EP2780856A1

EP2780856A1 - Method for securely searching, finding, reproducing, recovering, and/or exporting electronic data

Info

Publication number: EP2780856A1
Application number: EP12788182.9A
Authority: EP
Inventors: Jerry John Artishdad
Original assignee: Artec Computer GmbH
Current assignee: Artec Computer GmbH
Priority date: 2011-11-15
Filing date: 2012-11-14
Publication date: 2014-09-24
Also published as: US9450948B2; DE102011055384A1; US20140317412A1; WO2013072365A1

Abstract

The invention relates to a method which can be used for securely searching, finding, reproducing, recovering, and/or exporting electronic data from at least two systems which can be found in a network and which are organized in a functionally identical and decentralized manner. In the method according to the invention, the individual systems are provided with a system certificate and a corresponding serial number by the manufacturer and can carry out an authentication process using said system certificate and serial number. Furthermore, information is provided on user authorizations between the systems using configuration tables which are stored on each of the systems. A maximum level of security is ensured by combining cryptographic methods and the mutual authentication of the involved systems. Additionally, a user interface is provided for the user, wherein the user receives a pre-selection of the requested electronic data in the user interface and can then mark the pre-selection for further processing. A protection of the bandwidth is guaranteed by an adept exchange of data between the systems which can be found in a network and each of which is participating in the method. Additionally, it is possible to recover and/or export the selected data in a corresponding manner by means of the design of the system according to the invention.

Description

A method for the secure searching, finding, reproducing, restoring and / or exporting of electronic data

The present invention includes a method for securely searching, finding, playing, restoring, and / or exporting electronic data. In particular, a method is to be created here which makes it possible to record electronic data in a group of functionally equivalent and decentrally organized systems and to provide it to one or more users.

According to the state of the art, it is known that electronic data can be suitably processed by means of appropriate databases and electronic data processing systems. In the classical sense, this involves a so-called "client-server model", whereby the client makes a request to the server, a so-called request to a service of the server and waits for the response of the server, the so-called response, before the client As a rule, the fields of application of the respective databases are adapted to the needs of the application.

For quite some time, however, a completely new concept in information technology has opened up: so-called "cloud computing." The concept of this development promises great potential since software and data are no longer processed or stored locally, but in a completely external and With this emerging technology, it is also possible to outsource complete hardware and software systems in the so-called cloud and thus provide the required IT services in real time as a service over a network such as the Internet and charged after each use. Of course, this "outsource technology" not only has advantages, but also disadvantages, which are reflected massively in the context of data security and reliability. Thanks to modern business and office structures, networked work has become one of the pillars of business success, and as a result, thinking about the same structures and associated hardware and software is no longer or hardly conceivable. The majority of office work today is usually handled by electronic data processing equipment in conjunction with a variety of programs and systems.

An essential element of communication in business and office life is the electronic correspondence, which is a suitable e-mail program in conjunction with an input device such as computer, laptop, Blackberry systems, tablet PC, etc. an integral part of the modern communication is. Of course, not all information structures of modern office work are covered by the modern electronic means of communication and thus it is understandable that in addition the classic postal letter and the fax still have a quite respectable value in almost every business and office structure.

With new and modern possibilities of data acquisition and archiving, it is hardly surprising that the combination of modern data processing and the classical letter / facsimile has been introduced by optical character recognition (OCR).

In this case, in addition to the classical archiving systems, such as filing and appropriate introduction of identification elements such as file numbers or the like, the document in question scanned by means of a suitable external peripheral device and performed by a so-called OCR software, an optical automatic text recognition and optionally an automatic text correction. Of course, the document, which is now available electronically, can now be incorporated into existing archiving systems, or sent worldwide by e-mail without any time delay. This described "electrification" of the classic business data, the essential in modern office life method of electronic archiving of data beyond. In this case, suitable IT infrastructures make it possible to archive any data arising in everyday business such as e-mails, telephone calls, etc. The possibility of including, for example, postal correspondence and facsimile in an electronic archiving or data system is given due to the above description in full extent.

A fundamental advantage of such an archiving system for electronic data is the fact that the electronic data in its entirety generates a replica and is stored accordingly in the electronic archive. This standardized methodology now allows, regardless of the operating system of the respective serving an all-inclusive backup of the electronic data, which ensures high reliability due to the fact of archiving the replicas. As a rule, these secured replicas can be restored at any time and thus, in the event of a failure of the serving, the last known state of the electronic data can be restored immediately.

In order to make full use of the possibility of electronic archiving, however, suitable IT infrastructures are additionally required, which make it possible to access already archived data again and not only to find specific data via this infrastructure, but also to make it available to the respective user. that this requested data is provided in a prepared and readable form. Since these archives can achieve corresponding dimensions depending on the size of the company, the internal organization of the archive, as well as the simplicity of restoring the requested data, play a decisive role.

Since the complete scope of all electronic data in a company, which includes an amalgamation of various technical, primarily independent electronic systems, ad hoc can not be detected so easily, this poses a difficult task to the IT infrastructure. However, if the required electronic data can not be found either on the local workstation (client) or on the archiving system provided for it, the employee concerned often has no other choice but to obtain the required data through inquiries and research. This research is often very time consuming and, for example, in companies that operate globally, not profitable from the point of view of spatial distance in the economic sense, since the result is in no relation to the effort involved. However, exactly such a search may be necessary and a corresponding uneconomic productivity must be accepted.

Due to the globalization of companies and the associated decentralization of locations, it must be expected that the flow of information in this area may be further restricted in the future and that the aforementioned uneconomic productivity may need to be sustained over the long term. Obviously, massive disadvantages arise here from the state of the art, which are evidenced by the fact that the structures mentioned above must have a central data processing system per se, or are of little trustworthiness from a security-technical point of view. This globalization of companies has made it known from practice that globally active companies, which also have several geographically dispersed branches or subsidiaries, may experience problems with the storage and transmission of data in accordance with the laws of each country. For example, Directive 95/46 / EC on the protection of individuals with regard to the processing of personal data and on the free movement of data creates problems, for example because it provides for a general ban on the transfer of personal data from EU Member States to states that do not have access to a level of data protection that is equal to EU law. The central dogma here is the location of the respective data.

Another aspect of the job, of course, is to upgrade existing infrastructure in conjunction with prevailing current and future standards to use and thus to create a method that allows even in a few years, a quick and uncomplicated if possible handling for the user, but still loses none of its security and is expandable at any time without much effort.

This task is far from being achieved by the prior art, since this is either processed via a client-server system and thus has a central data processing unit, which may be redundant, but is not immune from attacks from the outside, as in a successful attack on the server system the rest of the system is no longer operational. The situation is similar with the already mentioned cloud solution, in which all data and even the corresponding software are partially or completely outsourced to the cloud solution. In terms of data security, this also does not seem to be an ideal solution. The basic effort that would have to be made to make this state of the art data-safe, fail-proof and above all so expandable is exorbitant. From practice it is known that in said method, the existing infrastructure at an increase in the structure at considerable expense and time required to be adjusted in order to ensure the user a trouble-free work. This warranty often requires an all-in-one approach to complete centralized information management, which involves a significant amount of extra work and potential integration issues with the existing system. On the other hand, for example, a migration of subsystems also generates massive problems in terms of effort. The centralized overall data would have to be separated in a migration case and further processed accordingly. In this respect, the divestment of company parts, including the corresponding electronic data, would not be to be despised, even with regard to the financial expenses for the separation of the centrally stored data.

From the prior art, it is now known that central data processing stations are used to manage client-server systems and centralize the respective clients with corresponding information. te server are supplied. This centralization obviously gives rise to some massive disadvantages. Thus, in the case of maintenance, either adequate replacement must be provided, or the time of maintenance must be adapted to the day-to-day work. This can lead to massive problems in globally active companies, such as finding a suitable worldwide maintenance window. An unforeseen systemic disaster can, in the worst case, lead to a prolonged loss of company productivity and would be associated with corresponding financial power files. For example, the addressed systemic disaster may result from active attacks on the centralized server, as well as from a failure of a centralized system or failure of a data service. Basically, however, in any case the entire system is affected by the failure and maintenance or data recovery can be very cost-intensive in this case. Even an extension of the system can lead to significant difficulties during operation.

Against this background, it is the object of the present invention to establish a method which makes it possible to use electronic data or archived electronic data, which are stored on at least two integrated, functionally equivalent and decentrally organized systems, by means of a secure method to search, find, reproduce, restore and / or export.

A method has been found for securely searching, finding, reproducing, restoring and / or exporting electronic data from at least two interconnected, functionally equivalent and decentrally organized systems comprising at least the following steps: a. Encrypted request for the requested data between at least two functionally equivalent systems, which in themselves have a layer model and consist of at least one presentation layer and one data access layer, b. Authentication of the requested query and / or the user, which is checked by the presentation layer of the requested system,

c. Execute the authenticated request,

d. Verification of the result and encrypted transmission of the relevant requested data, and

e. Presenting and / or processing the requested results. As can be seen in FIG. 1, the layers, which in this embodiment are made up of the presentation layers PA or PB and data access layers DA and DB, respectively, can contain a plurality of components. The data access layer D may, for example, consist of an archiving component 2A, a database 3A, a search server 4A, an indexing system 5A and an index 6A. This combination of components results from the requirements of the respective system and is therefore not to be seen as limiting. FIG. 1 further shows the schematized system according to the invention, which consists, for example, of system A and system B, which in principle have the same functional configuration. The respective system located in the system network, eg system A, comprises at least one presentation layer PA, which is preferably connected to the data access layer DA. As can be seen by way of example in FIG. 1, the presentation layer PA is connected to a database 3A. Furthermore, there is an advantageous connection to the search server 4A, which in turn can access an index 6A. The index 6A itself is not only read by the search server 4A, but may also be described by the indexing component 5A. As can be seen from Figure 1, this basic structure applies to the other systems in this system composite. The schematically illustrated embodiment of two systems likewise has the respective request 1 from system A to system B, as well as the corresponding answer 2 from system B to system A, which have also been shown schematically in FIG. Basically, an encrypted transport protocol such as HTTPS is used in the method according to the invention. As an example, HTTPS has the advantage of protecting all transmitted data from being read and modified by symmetric encryption and keyed hash message authentication code (HMAC), the design of which is based on a cryptographic hash function. Another advantage of using HTTPS, which is of course only given as an example here is that it creates a session key, which will be destroyed depending on the selected protocol variant after the end of the communication and so also no information about the content of the respective encrypted communication. In addition, data is not only encrypted, but also protected against change, for example, since the internal sequence of the data is also secured so that data contents can neither be interchanged nor taken out. Thus, with a protocol such as HTTPS, a standardized and effective cryptographic data protection would be achieved. Preferably, HTTPS should be used in the method according to the invention since this is an established secure industry standard whose security is comparable to that of a VPN technique such as IPSec. Of course, the use of HTTPS therefore has some advantages that ensure safe and robust operation of the process. However, the preferred embodiment in HTTPS should not be considered as limiting, since in principle any encrypted transport protocol could take the place of HTTPS and this represents only a preferred embodiment. The security aspect, which can not be solved via encryption, for example, is that of the authentication of the respective systems or the user. In principle, the method according to the invention is based on the fact that all systems in the network are fundamentally suspicious of one another. This basic mistrust creates a security standard based on the fact that even in the case of a compromised system, access to the corresponding other systems is only possible within the scope of the respective authorization. In the present invention, certificates are preferably used for this purpose, which for example by means of a "Public key infrastructure" and the corresponding combination of certificates and associated private key is usually included in such a system a private key and a certificate with a public key.This certificate is signed by a certification authority, including this The public certificate of the certification authority (root certificate) is widely publicized so that anyone can check the certificates An important consideration here is that the server addresses and names and other attributes contained in the certificates are not changed or changed by the user ., because they are drawn with the root certificate's private key.

In principle, each system of the method according to the invention in the production of the manufacturer contains a unique serial number. The manufacturer can preferably operate a certification authority which automatically issues a certificate to the respective system during production. In order to ensure the most secure access to the system, it is generally particularly advantageous that access to the web interface via HTTPS can be performed, and in this regard, an advantageously executed certificate can be used, for example, already by the manufacturer on the device can be installed. Since, at the time of production, it is generally not yet known in which environment the system is integrated, it is advantageous if this certificate is an intermediate certificate which can be used by the system itself in order to obtain a specific certificate. witness and sign when bound at its destination or at its destination domain. For example, one or more IP addresses or DNS names can be processed by the system from the intermediate certificate in such a way that the intermediate certificate stored is used to create a full certificate when it is integrated into an existing network, via which a HTTPS-secured web interface of the system is provided can be. In an advantageous embodiment, the manufacturer can already provide the respective certificates with corresponding serial numbers. In addition, this certificate can be submitted in the event of subsequent integration of a system without a corresponding certificate, for example as part of an update. It can be regenerated once by the manufacturer and with the help of a database flag it is ensured that this is only possible once per system and thus any possible misuse can be ruled out. Because the private key used to issue the certificates is the exclusive property of the manufacturer or a manufacturer's certification authority, no serial number can be changed or modified by the user. Based on this serial number, which can only be assigned by the manufacturer, a secure authentication is possible. An attacker is therefore unable to compromise this serial number in a way that is advantageous to him. Furthermore, this also means that this certificate can also be used in conjunction with HTTPS as a so-called "client certificate." This could be used, for example, to authenticate to another system, for example, another certificate could also be used for this purpose. which is advantageous for authentication via a serial number, and which was very advantageously generated by the manufacturer of the system during production, but this certificate can also be supplied later as part of an update.

This advantageous embodiment also makes it possible to integrate exchange systems, which take the place of defective or in-service systems, so that the exchange system can be integrated without security concerns or additional expense. To do this, the manufacturer must essentially introduce the corresponding certificates into the respective system before integrating the corresponding system. Advantageously, these certificates contain the corresponding serial number and the respective system can be easily integrated into the network. This new certificate now contains an original serial number, such as one Exchange system or a standby system without further problems to use the original serial number for the certificate.

Of course, a used system, possibly coming from another federation, can also be added to the federation without an unauthorized system having access to the federation of the systems. An advantage of this embodiment of the invention is the fact that the exchange of keys, passwords or certificates is not absolutely necessary here, since all the necessary data can be adapted, for example, by means of a configuration table.

Now, if system A wants to connect to system B with a query, then system A can use the intermediate certificate to check whether the connected system really is system B. After system A's testing by system A is complete, system A may be sure to also communicate with system B. Subsequently, system A now authenticates itself to system B in the further establishment of the HTTPS connection with its own client certificate. System B can now also be sure that system A and no other system of the association has connected to it. This mechanism makes it possible to carry out all further authorization checks exclusively on the basis of the serial numbers and ensures a very high level of security for the connection. The serial numbers of the systems, which of course are stored on all systems, ensure that only authorized systems can connect to one another. In practice, these are proprietary systems that may be distributed worldwide.

Basically, user administration should be organized into administrators and users, with administrators usually able to request all data from all users, while users can only query their own data. However, administrators can also be limited in their queries insofar as they are only allowed to query data over a certain period of time. The goal always has to be be both the users and the administrators to provide relevant information for them in the search network and to provide them with appropriate access rights. Each system in the federation must have a configuration table that assigns data to every other system in the federation. Such a single configuration table may include, for example, the following data:

- Serial number of system B;

- IP / DNS address under which system B can be reached for system A;

- whether system B can only be reached via a proxy server;

- Selected name of system B, which can be output as a result of a query;

tooltip;

- icon; which may include, for example, a company logo or a national flag;

- user account names that are allowed to submit a request 1 here without giving a correct password;

- user account names that can make an inquiry 1 here, if a correct username and password were mentioned;

- user account names, which can make a request 1 here if they were determined by a so-called single sign-on query, ie a one-time query;

- user account names, which, when logged on to System A, always automatically poll system B;

- Administrator account names, which can query here if they can correctly show username and password of an administrator account on System A. For the part of the query that takes place on system A, the rights and query restrictions that are defined for the administrator on system A are used;

- Administrator account names that can query here if they can show an existing user name of an administrator account on System A. For the part of the query that takes place on system A. det, the rights and query restrictions defined for the administrator on system A are used;

- Administrator account names that can query here, even if they do not exist. The part of the query that takes place on system A uses the rights and query restrictions that have been defined for the administrator on system B. The rights and the globally unique ID (GUID) of the administrator restriction are also transferred when logging in. If the administrator restriction does not exist under this GUID, the login fails;

- administrator account names, which, if logged on system A, should be able to poll system B if desired;

- Administrator account names, which, when logged on to System A, will always poll system B automatically.

Of course, dedicated account names can also be extended to all users with the help of wildcards. As a rule, every combination of systems will be found in one table row of the configuration table, where the specified settings can then be enabled or disabled for "All", "None" or for explicitly named users and administrators.

For example, a query by an administrator would look like this:

The administrator 1 logs on to system A and opens the query page. System A then determines from the configuration table on system A which query options are intended for administrator 1 at all. If the administrator 1 executes a request 1, for example, on a Web interface 1A of system A, system A will establish a connection to the desired or, depending on the configuration table, authorized systems which, for example, can be based on HTTPS.

In this case, it is checked that the correct HTTPS certificate is submitted to the respective systems so that system A can be sure that request 1 is also correct to send to the correct systems, such as system B, and not a wrong system commissioned with the request 1.

The qualifying system, such as system B, will check the HTTPS client certificate of system A as soon as the system A connection arrives, and compare it with its own configuration table to determine if that system or systems are even known and what authorization have the respective users on system A. System A now logs on to System B (or any other systems involved) on behalf of Administrator 1 using this HTTPS API. System B checks this logon of System 1 according to the authorization and the request. If a password were involved here, this password would be checked as if Administrator 1 logged in directly to the System B Web interface 1 B. Moreover, in the configuration table of system B, the system A would also be recognized by its serial number, and the entry in the configuration table would also query the requesting rights of the respective user. The system B now knows what rights the administrator 1 has when he is logged in on the system A and then makes a request 1 to system B. System A can now send a query via HTTPS (for example, via port 442) directly to system B. Of course, if System A interrogates multiple systems, those queries will be sent simultaneously by System A to all those systems that are allowed to poll for that query. System B now executes the query and sends the result in pieces back to the system A, which combines these pieces and presents them to the administrator 1. For example, if this query handles an e-mail or part of an e-mail, and the administrator calls a viewer for that e-mail stored on system B, system A sends over the HTTPS connection and session Command to system B, which answers the system B, for example, with header and body. In this case, it does not matter on which system the data is stored, because in the case of a result on another system, this particular system would have responded to the command for header and body, for example. It is known from practice that it can happen that corresponding systems consist of their development from different components and from different programming languages. This plays a minor role with the method according to the invention.

The inventive method makes it possible, for example, to execute search queries 1 such that, for example, the user starts a query 1 from the web interface or presentation layer PA and displays it in the presentation layer PA, if enough results for one page (eg 50 pieces ) available. Using PHP, for example, in the presentation layer PA would make it impossible to maintain the requests after the first results page, since PHP destroys all data structures and open connections after processing each request and does not support background processes. Now it is advantageous to equip the structure of the respective system with a search server 4A or 4B. In the case of a query, this search server 4A or 4B can continue to run in the background and, for example, self-terminate after a certain inactivity time. This, of course, has the great advantage that it does not matter in which language the surface is written and which disadvantages it offers.

In the case of a search, this search server 4A or 4B can continue to work in the background and search and load query results from the index 6A or 6B. Now, when the user views the first page, the search server 4A or 4B searches in the background (until, for example, a maximum value of results is reached) and as soon as the user calls up the next page of results, the next results are displayed Presentation Layer PA off. Of course, this only happens until the maximum value of the results is reached. Should a single system or multiple systems fail to respond to the request after a certain minimum response time, it is advantageous if, despite the fact that this system may not have the full query results from the querying system, the existing results are further processed become. In such a case, incomplete query results may occur in the worst case, but it should be ensured that the existing results are not discarded and the user is at least presented with the results that have been found up to that point in time. The incompleteness of the result can be indicated to the user, for example, by a corresponding message.

Another benefit of using HTTPS is its use of "Keep-Alive." This "keep-alive" mechanism keeps a connection alive for a period of time. If a new query is made during this time, the already open connection can be used immediately, without having to build up a new connection in a time-consuming manner and having to negotiate a new session key or having to check corresponding certificates. This embodiment makes it possible, using the search server 4B, to keep open and manage these keep-alive connections by means of a background process. As a result, all inquiries 1 take place from one system A to another system B or C etc. in the lowest "search server layer." Since the presentation layer PA or PB typically uses several processes for the requests, the principle of keeping The example of PHP makes it clear that this would not be so readily available.From practice, it is known that the common scripting language PHP, for example, immediately destroys the corresponding connections after each request Keep-Alive not or only partially realizable.With the search server 4A or 4B, which keeps these keep-alive connections open, this is possible in the present invention.

In detail, therefore, in a typical request 1 from system A, a request 1 is made to the local search server 4A in the presentation layer 1A of system A, which first starts a local search in the local index 6A and at the same time for example makes an HTTPS connection to the Builds system B, and also sends this request 1 to system B. These Inquiry 1 is received in system B in the presentation layer 1B and there the system A's login procedure is checked as already described. When this check is complete and the user is authorized to submit request 1, the request command is accepted. The presentation layer 1B of system B now establishes an internal connection to the search server 4B of its own system. If this search server 4B has not yet been executed at this time, it will of course be started beforehand, since otherwise it would not be accessible to the presentation layer 1B. The search server 4B of the system B now exclusively performs a local search on the system B and delivers the results, which of course have already been authenticated via the previous authorization check between the system A and the system B. Of course, a corresponding query restriction is incorporated due to the respective user rights of the requesting user and so the presentation layer 1 B of the system B prepares the query result according to the rights assignment and sends it back to the system A.

The local query itself is accomplished in two phases. In the first phase, the inverted indices 6A and 6B are scanned for the respective search words. Here, search words associated with Boolean algebra, such as "Word_A AND Word_B", for example, use two pointers in the inverted indices 6A and 6B, respectively. These pointers locate the words A and B. These two digits are now sequentially ascending Document numbers relating to search index 6A or 6B of all documents, each containing word A or word B. The search itself now skips over as many document IDs on the opposite list until both pointers have the same document ID ID would now be one in which both words, ie A and B are contained and thus relevant for the search.

Of course, the number of hits may be significant due to the size of the respective lists. In order to offer the user more comfort in this regard, the respective result is provided with a score value, which outputs a weighted result in the form of a value that indicates the number of relevant hits. The respective system processes these result pairs (consisting of the document ID and the respective score value) in order to determine the best results. The number of these results can usefully be limited accordingly with, for example, 5000 result pairs; At the same time, the number of relevant results is counted to determine how many hits are relevant and how many of them belong to the best 5000, for example.

In the second phase, the search result entries are loaded from the search index 6A or 6B. In this search result, for example, subject, sender, recipient of an e-mail can be noted. Of course, the document ID must also be noted, without which further access would of course not be possible. Here again comes the already described return of the results to bear, which for example, the first 50 results returns and represents and in the background on the already described search server 4A or 4B loads the outstanding results or then present them as needed, without a new search must be performed. The corresponding sorting takes place in the RAM, since the index 6A or 6B is not able to do so. Of course, this query can not only be done between two systems (in this case System A and System B), but of course several systems can be involved. In this regard, each "polled" system returns its results in, for example, blocks of 50 results each, all of which appear consecutively and are each separated by flush commands to mark the end of each block and the transmission of data through, for example, the HTTPS protocol immediately and The flush command is basically used to regulate the flow of data and clear the search buffer, making the existing connection ideal and delivering the data to the requesting system A as a quasi-push service upon availability. As can easily be understood, the query function described above can lead to massive problems between the file formats and file structures used. In order to be able to operate this method stably regardless of programming languages and file structures and the like, it makes sense if the presentation layer 1 B of the respective local system, for example system B, the data for the presentation layer 1A of the requesting system, for example system A, always in its typical presentation layer data structures and concepts, such as PHP serialized coded passes. The search server 4A of system A can not process this data and passes it on only to the presentation layer 1A of the queried systems. Among other things, these bring the data into a corresponding form and pass it to the respective local search server 4A or 4B. The returned data are again correspondingly evaluated by the respective presentation layer 1 B and transmitted to the querying system A. However, depending on the type of request, this can also be processed by means of an HTML code which is generated in the presentation layer 1B of system B and forwarded by the search server protocol 4A of the system A and its presentation layer 1A and output to the user accordingly can.

Of course, several tools for further processing can be integrated in the search results. It therefore makes sense to integrate not only icons for requesting the marked data in the respective surface but also, for example, download icons for downloading an attachment if the search result relates, for example, to a PDF attachment processed by means of OCR software. Likewise, further actions should be provided for the found and marked emails or documents, such as delete, restore, forward, list export as CSV file, EML bulk export or export as password protected ZIP file. The integration of a viewer, which can be integrated, for example, by means of a pop-up or displayed as a browser window, plays a significant role in the further processing of the data which was found with the aid of the method according to the invention. With the integration of such a surface, it is possible to process the results again. In one possible embodiment, a print view is advantageously integrated or a viewer which, for example, displays the header, the list of attachments and the body in the case of e-mails. For HTML mails, of course, the respective HTML text can be displayed. The viewer can also have buttons for "scrolling through" the results or navigating to the first or last result, as well as direct navigation to a specific result.Of course, the functions implemented here can be expanded and adapted to the respective users are and will not be limiting.

In principle, care is taken in the method according to the invention to work as gently as possible in a bandwidth-conserving manner. As already described, the output of the inquiry results does not transmit the complete relevant data, but only certain, relevant parts. The user can thus make a preselection or a selection of the query results that are of interest to him. Certain tools allow the user to further process the data that matches his search query. Due to the amount of data, however, it is important to avoid transmitting all search results directly to the user. Rather, it makes sense to let the user make a selection via a preview and then, when the user really needs the data and this decided on commission, the data on the same path, which was taken in the request 1 to to transmit the respective user. This has the immense advantage that the bandwidth can be spared and optimally exploited since only those data are transmitted that are also relevant. A meaningless data transfer is thereby avoided and the resources are used optimally. Such a user-made preview also gives the user the option of deciding whether the search result is relevant to him or not. If this is the case, the user can use the method according to the invention to send the respectively relevant search results to his inbox, for example, by means of a possibility of the restoration. Since, of course, the export of results is based on the fundamental idea of the method according to the invention, there is also the possibility of exporting relevant search results. Since the results do not always have to be a single result, but it is also conceivable that the relevant results are a larger number of relevant data, it would not be expedient for the user to save each individual result manually would. Rather, it makes sense to use to restore or export the results, for example, using a ZIP export. With a ZIP export, the existing ZIP library is adapted. The basic structure of a ZIP file, which can be used here very well for the further processing of the results, consists per file of a header and trailer with file names, a compression method and a CRC checksum. This is strung together per file and at the end all headers and trailers are repeated again to ensure quick access and ended with a central directory, ie a central directory, which points to the beginning of the list. In order to be able to create a ZIP archive here as well, due to the basic structure, which can be very spacious and contain several systems, the header, the content and the trailer always have to be marked with the entry for the end of the respective ZIP file. File to be linked. For the requesting system, eg system A, the linked parts must now be removed and buffered. The remainder is connected to the locally zipped data and those of the scanned systems, and the respective file offsets are stored. The respective ends of the ZIP file are cached in the same order in a temporary file or in RAM and the respective contained offsets are adapted to the content. Now that the search result has been completed and all relevant data of the query has been selected by the user, the directory which is stored, for example, in a temporary file is still displayed. hangs. As already stated, the relevant user-selected and merged part is also transmitted directly to the user or to the system which the user uses. As a result, the computer performance and the bandwidth are utilized very efficiently as before during the restoration, and the user is offered the most comfortable solution to the problem of secure searching, finding, reproducing, restoring and / or exporting.

It is now possible for the first time with the inventive method, a combination of systems that work independently and are functionally equivalent, are combined in a network, but without central organizational structures such as a server or the like, from each individual system, a request. 1 for the secure and encrypted searching, finding, reproducing, restoring and / or exporting of electronic data to all other systems. Due to the configuration of the method, the respective individual systems can be exchanged, expanded or removed from the composite at any time with simultaneous stability of the local continuity. Of course, this brings considerable advantages in terms of maintenance and service of the system network. It is now possible for the first time with the method according to the invention to ensure secure searching, finding, reproducing, restoring and / or exporting electronic data without relevance of the location, ie location-independent, and furthermore to burden any bandwidth only on the bare essentials and unnecessary data exchange minimize. LIST OF REFERENCE NUMBERS

A System A

DA Data Suite ffsschicht System A

1 A / PA Presentation Layer System A

2 A Other components System A; eg archiving

3 A Database System A

4 A Search Server System A

5 A Indexing System A

6 A Index System A

B System B

DB Data Access Layer System B

1 B / PB Presentation Layer System B

2 B Other components System B; eg archiving

3 B Database System B

4 B Search Server System B

5 B Indexing System B

6 B Index System B

(1) Request from system A to system B

(2) Response from system B to system A.

Claims

claims

1 . Method for the secure searching, finding, reproducing, restoring and / or exporting of electronic data from at least two integrated, functionally equivalent and decentrally organized systems, comprising at least the following method steps: a. Encrypted request for the requested data between at least two functionally equivalent systems, which in themselves have a layer model and consist of at least one presentation layer and one data access layer,

b. Authentication of the requested request and / or the user, which is checked by the presentation layer of the requested system,

c. Simultaneous execution of the authenticated request in the data access layers of all authorized, functionally equivalent systems in the network,

e. Presenting and / or processing the requested results.

2. The method according to claim 1, characterized in that the authentication between the individual systems on a system certificate of the respective system of equip goes, in each of which a serial number of the corresponding system is embedded.

3. The method according to claim 1 to 2, characterized in that the system certificate and the serial numbers of the respective systems are specified and managed by the manufacturer.

4. The method according to claim 1 to 3, characterized in that a configuration table is stored on each of the same functionally equivalent systems, which gives the system information about all other functionally equivalent systems in the network or the authorization of the user information.

5. The method according to claim 1 to 4, characterized in that the authentication of the interrogating system is only by the queried system of equip.

6. The method according to claim 1 to 5, characterized in that in a request between the functionally equivalent systems possible attachments are transmitted only in a dedicated request by the user to the corresponding function circumferentially equal, requesting system.

7. The method according to claim 1 to 6, characterized in that the function equivalent systems are interchangeable and at any time, given the administrative permissions, the possibility is given to insert systems in the network or remove them from the network.

8. The method according to claim 1 to 7, characterized in that when replacing an interconnected system, it needs no configuration adjustments to any other system in the composite to obtain the security properties and trust relationships between the systems in the composite.

9. The method of claim 1 to 8, characterized in that the respective request is completed successfully, even if a system within a minimum response time does not respond to the request, in which case the existing query results are processed further.

10. The method of claim 1 to 9, characterized in that the compromising of a single system only entails access to the same level of authorization and so the whole system despite

Compromise remains secure.

1 1 .Method according to claim 1 to 10, characterized in that no mitiierung is given to only one programming platform, but the claimed method is platform and surface independent.

12. The method of claim 1 to 1 1, characterized in that the requested data are displayed immediately on the requesting system and the query is processed at the same time further.

13. The method according to claim 1 to 12, characterized in that each request is specified in terms of the Boolean algebra.

14. The method according to claim 1 to 13, characterized in that are assigned via a corresponding administration, hierarchically unique access rights.

15. The method according to claim 1 to 14, characterized in that by means of this method also contents of possible file attachments are part of the request.

16. The method according to claim 1 to 15, characterized in that the result is weighted using corresponding score values.

17. System network for carrying out the method according to one of claims 1 to 16, which consists of at least two functionally equivalent subsystems and has a data connection, which makes it possible to transmit data between the function peripherally equivalent systems.

Computer program for carrying out the method according to one of claims 1 to 16 with program code which is stored on a machine-readable carrier when the program is executed in a computer.