DE19703970A1 - Arrangement for detecting data and communicating it in authentic form - Google Patents

Abstract

the arrangement has a data acquisition device, a first identification unit, which acquires user-specific information, a data encoding unit which transforms the data into the authentic form depending on the user-specific data and a data communications unit. The data acquisition device, the first identification unit, the data encoding unit and the data communications unit form a unit, which performs program instructions stored on a read-only memory.

Description

Background of the Invention

The present invention relates to the acquisition and transmission of data. More accurate The present invention relates to a data acquisition device, the data according to their Capture or input to another data processing device in an authentic Form. The authentic form is intended to draw a clear conclusion enable those users of the data acquisition device who after implementation Appropriate security or control measures released the transmission of the data Has. In addition, the authentic form can also be used to check this open up whether the data is transferred to another data processing device have been tampered with. The present invention also relates to a  Method for controlling a data acquisition device according to the invention, in particular also in its interaction with another data processing device.

Field of application of the invention

An important application of data processing devices or computers is that Transmission of data to other computers. Can be submitted together switched networks such as local area networks (LAN) or wide area networks (WAN) such as B. the Internet can be used. However, mobile is also becoming increasingly widespread Data communication. The data to be transmitted can be recorded directly in a data be entered or captured by this device, but they can also be from external devices such as B. peripherals, video cameras, scanners and the like be recorded.

Often, the use of the data acquisition device should only authorize this Be possible for users. Alternatively, however, it is often also necessary that the other computers can determine which user is submitting the data has been authorized. This is particularly necessary if the to be transmitted serve the data for the conclusion or execution of a transaction and therefore should be legally binding, or if the data should serve as evidence.

In addition, data is often transmitted that can be accessed or manipulated unauthorized third parties should not be accessible. Only if the other computer can determine that the data has not been manipulated during the transmission, is the authenticity or credibility of the data from the other computer are guaranteed.

State of the art

The user's access authorization is usually checked for these purposes and / or the data to be transmitted are encrypted.  

FIG. 9 shows a computer as it is used for data acquisition and data transmission in the prior art, an access control being provided so that the computer can only be used by those authorized to do so.

A computer ( 901 ) with a monitor ( 902 ) and keyboard ( 903 ) is shown. A processor card ( 904 ) is used to execute program instructions . Data that are entered via the keyboard or selected by the mouse are transmitted to the processor card ( 904 ) and from there passed on to application programs which are also operated on this processor card or on other PC cards.

Consider the case that the computer communicates with another computer over the communication path ( 905 ). So that the transmission of the data is not released or authorized by unauthorized persons, an access control system can be used. B. a magnetic stripe reader ( 906 ), which retrieves data stored on a storage medium ( 907 ) and, if necessary, with further user-specific data, such as. B. compares a personal identification number (PIN) or a transaction number (TAN). If the identification of the user was successful, the use of the computer is released for the user determined to be authorized to do so.

So that data traffic on the transmission path ( 905 ) cannot be overheard and / or manipulated by unauthorized third parties, encryption methods are usually used. Symmetrical or asymmetrical encryption methods are common. To encrypt the data, a specially designed encryption chip or crypto chip is often used, which is either located directly on the processor card ( 904 ) or at another location in the housing of the computer.

In combination with the access control described above, the computer can be operated in one Normal mode of operation in which the data is transmitted unencrypted be, or in an encryption mode in which the data before  Transmission will be encrypted.

If there is an access control, it is agreed with conventional systems that the transmission of the data has only been authorized by the person authorized to do so. A such an agreement is sufficient for certain data security concerns.

Disadvantages from the prior art

A disadvantage of the procedure described is that encryption is usually switched on and off dynamically. This means that too transmitting data at certain times during the described procedure wise in unencrypted form and only in a final step the transmission is encrypted. This provides a point of attack for the unwanted Manipulations. This applies in particular to the data that a user uses an application program, possibly including a menu selection in a data acquisition input device and then to a connected computer for the purpose of Transmission to another computer. Because the data too certain times are available unencrypted, such as B. during the transfer from Data acquisition device to the computer, they can be deciphered without major prior expenses are manipulated.

As long as it is not ensured that none within the data acquisition device Manipulation of the data to be transmitted can take place, or as long as the user The data to be transmitted cannot be checked again before it is transmitted ensure that the data that the other computer after transmission and, if decrypted, actually receives that from the user represent authorized data.

Another reason for the existing uncertainty is that the data acquisition device is on can be unsure. For example, because an unauthorized person has lost the hardware - invisible from the outside - can manipulate, or because in the software or that  Operating system viruses, worms or other means of manipulation are introduced can.

This uncertainty is increased because the networking of computers is common has become. Often computers are not only among themselves in local networks (LAN) e.g. B. networked a company but increasingly have either Workstation computers (clients) themselves or servers of such networks via one connection to insecure networks such as B. the Internet. In principle, this opens up the possibility that unauthorized persons either directly manipulate data in such networks can or by manipulating agents such as viruses or the like into important Parts of the program can be introduced, which in turn are unauthorized Make manipulations.

Another disadvantage is that detection of this and similar manipulations of the Data after its transmission is not possible with existing systems. The disadvantage is in particular, that reliable proof of the authenticity or authenticity of the data is not is guaranteed.

Another disadvantage is that data that is entered into data acquisition devices and / or detected by these and / or transmitted by these to other data processing devices are not used as a legally binding basis for the conclusion or implementation of Shops of any kind can be used.

Objects of the invention

An object of the present invention is to find a method that can enables changes or manipulations of recorded and transmitted Review data as early as possible in its creation or composition process point.

Another object of the present invention is to ensure security in detection,  Increase input and transmission of data. Another object of this invention is to find a method that allows data stored in a Data acquisition device entered and / or detected by and / or from this other data processing devices are transmitted as clearly as possible to the person can be assigned, which authorizes the use of the data acquisition device was and / or authorized the transmission of the data.

Another object of the present invention is to provide a data acquisition device to propose that is designed to carry out the aforementioned methods. In particular, a suitable procedure for recording and / or input is also intended and for the transmission of data by a data acquisition device according to the invention being found.

Another object of the present invention is that data generated by a Data acquisition device detected, entered into this and / or from this to other data processing devices have been transmitted as a legally binding basis for Conclusion, to conduct etc. of business can be used.

Another object of the present invention is to enable that only authentic data leaving a data acquisition device.

Solution of the tasks

The above objects are achieved by a device according to the main claim as well as the subordinate device claims as well as by a system according to the Supplementary claim 26 solved. The inventive method for solving the above Problems are claimed in independent claim 27. More appropriate execution Form the inventive method or data acquisition device for acquisition of data and their transmission in an authentic form are supported by the sub claims defined.  

Advantages of the invention

According to the invention, a data acquisition device is proposed which consists of only one Data acquisition unit, from an identification unit, from a data encryption unit and a data transmission unit. By reducing the assemblies on their absolute Miniinum is the number of vulnerabilities or possible Points of attack for manipulation of the captured data reduced. Preferably these modules are in a mechanically stable and protected housing, so that advantageously manipulation of the hardware of the data acquisition device is prevented.

The data acquisition device according to the invention only executes such program instructions which are on a read-only memory or ROM within the housing of the Data acquisition device. Because this is in its preferred embodiment does not have its own direct access memory or RAM advantageously manipulation of the device software by viruses, worms or other means of manipulation prevented.

Another idea on which the invention is based is that which is detected and to be transmitted Fix data as early as possible or in an authentic data representation transform. In a preferred embodiment, such as. B. when entering Data into a computer keyboard, the data is already inside the keyboard encrypted, transformed into an authentic representation and in this representation transmitted a connected computer. This advantageously prevents the Possibility that the data during its transmission via the connecting cable between the data acquisition device and another computer, or at the preferred one Embodiment between the computer keyboard and the computer, overheard and be manipulated.

Both the method according to the invention and the device according to the invention encrypt the data using a standard encryption before it is transmitted  selection procedure. Both asymmetrical encryption methods and symmetrical encryption methods can also be used. By going to Encryption custom keys are used is advantageous a clear identification of the user authorizing the transmission is possible. The prerequisite for this is that the identity or authorization of the user is sufficient is carefully checked. To identify the user are preferred biometric, password, shared-secret schemes used, one preferred embodiment, however, uses a smart card, which preferably includes a cryptography chip that is used to encrypt and transform the Data can be used in an authentic representation. This identification Processes are mentioned and described in the description section from the prior art well known and therefore need not be explained in more detail.

Symmetrical or asymmetrical encryption methods are state of the art Technology is well known and therefore need not be explained in more detail.

According to the present invention, the integrity or integrity of the transmitted data guaranteed by cryptographic test values or seals, with whose help modifications of the transmitted data can be determined. For this a preferred embodiment uses digital signatures usual asymmetric key. Another embodiment uses, however for this purpose symmetrical encryption methods.

Preferred signature methods are the usual digital signature algorithms (DSA), El- Gamal signature procedure, Fiat-Shamir protocols, RSA procedure or Rivest-Shamir- Adleman method and Schnorr method. When using symmetrical locks selection method, the embodiment according to the invention preferably uses one Block cipher method in CBC mode or in CFB mode. These procedures, methods and protocols are well known in the art and need therefore not be explained in more detail.  

In a preferred method, at least the keys used by one secure authority or secure-key-issuing-authority (SKIA).

Due to the use of such encryption and signature methods, the Recipients of data advantageously proof of unauthorized manipulation of the transmitted data possible.

Because the preferred embodiment of the invention - depending on those to be followed Security standards - carries out more or less complex test steps in which the Identity and / or authorization of the user is checked in connection with the above encryption method and / or digital signature method advantageous high security standard in the transmission of data guaranteed. Due to the special design of the data acquisition device according to the invention A high level of security in data acquisition is advantageously ensured.

By encrypting the data using a user-specific key and / or be provided with a digital signature, and thus the data in a preferred The embodiment can only be transmitted in an authentic representation transmitted data from the recipient advantageously as legally binding data for Doing any kind of business. Under an authentic In the following, data representation should always be understood to mean a data representation that one other computer enables to determine from which user the transmitted data have been authorized for transmission.

The present invention will be more specifically described in the following detailed Description and reference to the accompanying figures can be understood. Here further tasks and advantages as well as characteristics become apparent. The attached Figures referred to in the description represent some preferred ones Embodiments of the invention. Neither the description nor the figures however, not to be interpreted to mean that the invention is specific to these Embodiments would be limited.

Figure overview

Fig. 1 shows a first embodiment of the data recording apparatus of the present invention, which transmits the data directly to another computer.

Fig. 2 shows a further embodiment of the data acquisition device according to the invention, which comprises a unit for handling a chip card with an integrated crypto chip.

Fig. 3 is a flowchart showing a simple operation of the data acquisition device according to the Invention.

Fig. 4 shows a state transition diagram of the data acquisition device according to the invention.

Fig. 5 shows a preferred embodiment of the data acquisition device according to the invention, which is connected to a computer via which the transmission to the other computer takes place.

Fig. 6 is a flow chart associated with a preferred embodiment of Fig. 5.

Fig. 7 shows a further embodiment of the data acquisition device according to the invention, which enables feedback between the connected computer and the data acquisition device.

Fig. 8 is a flow chart associated with the embodiment of Fig. 7; and

FIG. 9 shows a computer as it is used for data acquisition and transmission in the prior art, an access control being provided so that the computer can only be used by those authorized to do so.

Special description part

Fig. 1 shows a first embodiment of a data capture apparatus according to the present invention. In its simplest basic form, this data acquisition device comprises a data acquisition unit ( 101 ), a first identification unit ( 102 ), a data encryption unit ( 103 ) and a data transmission unit ( 104 ) which transmits the data to another computer (AR, 106 ).

In order to increase security, according to the invention, all essentials are as possible Components of the data acquisition device in a mechanically stable and secured Housing housed. Security against viruses and other data manipulation To ensure means, the data acquisition device according to the invention preferably performs only program instructions that are stored in a read-only memory (ROM) within the Housing. By the data acquisition device preferably not having its own Read-write memory (RAM) has manipulation means for manipulation the program instructions not in the data acquisition device or in its processor fix in order to manipulate its execution.

The data acquisition unit ( 101 ) is used for data acquisition. In one embodiment, this is a conventional data entry keyboard. In order to increase the performance of the data acquisition device, however, more complex data input and data acquisition methods can also be used according to the invention, such as the acquisition of moving images or still images with the aid of a video camera, the scanning of documents with the aid of a scanner, the acquired optical information additionally can be preprocessed with the aid of filtering or optical letter recognition processes (OCR), or the acquisition of acoustic information, including speech recognition systems, in order to reduce the information content of the recorded data. To ensure data security, however, the program instructions are preferably stored in a read-only memory (ROM), which is located within the housing of the data acquisition device ( 100 ).

For the purpose of data acquisition, a correspondingly designed peripheral device (PG, 107 ) can also be connected to the data acquisition device.

For the encryption and transformation of the data into an authentic data representation, the embodiment depicted in FIG. 1 uses a data processor that processes special cryptographic program instructions. However, this data processor can also be a commercially available, specially designed cryptography processor, which saves computing time and thus increases the data transmission rate.

After the data have been encrypted in the cryptography processor ( 103 ), the data are transmitted to the other computer using a conventional data transmission unit using conventional data transmission protocols.

In order to ascertain the identity of the user, the data acquisition device has a first identification unit ( 102 ), which, as shown in FIG. 1, is preferably a device for handling commercially available smart cards or chip cards ( 108 ). Such chip cards, which are well known from the prior art, have at least an integrated read-only memory ( 109 ), but in most cases also a processor ( 109 ), so that simple program instructions can also be processed directly by the chip card , the program instructions required for this being either in the ROM of the data acquisition device or, preferably, in the read-only memory ( 109 ) of the chip card ( 108 ) itself.

In other applications in which, for example, the image data of a surveillance Video camera or a scanned text document transmitted in an authentic form However, a simple keyboard is often sufficient, using the User password, encryption key and the like upon request by the Identification unit can be entered. Even the above data Acquisition methods can be used individually or in combination to identify users identity used. The effort involved in determining user identity depends on the security standard that the system is to guarantee.  

To display entered or acquired data, the data acquisition device has a display device ( 110 ), which is preferably designed as an LCD screen or as a touch-sensitive screen, so that the use of an additional keyboard as a data acquisition unit is not necessary.

The data transmission with the other computer (AR, 106 ) takes place in a one-way mode of operation ( 111 ) or in a two-way mode of operation ( 112 ) via a data line which is part of a computer network such as a local area network (LAN) or a wide area network (WAN) or the Internet is. Usual data transfer protocols are used, such as Ethernet, Local Talk, FTP (file transfer protocol) or the like, which are sufficiently known from the prior art and therefore do not need to be explained in detail here. In another embodiment, the data is transmitted via wireless telecommunications in a customary data format. Another proposed type of data transmission is the storage of the data on a magnetic or optical data storage medium and the transfer of this data storage medium to the other computer.

Fig. 2 shows a further embodiment of the data acquisition device according to the invention, which comprises a unit for handling a chip card with an integrated crypto chip.

If this figure contains the same reference numerals as in Fig. 1, this also means the same units. In contrast to the embodiment according to FIG. 1, however, this data acquisition device does not contain its own crypto or encryption processor.

Rather, the chip card ( 208 ) to be inserted by a user is used for encryption and, in addition to a read-only memory (ROM) which contains user-specific data, also comprises an encryption processor ( 209 ). In addition, a conventional processor for carrying out the method according to the invention described below can also be located on this chip card.

All data that have been acquired by the data acquisition unit or by the peripheral device (PG) are transmitted via a central bus ( 213 ) to the processor or the encryption processor of the chip card. After encryption or transformation into an authentic representation, the data arrive at the transmission unit, which then transmits them to the other computer as described above.

Fig. 3 is a flow chart showing a simple operation of the data acquisition device according to the invention.

Before the data is entered or recorded or at least before it is transmitted to the computer connected to the data acquisition device, the identity of the user is checked ( 302 ).

Depending on the information content of the data acquisition device User-specific data can be done in different ways will.

In an embodiment that has no or only very limited user-specific Comparative or reference data are available to the data acquisition device a fixed public key is made available by the other computer as soon as the data acquisition device determines that a user is transmitting data requests. The data acquisition device then prompts the user to Enter identification data. In the simplest case, it can be Personal identification numbers (PIN) and / or transaction numbers (TAN) or other alphanumeric strings act on a data keyboard or to be entered via the data acquisition unit of the data acquisition device.

For higher security requirements, however, a greater information content is the Identification data an advantage. In a preferred embodiment, the Present invention uses a chip card, the user-specific data with compared alphanumeric character combinations to be entered by the user  will.

In a further preferred embodiment, as Identification data collected biometric data from physical characteristics and / or Properties of the user are derived. This is a or several fingerprints that are captured by a fingerprint scanner, or a scanner for scanning the retina or the fundus of the eye User, or a language analyzer that determines a language profile of the user. By comparing this biometric data with user-specific data, the Identity of the user can be determined very reliably. This comparison can be both in the data acquisition device itself or its chip card reader or in other calculator. In the latter case, the recorded identification data or the biometric data is encrypted using the public key and sent to the transmitted to other computers.

The other computer decrypts the incoming data using the associated secret key and compares the incoming identification data with user-specific reference data, which are taken from a database, for example. After a successful comparison, the data acquisition device changes into its authentic operating state. In this operating state, all data that leave the data acquisition device are only transmitted in encrypted form and after a digital signature ( 304 , 305 ). Optionally, it can be checked whether there is a malfunction ( 305 ), whereupon the data acquisition device returns to its plain text operating state in which the data are only transmitted unencrypted ( 303 ).

To encrypt the data, the data acquisition device must be on from the other computer user-specific public key. All to be submitted Data is encrypted with this key and with a digital signature Mistake.  

The transmitted data can thus be clearly assigned to an authorized user and because the data is transmitted with a digital signature have been provided, an unauthorized manipulation of the data during the Transmission to the other computer can be discovered.

In another preferred embodiment, the data acquisition device is available Verification of user identity more extensive user-specific reference data for Available, for example, because the user before collecting further identification data must insert a chip card into the chip card reader of the data acquisition device. The User-specific data stored in the ROM of the chip card leave a "zero knowledge "evidence of user identity, that is, evidence that the Data acquisition device does not require additional user-specific reference data, that have to be made available to him by the other computer. For Verification of the user identity, the recorded identification data and the user-specific reference data directly from the chip card reader or in Processor of the chip card compared.

If this check is successful, the encryption unit ( 304 ) of the data acquisition device according to FIG. 1 is given the user-specific public key (PK). In the case of a data acquisition device shown in FIG. 2 does not have the public key provided to further units of the data processing apparatus passed as long as it is operated only in a one-way mode of operation in which the data acquisition device data that are encrypted in the crypto chip of the smart card only at the transmitted to another computer. This further increases the security of the data acquisition device.

However, the data acquisition device should also be in a two-way mode of operation be operated in which the data acquisition device with the user-specific secret key encrypted instructions or data from the other computer to use, the encryption or decryption unit of the data acquisition device the user-specific public key that is on the chip card,  be handed over.

If the check of the user identity in step 302 was unsuccessful, the data acquisition device remains in the plain text operating state, so that the transmission of the data to the other computer is only carried out unencrypted.

Fig. 4 shows a state transition diagram of the data acquisition device according to the invention. Here, the example is considered that a bank customer wants to transmit data to a computer. In this example, computer is understood to mean the access computer of a bank, which is connected to the data acquisition device according to the invention via a data line. The data acquisition device could be an automated teller machine or a system for carrying out telebanking.

The data acquisition device used for this purpose has as Data acquisition unit via a conventional keyboard and as a first identification unit a smart card reader. In addition, there is a screen to display the data for which This example uses simple alphanumeric characters such as customer name, Bank account number or sort code. The bank customer has one Chip card that contains at least user-specific data, so that the chip card reader can perform zero-knowledge proof of user identity. The chip card can additionally also the private key (SK) and / or the public key (PK) included, which is used as the basis for an asymmetrical encryption method can be.

As long as the customer has not inserted the chip card ( 401 ), the data entered by the customer is transmitted unencrypted ( 402 ) from the data acquisition device to the other computer, as indicated by the loop at ( 402 ). This data traffic can easily be overheard by unauthorized persons and manipulated to its advantage. If the user now inserts the card ( 403 ), the user identity ( 404 ) is first checked and, if necessary, the validity of the chip card is also checked. If the result of this check ( 405 ) is negative, the card is ejected and the data acquisition device resumes its plain text operation.

If the result of the check is positive, the data acquisition device switches over to authentic operation ( 407 ), in which all the data leaving the data acquisition device are only transmitted in an authentic data representation. Because the authentic data can be used by the other computer to determine whether the data has been manipulated during the transmission, the data transmitted in this way can be regarded as genuine.

If the data acquisition device connects directly to the bank's access computer communicates, the data acquisition device needs one for encryption public key (PK). This can be from the chip card to the data acquisition device Will be provided. However, it can also be used by the data acquisition device Bank calculator will be made available after this from the positive Verification of user identity has been notified.

As long as there is no malfunction, the data is only transmitted to the computer in authentic form. However, if there is a malfunction ( 409 ), such as an interruption in communication, or if the bank customer ends the communication, the chip card is ejected and the computer returns to its plain text mode of operation.

Fig. 5 shows a preferred embodiment of the data acquisition device according to the invention.

Often, sensitive data requires that data that a user has about a Keyboard or enter data in one of the ways mentioned above unit were detected, transmitted to another computer via a computer should be. A typical application could be to make a transfer from PC of a bank customer who is connected via a data connection such as B. the Internet with is connected to the access computer of a bank. Another preferred application is  the authentic transmission of images and / or sound data from a PC or client within a computer network to another PC that is a client or server can be. This computer network could be the Internet or an intranet Company.

In the case of sensitive data, the other computer should be able to determine a) from which user of the computer the data transfer has been authorized and / or b) whether the data has been manipulated during the transmission. This is a Transmission of the data in an authentic format is required.

However, because the computer ( 500 ) is externally accessible via the network ( 504 ) and has a manipulable memory area, the user of the computer could authorize the transmission of data A and this inside the computer in data B from a virus or the like be converted without the user noticing. This problem can be solved by a data acquisition device according to the invention which is connected to the insecure computer.

For this purpose, in the embodiment shown in FIG. 5, a data acquisition device ( 100 ; 200 ) is provided, which has a chip card reader as the first identification unit and a fingerprint scanner as the second identification unit. The data acquisition device has a bus ( 502 ) for communication with the computer ( 500 ) and optionally also via a data input connection for receiving data from a peripheral device (PG).

The data is transmitted in an authentic data representation both via the bus ( 502 ) and via the network ( 504 ). Either the cryptography chip on the chip card to be inserted by the user or an encryption unit is used for encryption and decryption in the data acquisition device. The computer and the computer also require an encryption and decryption unit ( 503 ; 505 ), which can be located on a plug-in card or, preferably, in a special cryptography chip.

Fig. 6 is a flow chart associated with a preferred embodiment of Fig. 5.

Before the data is entered or recorded or at least before it is transmitted to the computer connected to the data acquisition device, the identity of the user is checked ( 602 ). If this check is successful, the encryption unit ( 503 ) of the computer is given the user-specific public key (PK). This is either on the read-only memory (ROM) of the chip card or is made available to the encryption unit by the other computer. If the data is encrypted in the encryption unit of the data acquisition device, the secret key (SK), which is located on the ROM of the chip card, is transferred to it. If, on the other hand, the data is encrypted - as in the embodiment according to FIG. 2 - on the crypto chip of the chip card, the data acquisition device only needs the secret key (SK) if it transmits data in encrypted form from the computer to the data acquisition device must be decrypted again.

The data is then encrypted using the secret key (SK) in the data acquisition device, provided with a digital signature ( 604 ) and transmitted to the computer ( 605 ). If an application program that is operated on the user's computer is to process the data further (check in step 606 ), the data ( 607 ) is first decrypted using the public key. After further processing of the data ( 608 ), the data is encrypted again using the public key and provided with a digital signature ( 609 ). Before the data ( 610 ) is transmitted to the other computer, an optional query can be made as to whether there is a malfunction, such as a malfunction on the transmission line or an error in the chip card reader. If there is a malfunction, either - as shown in the general state transition diagram in FIG. 4 - the data transmission is aborted completely or the data is transmitted in unencrypted form ( 613 ).

If, on the other hand, the verification of the user identity in step 602 was unsuccessful, the data acquisition device remains in the plain text operating state, so that the data are transmitted unencrypted both to the computer ( 612 ) and to the other computer ( 613 ).

Fig. 7 shows a further embodiment of the data acquisition device according to the invention, which enables feedback between the connected computer and the data acquisition device. This feedback ensures that the user can check the data again on a screen of the data acquisition device before it is transmitted from the computer to the other computer. If this data matches the data that have been acquired by the data acquisition device or a peripheral device (PG), entered by the user or selected by the user in an application program, the user authorizes the transmission of the data. Because the data acquisition device is secure and subsequent manipulation of the authentic data provided with a digital signature is possible, it is ensured that the data arriving at the other computer has been sent by the user. This data can be used by the other computer as a legally binding basis for the conduct of legal transactions.

The reference numerals given in FIG. 7, which correspond to those from FIG. 5, have already been explained in connection with FIG. 5. In addition, the data acquisition device of this further embodiment has a data display unit ( 711 ), which is preferably an LCD screen or a touch-sensitive or touch screen. The data are also transmitted back in an authentic form for the purpose of authorizing their transmission from the computer ( 500 ) to the data acquisition device ( 100 ; 200 ) via a connection ( 710 ). Link 710 can match link 502 . In addition, the data acquisition device can have a separate confirmation button ( 712 ) for authorizing the data transmission.

Reference numeral 707 represents a data entry mask, such as an Internet website or the like, in the html form of which the user is to enter data. Another possibility is the selection of data from a menu ( 708 ), for example by pointing and selecting using a computer mouse ( 709 ).

FIG. 8 is a flow chart associated with the embodiment of FIG. 7. This flowchart continues the flow of FIG. 6 from step 603 .

To transmit the data to the computer, it is encrypted using the user-specific secret key and provided with a digital signature ( 802 ). Subsequently, the transmission ( 803 ) to the computer takes place in an authentic form. The latter further processes the received data ( 805 ), the processing step analogous to step 607 in FIG. 6 being preceded by decryption of the data ( 804 ) or encryption of the data ( 806 ). The data is then transmitted in an authentic form to the data acquisition device ( 807 ), where the data is first decrypted ( 808 ).

The user is then asked to authorize ( 809 ) the transmission of the data thus transmitted to the data acquisition device. For this purpose, the data to be transmitted are displayed on the data display device ( 711 ). For authorization, the user either presses a separate confirmation button ( 712 ) or he presses a button such as. B. the "Enter" key of a conventional keyboard.

In one embodiment, the data acquisition device has a buffer memory which buffers the acquired data. Keyboard input data are preferably given in the buffer memory. In an application in which the user has to enter data in an input mask, for example by making a form entry in an html website, the data entered in this way and inserted by the computer into the input mask are transmitted back to the data acquisition device via the connection ( 710 ). Instead of displaying this data on the screen, the returned data can also be compared directly with the data buffered in the buffer memory. If the comparison is successful, this corresponds to an authorization of the transmission by the user ( 809 ).

The data is then encrypted again in the data acquisition device ( 810 ) and transmitted in an authentic representation to the computer and from there to the other computer ( 811 ). Optionally, a check can again be carried out with regard to any malfunctions, which leads to the abort of the transmission and the transition to the plain text mode of operation of the data acquisition device ( 612 ).

There is thus a method and a device for acquiring data and its data Transmission has been found in authentic form. Thus, the greatest possible Security standard for the collection of data and their transmission guaranteed will. The transmitted data can be due to the advantageously high Security standards in particular as a legally binding basis for the activity of Business of any kind or as authentic or credible proof of Documents or events that are represented by the data.

In order to demonstrate the invention more fully, the following two are added Variants listed and another specific embodiment is given:  

1. Introduction

Electronic media are currently becoming increasingly important information representation and communication of people. This technique draws through great flexibility, variety of information, topicality and speed as well relatively easy availability.

Due to the architecture and implementation of the transport protocols are currently publicly accessible computer networks usually only for open information exchange can be used. Because everyone can impersonate everyone and transport them through the networks data can be illegally changed very easily by third parties, it remains the same Users fail to exchange legally binding documents.

In order to be able to do business over the net, it is necessary to have a technology with which the authenticity of the recorded and transmitted data is verified can. This means that one is able to determine the origin and authenticity of an electroni document.

2 Subject of the idea to be protected

The basic idea is to fix data in its digital creation process - when it is captured. This should be done using data acquisition devices (such as keyboards, scanners, card readers from access control systems, etc.) of computer systems that are performed by cryptographi cal procedures convert the representation of the data so that the authenticity of the captured data can be proven. The advantage of this approach is that the equipment, the data Submit does not necessarily have to be secure for proof of authenticity can be performed. The data acquisition device and the processing unit must be secure on the evidence of authenticity.

3 Objective

Provision of authentic data by a data acquisition device that can be clearly assigned to a person. The data captured by the device are transformed by cryptographic methods in the data capture device. The cryptographically modified data representation is passed on to other devices or processing units. The converted representation of the data makes it possible:

• - detect a change in the data transferred from the data acquisition device
• - Clearly assign the data to a person and / or the data acquisition device.

4 technical implementation

The data acquisition device z. B. Keyboard has in addition to the technical devices for capturing the data

• 1. a unit to counter the user-specific data (user key) take and optionally check for their legality z. B. smart card reader and (optional) fingerprint scanner.
• 2. a passive or active encryption unit (firmware with locks algorithms or encryption hardware).
• 3. Optional: a worldwide unique identity with an unchangeable time knife.

The units mentioned can be separated from one another and / or from the data acquisition device be connected bar or separable. For the greatest possible security, however, it all makes sense Place components inseparably in one housing.

The device or the processing unit that holds the data of the data acquisition device has a special driver that

• 1. the data back in a plain text representation (processable representation) transformed,
• 2. (optional) enables data exchange with the data acquisition device by an association of the read data and data from the processing enabled by the encryption unit.

5 How it works (using a keyboard as an example)

The operator inserts his chip card (carrier of his specific secret) into the card slot the keyboard (for example, could only enter a password, but is relatively unsafe cher). The keyboard then only sends encrypted data to the computer. The Tasta Door driver decrypts the data received and provides the authentic one according to the requirements or plain text version available.

For applications there may be a need to include data from application programs to associate the user input. To do this, the application must have its inte demonstrate quality. If the proof is successful, the application passes the to the keyboard driver encrypted to associated data. The driver sends the data to the data input device forwarded, the application data with the by its encryption unit  associated with the data collected. If no card is inserted, the keyboard works like an ordinary.

5.1 General functional modes for data acquisition devices

• 1. The device only delivers cryptic data if a user-specific secret otherwise normal data. Application with z. B. scanner, keyboard, card reader for access control systems (time management, property protection, etc.)
• 2. The device always provides cryptic data whether there is a user secret or Not. Application with z. B. Card readers in access control systems (time keeper shaft, property protection, etc.)
• 3. The device only delivers data (cryptic or normal) if a user secret nis is present. Otherwise it will fail. Application with z. B. scanner, keyboard.

5.2 Option: Proof of the legality of the card use

When using chip cards, it can be useful to have the owner of the card verified that he uses the card lawfully. To do this, the user will insert the Cards with a signal prompt one or more fingers towards the fingerprint scanner lay. The data of the fingerprints are used with the data that are available on the card Proof of legality.

6 Differences to previously available systems

The transformation of the data cannot be switched on and off dynamically. Is that Ge proven or legitimate use of the user's secret, leave the Device only authentic data.

Existing procedures use dynamic switching on and off of the crypto graphic data display. But is on the "unsafe processing unit" Virus, worm or other manipulation, there is the basic possibility of Dar change position at a time when the actual user data - their Au Proof of authenticity is to be transferred unprotected (in plain text). These can then il be changed legitimately. The change would not be detectable. After the change de the attacker provided the text with the electronic signature of the author and author as well as recipients would initially not be aware of the illegal influence. Egg Another variant would be that the attacker would treat the data as his own could spend to the recipient.  

1. Introduction

The wide acceptance of computers in the business world as well as in private is sometimes rich in the more or less uniform and easy to use user interfaces between man and system unit. The success a program not only depends on the scope of its functions, but also increasingly also of interface design and manageability. Well designed User interfaces are characterized by intuitive, fast and, above all, safe loading serviceability. This includes, in particular, that the input masks are only useful inputs allow and the user of typing through appropriate selection offers relieve.

The described approach to authentic Exchange of data via open communication and data networks assumes that the data, the authenticity of which should be verifiable, via the corresponding secure input devices must be recorded. It is therefore not possible for the user select already available data and ensure their authenticity. This in The device described in this text is intended to remedy this defect.

2 Subject of the idea to be protected

The basic idea is that data does not arise process, but to fix it in their compositional process. That means you need a device with which the authenticity of data can be determined and that then converts this data into a representation, the authenticity of which Corresponding cryptographic procedures can be easily verified.

An expanded form of a screen or a keyboard should serve this purpose or which has the facilities as described in the above-mentioned document are, and which is also able to bidirectionally useful data with the ange exchange closed computers. There is also a way by which the Computer transmitted data securely on the correctness of the screen or the keyboard or the user can be checked. Are the data authentic? table, they are accepted and further entries made via the keyboard or other authentic data in an authentically verifiable representation to the Calculator sent.

3 Objective

Device for providing authentic data that is clearly assigned to a person can be. By the device itself or with the help of the device, the Cor correctness of data from an insecure data source for authenticity being checked. Authentic data from these sources can be secured with data from itself linked data sources. The representation of the produced authentic Data is transformed by appropriate cryptographic methods - so that whose authenticity can be proven - and only leave the device in this Presentation. Only data that is authentic leave the device.  

4 Technical implementation

The implementation of this device can be imagined in three variants:

• 1. Extended display device
• 2. Extended keyboard
• 3. Combination of monitor and keyboard

In addition to the components of its commercially available designs, the device has the following technical devices:

• - a unit to counter user-specific data for data transformation increase.
• - a unit to ensure the legality of the use of the user-specific data to be able to control data transformation.
• - worldwide unique identity with an unchangeable time unit.
• - Optional: an LCD display for direct communication with the user.
• - on the keyboard: a scanner with which certain parts on the screen can be scanned.
• - for the screen device: electronics with which certain screen area che can be represented in digital form.
• - a unit that verifies the data received from the computer: e.g. B. more specific Switch on the keyboard or comparator unit, the data from the screen canner or the screen electronics with those of the computer.

The most obvious form of implementation seems to be the screen, since here the Data are presented to the user here. You now need a key door input and a keyboard output to the computer. The bidirectional communication tion is given by the incoming video signal and the data of the keyboard.

The mixed form keyboard - screen could be designed so that instead of explicit display scanner transfers the data from the screen electronics to the keyboard be sent.

The keyboard version is conceivable in a simple form: that of the computer held data is shown on the LCD display and the user controls this. If he finds the data correct, he acknowledges it with an appropriate one Keyboard operation.

A more elaborate form: using a screen scanner, the screen data collected and sent directly to the keyboard that performs the check.  

5 puncture method

The designs are verified by the authenticity control of the Data selected on the screen expanded. The program sends the selected ones Data on the device that the screen display in a defined area for so long does not change until the device returns the data in an authentic representation gets. The device scans the screen and checks the results of the scanning process obtained data with those that it received from the computer. Are the dates correct match, these are transformed in their representation and sent back to the computer sent. This verification process does not apply to data from secure devices.  

Specific application example for the ADG (DATA-REQUIRED DEVICE)

The idea is to have a data acquisition device available that only delivers authentic data to the computer. The data acquisition device and the SKIA is called considered safe (trustworthy), anything but unsafe!

To ensure authenticity, the following points must be guaranteed (already known procedures):

• - no person can assume an identity that is assigned to another person,
• - The data have a representation that allows manipulations to be detected can.

Using a concrete example (bank customer who makes a transfer), the How the ADG works are explained:

preparation

• 1. The bank generates a private and a public key for a customer whose Identity in the form of characteristics (name, address, date of birth, etc.) with these keys be associated with the bank.
• 2. The private key is transferred on a Eurocheque card with a chip. (This Keys can only be read after proof of the customer's identity, e.g. B. password, Fingerprint, etc. This proof of identity cannot be read explicitly, but is checked using a so-called zero-knowledge procedure.)
• 3. The customer receives his Eurocheque card.

The bank takes over the task of the passport office (SKIA = Secure Key Issuing Authority)

Transfer

• 1. The customer inserts his Eurocheque card into the keyboard
• 2. The keyboard checks the validity of the card
• 3. The customer is prompted by a signal to legally use the inserted Evidence of Eurocheque card, e.g. B. by entering a password, hanging up a or several fingers on a scanner built into the keyboard, etc.
• 4. Can prove the correct identity (ie the legality of the card use) the crypto unit in the keyboard becomes the customer's secret SK key Provided. The keyboard also receives the public PK key. (One more a safer alternative would be for the chip on the card to take over the cryptographic tasks and just passes the public key to the keyboard.)
• 5. The public key is transferred to the connected computer, its special one Keyboard drivers transform the data received from the keyboard into the usual one Makes representation.
• 6. All data entered by the customer via the keyboard is first digitally in signed on the keyboard (public key procedure) and then sent to the computer transmitted. The keyboard driver provides the application software with the plain text version (using of the public key provided) and the authentic version of the Application software available.
• 7. When data is transferred using software selection options (e.g. bank sort codes, Account numbers of transfers already made, etc.) must be checked securely (as shown) to ensure the authenticity of the data can be ensured.

Claims (52)

1. Data acquisition device for the acquisition of data and its transmission in an authentic representation, which comprises:

• a data acquisition unit,
• a first identification unit to record user-specific data of a user,
• a data encryption unit which transforms the data into the authentic representation depending on the user-specific data, and
• - a data transmission unit.

2. Data acquisition device according to claim 1, wherein the data acquisition unit, the first identification unit, the data encryption unit and the data via form a unit that executes program instructions that are stored in a read-only memory (ROM). 3. Data acquisition device according to claim 1 or 2, wherein the first identification unit is a device for handling chip cards. 4. Data acquisition device for the acquisition of data and its transmission in an authentic representation, which comprises:

• a data acquisition unit,
• a device for handling a chip card with an integrated crypto chip, which detects the user-specific data of the user and transforms the data to be transmitted into the authentic data representation, and
• - a data transmission unit.

5. Data acquisition device according to one of the preceding claims, which a Verification unit includes, which the user's authorization to Use of the data acquisition device checked, the data optionally in a normal or an authentic representation. 6. Data acquisition device according to one of the preceding claims, in which the Data acquisition unit comprises a keyboard. 7. Data acquisition device according to one of the preceding claims, in which the Data acquisition unit includes a video camera. 8. Data acquisition device according to one of the preceding claims, in which the Data acquisition unit comprises a scanner, which optical information from a document or still image. 9. The data acquisition device according to claim 10, wherein the data acquisition unit additionally performs an optical letter recognition (OCR). 10. Data acquisition device according to one of the preceding claims, in which the Data acquisition unit and / or the first identification unit acoustic information mation can capture. 11. The data acquisition device according to claim 10, wherein the data acquisition unit and / or the first identification unit for a speech recognition system Conversion of spoken information into commands and / or alphanumeric Characters included. 12. Data acquisition device according to one of the preceding claims, which a Interface for communication with one or more peripheral devices includes.   13. Data acquisition device according to one of the preceding claims, which a includes second identification unit for recording second identification data. 14. Data acquisition device according to claim 13, wherein the verification unit with The authorization of the first and / or second identification data User checked to use the data collection device. 15. Data acquisition device according to one of claims 13 or 14, in which the second Identification unit biometric data determined by the user physical characteristics and / or characteristics derived from the user will. 16. The data acquisition device of claim 15, wherein it is the second Identification unit is a fingerprint scanner. 17. The data acquisition device of claim 15, wherein it is the second Identification unit is a speech analyzer. 18. A data acquisition device according to claim 15, wherein it is the second Identification unit is an optical scanner that receives information from of the retina and / or the fundus of the user. 19. Data acquisition device according to one of the preceding claims, which a Data processing unit includes. 20. Data acquisition device according to one of the preceding claims, which additionally includes a data display device. The data collection device of claim 20, wherein the data representation is direction is an LCD display.   The data acquisition device of claim 20, wherein the data representation is direction is a touch screen. 23. Data acquisition device according to one of the preceding claims, which one Has buffer memory in which captured data is temporarily stored. 24. Data acquisition device according to one of the preceding claims, which a Data comparison unit includes. 25. System for collecting data and transmitting it in an authentic form, which comprises:

• - A data processing device and
• - A data acquisition device according to one of claims 1 to 24, wherein
• - The data processing device comprises a driver for encryption and / or decryption of data, and
• - The data between the data processing device and the data acquisition device can be transmitted either in an unencrypted or only in the authentic representation.

26. The system of claim 25, wherein the data processing device Read-only memory that contains an authentic version of the application software contains goods. 27. A method for collecting data and transmitting it in an authentic representation, with the following steps:

• - the data is collected;
• - user-specific data of a user are recorded;
• - The data is transformed into the authentic representation depending on the user-specific data; and
• - The data is transmitted in the authentic representation.

28. The method according to claim 27, in which to detect the user-specific User data data are recorded, which are stored on a chip card are. 29. The method according to claim 27 or 28, in which to determine the identity of the User identification data are recorded and it is checked whether the user-specific data and the identification data to each other in one Relationship that is characteristic of the user. 30. The method according to claim 29, wherein the identification data and / or user-specific data are alphanumeric characters. 31. The method according to claim 29, wherein the identification data is biometric Data are collected based on physical characteristics and / or properties of the user. 32. The method according to any one of claims 27 to 31, wherein the data as an optical Information captured in the form of moving pictures or still pictures will. 33. The method of claim 32, wherein the information content of the data by electronic filtering is reduced. 34. The method according to any one of claims 32 or 33, wherein the data alpha represent numerical characters, which with the help of an optical letter identification procedure (OCR) can be determined from the recorded data. 35. The method according to any one of claims 27 to 34, in which to detect the Data acoustic data can be recorded.   36. The method of claim 35, wherein the data is alphanumeric characters represent which are determined with the aid of a speech recognition process. 37. The method according to any one of claims 27 to 36, in which to detect the Data alphanumeric characters can be entered using a keyboard. 38. The method according to any one of claims 27 to 37, in which to detect the Data a menu selection is made using a computer mouse. 39. The method of claim 38, in which a form for collecting the data is displayed on a screen in which the data is entered using a keyboard can be entered. 40. The method of claim 38 or 39, wherein the acquired data with the transmitted data and only after a successful comparison be transmitted. 41. The method according to any one of claims 27 to 40, wherein the to be transmitted Data displayed on a display device of a data acquisition device and the user releases the transmission of the data. 42. The method according to any one of claims 27 to 41, wherein the data for Transformation into the authentic data representation can be encrypted. 43. The method according to any one of claims 27 to 42, wherein the data using be encrypted using an asymmetrical encryption method. 44. The method of claim 43, wherein a public key is used to encrypt the data. 45. The method of claim 44, wherein the public key on the Chip card is saved.   46. The method of claim 44, wherein the public key is from a is deployed to another computer. 47. The method of claim 43, wherein a secure key (secure key) for Encrypt the data is used. 48. The method of claim 47, wherein the secure key on the chip card is saved. 49. The method according to any one of claims 27 to 48, wherein the electronic Data with the help of a digital signature process in the authentic Representation to be transformed. 50. The method according to any one of claims 27 to 49, wherein the data in Authentic representation from a data acquisition device to a computer be transmitted. 51. The method according to any one of claims 27 to 50, wherein the data on a local network (LAN) to another computer. 52. The method according to any one of claims 27 to 50, wherein the data on a wide area network (WAN) can be transferred to another computer.