DE102007032998A1 - Method for determining a use authorization of payload data of a data carrier in a computing device - Google Patents

Abstract

The invention relates to a method for creating a data carrier (100) which contains at least user data (200) and data for determining a use authorization (201) for use in a computing device (600), in particular a navigation system,
- wherein the data carrier (100) has an unchangeable identification tag (101),
wherein test data (202) are produced in a first method step (1) as a function of the identification identifier (101) of the data carrier (100) and at least part of the user data (200),
wherein, in a second method step (2), the data for determining a use authorization (201) is created as a function of a first cryptographic data record (311) and the check data (202),
- In a third step (3) the user data (200) and the data for determining a use authorization (201) are written to the data carrier (100).

Description

State of the art

The The invention is based on a method according to the type of independent Claims.

From the EP 1 655 576 A1 It is known to provide navigation data for a navigation system, the use and distribution of which can be controlled. The navigation data are stored here on a non-volatile storage medium and made available to the navigation system over this. A method is shown with which an access control for the access of the navigation system to the navigation data of the storage medium is made. According to one embodiment, the navigation data is stored unencrypted on the storage medium. Furthermore, an access protection code is created, which depends on an identification code of the storage medium. An access of the navigation system to the navigation data is only possible with a valid access code or access key code. The method allows only those users of a navigation system access to the navigation data, which have a valid access code or access key code. This access code or access key code may only be known to those users who should also have access to the navigation data.

Disclosure of the invention

Advantages of the invention

The inventive method for determining a Use authorization of user data of a data medium in a computing device, in particular a navigation system, has the advantage that a use of User data, which are stored on a data carrier, in a computing device, in particular a navigation system, is granted only if it is the disk is a disk, which is a legitimate manufacturer or distributor of user data was created. This prevents that without authorization a copy of the payload on another disk is created and by means of the other disk this Copy of the payload for use in a computing device, in particular in a navigation system, are accessible.

The inventive method for creating a Disk is suitable on the disk stored user data against unlawful Protect duplication. In the disk it is a storage medium, preferably a non-volatile Storage medium, such as a Secure Digital Memory Card, a Secure Digital High Capacity Memory Card, a Mini Secure Digital Memory Card, a Multimedia Card, a Reduced Size Multimedia Card, a Multimedia Card Micro, a CD, a DVD, a hard disk or another form of nonvolatile storage medium.

Of the Data carrier has according to the invention a unchangeable identification. In a first Process step will be test data depending on this identifier of the disk and at least created a part of the user data. The creation of test data is done by a mapping function, which identifies the identifier and at least part of the payload data on the test data displayed. Such a mapping function may be for example, a hash algorithm, such as the Message-Digest-Algorithm-5, the Secure-Hash-Algorithm-1, the Secure-Hash-Algorithm-2 or another hashing algorithm.

In In a second method step, data for determining a Usage authorization of the user data as a function of at least a first cryptographic record and the test data created. In a third step, the user data and the data for determining a usage authorization of the payload written to disk. The disk is it is that disk whose identification tag in the first step for creating the test data has been used.

It is according to the invention for the legitimate Manufacturer or distributor of user data possible, by Implementation of the method according to the invention for different volumes with different Identification identifiers respective different data for determination to create a use authorization of user data, and the User data and the individual for the disk Data for determining a use authorization of the user data to write on the respective media. Such Creating the data carrier is only possible when in the implementation of the invention Procedure the first cryptographic record is known.

Preferably the data consist of determining a use authorization from first partial data and second partial data. This is advantageous because thus to different partial data in the course of a determination a use authorization of payload data can be accessed.

Preferably, the payload data is map data for a navigation system. This is advantageous because it is thus a navigation System is made possible to make a route guidance of a user based on the user data.

Preferably the first cryptographic record is a first key of an asymmetric cryptography method. This is It is possible to use the first cryptographic record of an asymmetric cryptographic algorithm to create.

The Method according to an independent claim takes a determination of a usage authorization of payload data a present data carrier in a computing device, in particular a navigation system. The method has the advantage that only such payloads are used in a computing device, which are located on a current data carrier, which of a legitimate manufacturer or Distributor of the user data was created.

According to this Procedure, the disk has an unchangeable Identification tag. On the disk are at least user data and data for determining a use authorization the user data. The data for determining a use authorization of user data are to be checked to see if they are data for Determination of a use right, which was previously used by a legitimate manufacturer or distributor were created depending on such test data, which in turn depends on the identifier of the present data medium.

In a first process step depending on the Identification identifier of the present data carrier and at least a part of the payload test data created. The test data is created by the same Imaging function, which previously according to the invention Procedure for creating a disk was used.

In a second process step depending on at least one second cryptographic record and at least part of the data for determining a use authorization third data created. The second cryptographic record corresponds to the first cryptographic record. Further, the second one Cryptographic record unchangeable in a subsection of a Storage unit of the computing device stored. Preferably the second cryptographic record in a separate storage unit stored the calculator immutable.

Preferably is the second cryptographic record without restriction stored accessible. Accessible without restriction filed means that the second cryptographic record is off the storage unit can be read unhindered, or that the second cryptographic record from another storage unit or a storage medium located outside the computing device can be read without hindrance. A successful Implementation of the method according to the invention is possible even if preferably the second cryptographic Record is stored without restriction.

The third data serve according to the invention a determination a use authorization of the user data of the present data carrier. The third data is dependent on the data Determination of a use authorization, which in turn depends on to the identifier of that volume, on which the payload originally by a lawful Manufacturer or distributor were written. It is thus possible Use the third data to determine if the identifier of the present data carrier with the identification identifier of the data carrier on which the User data originally by a lawful Manufacturer or distributor were written.

According to the invention the first cryptographic record only a lawful one Manufacturer or distributor of user data accessible. This will ensured that only this manufacturer or distributor in the Able to provide data for determining a use authorization of Create user data, which of the identifier of a Depend on him created disk and also to grant the use of payload data of the volume to lead.

Preferably a determination of a usage authorization of the user data takes place the present data carrier in a computing device, by the third data with those created in the first step Test data of the kind to be compared that with a positive Result of the comparison of the computing device the use of User data of the present data carrier granted becomes.

Of the Comparison of the third data and the test data can be up be made different way. Preferably, the Comparison of the third data and the test data by one direct equivalence comparison of the third data and the Test data made. Further, other forms of a Comparison possible by means of different comparison functions. Preferably, a comparison function includes a modulo operation.

The third data is dependent on the data for determining a use authorization of the present data medium. These data for determining a use authorization are in turn dependent on the identifier of the data carrier on which the user data and the data for determining a use authorization by a legitimate manufacturer or distributor were written. Thus, the third data is also dependent on the identifier of the data carrier on which the user data and the data for determining a use authorization by a legitimate manufacturer or distributor were written. The test data in turn are dependent on the identifier of the present data carrier.

Preferably It is thus by comparing the third data and the test data possible to determine if this is the case Disk is a disk whose Identification by the lawful Manufacturer or distributor for the preparation of data for determination a use authorization was used.

Of the first cryptographic record is according to the invention only a legitimate manufacturer or distributor the user data accessible. The second cryptographic record is unchangeable according to the invention a portion of a memory of the computing device stored. It is therefore not possible, the user data and the data to determine a right of use of a lawful created disk on a second, unlawful to be created disk with a different identifier to copy that second volume with the on it copy of the user data and the copy of the data for determination use authorization in a computing device. Because by the inventive method can be determined that an identification identifier of a present, unlawfully created volume does not match the identifier of a volume, which by the legitimate manufacturer or Distributor for creating the data for determining a use authorization was used.

Further is it possible to rule out that new, changed Data for determining a use right on the unlawful written volumes are written, which is a Use a copy of the user data. Because to provide such data for determining a use authorization create, which in the implementation of the invention Procedure for granting the use of user data lead, the first cryptographic record must be known be. Since according to the invention this first cryptographic Record only a legitimate manufacturer or distributor of data carriers with user data is known, is an illegal creation of data media with copies of the payload for use in one Calculation device not possible.

Preferably the first cryptographic record is a first key of an asymmetric cryptography method. This is advantageous because the first cryptographic record thus systematic by means of an algorithm of an asymmetric cryptography method can be created to generate a key.

A Creation or generation of the first and second cryptographic Record is not necessarily to an identifier bound to a volume. Furthermore, a creation or a generation of the first and second cryptographic Record not necessarily to an identification identifier, in particular a serial number, a computing device, in particular a navigation system bound.

Around Ensure that only such media is provided for of payload data in computing devices used by one created by a legitimate manufacturer or distributor it is only necessary that a lawful Manufacturer or distributor of user data the first cryptographic Record keeps secret. The second cryptographic record may preferably be publicly accessible, without an examination to see if the disk from the legitimate manufacturer or distributor has been created to endanger.

Preferably is the second cryptographic record as a second key an asymmetric cryptography method is formed. hereby is it possible to use the second cryptographic record using an algorithm of an asymmetric cryptography method to create systematically.

Preferably is the asymmetric cryptography method around a method of creating a digital signature so that it can be the data for determining a use right by one digital signature acts.

Preferably, the first cryptographic data set is a first key of an asymmetric cryptography method. Furthermore, it is advantageous to use the first key of the asymmetric cryptography method as the secret key of an asymmetric cryptogra training procedure. This makes it possible to create data for determining a use authorization of user data, which is a digital signature.

Advantageous it is further, the second key as public Key of an asymmetric cryptography method which form the first, secret key of the asymmetric cryptography method.

In a preferred embodiment is in the first cryptographic record around a private key and the second cryptographic record one for private Key corresponding public key according to an RSA procedure. Preferably using a hash algorithm depending on user data and an identifier of a first volume Test data calculated in the form of a hash value. Then be preferably data for determining a use authorization the kind created by means of the private key depending on the hash value an encrypted Hash value is calculated. The payload and the encrypted hash value are preferably written to the first volume. Should a usage authorization be used for a given volume are determined by user data, so are preferably by means of a Hash algorithm depending on user data and one Identification identifier of the present data carrier test data calculated in the form of a second hash value. By means of public Key is preferably located on the present Disk encrypted hash value decrypted into a hash value to be tested. Subsequently, preferably the hash value to be checked and compared the second hash value. If these values match, so it can preferably be assumed that it is the current volume to a disk acts on which payload of a legitimate Manufacturer or distributor of the user data were written, which is why a use of the user data is granted.

According to one Embodiment takes place a determination of a use authorization the user data of the present data carrier in a computing device, by adding the third data initially in addition Dependence of the test data are created, and by comparing the third data with other data. According to this embodiment exist the data for determining a use right from first Partial data and second partial data. According to this embodiment acts it is the other data to the first partial data.

Of the Comparison of the third data and the first partial data may be different Be made way. Preferably, the comparison is by a direct equivalence comparison of the third data and the first partial data made. Further, other forms of a Comparison possible by means of different comparison functions. Preferably, a comparison function includes a modulo operation.

The third data are preferably in additional dependency to the test data. The test data are in turn depending on the identifier of the present invention Data carrier. Thus, preferably also the third Data dependent on the identifier of the present data medium. The first partial data, as partial data of the data for determining a use right, are in Dependency to the identification tag of that data carrier, on which the user data and the data for determining a use authorization by a legitimate manufacturer or distributor were written.

Preferably So it is by comparing the third data and the first one Partial data possible to determine whether the present Disk is a disk whose Identification by the lawful Manufacturer or distributor for the preparation of data for determination a use authorization was used.

Preferably the first cryptographic record is a private key and the second cryptographic Record to a corresponding to the private key, public Key according to a method according to Digital Signature Algorithm or Elliptic Curve Digital Signal Algorithm. Preferably, by means of a hash algorithm depending on user data and an identification identifier a first volume test data in the form of a Hash value calculated. Subsequently, preferably Create data to determine a use authorization of the type, that by means of the private key depending on of the hash value a digital signature is calculated. The digital Signature preferably has a first signature part R and a second signature part S on. The user data and the digital signature are preferably written to the first volume.

If an intended use of user data is to be determined in the case of a present data carrier, test data in the form of a second data are preferably generated by means of a hash algorithm as a function of user data and an identification code of the present data carrier Hash value calculated.

Preferably be by means of the public key, the first signature part R, the second signature part S, the hash value and the public key third data in Form of the data V calculated. Preferably, the data V with the first signature part R compared. The comparison can be different Comparison functions take place. A comparison function depends depending on which signature method is preferably used. If there is a positive result of the comparison, then preferably It can be assumed that the present data medium is a disk on which payload of a legitimate manufacturer or distributor of User data was written. Therefore, preferably, the computing device granted a use of the user data.

The Computing device according to a sibling Claim, in particular a navigation system, is to carry out the method according to the invention suitable. According to the invention, the Calculating means a reading unit for reading out user data and Data for determining a use authorization from a data carrier. The computing device furthermore has a memory unit for providing a second cryptographic record. The second cryptographic Record is immutable in a subset of the storage unit the computing device stored. This subarea can be Be part of the storage unit, it is also preferably provided another storage unit for storing the second cryptographic Form record. The computing device has a computing unit which, for carrying out the inventive Method uses the reading unit and the storage unit.

to Implementation of the first invention Process step creates the arithmetic unit in dependence the identifier of the disk and at least a part of the payload test data. To carry out of the second method step, the arithmetic unit creates third Data dependent on at least one second cryptographic Record and at least part of the data for determination a use authorization. To carry out the third Procedural step, the arithmetic unit takes a comparison of third data with more data of the kind that with a positive Result of the comparison of the computing device the use of User data of the disk is granted.

Preferably the further data are the test data. This has the advantage that by comparing the third data a determination of a use authorization with the test data the user data are performed in the computing device can.

According to one Embodiment will be the third data first additionally depending on the test data created and then compared with other data. According to this embodiment exist the data for determining a use right from first Partial data and second partial data. According to this Embodiment is the other data for the first part data.

The Computing device according to the invention has the advantages the method of the invention for the determination a use authorization of payload data of a data carrier on.

Brief description of the drawings

embodiments The invention is illustrated in the drawings and in the following Description explained in more detail.

1a shows a data carrier according to the invention.

1a shows a data carrier according to the invention with navigation data and data for determining a use authorization of user data.

1c shows data according to the invention for determining a use authorization of user data.

2 shows the implementation of the method according to the invention for creating a data carrier.

3a shows a data carrier, which is used in an implementation of the method according to the invention for determining a use authorization of user data in a computing unit.

3b shows data for determining a use authorization of payload data in a computing unit.

4a shows a first method step of the inventive method for determining a use authorization of user data in a computing unit.

4b shows a second method step of the inventive method for determining a use authorization of user data in a computing unit.

4c shows a third method step of the inventive method for determining a use authorization of user data in a computing unit.

5 shows a first embodiment of the third method step of the inventive method for determining a use authorization of user data in a computing unit.

6a shows an embodiment of the second method step of the inventive method for determining a use authorization of user data in a computing unit.

6b shows a second embodiment of the third method step of the inventive method for determining a use authorization of user data in a computing unit.

7 shows a first and a second cryptographic record, which correspond to each other.

8th shows a computing device according to the invention.

9 shows a preparation of a copy of a data carrier according to the invention.

10a shows an embodiment of the first method step of the inventive method for determining a use authorization of user data in a computing unit.

10b shows an embodiment of the second method step of the inventive method for determining a use authorization of user data in a computing unit.

10c shows an embodiment of the third method step of the inventive method for determining a use authorization of user data in a computing unit.

embodiments the invention

1a shows a volume 100 which is an identification identifier 101 own, which is unchangeable. The inventive method for creating a data carrier has the goal of a disk according to 1b to create. This disk 100 on the one hand has an unchangeable identification identifier 101 on. Further, on the disk 100 payload 200 and data for determining a use authorization 201 the user data 200 stored.

The inventive method for creating a data carrier 100 according to 1b can be found in 2 , In a first process step 1 become the identifier 101 and the payload 200 for the creation of test data 202 used. In a second process step 2 are based on a first cryptographic record 311 depending on the test data 202 the data for determining a use authorization 201 the user data 200 created. In a third process step 3 the data is used to determine a use authorization 201 together with the payload 200 on the disk 100 written.

As in 1c shown, the data to determine a use authorization 201 preferably from first partial data 211 and second part data 212 ,

3a shows a present volume 1000 with unchangeable identification 1001 as well as on the data carrier 1000 stored user data 2000 and data for determining a use authorization 2001 the user data 2000 ,

As in 3b shown, the data to determine a use authorization 2001 preferably from first partial data 2011 and second part data 2012 ,

4a shows the implementation of a first method step 11 the method for determining a use authorization of the user data 2000 of the disk 1000 according to 3a in a computing device 600 , In the first process step 11 become test data 302 depending on the identifier 1001 and at least part of the payload 2000 created.

The implementation of the second process step 12 is in 4b shown. In this second process step 12 third data 400 depending on a second cryptographic record 312 and at least part of the data for determining eligibility 2001 created.

The second cryptographic record 312 is unchangeable in a subarea 603 the storage unit 602 the computing device 600 stored as in 8th shown.

According to 4c is in a third step 13 a comparison of the third data 400 and more data 500 of the kind that, in the case of a positive result of the comparison, the method to the method step 20 branched. In this process step 20 becomes the computing device 600 the use of the payload 2000 of the disk 1000 granted. If the comparison does not result in a positive result, the procedure branches ren to the process step 21 in which the computing device 600 the use of the payload 2000 of the disk 1000 is not granted.

As in 5 it is preferably shown in the other data 500 around the test data 302 ,

As in 6a the third data are shown 401 in the second process step 120 preferably additionally depending on the test data 302 created. Subsequently, according to 6b preferably in the third process step 130 a comparison of the third data 401 with the first partial data 2011 of the kind that, in the case of a positive result of the comparison, the method to the method step 20 branched. In this process step 20 becomes the computing device 600 the use of the payload 2000 of the disk 1000 granted. If the comparison does not result in a positive result, the method branches to the method step 21 in which the computing device 600 the use of the payload 2000 of the disk 1000 is not granted.

The first cryptographic record 311 and the second cryptographic record 312 must correspond to each other, so that in the process step 13 comparison results in a positive result. Two cryptographic records corresponding to each other 311 and 312 are in 7 as elements of a common set 320 represented by two records.

A creation or generation of the first and second cryptographic records 311 . 312 is not necessarily an identifier of a volume 100 . 1000 bound. Further, a creation or generation of the first and second cryptographic data sets 311 . 312 not necessarily to an identification identifier, in particular a serial number, a computing device 600 , in particular a navigation system, bound.

To ensure that only such disk 100 . 1000 for the provision of user data 200 . 2000 in a computing device 600 used by one of a legitimate manufacturer or distributor, it is only necessary that a legitimate manufacturer or distributor of user data 200 . 2000 the first cryptographic record 311 keeps secret. The second cryptographic record 312 may preferably be publicly available without checking if the disk 100 . 1000 has been created by the legitimate manufacturer or distributor.

Will, as in 9 represented, the disk 100 with the identifier 101 used to from the disk, the user data 200 and the data for determining a use authorization 201 to another disk 1100 to copy, so assigns the disk 1100 an identifier 1101 on, which on the one hand of the identification identifier 101 of the disk 100 and on the other hand to compile the data for determining a use authorization 2001 taken into consideration.

Now goes this identification 1101 according to 10a instead of the original identifier 1001 in the first process step 11 together with the payload 2000 This results in different test data 3021 which differ from the original test data 302 in 4a differ.

According to 10b be in the second process step 12 the third data 400 depending on the second cryptographic record 312 and at least part of the data for determining eligibility 2001 created.

Be according to 10c preferably the different test data 3021 with the third data 400 compared, the comparison results in a negative result, which is why the method to the process step 21 branched. In this process step 21 becomes the computing device 600 the use of the payload 2000 of the disk 1100 is not granted.

In 8th is a computing device 600 shown. The computing device 600 has a reading unit 601 for reading data from a data carrier 100 . 1000 on. Furthermore, the computing device has 600 an arithmetic unit 604 and a storage unit 602 on. In a subarea 603 the storage unit 602 is the second cryptographic record 312 immutable stored. The computing device 600 is using the reading unit 601 , the computing unit 604 and the storage unit 602 able to perform the inventive method for determining a use authorization of user data.

In a final, concrete exemplary embodiment, the sequence of the methods according to the invention and the mode of operation of the inventive calculating device are explained again:
A secure digital memory card 100 owns a card identifier 101 , The navigation data 200 as well as the card identifier 101 are based on a hash function, for example, the secure hash algorithm-1, used to a hash value 202 to calculate. A private key 311 a Digital Signature Algorithm is used to generate in Dependency of the hash value 202 the signature data 201 to calculate. The signature data 201 consist of the partial signature R 211 and the partial signature S 212 , The signature data 201 and the navigation data 200 be in the third step 3 on the SD card 100 saved.

An SD card 1000 is the navigation system 600 fed so that the SD card 1000 in the reading unit 601 , which is designed as an SD card reader, is inserted. The navigation system 600 leads now by means of the arithmetic unit 604 , which can be designed as a CPU, with the aid of the SD card reader 601 and the memory 602 the method for determining a use authorization of the navigation data 2000 on the disk 1000 by. In the storage unit 602 is in a subarea 603 the public key 312 the Digital Signature Algorithm, which is the private key 311 of the Digital Signature Algorithm corresponds, stored immutable. First of all, from the SD card 1000 the card identifier 1001 and at least part of the navigation data 2000 to use the secure hash algorithm-1 to hash the hash value 302 to calculate. The signature data 2001 contain the first partial data 2011 , which are named as first partial data R, and the second partial data 2012 , which are named as second partial data S. Now the third data 401 , which are named as third data V, depending on the first partial data R 2011 , the second partial data S 2012 , the hash value 302 as well as the public key 312 calculated. Subsequently, the third data V 401 with the first partial data R 2011 compared. Voices the third data V 401 with the first partial data R 2011 agree, so there is a positive result of this comparison, so that the navigation system 600 the use of navigation data 2000 is granted.

QUOTES INCLUDE IN THE DESCRIPTION

This list The documents listed by the applicant have been automated generated and is solely for better information recorded by the reader. The list is not part of the German Patent or utility model application. The DPMA takes over no liability for any errors or omissions.

Cited patent literature

• - EP 1655576 A1 [0002]

Claims (16)

Method for creating a data carrier ( 100 ), which has at least user data ( 200 ) and data for determining a use authorization ( 201 ) for use in a computing device ( 600 ), in particular a navigation system, - wherein the data carrier ( 100 ) an unchangeable identifier ( 101 ), wherein - in a first process step ( 1 ) Test data ( 202 ) depending on the identifier ( 101 ) of the data carrier ( 100 ) and at least part of the payload ( 200 ), - in a second step ( 2 ) the data for determining a use authorization ( 201 ) depending on a first cryptographic data set ( 311 ) and the test data ( 202 ), - in a third step ( 3 ) the user data ( 200 ) and the data for determining a use authorization ( 201 ) on the data carrier ( 100 ) to be written. Method according to Claim 1, characterized in that the data for determining a use authorization ( 201 ) from first partial data ( 211 ) and second (212) sub-data. Method according to Claim 1 or 2, characterized in that the user data ( 200 ) are formed as map data for a navigation system. Method according to Claims 1 to 3, characterized in that the first cryptographic data record ( 311 ) is formed as a first key of an asymmetric cryptography method. Method for determining a use authorization of user data ( 2000 ) of a data carrier ( 1000 ) in a computing direction ( 600 ), in particular a navigation system, - wherein the data carrier ( 1000 ) an unchangeable identifier ( 1001 ) - where on the disk ( 1000 ) at least user data ( 2000 ) and data for determining a use authorization ( 2001 ) - wherein in a first process step ( 11 ) Test data ( 302 ) depending on the identifier ( 1001 ) of the data carrier ( 1000 ) and at least part of the payload ( 2000 ), - in a second step ( 12 ) third data ( 400 ) as a function of at least one second cryptographic data set ( 312 ) and at least part of the data for determining eligibility ( 2001 ), - in a third step ( 13 ) a comparison of the third data ( 400 ) with further data ( 500 ) is carried out of the kind that, in the case of a positive result of the comparison of the computing device ( 600 ) the use of the payload ( 2000 ) of the data carrier ( 1000 ). Method according to Claim 5, characterized in that the further data ( 500 ) about the test data ( 302 ). A method according to claim 5, characterized in that the data for determining a use authorization ( 2001 ) from first partial data ( 2011 ) and second partial data ( 2012 ) and that the third data ( 400 ) additionally depending on the test data ( 302 ) and that the other data ( 500 ) around the first partial data ( 2011 ). Method according to Claims 5 to 7, characterized in that the user data ( 2000 ) are formed as map data for a navigation system. Method according to Claims 5 to 8, characterized in that the second cryptographic data set ( 312 ) is formed as a second key of an asymmetric cryptography method. Method according to claim 9, characterized that the second key of an asymmetric cryptography method stored without restriction. Computing device ( 600 ), in particular navigation system, for carrying out the method according to claim 5, characterized by - a reading unit ( 601 ) for reading out user data ( 2000 ) and data for determining a use authorization ( 2001 ) from a data carrier ( 1000 ) - a storage unit ( 602 ) for providing the second cryptographic data set ( 312 ), - a computing unit ( 604 ) using the reading unit ( 601 ) and the storage unit ( 602 ) - test data ( 302 ) depending on the identifier ( 1001 ) of the data carrier ( 1000 ) and at least part of the payload ( 2000 ), - third data ( 400 ) as a function of at least one second cryptographic data set ( 312 ) and at least part of the data for determining eligibility ( 2001 ), - a comparison of the third data ( 400 ) with further data ( 500 ) of the kind that, in the case of a positive result of the comparison of the computing device ( 600 ) the use of the payload ( 2000 ) of the data carrier ( 1000 ). Computing device according to claim 11, characterized in that the further data ( 500 ) about the test data ( 302 ). Computing device according to claim 11, characterized in that the data for determining a use authorization ( 2001 ) from first partial data ( 2011 ) and second partial data ( 2012 ) and that the third data ( 400 ) additionally depending on the test data ( 302 ) and that the other data ( 500 ) around the first partial data ( 2011 ). Method according to Claims 11 to 13, characterized in that the user data ( 2000 ) are formed as map data for a navigation system. Method according to claim 11 to 14, characterized in that the second cryptographic data set ( 312 ) is formed as a second key of an asymmetric cryptography method. Method according to claim 15, characterized in that that the second key of an asymmetric cryptography method stored without restriction.