# US 2018/0324187 A1 · Device for use in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324187 A1 - Document ID: US20180324187A1 - Status: Published application - Kind: A1 - Application number: 15/769,913 - Filed: 2015-10-22 - Published: 2018-11-08 - Earliest claimed: 2015-10-22 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Markus Heintel; Amine Mohamed Houyou - Web page: https://patentgrep.com/patent/US20180324187A1 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 67/1042: using topology management mechanisms - H04L 67/1068: {Discovery involving direct consultation or announcement among potential requesting and potential source peers} - H04L 69/329: in the application layer [OSI layer 7] - H04W 12/63: Location-dependent; Proximity-dependent - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method and device are provided for use in a network including at least one existing device. At least one virtual sub-network is established within the network and a certain trust level is assigned to the at least one virtual sub-network. The device is assigned a first trust level. The device receives a token correlated with the assigned first trust level. The device is permitted into the at least one virtual subnet upon presentation of that token if the first trust level corresponds or includes the certain trust level. ## Claims ### Claim 1 A network having a device for use in the network, wherein the network comprises: at least one existing device; at least one virtual sub-network; wherein the at least one virtual sub-network is established within the network and a certain trust level is assigned to the at least one virtual sub-network, wherein the device is permitted into the at least one virtual sub-network after the device is: assigned a first trust level, receives a token correlated with the assigned first trust level, and presents the token when the first trust level corresponds to or comprises the certain trust level. ### Claim 2 (depends on 1) The network of claim 1, wherein the certain trust level corresponds to at least one security requirement for entering the virtual sub-network, corresponds to at least one capability required in the virtual sub-network, or corresponds to the at least one security requirement and corresponds to the at least on capability required; and wherein the first trust level corresponds to rights assigned to the device, wherein the assignment depends on at least one of a type of the, a status of an integration of the device into the network a previous accessing process by the device, at least one capability of the device, a geographic position of the device, or a security parameter of the device. ### Claim 3 (depends on 1) The network of claim 1, wherein the token is provided by a central unit of the network or by a member of the at least one virtual sub-network. ### Claim 4 (depends on 1) The network of claim 1, wherein the device is assigned a first trust level by the network or by being a member of the at least one virtual sub-network within the network. ### Claim 5 (depends on 1) The network of claim 1, wherein the network comprises a network for a production related process. ### Claim 6 (depends on 1) The network of claim 1, wherein the token is presented by sending a message to a network entity administrating the at least one virtual sub-network directly or by sending the message to a network entity handling communication outside of the network that forwards or induces communication in regard to the access of the device with the entity administrating the at least one virtual sub-network. ### Claim 7 (depends on 1) The network of claim 1, wherein the device is configured to perform at least two functions, wherein the device comprises at least two components, that are integrally built or placed at different geographical positions, and the at least two functions of the device are distributed amongst the at least two components. ### Claim 8 A controller for coordinating an access of a device to at least one virtual sub-network of a network, the controller configured to: initiate an assignment of a trust level to the device; and initiate a transmission of a token describing a permission to enter the at least one virtual sub-network, describing a certain trust level assigned to the at least one virtual sub-network, or describing the permission to enter the at least one virtual sub-network and describing the certain trust level assigned to the at least one virtual sub-network. ### Claim 9 (depends on 8) The controller of claim 8, wherein devices for the at least one virtual sub-network are chosen by considering security parameters. ### Claim 10 (depends on 8) The controller of claim 8, wherein the controller is formed by a trustworthy network component on or at each node. ### Claim 11 A network comprising at least one existing device, at least one controller, and a plurality of virtual sub-networks, wherein the plurality of virtual sub-networks comprises at least one of: an isolated sub-network comprising a certification authority used for initial communication with a new device entering the network, a virtual security management sub-network comprising network equipment and network access controller and certification authority for sharing information between identity management within the network and network access control, a virtual network management sub-network to share information amongst the members of the system enforcing virtual sub-networks, a virtual default sub-network for exchanging discovery or/and plug-negotiation information between the at least one existing device and the new device, a virtual registration sub-network for authentication between the new device and a network equipment, and a virtual production sub-network between the at least one existing device and the new device for performing a task. ### Claim 12 (depends on 11) The network of claim 11, wherein the at least one virtual sub-network comprises a plurality of devices configured for performing a production process together. ### Claim 13 A method for integrating a device in a physical network comprising at least one existing device, wherein in the physical network at least one virtual sub-network is assigned a certain trust level, the method comprising: assigning the device a first trust level; receiving, by the device, a token correlated with the assigned first trust level; and permitting the device into the at least one virtual sub-network upon presentation of the token when the first trust level corresponds to or comprises the certain trust level. ### Claim 14 (canceled) ### Claim 15 (canceled) ### Claim 16 (depends on 5) The network of claim 5, wherein the production related process comprises a transportation process, a milling process, or a work piece handling process. ### Claim 17 (depends on 7) The network of claim 7, wherein the at least two functions relate to production or communication processes. ### Claim 18 (depends on 9) The controller of claim 9, wherein the devices for the at least one virtual sub-network are chosen by considering a used encryption method. ### Claim 19 (depends on 11) The network of claim 11, wherein the network is a production network. ### Claim 20 (depends on 2) The network of claim 2, wherein the token is provided by a central unit of the network or by a member of the at least one virtual sub-network. ### Claim 21 (depends on 20) The network of claim 20, wherein the device is assigned a first trust level by the network or by being a member of the at least one virtual sub-network within the network. ### Claim 22 (depends on 1) The network of claim 1,wherein the token is presented by sending a message to a network entity administrating the at least one virtual sub-network directly or by sending the message to a network entity handling communication outside of the network that forwards or induces communication in regard to the access of the device with the entity administrating the at least one virtual sub-network.