A method for secure data transfer in an automation network wherein the method comprises authenticating a user by a program invocation rights system aided by user data for approving a use of the program invocation by the user, encrypting and signing data by the program invocation, were the data contains the user data. The method also includes transferring the data by a transfer medium from the program invocation to the subassembly, decrypting the data in the subassembly, authenticating the program invocation associated with the subassembly, and authenticating the user by the subassembly rights system aided by the user data.