DE102017108129A1 - Hardware-based security module - Google Patents

Abstract

The invention relates to a hardware-based security module (24) for authenticating an information and / or data processing device (12), in particular a mobile terminal (10), to at least one further information and / or data processing device (18) connected to the one information and / or data processing device (12), in particular via a network (16), data transmission technology - wireless or wired - connected. The hardware-based security module (24) comprises:
an arithmetic logic unit (26) for carrying out cryptographic operations for authenticating the information and / or data processing device (12),
- At least one formed as an air interface (30) interface (32) for data transmission connection of the hardware-based security module (24) to the information and / or data processing device (12) and
- A data memory (34) having an inaccessible via this at least one interface (32) memory area for storing at least one cryptographic key (36) for the cryptographic operations.
The invention further relates to a system (42) having an information and / or data processing device (12) and such a hardware-based security module (24).

Description

The invention relates to a hardware-based security module for authenticating an information and / or data processing device with respect to at least one further information and / or data processing device which is connected to the one information and / or data processing device via wireless or wired data transmission technology.

The invention further relates to a system having an information and / or data processing device and such a hardware-based security module.

Hardware-based security modules (HSM: Hardware Security Modules) have long been known. The English Wikipedia entry on "Hardware Security Module" describes such a module as a data processing device that secures and manages digital keys for strong authentication and provides cryptographic processing. Authentication is possible by means of such hardware-based security modules. These hardware-based security modules are usually designed in the form of a plug-in card or an external device that is connected directly to a computer, network server, or other information and / or data processing device.

The use of computers installed within a network and also the access from the outside via the Internet can be done safely via hardware-based security modules. However, this usually means that additional hardware has to be used. Thus, the use of USB tokens, which can optionally be activated via fingerprint, quite common. However, the problem is the use of mobile devices, such. of smartphones and tablets within such a network. The available software solutions can not be estimated as safe, as the encryption keys will be stored on the smartphone and can be found. Tokens for mobile devices are not known, so that one can currently rely only on an unsatisfactory solution using App, so software.

It is the object of the invention to provide measures for the simple realization of an authentication of an information and / or data processing device with respect to at least one further information and / or data processing device.

The object is achieved by the features of the independent claims. Advantageous embodiments of the invention are specified in the subclaims.

1. (i) ein Rechenwerk zur Durchführung von kryptografischen Operationen zur Authentifizierung des Informations- und/oder Datenverarbeitungsgeräts,
2. (ii) zumindest eine als Luftschnittstelle ausgebildeten Schnittstelle zur datenübertragungstechnischen Anbindung des hardwarebasierten Sicherheitsmoduls an das Informations- und/oder Datenverarbeitungsgerät und
3. (iii) einen Datenspeicher, der einen über diese zumindest eine Schnittstelle unzugänglichen Speicherbereich zur Ablage zumindest eines kryptografischen Schlüssels für die kryptografischen Operationen aufweist.

The hardware-based security module according to the invention for authenticating an information and / or data processing device with respect to at least one further information and / or data processing device, which is connected to the one information and / or data processing device by wireless or wired data transmission technology, has the following components:

1. (i) an arithmetic unit for performing cryptographic operations for authenticating the information and / or data processing device,
2. (Ii) at least one formed as an air interface interface for data transmission connection of the hardware-based security module to the information and / or data processing device and
3. (iii) a data store having a memory area inaccessible via said at least one interface for storing at least one cryptographic key for the cryptographic operations.

Such a security module is easy to use and allows authentication of conventional information and / or data processing devices, such as mobile devices, without having to modify them.

According to a preferred embodiment of the invention, the arithmetic unit is further configured for performing cryptographic operations for encrypting and / or decrypting data in the data transmission between the information and / or data processing device and the at least one further information and / or data processing device. The cryptographic key is also used for encryption and / or decryption.

• - Bluetooth und/oder
• - WLAN und/oder
• - Nahfeldkommunikation und/oder
• - Zigbee und/oder
• - proprietäre Datenübertragungssysteme

ausgebildet.According to a further preferred embodiment of the invention, the air interface is preferred as an air interface for wireless data communication and / or for wireless networks, in particular also wireless sensor networks

• - Bluetooth and / or
• - WLAN and / or
• - Near field communication and / or
• - Zigbee and / or
• - proprietary data transmission systems

educated.

According to yet another preferred embodiment of the invention, the hardware-based security module is designed to be mobile, ie a mobile security module.

It is preferably provided that the mobile security module has its own power supply, in particular an accumulator.

According to a preferred embodiment of the invention, the hardware-based security module is integrated in a separate device from the information and / or data processing device. This device is for example a watch, a car key or another mobile device.

In the system according to the invention with an information and / or data processing device and a hardware-based security module, it is provided that the hardware-based security module is designed as a module mentioned above.

According to a preferred embodiment of the system according to the invention, this further comprises an identification module for identifying the user of the information and / or data processing device. The identification module is connected to the information and / or data processing device and / or to the hardware-based security module in terms of data transmission technology.

It is preferred that the identification module comprises a module for detecting biometric features, in particular passive features such as fingerprint, face, retina, iris and hand geometry and / or a module for detecting active features: voice and / or speech behavior and a keyboard for entering a number combination / of a PIN.

• 1 ein System mit einem in ein Telefon- und Datennetz eingebundenen mobilen Endgerät und ein hardwarebasierte Sicherheitsmodul zur Authentifizierung des Endgerätes im Netz gemäß einer ersten bevorzugten Ausführungsform der Erfindung und
• 2 ein System mit einem in ein Telefon- und Datennetz eingebundenen mobilen Endgerät und ein hardwarebasierte Sicherheitsmodul zur Authentifizierung des Endgerätes im Netz gemäß einer zweiten bevorzugten Ausführungsform der Erfindung.

The invention will now be described by way of example with reference to the accompanying drawings with reference to preferred embodiments, wherein the features shown below may represent an aspect of the invention both individually and in combination. It shows:

• 1 a system with a mobile terminal integrated in a telephone and data network and a hardware-based security module for authenticating the terminal in the network according to a first preferred embodiment of the invention and
• 2 a system with a mobile terminal integrated in a telephone and data network and a hardware-based security module for authenticating the terminal in the network according to a second preferred embodiment of the invention.

The 1 shows as a mobile device 10 trained information and / or data processing device 12 that has a cellular connection 14 in a trained as a telephone and / or data network 16 is involved, which is a variety of other information and / or data processing equipment 18 includes. The mobile device 10 is for example a smartphone. It has one as an air interface 20 trained interface 22 on, over which the mobile terminal 10 with a hardware-based security module 24 connected is. The hardware-based security module 24 has an arithmetic unit 26 to perform cryptographic operations on at least one processor 28 , one as an air interface 30 interface designed for wireless communication 32 and a data store 34 on, in turn, one over the interface 32 Inaccessible storage area in which a cryptographic key 36 is stored for the cryptographic operations.

The hardware-based security module shown 24 is a hardware-based mobile security module 38 (HMD: hardware-based, mobile device) is formed and has its own power supply unit 40 on that the other components 26 . 32 . 34 of the hardware-based mobile security module 38 supplied with electrical energy. The power supply unit 40 is an accumulator in the example shown.

The connection between the air interfaces 20 . 30 (of the device 10,12 and the hardware-based security module 24 ) is in the example shown a connection by means of wireless data communication. The air interfaces 20 . 30 are accordingly air interfaces 20 . 30 for wireless data communication. Next to the air interfaces 20 has the mobile device 10 of course also an air interface (not explicitly shown here) for the radio connection 14 on. The cryptographic operations of the calculator 26 are typical operations for authentication. The decisive factor here is that the cryptographic key neither via the interface 32 , so here's the air interface 30 , in the store 34 written, can still be read out of it.

The calculator shown in the example 26 is for performing cryptographic operations (a) for authentication of the information and / or data processing device 12 opposite to the at least one further information and / or data processing device 18 and (b) to perform cryptographic operations on Encryption and / or decryption of data during data transmission between the information and / or data processing device 12 and the at least one further information and / or data processing device 18 set up.

The use of such a security module 24 enables or ensures secure authentication and associated secure, encrypted communication of devices 10 12 , such as smartphones or tablets, in a network 16 , such as the Internet. The hardware-based security module and the corresponding device 10 . 12 form a system 42 , In the age of IoT (Internet of Things) and networked industrial production (smart factories), connected vehicles and smart home applications, there is a particular need for secure communication over the Internet. The security module 24 It allows for the structural changes of the device through the wireless connection 10 . 12 and at the same time guarantees a very high (not to say the highest) safety standard. The security module 24 is also suitable for secure authentication of other information and / or data processing equipment 12 such as automotive (automotive) devices or machines in a network such as the Internet.

The following are the key features and benefits of various hardware-based security module designs 24 and the system 42 with security module 24 and corresponding device 10 . 12 described again in other words:

The security module 24 Used for bidirectional, wireless, optionally wired, communication with stationary and mobile devices 10 . 12 , It is used for authentication and data encryption of heterogeneous hardware, such as smartphones, different manufacturers regardless of the operating systems used by these devices 12 available.

To secure the communication (for example in companies) on the Internet so-called VPNs (virtual private networks) are used. So-called "remote users" can connect to the head office via the Internet using VPNs. This is usually done by entering a password. In general, however, using VPNs is not really secure. Companies pay for VPN services because they spend too much time running their own VPN server. The operator of the VPN server may have access to the transmitted data and has information about the communication partners. Since it is now common practice to store company data in clouds, the operator of this cloud must be given special trust in terms of data security. With regard to the company IP (Intellectual Property), there are significant risks when using VPN and Clouds. Alone the knowledge of the password, which e.g. can be spied out by malicious software, allows access to the data of the corresponding employee and can endanger the company know-how.

Today's encryption methods are safe, depending on the chosen method and a specified key length. Only the keys (keys) used to encrypt data 36 allow deciphering. Thus, hackers or other cybercriminals will try to get just those keys. These are usually on the devices 10 . 12 the user. Data encryption programs use different methods to encrypt and hide these keys. But it is possible and already happened that these keys were found and deciphered. Therefore, the encryption of data by software is not considered to be completely secure.

The use of mobile devices 10 , such as smartphones, tablets or notebooks and smartwatches with access to the Internet is common today. Unlike most home users, corporate computing and communication technology companies rely on VPNs. This communication is uncertain, as described above. A clearer improvement is the hardware-based security module 24 reached. This communicates wirelessly with mobile and wireless devices 10 , such as smartphones, etc.

1. (i) ein Gehäuse 44, gegebenenfalls einer Armbanduhr mit integrierten Modulkomponenten 26, 32, 34 oder einem Halsband mit Anhänger mit integriertem integrierten Modulkomponenten 26, 32, 34 oder einem Namensschild (o. ä.) mit integrierten Modulkomponenten 26, 32, 34 oder einem Ring mit integrierten Modulkomponenten 26, 32, 34,
2. (ii) eine oder mehrere drahtlose, optional auch drahtgebundene Kommunikationsschnittstellen 30, 32,
3. (iii) ein Rechenwerk 26 mit einem oder mehreren Prozessoren 28, insbesondere zur Verschlüsselung und Steuerung einer Sicherheitsschaltung, die das Auslesen des kryptographischen Schlüssels 36 (Keys) unmöglich macht bzw. sicher verhindert und
4. (iv) mechanische und/oder elektronische Vorkehrungen zur Manipulationssicherheit (tamper resistance).

The hardware-based security module 24 preferably has the following components:

1. (i) a housing 44 , optionally a wristwatch with integrated module components 26 . 32 . 34 or a collar with a pendant with integrated integrated module components 26 . 32 . 34 or a name tag (or similar) with integrated module components 26 . 32 . 34 or a ring with integrated module components 26 . 32 . 34 .
2. (ii) one or more wireless, optionally wired, communication interfaces 30 . 32 .
3. (iii) an arithmetic unit 26 with one or more processors 28 , in particular for encryption and control of a security circuit, which enables the read-out of the cryptographic key 36 (Keys) impossible or safely prevented and
4. (iv) mechanical and / or electronic tamper resistance measures.

The hardware-based security module 24 Enables certificate-less, optionally certificate-based authentication and data encryption in hardware and software with extremely high security, as the cryptographic key 26 in the hardware-based security module 24 can not be read and thus a deciphering by strangers (hackers) is not possible.

The encryption may be in the information and / or data processing device 12 or the hardware-based security module 24 respectively. This is independent of the operating system used.

The power supply of the hardware-based security module 24 takes place by means of battery / accumulator or self-sufficient energy using at least one of the following techniques: solar cell, heat (difference), movement such as vibration, etc. Charging a battery when used as an energy source is made inductively, via USB connector or mechanical and / or electrical Connection. The use of external power source is also provided.

To make the procedure of authentication more secure, two-way authentication can optionally be performed. The 2 shows a corresponding system 42 , The optional additional release of the hardware-based security module 24 requires the implementation of a module 46 for detecting biometric features, in particular passive features such as fingerprint, face, retina, iris and hand geometry and / or active features: voice and / or speech behavior and a keyboard for entering a number combination / PIN. The module is thus an identification module 46 to identify a user of the device 10 . 12 , This in 2 shown identification module 46 is a fingerprint scanner. The identification module 46 has an interface 48 on that with another interface 50 of the information and / or data processing device 12 Data transmission technology is connected. The module 46 for detecting biometric features is alternatively directly into the information and / or data processing device 12 and / or the hardware-based security module 24 integrated.

Mobile and stationary devices 10 . 12 which interface with the hardware-based security module via an air interface / hardware-bound interface 24 can connect to networks with the highest security. The exchange of saved data can be done by the user of the hardware-based security module 24 also done in groups. On the basis of a software (app) other users, which may also have a hardware-based security module 24 use, be included in a group. Communication can take place in the radio and reception area of the hardware-based security module (s) 24 respectively. A corresponding procedure is for example from the document EP 2 937 802 A known. Unlike the approach described in this document, mobile devices must 10 For the purpose of secure data exchange but not stacked.

In addition, the users of the hardware-based security module can 24 a group secure data exchange over the network 16 make. The location of the group members does not matter, as long as network access is possible.

Through the radio connection of the hardware-based security module 24 to the information and / or data processing device 12 becomes the haptic of the used mobile and stationary device 10 . 12 not changed. The user notices of the hardware-based security module 24 nothing, but is fully protected. The hardware-based security module 24 (HMD) can be carried in your pocket or implemented in a watch. The device 10 . 12 in which a secure communication and / or a secure data transfer, for example by email, etc., by the hardware-based security module 24 is not changed in its shape, weight and operation.

LIST OF REFERENCE NUMBERS

10

mobile terminal

12

Information and / or data processing device

14

cellular Line

16

network

18

other information and / or data processing device

20

Air interface

22

Interface (device)

24

Hardware-based security module

26

calculator

28

processor unit

30

Air interface

32

interface

34

data storage

36

cryptographic key

38

mobile security module

40

Power supply unit

42

system

44

casing

46

identification module

48

interface

50

interface

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• EP 2937802 A

Claims (9)

Hardware-based security module (24) for authenticating an information and / or data processing device (12), in particular a mobile terminal (10), to at least one further information and / or data processing device (18) connected to the one information and / or data processing device (12), in particular via a network (16), data transmission technology - wireless or wired - connected, with an arithmetic unit (26) for carrying out cryptographic operations for authenticating the information and / or data processing device (12), - At least one formed as an air interface (30) interface (32) for data transmission connection of the hardware-based security module (24) to the information and / or data processing device (12) and - A data memory (34) having an inaccessible via this at least one interface (32) memory area for storing at least one cryptographic key (36) for the cryptographic operations. Security module after Claim 1 , characterized in that the calculating unit (26) further for performing cryptographic operations for encrypting and / or decrypting data in the data transmission between the information and / or data processing device (12) and the at least one further information and / or data processing device is set up. Security module after Claim 1 or 2 , characterized in that the air interface (30) as an air interface (30) for wireless data communication and / or wireless networks, in particular wireless sensor networks, preferably for - Bluetooth and / or - WLAN and / or - Nahfeldkommunikation and / or - Zigbee and / or - proprietary data transmission systems is formed. Security module according to one of Claims 1 to 3 , characterized in that the hardware-based security module (24) is designed as a hardware-based mobile security module (38). Security module after Claim 4 , characterized in that the mobile security module (38) has its own power supply unit (40), in particular an accumulator. Security module according to one of Claims 1 to 5 , characterized in that it is integrated in one of the information and / or data processing device (12) separate other device. System (42) with an information and / or data processing device (12), in particular a mobile terminal (10), and a hardware-based security module (22) according to one of Claims 1 to 6 , System after Claim 7 , characterized by an identification module (46) for identifying the user of the information and / or data processing device (12). Security system after Claim 8 , characterized in that the identification module (46) comprises a module for detecting biometric features, in particular passive features such as fingerprint, face, retina, iris and hand geometry and / or a module for detecting active features: voice and / or speech behavior and a keyboard for input a number combination / PIN.

Images