WO2005055018A1

WO2005055018A1 - Method and device for securing digital data

Info

Publication number: WO2005055018A1
Application number: PCT/EP2004/013974
Authority: WO
Inventors: Ismet Koyun
Original assignee: Kobil Systems Gmbh
Priority date: 2003-12-08
Filing date: 2004-12-03
Publication date: 2005-06-16
Also published as: DE102004059265A1

Abstract

The invention relates to a method for securing digital data on a data carrier, whereby the data provided by the computer (6) can be encrypted by means of a cryptographic method, and the data carrier has a transportable design. The invention also relates to a device for carrying out the inventive method. The method and device are to be improved with little effort whereby digital data are stored with a high level of security so that they are protected from unauthorized interventions or eavesdropping and can be transported by a user. The data, when needed by the user, can be made available in a problem-free manner for additional processing or for reading or the like. To this end, the invention provides that: the data to be secured are fed via a connecting device (4) of a mobile device (2) to a crypto unit (12) contained in the latter; the encryption of the data is carried out while using a secret value of the crypto unit (12) that cannot be read out from the outside, and this data is subsequently written into a non-volatile memory (10) of the device (2) and stored therein, and; for additional use, the data thus encrypted in a highly secured manner are decrypted in a spy-proof manner and fed to the computer (6).

Description

Method and device for securing digital data

The invention relates to a device according to the features specified in the preamble of claim 1. The invention further relates to a device for performing such a method.

A method is known from US Pat. No. 5,483,598 for encrypting a digital message to be transmitted and for decrypting it after transmission in order to ensure confidentiality. A computer or transmitter contains a hash code generator which contains a one-way hash code for the concatenation of two values. This is a secret long-term value in one register and an initial value in another register of the transmitter and accordingly for a receiver. The sender uses the values mentioned to generate a key stream to encrypt the message, which is also divided into individual message parts, and also to decrypt the recipient accordingly. Furthermore, US Pat. No. 5,432,851 discloses a system for checking access to a computer, a unique password that is only valid for one session being generated by a processor chip card made available to a user. Here, the user can query, for example from a host computer, a log-in message which is shown on a display after generation and which the user then manually transfers to his processor chip card in order to encrypt his message to be sent , However, such methods are not sufficiently secure against inadmissible external attacks.

There are many situations in computer technology in which an authentication of a user has to be carried out for security reasons. This problem is particularly important in insecure networks, such as computer access on the Internet or in home banking via modem and telephone network.

Proceeding from this, the object of the invention is to further develop the method and the device with little effort in such a way that digital data can be stored with a high degree of security against unauthorized interference or eavesdropping and can be transported by a user, the data if necessary Users can easily be provided for further editing or reading or the like. With simple handling, the user should have a high degree of mobility with regard to the digital data mentioned and should be able to store and transport the data in a way that is safe from spying, so that the data can be used in the required manner on commercially available computer systems or computers can.

This object is achieved with regard to the method according to the features specified in claim 1. With regard to the device, the solution is implemented according to the features specified in the independent device claim.

The method according to the invention, which is implemented on a mobile device with a connection device to computer systems, opens up the following possible uses in a simple manner: A mobile user can authenticate himself highly securely to a computer system.

A mobile user can carry the digital data with them in a highly secure encrypted form, so that they can be decrypted if necessary, then viewed or edited and then stored again in highly secure encrypted form on the mobile device.

The invention is characterized by the following features and functions:

1. mobility of the user,

2. secure encryption and decryption of digital data and their secure transport,

3. authentication to the computer system,

4. Central access control.

Particular refinements and developments of the invention are specified in the subclaims and the following description.

The method according to the invention and the device proposed for carrying it out are explained in more detail below on the basis of the special exemplary embodiments illustrated in the drawing, without any limitation in this regard. Show it:

1 is a block diagram with the mobile device and a computer known per se,

Fig. 2 is a block diagram of a preferred method for generating passwords.

The aforementioned features and functions are explained in more detail with reference to FIG. 1.

1. User mobility A user is the owner of the device 2 according to the invention. The user is mobile when using the device in the following sense:

a) This device 2 is due to its small external dimensions (only a few centimeters wide, a few millimeters high and a few millimeters deep) ideal for mobile use in the sense that the user can carry the device 2 with him at all times without disabilities. The device 2 is basically constructed in the manner of a memory stick and contains a housing which accommodates the electronic components and a connection device 4 for connection to the computer 6, preferably as a USB interface.

b) The user does not have any software, device drivers, etc. for commissioning device 2. to install that would not already be on the device itself. Commissioning requires the physical connection of the device 3 by means of the connection device 4 to a corresponding connection device 8 of the computer 6, which is currently available to the user. It goes without saying that the connection devices 4, 8 enable the data exchange and the transmission of required signals, commands and the like in a known manner. For commissioning on a computer system 6, however, it is preferably not necessary to install software or device drivers from a data carrier (e.g. from a floppy disk, CD-ROM or DVD) other than the device according to the invention or from a server. In the context of the invention, it is of particular importance that the software and / or device driver required for performing the method is implemented in the mobile device 2 and in particular stored and / or stored in a non-volatile memory of the mobile device 2 to be explained below are available for retrieval etc. and processing. The software programs and / or drivers stored on the device according to the invention are stored in a freely accessible memory area, which in particular consists of a part of a non-volatile memory 10, but which can be accessed without further user authentication, as will be explained below.

In a variant of the device according to the invention, the full functionality is even given without installing any software or device drivers. If known technologies were used, a device driver suitable for the crypto unit 12 would have to be installed in order to use the crypto unit 12, which is used for encryption and decryption and for authentication. According to the invention, this is circumvented by the fact that the driver for the non-volatile memory (2) present on conventional computer operating systems is used by the device so intelligently that commands are thus sent to the crypto unit 12 and data is also received from the crypto unit 12 can be.

This solution according to the invention also makes it possible to use PC security applications, such as To carry virtual private network client applications or e-banking client applications that use the crypto unit 12 with them in the device according to the invention. For this purpose, the PC security application is stored in the non-volatile memory 10 and started from there by the user. The PC security application can communicate directly with the crypto unit 12 due to the intelligence of the device described above, without having to install a special device driver beforehand. The intelligence described above makes the usual device drivers superfluous. The usual device drivers for crypto units include e.g. Smartcard reader drivers, PKCS # 11 libraries, cryptographic service provider libraries. With this invention, the user is completely mobile when using the PC security application: use from any computer without having to install anything beforehand or having special access or execution rights on the computer.

2. Secure encryption and decryption of digital data and their secure transport.

The device 2 according to the invention contains, in addition to its connection device 4 to the computer system 6, for example via a USB interface, a data carrier with a crypto unit 12 and the non-volatile memory area 10. The non-volatile memory area 10 can be designed, for example, as a flash ROM , The crypto unit 12 is designed in particular as a crypto processor or cryptographic co-processor, for example as a smart card in the format of a cell phone SIM card. In the mobile device 2, the crypto unit 12 is arranged to be exchangeable in a simple manner, so that even laypersons can easily carry out the exchange with simple handling, comparable to the exchange of a cell phone SIM card in a cell phone. The crypto unit 12 is characterized in that it contains a memory area which cannot be read from the outside and which is suitable as a carrier of a secret value, in particular a private key or secret key, in that it uses a cryptographic algorithm (for example a public key encryption - process) using the secret value as a parameter, without the secret value or intermediate results of the algorithm being able to be read from outside (ie outside the crypto unit).

According to the invention, digital data can be stored in a highly secure manner on the device according to the invention by the computer system 6: The device 4 is connected to the computer system 6 via the connection device 4. The digital data to be backed up are fed to the device 2 and in particular its data carrier. The crypto unit 12 or software placed on the computer system encrypts the data to be secured using the secret value, in particular a public key. The data encrypted in this way is written into the non-volatile memory area 10 and thus permanently stored.

For further use, such as viewing or processing the original digital data, the encrypted data are first decrypted according to the invention. This decryption is carried out by the crypto unit 12 in the above. Senses carried out if the identification of the user previously carried out within the scope of the invention was successful. To identify the user, an identification check is carried out by the user and / or by the user, in particular the PIN of the crypto unit 12 or a biometric feature (e.g. fingerprint) stored digitally in the crypto unit 12 is queried. The feature entered by the user is compared with the corresponding reference data in the crypto unit 12. According to the invention, it depends on the result of the comparison whether the decrypted digital data is decrypted using the crypto unit 12.

3. Authentication to computer systems

According to the invention, the crypto unit 12 in the device 2 contains the secret value (for example private key or secret key), hereinafter also referred to as secret, and can execute cryptographic algorithms. This enables known ones to be performed Authentication method. This includes in particular the generation of one-time passwords, which are calculated using a symmetrical encryption method and the secret value, such as the secret key.

4. Central access control

In combination of the measures 2 and 3 explained above, the mobility of the device according to the invention can optionally also be configured such that access to the non-volatile memory area 10 is only released after successful authentication against a central access control system 14 , As a result, access to the non-volatile memory area 10 and thus to the data encrypted therein can be made dependent on the consent of the central access control system 14. For this purpose, a connection 16 between the computer system 6 and the central access control system 14 is specified, which e.g. can be designed as a network connection (also radio network).

The permission of the central access control system 14 to access the non-volatile memory area 10 must either be obtained with each access or can explicitly include future accesses for a limited period of time. After this permission has expired, a new permission must be obtained before the non-volatile memory area 10 can be accessed again. The checking of this permission is carried out with the help of the checking component 18 or 20, which either runs - preferably in the form of software 18 - on the computer system or is in particular part of the device 2 according to the invention and preferably runs in its hardware 20. Whether the non-volatile memory area 10 is accessible or not is made dependent on the result of the checking of the permission within the checking component 18 or 20. The checking component 18 or 20 can also use the crypto unit 12 to check the permission.

The central access control can be implemented and / or carried out as follows, for example:

Before access to the non-volatile memory 10, the crypto unit 12 generates a one-time password which is transmitted to the central access control system 14 via the connection 16. After the successful verification of the one-time password there, the central access control system 14 generates a permission feedback, which in turn is transmitted to the computer system 6 via the connection 16. There, the permission feedback is checked with the help of the checking component 18 or 20, and in the event of a positive check, the non-volatile memory area is released for access in order to now carry out the above-described secure encryption and decryption of the digital data and to enable their secure transport ,

A special embodiment of the invention is explained in more detail with reference to FIG. 2, which, in combination with the exemplary embodiment explained above, consists in the fact that the user transfers to the computer 6 a password that is only valid for a current session and which clearly identifies him as the authorized user or characterized authentic client. The computer 6, which is also referred to below as a computer and in particular as a server, is in turn able to determine the one-time password currently valid for this particular user. The user is only allowed further access if the entered password and the password calculated by the computer match. It is essential that the respective password is only valid once, which was generated once by synchronous calculation. Security against unauthorized use is thus also guaranteed in insecure networks, such as on the Internet or for home banking via modem and telephone network. All users or participants use the same encryption method or cryptosystem, the underlying encryption function f _{k C} ) being parameterized by a secret key k (C). All calculations, both on the user side and on the computer side, are carried out on a processor chip card which is designed to carry out the aforementioned encryption method. A family of permutations, ie bijective functions on their argument range, f _{k (C} : D → D) parameterized by a secret key k (C) is used. This family satisfies at least one, preferably several of the following conditions:

1. The definition set (and image set) D is finite and has a sufficient number of elements. In particular, it contains at least 2 ⁵⁴ many elements.

2. The set of all permitted keys is sufficiently powerful. In particular, it contains at least 2 ⁶⁶ many elements.

3. f _{k (C)} is a random function in the sense that with arbitrary According to the given argument x from the definition set D, the probability of obtaining a certain element y from D as a result of the function evaluation is approximately equal to 1 / | D | is when you randomly and equally select a key k (C) from the set of all possible keys.

4. With knowledge of a sequence of values x ₀ , x ,, x _n from the definition set D, where x _{i + 1} = f _{k (} c ₎ (Xi) for 0≤i <n, it should be a potential attacker in the In practice, even with the help of powerful computers, it may be impossible to determine the key k (C) or to calculate x _{n + 1} = f _{k (C)} (x _n ) within a reasonable time.

The computer 6 and the user both have a secret start value, which start value x _{0 c is} initially generated randomly by the server and is written in a secure environment into the secret memory area of the chip card of the user, which is not accessible from the outside. Furthermore, a random secret key value k (C) is determined by the computer and written by the latter into a memory area of a data carrier, in particular a chip card of the user C, which is not accessible from the outside. The chip card is then issued to user C. Furthermore, the computer contains a database which is only accessible to authorized persons, in which the assignment of the secret key k (C) assigned to the respective user and the last password x _nc used by user C are stored. Furthermore, in the

The chip card of the user C permanently stores the respective secret key value k (C) and the last password used x _nc in a secured memory area. Furthermore, according to the invention, the use of already existing hardware and firmware is made possible for the user. For example, the known EC cards with chip can be used, which are designed as processor chip cards and onto which other applications can be loaded in addition to standard applications, electronic cash and electronic wallets. The EC card currently issued by German banks can carry out the following encryption procedures as standard: The Data Encryption Standard, DES for short, and Triple-DES. The chip cards used in mobile phones can also be used.

The computer 6 contains a first unit 24 for carrying out a known cryptographic method with the encryption function f _kc. The user receives a data carrier 26 which has and / or is designed as the crypto unit already explained, which has a second unit 28 for carrying out the crypto unit of the crypto method according to f ^. The encryption methods that are used today are, in particular, the symmetrical cryptosystems that are customary today, such as DES, Triple-DES or IDEA

Use. Instead of the encryption function f _kc \ mentioned, the associated decryption function can be grounded according to the invention. The rech

ner 6 also contains a first component 30 for generating a secret starting value x _{0 c} and a second component 32 for generating a secret key k (C). The data carrier or chip card 36 contains a first memory 34 for the secret starting value x _{0 c} and a further memory 36 for the secret key k (C). Finally, the computer 6 contains a database 38 which is only accessible to authorized persons and in which the assignment of the user or the chip card with its secret key k (C) and the last password x _nc used by the user C are stored. All users or participants of the method or the device according to the invention use the same cryptosystem with the same encryption function and / or the associated decryption

function. It should be noted that the encryption function is a

Permutation, that is, a bijective function on the argument area, and that the associated decryption function can be used if necessary instead of the aforementioned encryption function. The encryption function f _C ) used is parameterized by the secret key k (C).

Within the scope of the invention, the secret initial value x _{0 c} , which is preferably initially generated randomly by means of the computer 6, is written to the data carrier 26, which according to the invention is contained in the mobile device, in its first memory area 34. Furthermore, the random key k (C), which is also preferably generated by means of the computer 6, is written into the second memory area 36 of the data carrier 26 of the user C, which is likewise not accessible from the outside. The data carrier or the chip card 36 prepared in this way is then handed over to the user C and enables his authentication or determination of the access authorization to the computer 22 at any time. If the last password used by C is x _nc , the client C and server find the next valid password Calculate ^x n + 1, C ^{= f} k (C) ( ^χ n, c) -

Within the scope of the invention, the user is thus able to use the data carrier 26 prepared in this way to provide the computer only for the desired te session to pass a one-time valid password, which clearly characterizes him as an authentic user. The computer, in particular the server, is in turn able to determine the one-time password currently valid for this one user. Further access is only possible for the user if the entered password and the password calculated by the computer match. The one-time password is generated for each session or transaction and is only valid for this one time.

Alternatively, provided that the encryption function is a

Permutation shown, the corresponding instead of the encryption function

Decryption function can be used, calculating the next

The valid password is based on the formula: n + 1, C ^{= f} k (C) ( ^χ n, c) -

Since a secure cryptosystem such as DES, Triple-DES or IDEA is used, an unauthorized person can also do the next one even if x ₀ to x _n Q is known

Do not calculate password x _{n + 1 c} or the encryption method

to calculate. Through the use of the symmetrical crypto systems mentioned today, it is possible to use the decryption function instead of the

Encryption function can be dispensed with, since knowledge of the explicit

Encryption function can be determined efficiently the decryption function in question in a simple manner.

So that the software that executes the crypto-algorithms cannot be manipulated by unauthorized persons, the first unit 34, the first component 30, the second component 32 and also the second unit 38, the second memory area 36, which are on the data carrier, are expediently of the mobile device are located, implemented in whole or in part on a highly secure processor chip card. reference numeral

mobile device

Connection setup of 4

Computer / computer system

Connection setup of 6 non-volatile memories

Central access system crypto unit

Connection between 6 and 14

Test component first unit

Data carrier / chip card second unit first component second component first memory area second memory area

Database

Claims

claims

1. A method for backing up digital data on a data carrier, the data provided by a computer (6) being encryptable using a cryptographic method and the data carrier being designed to be transportable, characterized in that the data to be backed up is provided by a connection device (4) Mobile device (2) are fed to a crypto unit (12) contained in the latter, that the encryption of the data is carried out using a secret value of the crypto unit (12) that cannot be read from the outside, which is subsequently encrypted in a non-volatile memory (10) of the device (2) are written and stored and that for further use, the data, which is encrypted in such a highly secure manner, is decrypted in such a way that it is secure against spying and is fed to the computer (6).

2. The method according to claim 1, characterized in that after performing an authentication method and an identification of an authorized user, the decryption of the stored data is carried out and the decrypted data are supplied to the computer (6) via the connection device (4) and / or by means of a secret value, which is contained in a memory area of the crypto unit (12) that cannot be read from the outside, a cryptographic algorithm is executed, wherein neither the secret value nor intermediate results of the algorithm from outside, thus outside the crypto unit (12), can be read out.

3. The method according to claim 1 or 2, characterized in that the digital data to be backed up after being fed to the device (2) by means of the crypto unit (12) or on software contained in the computer (6) are encrypted by means of the secret value and that the data encrypted in this way is written into the non-volatile memory area (10) and thus permanently stored and / or that the encrypted data is used by the crypto unit (12) for further use are decrypted, the user being identified beforehand and the encrypted digital data being decrypted using the crypto unit (12) only if there is a positive result.

4. The method according to any one of claims 1 to 3, wherein starting from a secret start value (x _{0 c} ), which is stored together with a secret key (k (C)) in a computer (2) and at a user (C) , a next key value (x _nc ) is calculated using an encryption function, including a previously used, in particular the last used, key value, characterized in that the key value generated in each case is formed as a one-time password for the access authorization to the computer (2) that the secret starting value (x _{0 c} ) and the secret key (k (C)) are stored on a data carrier (6) made available to the user (C) and designed as a processor chip card in a secure memory area which is not accessible from the outside, that the next password (x _{π c} ) berec on the data carrier (6) by means of the aforementioned encryption function including the previously used password hnet and given to the computer (2) to check the access authorization of the user (C) to the computer (2) that the last password used in the computer (2) is the secret key (k (C)) of the respective user (C ) and / or that the passwords are generated by synchronous calculation both in the computer (2) and on the data carrier (6).

5. The method according to claim 4, characterized in that a set of permutations parameterized by the secret key (k (C)) of permutations, ie bijective functions on their argument range, f _{k (C)} : D → D are used as the encryption function, the following conditions are wholly or partly sufficient in such a way that the definition set and / or the image set D are finite and have a sufficient number of elements, in particular at least 2 ⁵⁴ elements and / or that the set of all permissible keys is sufficiently powerful and preferably at least 2 ⁶⁶ many elements and / or that the function f _{k (C) is} a random function (random function) such that, given any given argument x from the definition set D, the probability of obtaining a certain element y from D as a result of the function evaluation is approximately the same 1 / | D | is preferably a key k (C) from the set of all possible keys randomly and / or equally distributed is selected and / or that the underlying encryption function or decryption function is parameterized by the secret key.

6. The method according to any one of claims 1 to 5, characterized in that on the computer side an assignment of the secret key value and the last password used by the user to this user and / or that the secret start value by means of the computer (2), initial and is generated randomly and / or that the random, secret key value is generated by means of the computer (2).

7. The method according to any one of claims 1 to 6, characterized in that in particular in the crypto unit (12) data for access authorization, in particular PIN or reference data, are stored in the device (2), which data are compared with the data to be entered by a user , and that if a match is found, the decrypted data is decrypted, and / or that the data which is encrypted using a secret value and is written into the non-volatile memory area (10) and / or in particular is stored permanently.

8. The method according to any one of claims 1 to 7, characterized in that in order to use the original digital data, which is stored encrypted in the non-volatile memory (10), a query of the access authorization and / or an identification of the user is carried out, a reference value stored in the device is used, and / or that the software and / or driver required for the implementation of the method, in particular by means of the crypto unit (12) and / or the non-volatile memory, by means of the mobile device ( 2), preferably the crypto unit (12) and / or the non-volatile memory (10) are provided.

9. Device for securing digital data, characterized by a mobile device, comprising a connection device (4) to a computer (6) and a data carrier with a non-volatile memory (10) and a crypto unit (12), which are used for carrying out of the method according to one of claims 1 to 8 are formed.