DE102007000963B4 - I / O interface for establishing a secure connection between network servers for requesting data in the event of an alarm - Google Patents

Abstract

I / O interface for establishing a secure connection for data exchange between a network server of a digital information system of a help-seeking network (10) and a server of assistance networks (41; 42; 43) having the following features:
- The help-seeking network comprises on the one hand an internal LAN (11) with the network server and the other monitoring means (12) whose data is stored on a hard disk, and at least one alarm device for triggering an alarm;
- The I / O interface (20) has a first data path (21) and a second data path (24), both of which are physically separated from each other, and only one of which is open for data exchange via an external network;
Each of the data paths (21, 24) has an isolator (22, 25),
- Each of the separating members (22, 25) of the first and the second data path (21, 24) interacts with the alarm transmitter such that in alarm-free normal operation, the first isolator is activated and the second isolator is deactivated, ...

Description

The invention relates to an I / O interface for establishing a secure connection for data exchange between a network server of a digital information system of a help-searching network and a server of assistance networks.

It is notoriously known that in banks, department stores, supermarkets and the like to prevent robberies and inventory losses as well as for monitoring certain areas in public transport monitoring measures are provided that provide with surveillance cameras that allow recording of video images. For this purpose, the cameras are connected to the control center, which includes a server that allows storage of video signals on a hard drive, via corresponding transmission links. For such surveillance systems, requirements for image transmission from objects to be secured have been established for the Image Transmission and Image Control Directive (ÜEA Directive, as of August 2007 - expert group "ÜEA" on behalf of the Commission "Fundamentals of Surveillance Technology"). It is not taken into account that disturbers who have set off the alarm can obtain information about countermeasures by accessing such data, which may be detrimental to these countermeasures. The transmission lines are in the range of banks, department stores, supermarkets and the like. Designed as a LAN. Direct access by external third parties to the recording is not possible. These digitally delivered images camera / cameras are recorded on suitable storage means and kept the record for a certain time. This makes it possible to assess an a posteriori alarm on the occurrence, the course and the progress of the situation underlying the alarm case. One way to observe the events underlying the alarm from an external online help center is not. Although an online image transmission via web cameras is often offered via the InterNet, the data from the web camera both wired via data lines as well as wirelessly fed via transmission links in the InterNet, but this continuous image transmission is free for all User. For this reason, such image transmission is not suitable for physical security and surveillance, as this does not ensure the necessary data protection. Although a picture transmission after alarm messages from the secured help-seeking body to a supportive body (police, security, ...) would allow emergency services to provide a precise assessment of the situation, however, it is disadvantageous that these image transmissions are open and allow unwanted access, so that security-relevant objects without concern so that it can not be monitored.

On this basis, the task arises, the known transmission links between servers of the help-seeking body on the one hand and one of the servers of the help stations on the other hand so that one of the external assistance centers in case of alarm access to image data of the server of the internal network of the help-seeking body only one of the servers Helpdesks is possible if they are granted access rights; Furthermore, a procedure is to be specified, with which the access grant can certainly be operated taking into account the limits given by data protection in such a way that the assistance center can estimate the situation underlying the alarm via the transferred records and initiate appropriate countermeasures.

This object is solved by the features of independent claims 1 and 6; Advantageous developments and preferred embodiments describe the dependent subclaims 2 to 5.

The server of the digital information system of the help-seeking body has an I / O interface provided with two parallel, physically separate paths with corresponding outputs. Both outputs are for establishing the connections of this server with a server of an external network - such as a WEB server, being connected to the external network, in particular the InterNet forming world-wide-web www, servers of assistance centers, each with a number of users are. In addition to the servers of the assistance centers, other users have access to the data fed into such open networks, whereby this access is permitted and even desired in the alarm-free normal manner, so that data can be exchanged via the public network. This data exchange is public, an exchange of confidential or secret data is not possible. Normally, only the first output for a general data exchange via the open network is open.

Although is off US Pat. No. 7,219,149 B2 an I / O interface for data transmission over an external network with a primary and a secondary data path known. This is available for data transmission errors, for example, in the primary data path, as well as to allow data transfers under various transmission protocols, different security requirements, for error detection, and other network administration functions. The aim is to provide the most flexible transmission system possible. Though Here, too, the problem of security of data transmission is addressed, but the possibility of a normally open access to the data, which is limited to legitimate servers in the event of an alarm, not treated. Next discloses the DE 10 2006 060 222 A1 a redundant Ethernet connection via at least electrically separated two data paths with an I / O interface (switching matrix), the error on the active data line reveals and switches to the other (functioning, so far passive) data performance. The goal is to achieve redundancy in data transmission. This does not affect the problem of normally authorized access to the data, which is only open to authorized persons in the event of an alarm.

In the event of an alarm, this first data path is blocked and only the second output, which is only open in the event of an alarm, is available to the data stream for access by network servers. Only connections with such servers are made possible by support centers whose URL is already known and stored. The connection is made and maintained only after positive verification of the URL. In this case, the data exchange is only permitted if the password of the accessing server is positively checked in addition to a match of the URL.

The access of one of the server of assistance points to the server of the help-seeking body via the open, external network, in particular via the InterNet forming world-wide-web www. Under normal circumstances, the data exchanged can be viewed by authorized persons as well as by unauthorized persons, whereby encryption does restrict the viewing of unauthorized persons, but does not prevent them. Since in the event of an alarm any insight into exchanged data should be prevented, the URLs are exchanged in case of alarm from the servers of the support center and one of the servers of the assistance center. Only if the URL of the server of the assistance center agrees with one of the URLs that have been stored as authorized in advance in a memory, the connection is permitted as a secure connection for a data exchange.

The password is transmitted by the accessing server via this permitted connection. A check is carried out with the password stored in advance in advance for the permitted URL as an identification of the access right. If there is a match, the held connection is allowed to communicate with the server of the assistance center on the video data of the digital information system of the help-seeking body. If there is no match, the connection is terminated.

In the case of an alarm, such as a raid, the information provided by the server of the requesting body and requested by the server of the assistance center contains the information important for the assessment of the situation underlying the alarm. This approach prevents unauthorized access of any open network user to the data, while it provides information about the situation on the ground, which allows a more accurate assessment of the situation.

Advantageously, the two double-applied data paths of the I / O interface are realized by physically separate network cards. Normally, only the data path via one of these network cards is open, which is blocked via the second network card. If an alarm is triggered, the data path is blocked via this first network card and the data path is opened via the second network card. Thus, two differently treatable data paths are available for the output to the public network. While the data path via the first network card allows open access by any user to available data, the second network card only allows connections to network servers whose URL addresses are stored as previously known. These connections are recognized as secure connections and are available for data exchange in the event of an alarm. Since both network cards are physically separated from each other, so a restriction of the data exchange can be realized, which excludes unauthorized access.

The respective outputs are provided with separating members as switching means. These isolators are switchable so that in normal operation there is a connection of the normal output to the open network and the connection of the alarm output is prevented with the open network, while in case of alarm only a connection of the output of the second network card with the open network; the connection of the normal output to the external network is prevented in this case.

The switching means are designed as electronic switches, and designed to handle preferably large, resulting in image transmission image data streams. These are common electronic switches that can handle a large data stream.

The alarm network card is equipped with test stations. A test station is used to check the various addresses of accessing in the event of an alarm server helpdesks whose URL is deposited as authorized in a memory. A second test station allows checking the Passwords, so that the connection is kept above the data path opened in the event of an alarm only if the password matches the password stored for the URL of the accessing server of the assistance center. This ensures that data exchange in the event of an alarm can only take place via secure connections to the authorized network server.

The switching means of the isolators are designed as a changeover switch, and designed to handle preferably large, resulting in image transmission image data streams. Serve electronic switches with the capacity for large data streams.

The server of the help-seeking body has at least one internal or external hard disk on which at least the image data can be recorded. The hard disk is advantageously provided with a time buffer. This allows a time-delayed retrieval of the stored image information and so also access to temporally past image sequences.

• – Übergabe zumindest von Videodaten von Überwachungskameras des hilfesuchenden Netzes sowie anderer Daten über ein internes LAN an den Server des digitalen Informationssystems der Hilfesuchenden Stelle und deren ständiges Aufzeichnen auf eine Festplatte des Servers;
• – Führung des Datenaustauschs von dem Server des digitalen Informationssystems des Hilfesuchenden Netzes über zwei Datenpfade, in die jeweils ein Trennglied eingeschaltet ist, wobei die beiden Trennglieder so geschaltet sind, dass jeweils nur eines dieser Trennglieder offen, das andere geschlossen ist,
• – Öffnung im alarmfreien Normalbetrieb des ersten Datenpfades durch Aktivierung des ersten Trenngliedes und Schließung des zweiten Datenpfades durch Deaktivierung des zweiten Trenngliedes,
• – Öffnung im Alarmfall des zweiten Datenpfades durch Aktivierung des zweiten Trenngliedes und Schließung des ersten Datenpfades durch Deaktivierung des ersten Trenngliedes,
• – Überprüfung im Alarmfall der Adresse (URL1, URL2) eines zugreifenden Servers eines der Hilfeleistungsnetze (41, 42, 43) auf Übereinstimmung mit einer als berechtigt in einer Prüfstation gespeicherten Adresse (URL1, URL2) auf deren Übereinstimmung, wobei nur bei Übereinstiummung der Adressen der zweite Datenpfad zum Datenaustausch geöffnet wird.

To establish a secure connection from the server of the digital information system of the help-seeking body to an assistance network of a support center via an external network, the following method steps are advantageous:

• - Transfer at least video data from surveillance cameras of the help-seeking network and other data via an internal LAN to the server of the digital information system of the help-seeking body and their continuous recording on a hard disk of the server;
• - Guiding the data exchange from the server of the digital information system of the Hilfesuchenden network via two data paths, in each of which a separator is turned on, the two dividers are connected so that only one of these separators open, the other is closed,
• Opening in alarm-free normal operation of the first data path by activation of the first isolator and closure of the second data path by deactivation of the second isolator,
• Opening in the event of an alarm of the second data path by activating the second isolator and closing the first data path by deactivating the first isolator,
• - checking in the event of an alarm the address (URL1, URL2) of an accessing server of one of the assistance networks ( 41 . 42 . 43 ) to match an address (URL1, URL2) stored as authorized in a test station for their match, wherein only when the addresses match the second data path is opened for data exchange.

The essence of the invention will be apparent from the in 1 illustrated embodiment illustrated in more detail; shows

1 : Data flow diagram for a secured connection.

To a server of a digital information system 10 the help-seeking job with (internal or external) hard drive is on the one hand an internal LAN 11 connected for general data, as well as the video data of the security cameras used for security 12 , About the data outputs 13 and 14 the available data can be output or queried. An additional alarm output 15 takes over from anywhere the help-seeking body z. B. in a raid o. The like. Triggered alarm signal and passes it over the output 15 the I / O interface 20 to.

The I / O interface 20 has two data paths 21 and 24 for the data from the digital information system 10 on. These are for data exchange with the data I / O 13 and 14 over the connections 21.1 and 24.1 connected. The first of these data paths 21 leads via a first isolator 22 to the exit 23 who shares this data with the external network 30 feeds. The other data path 24 is about a second separator 25 guided, which is open in case of alarm. Both isolators are from an alarm switcher 29 driven by the connection 29.1 with the alarm output 15 of the digital information system 10 connected is. The thus transmitted alarm signal acts via the alarm transmitter 29 on the dividers 22 and 25 so that, in alarm-free normal case, the isolator 22 open, the isolator 25 is closed, which reverses this position of the isolators in the event of a present alarm. The facilitator authorized for data exchange 41 . 42 or 43 now has access to the video data and possibly also to audio data recorded by the surveillance cameras 12 the help-seeking body and stored in the digital information system 10 the job seeker job.

The data path assigned to the normal case 21 is over the exit 21.2 with the external network 30 and its WEB server 31 connected. The data path associated with the alarm 24 is first about a test member 26.1 to check the address of one over the external network 30 on the digital information system 10 the help-seeking site accessing help server 41 . 42 respectively. 43 each with its own URL address. If this address agrees with that stored in the "Address" check element, this data path is released and a second check element 26.2 forwarded to check the password for compliance with the password stored for this address. If this check also results in a match, the data path becomes the output 24.2 connected through.

If this match is missing on one of the test members 26.1 respectively. 26.2 , the control will "termination connection" 28 controlled, the (initially open) isolator 25 about the controller 28 "Breaking the connection" locks. This ensures that the data flow normally via the (not further secured) data line 21 to the external network with the WEB server 30 while in the event of an alarm, a (double) secure connection can be established by the service provider to the job seeker. In addition, this can live on the video data of the surveillance cameras 11 as well as microphoned surveillance cameras 11 also access the audio data. This also allows storage of past data for archiving purposes. If the hard disk is provided with a time buffer, this enables a time-delayed data transmission (known from HD recorders) of the video and possibly also audio data from a past period. In order to prevent the hard disk from running out, data that was recorded before a (generally predefinable) period of time is overwritten by newer data. Through this training of the server of the Job Seekers Help Desk, the Aid Agency is also able to access temporally past images and can thus gain a good overview of the development of the situation.

LIST OF REFERENCE NUMBERS

10

digital information system 10

11

Internal LAN 11

12

surveillance cameras 12

13

Data input / output 13

14

Data input / output 14

15

alarm output 15

16

17

18

19

20

I / O interface 20

21

data path 21

21.1

entrance

21.2

output 21.2

22

first isolator 22

23

24

data path 24

24.1

output 24.1

24.3

output 24.2

25

second isolator 25

26.1

(first) examiner (URL) 26.1

26.2

(second) examiner (password) 26.2

27

28

Demolition connection " 28

29

Alarm switch 29

29.1

Alarm switch connector

30

External network /

31

WEB server 31

32

33

34

35

36

37

38

39

40

41

Assistance body 1

42

Assistance body 2

43

Aid body 3

Claims (6)

I / O interface for establishing a secure connection for data exchange between a network server of a digital information system of a help-seeking network ( 10 ) and a server of assistance networks ( 41 ; 42 ; 43 ) with the following features: - the network seeking assistance comprises, on the one hand, an internal LAN ( 11 ) with the network server and on the other monitoring means ( 12 ) whose data is stored on a hard disk and at least one alarm device for triggering an alarm; - the I / O interface ( 20 ) has a first data path ( 21 ) and a second data path ( 24 ), both of which are physically separate from each other, and only one of which is open for data exchange over an external network at a time; - each of the data paths ( 21 . 24 ) has a separating member ( 22 . 25 ), - each of the isolators ( 22 . 25 ) of the first and second data paths ( 21 ; 24 ) interacts with the alarm transmitter in such a way that in alarm-free normal operation the first isolator is activated and the second isolator is deactivated, while in the event of an alarm the first isolator ( 22 ) and the second isolator ( 25 ), so that normally a data flow over the first data path ( 21 ) and in the event of an alarm, the data flow exclusively via the second data path ( 24 ) is released; The second data path ( 24 ) has at least one test station ( 26.1 ; 26.2 ) for checking the address (URL1; URI2) and / or a password of an accessing server of one of the assistance networks ( 41 ; 42 ; 43 ) authorizing access to the hard disk of the network server of the digital information system of the network seeking help ( 10 ) stored video and / or audio data. I / O interface according to claim 1, characterized by two physically separate network cards, the first network card for the first data path ( 21 ) and the second network card for the second data path ( 24 ), of which only one of the data paths ( 21 ; 24 ) for data exchange over the external network ( 30 ), and wherein in each of the network cards the data paths ( 21 . 24 ) corresponding separating members ( 22 . 25 ) are provided. I / O interface according to claim 1 or 2, characterized by at least one test means ( 26.1 ), which is designed in such a way that, in the event of an alarm, it receives the information from the accessing server of one of the assistance networks ( 41 ; 42 ; 43 ) transmitted URL of a to the server of the digital information system of the help-seeking network ( 10 ) the server of the assistance network accessing the requesting body ( 41 ; 42 ; 43 ) with the access rights for servers of assistance networks ( 41 ; 42 ; 43 ) compares stored URL addresses and, if they match, allows a connection with the accessing help point, in case of non-compliance. I / O interface according to Claim 3, characterized by further test means, of which a second test device ( 26.2 ), which is designed in such a way that, in the event of an alarm, it receives the information from the accessing server of an assistance network ( 41 ; 42 ; 43 ) transmitted password to the server of the digital information system ( 10 ) the server of an assistance network accessing the requesting body ( 41 ; 42 ; 43 ) compares with the stored for a permission to exchange data for this URL address and allows a data exchange on this connection with the accessing assistance device in case of agreement, locks in case of non-compliance. I / O interface according to claim 3 or 4, characterized in that the test equipment ( 26.1 . 26.2 ) is designed as a shift register, which interacts with one of the access-authorized URL addresses and the memory containing these passwords associated with passwords. Method for establishing a secure connection for data exchange between the network server of a digital information system of a help-seeking network ( 10 ) and a server of assistance networks ( 41 . 42 . 43 ) of different address (URL1, URL2) via an I / O interface according to one of claims 1 to 5, wherein the help-seeking network comprises on the one hand an internal LAN and on the other monitoring means, with the following method steps: - transferring at least video data from surveillance cameras of the help-seeking network as well as other data via an internal LAN to the server of the digital information system of the person seeking help Stel le and their continuous recording to a hard disk of the server; - Guidance of the data exchange from the server of the digital information system of the help-seeking network via two data paths, in each of which a separator is turned on, wherein the two dividers are connected so that only one of these dividers open, the other is closed, - opening in alarm-free Normal operation of the first data path by activation of the first isolator and closure of the second data path by deactivation of the second isolator, - opening in case of alarm of the second data path by activating the second isolator and closure of the first data path by deactivating the first isolator, - checking in the event of an alarm the address ( URL1, URL2) of an accessing server of one of the assistance networks ( 41 . 42 . 43 ) on the match, with an address (URL1, URL2) stored as authorized in a test station for their match, whereby the second data path is opened for data exchange only if the addresses match.

Images