DE102013218373A1 - Method and system for cryptographically securing a given message processing flow - Google Patents

Abstract

A method for exchanging data (11, 12) between a first security zone (98) and a second security zone (99), comprising the method steps: - receiving data (11) from the first security zone (98) an input stage (2) of a gateway (1); Performing a process comprising different required checks of the data (11); - Wherein a processing of each of the required tests in each case by a cryptographic protection measure (3a, 4a, 5a) is ensured by using the cryptographic protection measures (3a, 4a, 5a) ensures that an output stage (9) of the gateway (1) the Data (11) or data (12) derived from the data is not readable by the second security zone (99) if at least one of the required checks has not been performed.

Description

The present invention relates to the technical field of securely exchanging data between a first security zone and a second security zone.

For a high level of security of the Cross Domain Solution, it must be ensured that all required checks and processing steps have actually been completed. Although this can be achieved by a corresponding overall solution. However, a fixed, rigid sequence of checks is impractical for increased robustness, flexibility in which tests to perform (e.g., depending on file type), and simpler modular compliance evidence. Nevertheless, high reliability must be achieved.

• • Content Checking mit separater Input-Stufe und Output Stufe (3) sowie mit kombinierter Input-Output-Stufe (2)
• • Verwendung mehrerer Content Checker :Anordnung mehrerer Prüfstufen hintereinander, parallel oder dezentral über Datenbank (5, 6, 7)
• • Verschlüsselung von eingehendem Content durch Input-Stufe; Entschlüsselung von ungeprüftem Content und digitale Signatur (8). Es ist sichergestellt, dass die Output-Stufe keine ungeprüften Daten ausgeben kann, da sie den Entschlüsselungsschlüssel nicht kennt.

In the patent application US2012226917A1 In particular, "Data Content Checking" (QinetiQ) is disclosed:

• • Content checking with separate input level and output level ( 3 ) and with combined input-output stage ( 2 )
• • Use of multiple Content Checker: Arrangement of several test stages in succession, parallel or decentralized via database ( 5 . 6 . 7 )
• • Encryption of incoming content by input level; Decryption of unchecked content and digital signature ( 8th ). It is ensured that the output stage can not output unchecked data because it does not know the decryption key.

Data diodes are known to ensure by physical or partially even only logical protective measures that only a unidirectional data communication takes place.

In the regulatory environment, cross-domain security solutions ("data locks") are known that allow a controlled exchange of documents between two security zones. In addition to data diodes, filtering for malware and the document format or classification of a document are performed. For a bidirectional communication is such a data lock separately for each direction of communication, that is to provide twice.

A major disadvantage of the known cross-domain security solution architectures is that they must operate unidirectionally (i.e., be duplicated for a bidirectional solution). Further, in the industrial application environment, there is an increasing demand for a flexible, extensible solution to support different communication protocols and document types.

From DE 10 2006 036 111 B3 (Siemens) is a solution for a secure transmission of a message from a first zone in a second zone known, wherein carried out in a demarcated by unidirectional data diodes transition zone before forwarding a document at least two different content checks.

From US 2012/0226914 A1 (QinetiQ) is known to provide multiple content checkers for reviewing a document in a parallel arrangement.

From US 2012/0226917 A1 (QinetiQ) is aware that incoming files are encrypted before testing (this can not harm them). A content checker decrypts the document and digitally signs it when it has successfully verified it.

From WO 2012/170485 A1 (Adventium) is known to realize a cross domain security solution in a virtualized execution environment. Separate virtual machines are provided for the individual components of the Cross Domain Security Solution.

Secret sharing methods are well known, see e.g. http://en.wikipedia.org/wiki/Secret_sharing. A secret can only be determined if several pieces of information are merged.

The prior art describes that a single test component creates a digital signature upon successful verification.

Multi-signatures are described eg in:
http://charlotte.ucsd.edu/~mihir/papers/id-multisignatures.pdf . http://www.informatica.si/PDF/34-4/12_Shao-Multisignature%20Scheme%20Based%20on%20Discrete%20Logarith.pdf

In the case of packet-switched data communication, for example IP communication, source routing is known in which the sender specifies the path of a data packet (see, for example, US Pat http://de.wikipedia.org/wiki/Source_Routing ).

1 shows an arrangement 901 according to the prior art for secure data exchange between two security zones 998 . 999 , Via a combined input-output stage 902 . 909 become news 911 . 912 . 913 . 914 received and spent. Multiple Message Processing Engines 903 . 904 . 905 . 906 are provided to the news 911 . 914 to check and if necessary to edit. While editing are the news 911 . 912 . 913 . 914 encrypted and packaged in a message container data structure. The news 911 . 912 . 913 . 914 or the Message Container data structures contained in these are stored in a Message Container Data Base (MCDB) 908 stored. A message processing execution engine 907 controls the processing of the messages 911 . 912 . 913 . 914 ,

This arrangement 901 has the advantage of having a testing component 903 . 904 . 905 . 906 basically for news 911 . 912 . 913 . 914 is usable in both directions. It is for more than two interfaces 902 . 909 expandable. For different types of data, a different subset of fundamentally possible tests can be performed. It is easy to add additional message processing engines. The order 901 However, has the disadvantage that compliance with a predetermined order of the given tests can not be reliably guaranteed. There is also the possibility that in case of malfunction of the input-output stage 902 . 909 the case may arise that a message is issued that has not passed all the predetermined checks successfully.

There is a need for a flexible solution for the secure exchange of data between two security zones (eg zones) ISO / IEC62443 ). It is an object of the present invention to meet this need.

This object is achieved by the solutions described in the independent claims. Advantageous embodiments of the invention are specified in further claims.

According to a first aspect, the invention relates to a method for exchanging data between a first security zone and a second security zone. The method comprises a method step according to which data is received from the first security zone at an input stage of a gateway and a method step according to which a process is carried out. The process involves different required checks of the data. A processing of each of the required tests is ensured by a cryptographic protective measure. The cryptographic protection measures ensure that an output stage of the gateway does not make the data or data derived from the data readable for the second security zone if at least one of the required checks has not been carried out.

According to a further aspect, the invention relates to a system for exchanging data between a first security zone and a second security zone. The system comprises an input stage, an output stage and at least two check engines. By means of the input stage data from the first security zone can be received. By means of the output stage, the data or data derived from the data can be provided for the second security zone. On the at least two test engines, a different required test of the data is feasible. Each of the at least two check engines comprises a cryptographic protection measure with which it can be ensured that the output stage does not make the data or the derived data readable for the second security zone if at least one of the at least two required checks has not been performed.

The invention will be explained in more detail with reference to the figures, for example. Showing:

1 An arrangement for secure data exchange between two security zones according to the prior art;

2 A system and method according to an embodiment of the invention.

3 A variant of the system and method of 2 ;

4 A variant of the system and method of 2 as well as from 3 ,

2 shows a system 1 and a method for cryptographically securing multi-stage message processing according to an embodiment of the invention. The system 1 serves the secure exchange of data 11 . 12 between a first security zone 98 and a second security zone 99 , The system 1 includes an input level 2 , an output stage 9 and at least two test engines 3 . 4 . 5 , By means of the input level 2 are the data 11 from the first security zone 98 receivable. By means of the output stage 9 are the data 11 or from the data 11 derived data 12 for the second security zone 99 mountable. On each of the at least two test engines 3 . 4 . 5 is each a different required test of the data 11 . 12 feasible. Each of the at least two test engines 3 . 4 . 5 includes a cryptographic protection measure 3a . 4a . 5a by means of which it can be ensured that the output stage 9 the data 11 . 12 not for the second security zone 99 readable if at least one of the at least two required tests has not been carried out.

To the data 11 . 12 between the first security zone 98 and the second security zone 99 to be exchanged according to a Embodiment of the method, the data 11 from the input level 2 receive. After that, through the system 1 different required checks of the data 11 or from the data 11 derived data 12 carried out. This involves a complete execution of the required checks with the help of the cryptographic safeguards 3a . 4a . 5a ensured by using the cryptographic safeguards 3a . 4a . 5a it is ensured that the output level 9 the data 11 or from the data 11 derived data 12 not for the second security zone 99 readable if at least one of the required tests has not been carried out.

In the in 2 illustrated embodiment, the data 11 by means of one of the security zone 98 sent message through the input level 2 from the first security zone 98 receive. While passing through the system 1 Exams can also be used to process the data 11 be made from the data 11 that is, derived data 12 be generated, as in 2 - 4 represented for example the test engine 4 can make a change in the data.

One, several or all of the required checks on the data may or may not include the data 11 but from the data 11 derived data, such as the data 12 , being checked. An examination of from the data 11 derived data is thus according to the laws of logic and in the context of this document also as an examination of the data 11 specific.

According to preferred embodiments, the data becomes 11 however, not changed and the data 11 are identical to the data 12 , By means of a message the data become 11 . 12 through the output stage 9 for the second security zone 99 provided.

Preferred embodiments of the invention make it possible to ensure that the required execution of the required tests by the test engines 3 . 4 . 5 actually complied before a message with the data 12 from the output stage 9 readably provided or output. According to the laws of logic and within the scope of this invention, the unreadable providing of data includes 11 . 12 of course not providing the data 11 . 12 , In other words, if the output level 9 the data 11 . 12 does not provide, so is the data 11 . 12 inevitably unreadable provided.

By the issue level 9 the data 11 . 12 not for the second security zone 99 provides readable, if at least one of the required checks has not been performed, it ensures that the output level 9 the data 11 . 12 only readable for the second security zone 99 when each of the required tests has been carried out. Of course, other conditions for providing the data 11 . 12 through the output stage 9 be provided. In general, a separate security mechanism will prevent the data 11 . 12 to the second security zone 99 when all the required tests have been carried out but at least one of the required tests has not been successful. Further embodiments of the present invention thus additionally include processing each of the required tests by a cryptographic protection measure 3a . 4a . 5a is ensured by ensuring that the output level 9 the data 11 . 12 not for the second security zone 99 readable if one of the required checks has not been successfully completed.

Preferably, the system is or includes 1 a gateway 1 , The gateway 1 can be as an integrated solution (appliance). In this case, the gateway performs 1 all the necessary tests yourself and includes at least two test engines 3 . 4 . 5 , Alternatively, the system can be implemented in the form of separate, interconnected individual components, for example, so that part of the required checks by the gateway 1 while another part of the tests is outsourced. Likewise, all required tests can be outsourced.

In the in 2 illustrated embodiment also include the input stage 2 and the output level 9 one protective measure each 2a . 9a , with the help of which each is verifiable that the output stage 9 the data 11 . 12 not for the second security zone 99 readable. The testing engines 3 . 4 . 5 are preferably configured as message processing engines. The system 1 is preferably bidirectionally operable, so that the output stage 9 is operable as an input level and the input level 2 as output level. In this context, one also speaks of the input-output stage 2 and the input-output stage 9 ,

Preferably, the required tests are each by a different test engine 3 . 4 . 5 carried out. Preferably, the test engines 3 . 4 . 5 logical test engines.

In preferred embodiments, the input stage comprises 2 a fixing agent 21 which is designed and / or adapted, depending on the type of data 11 determine which tests are required and / or Define in which series the required tests are to be performed and / or to establish a workflow according to which the data 11 the at least two test engines 3 . 4 . 5 run through.

In preferred embodiments, the required checks include any selection of: a format check, a range check, a font check, a data volume check, a virus scanner, a plausibility check of the contents of the data.

The test engines designed as test blocks 3 . 4 . 5 can also be outsourced (eg cloud service). A desired execution order can be graphically eg as in 2 being represented. Through the cryptographic safeguards 2a . 3a . 4a . 5a . 9a it is achieved that a different execution order is not possible, because otherwise required keys are the components involved 2 . 3 . 4 . 5 . 9 not available. Compared to the in 1 state of the art require database 908 and the execution engine 907 no access to the keys. The message 11 This is done, for example, for each handover to and from a check engine into a cryptographically protected message container 2 B . 3b . 4b . 5b packed.

In preferred embodiments, each of the cryptographic protections includes 3a . 4a . 5a a cryptographic encryption of the data 11 . 12 by means of a test engine comprising the test and / or the respective cryptographic protection measure 2 . 3 . 4 dependent cryptographic key k1, k2, k3, k4, as determined by 3 executed in more detail.

• – Die Daten 11 werden von der Eingabestufe 2 empfangen und von dieser mit dem Schlüssel k1 der ersten erforderlichen Prüfung verschlüsselt;
• – Jede der als Zwischenstufen ausgebildeten Prüf-Engines 3, 4, 5 führt Entschlüsselung, Prüfung, Verschlüsselung durch;
• – Für jede Weitergabe zwischen zwei Stufen (und von der Eingabestufe 2 und zu der Ausgabestufe 9) wird ein separater Schlüssel k1, k2, k3, k4 verwendet;
• – Die beteiligten Prüf-Engines 3, 4, 5 verfügen über den entsprechenden Schlüssel k1, k2, k3, k4, beispielsweise voreingerichtet, oder bekommen ihn über ein Nachrichtentypspezifisches Key Management bereitgestellt;
• – Die letzte erforderliche Prüf-Engine 5 entschlüsselt die bei ihr eingehenden Daten 12 und leitet diese an die Ausgabestufe 9 als Klartext oder verschlüsselt mit einem Schlüssel k4 der Ausgabestufe weiter.

3 shows a sub-variant of the embodiment of 2 with symmetric encryption, eg AES, as a protective measure. In 3 therefore become the cryptographic safeguards 3a . 3b . 3c further specified. The cryptographic protection measure 3a comprises means for decrypting incoming messages with the key k1 and for encrypting outgoing messages with the key k2. The cryptographic protection measure 4a comprises means for decrypting incoming messages with the key k2 and for encrypting outgoing messages with the key k3. The cryptographic protection measure 5 comprises means for decrypting incoming messages with the key k3 and for encrypting outgoing messages with the key k4. The method and the key distribution are performed according to the following processing steps, for example:

• - The data 11 be from the input level 2 received and encrypted by this with the key k1 of the first required test;
• - Each of the test engines designed as intermediate stages 3 . 4 . 5 performs decryption, testing, encryption;
• - For each transfer between two levels (and from the input level 2 and to the output stage 9 ) a separate key k1, k2, k3, k4 is used;
• - The involved test engines 3 . 4 . 5 have the corresponding key k1, k2, k3, k4, for example pre-established, or provided via message type-specific key management;
• - The last required test engine 5 decrypts the incoming data 12 and forwards them to the output stage 9 as plain text or encrypted with a key k4 of the output level.

Thus, the data becomes a required test 11 . 12 decrypted by the dependent of the required test key k1, k2, k3, and encrypted after performing the required test by means of a dependent of a second required test key k2, k3, k4.

Instead of the AES encryption method, other encryption methods may be used. Thus, for example, an encryption with another symmetric encryption algorithm such as IDEA, MISTY, PRESENT, 3DES or an asymmetric encryption method such as RSA or ECC, eg according to the Standard PKCS # 7 or the Standard "XML Encryption Syntax and Processing" respectively.

According to another variant, the system comprises 1 an encryption means configured and / or adapted after receiving the data 11 at the input level 2 the data 11 to encrypt and divide the cryptographic key used in a secret sharing scheme in several shares between the at least two test engines and the at least two test engines 3 . 4 . 5 to provide the respective share. Each of the at least two test engines 3 . 4 . 5 is adapted, a share of the output level allocated to it 9 only if the respective required test has been carried out.

A message is thus from the input level 2 encrypted. Preferably, a message-specific key is determined. The key used is divided into several shares sh1, sh2, ... according to a secret sharing scheme. The output level is only the encrypted message, ie the encrypted data 11 . 12 , The exam engines each know a share sh (n) provided to them, for example, by the ingress level or a separate key management level. If the reviewed message is considered legal by any of the review engines, the associated secret share sh (n) is provided by the review engine. Only if all audit engines provide their share can the message be from the output stage, preferably configured as an input-output stage 9 be decrypted. The input stage, which is also designed as an input-output stage 2 Encrypts the input message 11 , The key used is divided into several shares sh1, sh2, ..., which are provided to the test stages.

It has output level 9 only access to the encrypted data 11 . 12 , The checks can access the plain text data or encrypted data. Here a common key of the tests could be used or alternatively a test-dependent key. For a received message, therefore, there are two differently encrypted data in one variant. A message is encrypted once according to the secret sharing procedure. This so encrypted message becomes the output stage 9 provided. Additionally, the message is keyed with a test engine 3 . 4 . 5 Encrypted, so the testing engines 3 . 4 . 5 can decrypt the encrypted message for a check of the message. For this purpose, in one variant, a common key can be used, which all test Engines 3 . 4 . 5 or the group of audit engines intended to audit this message 3 . 4 . 5 is present.

It may be a key of the first testing engine in another variant 3 which, as described above, decrypts the message and after successful checking, the message with a key of the second check engine 4 encrypted. Accordingly, the second testing engine would 4 decrypt the message, check it and after successful verification with a key of the third test engine 5 encrypt. In the variant described here, the first and second check engine would 3 . 4 only if the exam is successful, will each continue to receive its respective share of the issue level 9 provide. This ensures that the output level 9 The encrypted data can only be decrypted when used by all test engines 3 . 4 . 5 the respective share has been provided and thus can decrypt the message.

According to further preferred embodiments, by means of a multi-signature cryptographic construction with a multi-signature verification certificate, it is ensured that a valid signature is present at the output stage 9 is only present when each of the required tests has been carried out. It is proposed to use a cryptographic multisignature construction. A valid signature is only available if each of the required test engines 3 . 4 . 5 carried out their calculation.

The multisignatures result in a cryptographic confirmation of the processing, quasi a group signature of the trained as a content scanner test engines. The well-known alternative is summarizing the individual signatures of the Content Scanner. However, this has the disadvantage that it can be seen from the individual signatures, how many and possibly also which scanners were used, is visible to the outside. According to preferred embodiments of the invention, a valid digital signature is only present in a cryptographic multi-signature method if all required parties have calculated and provided their partial signature. If only one of the check engines did not create its partial signature, then there is no valid signature. This criterion is of the output stage 9 clearly and with high reliability testable. If, on the other hand, only several individual signatures are checked, then on the one hand the checking effort is required by the output stage 9 because it needs to verify its signature for each required verification engine. On the other hand there is the possibility of a misconfiguration or malfunction of the output stage 9 where data is being provided, although only a few, but not all, of the test engines required have successfully verified the data. These variants of the invention ensure that there is no valid signature. This eliminates the need for the output stage 9 Corresponding error-prone checks which checks are required.

The decryption is done by an output function of the output stage 9 , This is possible only because of the properties of cryptographic encryption methods when the output stage 9 the encrypted message and the associated decryption key are present or if a correctly signed message is present. According to preferred embodiments, in a solution using a secret sharing signature scheme, the verification engines supplement a secret-sharing signature information. Only if all necessary shares are present, then lies at the output stage 9 the message with a valid signature.

According to preferred embodiments, the permissible data flow is not achieved rigidly by physical devices (data diode) and a fixed arrangement of test components (content checking of the data), but by logical measures. As a result, the implementation cost is lower and it can be flexible different types the tests or new data formats and protocols are supported. Data can be eg a file, an XML document, an object, for example Corba, Java RMI, DCOM, or a SOAP message. The actual processing of required checks during a data transfer between two security zones is ensured by cryptographic protection measures with high reliability. Even in the case of a malfunction in which a required check does not take place, inadmissible data traffic is prevented by cryptographic measures, since a successful decryption or successful signature check at the output stage is not technically possible.

In accordance with preferred embodiments, this ensures that cryptographic safeguards ensure that a predefinable set of checks has actually been carried out before, for example, forwarding a document to another security zone. That that a required message processing schedule has actually been processed before a message is forwarded. In particular, the direction-dependent processing is ensured. In particular, in a variant, a specific sequence of checks can be forced.

According to preferred embodiments, this is achieved by defining a "workflow", which processing steps are to be carried out before the forwarding of a message. The message is forwarded between two processing steps, where it is protected by a processing step dependent cryptographic key. In addition to the dependence on a processing step, the next processing step can also be included. This can be achieved that processing steps can not be skipped.

According to further preferred embodiments, for different types of data at the input stage 2 and / or the output stage 9 a classification of the message is made and depending on a number of required tests are determined message-specific.

According to preferred embodiments, after receiving the data 11 at the input level 2 of the gateway 1 determine which required checks of the data are to be made, preferably depending on the type of data 11 and / or depending on an operating state of a system of the first security zone 98 and / or the second security zone 99 , An operating state of a system of the first security zone 98 can describe, for example, whether a maintenance mode or a regular operating mode exists.

According to preferred embodiments, after receiving the data 11 at the input level 2 of the gateway 1 Determines the order in which the required checks are to be performed, preferably by providing the data in a given workflow to the check engines 3 . 4 . 5 go through and / or preferably depending on the type of data 11 and / or depending on an operating state of a system of the first security zone 98 and / or the second security zone 99 ,

4 shows variants of the embodiments of 2 and 3 in accordance with preferred embodiments of the invention, which enable optimization of the message-specific audit workflow. In order to achieve high flexibility, the incoming data 11 at the input level 2 classified. Depending on this, a test workflow is determined. For this purpose, a workflow information is generated, which describes which tests or which test engines 3 . 4 . 5 for the information 11 to go through. The check workflow is preferably protected with a cryptographic checksum, for example a digital signature or a message authentication code. About a hash value of the information 11 that is encompassed by the cryptographic checksum may have a non-manipulatable binding to the information 11 getting produced.

The information 11 becomes a message container together with the assigned check workflow pwf 2 B . 3b . 4b . 5b packed. The individual test units 3 . 4 . 5 add in the 3b . 4b . 5b one confirmation after successful examination 3d . 4d . 5d in the form of an attestation protected by a cryptographic checksum. An attestation can also confirm the negative test result. This makes it possible to distinguish between a missing test and a test with a negative test result.

The output stage serving as an output component 9 directs the information 11 . 12 only continue if in the message container of a message m all tests specified in the check workflow are confirmed as successful.

The described method of protecting the workflow when passing through a security zone between two zones of different security levels can also generally be transferred to general workflows, eg in the manufacturing industry or in business processes. In this case, an object to be processed can be assigned a "pass-through plan" by a production method described above. This is particularly advantageous if not only one manufacturer is involved in the production, but different production steps at different manufacturers have to go through. The method described here also ensures the complete run through the production and the order of the processing steps. The same applies to workflows in IT systems in which, for example, documents must be released.

The actual processing of required checks for a data transfer between two security zones is ensured by cryptographic safeguards 3a . 4a . 5a guaranteed. As a result, a highly trustworthy realization of a cross-domain security solution can take place in which it is ensured by logical measures instead of inflexible, expensive hardware measures that a data transfer only takes place as far as all required test stages have been completed.

The advantage of the described methods and system is the ability to verifiably go through a fixed set of content scanners. In addition, the order of application of the content scanner can also be specified.

In addition to the order, the flow direction (workflow) for the arrangement can also be specified. This allows the use of the system 1 for the direction-specific processing of messages (incoming and outgoing).

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2012226917 A1 [0003]
• DE 102006036111 B3 [0007]
• US 2012/0226914 A1 [0008]
• US 2012/0226917 A1 [0009]
• WO 2012/170485 A1 [0010]

Cited non-patent literature

• http://charlotte.ucsd.edu/~mihir/papers/id-multisignatures.pdf [0013]
• http://www.informatica.si/PDF/34-4/12_Shao-Multisignature%20Scheme%20Based%20on%20Discrete%20Logarith.pdf [0013]
• http://en.wikipedia.org/wiki/Source_Routing [0014]
• ISO / IEC62443 [0017]
• Standard PKCS # 7 [0042]
• Standard "XML Encryption Syntax and Processing" [0042]

Claims (16)

Method for exchanging data ( 11 . 12 ) between a first security zone ( 98 ) and a second security zone ( 99 ), comprising the method steps: - receiving data ( 11 ) from the first security zone ( 98 ) at an input stage ( 2 ) of a gateway ( 1 ); Performing a process involving different required checks of the data ( 11 ); - each processing of each of the required tests being carried out by a cryptographic protective measure ( 3a . 4a . 5a ) by using the cryptographic safeguards ( 3a . 4a . 5a ) ensures that an output level ( 9 ) of the gateway ( 1 ) the data ( 11 ) or data derived from the data ( 12 ) not for the second security zone ( 99 ) readable if at least one of the required tests has not been carried out. The method of claim 1, wherein the required checks are each performed by a different check engine ( 3 . 4 . 5 ), preferably the test engines ( 3 . 4 . 5 ) are logical test engines. Method according to claim 1 or 2, wherein after receiving the data ( 11 ) at the input level ( 2 ) of the gateway ( 1 ), which required checks of the data are to be made, preferably depending on the type of data ( 11 ) and / or depending on an operating state of a system of the first security zone ( 98 ) and / or the second security zone ( 99 ). Method according to one of the preceding claims, wherein after receiving the data ( 11 ) at the input level ( 2 ) of the gateway ( 1 ) determines the order in which the necessary tests are to be carried out, preferably by 11 ) and / or from the data ( 11 ) derived data in a given workflow the test engines ( 3 . 4 . 5 ) and / or - preferably depending on the type of data ( 11 ) and / or - depending on an operating state of a system of the first security zone ( 98 ) and / or the second security zone ( 99 ). Method according to one of the preceding claims, wherein the cryptographic protective measure ( 3a . 4a . 5a ) a preferably symmetric cryptographic encryption of the data ( 11 ) and / or from the data ( 11 ) comprises data derived by means of a cryptographic key dependent on a required check (k1, k2, k3, k4). Method according to claim 5, wherein for a required test the data ( 11 ) and / or the derived data are decrypted by means of the key (k1, k2, k3) dependent on the required check and encrypted after carrying out the required check by means of a key (k2, k3, k4) dependent on a second required check. Method according to one of the preceding claims, wherein after receiving the data ( 11 ) at the input level ( 2 ) the data ( 11 ) and the cryptographic key used is divided into the required checks according to a secret sharing scheme in several shares, and each of the required checks assigns the issuing stage shares ( 9 ) for the decryption of the encrypted data ( 11 ) only if the respective required test has failed successfully.  Method according to one of the preceding claims, wherein it is ensured by means of a cryptographic multisignature construction that a valid signature is present at the output stage only when each of the required tests has been carried out. Method according to one of the preceding claims, wherein the gateway ( 1 ) carries out all necessary tests itself; or where some of the required checks by the gateway ( 1 ) while another part of the tests is being outsourced; or where all required tests are outsourced. System ( 1 ) to exchange data ( 11 . 12 ) between a first security zone ( 98 ) and a second security zone ( 99 ), comprising: an input stage ( 2 ) by means of which data ( 11 ) from the first security zone ( 98 ) are receivable; An output stage ( 9 ) by means of which the data ( 11 ) or from the data ( 11 ) derived data ( 12 ) for the second security zone ( 99 ) are available; - at least two test engines ( 3 . 4 . 5 ) on each of which a different required verification of the data ( 11 ) is feasible; - each of the at least two test engines ( 3 . 4 . 5 ) a cryptographic protection measure ( 3a . 4a . 5a ), by means of which it can be ensured in each case that the output stage ( 9 ) the data ( 11 ) or the derived data ( 12 ) not for the second security zone ( 99 ) readable if at least one of the at least two required tests has not been carried out. System ( 1 ) according to claim 10, wherein the at least two test engines ( 3 . 4 . 5 ) are logical test engines. System ( 1 ) according to one of claims 10 or 11, comprising a fixing means ( 21 ) which is designed and / or adapted depending on the type of data ( 11 ) determine which examinations are required and / or determine the order in which the required examinations should be performed and / or establish a workflow according to which the data should be passed to the at least two test engines ( 3 . 4 . 5 ) run through. System ( 1 ) according to one of claims 10 to 12, wherein the cryptographic protective measure ( 3a . 4a . 5a ) a cryptographic encryption of the data ( 11 ) and / or from the data ( 11 ) derived data by means of which the respective cryptographic protection measure ( 3a . 4a . 5a ) comprehensive test engine ( 3 . 4 . 5 ) dependent cryptographic key (k1, k2, k3, k4), and wherein the encryption is preferably symmetric. System ( 1 ) according to one of claims 10 to 13, comprising an encryption means, which is designed and / or adapted, after receiving the data at the input stage, the data ( 11 ) and to divide the cryptographic key used in a secret sharing scheme into several shares between the at least two check engines and the at least two check engines ( 3 . 4 . 5 ) provide the respective share, and wherein each of the at least two check engines ( 3 . 4 . 5 ) is adapted, a share of the output stage ( 9 ) only if the required test has been carried out. System ( 1 ) according to one of Claims 10 to 14, it being possible by means of a cryptographic multisignature construction to ensure that a valid signature at the output stage ( 9 ) is only present when each of the required tests has been carried out. System ( 1 ) according to any one of claims 10 to 15, wherein the system ( 1 ) is a gateway.

Images