# US 2013/0173922 A1 · Method for certificate-based authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0173922 A1 - Document ID: US20130173922A1 - Status: Published application - Kind: A1 - Application number: 13/821,511 - Filed: 2011-07-22 - Published: 2013-07-04 - Earliest claimed: 2010-09-07 - Assignees: Siemens Aktiengesellschaft - Inventors: Rainer Falk; Steffen Fries - Web page: https://patentgrep.com/patent/US20130173922A1 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 21/33: using certificates - G06F 21/44: Program or device authentication - G06F 21/445: {by mutual authentication, e.g. between devices or programs} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04W 12/069: using certificates or pre-shared keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A first subscriber authenticates himself to a second subscriber with a certificate associated to the first subscriber. The certificate specifies one or several characteristics, which have to be fulfilled by the second subscriber. In the course of the authentication, it is verified using the certificate whether the second subscriber fulfills the characteristics, wherein a criterion required for successful authentication is that the second subscriber fulfills the characteristics(s). Characteristics of the second subscriber are verified in the framework of the authentication process, the second subscriber representing the authenticator with respect to whom the authentication is carried out. In this way, certificates for authentication dedicated communication links between two communication partners can be determined. The method can be used for any subscribers in a communication network, e.g., representing components of an automation system, such as, for example, control devices, field devices, sensors, actuators and the like. ## Claims ### Claim at position 1 1-16. (canceled) ### Claim 17 A method for certificate-based authentication in which a first subscriber provides self-authentication to a second subscriber using a certificate assigned to the first subscriber, comprising: specifying, in the certificate, at least one characteristic which must be fulfilled by the second subscriber; and verifying, during authentication with reference to the certificate, whether the second subscriber fulfills the at least one characteristic, where a criterion required for successful authentication is that the second subscriber fulfills the at least one characteristic. ### Claim 18 (depends on 17) The method as claimed in claim 17, wherein the at least one characteristic is specified by at least one attribute and/or at least one reference to attribute in the certificate. ### Claim 19 (depends on 18) The method as claimed in claim 18, wherein said verifying is performed by the second subscriber. ### Claim 20 (depends on 19) The method as claimed in claim 19, further comprising, prior to said verifying, one of transmitting, from the first subscriber to the second subscriber, the certificate assigned to the first subscriber; and retrieving by the second subscriber the certificate from a third place. ### Claim 21 (depends on 20) The method as claimed in claim 20, wherein said verifying is performed by the first subscriber. ### Claim 22 (depends on 21) The method as claimed in claim 21, further comprising one of receiving by the first subscriber information relating to properties of the second subscriber from the second subscriber and retrieving the information from a third place; and wherein said verifying is performed by the first subscriber using the information to determine whether the second subscriber fulfills the characteristic or characteristics specified in the certificate. ### Claim 23 (depends on 22) The method as claimed in claim 22, wherein the at least one characteristic which must be fulfilled by the second subscriber comprises at least one of an identity or an identity range for the second subscriber, a device type of the second subscriber, a service provided by the second subscriber, and a method provided by the second subscriber. ### Claim 24 (depends on 23) The method as claimed in claim 23, wherein the identity or the identity range comprises at least one of an IP address or MAC address, an IP address range or MAC address range, a DNS name, a DNS name range, a port number or a port number range based on the TCP and/or UDP protocol, and a URL identifier or a URL identifier range. ### Claim 25 (depends on 23) The method as claimed in claim 23, wherein the service provided by the second subscriber includes a web service and/or the method provided by the second subscriber includes a method of a web service. ### Claim 26 (depends on 25) The method as claimed in claim 25, further comprising, during the authentication of the first subscriber to the second subscriber, verifying the certificate of the first subscriber is performed by the second subscriber. ### Claim 27 (depends on 26) The method as claimed in claim 26, further comprising establishing a cryptographically secure connection between the first and second subscriber based on at least one of an SSL/TLS protocol, an IKE/IPsec protocol and an IKEv2/IPsec protocol, using a public key of the first subscriber contained in the certificate and a private key assigned to the public key. ### Claim 28 (depends on 27) The method as claimed in claim 27, wherein the certificate is an extended X.509 certificate, which also specifies the at least on characteristic which must be fulfilled by the second subscriber. ### Claim 29 (depends on 28) The method as claimed in claim 28, wherein the method for the authentication of the first subscriber is used with the second subscriber and the method for the authentication of the second subscriber is used with the first subscriber. ### Claim 30 (depends on 29) The method as claimed in claim 29, wherein at least one of the first and second subscriber is at least one component of an automation system. ### Claim 31 A communication network, comprising: first and second subscribers in which during operation of the communication network certificate-based authentication is performed with the first subscriber providing self-authentication to the second subscriber using a digital certificate, assigned to the first subscriber, specifying at least one characteristic that must be fulfilled by the second subscriber and during authentication, there is verification with reference to the digital certificate whether the second subscriber fulfills the at least one characteristic, where a criterion required for successful authentication is that the second subscriber fulfills the at least one characteristic. ### Claim 32 (depends on 31) The communication network as claimed in claim 31, wherein at least one of the first and second subscriber is at least one component of an automation system. ### Claim 33 (depends on 31) The communication network as claimed in claim 31, wherein the at least one characteristic is specified by at least one attribute and/or at least one reference to attribute in the digital certificate. ### Claim 34 (depends on 31) The communication network as claimed in claim 31, wherein the at least one characteristic which must be fulfilled by the second subscriber comprises at least one of an identity or an identity range for the second subscriber, a device type of the second subscriber, a service provided by the second subscriber, and a method provided by the second subscriber. ### Claim 35 (depends on 34) The communication network as claimed in claim 34, wherein the identity or the identity range comprises at least one of an IP address or MAC address, an IP address range or MAC address range, a DNS name, a DNS name range, a port number or a port number range based on the TCP and/or UDP protocol, and a URL identifier or a URL identifier range. ### Claim 36 (depends on 34) The communication network as claimed in claim 34, wherein the service provided by the second subscriber includes a web service and/or the method provided by the second subscriber includes a method of a web service.