DE102019214364B4 - Method for operating a data processing arrangement and data processing arrangement - Google Patents

Abstract

Method for operating a data processing arrangement (10), with a network (12) to which at least one server computer (14) providing capacities and at least one first client computer (16) using available capacities are assigned as participants, and the server computer (14) and the at least one first client computer (16) are connected to one another via the network (12) in such a way that communication between the computers (14, 16) is permitted, with the following steps: a. Execution (S1) of an initiated data processing operation by the server computer (14); b. receipt (S2) of at least one execution result of the data processing operation of the server computer (14) by the first client computer (16); c. Presentation (S3) of the at least one execution result of the data processing operation of the server computer (14) by the first client computer (16) as a video signal; d. making available (S4) the video signal in the form of a serial digital video signal by the first client computer (16);e. Applying (S5) the video signal to a first data interface (20) outside the first client computer (16); f. providing (S6) processing means (30) for the video signal; g. Further processing (S7) of the video signal using the processing means (30), the processing means (30) being formed by an image acquisition device (36) which is assigned to a second client computer (18), the processing means (30) using a character-based and /or graphically displayable content of the video signal is transferred at least indirectly to an interpreting program on the second client computer (18), and further processing of the content of the video signal is initiated by means of the interpreting program on the second client computer (18).

Description

The present invention relates to a method for operating a data processing arrangement, with a network to which at least one server computer providing capacities and at least one first client computer using available capacities are assigned as participants, and the at least one server computer and the at least one first client computer being connectable or connected to one another via the network in such a way that communication between the computers is permitted. In addition, the invention equally relates to a data processing arrangement with which the method according to the invention can be carried out.

Data processing devices connected in a network in the form of client computers and server computers are ubiquitous today, since many operations and processes in everyday life are already based on the exchange of information, whether it is mainframe computers exchanging or comparing or even just that a single user initiates an information query via a single computer or his smartphone, tablet or other "small computer", for example in the form of a search query on a corresponding search engine, makes purchases in a shop as well as on the Internet or in the broadest sense handles its payment transactions. There is regular access to a server computer which is attempting to answer the relevant information query by accessing an information stock stored in storage media directly available to it or in third-party databases.

Also you know from the U.S. 2017/0237986 A1 a video coding method and an electronic device adapted to perform this method. Here, the electronic device comprises the necessary facilities for making a video call via a wireless communication circuit, and the method relates to the establishment of the corresponding video stream. The photoTAN procedure is also known from the Wikipedia article on "Transaction number" from September 17th, 2019.

Unfortunately, the networks in question are not exclusively used by users with noble intentions, so that a threat to both individual network participants and entire infrastructures from so-called malicious programs is omnipresent. Some examples of this are programs that can be used to carry out so-called (D)DOS attacks (acronym for (Distributed) Denial of Service) and thereby paralyze individual data processing devices as well as entire systems, such as subnets, despite protective measures being taken beforehand. One could also think of blackmail in the form of ransomware, e.g. so-called crypto-Trojans, which encrypts one's own data and only releases the key required for decryption in return for payment of a sum of money. After all, there is a large amount of spy software that is able to spy on databases in order to gain competitive advantages from the knowledge advantage, for example.

What the scenarios described have in common is that a computer as a data processing device cannot, of course, per se initially distinguish whether an instruction that may be addressed to it is in the interests of its owner or not. Therefore, future security gaps cannot be ruled out either in the area of system or application programs. With today's connection technology, there will always be opportunities to attack computers or databases.

As soon as there is a direct physical connection, for example via the Internet, but also in closed networks, between two data processing devices participating in the respective network, many different programs run in the background, which, due to the security gaps described above as examples, allow malicious code to be embedded in a Smuggling in client computers as participants and gaining access to their possibly usable data. Of course, this also applies to threats from a computer that is qualified as a participant in the respective network if the network otherwise appears to be isolated from the "outside".

Against this background, the present invention has the object of providing a method and a device which, independently of the respective network architecture, allows a reliable, secure answer to an information request from a client computer to a server computer, without any participant on the network based on the specific request or another data processing operation, gains access to or control of data to be processed on the client computer or instructions initiated by it.

This object is solved by the features of the independent claims. The solution consists in particular in that in the method an initiated data processing operation is carried out by the at least one server computer, through the at least one first client computer at least one execution result of the at least one server computer is received then the at least one execution result of the server computer is displayed by the at least one first client computer as a video signal, and this makes a video signal available in the form of a serial digital video signal, after which the relevant video signal is transmitted to a first data interface outside the at least a first client computer is present, with the data processing arrangement providing processing means for the video signal, by means of which the video signal is further processed.

The invention consists in particular in preparing an electronic response coming from the server computer to a query or another data processing operation or a result graphically on a first client computer and displaying it as screen content and then forwarding this information as a serial digital video signal, i.e. making the video signal available as a data flow at the data interface, where it can be tapped for further processing. However, this in turn also means that the signal then available does not provide for further, at least immediate, electronic processing. In this way, access to data or structures of a second client computer, which can further process the video signal provided, is not possible, while, as already mentioned, the first client computer is responsible for graphically displaying the result of an external data processing operation processed and displayed identically and to provide the pure video signal as a result of this processing. However, it is also possible to simply display the video signal without an additional client computer.

Further advantageous configurations can be found in the dependent claims.

The processing means can be formed by an image acquisition device that is assigned to a second client computer. On the other hand, a second client computer can be provided on which either a graphic representation of the video signal or another type of processing is provided. An image acquisition device is provided on this as a video signal input in order to be able to further process the signal. This can be a kind of grabber that “reads in” the video signal for the second client computer. However, in contrast to the usual understanding of the term "frame grabber", no analog/digital conversion takes place, since the signal is already available in digital form. In the present case, grabber means a kind of “image capturing device”. In terms of possible further processing of data transported with the video signal, it is conceivable here for the video signal to depict a code, for example a QR code. However, other codings are also conceivable. For example, individual characters or strings of characters can be copied from the video display to a clipboard and in this way text can be transferred to the second client computer. For the purposes of the foregoing, the first client computer may be considered and referred to as an unprotected computer, while a second client computer is a protected computer in nature.

Reliable transmission of the video signal at the data interface is ensured by a variant of the method in which a Transition-Minimized Differential Signaling (TMDS)-compliant video signal, in particular an HDMI signal, is transported and possibly processed as the video signal. In this case, a sufficiently large bandwidth of the video signal is provided, which is transmitted in transmission lines in which, for example, one line can be provided for each color channel and whose bandwidth is in the order of magnitude of a few Gbit/s. This can also be used to transmit high-resolution video signals, e.g. with 1900 x 1200 pixels, with a refresh rate of 60 Hz. For the respective possible data rates and the like, reference can also be made to the individual HDMI specifications.

In terms of further processing of data, at least one character-based and/or graphically displayable content of the video signal can be transferred at least indirectly to at least one interpreting program of the second client computer in the method according to the invention by means of the processing means. This interpreting program can be, for example, an interpreter for code, which can extract a QR code from the video signal, for example. Insofar as the interpreting program is to initiate further measures based on the code read out, safety queries can expediently be provided before further execution, which can or even have to authorize the further measures. On the one hand, the character-based content mentioned can actually be pure so-called "characters", i.e. letters, numbers or special characters. On the other hand, however, this can be provided with a type of formatting, which can be, for example, links in the sense of mathematical conjunctions of basic arithmetic operations or even formulas. Structured formats, which could be assigned to commercial software as permitted commands, are also conceivable. Just think of the “Excel” software from Microsoft as an example. In addition, other such formats are conceivable.

Advantageously, the at least one interpreting program of the second client computer can be used to initiate further processing of the content of the video signal. Very different types of further processing are conceivable, from a further query to be initiated on a server computer, to archiving of representations of the video signal, to the initiation of specific measures in the physical world, which can be based on coded instructions transmitted with the video signal. Here, too, automated, approval-free processes are just as grateful as those that have to be authorized.

For example, in an expedient variant of the method, the content(s) of the video signal can be further processed by data processing devices separate from the second client computer, for which purpose instructions are issued by the second client computer, which had interpreted the video signal to this effect.

Here, in an advantageous variant, the character-based and/or graphically displayable content can be transferred back to the first client computer or to another network participant by the interpreting program via a second data interface that is independent of the first data interface. It would be conceivable at this point, for example, for a command wrapped in a QR code to be returned to the first client computer for execution.

In another advantageous variant of the method according to the invention, signals intended for further processing can be caused by peripheral devices of the second client computer or instructions output by the interpreting program. Peripheral devices can be input devices such as keyboards, mice, digital pens or the like, which can be connected to the second client computer via a serial interface.

As already described, the instructions from the second client computer are passed back to the first client computer in a return channel in the form of control commands/control signals, with this return channel being unidirectional in order to initiate further data processing operations on the first client computer, for example or to have control commands for this passed on by the latter.

In an advantageous variant, the first and the second client computer can be of modular design and can therefore be arranged at a distance from one another. They can just as well share a housing with one another, but be separated from one another and only connected to one another via the interface at which the graphics signal is present. In both variants, the two computers can in particular be designed to be portable, as a result of which they can be quickly integrated into any network structures.

The object set at the outset is also achieved by the arrangement according to the invention, in which the at least one server computer executes at least one initiated data processing operation, the at least one first client computer receives at least one execution result of the at least one server computer, and the at least one first client computer which outputs at least one execution result of the server computer in the form of a video signal, the at least one first client computer providing a video signal in the form of a serial digital video signal and the video signal being transmitted to a first data interface outside the at least one first Client computer is applied, and wherein the data processing arrangement at the data interface provides a processing means for the video signal and the processing means further processes the video signal.

At least one second client computer can receive the video signal and process it further using a processing means. Since no data processing in the conventional sense takes place on the second client computer, but only the presentation/processing of a visual result of data processing on the first client computer, the second client computer is a type of protected computer. A text transfer is only possible by copying characters or character strings to a clipboard (copy/paste).

Another advantageous development of the data processing arrangement according to the invention can consist in the data interface being connected to a universal serial bus of the at least one second client computer, with which the digital serial video signal provided by the first client computer is transmitted from an HDMI -Bus is converted to a digital data bus in the form of the USB bus of the second client computer.

In the sense of a lack of manipulation possibilities, the video signal provided by the first client computer is advantageously converted by the data interface to the universal serial bus of the at least one second client computer in binary-identical form. In this case, there is only one data flow from the HDMI bus to the USB bus, with the data not being changed, i.e. being binary identical. The HDMI bus, by the way, too could transport audio data is in principle bidirectional, and the processing means (“grabber”) is also able to communicate with the monitor output of the first client computer, for example, but there is no function to collect data from the USB bus of the second client computer and forward it to the HDMI bus. The data interface can therefore be regarded as “quasi-unidirectional”.

It is advantageous that the first client computer that is "exposed" to the network can be viewed as a kind of victim computer whose only task is to graphically process the results and display them as a video signal. For this purpose, the first client computer in question has, in addition to its graphic display options, at least one processor and a non-volatile, self-contained memory area, the readout of which provides the coupter with the capabilities required for an activity. At least one additional, volatile memory area can of course be provided for data processing. Should this first client computer be compromised or have other problems, the easiest thing to do is to simply switch it off and a few moments later "clean" it up again in the same, self-selected configuration and put it back on the network.

In preferred developments of the data processing arrangement according to the invention, the processing means is provided with a display means designed in particular as a display device and/or with an image acquisition device. A particularly preferred display means is, for example, a monitor and a particularly preferred image capture device is a type of "grabber", as already mentioned above, but on which no A/D conversion takes place, only image capturing.

In order for the second client computer to communicate, in an expedient embodiment it can be connected to at least one serial interface, which forwards instructions originating from it to participants in the network. This can be an RS232C interface, for example, but other serial interfaces are also conceivable. Instructions from the second client computer go out via the serial interface, which in turn takes place unidirectionally, after which the corresponding signals on the first client computer must in turn be converted to its data bus

In one embodiment of the data processing arrangement, the at least one second client computer can advantageously be provided with at least one input device for generating instructions. This can be a keyboard, mouse, pen or similar device.

Further advantageous refinements and developments result from the further dependent claims and from the description with reference to the figures.

The above configurations and developments can be combined with one another as desired, insofar as this makes sense. Further possible configurations, developments and implementations of the invention also include combinations of features of the invention described above or below with regard to the exemplary embodiments that are not explicitly mentioned. In particular, the person skilled in the art will also add individual aspects as improvements or additions to the respective basic form of the present invention.

• 1 eine schematische Darstellung der Verfahrensschritte des erfindungsgemäßen Betriebsverfahrens eine Datenverarbeitungsanordnung; und die
• 2 ein schematische Darstellung einer Datenverarbeitungsanordnung mit einem Netzwerk, einem Server-Computer, einem ersten Client-Computer, einer Datenschnittstelle und einem zweiten Client-Computer.

The present invention is explained in more detail below with reference to the exemplary embodiments given in the schematic figures. They show:

• 1 a schematic representation of the method steps of the operating method according to the invention a data processing arrangement; and the
• 2 a schematic representation of a data processing arrangement with a network, a server computer, a first client computer, a data interface and a second client computer.

The accompanying figures are intended to provide a further understanding of embodiments of the invention. They illustrate embodiments and, together with the description, serve to explain principles and concepts of the invention. Other embodiments and many of the foregoing advantages will become apparent by reference to the drawings. The elements of the drawings are not necessarily shown to scale with respect to one another.

In the figures of the drawing, elements, features and components that are the same, have the same function and have the same effect--unless stated otherwise--are each provided with the same reference symbols.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a, an, an"; and "the" also include the plural forms, so long as off the context does not make it clear otherwise. Further, it is to be understood that the terms "comprises" and/or "comprising" when used in the present specification indicate the presence of the recited features, numbers, steps, operations, elements and/or components/fittings, but not exclude the presence or addition of one or more features, numbers, steps, operations, elements, components/ingredients and/or groups thereof. As used herein, the term "and/or" includes any and all combination of one or more of the listed items associated therewith.

In the 1 one can first see a schematic representation of the method according to the invention with its method steps S0-S7. The method step S0 shown in dashed lines indicates an upstream step that does not actually belong to the method, in which the server computer 14 is prompted to carry out a data processing step, but this is not necessarily caused by one of the client computers 16, 18 involved in the method must be, but can be.

The following steps can then be identified for the method according to the invention: A step S1, in which the at least one server computer 14 initiates the execution of a data processing operation, followed by a step S2, in which an execution result of the data processing operation of the at least one server computer Computer 14 is received by the at least one first client computer 16, after which in a step S3 the at least one execution result of the server computer is displayed by the at least one first client computer 16 as a video signal. In a subsequent step S4, the video signal is made available in the form of a serial, digital video signal by the at least one first client computer 16 and is then applied to a first data interface 20 outside of the at least one first client computer 16 in a step S5. In a subsequent step S6, the data processing arrangement makes available a processing means 30 for the video signal, after which the video signal is further processed by means of the processing means 30 in a step S7. The dashed line following step S7 is intended to indicate that further steps can optionally follow.

Now the 2 turning, one recognizes in this the data processing arrangement 10 according to the invention with a network 12, which use a server computer 14 providing capacities and at least one available capacity since first client computers 16 are assigned. The server computer 14 and the at least one first client computer 16 are connected to one another via the network 12 in such a way that communication between the computers 14, 16 is permitted.

When the method according to the invention is carried out, the at least one first client computer 16 receives an execution result of a data processing operation of the server computer 14 and presents this as a video signal, which is 2 should be indicated by the screen 22 connected to the at least one first client computer 16 by dashed lines. The corresponding video signal can represent the content of the screen 22 approximately pixel by pixel, with each pixel of the screen being assigned a position and a color value.

The at least one first client computer 16 then makes the video signal available in the form of a serial, digital video signal and applies it to a data interface 20 located outside of the at least one first client computer 16, using the HDMI bus 26 as a means of transport for the serial digital video signal.

The video signal present can be further processed at the data interface 20 by means of a processing means 30 . The relevant further processing can consist, for example, of simply showing the video signal that is made available on a screen 24 (monitor) and of visually transmitting the information transported using the video signal. The transported information can consist, for example, of an image, image sequences or coded information, for example in the form of a QR code.

A further possibility for further processing the video signal present at the data interface 20 can consist in converting the video signal from the HDMI bus 26 to the USB bus 28 of the second client computer 18 in order to display the video signal processed by the second client computer . For example, the second client computer 18 can be a notebook computer, on the screen of which the video signal is displayed. In this case, the processing means 30 consists of a “capturing device” 36 assigned to the second client computer 18, which appropriately processes the video signal for display on the small computer without an A/D conversion taking place in the process.

Finally one recognizes in the 2 further that the data processing arrangement 10 according to the invention also for the second client Compu ter 18 provides a way to transfer character-based (in the sense of "character") information, for example by means of a text consisting of one or more character strings, via a clipboard 32 (clipboard), into which the information in question is copied, from the at least one first Client computer 16 to take over. The character-based information in question is ultimately nothing more than a graphic representation of information.

It can therefore be seen that the data processing arrangement according to the invention and the method according to the invention for its operation create a possibility of transmitting information to a client computer 18 and nevertheless isolating it from harmful influences that would exist if a data connection existed. An obvious conceivable information transmission scenario can be designed, for example, such that a program is executed on the first client computer 16, which is designed, for example, as a web browser that makes requests to a server computer 14 located somewhere in the network 12, which it answers . Actual data processing operations usually take place on the server computer 14, while the first client computer 16 is responsible for the execution result of the data processing operation or data processing operations on the server computer 14 as a visual result on the protected or isolated second client computer 18 to pass on. Conversely, the first client computer 16 can be prompted by the second client computer 18 via a unidirectional return channel 34 to execute commands, which this will usually only pass on. Such a command can, for example, be a request (http request) to a website.

Overall, the present invention therefore provides a method by which a second client computer 18 is isolated from data processing operations within a network 12 by showing it the results of data processing operations of a server computer 14 within the network as graphic information in the form of a video signal a first client computer 16 are made available, the video signal being present at a data interface 20 for further processing.

Furthermore, the present invention also creates a data processing arrangement (10) for carrying out the method.

Reference List

S0-S7

process steps

10

data processing arrangement

12

network

14

server computer

16

first client computer

18

second client computer

20

data interface

22

Screen

24

screen, display device

26

HDMI bus

28

USB bus

30

processing means

32

Clipboard

34

return channel

36

“capturing device”, image capturing means

Claims (12)

Method for operating a data processing arrangement (10), with a network (12) to which at least one server computer (14) providing capacities and at least one first client computer (16) using available capacities are assigned as participants, and the server computer (14) and the at least one first client computer (16) are connected to one another via the network (12) in such a way that communication between the computers (14, 16) is permitted, with the following steps: a. Execution (S1) of an initiated data processing operation by the server computer (14); b. receipt (S2) of at least one execution result of the data processing operation of the server computer (14) by the first client computer (16); c. presentation (S3) of the at least one execution result of the data processing operation of the server computer (14) by the first client computer (16) as a video signal; i.e. making available (S4) the video signal in the form of a serial digital video signal by the first client computer (16); e. Applying (S5) the video signal to a first data interface (20) outside the first client computer (16); f. providing (S6) processing means (30) for the video signal; G. Further processing (S7) of the video signal using the processing means (30), the processing means (30) being formed by an image acquisition device (36) which is assigned to a second client computer (18), the processing means (30) using a character-based and /or graphically displayable content of the video sign is passed at least indirectly to an interpreting program on the second client computer (18), and further processing of the content of the video signal is initiated by means of the interpreting program on the second client computer (18). procedure after claim 1 , whereby a Transition-Minimized Differential Signaling (TMDS)-compliant video signal is transported and possibly processed as the video signal. procedure after claim 2 , the video signal being in the form of an HDMI signal. Procedure according to one of Claims 1 until 3 , wherein the content or contents of the video signal are further processed by data processing devices that are separate from the second client computer (18). Method according to one of the preceding claims, wherein the character-based and/or graphically displayable content is transferred back to the first client computer (16) or to another network participant by the interpreting program at a second data interface independent of the first data interface (20). Method according to one of the preceding claims, in which signals intended for further processing are caused by peripheral devices of the second client computer (18) or by instructions output by the interpreting program. Data processing arrangement (10) for carrying out an operating method with a network (12) to which at least one server computer (14) providing capacities and at least one first client computer (16) using available capacities are assigned as participants and the server - the computer (14) and the first client computer (16) can be or are connected to one another via the network (12) in such a way that communication between the computers (14, 16) is permitted, wherein the server computer (14) executes at least one initiated data processing operation, wherein the first client computer (16) receives at least one execution result of the server computer (14), wherein the first client computer (16) outputs the execution result of the server computer (14) in the form of a video signal and makes it available in the form of a serial digital video signal, wherein the serial digital video signal is present at a first data interface (20) external to the first client computer (16), and the data processing arrangement (10) providing processing means (30) for the video signal at the data interface (20) and the processing means (30) processing the video signal further wherein the processing means (30) is formed by an image acquisition device (36) which is assigned to a second client computer (18), wherein the processing means (30) transmits a character-based and/or graphically displayable content of the video signal at least indirectly to an interpreting program on the second client computer (18), and wherein the interpreting program of the second client computer (18) causes further processing of the content of the video signal. arrangement according to claim 7 , The data interface (20) being connected to a Universal Serial Bus (28) of the second client computer (18). arrangement according to claim 8 , The data interface (20) converting the video signal provided by the first client computer (16) to the universal serial bus (28) of the second client computer (18) in a binary-identical manner. Arrangement according to one of Claims 7 until 9 , wherein the processing means (30) is provided with a display means (24) and/or with an image acquisition device (36). Arrangement according to one of Claims 7 until 10 , The second client computer (18) having at least one serial interface which forwards instructions originating from this to participants in the network (12). Arrangement according to one of Claims 7 until 11 , wherein the second client computer (18) can be provided or is provided with at least one input device for generating instructions.

Images