DE102015211104A1 - Method for providing authentication factors - Google Patents

Abstract

A method for providing an authentication factor, wherein a mobile computing unit (22) addresses a first server (30) managing identities with a request, the mobile computing unit (22) from the first server (30) one of key received from the first server (30), the mobile computing unit (22) sending the key to a second server (42), and the mobile computing unit (22) from the second server (42) after checking at the first server (30). the authentication factor is received.

Description

The invention relates to methods for providing an electronic authentication factor for the activation of functions, for example of functions in IoT objects. The invention further relates to a 2-factor authentication for a motor vehicle.

State of the art

As an anti-theft device, which is also referred to as a security, a device is referred to, either prevents the theft of an object or a product or the goods is rendered useless for the thief. In addition to the conventional anti-theft device, which, for example, works with locks, chemical goods security and electronic article surveillance are also known. Electronic goods security covers electromagnetic, radiofrequency and acoustomagnetic systems.

An important application for anti-theft devices is found in motor vehicles (motor vehicles). In this area, mainly conventional and electronic security systems are known. The problem with vehicle theft protection systems is that the owner of the vehicle must unlock it synchronously before every journey. As a result, there is a risk of increasing violent crime, especially in the case of high-quality vehicles. Thus, the driver can be forced to reveal a code or hand over special keys or key cards.

Furthermore, a method is known in which a thief can first steal the vehicle, but the holder subsequently has the possibility of rendering the vehicle unsuitable. This appears less dangerous for the vehicle owner.

It should also be noted that security gaps in vehicle electronics represent an ever-increasing problem. For example, modern automobiles with their mobile and Internet access offer new access points for unauthorized persons. If necessary, remote-controlled life-threatening accidents can be triggered via these new entrance gates. It should be noted that vehicle theft in the past has been the domain of pickpockets or petty criminals. Meanwhile, car theft is the field of organized crime and was perfected by this. After all, the attackers still have to move to the scene of the crime.

The networking of motor vehicles with the Internet now leads to new threat scenarios, which are characterized by the fact that the attack takes place from the Internet. Thus, an attack on a motor vehicle in Germany can certainly be carried out selectively by an attacker from afar.

In the field of data security on the Internet, it is known to use a so-called public-key infrastructure (PKI). This is a system that allows issuing, distributing and reviewing digital certificates. In this case, keystores delivered within the PKI are used to secure computer-aided communication and to authenticate the user of an app.

PKIs are used in IT to distribute keystores and validate certificates. The keystores contain a public and private key for encryption and signing of files and connections, as well as a certificate for authentication of the computer.

In this application, a keystore is understood to mean a key container in which keys, for example private and public keys, as well as a certificate for identifying the owner, are stored. A keychain is an area where keys are stored.

The authentication of users to applications is usually realized by the input of a user ID and a password. Physical characteristics or ownership factors are rarely used, as the procedures for handling these authentication factors are in many cases uncertain or cumbersome.

Occasionally, transactions are secured by additional authentication factors, such as: For example, a transfer using a mobile TAN (transaction number). However, multi-signature transactions that are electronically shared by multiple people are unknown.

Disclosure of the invention

Against this background, methods with the features of claims 1, 6 and 11 are presented. Furthermore, computer programs according to claim 13 for carrying out the method and a machine-readable memory program according to claim 14 are presented. Embodiments result from the dependent claims and the description.

The presented methods enable the secure networking of Internet of Things (IoT) objects. IoT objects are objects that have data and / or functions that can be exchanged or triggered over the Internet. These include control units and sensors in the car as well as medical technology apparatus or production machines. Only through the authentication methods described herein does the interaction of the objects by manufacturers, owners and users become controllable.

A method described herein generates and uses an App PKI User Certificate (ABZ) on a mobile phone. It is on this 2 directed. The activation is realized by an app that contains the ABZ. It is on this 3 directed. In particular, this method requires an app PKI infrastructure (A-PKI), the functionality of which is also the subject of this invention. The second method uses the car key built-in electronic key (AVK) to unlock functions in control units in the car. It is on this 4 directed. The combination of the ABZ with the test result of the AVK by the immobilizer realizes a two-factor authentication for a motor vehicle.

An authorization system implemented using the described methods receives object owners and object user data which are automatically fed into the system by the users via the use of the associated app. The owner of an IoT object can use the app to roll over additional users or to pass the IoT object to another owner. The system architecture may assist the owner eg of a robot in documenting the performed functions. It can be clarified, for example, who did what and when and with what result. The manufacturer can make the system and the IoT objects resilient through diagnostic data, selective setting of debug modes, and secure software updates, and continue to evolve as the lead time decreases, from product idea to finished product. This can be summarized with the term IoT Scrum. Scrum is a process framework in the field of software development.

It should be noted that the Internet networks its users through data exchange systems such as Mail, Chat, VoIP or FTP and thus supports the exchange of information between people, ie communication between people. In IoT and Industry 4.0, computers should use the Internet. One speaks of machine communication or speaking things.

The presented methods connect the networked objects and networked persons and bring IT concepts such as authentication and authorization into the world of things. Furthermore, the technology described here enables IoT security concepts such as localization and multi-signature transactions.

• • Im Automobil kann das Verfahren zur Freischaltung von Software- und Konfigurationsdownloads genutzt werden. Dabei können auch Multi-Signature-Transaktionen zum Einsatz kommen, die dadurch gekennzeichnet sind, dass mehrere User, wie zum Beispiel der Hersteller und der Eigentümer den Softwaredownload für das KFZ-Steuergerät (IoT-Objekt) freigeben müssen.
• • In Bereich der Industrie oder der Medizin kann das Verfahren zur Freischaltung von kosten- oder sicherheitsrelevanten Funktionen verwendet werden. So kann es erforderlich sein, dass eine Produktionslinie Material nicht vollständig selbständig nachbestellen kann, sondern dass die Freigabe durch den Kostenverantwortlichen erfolgt. Im Krankenhaus kann eine medizintechnische Anlage, wie bspw. der Start eines Anästhesiegeräts oder eines elektronischen chirurgischen Werkzeugs, die Freigabe durch einen Anästhesisten oder Arzt erfordern. In allen genannten Fällen unterstützt das Verfahren zusätzlich die Qualität der Dokumentation der durchgeführten Aktionen und hilft vorbeugend bei der Vermeidung von Verwechslungen und Fehlern.
• • Der Betreiber eines Systems, das auf dem beschriebenen Verfahren basiert, erhält integre Objekt-Besitz und Objekt-Nutzungsdaten. Diese Daten können bei der Fehlerdiagnose und der Verbesserung des Systems und der einzelnen IoT-Produkte helfen. Insbesondere das sichere Nachladen oder Korrigieren von Funktionen oder Algorithmen wird durch das beschriebene Verfahren erst ermöglicht.

The following statements are made for the use of the authentication factor ABZ:
The process for the activation of networked product functions by persons and objects has wide-ranging areas of application:

• • In automobiles, the procedure for activating software and configuration downloads can be used. In this case, multi-signature transactions can be used, which are characterized in that several users, such as the manufacturer and the owner have to release the software download for the vehicle control unit (IoT object).
• • In the field of industry or medicine, the procedure can be used to unlock cost or safety-relevant functions. For example, it may be necessary for a production line not to be able to reorder material completely on its own, but to be released by the person responsible for the costs. In the hospital, a medical device, such as the start of an anesthetic device or an electronic surgical tool, may require approval by an anesthesiologist or physician. In all cases mentioned above, the procedure additionally supports the quality of the documentation of the actions carried out and helps to prevent confusion and errors.
• The operator of a system based on the described method receives integre object ownership and object usage data. These data can help with troubleshooting and improving the system and individual IoT products. In particular, the safe reloading or correction of functions or algorithms is made possible by the method described.

• • die Registrierung eines neuen Autoschlüssels kann bspw. erst erfolgen, wenn das Fahrzeug durch den Eigentümer für diese Funktion freigeschaltet wurde – eine Freischaltung bspw. durch eine Person, die für dieses Fahrzeug nur die Rolle Fahrer besitzt, würde vom System nicht akzeptiert.
• • Die Wegfahrsperre besteht aus mehreren elektronischen Komponenten. Nach dem Austausch einer solchen muss die neue Komponente im System registriert werden. Diese Funktion kann durch eine Multi-Signature-Transaktion gesichert werden. Dabei wird es erforderlich, dass die Freigabe z. B. durch einen Monteur und durch den Eigentümer erfolgt. Vielleicht ist auch noch die Freigabe durch den Hersteller erforderlich.

For the new authentication factor AVK following statements are made:
In the case of the immobilizer in the car, the ABZ procedure can solve known or becoming known system-related security gaps by means of the additional authentication:

• For example, the registration of a new car key can not take place until the vehicle has been activated by the owner for this function - activation by, for example, a person who only has the driver role for this vehicle would not be accepted by the system.
• • The immobilizer consists of several electronic components. After replacing one, the new component must be registered in the system. This feature can be secured by a multi-signature transaction. It will be necessary that the release z. B. by a fitter and by the owner. Maybe the release from the manufacturer is also required.

If the immobilizer is first secured, it can in return for the activation of other functions, such as. The software download, as Authentication factor help. The test result of the electronic key or key (AVK) installed in the car key is used after the test by the immobilizer as a prerequisite for the start of the software download function of a control unit.

• • Software-Download
• • Konfigurations-Download
• • Sicherheits-Update
• • Debug Levels in Steuergeräten setzen
• • Diagnosedaten einsammeln und in der App speichern
• • Diagnosedaten einsammeln und auf dem Server speichern
• • Eigentümerübergabe des Autos

In the motor vehicle, the new authentication factors, ie ABZ and AVK, can be used in suitable combinations for the following function releases:

• • Software download
• • Configuration download
• • Security Update
• • Set debug levels in ECUs
• • Collect diagnostic data and save it in the app
• • Collect diagnostic data and save it on the server
• • Owner handover of the car

In this case, the ABZ can establish user and object reference, while the AVK has no user reference, since it is not known who currently holds the car key in his hands. Conversely, the ABZ can provide localization, but also from the Internet, z. For example, in multi-signature transactions, while the AVK localized the release system.

If the ABZ and / or the AVK method is installed in an asynchronous anti-theft device, this requires no additional equipment or additional handling for the user of the vehicle. However, the process can sustainably contribute to safety in the motor vehicle by a small extension. Safety or safety is the reliability and reliability of systems. Resiliency is improved by noticing faults and fixing them with software. Thus, as part of the procedure, diagnostic data can be sent to the application or application server, which in turn can be remedied by updating or updating. The updates arrive safely and appropriately authenticated on the affected ECUs. An advantage is the combination of the functions described with an asynchronous anti-theft device, since the driver to raise the anti-theft timer occasionally establishes a connection to the server, which can then also be used for the functions described, but this is not always a possibility attack from the entire Internet delivers, but by localization drastically shortened the attack vector.

The presented methods therefore make it possible in an embodiment to secure safety-relevant functions in the vehicle. The function is only executed when the ignition key has unlocked the vehicle as a possession factor. The second factor comes from the internet. It is supplied by the owner, for example, via his mobile phone, which establishes an authenticated connection to a secure server.

Thus, the presented methods can be combined with a classic immobilizer. For theft protection, this combination is a kind of two-factor protection. Here comes the electronic key for the control unit from the Internet, and the mechanical key from the car, you have to have with you.

It has thus been recognized that to secure important functions from the Internet a two-factor authentication is advantageous. It stipulates that the factors can only be applied locally. The factors should be designed to balance each other's vulnerabilities.

The developments in the area of IoT (Internet of Things), the Internet of Things, network the vehicle with the Internet. This networking can be used to implement an asynchronous anti-theft device that makes the protection of the vehicle independent of the owner. A smartphone app is used as an IoT hub to establish a cryptographically secured, authenticated connection to a server.

The anti-theft method uses the method to deliver a key that can raise a timer in the component. The theft protection is deliberately asynchronous. However, a synchronous backup, so that the vehicle only starts when the key was received, would not be practical, since the vehicle can sometimes stand in a radio hole.

• – Softwareaktualisierungen bzw. -updates durch den Besitzer oder durch die Werkstatt. Im Falle der Werkstatt richtet der Besitzer einen neuen Nutzer mit der Rolle "Monteur" ein. Dieser kann dann auch das Serviceheft pflegen und die entsprechenden Daten serverseitig dem Auto zuordnen,
• – die Registrierung eines neuen Autoschlüssels, diese kann erst erfolgen, wenn das Fahrzeug durch den Besitzer für diese Funktion freigeschaltet wurde,
• – neue Funktionen, wie bspw. der Start des Fahrzeugs beim autonomen Fahren oder die Eingabe des Fahrziels,
• – Steuerung oder Konfiguration mechanischer Komponenten, die bei Fehlern oder Manipulation zu Unfällen führen können,
• – die Änderung von elektronischen Schlüsseln zur Daten- oder Zertifikatsverschlüsselung,
• – die Übergabe des Fahrzeugs an einen neuen Besitzer.

Security-relevant functions are, for example:

• - Software updates or updates by the owner or the workshop. In the case of the workshop, the owner sets up a new user with the role of "mechanic". This can then maintain the service booklet and assign the corresponding data on the server side of the car,
• - the registration of a new car key, this can be done only when the vehicle has been unlocked by the owner for this function,
• New functions, such as the start of the vehicle in autonomous driving or the entry of the destination,
• - control or configuration of mechanical components that can lead to accidents in case of errors or manipulation,
• - the modification of electronic keys for data or certificate encryption,
• - the transfer of the vehicle to a new owner.

Previous methods of establishing connectivity to the Internet do not authenticate the owner or user. Thus, there can be no authorization, so the assignment of different roles that can then restrict the execution of different functions. In this example, these are the roles, owner, driver, mechanic. In order for an authorized person to perform the function, they must be in the vicinity of the vehicle with the evidencing user certificate.

The presented method provides in an embodiment that a second authentication factor is used in addition to the car key. The method specifically specifies this synchronous authentication factor for use in electronic IoT components.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

Brief description of the drawings

1 shows an embodiment of a computer network.

2 shows an embodiment of a method for generating a ABZ.

3 shows an embodiment of a method for activation.

4 shows a method for implementing an immobilizer.

Embodiments of the invention

The invention is schematically illustrated by means of embodiments in the drawings and will be described in detail below with reference to the drawings.

1 shows a schematic representation of a computer network, the total with the reference numeral 10 is designated. The illustration shows a first arithmetic unit 12 and a second arithmetic unit 14 that over the internet 16 connected to each other. Furthermore, the illustration shows a first technical device 18 and a second technical facility 20 that in the computer network 10 also via the internet 16 are involved.

The technical equipment 18 . 20 are, for example, production plants or even motor vehicles that are in this computer network 10 , which is an example of the so-called Internet of Things, controllable and thus manipulated. This means that security measures must be taken to prevent abuse. Generally, the facilities can 18 . 20 also be referred to as objects.

2 shows the construction of an app PKI infrastructure as well as the process of creating the ABZ in the app's keychain. Since the ABZ has a limited validity, such as one year, this procedure is used only occasionally to renew the ABZ.

The illustration shows an IoT network 10 , an internet 12 and an IoT cloud 14 , In the IoT network 10 are an object 20 , in this case a drill, a mobile computing unit 22 , in this case a mobile phone, a control unit or hub 24 and sensors and actuators 26 intended. On the Internet 12 is a first server 30 , which is a central processing unit provided, which implements the functionality of an identity provider. Such services or services are provided, for example, with the standard oAuth (open authentication). In the IoT cloud 14 are a second server 42 as the authentication or registration authority and a third server 40 as a certification authority.

An App PKI Infrastructure (A-PKI) is set up for the procedure, which authenticates the user via his email address and / or his mobile phone number. The procedure is used to create a user certificate in the authentication app (AuthApp) in the mobile computing unit 22 store.

First, the user installs an app from one of the appstores. When starting the app, the app notices that there is no valid ABZ in the keychain. The app prompts the user to log in to the first server 30 , which represents a so-called identity provider, to authenticate. The authentication is realized by request (arrow 50 ) with the standard command. Thus, the identity provider is part of the registration authority (RA) of the A-PKI.

• • Die Kennung bzw. ID des Benutzers, also die Mailadresse und/oder die Telefonnummer.
• • Eine App-Id, damit klar ist für welche App das Zertifikat gültig ist.
• • Die IP-Adresse des OCSP-Responders, der gesperrte Zertifikate listet.

The app now has a key or one-time token with which the user data can be checked. Missing data, such as B. deviating mail address or phone number, the user can enter manually. The app now sends an ABZ request to the second server or authentication server 42 containing the one-time token (arrow 52 ). The second server 42 checks the token (arrow 54 ). This completes the registration process, which is the second part of the RA functionality. The second server 42 loads the keystore (arrow 56 ) from the third server or certification server 40 , which creates this keystore as needed, and encrypts it with a one-time password, which he sends to the user by mail and / or SMS and returns the encrypted keystore to the app (arrow 58 ). The keystore contains as result an ABZ with the following data:

• • The ID or ID of the user, ie the e-mail address and / or the telephone number.
• • An app id to make it clear which app the certificate is valid for.
• • The IP address of the OCSP Responder that lists locked certificates.

The app finally decrypts the keystore and stores it in its keychain.

The method thus serves to provide an authentication factor, in which the mobile computing unit 22 to the first server 30 that manages identities, with a request, the mobile computing unit 22 from the first server 30 one from the first server 30 created key, the mobile computing unit 22 the key to a second server 42 sends and the mobile computing unit 22 from the second server 42 after a check on the first server 30 This check, for example, from the second server 42 in communication with the first server 30 is performed, typically on the basis of the key that receives the authentication factor.

In the method according to 3 is the ABZ out 2 used to realize user- and object-specific releases and thus a personal authorization concept. 3 shows in particular a method for activating an IoT product function. The illustration again shows the IoT network 10 , the Internet 12 and the IoT cloud 14 , In the IoT network 10 are an object 20 , in this case a drill, a mobile computing unit 22 , a controller or hub 24 and sensors and actuators 26 intended. In the IoT cloud is a fourth server or an application server 60 shown.

The AuthApp authenticates the user to be from the fourth server 60 can request the unlock code for a function on an object. Depending on the application, the user is also localized. As a result, the app receives the unlock code, or possibly not, which it to the object 20 or the controller 24 by ranges. The object 20 performs a hash function and compares the result, so checks the unlock code, and performs the function if the comparison is positive.

A user launches a feature that requires an unlock code. In the simplest case, he presses a button on the object or the machine 20 or he sits in front of a computer, with the machine 20 connected and clicks on a feature. Does the system architecture suggest that the computer does not have a localized connection (wired or wireless) to the machine 20 No GPS or other localization is performed.

Alternatively, the user uses an app (AnwApp) associated with the machine 20 connected is. The AuthApp and the AnwApp are typically integrated into a single app. Is the app over a local network with the machine 20 connected, the user is near the machine 20 localized. Thus, the app can also be used to establish the Internet connection of other object functions - ie as an IoT hub. The machine 20 can also independently trigger a function request, such as for the function "reorder material".

The object 20 connects to the AuthApp (arrow 62 or 64 ). If the object 20 has no internet connection, this only works if the connection is localized. If the user has triggered the function via a computer or via the AppApp, the object may become 20 also over the internet 12 connect to the AuthApp (arrow 63 ), to a mobile phone 65 that on the internet 12 is and not a local connection to the object or the machine 20 can build up.

The AuthApp directs the activation code request to the specified application server or the fourth server 60 continue and send the user certificate (arrow 66 ). The fourth server 60 can then return the release code for the function depending on the user and the object ID specified in the request (arrow 66 ).

It is a question of implementation for the corresponding object type, whether the user must explicitly confirm the function release again.

This in 3 The illustrated method thus serves to unlock a function of the object 20 depending on a role of a user relative to the object 20 in which the user by means of an app that has an Authentifzierungsfaktor, by a request to the fourth server 60 receives a user-specific activation code for the object.

The object 20 may also require a multiple authentication in an embodiment, which may also require a certain order of authentications. This is of particular interest for sensitive and critical functions.

In 4 the method for using the car key built-in electronic key (AVK) is described as another authentication factor. The test result of the AVK is provided by an interface of the immobilizer. The illustration shows the IoT network 10 , in the motor vehicle typically consisting of CAN 80 and radio 82 , and the internet 12 , In the IoT network are a key 70 , a crypto controller 72 which checks the key of the RFID tag and a controller or hub 74 intended. With reference number 76 are called actuators and sensors.

First, an unlock feature requires the presence of a matching vehicle key. The control unit 74 , which is to perform the function, calls the appropriate API (Application Programming Interface) of the Crypto controller 72 the immobilizer via the CAN bus 80 on (Controller Area Network, wired). The return value is given by the control unit 74 via radio 82 the information as to whether a suitable car key is being used.

The immobilizer connects via its standard procedure (Bluetooth, NFC, wired, ...) with the car key 70 , reads out the key stored there, checks it and returns the test result to the control unit (arrow 84 ).

Combining the authentication with ABZ and AVK, you have a "2-factor authentication for the car". The authentication factors can also be used separately depending on the application.

The units referred to here as servers represent arithmetic units, in particular central arithmetic units. An app or application software denotes an application software, in particular in the field of mobile operating systems.

Claims (14)

Method for providing an authentication factor, in which a mobile computing unit ( 22 ) to a first server ( 30 ), which manages identities, with a request, the mobile computing unit ( 22 ) from the first server ( 30 ) one from the first server ( 30 ), the mobile processor ( 22 ) the key to a second server ( 42 ) and the mobile computing unit ( 22 ) from the second server ( 42 ) after a check on the first server ( 30 ) receives the authentication factor. Method according to Claim 1, in which the mobile computing unit ( 22 ) as the authentication factor one from a third server ( 40 ), to which the second server ( 42 ) after checking applies, generates authentication factor generated.  The method of claim 1 or 2, wherein the authentication factor represents an app user certificate comprising a user and / or app specific identifier.  Method according to Claim 3, in which an e-mail address and / or a mobile number is used as the user-specific identifier.  Method according to one of claims 1 to 4, which is used to set up a key for an immobilizer. Method for activating a function of an object ( 20 ) depending on a role of a user relative to the object ( 20 ), in which the user uses an app that is stored on a mobile computing unit ( 22 ) and that has an authentication factor, by requesting a fourth server ( 60 ) a user-specific activation code for the object ( 20 ) receives.  Method according to Claim 6, in which the authentication factor according to one of Claims 1 to 5 is obtained. Method according to one of Claims 6 or 7, in which a connection to the object ( 20 ) via a radio link. Method according to one of Claims 6 or 7, in which a connection to the object ( 20 ) via an internet connection. Method according to one of Claims 6 to 9, in which the object ( 20 ) requires multiple authentication for execution.  Method for activating a function in a motor vehicle, in which in addition to an authentication factor according to claim 1 to 4, a further authentication factor is required. Method according to claim 11, in which as another authentication factor a car key ( 70 ) is used. Computer program with program code means, which is set up to carry out a method according to one of claims 1 to 12, when the computer program is stored on a computer, in particular a mobile computer ( 22 ), is performed.  Machine-readable storage medium with a computer program stored thereon according to claim 13.

Images