DE19703970B4 - Method for collecting data and transmitting it in authentic form - Google Patents

Abstract

) Method for collecting data and transmitting it in an authentic representation, comprising the following steps:
Acquisition of the data to be transmitted in an authentic representation by means of a data acquisition unit in the data acquisition device (100, 200),
Storage of the acquired data in a buffer memory in the data acquisition device (100, 200),
Detection of user-specific data and authentication of the user by means of an identification unit in the data acquisition device (100, 200),
Encryption of the data to be transmitted in an authentic representation by means of a data encryption unit in the data collection device (100, 200) if the user has been successfully authenticated,
the program instructions of the data acquisition device (100, 200) being stored exclusively in a read-only memory (ROM) of the data acquisition device (100, 200) or a chip card to be inserted in the latter,
Transmission of the encrypted data to the data processing device (500) by means of a data transmission unit in the data acquisition device (100, 200),
Receiving the encrypted data by means of a data receiving unit in the data processing device (500),
-...

Description

background the invention

The The present invention relates to detection and transmission of data. More particularly, the present invention relates to a data collection device that collects data after its detection or input to another data processing device in one transmit authentic form should. The authentic form should be a clear inference to the user of the data acquisition device allow the after execution appropriate security or control measures the transmission has released the data. additional The authentic form may also open a way of checking whether the data in the transmission have been manipulated to another computer unauthorized are. Furthermore The present invention also relates to a method of control a data acquisition device, especially in its interaction with another data processing device.

field of use the invention

A important application of data processing equipment or computers is the transmission of Data to other computers. For transmission can be interconnected Networks such as local area networks (LAN) or wide area networks (WAN) such as e.g. the internet will be used. But more and more widespread is also the mobile data communication. The data to be transmitted can directly into a data collection device entered or recorded by it, but they can also be obtained from external sources devices such as. Peripherals Video cameras, scanners and the like are detected.

there should be frequent the use of the data acquisition device only entitled to this Users possible be. Alternatively, however, it is often required that the other Computer can determine from which user the transmission of the Data has been authorized. This is especially necessary if the to be transmitted Data to the conclusion or to carry out a shop serve and therefore should be legally binding, or if the Data should serve as proof.

Further become common Transmit data, the access or manipulation by unauthorized third parties inaccessible should be. Only if the other computer can determine that the data while the transmission have not been tampered with, is the authenticity or credibility the data received from the other computer.

Usually For this purpose, the access authorization of the user is checked and / or the ones to be transferred Data is encrypted.

9 represents a computer, as it is used for data collection and data transmission in the prior art, with an access control is provided so that the computer can be used only by those entitled.

There is a computer ( 901 ) with monitor ( 902 ) and keyboard ( 903 ). A processor card is used to execute program instructions ( 904 ). Data entered via the keyboard or selected by the mouse is sent to the processor card ( 904 ) and passed from this to application programs that are also operated on this processor card or on other PC cards.

Consider the case where the computer is connected to another computer via the transmission path ( 905 ) communicates. So that the transmission of the data is not authorized or authorized by unauthorized persons, an access control system can be used, such as a magnetic stripe reader ( 906 ), which is stored on a storage medium ( 907 ) retrieves stored data and, if necessary, compares it with further user-specific data, such as a personal identification number (PIN) or a transaction number (TAN). If the identification of the user was successful, the use of the computer is released for the authorized user.

So now not the traffic on the transmission path ( 905 ) can be overheard and / or manipulated by unauthorized third parties, encryption methods are usually used. Common are symmetric or asymmetric encryption methods. To encrypt the data, a specially trained encryption chip or crypto chip is often used, which is located either directly on the processor card (FIG. 904 ) or elsewhere in the computer case.

In Combination with the access control described above can Computer operated in a normal mode of operation, in which the data is transmitted unencrypted or in an encryption mode in which the Data before transmission encoded become.

If an access control takes place, it is agreed in conventional systems that the Transmission of the data has been authorized only by the authorized person. Such an agreement is sufficient for certain data security concerns.

adversely the procedure described is first that the encryption is common is dynamically switched on and off. This means that to be transmitted Data at certain times during the procedure described are available in unencrypted form and only in a final Step before the transmission encoded become. This provides a point of attack for unwanted manipulations. This specifically concerns those data that a user uses with help an application program including, if necessary, a menu selection into a data collection device enters and then to a connected computer for the purpose the transmission be forwarded to another computer. Because the data too unencrypted at certain times present, such as while the transmission from the data acquisition device to the computer, can she without major previous Decryption effort can be manipulated.

So long it is not guaranteed that within of the data acquisition device no manipulation of the to be transmitted Data can be made, or as long as the user to be transmitted Data before their transmission not checked again, can not guaranteed be that ones Data that the other computer after transmission and, if necessary after their decryption gets really represent the data authorized by the user.

One another reason for the existing uncertainty is that the data acquisition device is inherently unsafe can be. For example, because an unauthorized person manipulates the hardware - from the outside unobservable can, or because in the software or the operating system viruses, worms or other manipulation means can be introduced.

These Uncertainty is increased by that the Networking of computers usual has become. Often computers are not only interconnected in local networks (LAN) e.g. networked but increasingly have either the workstation (clients) themselves or servers of such Networks over a connection insecure networks, e.g. the internet. This opens up in principle the possibility, that unauthorized person either can directly manipulate data in such networks or in that manipulation means. as Viruses or the like are introduced into important parts of the program can, which in turn then make unauthorized manipulations.

adversely is also the existence Proof of this and similar Manipulation of the data after its transmission in existing ones Systems not possible is. A particular disadvantage is that a reliable proof of authenticity or authenticity of the data is not guaranteed.

adversely is also that data, in data acquisition devices entered and / or recorded by these and / or from these to others Data processing equipment transmitted not as a legally binding basis for concluding or implementing shops of any kind can be used.

The publication US 5546463 A describes a method with which an authentic communication between two data processing units can be realized. In this case, the data acquisition unit is not part of the described device and thus susceptible to manipulation. Furthermore, the device has no device with which the data to be transmitted can be checked for authenticity.

The publication DE 3704814 A1 describes a method of using an IC card by multiple parties, whereby the correct use of the card is ensured by special coding algorithms, which among other things, provide feedback. However, unlike the present method, the feedback relates only to events that occur in the card.

Object of the invention

A The object of the present invention is to find a method that makes it possible changes or manipulation of collected and transmitted data as far as possible early to prove in their creation or composition process, where

Solution of the task

The The above object is achieved by a method according to the main claim expedient embodiments the method according to the invention to collect data and transmit it in authentic Form are given by the subclaims Are defined.

Advantages of invention

According to the invention, a data acquisition device is proposed which consists only of a data acquisition unit, an identification unit, a data encryption unit and a data transmission unit. By reduction If the modules are kept to their absolute minimum, the number of weak points or possible points of attack for manipulating the recorded data is reduced. Preferably, these assemblies are in a mechanically stable and protected housing, so that advantageously a manipulation of the hardware of the data acquisition device is prevented.

The Data collection device only leads such program statements based on a read-only memory or ROM within the housing of the data acquisition device are located. Because this in its preferred embodiment does not have its own Direct access memory or RAM is advantageously a manipulation of the device software through viruses, worms or other manipulation means prevented.

A Another idea underlying the invention is the detected and to be transmitted Dates so early as possible to fix or to transform into an authentic data representation. In a preferred embodiment, such as. when entering data into a computer keyboard, thus become the data is already encrypted inside the keyboard, in an authentic Representation transformed and in this representation to a connected Computer transmitted. This advantageously prevents the possibility that the data during their transmission over the Connecting cable between the data acquisition device and another computer, or in the preferred embodiment between computer keyboard and computer, overheard and manipulated become.

The inventive method encoded the data before its transmission with the help of a usual Encryption method. Here you can both asymmetric encryption methods as well as symmetric encryption methods be used. By customizing for encryption key used is advantageously a unique identifier of the transmission authorizing user possible. requirement therefor is that the identity or authorization of the user is sufficiently carefully checked. For identification of the user are preferably biometric Procedure, password procedure, Shared Secret Schemes uses a preferred embodiment however, uses a smart card, which preferably has a cryptographic chip includes that for encryption and transform the data into an authentic representation can be. These identification methods are in the description part called and described, well known from the prior art and therefore need not be explained in more detail.

symmetrical or asymmetric encryption methods are sufficiently known and need from the prior art therefore not explained in detail become.

According to the present Invention becomes integrity or integrity of the transmitted information Data through cryptographic test values or seal ensures with whose help modifications of the transmitted data were found can be. For this uses a preferred embodiment digital Signatures using common asymmetrical key. Another embodiment used however for this purpose symmetric encryption methods.

preferred Signature methods are the usual ones Digital Signature Algorithms (DSA), El Gamal Signature Techniques, Fiat Shamir Protocols, RSA Techniques or Rivest-Shamir-Adleman method and Schnorr methods. When using symmetric encryption methods uses the embodiment of the invention preferably a block cipher method in CBC mode or in CFB mode. These methods, methods and protocols are state of the art Technology well known and therefore do not need more detailed explained become.

In A preferred method is at least the keys used by a secure authority or secure-key issuing authority (SKIA).

by virtue of the use of such encryption and signature method is advantageous to the recipient of data Proof of unauthorized manipulation of the transmitted data possible.

Because the preferred embodiment of the invention - ever according to the safety standards to be met - more or less expensive test steps executing, where the identity and / or authorization of the user is in contact with the above encryption methods and / or digital signature method an advantageously high security standard in the transmission guaranteed by data. Due to the special design of the data acquisition device is advantageously ensures a high level of security during data acquisition.

By encrypting the data by means of a user-specific key and / or provided with a digital signature, and thus the data are transmitted in a preferred embodiment only in an authentic representation, the transmitted data from the recipient can advantageously as legally binding data for Tati be used for any kind of business. In the following, an authentic data representation is always understood as meaning a data representation which enables another computer to determine from which user the transmitted data has been authorized for transmission.

The The present invention will be more particularly understood by the following detailed Description and reference to the accompanying figures are understood. The attached Figures to which reference is made in the description some preferred embodiments of the invention.

LIST OF FIGURES

1 shows a first embodiment of the data acquisition device of the present invention, which transmits the data directly to another computer.

2 shows a further embodiment of the data acquisition device, which comprises a unit for handling a chip card with integrated crypto chip.

3 is a flow chart showing a simple operation of the data acquisition device.

4 represents a state transition diagram of the data acquisition device.

5 shows a preferred embodiment of the data acquisition device, which is connected to a computer, via which the transmission to the other computer takes place.

6 is a to a preferred embodiment according to 5 associated flow chart.

7 shows a further embodiment of the data acquisition device, which allows a feedback between the connected computer and the data acquisition device.

8th is one of the embodiment according to 7 associated flowchart; and

9 represents a computer, as used for data collection and transmission in the prior art, wherein an access control is provided so that the computer can be used only by those entitled.

special Description part

1 shows a first embodiment of a data collection device according to the present invention. In its simplest form, this data acquisition device comprises a data acquisition unit ( 101 ), a first identification unit ( 102 ), a data encryption unit ( 103 ) and a data transmission unit ( 104 ), which transfers the data to another computer (AR, 106 ) transmitted.

Around to increase security be according to the invention preferably all essential components of the data acquisition device in one housed mechanically stable and secure housing. For safety to ensure against viruses and other data manipulators, the data collection device preferably performs only program statements that rely on a read-only memory (ROM) inside the case are located. Indern the data acquisition device preferably via none own read-write memory (RAM), can be manipulating means for manipulating the program instructions not in the data acquisition device or in its processor set, so as to manipulate its execution.

For data acquisition, the data acquisition unit ( 101 ). This is one embodiment of a traditional data entry keyboard. In order to increase the performance of the data acquisition device, however, more complex data input and data acquisition methods can be used according to the invention, such as the capture of moving images or still images using a video camera, the scanning of documents using a scanner, wherein the detected optical information with Aid of filtering or optical character recognition (OCR), or the acquisition of acoustic information, including speech recognition systems, to reduce the information content of the acquired data. However, to ensure data security, the program instructions are preferably stored on a read-only memory (ROM) located inside the housing of the data acquisition device ( 100 ) is located.

For the purpose of data acquisition, a correspondingly designed peripheral device (PG, 107 ) are connected to the data acquisition device.

To encrypt and transform the data into an authentic data representation, the in 1 illustrated embodiment of a data processor, which executes special cryptographic program instructions. However, this data processor may also be a commercially custom-designed cryptographic processor, which saves computing time and thus increases the data transmission rate.

After encryption of the data in the cryptography processor ( 103 ) the data is transmitted to the other computer using a common data communication unit using common data transmission protocols.

In order to determine the identity of the user, the data acquisition device has a first identification unit ( 102 ), in which it prefers, as in 1 pictured to a device for handling commercially available smart cards or chip cards ( 108 ). Such smart cards, which are well known from the prior art, at least have an integrated read-only memory ( 109 ), but in most cases also via a processor ( 109 ), so that the processing of simple program instructions can also be done directly by the smart card, with the required program instructions either in the ROM of the data acquisition device or preferably in read-only memory ( 109 ) of the chip card ( 108 ) yourself.

In other applications, for example, in which the image data of a surveillance video camera or a scanned text document in authentic form should be enough however often also a simple keyboard over which a user password, encoding key and the like on request by the identification unit can be entered. Also the above mentioned data collection methods can used individually or in combination to determine user identity become. The effort used to determine the user identity depends on the Safety standard that the system should guarantee.

In order to display entered or acquired data, the data acquisition device has a presentation device ( 110 ), which is preferably formed as an LCD screen, or as a touch-sensitive screen, so that the use of an additional keyboard as a data acquisition unit is not required.

Data transmission with the other computer (AR, 106 ) takes place in a one-way operation ( 111 ) or in a two-way mode ( 112 ) via a data line that is part of a computer network such as a local area network (LAN) or a wide area network (WAN) or the Internet. Conventional data transfer protocols are used, such as Ethernet, local talk, FTP (file transfer protocol) or the like, which are well known from the prior art and therefore need not be explained in detail here. The data transmission takes place in another embodiment via wireless telecommunications in a conventional data format. Another intended method of data transmission is the storage of the data on a magnetic or optical data storage medium and the transfer of this data storage medium to the other computer.

2 shows a further embodiment of the data acquisition device, which comprises a unit for handling a chip card with integrated crypto chip.

If this figure has the same reference numbers as in 1 contains, are meant the same units. In contrast to the embodiment according to 1 However, this data collection device does not contain its own crypto or encryption processor.

Rather, the smart card to be inserted by a user is used for encryption ( 208 ), which in addition to a read-only memory (ROM) containing user-specific data, also an encryption processor ( 209 ). In addition, this chip card can also be a common processor for carrying out the inventive method described below.

All data acquired by the data acquisition unit or the peripheral device (PG) is transmitted via a central bus ( 213 ) is transmitted to the processor or the encryption processor of the chip card. After encryption or transformation into an authentic representation, the data reaches the transmission unit, which then transmits it as described above to the other computer.

3 is a flow chart showing a simple operation of the data acquisition device.

Prior to entering or collecting the data or at least before transmitting it to the computer connected to the data acquisition device, the check is carried out ( 302 ) the identity of the user.

ever according to the information content of the data acquisition device available user-specific data Hereby different procedures are made.

In one embodiment, where no or very limited user-specific comparison or reference data is available, the data acquisition device is provided by the other computer with a fixed public key when the data acquisition device determines that a user is requesting the transmission of data. Subsequently, the Datenerfas device, the user to enter identification data. In the simplest case, these may be person-specific identification numbers (PIN) and / or transaction action numbers (TAN) or other alphanumeric character strings which are to be entered via a data keyboard or via the data acquisition unit of the data collection device.

For higher security requirements is however a larger information content the identification data of advantage. This is done in a preferred embodiment the present invention uses a smart card whose user-specific Data with user-entered alphanumeric character combinations be compared.

at a further preferred embodiment be additional recorded as identification data biometric data, the physical characteristics and / or properties of the user. in this connection it is one or more fingerprints of one Fingerprint scanner detected or a scanner to scan the retina or fundus the user, or a language analyzer that has a language profile determined by the user. By comparing these biometric data With user-specific data, the identity of the user can be determined very reliably become. This comparison can be done both in the data acquisition device itself or his chip card reader done or in the other computer. In the latter case, the detected Identification data or biometric data using the public key encoded and transmitted to the other computer become.

The other computer decrypts the incoming data using the associated secret key and makes the comparison of the incoming identification data with user-specific reference data, which are taken approximately from a database. After a successful comparison, the data acquisition device goes into its authentic operating state. In this operating state, all data leaving the data acquisition device is transmitted only in encrypted form and after digital signature ( 304 . 305 ). Optionally, it can be checked whether there is a malfunction ( 305 ), whereupon the data acquisition device returns to its plain text operating state in which the data is transmitted only in unencrypted form ( 303 ).

to encoding The data must be the data acquisition device of the other Computer a user-specific public key to be passed. All to be transmitted Data will be with this key encoded and provided with a digital signature.

Consequently can the transferred ones Data is uniquely assigned to an authorized user, and because the data before the transmission can be provided with a digital signature, a unauthorized manipulation of the data during transmission to the other computer get discovered.

In another preferred embodiment stand the data acquisition device to check the user identity more comprehensive user-specific reference data available, such as because of the user before acquiring further identification data must insert a smart card in the smart card reader of the data acquisition device. The im ROM of the chip card stored user-specific data a "zeroknowledge" proof of user identity too, so a proof to which the data acquisition device does not add extra user-specific reference data required by him about other computers available have to be asked. To check the Benutzendentität become the captured ones Identification data and the user-specific reference data immediately from the chip card reader or compared in the processor of the chip card.

If this check is successful, the encryption unit ( 304 ) of the data acquisition device according to 1 pass the user-specific public key (PK). In a data acquisition device according to 2 the public key need not be passed on to other units of the data processing device as long as it is operated only in a one-way operation in which the data collection device transmits data encrypted in the crypto chip of the smart card only to the other computer. This additionally increases the security of the data acquisition device.

Should the data acquisition device however, in addition be operated in a two-way operation in which the Data collection device instructions encrypted with the user-specific secret key or to use data from the other computer, the or decryption unit of the data acquisition device the user-specific public Key, which is located on the chip card to be passed.

Was checking the user identity in step 302 unsuccessful, the data acquisition device remains in plain text mode, so that the transmission of the data to the other computer is only unencrypted.

4 represents a state transition diagram of the data acquisition device. Here, the example is considered that a bank customer wants to transmit data to a computer. Computer in this example is understood as the access computer of a bank, which communicates with the data acquisition device via a data line. The data collection device could be an ATM or a system for performing telebanking.

The For this data acquisition device used as data acquisition unit via a standard keyboard and as a first identification unit via a chip card reader. In addition, there is a screen for displaying the data in which In this example, these are simple alphanumeric characters, such as such as customer name, bank account number or bank code. Of the Banking has one Chip card containing at least user-specific data, so the chip card reader can perform a zero-knowledge proof of user identity. The chip card can additionally also the private key (SK) and / or the public key (PK) included as a basis for an asymmetric encryption method can be used.

As long as the customer has not inserted the chip card ( 401 ), the transmission of data entered by the customer from the data acquisition device to the other computer is unencrypted ( 402 ), as shown by the loop at ( 402 ) indicated. This traffic can easily be overheard by unauthorized persons and manipulated to their advantage. The user now inserts the card ( 403 ), the user identity is first checked ( 404 ) and possibly also the verification of the validity of the chip card. If this result is negative ( 405 ) eject the card and the data acquisition device resumes its plain text operation.

If the result of the check is positive, the data acquisition device enters the authentic mode ( 407 ), in which all the data leaving the data acquisition device data are transmitted only in an authentic data representation. Because it is possible to determine from the other computer, based on the authentic data, whether the data has been manipulated during the transmission, the data thus transmitted can be regarded as genuine.

If the data acquisition device communicates directly with the access computer of the bank, so needed Data collection device for encryption a public one key (PK). This can be made available to the data acquisition device by the chip card become. However, he can the data acquisition device from the bank computer to disposal after this from the positive review of the user identity has been informed.

As long as no malfunction occurs, the data will only be transmitted to the computer in authentic form. However, if a malfunction occurs ( 409 ), such as an interruption of the communication, or the bank customer terminates the communication, the chip card is ejected and the computer returns to its plaintext mode of operation.

5 shows a preferred embodiment of the data acquisition device.

Frequently In the case of sensitive data, it is required that data that a user has about a Keyboard enters or in one of the above ways of a data acquisition unit were detected, via a computer to a transmitted to other computers should be. A typical application might be making a referral from a bank customer's PC using a data connection like e.g. connected to the Internet with the access computer of a bank. Another preferred application is authentic delivery of image and / or sound data from a PC or client within one Computer network to another PC, a client or a server can be. This computer network could be the Internet or an intranet of a company.

at sensitive data, the other computer should be able to determine: from which user of the computer the data transmission has been authorized is and / or b) whether the data is during transmission have been manipulated. For this is a transmission of the data in one authentic format required.

Because, however, the computer ( 500 ) over the network ( 504 ) is accessible from the outside and has a manipulable memory area, the user of the computer could authorize the transmission of data A and still be converted within the computer in data B of a virus or the like, without the user noticing. This problem can be solved by using a data logger connected to the insecure computer.

This is in the in 5 shown embodiment, a data acquisition device ( 100 ; 200 ), which has as a first identification unit via a smart card reader and as a second identification unit via a fingerprint scanner. The data acquisition device has a bus ( 502 ) for communication with the computer ( 500 ) and optionally also via a data input connection to Receiving data from a peripheral device (PG).

The data is transmitted both via the bus ( 502 ) as well as over the network ( 504 ) in authentic data representation. For encryption and decryption in the data collection device, either the cryptographic chip on the chip card to be inserted by the user or else an encryption unit is used. The computer and the computer also require an encryption and decryption unit ( 503 ; 505 ), which may be on a plug-in card or preferably in a special cryptographic chip.

6 is a to a preferred embodiment according to 5 associated flow chart.

Prior to entering or collecting the data or at least before transmitting it to the computer connected to the data acquisition device, the check is carried out ( 602 ) the identity of the user. If this check is successful, the encryption unit ( 503 ) pass the user-specific public key (PK) to the computer. This is located either on the read-only memory (ROM) of the chip card or the encryption unit is provided by the other computer. If the encryption of the data is carried out in the encryption unit of the data acquisition device, so you will give her the secret key (SK), which is located on the ROM of the smart card. If the encryption of the data, however - as in the embodiment according to 2 - Is done on the crypto chip of the smart card, the data acquisition device requires the secret key (SK) only if it has to decrypt data that are transmitted from the computer to the data acquisition device in encrypted form again.

Subsequently, the data is encrypted using the secret key (SK) in the data acquisition device, provided with a digital signature ( 604 ) and transmitted to the computer ( 605 ). If an application program running on the user's computer is to process the data (check in step 606 ), the first step is the decryption of the data ( 607 ) with the help of the public key. After further processing of the data ( 608 ), the data is again encrypted using the public key and provided with a digital signature ( 609 ). Before transmitting the data ( 610 ) to the other computer can optionally query whether there is a malfunction, such as a fault on the transmission line or a fault in the smart card reader. If there is a malfunction, either - as in the general state transition diagram in 4 a complete interruption of the data transmission or a transmission of the data in unencrypted form ( 613 ).

On the other hand, the user identity check was in step 602 unsuccessful, the data acquisition device remains in plain text mode, so that the transmission of the data to both the computer ( 612 ) as well as to the other computer ( 613 ) takes place unencrypted.

7 shows a further embodiment of the data acquisition device, which allows a feedback between the connected computer and the data acquisition device. This feedback ensures that the user can recheck the data before transmitting it from the computer to the other computer on a screen of the data logger. If this data coincides with the data collected by the data acquisition device or a peripheral device (PG), entered by or selected by the user in an application program, the user authorizes the transmission of the data. Because the data acquisition device is secure and subsequent manipulation of the authentic data provided with a digital signature is possible, it is ensured that the data arriving at the other computer has been sent by the user. This data can thus be used by the other computer as a legally binding basis for the execution of legal transactions.

In the 7 quoted reference numerals with those of 5 have already been associated with 5 explained. In addition, the data acquisition device of this further embodiment has a data representation unit ( 711 ), which is preferably an LCD screen or a touch-sensitive or touch screen. The data is used for the purpose of authorizing its transmission from the computer ( 500 ) to the data acquisition device ( 100 ; 200 ) via a connection ( 710 ) also in authentic form. connection 710 can with connection 502 to match. In addition, the data acquisition device can be activated via a separate confirmation key ( 712 ) to authorize the transfer of data.

reference numeral 707 represents a data entry mask, such as an Internet web page or the like, in whose html form the user is to enter data. Another option is to select data from a menu ( 708 ), for example by pointing and selecting with a computer mouse ( 709 ).

8th is one of the embodiment according to 7 associated flow chart. This flowchart suspends the operation 6 from step 603 continued.

To transmit the data to the computer, these are encrypted using the user-specific secret key, provided with a digital signature ( 802 ). Subsequently, the transmission ( 803 ) to the computer in authentic form. This process the received data further ( 805 ), the processing step being analogous to the steps 607 in 6 a decryption of the data ( 804 ) or an encryption of the data follows ( 806 ). Afterwards, the data is sent back to the data acquisition device in authentic form ( 807 ), where first the decryption of the data takes place ( 808 ).

Subsequently, the user is requested to authorize the transmission of the data thus transmitted to the data acquisition device ( 809 ). For this purpose, the data to be transmitted on the data presentation device ( 711 ). For authorization, the user either actuates a separate confirmation key ( 712 ) or he presses a key such as the "Enter" key of a conventional keyboard.

In one embodiment, the data collection device has a buffer memory that caches the captured data. Preferably, keyboard input data is given to the buffer memory. For example, in an application where the user needs to enter data into an input mask, for example, by making a form entry in an html web page, the data entered and inserted by the computer into the input mask (Fig. 710 ) back to the data collection device. Instead of displaying this data on the screen, the returned data can also be compared directly with the data buffered in the buffer memory. If the comparison is successful, this corresponds to an authorization of the transmission by the user ( 809 ).

Afterwards, the data is re-encrypted in the data acquisition device ( 810 ) and transmitted in authentic representation to the computer and from this to the other computer (811). Optionally, a check can again be carried out with regard to possible malfunctions, resulting in the interruption of the transmission and the transition to the clear-text mode of operation of the data acquisition device ( 612 ) leads.

Consequently is a method and apparatus for collecting data and their transmission found in authentic form. Thus, the greatest possible Security standard for the collection of data and their transmission guaranteed become. The transmitted Data can due to the advantageous high safety standards in particular as a legally binding basis for doing business for anyone Or as authentic or credible proof of documents or events represented by the data.

Around to show the invention even more comprehensive, in addition following two variants are given and another concrete embodiment stated:

Version 1:

1. Introduction

electronic Media are currently gaining more and more an essential meaning within the framework of the information representation and communication of the people. This technique is characterized by great flexibility, variety of information, high actuality and Speed as well as relatively easy availability.

by virtue of the architecture and implementation of the transport protocols currently public accessible Computer networks usually only for open information exchange be used. Since everyone is for anyone can spend and the data transported through the networks very simply can be changed by third illegally remains Users are unable to exchange legally binding documents.

Around Shops about that Make network to be able to it is necessary over to have a technique with the authenticity the captured and transmitted Data can be detected. This means that one is able to do that Origin and authenticity to prove an electronic document.

2 Subject of the protected idea

The basic idea is to fix data in their digital creation process - when they are captured. The is intended by data acquisition devices (such as keyboards, scanners, card readers of access control systems etc.) of computer systems, which are by cryptographic Method to convert the representation of the data so that the authenticity of the collected data can be detected. Advantage of this approach is that the devices that Submit data not necessarily be sure of proof of the authenticity guided can be. Certainly that has to be Data collection device and the processing unit on which evidence of authenticity is kept.

3 objective

• • eine Veränderung an den vom Datenerfassungsgerät übergebenen Daten festzustellen
• • die Daten einer Person und/oder dem Datenerfassungsgerät eindeutig zuzuordnen.

Providing authentic data through a data collection device that can be uniquely assigned to a person. The data detected by the device is transformed by cryptographic methods in the data acquisition device. The cryptographically modified data representation is passed on to other devices or processing units. The converted representation of the data makes it possible:

• • detect a change in the data provided by the data acquisition device
• • to uniquely associate the data with a person and / or the data collection device.

4 technical realization

• 1. eine Einheit, um die benutzerspezifischen Daten (Benutzerschlüssel) entgegen zu nehmen und optional auf ihre Rechtmäßigkeit zu prüfen z.B. Chipkartenleser und (optional) Fingerprintscanner.
• 2. eine passive oder aktive Verschlüsselungseinheit (Firmware mit Verschlüsselungsalgorithmen oder Verschlüsselungshardware).
• 3. optional: eine Weltweit eindeutige Identität mit einem unveränderbaren Zeiteinheitenmesser.

The data acquisition device eg keyboard has besides the technical devices for collecting the data

• 1. a unit to receive the user-specific data (user key) and optionally to check its legitimacy eg chip card reader and (optional) fingerprint scanner.
• 2. a passive or active encryption unit (firmware with encryption algorithms or encryption hardware).
• 3. optional: a globally unique identity with a fixed time unit meter.

The mentioned units can with each other and / or with the data acquisition device inseparable or separable be connected. For the greatest possible security However, it seems sensible all components inseparable in one casing accommodate.

• 1. die Daten wieder in eine Klartextdarstellung (verarbeitbare Darstellung) zurücktransformiert,
• 2. (optional) einen Datenaustausch mit dem Datenerfassungsgerät ermöglicht, durch den eine Assoziierung der eingelesenen Daten und Daten von der Verarbeitungseinheit durch die Verschlüsselungseinheit ermöglicht.

The device or the processing unit that receives the data from the data acquisition device has a special driver, the

• 1. the data is transformed back into a plain text representation (processable representation),
• 2. (optionally) enables data exchange with the data acquisition device, through which allows an association of the read data and data from the processing unit by the encryption unit.

5 mode of operation (example a keyboard)

Of the Operator puts his chip card (carrier of his specific secret) in the card reader of the keyboard (for example, could only a password enter, but is relatively uncertain). The keyboard will send only encrypted Data to the computer. The keyboard driver decrypts the obtained Data and provides the authentic or plain text version depending on the requirement to disposal.

at Applications may require data from application programs to associate with the user input. For this, the application must be the input device integrity prove. If the proof is successful, the application passes the keyboard driver Encrypts the data to be associated. The data will be through the driver is forwarded to the data input device through its encryption unit the application data associated with the data collected by him. is no card inserted, so the keyboard works like a normal one.

5.1 General function mode for data acquisition devices

• 1. The device provides only cryptic data if a user-specific secret present, otherwise normal data. Application at e.g. Scanner, keyboard, Card readers in access control systems (time management, property protection etc.)
• 2. The device always provides cryptic data if there is a user secret or not. Application at e.g. Card reader in access control systems (Time management, property protection, etc.)
• 3. The device only returns data (cryptic or normal) if a user secret is present. Otherwise it fails the service. Application at e.g. Scanner, Keyboard.

5.2 Option: proof of legality the card usage

at Use of smart cards, it may be useful to the owner of the Card to prove that he the card is lawfully used. For this purpose, the user is after inserting the cards by a Signal prompts one or more fingers on the fingerprint scanner to lay. The data of the fingerprints serve with the data available on the map are proof of legality.

6 differences to date available systems

The Transformation of data can not be dynamically turned on and off become. Is the secret or lawful use of the secret The user only leaves the device with authentic data.

Existing methods use dynamic activation and deactivation of the cryptographic data representation. However, if there is a virus, worm or other manipulation on the "unsafe processing unit", then there is the possibility in principle of changing the display mode at a time when the actual payload - whose authenticity is to be proved - is transmitted unprotected (in plain text) , These can then be illegitimately changed. The changes would not be detectable. After the change, the attacker would provide the text with the electronic signature of the author and author and receiver would first gain knowledge of the illegal interference. Another variant would be that the aggressor could output the data as his own data to the recipient.

Variant 2:

1. Introduction

The broad acceptance of computers in the business world as well as in the private sector Area is sometimes on the more or less uniform and easy-to-use user interfaces between human and system unit due. Of the Success of a program depends not only from the scope of its functions, but increasingly also from interface design and manageability. Well designed user interfaces are characterized by intuitive, fast and above all secure operability out. Also includes in particular, that the input masks only allow meaningful input and the user of typing relieve by appropriate selection offers.

Of the described approach to the authentic exchange of data over open Communication and data networks assume that the data, their authenticity should be detectable over the corresponding secure input devices must be detected. So it's up to the user not possible, already available Select data and their authenticity sure. The device described in this text should be this Eliminate the defect.

2 Subject of the protected idea

The basic idea Data is not to be fixed during the process of creation, but rather during its compositional process. That means you need a machine, with the authenticity of data can be detected and then this Data is converted into a representation whose authenticity is determined by appropriate cryptographic methods are easily detected can.

To should be an advanced form of screen or keyboard who owns the facilities as described above are described in the above-mentioned document, and which, moreover, in capable of bidirectional payload with the connected computer exchange. Besides, exists a way in which the data transmitted by the computer safely their correctness from the screen or the keyboard or the Users are checked can. If the data are authentic, they are accepted and with further input about the Keyboard or other authentic data in an authentically verifiable representation sent to the computer.

3 objective

Device for deployment authentic data that can be uniquely assigned to a person. By the device yourself or with the help of the device can correct the accuracy of data from an insecure data source come, on authenticity checked become. Authentic data from these sources can be secure with data Linked data sources become. The representation of the produced authentic data becomes transformed by appropriate cryptographic methods - so that their authenticity can be demonstrated - and leave the device only in this representation. The device only leaves data that are authentic.

4 Technical realization

• 1. erweitertes Bildschirmgerät
• 2. erweiterte Tastatur
• 3. Kombination aus Bildschirmgerät und Tastatur

The realization of this device is conceivable in three variants:

• 1. extended screen device
• 2. advanced keyboard
• 3. Combination of screen device and keyboard

• • eine Einheit, um benutzerspezifische Daten zur Datentransformierung entgegenzunehmen.
• • eine Einheit, um die Rechtmäßigkeit der Benutzung der benutzerspezifischen Daten zur Datentransformierung kontrollieren zu können.
• • weltweit eineindeutige Identität mit einem unverändsrbaren Zeiteinheitenmesser.
• • optional: ein LCD Display zur direkten Kommunikation mit dem Anwender.
• • bei der Tastatur: ein Scanner, mit dem bestimmte Teile auf dem Bildschirm gescannt werden können.
• • beim Bildschirmgerät: eine Elektronik, mit welcher bestimmte Bildschirmbereiche in digitaler Form dargestellt werden können.
• • eine Einheit, die die vom Rechner erhaltenen Daten verifiziert: z.B. spezieller Schalter auf der Tastatur oder Vergleichereinheit, die Daten vom Bildschirmscanner bzw. von der Bildschirmelektronik mit denen vom Rechner vergleicht.

The device has the following technical devices in addition to the modules of its commercial designs:

• • one unit to receive user-specific data transformation data.
• • a unit to control the lawfulness of the use of the user-specific data transformation data.
• • unambiguous identity worldwide with an unalterable time unit meter.
• • optional: an LCD display for direct communication with the user.
• • on the keyboard: a scanner that can be used to scan certain parts of the screen.
• • on the screen device: an electronic device with which certain screen areas can be displayed in digital form.
• • a unit that verifies the data received from the computer: eg special keyboard or comparator unit that compares data from the screen scanner or from the display electronics with those from the computer.

The most obvious form of realization seems to be the screen because here the data is presented here to the user. You still need it a keyboard input and a keyboard output to the computer. The Bidirectional communication is through the incoming video signal and given the data of the keyboard.

The Mixed form keyboard - screen could be like that accomplished be that instead the explicit display scanner, the data from the display electronics the keyboard will be sent.

The keyboard version is conceivable in a simple form: the one obtained from the computer Data is displayed on the LCD screen and the user controls these. If he finds the data as correct, he acknowledges it a corresponding keyboard operation.

A more complex form with the help of a screen scanner, the Recorded screen data and sent directly to the keyboard, which makes the check.

5 operation

The versions be through the authenticity control the one selected on the screen Data expanded. The program sends the selected data to the device that contains the Screen display in a defined area as long as it does not change from the device the data gets delivered back in authentic representation. The device is scanning the screen and check out the Data obtained with the scanning process from those who receive it from the computer Has. If the data match, they are transformed in their representation and returned to the computer sent. For Data from secure devices eliminates this verification process.

Specific application example for the ADG (DATA FACTORY DEVICE)

object The idea is to have a data collection device that is only authentic Data to the computer supplies. The data acquisition device and the SKIA is considered safe (trustworthy), everything else as insecure!

• – keine Person kann eine Identität annehmen, die einer anderen Person zugeordnet ist,
• – die Daten besitzen eine Repräsentanz, die es zuläßt, daß Manipulationen festgestellt werden können.

In order to ensure the authenticity, the following points must be ensured (already known methods):

• - no person can accept an identity that is assigned to another person,
• - The data have a representation that allows manipulation to be detected.

Based a concrete example (banker making a transfer) explains how the ADG works become:

Preparation:

• 1. The bank generates a private and a public key for one Customers whose identity in the form of characteristics (name, address, date of birth, etc.) with these keys be associated with the bank.
• 2. The private key is transmitted on a Eurocheque card with a chip. (This key can only after proof of the identity of the Customers are read, e.g. Password, Fingerprint, etc. This proof of identity can not are explicitly read, but is a so-called zero-knowledge Procedure checked.)
• 3. The customer receives his Eurocheque card.

The Bank takes over the task of the passport (SKIA = Secure Key Issuing Authority)

Transfer:

• 1. The customer puts his Eurocheque card in the keyboard
• 2. The keyboard checks the validity the map
• 3. The customer is prompted by a signal, its lawful use the inserted week eve card, e.g. by entering a password, Placing one or more fingers on a keyboard-mounted scanner etc.
• 4. Can the correct identity (ie the legality card usage), the crypto unit is detected in the keyboard the secret key available to the customer posed. Furthermore receives the keyboard the public Key. (An even safer alternative would be that the chip on the card cryptographic tasks over takes and only the public key passes to the keyboard.)
• 5. The public key is passed to the connected computer, its special keyboard driver the transformation of the data obtained from the keyboard into the usual representation performs.
• 6. All data entered by the customer via the keyboard be, be first digitally signed in the keyboard (public-key method) and subsequently transmitted to the computer. The keyboard driver provides the application software with the plain text version (with the help of him available put public key) and the authentic version of the application software.
• 7. At a takeover of data through software selections (e.g., bank codes, account numbers of transfers already made, etc.) must have a secure verification (as shown) done so the authenticity the data can be ensured.

Claims (26)

) Method for collecting data and transmitting it in an authentic representation, comprising the following steps: - collecting the data to be transmitted in an authentic representation by means of a data acquisition unit in the data acquisition device ( 100 . 200 ), - storage of the collected data in a buffer memory in the data acquisition device ( 100 . 200 ), - acquisition of user-specific data and authentication of the user by means of an identification unit in the data acquisition device ( 100 . 200 ), - Encryption of the data to be transmitted in an authentic representation by means of a data encryption unit in the data acquisition device ( 100 . 200 ), if the user has been successfully authenticated, the program instructions of the data collection device ( 100 . 200 ) exclusively in a read-only memory (ROM) of the data acquisition device ( 100 . 200 ) or a chip card which can be inserted in this chip, transmission of the encrypted data by means of a data transmission unit in the data acquisition device ( 100 . 200 ) to the data processing device ( 500 ), Receiving the encrypted data by means of a data receiving unit in the data processing device ( 500 ), - decryption of the encrypted data by means of a decryption unit in the data processing device ( 500 ), - output or further processing of the decrypted data in the data processing device ( 500 ), characterized in that in addition the following steps are carried out: - transmission of the data by means of a data transmission unit in the data processing device ( 500 ) to the data acquisition device ( 100 . 200 ), - Receipt of the data by the data acquisition device ( 100 . 200 ), - where appropriate, decryption of the received data by the data acquisition device ( 100 . 200 ), - comparison of the decrypted data with that in the buffer memory of the data acquisition device ( 100 . 200 ) - Authorization of the data if the user agrees or confirms the correctness of the output data on the data acquisition device ( 100 . 200 ), - Encryption of the authorized data by means of a data encryption unit in the data acquisition device ( 100 . 200 ) and - transmission of the encrypted data by means of a data transmission unit in the data acquisition device ( 100 . 200 ). Method according to Claim 1, in which for detection the user-specific data of the user data is captured, which are stored on a chip card. Method according to claim 1 or 2, wherein for the determination the identity the user's identification data is captured and verified whether the user-specific data and the identification data to each other to stand in a relationship for the User is characteristic.  Method according to Claim 3, in which the identification data and / or specific data are alphanumeric characters. Method according to Claim 3, in which the identification data Biometric data collected by physical characteristics and / or Characteristics of the user are derived.  Method according to one of claims 1 to 5, wherein the data as optical information in the form of moving pictures or still pictures recorded. The method of claim 6, wherein the information content the data is reduced by electronic filtering. Method according to one of claims 4 or 7, wherein the data represent alphanumeric characters, which by means of an optical Letter recognition method (OCR) determined from the collected data become. Method according to one of claims 1 to 8 in which for detection the data acoustic data are recorded.  The method of claim 9, wherein the data is alphanumeric Represent characters, which by means of a speech recognition method be determined. Method according to one of claims 1 to 10, wherein for the detection the data entered alphanumeric characters via a keyboard become. Method according to one of claims 1 to 11, wherein for the detection the data is a menu choice with the help of a computer mouse.  The method of claim 12, wherein for detection the data a form is displayed on a screen in that the data over a keyboard can be entered. The method of claim 12 or 13, wherein the detected Data will only be sent after a successful comparison. Method according to one of claims 1 to 14, wherein the data to be transmitted on a Presentation device of a data acquisition device are displayed and the user releases the transmission of the data. Method according to one of claims 1 to 15, wherein the data be encrypted for transformation into the authentic data representation. A method according to any one of claims 1 to 16, wherein Your data with the help of an asymmetric encryption method be encrypted. The method of claim 17, wherein a public key (public key) for encrypting the Data is used. The method of claim 18, wherein the public key stored on the chip card. The method of claim 18, wherein the public key provided by another computer. The method of claim 20, wherein a safer key (secure key) to encrypt the data is used. The method of claim 21, wherein the secure key stored on the chip card. Method according to one of claims 1 to 22, wherein the electronic data using a digital signature method be transformed into the authentic representation. Method according to one of claims 1 to 23, wherein the data in authentic representation of a data acquisition device to a Computer transmitted become. Method according to one of Claims 1 to 24, in which the data are transmitted via a local area network (LAN) to another computer. A method according to any one of claims 1 to 24; with yours Data about a spacious room Network (WAN) to another computer.