificate  500 . The certificate  500  is shown schematically in  FIG. 2 . In addition, the first device  100  indicates a first additional identifier  112 , a second additional identifier  121 , and a third additional identifier  122  in an extended identity region  520 . 
     A MAC address for a physical network interface may be subdivided into three address regions: a front address region for the manufacturer&#39;s identifier and for the device&#39;s identifier; a middle address region indicating the network interface as the physical network interface; and a rear address region indicating, respectively, the different MAC addresses for each physical network interface and each device. 
     Thus, a virtual network interface has a middle address region indicative of a virtual network interface, a front address region for the manufacturer, and a rear address region that indicates the respective virtual network interface for each device. 
     A MAC address of the form 00-30-05-5A-DB-A0 has six bytes. The first three bytes are used as manufacturer bytes and include, inter alia, the manufacturer identification number. The following two bytes include the device identification number and may distinguish between a MAC address assigned to a virtual network interface and a MAC address assigned to a physical network interface. The last byte uses an included version number or a device build year to indicate the network interface (in other words, each available network interface, whether virtual or physical, has an indicating ending). 
     In addition to the first identifier  111 , the first device also transmits the first additional identifier  112 , the second additional identifier  121 , and the third additional identifier  122  in the certificate  500 . The first device has a second MAC address (first additional identifier  112 ) that belongs to the physical network interface, and two additional MAC addresses (second additional identifier  121  and third additional identifier  122 ) that belong to two virtual network interfaces. 
     In a fourth act S 4 , the switch  300  verifies the certificate  500  presented by the first device  100  with the aid of an authentication server  600 , and authenticates the first device after successful verification. In a fifth act S 5 , the first device  100  is granted access to the network  400  from all network interfaces and with all MAC addresses. 
     If a second device  200  attempts to access the network in a sixth act S 6  using a first secondary device identifier  211 , the first secondary device identifier  211  being in the form of a first secondary device MAC address and belonging to a physical network interface of the second device  200 , the switch  300  transmits a request for authentication in a seventh act S 7  since this MAC address has not yet been authenticated by the switch. 
     The authentication process according to the third act S 3 , the fourth act S 4 , and the fifth act S 5  takes place in a similar manner for the second device  200 . 
     Thus, for a switch  300  that is used for a network in an automation installation, each device in a plurality of devices connected in series is individually authenticated. 
       FIG. 2  shows a schematic illustration of a data structure  500  having an identity region  510  and an extended identity region  520 . Authentication is carried out by the switch  300  according to the IEEE 802.1X standard. The first device  100  transmits a device certificate according to the X.509 standard (e.g., RFC 5280) for authentication. 
     The additional MAC addresses (second additional identifier  121  and third additional identifier  122 ) and the second MAC address (first additional identifier  112 ) of the first device  100  may be implemented using an extension “SubjectAltName” according to RFC 5280 by an entry “other name.” There is a large degree of freedom during naming and a list of the additional MAC addresses (second additional identifier  121  and third additional identifier  122 ) or the second MAC address (first additional identifier  112 ) may be stored. The first device  100  creates a list of all MAC addresses for the first device&#39;s network interfaces. The first MAC address  111  may also be described in “SubjectAltName.” Thus, the logical separation between the identity region  510  and the extended identity region  520  may be technically implemented by a common entry. 
     For authentication, the second device  200  transmits an attribute certificate according to X.509. In the extension of the attribute certificate, a range of addresses for which authentication is to be simultaneously carried out is indicated as “other name” with the aid of a placeholder. Due to the placeholder (e.g., a wildcard), an address region of a definite or indefinite length may be read in any desired manner. No further authentication is needed in a request for access to the network  400  by the second device  200  using a first additional secondary device identifier  221 , a second additional secondary device identifier  222 , and a third additional secondary device identifier  212 . The first additional secondary device identifier  221 , the second additional secondary device identifier  222 , and the third additional secondary device identifier  212  may be in the form of an additional secondary device MAC address in the region encompassed by the placeholder. The second device  200  transfers the first secondary device MAC address  211  in a form wherein only the manufacturer bytes and a device identifier are explicitly indicated. The last byte or the ending is kept open using a placeholder: 00-30-05-5A-DB-*. 
     The above-described approach may be carried out separately for the virtual and physical network interfaces. Additional secondary device MAC addresses (first additional secondary device identifier  221 , the second additional secondary device identifier  222 ) may be encompassed by a MAC address with a placeholder belonging to a virtual network interface, and a second secondary device MAC address  212  may be encompassed by a MAC address with a placeholder (e.g., with different device identifier bytes) belonging to a physical network interface. 
     In addition to being used for authentication according to the IEEE 802.1X standard, a method in accordance with the present teachings may be used for authentication based on an Internet protocol connection. Authentication based on an Internet protocol connection may be carried out, for example, as part of network access authentication using the Protocol for Carrying Authentication for Network Access (PANA) according to the Request for Comment 5191 (RFC 5191). In a layer model (e.g., the Open Systems Interconnection Reference Model or OSI layer model), authentication using PANA is carried out at a higher level than using IEEE 802.1X. The transmitted information (e.g., the identifiers described in exemplary embodiments) is processed in a similar manner to the processing according to IEEE 802.1X on the network layer. 
     The first device  100  and the switching center  300  may be realized and implemented using software, hardware, or a combination of software and hardware. 
     The acts carried out by the units may be stored as program code on a storage medium (e.g., a hard disk, a CD-ROM or a storage module). The individual instructions of the program code may be read and processed by at least one computing unit of the first device  100  and/or of the switching center  300  including a processor. 
     The processor is connected to the storage medium via a bus for the interchange of data. 
     An input/output unit may be connected via the bus. Data (e.g., messages) may be received and/or transmitted using the input/output unit. 
     The above-described embodiments may be freely combined with one another. 
     While the present invention has been described above by reference to various embodiments, it should be understood that many changes and modifications may be made to the described embodiments. It is therefore intended that the foregoing description be regarded as illustrative rather than limiting, and that it be understood that all equivalents and/or combinations of embodiments are intended to be included in this description. 
     It is to be understood that the elements and features recited in the appended claims may be combined in different ways to produce new claims that likewise fall within the scope of the present invention. Thus, whereas the dependent claims appended below depend from only a single independent or dependent claim, it is to be understood that these dependent claims may, alternatively, be made to depend in the alternative from any preceding claim—whether independent or dependent—and that such new combinations are to be understood as forming a part of the present specification.