DE4125830C1 - Data security appts. for local area network - exchanges data between network processors via encoding connection nodes w.r.t. coding classification - Google Patents

Abstract

The data protection apparatus is used for a local data network (1) comprising a number of individual processors (2/i), each of which incorporates a data protection filter (3/i) allowing characteristic data for the authorised user to be compared with authentification data, entered by the user, before data transfer is allowed. The data processor transmission line (9/i) to a data encoding connection node (4) which only allows received data from one processor (2/i) to be transferred to a second processor (2/2) when the two processors (2/1,2/2) have the same encoding classification. USE - For preventing unauthorised access to computer data.

Description

The invention relates to a safety device on egg nem local network, in which classified data under different levels of confidentiality can be transferred simultaneously and are processable.

Such local area networks comprise a limited number (n) of network computers between which data is exchanged can be the possibly different Ge levels of compliance are subject to. To protect such To obtain data against unauthorized access, who which the data transmits in various encodings gen. Within the scope of the safety device, a Ver equalization with the network computers each individually arranged security filters provided from a ver immediately saved in the respective security filter Circle of authorized data characterizing users with from a user to prove his identity and User authorization (authentication) entered Data an authentication related to the network computer Check is carried out and only if successful Authentication the release of what the user wants Data transmission path and the output of data VS in a characteristic of the sending network computer Encryption to the transmission line system of the  Network mediated.

One such, according to the so-called off-line method working security device for a local network is by Matyas S., and Meyer, C .: Cryptography: "A new dimension in computer data security ", pages 511 to 520, known.

A disadvantage of such safety devices is one that all the information on each network computer about who, and if so, to what extent, to use the respective network computer and the local one Network is authorized, as well as the keys with which the individual network computers work, both with high Hardware and software expenditure on the individual network computers is linked. There is also the fact that such inevitably measured diverse distribution of information nen about the individual network computers and their possible Be represents a not insignificant security risk.

This also applies if the authentication of the respective ligen user in an online process against the Communication partner takes place as by the US-PS 46 94 492 known in the event that the user is from a pe peripheral station from opposite a main computer to which he wants to have access, has to authenticate or how known from US-PS 44 38 824 in the event that a User away from a local area network computer kes off compared to a central security service sta Authentication in a "question and answer game"  must, but then the communication between the network computer the user - the sender - and the Emp is released and then between these networks in principle, any information exchanged can be.

Is intended for communication between two networks computers of a local network also their given if different security ratings are taken into account , it is therefore inevitable that when building Data transmission paths between communicating with each other additional authentication protocol for network computers le are processed, based on which also the admissibility the opening of a transmission path under the face point of security classification or authorization of Communication partner takes place.

As far as such security requirements sufficient loka le networks are currently feasible, regardless of the type of authentication of the Be users, either the use of multi-stage, safe rakes systems necessary as network computers, their operating sys steme for simultaneous processing and spoke Data VS different confidentiality level fen are designed, or a connection to the network ner with the respective transmission line system special network adapters, d. H. Components in existing local networks do not, at least not can be integrated with reasonable effort.  

In such a network realized with "usual" computing systems work is a reasonably effective safeguard against External access to data classified information (data VS) or ge against an uncontrolled disclosure at most achievable through organizational measures such that the processing of data VS the same secret level of certain periods of time (detected operation mode) is reserved, but this has the disadvantage that a time-saving simultaneous processing of data VS. different levels of confidentiality is not possible.

The object of the invention is therefore a security direction on a local network of the aforementioned Kind of creating that, without prejudice to the possibility of one simultaneous processing and storage of data VS. different levels of confidentiality in the network, effective protection against unauthorized access to the data VS and / or against an uncontrolled open placement of the same mediated, nevertheless with simpl Chen technical means feasible and necessary if in the structure of an existing local Network is insertable.

This object is achieved by the in the characterizing ning part of claim 1 resolved features.

Through the creation of a VS mediator node that is in a user authentication tion further authentication step a comparison of those for the network computers, for one  Data exchange are provided, relevant security ratings "decides" whether an interaction of these Network computer is allowed or not and in the event that a data exchange between the designated network computers, whose exclusive communication Mediation is a structure of security device achieved, the circuitry in the peripheral Area of network computers and local network in total lies together, so that it is characterized by this structure te safety device easily into the best existing network and this meets the requirements for simultaneous processing and storage of data VS different levels of confidentiality can be adjusted can.

The security insertion provided according to claim 2 filter between the application software of the respective network computer and their NetBIOS interfaces, (BIOS = Basic Input / output system) is particularly advantageous since here Security filter as defined by the features of claims 3, 4, 5 and / or 6 specified in more detail and according to claim 7 designed as plug-in cards, via bus adapter to the data Bus and the address bus of the respective network computer are easy to connect.

Peripheral inputs provided individually for the filters councils with which the authenticated with saved  tion data to be compared personal data of the possible Users can be entered are in a preferred design as Smart card readers trained with which user-related gene chip cards are legible, their physical possession requires is legiti to the local network to be able to lubricate. The one that can be achieved through this alone "Security threshold" against unauthorized interference in the local network can be in the preferred form of security Unit device can be increased by the fact that in addition issued to an authorized user ten chip card, the only one authorized to do so ten user possible action, e.g. B. entering a Password is required to successfully authenticate tion to achieve.

The representation of a multitude of communication connections between a sending and a receiving network rake ner and simultaneous processing of data VS difference levels of secrecy between different Network pairs are exchanged is simple Way by recoding the in a specific ver encryption of the sending network computer on the VS switch node incoming data VS on the for the receiving Network-specific key possible.

In a preferred design of the safety device, the VS switching node a selected network computer assigned to local network and mediated for this network the function of the security filter of the cover Lich this network computer the user authentication prototype koll handled. This selected network computer on which alone  the accessibility to by means of the VS switching node storable log data exists that covers all Interactions in the local network, in particular also Access to this is the so-called Assigned to the security administrator of the local network, who has the highest security facility.

The invention is described below with reference to a drawing schematically simplified local network (LAN) with a security device according to the invention is equipped, explained in more detail.

The local network (LAN) shown in the drawing, denoted overall by 1, is designed as a network that corresponds to the relevant standards IEE 802.3, 802.4, 802.5 and ISO 8802, in which a simultaneous storage, processing and transmission of encrypted matters (Data VS) different levels of secrecy should be possible, for example the secrecy levels "VS - only for official use", "VS - confidential" or "VS - secret", as specifically through the data VS guidelines of the Federal Minister of the Interior of the Federal Republic Germany, 1980, defined.

The local network 1 comprises a - limited, otherwise arbitrary - number of network computers 2 / i (i = 1, 2,..., N), whose owners or groups of owners are authorized to deal with classified information of different levels of confidentiality, the or the owners of a single one of the respective network computers have a specific authorization, in the case of several owners of the network computer, to handle classified information.

According to the aforementioned standards, the local network 1 is designed so that

• - with simultaneous processing of data VS under different levels of confidentiality, the data VS only the get to know the right to receive,
• - Only those network computers 2/1 and 2/2 connected to the network 1 , and possibly further network computers 2 / i, which are staffed with authorized users, can receive or send data VS and
• - When transferring data VS the In to be transferred formation is encrypted.

The realization of this capability of the local network 1 is achieved by adding components, namely that, compared to a "conventional" network, in which any computing systems are networked with one another, which have no equipment for data-safe processing of data VS of different levels of secrecy network computers individually associated safety filter 3 / i and a designated overall by 4 VS-switching node, wherein are / i diverted i of the network computers 2 to transfer data VS in encrypted form to the switch node 4 by the safety filter 3 / and the data VS in the local network 1 under the sole direction of the VS switching node 4 in encrypted form to the network computer provided as the receiver, e.g. B. the network computer 2/2 are sent, and the VS switching node 4 monitors the permissibility of the data transmission between the sending network computer 2/1 and the receiving network computer 2/2 and omits the forwarding of data VS if this is unacceptable would mean casual transmission between the network computers 2/1 and 2/2 .

These additional components - security filter 3 / i and VS switching node 4 - are explained in more detail below on the basis of their functions, which results in numerous possibilities for the person skilled in the art to implement these components with regard to hardware and any additional software that may be required, the circuit of which technical description therefore does not appear necessary.

The security filters 3 / i can be designed as pure hardware components or as program-controlled microprocessors and are logically connected between the application level and the NetBIOS interface of the respective network computer 2 / i. Your task is the complete control of all interactions between the application software 5 / i and the computer operating system 6 / i and the LAN operating system 7 / i of the respective network computer 2 / i, on the one hand, and the software drivers and hardware Components, in particular the LAN adapters 8 / i, on the other hand, via which the data VS is coupled into the transmission line 9 / i leading to the VS switching node or, viewed in the direction of the data flow, from the transmission line coming from the switching node 4 9/2 can be coupled into the receiving network computer 2/2 .

This control is carried out in that all orders from the application software 5 / i to the local network 1 are initially stopped, analyzed and changed by the respective security filter 3 / i in such a way that no data VS can be transmitted to unauthorized network computers 2 / i , after which the data VS are passed on to the local network 1 . Conversely, all messages that come from the local network 1 into one of the network computers 2 / i are stopped by their security filter 3 / i and processed in a corresponding manner before they are passed on to the application software 5 / i.

The security filter 3 / i change all orders to the local network 1 in such a way that all messages - data VS - which are sent from network computers 2 / i are redirected to the VS switching node 4 , which is due to a forced addressing successful implementation of the address information contained in the data blocks is achieved. No message gets bypassing the VS switching node 4 directly from one of the network computers 2/1 to another.

The VS switch node also switches the function that Check the admissibility of the data transfer and in the sense a mediation function, if applicable, the respective To forward messages to the intended recipient average.  

The security filter 3 / i contain an encryption component that encrypts all application data contained in message blocks. The encryption component also automatically performs the encryption and decryption of the data stored in the local mass storage devices of the network computers. Furthermore, the security filters ensure that data can only get into the local network 1 in encrypted form.

Accordingly, a encryption component is provided in the VS switching node 4 , which in the event of a transfer of data blocks from a sending network computer, for. B. the network computer 2/1 to the receiving network computer 2/2 for converting the data encrypted by means of the security filter 3/1 with the transmitter key to the key of the security filter 3/2 of the receiving network computer 2/2 , the VS switching node being used 4 only has keys shared with one of the network computers 2 / i.

The encryption components of the security filter 3 / i of the network computer 2 / i are also used for processing cryptographic authentication protocols to be explained in more detail below, by means of which users of the local network 1 must prove their identity and the degree of their authorization to deal with data VS.

Every user of a network computer 2 / i must authenticate himself to this. As a means for this user authentication is a machine-readable data carrier, for. B. suitable a chip card, which is equipped with its own microprocessor and memory and is personalized with user-specific identity and authentication features, one of these identity features also indicates the degree of authorization of the user to handle classified information.

For user authentication, the chip card is inserted into a suitable chip card reader 12 / i assigned to one of the security filters 3 / i and a cryptographic authentication protocol is inserted between the chip card of the user and the security filter 3 / i of the respective network computer 2/1 processed, within which the user has to identify himself against the security filter 3 / i by entering a password. A user session lasts as long as the user leaves his chip card in the chip card reader. As soon as the chip card is removed from the reader, the user session is ended, and a new user session can only be initiated by a new authentication. Only the possession of the personalized chip card and the additional knowledge of the correct password lead to successful authentication, according to which the security filter 3 / i addressed in this way of the network computer 2 / i used, the VS switching node 4, the identity of the user and the degree of his VS- Empowerment.

The VS switching node stores this data and classifies the - sending - network computer according to the degree of authorization of the user. All data subsequently arriving from the sending network computer into the local network 1 are treated by the VS switching node 4 in accordance with this classification. After receiving such a data block, the VS switching node 4 references the stored table of the VS classifications of all network computers 2 / i and compares the corresponding entries. If the rating of the addressee to whom the data is to be forwarded is lower than that of the sending network computer, the transfer of the data is refused.

If, on the other hand, the addressee's rating is equal to or higher than that of the sender, the data is transcoded with the recipient's key and forwarded to it. The security filter 3 / i of the receiver network computer 2 / i decrypts the data and passes it to the operating system 6 / i of this network computer 2 / i for further processing.

The address information necessary for the switching by the VS switching node 4 is exchanged between the security filter 3 / i of the respective network computer 2 / i and the VS switching node 4 in special protocols.

Data is stored locally on mass storage devices only in encrypted form and can only be written or read by the respective owners of a network computer 2 / i or the owners of the VS switching node 4 , if this, as shown, both the VS within the framework of the network computer 2/3 - Mediation function for the network 1 as a whole and also the function of the security filter for the computer 2/3 .

The owner status is here by the following randbe conditions that also apply to the authentication of the Users are considered:

• 1. Only the owners of the respective network computer 2 / i can access the data stored locally with them.
• 2. For the owner of a network computer must on an off in the case of the local network, a "stand-alone" operation with the locally stored data.

The - common - owners of a network computer form one User group that have a common key for the Encryption of the mass storage of the network concerned share computer, with all owners of this network computer have the same authorization to handle classified information.

All legitimate users can log in if not disturbed Authenticate network operation via any network computer to this to use as a workstation computer without mass storage.

The owner of the VS switching node is the "security administrator", who can authenticate himself as the only user at the VS switching node 4 . He is the only user who can access the data stored locally in the VS switching node 4 to store masses.

The VS switch node is also with a logging component equipped that all safety-relevant Er events and the security administrator's work provides evidence for the evaluation of these protocols.  

The security filter 3 / i and the VS switching node 4 of the network computer 2/3 of the security administrator contain the encryption modules required for their function and are also equipped with a microprocessor for implementing the interactions with the computer and LAN operating systems has a RAM memory as the main memory, a ROM memory element being provided for the application software of this microprocessor. An EPROM memory element is provided for the recording of personal user data, which can be compared with the data offered by means of the chip card. Furthermore, an EEPROM memory element is provided as part of the security filter, in which protocol data can be stored which relate to the handling of the authentication protocols that are processed between the security filters 3 / i and the VS switching node 4 , and possibly refer to unauthorized attempts to use the local network 1 and can be used by the security administrator to identify such attempts.

These components are also provided in an analog function in the VS switching node 4 . This is expediently additionally equipped with a battery-backed CMOS RAM memory element, in which such protocol data can also be stored very quickly, which can then be transferred to the EEPROM memory element.

In the VS switching node 4 , a further crypto block is expediently provided, which enables parallel processing of incoming and outgoing message blocks.

Accordingly, at least the VS switching node 4 containing network computer 2/3 with an operating system, z. B. equipped the Microsoft operating system OS / 2, which enables parallel data processing in the sense of different application programs.

The electronic components of the security filter 3 / i explained so far, with the exception of the chip card reader, are switched together on a common circuit card, which are connected to the data and address buses with conventional bus adapters at connection points of the network computers 2 / i prepared for this purpose. The same applies analogously to the VS switching node 4 of the network computer 2/3 of the security administrator.

The principle explained above of the constant control of all interactions between the application software of a network computer and the software drivers and the hardware components of the local network 1 (separation) and checking the permissibility of data transmission between a sending and a receiving network computer, for. B. 2/1 and 2/2 and mediation between these two network computers can be used for both connectionless and connection-oriented data transmission (as defined by the ISO standard).

While a connectionless transmission of data in the detail explained manner may be passed over the VS-switching node 4, in connection-oriented communication between two network computers, the monitoring and switching function of the VS-switching node 4 can be limited to the connection, such that after a successful Mediation of a connection by the VS switching node thereafter data VS can be exchanged directly between the network computers communicating with one another.

If the security filter 3 / i, as shown in the drawing and explained above, are used between the application software and the NetBIOS interface 11 / i of the respective network computer 2 / i, this means that the security filter 3 / i is the Applications compared to the NetBIOS interfaces 11 / i and vice versa the NetBIOS interfaces 11 / i to how applications have to behave. The security functions mentioned are so far inserted within a "phantom layer" between existing protocol layers. This principle, which is characteristic of the invention, can be used for all interfaces of the local network 1 which can be controlled in the manner described by way of example.

Claims (12)

1. Security device on a local network in which classified data of different levels of secrecy can be simultaneously transmitted and processed, the local network ( 1 ) being a number (n) of network computers ( 2 / i; i = 1,2,... , n), from which data can be sent encrypted to the other network computers, and in the context of the security device, a comparison device with the network computers ( 2 / i) is provided for each individually assigned security filter ( 3 / i), which is based on a comparison data stored in the security filter that characterizes the group of authorized users with a data provided by a user to prove his identity and user authorization (authentication) carries out an authentication check related to the network computer ( 2 / i) and only in the case of successful authentication the release the data transmission path desired by the user and the output of data VS i n an encryption characteristic of the sending network computer to the transmission line system ( 9 / i) of the network ( 1 ), characterized in that a VS switching node ( 4 ) is provided to which the network computer ( 2 / i ) via a data transmission line (9 / i) are connected, switching nodes on the Sendebe the network computer operating the data transfer for Sal (4) and in the receiving operation of the network computer, the data transfer from the VS-switching node (4) is carried out to the network computer down, the exchange of data between communicating network computers exclusively via the VS-switching node (4), and in that the VS-switching node (4) is provided with a comparator which from the Ver equal to the respectively relevant for the network computer VS-classifications of their owners the data transmission path between two network computers (e.g. B. 2/1 and 2/2 ) only releases if the VS rating relevant for the receiving network computer ( 2/2 ) corresponds at least to the VS rating relevant for the sending network computer ( 2/1 ). 2. Security device according to claim 1, characterized in that the security filter ( 3 / i) between the application software ( 5 / i, 7 / i) of the respective network computer ( 2 / i) and their NetBIOS interfaces ( 11 / i) connected are. 3. Security device according to claim 1 or claim 2, characterized in that for encryption via network adapter ( 8 / i) to the data transmission line (s) ( 9 / i) data to be output and for decryption via the network adapter ( 8 / i) received data provided crypto modules are provided within the security filter ( 3 / i). 4. Security device according to one of claims 1 to 3, characterized in that for processing authentication protocols in each of the security filters ( 3 / i) a microprocessor is provided for which a RAM memory element is provided as the working memory, the operating software is implemented by means of a ROM memory element and an EPROM memory is provided for storing comparison data required for the authentication procedures. 5. Security device according to claim 4, characterized in that the security filter ( 3 / i) are additionally equipped with an EEPROM memory, in which protocols about any interventions in the network ( 1 ) or interactions with the local network ( 1 ) can be stored . 6. Security device according to one of claims 1 to 5, characterized in that at least individual ones of the security filters ( 3 / i) are provided with a random number generator for carrying out special authentication procedures for a connection set-up using publicly available key information. 7. Safety device according to one of claims 1 to 6, characterized in that the safety filter ( 3 / i) are designed as plug-in cards which are connected via bus adapter to the data bus and the address bus of the respective network computer ( 2 / i) can be connected. 8. Security device according to one of claims 1 to 7, characterized in that for the security filter ( 3 / i) each a peripheral input device ( 12 / i) is provided with which the authentication data to be compared with stored authentication data per personal authentication data of the user can be entered. 9. Security device according to claim 8, characterized in that the input device ( 12 / i) is formed as a chip card reader, with which an authentication data related to the respective user of the user containing chip card is readable. 10. Security device according to claim 9, characterized in that for successful authentication of a user against the network computer selected for handling the authentication protocol ( 2 / i) in addition to the intended use of a machine-readable data carrier, an action by the user, for. B. the entry of a password in the security filter ( 3 / i) of the network computer ( 2 / i) is required. 11. Security device according to one of claims 1 to 10, characterized in that the representation of the connection between a sending network computer ( 2/1 ) and a receiving network computer ( 2/2 ) of the local network ( 1 ) in the VS switching node ( 4 ) by converting the incoming VS data in the encryption of the sending network computer ( 2/1 ) at the VS switching node ( 4 ) to the key of the network computer ( 2/2 ) provided for the reception of this data and its further processing . 12. Security device according to claim 11, characterized in that the VS switching node ( 4 ) is assigned to a selected network computer ner ( 2/3 ) of the local area network ( 1 ) and also conveys the function of the security filter for this network computer ( 2/3 ) , which handles the user authentication protocol with respect to this network computer ( 2/3 ).