Method and arrangement for secure communication between network units in a communication network

In a non-transitory computer-readable storage medium storing instructions executable by a processor for secure communication between a first network unit and a second network unit in a communication network, the instructions comprising:

• storing a first common secret, a first algorithm, and a second algorithm on the first network unit using the at least one secure hardware component, wherein the first network unit comprises the at least one secure hardware component for secure storage and secure running of software, and on the second network unit using the at least one secure software component formed by code obfuscation, white-box cryptography, measures to protect against debugging attacks, or any combination thereof, wherein the second network unit comprises an insecure hardware platform and using the least one secure software component for secure storage and secure running of software and the first algorithm is distinct from the second algorithm;
• transmitting a first datum from the second network unit to the first network unit;
• running the first algorithm on the first network unit using the at least one secure hardware component and on the second network unit using the at least one secure software component for respective provision of a second common secret, wherein an input for the respective first algorithm is formed by the first common secret and the first datum;
• transmitting a second distinct datum from the first network unit to the second network unit;
• running the second algorithm on the first network unit using the at least one secure hardware component and on the second network unit using the at least one secure software component for respective provision of a third common secret, wherein an input for the respective second algorithm is formed by the second common secret and the second datum, wherein the transmitting of the second datum and the running of the second algorithm are repeated for an update of the third common secret according to a predefinable rule comprising a trigger activated after each use of the third common secret by the first network unit or the second network unit;
• and
• using the third common secret by the first network unit and the second network unit, such that a secure communication between the at least one secure hardware component of the first network unit and the insecure hardware platform of the second network unit is provided.

An arrangement comprising:

• a first network unit;
• and
• a second network unit in a communication network, wherein the first network unit comprises at least one secure hardware component for secure storage and secure running of software, wherein the second network unit comprises an insecure hardware platform and at least one secure software component formed by code obfuscation, white-box cryptography, measures to protect against debugging attacks, or any combination thereof,
• wherein the at least one secure hardware component is configured for secure storage of a first common secret, a first algorithm, and a second algorithm on the first network unit, and the at least one secure software component is configured for secure storage of the first common secret, the first algorithm, and the second algorithm on the second network unit, wherein the first algorithm is distinct from the second algorithm,
• wherein a first transmitter is configured for transmission of a first datum from the second network unit to the first network unit, the second network unit comprising the first transmitter,
• wherein the at least one secure hardware component is configured for secure running of the first algorithm on the first network unit, and the at least one secure software component is configured for secure running of the first algorithm on the second network unit for respective provision of a second common secret, and wherein an input for the respective first algorithm is formed by the first common secret and the first datum,
• wherein a second transmitter is configured for the transmission of a second distinct datum from the first network unit to the second network unit, the first network unit comprising the second transmitter,
• wherein the at least one secure hardware component is configured for secure running of the second algorithm on the first network unit, and the at least one secure software component is configured for secure running of the second algorithm on the second network unit for respective provision of a third common secret, wherein an input for the respective second algorithm is formed by the second common secret and the second datum, wherein the transmitting of the second datum and the running of the second algorithm are repeated for an update of the third common secret according to a predefinable rule comprising a trigger activated after each use of the third common secret by the first network unit or the second network unit, and
• wherein the first network unit and the second network unit comprise communication devices configured for use of the third common secret by the first network unit and the second network unit, such that a secure communication between the at least one secure hardware component of the first network unit and the insecure hardware platform of the second network unit is provided.