DE102015214370A1 - Method and system for verifying data - Google Patents

Abstract

The invention relates to a method for verifying data comprising the steps of: acquiring data by at least one sensor; Sending the collected data as well as initial security features by the sensor; Receiving the data emitted by the sensors and the first security features by a verification device; Verifying the received data by the verification device based on the received first security features; Processing the received data by the verification device; Sending the processed data as well as second security features through the verification device; Receiving the data and second security features transmitted by the verification device by a receiver; Verifying the received data by the receiver based on the second security features.

Description

The present invention relates to a method and a system for verifying data.

State of the art

The Internet of Things (IoT) is considered the next evolution of the Internet. In the future, a large number of different sensors and actuators will increasingly be linked to one another. In the process, the generation of data on the one hand and the evaluation and utilization of the data on the other will often take place in areas that are often far apart. For example, from the DE 10 2012 210 041 A1 a pressure sensor is known, which has sensors for detecting air pressure, and a radio interface, which transmits the data detected by the pressure sensors to a control device.

On the one hand, the actuators must therefore process data from sensors that are far away, but on the other hand, the sensors must be authenticated in order to guarantee safety. For example, the triggering of actions by the actuators may have significant consequences for a consumer, such that the consumer must rely on the sensor data or sensor not being manipulated by a third party or data intercepted.

Disclosure of the invention

The present invention, according to a first aspect, provides a method for verifying data. In this case, data is acquired by at least one sensor and the recorded data and first security features are transmitted. A verification device receives the data sent by the sensors and the first security features and verifies the received data based on the received first security features. The verification device processes the received data and sends out the processed data as well as second security features. A receiver receives the data sent by the verification device and second security features and verifies the received data based on the second security features.

In a further aspect, the present invention provides a system for verifying data having at least one sensor for acquiring data and transmitting the data, and first security features. The system further comprises a verification device which is designed to receive the data emitted by the sensors, to verify, to process and to send out the processed data and second security features on the basis of the first security features emitted by the sensors. Finally, the system comprises a receiver, which is designed to receive the data emitted by the verification device and to verify it by means of the second security features emitted by the verification device.

Advantages of the invention

The verification device serves as a central unit of a multi-sensor system, which has a high degree of trustworthiness, for example due to a secure physical structure. This central verification device serves to identify and verify the sensors which transmit data to the verification device.

Conversely, the verification device provides data to the recipient. The receiver therefore does not have to communicate directly with the sensors, but can rely on the trustworthiness of the verification device.

Due to the security of the verification device, it is more difficult to interfere with the data exchange between the sensor and the verification device or between the verification device and the receiver and to read or manipulate the data, even if an attacker manipulates the sensor itself. The receiver can in particular trust a sensor even if it is not known to it directly, for example through an earlier mutual identification phase. Rather, he only has to trust a single unit, namely the verification device. As a result, a simpler construction of a sensor system is possible because the sensors need only be known to the verification device, but not every single receiver. In addition, compared to the case that the sensors are directly connected, resulting from the decoupling easier interchangeability of the sensors.

According to a further embodiment of the method for verifying data, the first security features or second security features are generated by a hardware security module or trusted platform module by the sensors or the verification device and contain a signature that includes a checksum and a nonce. Using a Trusted Platform Module can ensure that the data is authentic. In particular, it can be stated that data has been manipulated if the checksum or the nonce are faulty.

According to a further embodiment of the method for verifying data, the first security features or second security features are generated in a protected execution mode by the sensors or the verification device.

According to a further embodiment of the method for verifying data, the first security features or second security features are generated by means of software attestation from the sensors or the verification device. This makes it difficult for an attacker to manipulate the data. The software attestation hereby uses device-specific properties, in particular the response time, which the sensor or the verification device requires to execute a predetermined calculation.

According to a further embodiment of the method for verifying data, the first security features or second security features are transmitted by means of a physically non-clonable function from the sensors or the verification device in response to one of the verification device to the sensors and from the receiver to the verification device Challenge created. The security features here depend on physical properties of the sensors or the verification device, in particular a characteristic background noise, whereby the sensors or the verification device can be clearly identified.

According to a further embodiment of the method for verifying data, the first security features or second security features are generated in a hardware security module by the sensors or the verification device. The hardware security module is responsible here for the verification of the authenticity of the sensor or the verification device in a multi-core microcontroller and for the protection of the cryptographic keys.

According to another embodiment of the method for verifying data, processing the data by the verification device comprises merging data from a plurality of sensors, combining data from one and / or more sensors acquired over a period of time, and / or changing the data, especially by adding noise. This allows the verification device to act as a centralized data management point, combining and providing various data to the recipient. Changing the data, such as adding noise, may serve to obscure the identity of the sensor that provided the data for added security.

According to another embodiment of the method for verifying data, in an initial initialization phase, the verification device exchanges first certificates or second certificates with the at least one sensor or the receiver, which are used to create the first security features or second security features. Here, the verification of the received data by the verification device based on the received first security features or the verification of the received data by the receiver on the basis of the second security features by checking the first certificates or the second certificates performed.

According to another embodiment of the system for verifying data, the verification device is a capture / compare unit, a context proxy and / or a sensor network gateway.

Brief description of the drawings

Show it:

1 a flow chart for a method for verifying data according to an embodiment of the invention; and

2 a block diagram of a system for verifying data.

In all figures, the same or functionally identical elements and devices - unless otherwise stated - provided with the same reference numerals. The numbering of method steps is for the sake of clarity and, in particular, should not, unless otherwise indicated, imply a particular chronological order. In particular, several method steps can be carried out simultaneously.

Description of the embodiments

1 shows a flowchart for a method for modifying data according to an embodiment of the present invention.

In a first step, first data n ₁ , second data n ₂ and third data n ₃ are detected by a first sensor S ₁ , a second sensor S ₂ and a third sensor S ₃ . The sensors S ₁ to S ₃ may in this case comprise any desired sensors, in particular optical sensors such as cameras, acoustic sensors for detecting sound, sensors for detecting temperature, pressure, brightness, acceleration sensors or chemical sensors, wherein the sensors generate data in the form of electrical signals. The number of sensors is not limited to three. In particular, the invention is intended for a large number of different sensors.

In a second step S2 of the first sensor S ₁ transmits the first data acquired from n ₁ together with the first security features T _S1 of the first sensor _S1. Analogously, the second sensor S ₂ or the third sensor S ₃ sends the second detected data n ₂ together with second security features T _{S2 of} the second sensor S ₂ and the third detected data n ₃ together with third security features T _{S3 of} the third sensor S ₃ out.

In a third step S3, the data sent by the sensors S ₁ to S ₃ data n ₁ to n ₃ and first security features T _S1 to T _{S3 are} received by a verification device P. The sending and receiving of the data here can be done via direct connections, in particular power cable or fiber optic cable, but also without power, in particular via a radio interface.

The verification device P is in this case, for example, a capture compare unit (CCU), which serves for detecting and comparing data, a context proxy or a gateway for a sensor network.

In a fourth step S4, the received data n ₁ to n ₃ are verified by the verification device P on the basis of the received first security features T _S1 to T _S3 .

According to one embodiment, the verification can take place in that the verification device P exchanges first certificates Z ₁ , Z ₂ and Z ₃ with the sensors S ₁ , S ₂ and S ₃ in an original identification phase preceding the method. The first security features T _S1 to _S3 T of the sensors S ₁ to S ₃ are created from the sensors S ₁ to S ₃ using the first certificates Z _1, Z ₂ and Z. ₃ The firmware or software of the verification device P can identify the first security features T _S1 to T _S3 on the basis of the first certificates Z ₁ , Z ₂ and Z ₃ .

According to a further embodiment, the first security features T _S1 may be generated by the sensors S ₁ to S ₃ to T _S3 of the sensors S ₁ to S ₃ by a trusted, protected component, such as a hardware security module or a Trusted Platform Module. In this case, the first security feature T _S1 of the first sensor S ₁ Sig includes, for example, a signature (Chk (W _S1), N _1), consisting of a checksum Chk (W _S1) and a nonce N. ₁ The checksum Chk (W _S1 ) depends on the software or firmware W _{S1 of} the first sensor S _{1 used} and serves to verify this software or firmware W _S1 . The nonce N ₁ is a unique number that ensures that the data is not intercepted by an attacker during transmission and later reused. By verifying checksum Chk (W _S1 ) and nonce N _1, the verification device P verifies the received data n ₁ . The first security features T _S2 and T _{S3 of} the second sensor S ₂ and third sensor S ₃ may include analog signatures and be verified analogously, which protects against manipulation.

According to a further embodiment, the verification device verifies the received data n ₁ to n ₃ based on the received first security features T _S1 to T _S3 , wherein these first security features T _S1 to T _S3 were generated in a protected execution mode from the sensors S ₁ to S ₃ . The software / firmware used by the sensors S ₁ to S ₃ is hereby executed in a protected execution mode, whereby the data is generally difficult for an attacker to modify. The protected execution mode can be realized for example by means of ARM TrustZone ^{® ®.}

According to a further embodiment, the first security features T _S1 to _S3 T of the sensors S ₁ to S ₃ by means of software generated Attestation from the sensors S ₁ to _S3. For example, the sensors are sent in a preceding identification phase of the verification device P challenges, which are calculated from the sensors S ₁ to S ₃ and the result is sent back to the verification device P. On the basis of the specific transit time, which depend on the physical properties of the sensors S ₁ to S ₃ , the identity of the sensor can be determined. A potential attacker is not aware of the physical properties of the sensor. Therefore, if he intercepts the message, he will not solve the challenge in the time characteristic for the sensor and the verification will fail.

According to a further embodiment, the first security features T _S1 to T _{S3 are} adjusted by the sensors S ₁ to S ₃ by means of a physically non-clonable function (PUF). Here, the verification device P sends challenges to the sensors S ₁ to S ₃ , which process the sensors and return responses to the verification device P. The challenges may be, for example, to carry out a typical task for the respective sensor S ₁ to S ₃ . For example, an optical sensor for capturing an image may be requested. On the basis of this data acquired by the sensor, which the sensor makes available to the verification device P, the verification device can be typical determine physical characteristics of the sensor S ₁ to _S3. This may be, for example, a characteristic background noise in an acoustic or optical signal which is unambiguously characterized for the respective sensor and which serves to verify the data n ₁ to n ₃ , which have a similar characteristic background noise.

According to a further embodiment, the first security features T _S1 to T _{S3 are} generated in a hardware security module by the sensors S ₁ to S ₃ .

The first security features T _S1 to T _S3 may also be generated and verified by combining several of the embodiments described above.

Furthermore, the verification device P can also only allow data from certain sensors S ₁ to S ₃ , for example from sensors of a specific manufacturer or sensors of a certain type, for example only optical sensors, while other sensors are not verified.

In a fifth step S5, the received data n ₁ to n ₃ are processed by the verification device P, for example by a software or firmware _P W, which is performed on the verification device P. For example, the verification device P can jointly evaluate the first data n ₁ , the second data n ₂ and the third data n ₃ and combine the evaluated data or parts of these data. Furthermore, the verification device P can store and evaluate data acquired by one and / or a plurality of sensors S ₁ to S ₃ over a period of time. Furthermore, the verification device P can change the data n ₁ to n ₃ . In particular, it can add noise to increase security, since the background noise characteristic of the particular sensor is suppressed and therefore the data can no longer be uniquely assigned, thereby increasing the safety of the sensors. The verification device P can add further information to the data n ₁ to n ₃ , for example meta information concerning the specific sensors S ₁ to S ₁ .

By processing the received data n ₁ to n ₃ by the verification device P, processed data n * is generated.

In a sixth step S6, the processed data n * and second security features T _{P are sent out} by the verification device _P. In this case, the transmission can in turn be carried out either via direct connections, such as, for example, power or fiber optic cable, but can also take place without a current, in particular via a radio interface.

In a seventh step S7, the data n * sent out by the verification device _P and the second security features T _{P are received} by a receiver C. In this case, the receiver C is preferably an end user, who may have requested data from the verification device P in particular. However, the data may also be received by a plurality of receivers.

In an eighth step S8, the received data n * are verified by the receiver C on the basis of the second security features T _P.

The second security features T _P can in this case be generated by the verification device P according to the embodiment of the method described above for the sensors S ₁ to S ₃ .

In particular, in an initial initialization phase, second certificates Z _C can be exchanged between the verification device P and the receiver C, on the basis of which the second security features T _{P are} generated. By checking the second security features T _P received by the receiver C, the latter can verify the verification device _P.

For example, the second security features T _P comprise a signature Sig (Chk (W _P ), N _P , Msg), comprising a check sum Chk (W _P ) of the software or firmware W _P used by the verification device, a nonce N _P, and a optional message Msg to the receiver C. By verifying the checksum Chk (W _P ) and the nonce N _P, the receiver C verifies the received data n *.

If the receiver C verifies the received data n *, it has hereby also checked that the received data n * originate from non-modified sensors S ₁ to S ₃ , that is, in particular the data n acquired by the sensors S ₁ to S _{3 1} to n _{3 were} not intercepted or modified by a third party.

If the verification of the received data n ₁ to n ₃ by the verification device P or the verification of the received data n * by the receiver C fails, for example the verification device P or the receiver C can issue a warning to the receiver C via an interface the receiver C or to a central monitoring unit, which can monitor in particular several systems spend.

The verification of the received data n ₁ to n ₃ by the verification device P or the verification of the received data n * by the receiver can hereby optionally be carried out for all transmitted data or only at the respectively first connection between the sensors S ₁ to S ₃ and the verification device P and the verification device P and the receiver C, or only when the received data n ₁ to n _{3 of} the sensors S ₁ to S ₃ are joined together by the verification device P.

2 shows a system 1 for verifying data. In this case, the system has a first sensor S ₁ , a second sensor S ₂ and a third sensor S ₃ , which are designed to acquire data n ₁ to n ₃ . The number of sensors is not limited and the system 1 may in particular include a plurality of different sensors. The sensors S ₁ to S ₃ are designed for detecting and transmitting data n ₁ to n ₃ as well as first security features T _S1 to T _S3 .

Furthermore, the system includes 1 for verifying data, a verification device P, which is designed to receive the data n ₁ to n ₃ emitted by the sensors S ₁ to S ₃ . Based on the first security features T _S1 to T _{S3 of} the sensors S ₁ to S ₃ , these sensors S ₁ to S _{3 are identified} by the verification device P.

The first security features T _S1 to T _S3 are hereby generated according to one of the methods described above. The verification device P is furthermore designed to process the received data n ₁ to n ₃ , in particular by merging or changing, as described above, and to generate data n * processed thereby.

The processed data n * are sent out by the verification device P together with second security features T _P. The system 1 for verifying data further comprises a receiver C, which is designed to receive the data n * sent by the verification device P. In this case, the receiver C in particular has an interface for receiving the data, for example a cable or wireless connection interface. The second security features T _{P of} the verification device P are in this case produced according to one of the methods described above. Verification by the receiver C is also done by one of the methods described above.

The system can be used, for example, in security technology, with the sensors S ₁ to S _{3 being} surveillance cameras. However, the device can also be used in conjunction with microelectromechanical systems (MEMS), in particular with MEMS sensors.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102012210041 A1 [0002]

Claims (10)

A method of verifying data comprising the steps of: detecting (S1) data (n ₁ , n ₂ , n ₃ ) by at least one sensor (S ₁ , S ₂ , S ₃ ); Transmitting (S2) the acquired data (n ₁ , n ₂ , n ₃ ) as well as first security features (T _S1 , T _S2 , T _S3 ) by the sensor (S ₁ , S ₂ , S ₃ ); Receiving (S3) of the sensors (S _1, S _2, S ₃₎ transmitted data (n _1, n _2, n ₃₎ and the first security features (T _S1, T _S2, T _S3) by a verification device (P) ; Verifying (S4) the received data (n ₁ , n ₂ , n ₃ ) by the verification device (P) on the basis of the received first security features (T _S1 , T _S2 , T _S3 ); Processing (S5) the received data (n ₁ , n ₂ , n ₃ ) by the verification device (P); Transmitting (S6) the processed data (n *), and preferably second security features (T _P ), through the verification device (P); Receiving (S7) the data (n *) sent by the verification device ( _P ) and preferably the second security feature (T _P ) by a receiver (C); Verifying (S8) the received data (n *) by the receiver (C), preferably based on the second security features (T _P ). Method for verifying data according to claim 1, wherein the first security features (T _S1 , T _S2 , T _S3 ) or second security features (T _P ) are determined by a Trusted Platform Module from the sensors (S ₁ , S ₂ , S ₃ ) or of the verification device (P) and include a signature comprising a checksum and a nonce. Method for verifying data according to one of the preceding claims, wherein the first security features (T _S1 , T _S2 , T _S3 ) and second security features (T _P ) in a protected execution mode of the sensors (S ₁ , S ₂ , S ₃ ) or the verification device (P) are generated. Method for verifying data according to one of the preceding claims, wherein the first security features (T _S1 , T _S2 , T _S3 ) and second security features (T _P ) by means of software attestation from the sensors (S ₁ , S ₂ , S ₃ ) and the verification device (P) are generated. Method for verifying data according to one of the preceding claims, wherein the first security features (T _S1 , T _S2 , T _S3 ) and second security features (T _P ) are determined by means of a physically non-clonable function from the sensors (S ₁ , S ₂ , S ₃ ) or the verification device (P) in response to a challenge sent from the verification device (P) to the sensors (S ₁ , S ₂ , S ₃ ) or from the receiver (C) to the verification device (P) become. Method for verifying data according to one of the preceding claims, wherein the first security features (T _S1 , T _S2 , T _S3 ) and second security features (T _P ) in a hardware security module from the sensors (S ₁ , S ₂ , S ₃ ) or the verification device (P) are generated. Method for verifying data according to one of the preceding claims, wherein the processing of the data (n ₁ , n ₂ , n ₃ ) by the verification device (P) comprises at least one of: merging data (n ₁ , n ₂ , n ₃ ) of several sensors (S ₁ , S ₂ , S ₃ ); Combining data acquired over a period of time (n ₁ , n ₂ , n ₃ ) from one and / or more sensors (S ₁ , S ₂ , S ₃ ); and changing the data (n ₁ , n ₂ , n ₃ ), in particular by adding noise. Method for verifying data according to one of the preceding claims, wherein in an initial initialization phase the verification device (P) has first certificates (Z _S1 , Z _S2 , Z _S3 ) or second certificates (Z _C ) with the at least one sensor (S ₁ , S ₂ , S ₃ ) and / or the receiver (C) used to create the first security features (T _S1 , T _S2 , T _S3 ) and second security features (T _P ), respectively, and verifying the received data (n ₁ , n ₂ , n ₃ ) by the verification device (P) based on the received first security features (T _S1 , T _S2 , T _S3 ) or verifying the received data (n *) by the receiver (C) on the basis of second security features (T _P ) by checking the first certificates (Z _S1 , Z _S2 , Z _S3 ) and the second certificates (Z _C ) is performed. System ( 1 ) for verifying data, in particular with means for carrying out the method according to one of the preceding claims, with at least one sensor (S ₁ , S ₂ , S ₃ ) for acquiring data (n ₁ , n ₂ , n ₃ ) and for transmitting the data (n ₁ , n ₂ , n ₃ ) as well as first security features (T _S1 , T _S2 , T _S3 ); a verification device (P) which is designed to receive the data (n ₁ , n ₂ , n ₃ ) emitted by the sensors (S ₁ , S ₂ , S ₃ ) on the basis of which the sensors (S ₁ , S ₂ S ₃ , S ₃ ) to verify the first security features (T _S1 , T _S2 , T _S3 ) emitted and edit the processed data (n *) and preferably second security features (T _P ); and a receiver (C) configured to receive the data (n *) sent by the verifying device (P) and, preferably, based on the from the verification device (P) emitted second security features (T _P ) to verify. The data verification system of claim 9, wherein the verification device (P) is a capture / compare unit, a context proxy, and / or a sensor network gateway.

Images