CH640971A5 - Mobile data container secured against unauthorised access - Google Patents

Description

The invention relates to a mobile data container for the storage of user data secured against unauthorized access, with a closed housing, in which there is a main data memory for the user data and an identification device which compares identification data supplied from the outside with identification data stored in it and, depending on the comparison result, access releases or blocks to the main data memory, and which data container is further equipped with sensor means which, when the data container is opened by force or by unauthorized persons, render a part of the stored data unusable or destroy it.

The secure storage of data of all kinds and the protection of data against unauthorized access is becoming increasingly important. With stationary systems, e.g. In banks and vaults or computer rooms, security against unauthorized data access is mainly carried out by storing the data in rooms with solid walls, monitoring the rooms using various alarm systems and / or by appropriate personnel and using various more or less complicated identification systems that automatically access only allow authorized persons. However, these measures are generally impractical for mobile data containers, which in many cases should or must be as small and light as possible.

For many applications of such a data container, in particular, for example, in diplomatic messaging or as a key store for encryption systems, it can be accepted that the stored data is deleted or destroyed, rather than getting into the hands of unauthorized persons.

The object of the invention is therefore to provide a mobile data container that does not allow unauthorized persons access to the data contained therein. In particular, this data container should not require massive walls and the like, so that it can be made correspondingly small and light, and does not require any personnel to monitor it. Furthermore, the data stored in it should be destroyed or made unusable if the container is opened without authorization or by force.

This object on which the invention is based is achieved according to the invention by the measures and features listed in claim 1.

DE-OS 2224937 describes an identification system with data carriers on which identification data and any other, e.g. Data relating to a bank account of the user are stored, the latter being secured by the identification data. The data memories are protected against physical access by a sensor system, in that this system automatically and inevitably deletes the identification data when an attempt is made to access them. To this

5

10th

15

20th

25th

30th

35

40

45

50

55

60

o5

3rd

640 971

Although the data carrier becomes useless and worthless as a means of identification, the remaining stored data is retained and can therefore fall into unauthorized hands. These known data carriers are therefore unsuitable for achieving the object on which the invention is based.

The invention is explained in more detail below with reference to the drawing. Show it:

1 shows a schematic sectional illustration of a data container according to the invention with a block diagram of the electronic functional groups contained therein,

2-4 various details from FIG. 1 in a schematic representation and

Fig. 5 is a schematic sectional view of a loading device for storing data in the container.

The data container designated 1 as a whole in FIG. 1 comprises a housing 11 with, for example, a trough-shaped lower part 111 and a flat cover 112. The housing consists of non-conductive plastic and is surrounded on the outside with a metal layer 113.

Among other things, data container 1 contains a main data store 20, a central identification data store 30 and a subscriber identification data store 40. A memory controller 21 or 31 or 41, an erasing device 22 or 32 or 42 and a write gate 23 or 33 or 43 are assigned to each of these three stores. Data can be supplied to the data container 1 via the write gates via plug connections Si or S2 or S3 provided on its housing 11 and loaded into the memories. The assignment of the data to the individual memory locations etc. is provided by the memory controllers, which in turn receive the necessary control commands, such as switching from reading to writing, etc., via a multiple plug connection G in the housing wall of the container. The memory controllers essentially comprise an address counter and an address decoder and are therefore not described in more detail.

Furthermore, a quartz-controlled clock 50 with a coaster 51 for the clock cycle, an actuating stage 52 for adjusting or correcting the clock 50 and a time switch 53 which cooperates with the clock is provided in the data container. The setting stage 52 and the timer 53 can be controlled from two plug connections U and Z on the container wall. The activation of the timer 53 is secured by a gate 54 switched on in its connecting line to the plug connection.

Two comparison stages 60 and 70 work together with the two identification data memories 30 and 40. These receive data from the two memories 30 and 40 on the one hand and on the other hand via a central identification data plug connection ZI or via a gate 71 via an input keyboard 72 arranged in the housing wall for subscriber identification data. Instead of using the keyboard 72, the comparison stage 70 can also be supplied with identification information from outside via a subscriber identification data connector TI. This can be used both in place of the keyboard for the identification on the subscriber side and, as will be described, during the identification by the charging center.

The subscriber identification data memory 40 contains, in addition to subscriber identification data still to be explained, information specific to the data container 1, e.g. a serial number. This information is stored in such a way that it can be read out directly via a further plug connection L.

The comparison stage 70 controls the gate 43 and a read gate 24, which controls the data flow from the main data memory 20 to a read plug connection L [. This reading gate 24 is also controlled by the timer 53.

An alarm output of comparison stage 70, at which the comparison result is signaled, is connected to a corresponding plug connection A2 on container 11.

The comparison stage 60 blocks or opens the write gates 23 and 33, the gate 54 and the setting stage 52 for the clock 50. Furthermore, this stage 60 has an alarm output which is connected to a corresponding plug connection A2 in the container wall.

Furthermore, a mixing stage 80 is provided in the data container and a pluggable bridge 81 is provided in the feed line from the memory 30 to the mixing stage, the latter being normally open. When the bridge is inserted, the data read from the main data memory 20 and the central identification data memory 30 are exchanged with one another, e.g. Modulo-2 mixed. The mixed product reaches the read connection Lp via the reading gate 24. If the bridge 81 is not inserted or is open, the central identification data cannot reach the mixing stage 80. In this case, the data read out of the main data memory 20 reach the read connection L 1 unmixed

If necessary, the outputs of the two comparison stages 60 and 70 can be interconnected by means of a further bridge 82, as will be explained further below.

Furthermore, there is a relay stage 90 in the data container 1, which is controlled by various destruction sensors to be explained below, and a current source 100 e.g. in the form of a rechargeable battery. The current source 100 is connected to two further plug connections Bi and B2 on the housing wall.

Relay stage 90 controls three switch contacts 91-93. In the idle state of the relay stage 90, which corresponds to its normal state, the switch contacts are in the position shown. The supply voltage from the current source 100 and the system clock T from the coaster 51 are fed via the contacts 92 and 93 to the memories 20 to 40 or their associated controls 21-41. Contact 91 is open. When the relay stage 90 responds, the contacts are moved into their position, not shown. In this case, the voltage and the clock supply for the memories are interrupted and supply voltage is fed via the contact 91 to the quenching devices 22-42 assigned to the memories 20-40. Depending on the type of memory, the interruption of the memory supply and / or the activation of the deletion devices causes the destruction or deletion of the stored data.

The erasers will of course depend on the type of storage used. In the case of magnetic bubble memories e.g. 3 can consist of a coil 221 which is capable of generating a sufficiently strong magnetic field which destroys the stored data. For other storage systems that do not automatically lose their charge in the event of a power failure, the extinguishing devices can e.g. consist of a smaller controller, which in rapid succession all memory locations with the same information, e.g. loads with all binary zeros. In the case of volatile memories that lose the stored information in the event of a power failure and / or clock failure, the erasure devices can of course also be dispensed with.

The three memories 20-40 could of course also be formed by areas of a single larger memory and e.g. also be divided into several memory blocks. The three memory controllers 21-41 could also be implemented by a single, correspondingly complicated controller. The three division shown was chosen only for reasons of clarity.

The relay stage 90 is e.g. three sensor stages 94-96 controlled, which in turn with corresponding sensors

5

10th

15

20th

25th

30th

35

40

45

50

55

60

o5

640 971

4th

or sensors that are arranged inside the data container or in its walls, work together.

The sensor stage 94 is a current detector. The associated sensors are designed as thin wire lines 941 and 942, which are laid in the walls of the container and are connected to the voltage source 100 via series resistors 943 and 944. The course of the wire lines in the container walls differs from container to container and is preferably chosen randomly. At the transition points between the lower container part 111 and the cover 112, the lines are connected by plug connections 945 and 946. If one of the lines is interrupted by an external influence, the current sensor stage 94 triggers the relay stage 90 and thereby initiates the data deletion processes already described above.

The sensor stage 95 is controlled by a pressure sensor 951, which reacts to the internal pressure pi prevailing in the data container 11. The sensor stage 95 triggers the relay stage 90 when the internal pressure e.g. due to the violent opening of the data container deviates from a desired value by a certain amount.

At some point in the container wall, e.g. here in the floor, the plastic wall is provided with an opening 952, which, however, is hermetically sealed by the metal shield 113. If the metal shield is removed for any reason, this leads to a change in pressure in the data container and thus to the relay stage 90 responding.

The sensor stage 96 works together with a large number of differential pressure sensors 961, only two of which are shown in FIG. 1. These differential pressure sensors 961 record the pressures in four channels 962-965 connected to them in the container walls. These channels, which are each in pairs under the same pressure, run arbitrarily within the container wall.

Such a differential pressure sensor 961 is shown in more detail in FIG. 2. It essentially contains two e.g. piezoelectric pressure transducers 966, each closing one of the four channels 962-965, and two differential amplifiers 967 and 968, each of which is connected to the two pressure transducers connected to a pair of channels 962-964 or 963-965, the outputs of which are connected via unspecified cables and connectors the sensor stage 96 are connected.

The pressure pi prevails in the channel pair 962-964, and a different pressure p2 in the channel pair 963-965. Normally, the output signals of both differential amplifiers 968 and 967 will be zero.

Now e.g. due to the violent opening of the data container of any of the channels, pressure equalization with the environment takes place and the differential amplifier (s) come out of balance. This is then evaluated accordingly by the sensor stage 96 and ultimately leads to the relay stage 90 responding.

Due to the paired arrangement of channels in connection with the differential amplifiers, e.g. Pressure drift phenomena caused by temperature fluctuations have no influence on the function of this stage. By using two pairs of ducts at different pressures, it is also impossible to open the container without authorization in a room where the pressure is the same as in one of the ducts.

The channels can be formed as cavities within the plastic walls of the data container. However, it is equally possible to form the channels by hoses or pipes which are cast into the container wall. In the latter case, the hoses or pipes are preferably made of the same or a chemically and physically similar material as the container wall, so that e.g. it is not possible to access the channels by chemical or physical ablation without destroying them.

The various destruction sensors (lines, channels, etc.) are, as already mentioned, different from container to container and are preferably arranged randomly in the container walls. This can e.g. by means of processing machines controlled by a random generator. In this way it is ensured that no two containers are of the same design with respect to these sensors and thus the security with regard to unauthorized opening is significantly greater.

The metallic shield 113 of the data container 1 is intended to prevent the position and distribution of the destruction sensors from being found out by means of radiographic methods.

In addition to the three described destruction sensors, other types of sensors can of course also be provided. For example, according to FIG. 4, it would be readily possible to mount an oscillating circuit 971 at one or more locations in the container wall 111, which works with a corresponding detector stage 97. The resonant circuit would move when approaching or e.g. detuning when removing the metallic shield 113 and thereby triggering the relay stage 90 via the detector stage 97.

As indicated in FIG. 1 by the dashed lines 921 and 931, it would also be possible to route the clock and / or the feed lines to the storage controls through the container walls, which would achieve further security.

5 shows a charging center 1000 which is particularly suitable for loading data into the data container 1 or its memory. It comprises a solid container 1001 with a trough-shaped lower part 1011 and a lid 1012. The housing is protected against access by unauthorized persons by means of any conventional measures, which are symbolized here only by a key 1013.

In the interior of the container 1001 there are essentially a data control computer 1100 and a plug connection 1101 for one or more data containers 1, 1 ', which is only indicated here by a dash-dotted line. Furthermore, there is a power source 1200, a switch contact 1201 cooperating with the cover 1012 , an OR stage 1300, an acoustic alarm device 1301 and an optical alarm device 1302 are provided for each data container.

The data control computer 1100 is any conventional computer and includes, inter alia, a data source 1110, which is still to be discussed, and a central identification data memory 1130 and a subscriber identification data memory 1140 for each data container 1 to be connected. In these two memories 1130 and 1140, the individual central and participant identification data are stored for all data containers belonging to the system.

The operation and operation of the data container 1 and the charging center 1000 are described below. It is assumed that the container already contains data from an earlier loading process which is now to be replaced.

For this purpose, the data container 1 is introduced into the charging center 1000 and connected to the computer 1100 via the plug connection 1101. The computer 1100 is only released when the cover 1012 of the charging center is closed, since, as is symbolically indicated here, it is only then supplied with supply voltage via the contact 1201. This ensures that no unauthorized manipulations are carried out during the loading of the data container5

10th

15

20th

25th

30th

35

40

45

50

55

60

o5

5

640 971

men can be.

First of all, the data control computer 1100 reads out the serial number of the data container in question from its memory 40 via the output L of each container 1, 1 ', etc. On the basis of this serial number, the identification data assigned to the respective container are selected from the totality of the identification data available in the memories 1130 and 1140 and the central identification data are first transferred to the comparator 60 of the respective container 1 via the connection ZI. The latter now compares this data with the data contained in the internal memory 30. The comparison result is obtained via connection A | reported to the computer, the gates 23 and 33 being released in the event of a match in the data container. In the event of a mismatch, the acoustic alarm 1301 and the optical alarm 1302 assigned to the data container concerned respond and any further operation is prevented, which is indicated here by the gates 1131.

If the central identification data stored in the control center and the central identification data stored in the container match, the memory 30 in the data container 1 and the memory area of the memory 1130 assigned to this container in the control center are assigned a new, e.g. loaded by a random generator contained in the data control computer, purely random central identification information.

The next step is to check the subscriber identification data for each data container. These are transferred from the area of the memory 1140 defined by the container sequence number via the connection TI of the container to its comparator stage 70 and compared there with the data read out from the internal memory 40. In the event of a mismatch, an alarm is triggered via outputs A2 in a manner similar to that for the central identification data. If they match, the gates 43 and 24 in the container 1 are released and new, randomly generated subscriber identification data are read in via the connection S3 of the container 1 into its memory 40 and into the area of the memory 1140 of the data control computer 1100 defined by the sequence number.

For simpler applications in which security does not have to be as high, the checking of the subscriber identification data in the charging center can also be dispensed with. In this case, the connections of the computer to the connections S3 and TI of the containers would simply have to be interrupted, which is indicated in the drawing by the bridges 1102 and 1103.

After these prepared control operations, the main data are loaded into the main data memory 20 of each data container via the connection Si. The main data comes from the data source 1110. The data source can be any storage input device by means of which data can be made available. If the main data are secret keys in connection with an encryption system, the data source can also be a random generator or the like, which automatically generates this key data.

During the various control and charging processes, the accumulators 100 in the data containers 1 are simultaneously recharged via the connections Bi and B2.

After the main data store 20 has been loaded, the clock 50 is set in the data container via the U connection, if necessary, and the timer stage 53 is set via the Z connection, if necessary. The latter can be used to define a time window within which the main data can or must be read out.

The charging process in the charging center is now complete and the data containers are now being sent to the user. This can only read the main data from the memory 20 via the read connection L ^ us. However, it cannot change the data in the memories or the setting of the timer stage 53, since the corresponding inputs are blocked by the central identification data comparison stage 60.

In order to gain access to the main data, the user must first enter the subscriber identification data assigned to the relevant data container via the keyboard 72 into the comparison stage 70. This compares the entered data with the data stored in the memory 40 and, in the event of a match, releases the reading gate 24 and thus access to the main data memory 20. If the timer stage 53 also enables the reading gate 24, i.e. if the desired data access torque is within the time window specified by the timer stage 53, the main data can then be read out from the memory 20 via the connection Li. As with all other operations, the preparation and control of the memories required for this takes place via the control connection G.

The keyboard 72 or the comparison stage 70 can be designed such that e.g. If incorrect identification data is entered three times, each further entry is blocked and an alarm is triggered. In this way it is prevented that the identification data unknown to him can be found out by an unauthorized person by systematic trial and error.

The electrical access to the stored data via the externally accessible plug-in connections of the data container is thus secured by the central and subscriber-specific identification data. Access by violent opening of the data container is prevented by the various destruction sensors and the levels that work with them.

A further security against unauthorized data access is the mixing stage 80, which mixes the main data with the central identification data of the memory 30, so that the data that can be obtained at the output Lj form a mixed product. When using the data container as a key storage in encryption systems, this mixed product can then be used as an encryption key, provided that the randomly generated and unknown central identification data are the same for all key containers involved. Under these conditions it is e.g. It is possible to delete only the central identification data memory, but not the main data memory, if the container is opened without authorization, since the data contained therein are useless without the central identification data and are therefore worthless.

For particularly important applications, it may be advisable not to store the data to be securely stored in plain text, but in any way encrypted or otherwise processed. In Fig. 1, a processor 83 is therefore indicated by dashed lines, which is switched into the data paths from the write gate 23 to the memory 20 and from there to the mixer 80 and can be controlled from the control input G. This processor encrypts the main data supplied with its own encryption program and decrypts the outgoing data again. The encryption program is generated by the processor on the basis of key information stored in it, which is loaded into the processor when the data container is loaded. The processor is prepared for this in the same way as for the memories via the control connection G on the data container 1.

If the data containers are used to store encryption keys, all key containers belonging to a connection network must of course be loaded at the same time, for each connection option within the network in pairs with the same information. In

5

10th

15

20th

25th

30th

35

40

45

50

55

60

OD

640 971

6

In this case, the charging center is designed to accommodate several data containers at the same time. However, the various controls and so on are carried out separately for each individual container. The serial numbers of the individual containers then determine the assignment of the individual key data to the respective containers.

The bridge 82 indicated as broken or broken in FIG. 1 offers a further possibility of variation of the data container according to the invention. When the bridge 82 is closed or inserted, after identification of an authorized person by means of the comparison stage 70 and the associated release of the write gate 23 via the write connection Si, information can be written into the data main memory 20 and / or the clock 50 can be adjusted via the setting connection U. This can be desirable and advantageous for certain exceptional situations 15, but does not form the normal case.

In addition to securing the stored data using the means already described, it is e.g. it is also possible to provide a further backup via the readout rate. This is particularly advantageous in connection with encryption systems. For example, the controller 21 of the main data memory 20 can be designed in such a way that it only outputs a certain number of data bits from the memory at the clock T of the clock pulse divided by the coaster 51 and thus autonomously controlled by the clock 50. The whole can also be organized in such a way that the data are read out completely autonomously at certain time intervals predetermined by the clock 50 and the relevant storage locations of the main data memory are then preferably deleted immediately after each output.

The deletion of the data read out in each case may also be desirable in other applications. Switching means, e.g. provided in the form of jumpers or the like, by means of which it is possible to choose between the “delete” and “non-delete” modes after reading out.

G

3 sheets of drawings

Claims (16)

640 971 1. Mobile data container for the storage of user data secured against unauthorized access with a closed housing (11), in which there is a main data memory (20) for the user data and an identification device (40, 70), which the identification data supplied from the outside are in it compares stored identification data and, depending on the comparison result, enables or blocks access to the main data memory (20), and which data container is also equipped with sensor means (90-96) which, when the data container is opened by force or by unauthorized persons, render a part of the stored data unusable or destroy it, characterized in that the sensor means (90-96) render the useful data in the main data memory unusable or delete them. 2. Data container according to claim 1, characterized in that the sensor means (90-96) in the walls (112, 111) of the housing (119) comprise destruction sensors (941, 942; 962-965) which respond when the walls are broken . 2nd PATENT CLAIMS 3. Data container according to claim 2, characterized in that the sensor means (90-96) from data container to data container are arranged differently and preferably randomly and are secured against localization from the outside. 4. Data container according to claim 3, characterized in that the sensor means comprise wire lines (941, 942) arranged in the housing walls. 5. Data container according to claim 4, characterized in that the housing (11) has a metallic shield (113) on the outside. 6. Data container according to one of claims 1 to 5, characterized in that the sensor means comprise a pressure detector (95,951) for the internal pressure (p; of the housing (11). 7. Data container according to claims 5 and 6, characterized in that the housing walls (111, 112) are provided with an opening (952) which, when the shield (113) is removed, connects the interior of the housing to the atmosphere. 8. Data container according to claim 2, characterized in that the destruction sensors comprise cavities (962,963,964,965) arranged in the housing wall, which are in pairs under the same pressure (pi, p2), two pairs of cavities (962,963; 964,965) each on two differential pressure detectors (967,968) are connected, the output signals of a differential pressure sensor stage (96) are supplied (Fig. 2). 9. Data container according to one of claims 2 to 8, characterized in that the sensor means comprise a relay stage (90) which is controlled by the destruction sensors and which makes the useful information unusable. 10. Data container according to one of claims 1 to 9, characterized in that the identification device (40, 70) controls only the read access to the main data memory (20). 11. Data container according to one of claims 1 to 10, characterized in that it contains a second identification device (30, 60) which independently of the first-mentioned identification device (40, 70) controls the registered access to the main data memory (20). 12. Data container according to one of claims 1 to 11, characterized in that it contains a timer stage (50, 51, 53) which permits access to the main data memory (20) only during a preselected period. 13. Data container according to one of claims 1 to 12, characterized in that it is designed for releasable connection to a charging device (1000) which writes the user data fully automatically into the main data memory (20). 14. Use of the data container according to claim 1 for storing key data in encryption systems. 15. Use according to claim 14 of a data container according to one of claims 2 to 13. 16. Use according to claim 14 of a data container according to claims 10 and 13, characterized in that the loading device (1000) has an identification data memory (1130) in which the identification data required for the second identification device (30, 60) in the data container (1) are stored , as well as means for automatically entering this identification data into the second identification device (30, 60).