Detecting manipulated clients in a control system

A client server architecture for a control system of a technical plant comprising at least one processor and memory, wherein the client server architecture comprising:

• at least one first device comprising at least one client;
• and
• first and second servers, the at least one client communicating with the first and second servers within the control system of the technical plant over a terminal bus;
• wherein the client server architecture is configured to:
• a) register the at least oneclient with at least one of the first and second servers and download operational code to be executed by the at least one client from at least one of the first and second servers;
• b) generate a secret key, encrypt the secret key aided by a public key of the at least oneclient andcreate a signature for the encrypted secret key aided by a public key of a server via at least one of the first and second servers;
• c) transmit the previously encrypted and signed secret key from at least one of the first and second servers to the at least one client;
• d) check the created signature of the encrypted and signed secret key aided by the public key of at least one of the first and second servers;
• e) decrypt the encrypted secret key aided by a private key of the at least one client via the at least one client, if the previously checked signature is valid;
• f) determine a hash value of the operational code aided by a hash function via the at least one client;
• g) encrypt the hash value aided by the secret key and sign the encrypted hash value aided by the private key of the at least one client via the at least one client;
• h) transmit the encrypted and signed hash value from the at least one client to at least one of the first and second servers;
• i) check the signature of the encrypted and signed hash value aided by the public key of the at least one client via at least one of the first and second servers;
• j) decrypt the encrypted hash value aided by the secret key via at least one of the first and second servers, if the previously checked signature is valid;
• k) determine an additional hash value of a copy of the operational code stored on at least one of the first and second servers and not transmitted to the at least one client via at least one of the first and second servers;
• and
• l) allow, by at least one of the first and second servers, the at least one client to communicate with the control system of the technical plant in an event the hash value and the additional hash value match.