Abstract: Provided is a method for validating a predetermined digital certificate having a validation device, wherein the validation device stores approval information that specifies which digital certificates of a plurality of digital certificates are permissible digital certificates, and wherein the validation device further stores trust information which indicates a trust level of the permissible digital certificates. The method includes determining, while taking account of the approval information, whether the predetermined digital certificate is permissible for the planned use under the current conditions; and if it is determined that the predetermined digital certificate is permissible, determining the trust level of the predetermined digital certificate by taking into consideration the trust information for the planned use and the current conditions, is provided.

Abstract: Provided is a method for validating a predetermined digital certificate having a validation device, wherein the validation device stores approval information that specifies which digital certificates of a plurality of digital certificates are permissible digital certificates, and wherein the validation device further stores trust information which indicates a trust level of the permissible digital certificates. The method includes determining, while taking account of the approval information, whether the predetermined digital certificate is permissible for the planned use under the current conditions; and if it is determined that the predetermined digital certificate is permissible, determining the trust level of the predetermined digital certificate by taking into consideration the trust information for the planned use and the current conditions, is provided.

Abstract: There is a need for coupling, for example within an automation area, particularly critical subareas with less critical subareas of the automation area. The invention relates to a method and a network filtering device for filtering a data packet between a first network and a second network. According to the invention, a data packet is checked several times in parallel by means of a multiplier and a plurality of filtering devices.

Abstract: Provided is a method for an authorized issuing of an authentication token for a device, including requesting an authentication token for the device by sending a request message and at least one authentication parameter to an authorization apparatus, verifying authenticity of the request message using the authentication parameter, verifying authorization for the request by comparing information on the device obtained with the request message in the authorization apparatus with context information for the device stored in a database, and on success of the verification of the authenticity and of the authorization, authorizing the issuing of the requested authentication token.

Abstract: Systems and methods for characterizing a client apparatus on at least one server apparatus are provided. A first certificate is received in the event of a first request for a connection set-up from a server apparatus in a client apparatus. One or more predefined certificate parameters of the first certificate are stored as a set of characterization parameters in the client apparatus. Each further certificate from a server apparatus is checked that is received in the client apparatus in the event of a request for a further connection set-up, against the stored characterization parameter set. A request for a further connection set-up is accepted only if all of the predefined certificate parameters of the further certificate match all characterization parameters of the characterization parameter set.

Abstract: Provided is a method for an authorized issuing of an authentication token for a device, including requesting an authentication token for the device by sending a request message and at least one authentication parameter to an authorization apparatus, verifying authenticity of the request message using the authentication parameter, verifying authorization for the request by comparing information on the device obtained with the request message in the authorization apparatus with context information for the device stored in a database, and on success of the verification of the authenticity and of the authorization, authorizing the issuing of the requested authentication token.

Abstract: The invention relates to a method for monitoring a security network interface unit (23), for example a firewall, which receives a stream of data packets via a first interface (21), checks said data stream with respect to filtering rules, and outputs said data stream to a second interface (22). The method has the steps of duplicating and outputting the data stream to the second interface (22), checking the output data stream for inadmissible data traffic, transmitting a warning message to the security network interface unit if inadmissible data traffic is detected in the data stream, and restricting the data stream by means of the security network interface unit if the warning message is received in the security network interface unit (23). The device or the system according to the invention comprises units which are designed to carry out the aforementioned method.

Abstract: Systems and methods for characterizing a client apparatus on at least one server apparatus are provided. A first certificate is received in the event of a first request for a connection set-up from a server apparatus in a client apparatus. One or more predefined certificate parameters of the first certificate are stored as a set of characterization parameters in the client apparatus. Each further certificate from a server apparatus is checked that is received in the client apparatus in the event of a request for a further connection set-up, against the stored characterization parameter set. A request for a further connection set-up is accepted only if all of the predefined certificate parameters of the further certificate match all characterization parameters of the characterization parameter set.

Abstract: There is a need for coupling, for example within an automation area, particularly critical subareas with less critical subareas of the automation area. The invention relates to a method and a network filtering device for filtering a data packet between a first network and a second network. According to the invention, a data packet is checked several times in parallel by means of a multiplier and a plurality of filtering devices.

Abstract: The invention relates to a method for monitoring a security network interface unit (23), FIG. 2 for example a firewall, which receives a stream of data packets via a first interface (21), checks said data stream with respect to filtering rules, and outputs said data stream to a second interface (22). The method has the steps of duplicating and outputting the data stream to the second interface (22), checking the output data stream for inadmissible data traffic, transmitting a warning message to the security network interface unit if inadmissible data traffic is detected in the data stream, and restricting the data stream by means of the security network interface unit if the warning message is received in the security network interface unit (23). The device or the system according to the invention comprises units which are designed to carry out the aforementioned method.

Abstract: An IT system includes at least one first processing unit and one second processing unit. The first and second processing units jointly execute an application program and are each associated with an installation routine designed to control updating of a first or second program part of the application program. A first actual state is associated with the first processing unit and a second actual state is associated with the second processing unit. After system reboot, or as soon as the first and second program part have been successfully stored, or an error is detected when storing the first and/or second program part, predefined processing steps are respectively carried out in a predefined order by the first processing unit aid the second processing unit depending on the actual state of the first processing unit and the actual state of the second processing unit.

Abstract: An IT system includes at least one first processing unit and one second processing unit The first and second processing units jointly execute an application program and are each associated with an installation routine designed to control updating of a first or second program part of the application program. A first actual state is associated with the first processing unit and a second actual state is associated with the second processing unit. After system reboot, or as soon as the first and second program part have been successfully stored, or an error is detected when storing the first and/or second program part, predefined processing steps are respectively carried out in a predefined order by the first processing unit aid the second processing unit depending on the actual state of the first processing unit and the actual state of the second processing unit.

Abstract: A data processing device having a security processor for processing data in a manner secure from manipulation and/or a confidential manner. At least one ASIC circuit is connected to the security processor via an internal bus. The ASIC circuit has a plurality of interfaces for connecting peripheral units, and the security processor exchanges data with the peripheral units via the ASIC circuit.