WO2006081599A1

WO2006081599A1 - Method for authentication of a data-transmitting terminal

Info

Publication number: WO2006081599A1
Application number: PCT/AT2006/000038
Authority: WO
Inventors: Dieter Schmidradler; Christian Öhreneder
Original assignee: Kapsch Trafficcom Ag
Priority date: 2005-02-01
Filing date: 2006-02-01
Publication date: 2006-08-10
Also published as: AT501428A1

Abstract

The invention relates to a method for authentication of a data-transmitting terminal (1) with a corresponding data-receiving recorder unit (3), characterised in that in the terminal (1) and in the recorder unit (3) corresponding keys (Key1 KAM, Key2KAM; Key1EE, Key2EE) which are not externally readable are stored, during an active operation the keys (Key1 KAM, Key2KAM; KeylEE, Key2EE) are monitored by a suitable computing process between the terminal (1) and recorder unit (3) and only when the checking provides the authenticity of the terminal (1) are the data (D) from the terminal (1) accepted by the recorder unit (3).

Description

Method for authenticating a data transmitting terminal

The present invention relates to a method for authenticating a data transmitting terminal to an associated data receiving detection unit.

The invention relates to the problem of ensuring the authenticity of terminals, in particular when the transmission link between the terminal and the detection unit can not be reliably protected from attacks. In particular, the invention relates to the field of application to securely document a traffic scene or any other scene with the aid of cameras or other sensors.

Common applications in traffic engineering are the documentation of offenses against the traffic regulations, such as speeding, crossing a red light crossing, etc. , or the control of tolls or access permissions. Often cameras are used in conjunction with other sensors to detect the violation. The captured images should reflect the scene unadulterated and be protected against manipulation.

For this it is state of the art, the collected data, z. As images to be provided with an electronic signature. In the process, a hash value is calculated for the image and the signature is created with a secret key using an asymmetrical encryption method. The images are protected against subsequent changes.

The images are often compressed before being signed. Since both compression and signing are computationally intensive, these processing steps are typically performed on a personal computing device. Until the image reaches the PC, it is not protected against manipulation. In particular, can not be prevented by the signing on the PC that z. B. Pictures are shown ^'hentischen sources in the PC of non-aut. _ p _

Known system solutions prevent the import of non-authentic images by the detection unit and the camera are closely integrated with each other and thus the interface is made inaccessible and protected from external intrusions. If several terminals are operated in a system and these are spatially separated from one or more detection unit (s), an integration of the detection units and terminals to an externally protected unit both technically and economically not meaningful or possible. Accordingly, the object of the invention is to ensure in a system with one or more terminals, which are connected via unprotected communication links to one or more detection unit (s), that only data from authentic terminals of the or the detection unit (s ) be accepted. Third-party devices should be recognized and no data transferred from them.

This object is achieved with a method of the aforementioned type, which according to the invention is characterized in that stored in the terminal and in the detection unit mutually associated, each not externally readable key that the keys during operation on a coordinated calculation rule between terminal and detection unit are checked, and that only the data of the terminal are accepted by the detection unit, if the verification gives the authenticity of the terminal.

In the invention, a key is stored in a protected memory area in the terminal and in the detection unit. A coordinated calculation rule is used to check whether keys assigned to one another are entered in the terminal and in the registration unit. The method is designed so that the keys themselves are not transmitted via the communication link. The registration unit may even send an authentication request with non-consistent data to the terminal, as will be explained later. The terminal calculates with this data and the key stored in it a reply to the authentication request. This response is checked by the capture unit. The coordinated calculation rule expediently uses cryptographic methods which ensure that the expected response of the detection unit can only be calculated with reasonable computational effort if the key stored in the terminal is known. Conversely, if the answer is correct, it can thus be concluded that the terminal has stored the corresponding key and can therefore be accepted as an authentic source. A preferred embodiment of the method of the invention is characterized in that, for checking the key during operation, the detection unit generates an authentication request and sends it to the terminal, the terminal encodes it with its key and returns it in response to the detection unit, wherein the detection unit the authentication request is encrypted with its key and compared with the received response, the equality case indicating the authenticity of the terminal.

Alternatively, the detection unit may decrypt the received response with its key and compare it with the original authentication request; or the detection unit sends the authentication request encrypted with its key to the terminal, which decrypts it with its key for comparison with the original authentication request.

All these variants allow a particularly simple and secure implementation with the above advantages. According to a further feature of the invention, the authentication request is preferably created on the basis of random or changing data. With a sufficiently large supply of possible underlying data, this ensures that a decryption of the authentication process, for example by listening to the communication connection, is practically impossible.

The authentication method according to the invention can be carried out once, during the log-on of the terminal to the recording unit for the current operation, or also, every time the terminal sends data. In the latter case, it is particularly favorable if the terminal sends its data together with the mentioned answer, and / or the authentication request comprises a request for the transmission of the data of the terminal. Both measures speed up the transmission protocol or reduce the data traffic on the interface or communication connection between terminal and detection unit.

The keys used in the terminal and in the registration unit do not necessarily have to be identical, and preference may also be given to using mutually different keys which are only uniquely assigned to each other. As a result, the security of the authentication process can be further increased. Alternatively, it would also be conceivable to use a key pair according to a private / public-key method, if desired.

Another aspect of the present invention includes a preferred embodiment for securely assigning and storing the keys. If a system has security flaws in the installation of new ^■ Key, the overall security of the system is at risk. A particularly preferred embodiment of the method according to the invention is therefore that the key of the detection unit can only be stored in this when a dongle is connected to the detection unit. Preference is also the - O -

Key of the terminal entered into the detection unit and sent from the latter only to the terminal and stored there when a dongle is connected to the detection unit. The term "dongle" is understood in the present description to mean a device which serves to enable special functions of a system which are not permitted without this device.

The invention thus provides a system that allows the insertion of keys only when the system is unlocked by connecting the dongle for key insertion.

Preferably, the dongle is authenticated to the detection unit in the same way as a terminal, and only in the case of authentication the keys are stored in the detection unit or in the terminal. As a result, it can be determined with sufficient certainty whether an authentic and thus valid dongle is connected to the registration unit. Furthermore, according to a further preferred feature of the invention, the keys can be stored in the terminal and / or the detection unit only if at least one key previously stored therein is also entered into the detection unit for validation. The key storage is thus unlocked by a query previously valid keys, d. H . Any existing "old" keys must be known so that "new" keys can be imported. Advantageously, the "very first" old keys are already stored in the production, delivery or initial commissioning of a detection unit in this.

In each case it is particularly favorable if, as a further consequence, the detection unit itself is also protected against external intervention and manipulation of the acquired data. This ensures that no changes can be made to the data recorded. According to further preferred features of the method, the acquired data can be supplied to a signal enhancement to increase the interpretability of the meaning derivable therefrom; and / or added data can be added to the acquired data via the acquisition process itself and / or additional data derived from the collected data itself; and / or the acquired data can be compressed and / or protected against changes by means of a digital signature. In this way, a trustworthy transmission chain of the data from the terminal via the detection unit to the handover to an interface or. a final processing can be ensured.

The docking terminal may be of any type known in the art. As mentioned above, the method of the invention is particularly suitable for the authentication of sensors, in particular cameras, and the data are preferably image data. Alternatively, the terminal may be a radio receiver, preferably a radio transceiver, via which a bidirectional exchange of information between an external device and the detection unit is handled, for example a radio beacon in an electronic road toll system, an access control system, a warehousing or billing system by means of RFID Tags etc. According to a further feature of the invention, the terminals may also comprise at least one actuator, which is connected to the detection unit via the same interface as the terminal. Examples of possible actuators are barriers, gripper arms, servomotors for camera settings, etc. In this way, all data transmitting terminals used in such systems, such as cameras, radio beacons, billing stations, monitored barriers, etc., can be authenticated in a uniform, secure manner with respect to a central detection unit become .

Further features and advantages of the invention will become apparent from the following description of preferred embodiments. binding with the attached drawings. In the drawings shows:

1 shows the method for authenticating a terminal relative to a detection unit schematically in block diagram form,

2 shows the flow of the method of FIG. 1 in flow chart form,

Fig. 3 shows the method for storing the key by means of a dongle schematically in block diagram form, the Fig. 4a and 4b, the method of FIG. 3 in flow chart form, and

Fig. 5 shows the further processing of the detected data in the detection unit in combined block diagram and flow chart form. 1 shows a first embodiment of a method for authenticating a data-transmitting terminal 1 with respect to an associated data-receiving detection unit 3. In the example shown, several terminals in the form of cameras 1 are connected to the detection unit 3 via a communication link 2.

In each camera 1 is a key KeylκMd / Key2κM _< u etc. stored in a protected memory 4. The protected memory 4 is designed so that only the built-in camera 1 processor 5 can read the key. The key can not be read out via the communication link 2.

In the detection unit 3, an assigned key Keyl _EE , Key2 _E E, etc. is stored in a protected memory 6 for each connected camera 1. The protected memory 6 is designed so that only the processor 7 built into the detection unit 3 can read the key. The key can not be read via the communication link 2 or via another interface of the system. In a simpler variant, a single, shared key Keyl _{EE can be used} for all cameras 1.

Fig. 1 also shows an external trigger source 8. This is necessary when image acquisition is to be performed due to external events. It is irrelevant whether one or more trigger sources 8 are physically connected to the cameras 1 or the detection unit 3. If no external trigger source 8 is present, the image capture z. B. derived from the frame rate of the cameras 1 itself or triggered by the detection unit 3 generated trigger or requirements for the transmission of data.

1 shows a higher-level system 19. The images acquired by the cameras 1 and any image evaluation data 15 (see FIG. 5) are usually forwarded to other systems, such as the system 19 shown. This can be a single higher-level system 19 or the detection unit 3 can exchange data with several higher-level systems 19. The interface to the higher-level system 19 is designated by 18.

Fig. 2 shows the sequence of a data acquisition (here: image capture) with authentication of the terminal 1 (here: camera) with respect to the detection unit 3 in the following steps: 1st step: The detection unit 3 generates an authentication request A. The data of the authentication request A change prefers each time, u. zw. either randomly or after a fixed rule within a sufficiently large set of values to ensure that an imitation of authentication by listening to the communication link 2 is practically impossible.

2nd step: The detection unit 3 sends a request for the transmission of data (here: image request) together with the authentication request A to the camera 1. Step 3: The image request either refers to an image already taken by the camera 1 or triggers an image capture in it. The camera 1 is calculated with the value stored in the camera 1 and a key Keylκ _ÄM matched between the camera 1 and detecting unit 3 for calculation rule an encrypted authentication request as A *

A * = f (A, KeylκaM)

Step 4: The image data and the encrypted authentication request A * are sent from the camera 1 to the detection unit 3 as a response A *.

5th and 6th step: The detection unit 3 checks whether the answer A * ("actual answer") has been prepared with a key matching the key Keyl _EE stored in the detection unit 3. This can be done in different ways. In a first implementation of the method, the detection unit 3 executes the same calculation rule f with the same key as used in the camera 1 (i.e., Keyl _EE = KeylκMi) ι by a "target response" A * _SOLL

A * _SOL L = f (A, Keyl _EE )

and compares it with the response A * received from the camera 1. If the target response A * _SOLL calculated by the detection unit 3 coincides with the actual response A * obtained from the camera 1, then the camera 1 is accepted as authentic and the data D (see FIG. 5) transmitted by it is detected; otherwise the data D is discarded. The calculation rule f is carried out so that only with knowledge of the j eweiligen the camera 1 associated key Keyl _EE , or their key KeylκAM itself, the target response A * _SOLL can be calculated, d. H . the keys Keyl _EE or KeylκAM can not be derived from the messages exchanged between the camera 1 and the detection unit 3 with a practicable observation time with a reasonable computing effort. The calculation rule f can include both symmetric and asymmetric encryption methods. For example, in the camera 1 and the detection unit 3, keys KeylκAM, Keyl _E E, which are different from one another, can be assigned to each other. Key2κaM, Key2 _E E etc. be stored; alternatively, the keys are identical (KeylκAM = Keyl _E E, Key2κAM = Key2 _EE , etc.). Different keys KeylκAM _r Key2κAM etc. can be assigned to the cameras, or one and the same key can be used for all cameras 1 (KeylκAM = Key2 _EE = Key3κAM etc.).

Further modifications of the method described above are possible. For example, the detection unit 3 can decrypt the message A * received by the camera 1 with the inverse calculation rule f *, ie. H.

A _is = f * (A *, Keyl _EE )

and check whether the "actual answer" _{Aj.st corresponds to} the originally sent authentication _request A. A further alternative is that the detection unit 3 encrypts the authentication request A with its own key Keyl _EE assigned to the respective camera 1, that is to say in the case of FIG ,

A * = f (A, Keyl _EE )

and sends as an encrypted authentication request A * to the camera 1, which this with their key KeylκaM to

Aist = f * (A *, KeylKAM)

decrypted and as actual response A _{is returned} to the detection unit 3 for comparison with the original authentication request A.

In a further implementation variant, any authentication errors are reported to the higher-level system 19 in step 6 in order to immediately detect attempted manipulations of the system and to be able to derive further measures. In itself, it does not matter if the authentication is directly linked to the collection of the data. If z. B. If the system reliably detects temporary line interruptions and temporary shutdowns of the sys- tem or system components, it is sufficient to re-authenticate after every interruption detected. A further option is to ensure the authenticity of the terminals or cameras 1 by means of a sufficiently frequent authentication, but decoupled from the data acquisition process. Fig. 3 shows an embodiment of the method for securely importing or storing the keys, in order to prevent incorrect keys from being imported into the system via unauthorized access and thus manipulating the authentication. According to FIG. 3, in addition to the cameras 1, a special device, a so-called. "Dongle" 9, connected to the detection unit 3. The dongle 9 is preferably authenticated to the detection unit 3 according to the same procedure described for the cameras 1. The detection unit 3 is designed such that the key Keyl _{EE r} Key2 _EE , KeylKAM, Key2κAM, etc. is only possible if the dongle 9 is connected and a correct authentication of the dongle 9 takes place with respect to the detection unit 3. For the purpose of dongle 9, no image acquisition is expediently carried out.

If the camera system described is used in the context of large systems with remote maintenance access, the dongle 9 also has the advantage that key operator must be on-site for key storage, ie the key memory not only via the remote maintenance access, eg. B. the interface 18 to the parent system 19, can be performed. The on-site operator has the ability and the task to detect manipulation of the devices that make a secure key input impossible. In addition to this measure, the import of keys in a further implementation variant is possible only if the respectively previously stored keys, the so-called "old" keys, are known.Figures 4a and 4b show the procedure for the secure one Importing the keys in the following steps:

1st - 6th step: The dongle 9 is connected to the detection unit 3, and the detection unit 3 enters a key storage mode. The sequence of steps 1-6 (FIG. 4 a) for the authentication of the dongle 9 is analogous to that in FIG. 2 illustrated sequence. for Authentication of the Camera 1. If the authentication of the dongle 9 fails in step 6, the key memory is aborted; otherwise, the process moves to steps 7-10 (Figure 4b). 7th step: The previously stored in the detection unit 3, old key 3 Keyl _EE , _aL τ and to be stored "new" key Keyl _EE , _NEW for the detection unit 3 or KeylκAM, N _E u for the camera 1 via an external interface, such. B. by manual entry via a keyboard, sent to the detecting unit 3. If the authentication approximation method identical keys in camera 1 and collection ^■ sungseinheit 3 is used (i. e. _M = KeylκA Keyl _e e, etc.) , only a new key is sent to the registration unit 3, otherwise both new keys Keyl _EE , _NEÜ and

sent to the detection unit 3.

8th step: If the input old key Keyl _EE , _{aLT matches} the key stored in the detection unit 3, the detection unit 3 takes over the new key Keyl _EE , _NEÜ and _enters it in the protected memory 6, otherwise there is no entry of the new key possible. The process described ends with step 8.

Step 9: The detection unit 3 also transmits the camera 1 assigned new key Keylκ _AEM _N Eu to the camera. 1 Step 10: The camera 1 takes over the new key KeylκAM, NEW and enters it in the protected memory 4.

After completion of the key assignment, the dongle 9 is disconnected from the detection unit 3 and the system returns to normal operation.

According to the method described here, it is not necessary to protect the camera against manipulation of the keys by expensive security measures, because a terminal with a wrong key can not send pictures to the registration unit and thus there is no danger that manipulated or not authentic pictures in the Recording unit are recorded. Therefore, in step 10, when storing the key in the camera 1, an additional protection mechanism, e.g. B. that the old camera key KeylκAM, ALτ must be known to the key

i ⁿ the camera 1 to save, not required.

By applying the present method, it is possible to build a secure processing chain for the overall system and thus to achieve data security that has not hitherto been achieved in decentralized architectures. This is shown in FIG. 5, which will now be explained in more detail.

In Fig. 5, the acquired data (here: a picture) in the different stages of its processing chain is denoted by D, D ¹ , D ", D '" and D "". The image D is detected in the camera 1 and sent from it to the detection unit 3 where it exists as a received image D '. With known methods for detecting and correcting transmission errors between camera 1 and detection unit 3, it can be ensured that the received image D ^{1 is} not only authentic but also error-free. This ensures that the image D ', which is taken over in the detection unit 3, is largely identical to the image D.

In many cases, it is favorable from the captured image material, for. B. individual images or image sequences of one or more cameras 1, by means of an image analysis 10 statements about Bildin- by deriving that the image analysis 10 does not make any changes to the received images D 'and, by applying known operating system security mechanisms, the image analysis 10 itself prevents unauthorized manipulation is protected, further Auswertedateri 15, 16 and / or actions can be derived from the received image D ', which can also serve, inter alia, to influence the image acquisition process of the system itself. In Fig. 5 is such information flow to control the camera 1 z. B. drawn due to image content or evaluation data 16. The flow of information to the camera 1 is advantageously via the communication link. 2

The received image D 'is subsequently processed by a contrast enhancement 11 for the visual assessment (D ") and supplemented by additional information 12 being superimposed by readable additional information (D" ¹ ) _/ as will now be explained in detail.

In the contrast enhancement 11 is by a simple calculation rule, for. B. Multiplication of all pixel values with a constant number, a picture D "derived, which is easier for the viewer to interpret, for example, the brightness of the individual pixels, but not the image content is changed in terms of its meaning, so that the image D "'continues to authentically reproduce the scene. The contrast enhancement 11 can also be a preparatory processing step for any subsequent compression 13, especially as known compression methods often impair image information in dark image areas. A previous lightening reduces this influence.

The insertion of additional data 12 can z. For example, information may be obtained either by displaying information at predefined positions in the original image without carrying out further image manipulations, or by expanding the acquired image to the extent of a defined location where the display of the information is displayed. record data 12 is made. After inserting the additional data 12, the picture D "'results.

To reduce the bandwidth and memory requirements in higher-level systems 19 (Figure 1), it is often necessary to compress the image material. For compression (13) z. For example, a compression method corresponding to the prior art can be used with which a compressed image D "" is created from the image D ". Known methods at the operating system level can be used to protect the compression 13 against unauthorized manipulations ,

An optional signing stage 17 subsequently calculates, for example, a hash value from the image D "" and / or the additional data 12 and / or the evaluation data 15 and from this a signature with a secret key by means of an asymmetrical encryption method. The data or images D "", in particular if the associated additional and evaluation data 12, 15, can be protected against subsequent changes outside the detection unit 3.

The compressed image D "", the signature 17 and the evaluation data 15 are transferred to the higher-level system 19 at the interface 18.

The preceding illustrations describe the use of the method, in particular in imaging systems. The communication connection 2 to the camera 1 can be used not only for authentication, but also for setting, for example, the operating mode or the sensitivity of the camera or the intensity of the camera associated light source, the temperature in the housing of the terminal, etc. The data transmitting terminal 1 Accordingly, not only be a sensor (such as a camera), but also include a servo, control or servo member or a manufacturing cell in the field of industrial production, ie in general an arbitrary actuator. As used herein, the term "sensor" also includes multisensor terminals that may be used, for example, at multiple locations (e.g., stereo video, light curtains, etc.) and / or using various measurement principles (e. Laser, ultrasound, magnetism).

The collection of environmental data subsequently also includes the emission of information, for. B. the emission of a laser pulse for transit time measurement in laser sensors _i or radio waves. Another application of the method is therefore also in the authentication of communication terminals, z. B. Radio beacons in electronic access or toll systems whose task is to transmit data in accordance with defined communication protocols of third-party devices, such. As vehicle devices or RFID tags to read. It is both possible that the terminal 1 handles the entire communication protocol with the third party device independently, as well as that the communication protocol is handled with the third party device by ongoing data exchange between the terminal 1 and the detection unit 3; Also in this application, the authenticity of the terminal 1 can be ensured with the help of the presented method. The exchanged with the third party data can be z. B. be protected by encryption measures against unauthorized interception. ^'The presented method can be uniform in a variety or different terminals 1 (sensors, sensor / actuator combinations, actuators, communication units) may be employed, as well as at a plurality of identical or different acquisition units 3. In this way, z may. B. all terminals are authenticated in a complete access, toll or surveillance system consisting of a wide variety of detection and classification sensors, video cameras, communication units and associated acquisition units.

Claims

Claims:

1. A method for authenticating a data-transmitting terminal (1) against an associated data-receiving detection unit (3), characterized in that in the terminal (1) and in the detection unit (3) associated with each other, each not externally readable key (KeylκÄM, Key2κAM / Keyl _EE , Key2 _EE ) are stored so that the keys (Keyl _KAM , Key2κa _M , Keyl _EE , Key2 _EE ) are checked during ongoing operation via a coordinated calculation rule between terminal (1) and detection unit (3), and that only the data (D) of the terminal (1) from the detection unit (3) are accepted if the verification gives the authenticity of the terminal (3).

2. The method according to claim 1, characterized in that for verification of the key (KeylκA _Mf Key2 _κaM ; Keyl _EE , Key2 _EE ) during operation, the detection unit (3) creates an authentication request (A) and to the terminal (1) sends, - the terminal (3) with its key (Keyl ^ mr Key2 _KÄM ) encrypted and _{returns in} response to (A *) to the detection unit (3), wherein the detection unit (3) the authentication request (A) with their Key (Keyl _EE , Key2 _EE ) encrypted and compared with the received response (A *), the equality case indicating the authenticity of the terminal (1).

3. The method according to claim 1, characterized in that for verification of the key (KeylκÄM, Key2κAM, Keyl _EE , Key2 _EE ) during operation, the detection unit (3) creates an authentication request (A) and sends to the terminal (1), the Terminal (1) with its key (KeylκAio Key2κ _A M) encrypted and returns as a response (A *) to the detection ^¬ unit (3), wherein the detection unit (3) decrypts the answer (A *) with its key (Keyl _EE , Key2 _EE ) and compares it with the original authentication request (A), the equality case indicating the authenticity of the terminal (3).

4. The method according to claim 1, characterized in that for verification of the key (KeylKAM, Key2κAMJ Keyl _EE , Key2 _EE ) during operation, the detection unit (3) creates an authentication request (A), with their key (Keyl _EE , Key2 _EE ) encrypted (A *) and sends to the terminal (1), the terminal (1) this with his. Key (Keylκa _M , Key2 _KAM ) is decrypted and sent back as response (A) to the detection unit (3), wherein the detection unit (3) compares the response (A) with the original authentication request, the equality case verifying the authenticity of the terminal (1) indicates.

5. The method according to any one of claims 2 to 4, characterized in that the authentication request (A) is created on the basis of random or changing data.

6. The method according to any one of claims 2 to 5, characterized in that the terminal (1) sends its data (D) together with said response (A; A *).

7. The method according to any one of claims 2 to 6, characterized in that the authentication request (A, A *) comprises a request for the transmission of the data (D) of the terminal (1).

8. The method according to any one of claims 1 to 7, characterized in that for the key (KeylκMj / Key2κMyi) of the terminal (1) and the key (Keyl _EE , Key2 _EE ) of the detection unit (3) mutually different, mutually associated Keys are used.

9. The method according to any one of claims 1 to 7, characterized in that for the key (KeylκAM, Key2κMi) of the terminal ^¬ device (1) and the key (Keyl _EE , Key2 _EE ) of Erfas- (3) a key pair is used according to a private / public-key method.

10. The method according to any one of claims 1 to 9, characterized in that the key (Keyl _EE , Key2 _E E) of the detection unit (3) can only be stored therein when a dongle (9) to the detection unit (3 ) is connected.

11. The method according to any one of claims 1 to 10, characterized in that the key (Keyl _EE , Key2 _EE ) of the terminal (1) in the detection unit (3) is input and sent from this only to the terminal (1) and there is stored when a dongle (9) is connected to the detection unit (3).

12. The method according to claim 10 or 11, characterized in that the dongle (9) in the same manner as a terminal (1) relative to the detection unit (3) is authenticated and only in the case of authentication, the keys (KeylκÄMΛ Key2κÄii; Keyl _E E / Key2 _E E) are stored in the detection unit (3) or in the terminal (1).

13. The method according to any one of claims 1 to 12, characterized in that the keys

Key2 _KÄM ; Keyl _E Ef

Key2 _E E) can only be stored in the terminal (1) and / or the detection unit (3) if at least one previously stored therein key (Keyl _EE , _A Lτ) is entered for validation in the detection unit (3).

14. The method according to any one of claims 1 to 13, characterized in that the detection unit (3) is protected against external interference and manipulation of the detected data (D).

15. The method according to any one of claims 1 to 14, characterized in that the detected data (D) of a signal enhancement (11) supplied to increase the interpretability of the derivable from the data meaning.

16. The method according to any one of claims 1 to 15, characterized in that to the detected data (D) additional data (12) be added through the detection process itself and / or from the detected DA ¹ ^■ th (D) is itself derived supplementary data (15).

17. The method according to any one of claims 1 to 16, characterized in that the detected data (D) compressed (13) and / or by means of a digital signature (17) are protected against changes.

18. The method according to any one of claims 1 to 17, characterized in that the terminal (1) is a sensor, preferably a camera and the data (D) image data.

19. The method according to any one of claims 1 to 17, characterized in that, the terminal (1) is a radio receiver, preferably a radio transceiver over which a bidirectional information exchange between an external device and the detection unit (3) is handled.

20. The method according to any one of claims 1 to 19, characterized in that the terminal (1) comprises at least one actuator which is connected via the same interface (2) with the detection unit (3) as the terminal (1).