Method for certificate-based authentication

A communications network comprising:

• a first subscriber device, a second subscriber device, and a third subscriber device communicatively coupled to each other via a communications network,
• wherein the first and second subscriber device are configured to perform a certificate-based authentication prior to initiating a confidentially-protected communication between the first and second subscriber device, wherein, in the operation of the communications network, the first subscriber device authenticates himself to the second subscriber device with the aid of a digital certificate associated to the first subscriber device and containing a public key of the first subscriber device,
• wherein the digital certificate identifies one or more requirements for which the fulfillment thereof is ensured by the third subscriber device, and
• wherein upon request the third subscriber device is configured to issue the one or more requirements identified by the digital certificate associated with the first subscriber device,
• wherein the one or more requirements are issued separately from the digital certificate by the third subscriber,
• wherein, within a framework of an authentication process by the second subscriber device:
• the second subscriber device is configured to classify the digital certificate of the first subscriber device as valid when a validity condition is fulfilled, wherein the validity condition is dependent on whether or not one or more of the requirements specified in the digital certificate have been issued by the third subscriber device;
• wherein the first subscriber requests information from the third subscriber as to whether one or more of the requirements identified in the digital certificate were issued by the third subscriber, wherein the first subscriber provides the information requested to the second subscriber, whereupon the second subscriber, based on this information, checks the validity condition, wherein the first and the second subscribers must authenticate themselves to the third subscriber for the requesting of the one or more requirements;
• wherein the validity condition is a logic operations sequence comprising multiple links selected from the group consisting of AND-links, NAND-links, OR-links, XOR-links, and NOR-links, wherein the operations sequence is encoded in the digital certificate;
• and
• wherein at least one of the first, second, and third subscriber represents components of an automation system.

A method for mutual certificate-based authentication, comprising:

• transmitting, from a first subscriber to a second subscriber, via a communications network, a first digital certificate associated to the first subscriber and which contains a public key of the first subscriber, wherein the first digital certificate specifies one or more first requirements and for which the fulfillment thereof is ensured by a third subscriber,
• classifying, by a processor of the second subscriber, the first digital certificate of the first subscriber as valid when a first validity condition is fulfilled, wherein the first validity condition is dependent on whether or not the one or more first requirements specified in the first digital certificate have been separately issued by the third subscriber,
• the second subscriber transmitting to the first subscriber, via the communications network, a digital certificate associated to the second subscriber and which contains a public key of the second subscriber, wherein the second digital certificate specifies one or more second requirements for which the fulfillment thereof is ensured by the third subscriber,
• classifying, by a processor of the first subscriber, the second digital certificate of the second subscriber as valid when a second validity condition is fulfilled, wherein the second validity condition is dependent on whether or not the one or more second requirements specified in the second digital certificate have been separately issued by the third subscriber,
• initiating, by the respective processors of the first and second subscribers, a confidentially-protected communication between the first and second subscribers only when both (a) the second subscriber classifies the first digital certificate of the first subscriber as valid and (b) the first subscriber classifies the second digital certificate of the second subscriber as valid;
• wherein the first subscriber requests information from the third subscriber as to whether one or more of the requirements identified in the digital certificate were issued by the third subscriber, wherein the first subscriber provides the information requested to the second subscriber, whereupon the second subscriber, based on this information, checks the validity condition, wherein the first and the second subscribers must authenticate themselves to the third subscriber for the requesting of the one or more requirements;
• wherein the validity condition is a logic operations sequence comprising multiple links selected from the group consisting of AND-links, NAND-links, OR-links, XOR-links, and NOR-links, wherein the operations sequence is encoded in the digital certificate;
• and
• wherein at least one of the first, second, and third subscriber represents components of an automation system.