A system for providing broadcast communication security over Ethernet for an automation network which can be wired or wireless or a combination of wired and wireless technology and which comprises a plurality of automation components, wherein the system comprises: a. One or more security plugs (24; 45) for providing broadcast communication security between an arbitrary set of automation components attached to the automation network, wherein the security plugs (24; 45) are Ethernet based and application protocol-independent; b. A broadcast key server, for distributing keys to the one or more security plugs (24; 45) to communicate securely; and c. Bootstrapping means for performing an initialization and a key management across the one or more security plugs (24; 45); and wherein the respective security plug (24; 45) comprises: a. A key management module for storing security bootstrap information available from a security bootstrap communication logic and for providing interfaces for other modules of the device for retrieving a security bootstrap information; b. A broadcast key establishment module for using a long-term security bootstrap information to generate and distribute short-term session broadcast-keys using the services of a communication logic, a confidentiality module, an integrity module and a flow management module; c. The confidentiality module for providing interfaces for encrypting and decrypting data; d. The integrity module for providing interfaces for generating and verifying a security checksums for data; e. The flow management module for ensuring data flow and operational control and for controlling and interfacing the various modules with each other; f. The security bootstrap communication logic for providing a near-field or physically protected communication channel to be used by the key management module for performing key management operations; and g. The communication logic for providing data interfaces for the flow management module to interact with any physical medium; wherein the one or more security plugs (24, 45) are designed to have a broadcast secret key establishment phase of operation wherein a key server module is designed for sending and receiving certain messages related to the identification of one among many key servers as a master key server wherein the master key server is for generating and establishing the session key among all security plugs (24, 45) and wherein the confidentiality module an the integrity module of each security plug are designed to be loaded with session keys upon receiving an activation signal from the master key server and wherein the key management module of each security plug is designed to be updated upon receiving the activation signal from the master key server. a. One or more security plugs (24; 45) for providing broadcast communication security between an arbitrary set of automation components attached to the automation network, wherein the security plugs (24; 45) are Ethernet based and application protocol-independent; b. A broadcast key server, for distributing keys to the one or more security plugs (24; 45) to communicate securely; and c. Bootstrapping means for performing an initialization and a key management across the one or more security plugs (24; 45); and wherein a. A key management module for storing security bootstrap information available from a security bootstrap communication logic and for providing interfaces for other modules of the device for retrieving a security bootstrap information; b. A broadcast key establishment module for using a long-term security bootstrap information to generate and distribute short-term session broadcast-keys using the services of a communication logic, a confidentiality module, an integrity module and a flow management module; c. The confidentiality module for providing interfaces for encrypting and decrypting data; d. The integrity module for providing interfaces for generating and verifying a security checksums for data; e. The flow management module for ensuring data flow and operational control and for controlling and interfacing the various modules with each other; f. The security bootstrap communication logic for providing a near-field or physically protected communication channel to be used by the key management module for performing key management operations; and g. The communication logic for providing data interfaces for the flow management module to interact with any physical medium;