DE102021209505A1 - System and method for upgrading an outdated client/server application for secure and confidential data transmission - Google Patents

Abstract

The invention relates to a system (100) for upgrading at least one client/server application for secure and confidential data transmission, having:
- a client platform (10) with a legacy client (11) and
- a server platform (20) with a legacy server (21),
- whereby according to the client/server application the legacy client (11) receives access to the legacy server (21) using login data (AD),
- wherein the client platform (10) is implemented with a security token (12),
to set up a tunnel (40) to the server platform (20) for encrypted and authorized communication,
and to enable authentication of the legacy client (11) for communication with the legacy server (21),
- wherein the server platform (20) is designed with a security server (22),
to set up the tunnel (40) to the client platform (10) for encrypted and authorized communication,
and to perform the authentication of the legacy client (11) for communication with the legacy server (21),
- and wherein the server platform (20) is designed with a registration analysis module (23),
to check the credentials (AD) of the legacy client (11) for access to the legacy server (21).

Description

The invention relates to a system for upgrading a client/server application, in particular an outdated one, for secure and confidential data transmission according to the independent system claim. In addition, the invention relates to a use of a corresponding system according to the independent use claim. The invention also relates to an infrastructure according to the independent system claim that is set up using a corresponding system. Furthermore, the invention relates to a corresponding method for upgrading a client/server application, in particular an outdated one, for secure and confidential data transmission according to the independent method claim.

Older server-client applications, for example so-called legacy server-client applications and/or Synergy server-client applications, often no longer meet the necessary requirements for processing data, especially as soon as the data is classified as confidential. There is often no alternative to the system used with the outdated server-client applications, or the use of an alternative can only be implemented with considerable financial and time effort.

The object of the invention is therefore to provide a system for upgrading a client/server application, in particular an outdated one, for secure and confidential data transmission. In particular, the invention is based on the object of providing a system for upgrading a particular outdated client/server application for secure and confidential data transmission, which enables secure and confidential data transmission between a client platform and a server platform, which is simple is constructed in a cost-effective manner, which requires little computational effort, which can be easily installed and which enables flexible use with different outdated client/server applications. In addition, it is the object of the invention to provide a use of a corresponding system. Furthermore, it is the object of the invention to provide an infrastructure that is set up using a corresponding system. Furthermore, the object of the invention is to provide a corresponding method for upgrading a client/server application, in particular an outdated one, for secure and confidential data transmission.

The object according to the invention is achieved by: a system for upgrading a client/server application, in particular an outdated one, for secure and confidential data transmission with the features of the independent system claim; a use of a corresponding system with the features of the independent use claim; an infrastructure with the features of the subordinate independent system claim, which is built using a corresponding system; and a corresponding method for upgrading a client/server application, in particular an outdated one, for secure and confidential data transmission with the features of the independent method claim. Features that are described in connection with individual aspects of the invention also apply, of course, in connection with the other aspects and vice versa, so that the disclosure of the individual aspects of the invention is or can always be referred to reciprocally.

• - eine Client-Plattform mit einem Legacy-Client und
• - eine Server-Plattform mit einem Legacy-Server,
• - wobei gemäß der, insbesondere veralteten, Client/Server-Anwendung der Legacy-Client mithilfe von Anmeldedaten einen Zugriff auf den Legacy-Server erhält,
• - wobei die Client-Plattform mit einem Sicherheits-Token, bspw. in Form einer PKI-Karte, ausgeführt ist, um einen Tunnel zur Server-Plattform für eine verschlüsselte und autorisierte Kommunikation aufzubauen, und um eine Authentifizierung, insbesondere eine Zwei-Faktor-Authentifizierung, des Legacy-Clients für eine Kommunikation mit dem Legacy-Server zu ermöglichen,
• - wobei die Server-Plattform mit einem Sicherheits-Server ausgeführt ist, um den Tunnel zur Client-Plattform für eine verschlüsselte und autorisierte Kommunikation aufzubauen, und um die Authentifizierung des Legacy-Clients für eine Kommunikation mit dem Legacy-Server durchzuführen,
• - und wobei die Server-Plattform mit einem Anmelde-Analyse-Modul ausgeführt ist, um die Anmeldedaten des Legacy-Clients für einen Zugriff auf den Legacy-Server zu überprüfen.

The invention provides: a system for upgrading at least one, in particular obsolete, client/server application for secure and confidential data transmission, having:

• - a client platform with a legacy client and
• - a server platform with a legacy server,
• - whereby according to the, in particular outdated, client/server application, the legacy client is given access to the legacy server using login data,
• - Wherein the client platform is designed with a security token, e.g. enable authentication of the legacy client to communicate with the legacy server,
• - wherein the server platform is implemented with a security server in order to set up the tunnel to the client platform for encrypted and authorized communication, and to carry out the authentication of the legacy client for communication with the legacy server,
• - and wherein the server platform is implemented with a login analysis module to verify the credentials of the legacy client for access to the legacy server.

Such a system can be used to build an infrastructure (e.g. "public key infrastructure", so-called PKI) with a public and/or private key under a number of platforms, e.g. in the form of servers. The number of platforms may include multiple client platforms and multiple client platforms. The infrastructure can be used, for example, in an organization or in a company to connect at least one client platform with at least one server platform, preferably different client platforms with different client platforms, securely (through encryption) and confidentially (through authentication) to network.

With the help of such a system, a tunnel for encrypted and confidential communication and/or data transmission can be set up between a client platform from the plurality of client platforms and at least one application-side server platform from the plurality of server platforms.

A tunnel, e.g. an SSH tunnel, enables encrypted communication with secure authentication. Asymmetric encryption based on a pair of keys with a public and/or private key can advantageously be used. Different encryption methods can be used for this.

SSH stands for eng. "Secure Shell" and includes a cryptographic network protocol for the secure operation of network services, even over unsecured networks. The encryption technique used by SSH is designed to ensure the confidentiality, integrity, and authenticity of data sent over an insecure network (such as the Internet).

With the help of such a system, encrypted data transmission can be carried out between a client platform and a server platform, in which case the client ID is protected by a public key. In this way, the identity of the client can be kept confidential and thus protected.

With the help of such a system, several unique key pairs can be created and distributed within an infrastructure, which allow different client platforms to protect the identity of their users and at the same time secure access to at least one or more server platforms.

An individual public key for encrypting the communication and/or data transmission and the client ID can be assigned to each client, preferably with the aid of a corresponding security token. Furthermore, it can be advantageous if only one private key is assigned for each public key. The messages encrypted using the public key can only be decrypted using an associated private key. Public key encryption can be used to digitally sign messages.

The invention enables a strongly encrypted tunnel to be established from a loopback address of the legacy client to the legacy server of the legacy application via a service (security token) on the client platform and a service (security server) on the server platform. The security token is used for encryption and authentication when setting up the tunnel. The login analysis module is followed by a check of the legacy client's login data. In other words, the security token ID is checked on the registration analysis module and assigned to the corresponding client ID. Finally, log inspection on the security server binds the legacy application's client management to the security token.

• - generischer Ansatz für beliebige Altanwendungen,
• - starke Kryptographie,
• - Zwei-Faktor-Authentifizierung via Sicherheits-Token bzw. PKI-Karte,
• - keine erhöhten Rechte im System nötig,
• - einfacher und kostengünstiger Aufbau,
• - geringer rechentechnischer Aufwand,
• - einfache Installation und Implementierung.

Several significant advantages can be achieved with the aid of the invention, namely:

• - generic approach for any legacy application,
• - strong cryptography,
• - Two-factor authentication via security token or PKI card,
• - no increased rights required in the system,
• - simple and inexpensive construction,
• - low computational effort,
• - easy installation and implementation.

Furthermore, it can be provided that the tunnel is provided in the form of an SSH tunnel. Regardless of the design of the legacy application, an SSH tunnel can be used to create a secure connection to the server platform, in which data transmission is encrypted and the client ID is handled confidentially.

Furthermore, it is conceivable that the security token is in the form of a chip card or a PKI card. In this way, different clients can be easily and conveniently connected to a public key infrastructure using an individual PKI card. A PKI card can advantageously be used to provide two-factor authentication, which requires physical possession of the PKI card on the one hand and knowledge of an associated pin on the other. An encrypted connection can also be made via the PKI card Rarely can communication be established that has strong cryptography and reliably protects the client ID.

Advantageously, the registration analysis module can be integrated into the security server in terms of hardware, software and/or function. In this way, an improved security server with increased functionality can be provided. Furthermore, it is conceivable that the registration analysis module can be designed as an individually manageable module which can be installed on the security server or which can be used as a separate component.

In addition, the registration analysis module can have an evaluation unit that can be designed to check the registration data of the legacy client. In this way it can be ensured that only the legacy client can access the legacy server to which the appropriate credentials are assigned.

A directory can be provided as part of a system, which is designed to contain at least some of the login data and/or other user data (e.g. personal data of the user), in particular extended user data (e.g. personal data and optionally work-related, company-related, CV-related, learning-related, further education-related, interest-related, etc. data of the user) for a client ID. The directory can be in the form of a database, for example, and link multiple client IDs with associated data. The registration analysis module can, for example, obtain at least some of the registration data from the directory in order to register the legacy client for access to the legacy server. The user data, in particular extended user data, can advantageously include further useful data, such as e.g. B. the current status of the client, such. B. active employee or deactivated employee, an e-mail address, membership in a group, etc. In this way, not only a login, but also a secure and, if desired, refined authentication of the legacy client for access to the legacy server can be enabled.

In addition, the registration analysis module can have an interface to a directory in order to query at least some of the registration data and/or other user data, in particular extended user data, for a client ID. For example, the interface can be designed specifically for access to the directory. The interface can preferably enable secure communication with the directory, e.g. using an encryption protocol for secure data transmission, such as e.g. B.TLS.

Provision can furthermore be made for the registration analysis module to have a receiving unit in order to receive the ID data and/or the registration data of the legacy client from the security token, and/or for the registration analysis module to have a forwarding unit has to forward the ID data and / or the credentials of the legacy client to the legacy server, in particular only forward if the credentials of the legacy client for access to the legacy server have been positively verified. In this way, an advantageous registration analysis module with an autonomous function can be provided.

Furthermore, it can be advantageous if the registration analysis module has a storage unit, in particular a non-volatile storage unit, for the registration data of the legacy client and/or for log entries. In this way, a log can be automatically kept of all or specific actions of the client/server application. For example, the storage unit can be used to keep a log of the legacy client's registrations on the legacy server. With the help of the storage unit, the login data for a login of the legacy client can be kept ready on the legacy server in order to enable a quick login.

Furthermore, it can be advantageous if the registration analysis module is designed to bind the client ID and/or client administration to the security token on the server platform. In this way, an outdated and possibly unsecured application can be upgraded in terms of security and confidentiality during data transmission.

As already mentioned above, an advantageous use of a system, which can be designed as described above, is provided in a distributed infrastructure, in particular a public key infrastructure.

• eine Vielzahl an Client-Plattformen und
• eine Mehrzahl an Server-Plattformen,
  • - wobei die Vielzahl an Client-Plattformen gleich oder ungleich der Mehrzahl an Server-Plattformen ist,
  • - und wobei zwischen einer Client-Plattform von der Vielzahl an Client-Plattformen und mindestens einer anwendungsseitigen Server-Plattform von der Mehrzahl an Server-Plattformen jeweils ein Tunnel mithilfe eines Systems, welches wie oben beschrieben ausgeführt sein kann, aufgebaut ist.

The invention also provides: a distributed infrastructure, in particular a public key infrastructure, having:

• a variety of client platforms and
• a variety of server platforms,
  • - wherein the plurality of client platforms is the same or different than the plurality of server platforms,
  • - and wherein a tunnel is set up between a client platform from the plurality of client platforms and at least one application-side server platform from the plurality of server platforms using a system which can be implemented as described above.

The infrastructure according to the invention achieves the same advantages as described above in connection with the system according to the invention. Reference is made in full to these advantages here.

• - Ausführen der Client-Plattform mit einem Sicherheits-Token, um einen Tunnel zur Server-Plattform für eine verschlüsselte und autorisierte Kommunikation aufzubauen, und um eine Authentifizierung, insbesondere eine zwei-Faktor-Authentifizierung, des Legacy-Clients für eine Kommunikation mit dem Legacy-Server zu ermöglichen,
• - Ausführen der Server-Plattform mit einem Sicherheits-Server, um den Tunnel zur Client-Plattform für eine verschlüsselte und autorisierte Kommunikation aufzubauen, und um eine Authentifizierung des Legacy-Clients für eine Kommunikation mit dem Legacy-Server durchzuführen,
• - Ausführen der Server-Plattform mit einem Anmelde-Analyse-Modul, um die Anmeldedaten des Legacy-Clients für einen Zugriff auf den Legacy-Server zu überprüfen.

The invention also provides: a method for upgrading at least one, in particular outdated, client / server application for secure and confidential data transmission between a client platform with a legacy client and a server platform with a legacy server, according to the, in particular outdated, client/server application, the legacy client gains access to the legacy server using login data, having:

• - Running the client platform with a security token to build a tunnel to the server platform for encrypted and authorized communication, and authentication, particularly two-factor authentication, of the legacy client for communication with the legacy - allow server
• - running the server platform with a security server to establish the tunnel to the client platform for encrypted and authorized communication, and to perform authentication of the legacy client for communication with the legacy server,
• - Running the server platform with a login analyzer module to verify the legacy client's credentials for accessing the legacy server.

The method according to the invention can advantageously be carried out with the aid of a system which can be designed as described above. The method according to the invention achieves the same advantages as described above in connection with the system according to the invention. Reference is made in full to these advantages here.

Furthermore, the invention is illustrated in more detail with reference to the figure. It should be noted that the figure has only a descriptive character and is not intended to limit the invention in any way.

• 1 eine beispielhafte Darstellung eines Systems im Sinne der vorliegenden Offenbarung.

It shows:

• 1 an exemplary representation of a system within the meaning of the present disclosure.

The 1 shows a system 100, which is designed to run at least one, in particular outdated, client/server application, such as e.g. B. a "legacy" - and / or "synergy" application, upgrade between a client platform 10 and a server platform 20 for secure and confidential data transmission.

• - eine Client-Plattform 10 mit einem Legacy-Client 11 und
• - eine Server-Plattform 20 mit einem Legacy-Server 21,
• - wobei gemäß der, insbesondere veralteten, Client/Server-Anwendung der Legacy-Client 11 mithilfe von Anmeldedaten AD einen Zugriff auf den Legacy-Server 21 erhält.

The system 100 has the following elements:

• - a client platform 10 with a legacy client 11 and
• - a server platform 20 with a legacy server 21,
• - Wherein according to the, in particular outdated, client/server application, the legacy client 11 is given access to the legacy server 21 using login data AD.

As part of the system 100, the client platform 10 is implemented with a security token 12, for example in the form of a PKI card. The security token 12 is in turn designed to set up a secure tunnel 40 to the server platform 20 for encrypted and authorized communication and authentication, in particular two-factor authentication, of the legacy client 11 for communication with the legacy Server 21 to allow.

The server platform 20 is implemented with a security server 22 . The security server 22 is designed as a security forwarding server as a precursor to the legacy server 21 to build the tunnel 40 to the client platform 10 for encrypted and authorized communication, and to authenticate the legacy client 11 for a To perform communication with the legacy server 21.

The server platform 20 is advantageously implemented with a registration analysis module 23 . The registration analysis module 23 is in turn specifically designed to check the registration data AD of the legacy client 11 for access to the legacy server 21, or in other words to assign a client ID to the security token 12 and the client ID to verify access authorization to the legacy server 21. The registration data AD can include, for example, a client ID and an associated access authorization. Trains Pertinent access authorization can be obtained from a directory 26, for example.

Such a system 100 can advantageously be used to set up an infrastructure S, e.g. a so-called "public key infrastructure" or PKI for short, which has multiple platforms 10, 20, e.g. in the form of servers, with a public and/or private key networked. The platforms 10, 20 can have a multiplicity of client platforms 10 and a multiplicity of server platforms 20. The infrastructure S can be used, for example, in an organization or in a company to connect at least one client platform 10 to at least one server platform 20, preferably different client platforms 10 to different server platforms 20, securely (by encryption) and network confidentially (through authentication).

With the help of such a system 100, a tunnel 40 for encrypted and confidential communication and/or data transmission can be set up between a client platform 10 from the plurality of client platforms 10 and at least one application-side server platform 20 from the plurality of server platforms 20 become.

A tunnel 40 can be understood, for example, as an SSH tunnel for encrypted communication (for example with asymmetric encryption) with secure authentication (for example using the public key). In principle, different encryption methods can be used for asymmetric encryption.

With the help of such a system 100, the identity of the client is handled confidentially and is therefore protected. Within the framework of a corresponding infrastructure S, several unique key pairs can be created and distributed, which allow different client platforms 10 to protect the identity of their users.

Each legacy client 11 is provided with a corresponding security token 12 with a permanently assigned public key. In turn, only one individual private key can be assigned for each public key. The messages encrypted using the public key can only be decrypted using an associated private key. Public key cryptography can also be used to digitally sign messages to authenticate the client.

The invention thus enables a strongly encrypted tunnel 40 to be set up from a loopback address of the legacy client 11 to the legacy server 21 of the old application via the security token 12 on the client platform 10 and the security server 22 on the server platform 20 Encryption and authentication when setting up the tunnel 40 takes place via the security token 12. The registration data AD of the legacy client 11 or the link is checked on the registration analysis module 23 on the security server 22 side the security token ID to the client ID.

The security token 12 can be in the form of a chip card or a PKI card. With the help of an individual PKI card, different clients can be easily and conveniently connected to a public key infrastructure. A two-factor authentication can advantageously be provided with the aid of a PKI card.

Like it the 1 indicates, the registration analysis module 23 can be integrated in the security server 22 in terms of hardware, software and/or function. The registration analysis module 23 can be in the form of a software and/or hardware component which can be integrated in the security server 22 .

In addition, the 1 that the registration analysis module 23 can have an evaluation unit AI. The evaluation unit AI can be designed to check the registration data AD of the legacy client 11 .

Like it the 1 1, a directory 26 may be provided within a system 100. FIG. At least part of the registration data AD and/or further user data BD, in particular extended user data, can be stored in the directory 26 for different client IDs. The directory 26 can be in the form of a database, for example, and can link a number of client IDs with associated data. The registration analysis module 23 can, for example, obtain at least some of the registration data AD from the directory in order to check the access authorization of the legacy client 11 for access to the legacy server 21 . The user data BD, in particular extended user data, can include other useful data on a client ID, such as B. the current status of the legacy client 11, such as. B. active employee or deactivated employee, an email address, a membership in a group, etc.

In addition, the 1 That the registration analysis module 23 can have an interface SN to the directory 26 to at least partially the registration data AD, such as. Legs Request access authorization and/or additional user data BD, in particular extended user data, for a client ID. The interface SN can preferably enable secure communication with the directory 26, e.g. using an encryption protocol for a secure communication link 25, such as e.g. B.TLS.

Furthermore, the 1 that the registration analysis module 23 can have a receiving unit EI in order to receive the ID data and/or the registration data AD of the legacy client 11 from the security token 12, and/or that the registration analysis module 23 can have a forwarding unit Wl in order to forward the ID data and/or the registration data AD of the legacy client 11 to the legacy server 21 . The forwarding can preferably only take place if the registration data AD of the legacy client 11 for access to the legacy server 21 have been positively verified.

The communication connection 24 between the legacy server 21 and the security server 22 can, for example, take place via an SSL/TLS connection. The communication connection 14 between the legacy client 11 and the security token 12 can also take place via an SSL/TLS connection. In principle, any connection that is supported by the server platform 20 or client platform 10 is conceivable.

Advantageously, the registration analysis module 23 can have a, in particular non-volatile, memory unit MU for the registration data AD of the legacy client 11 and/or for log entries, for example to automatically create a log of the registrations of the legacy client 11 on the legacy -Server 21 to lead. With the help of the storage unit MU, the registration data AD can also be kept ready for quick registration of the legacy client 11 on the legacy server 21 .

Like it the 1 schematically illustrated, the login analysis module 23 can be designed to bind the client ID and/or client administration on the server platform 20 to the security token 12 .

• eine Vielzahl an Client-Plattformen 10 und
• eine Mehrzahl an Server-Plattformen 20,
  • - wobei die Vielzahl an Client-Plattformen 10 gleich oder ungleich der Mehrzahl an Server-Plattformen 20 ist,
  • - und wobei zwischen einer Client-Plattform 10 von der Vielzahl an Client-Plattformen 10 und mindestens einer anwendungsseitigen Server-Plattform 20 von der Mehrzahl an Server-Plattformen 20 jeweils ein Tunnel 40 mithilfe eines Systems 100, welches wie oben beschrieben ausgeführt sein kann, aufgebaut ist.

A corresponding distributed infrastructure S, in particular a public key infrastructure, also represents an aspect of the invention, having:

• a variety of client platforms 10 and
• a plurality of server platforms 20,
  • - wherein the plurality of client platforms 10 is the same or different than the plurality of server platforms 20,
  • - and wherein between a client platform 10 from the plurality of client platforms 10 and at least one application-side server platform 20 from the plurality of server platforms 20, a tunnel 40 is established with the aid of a system 100, which can be implemented as described above, is constructed.

• - Ausführen der Client-Plattform 10 mit einem Sicherheits-Token 12, um einen Tunnel 40 zur Server-Plattform 20 für eine verschlüsselte und autorisierte Kommunikation aufzubauen, und um eine Authentifizierung, insbesondere eine zwei-Faktor-Authentifizierung, des Legacy-Clients 11 für eine Kommunikation mit dem Legacy-Server 21 zu ermöglichen,
• - Ausführen der Server-Plattform 20 mit einem Sicherheits-Server 22, um den Tunnel 40 zur Client-Plattform 10 für eine verschlüsselte und autorisierte Kommunikation aufzubauen, und um die Authentifizierung des Legacy-Clients 11 für eine Kommunikation mit dem Legacy-Server 21 durchzuführen,
• - Ausführen der Server-Plattform 20 mit einem Anmelde-Analyse-Modul 23, um die Anmeldedaten AD des Legacy-Clients 11 für einen Zugriff auf den Legacy-Server 21 zu überprüfen.

A corresponding method for upgrading at least one, in particular outdated, client / server application for secure and confidential data transmission between a client platform 10 with a legacy client 11 and a server platform 20 with a legacy server 21, wherein according to the , in particular outdated, client/server application, the legacy client 11 gains access to the legacy server 21 using login data AD, having the following actions:

• - Running the client platform 10 with a security token 12 to build a tunnel 40 to the server platform 20 for encrypted and authorized communication, and authentication, in particular a two-factor authentication, the legacy client 11 for enable communication with the legacy server 21,
• Running the server platform 20 with a security server 22 to set up the tunnel 40 to the client platform 10 for encrypted and authorized communication, and to authenticate the legacy client 11 for communication with the legacy server 21 ,
• - Running the server platform 20 with a login analysis module 23 to check the login data AD of the legacy client 11 for access to the legacy server 21.

The method according to the invention can advantageously be carried out using a system 100 which can be implemented as described above.

The above description of the figure describes the present invention solely within the framework of examples. It goes without saying that individual features of the embodiments can be freely combined with one another, insofar as this makes technical sense, without departing from the scope of the invention.

Reference List

100

system

10

client platform

11

legacy client

12

security token

14

communication link

20

server platform

21

legacy server

22

security server

23

Login Analysis Module

24

communication link

25

communication link

26

directory

40

tunnel

S

infrastructure

AD

credentials

Al

evaluation unit

BD

user data

EGG

receiving unit

MU

storage unit

SN

interface

WI

forwarding unit

Claims (10)

A system (100) for upgrading at least one client/server application for secure and confidential communications, comprising: - a client platform (10) with a legacy client (11) and - a server platform (20) with a legacy server (21), - whereby according to the client/server application the legacy client (11) receives access to the legacy server (21) using login data (AD), - wherein the client platform (10) is implemented with a security token (12), to set up a tunnel (40) to the server platform (20) for encrypted and authorized communication, and to enable authentication of the legacy client (11) for communication with the legacy server (21), - wherein the server platform (20) is designed with a security server (22), to set up the tunnel (40) to the client platform (10) for encrypted and authorized communication, and to perform the authentication of the legacy client (11) for communication with the legacy server (21), - and wherein the server platform (20) is designed with a registration analysis module (23), to check the credentials (AD) of the legacy client (11) for access to the legacy server (21). system (100) after claim 1 , wherein the tunnel (40) is provided in the form of an SSH tunnel, and/or wherein the security token (12) is in the form of a chip card or a PKI card. System (100) according to one of the preceding claims, wherein a directory (26) is provided in order to provide at least some of the registration data (AD) and/or further user data (BD), in particular extended user data, for a client ID. System (100) according to one of the preceding claims, wherein the registration analysis module (23) has an interface (SN) to a directory (26) in order to at least partially store the registration data (AD) and/or further user data (BD) , in particular extended user data, to query a client ID. System (100) according to any one of the preceding claims, wherein the registration analysis module (23) has a receiving unit (EI) in order to receive the ID data and/or the registration data (AD) of the legacy client (11) from the security token (12), and/or wherein the registration analysis module (23) has a forwarding unit (WI) in order to forward the ID data and/or the registration data (AD) of the legacy client (11) to the legacy server (21), in particular only to be forwarded if the login data (AD) of the legacy client (11) for access to the legacy server (21) has been positively verified. System (100) according to one of the preceding claims, wherein the registration analysis module (23) has a, in particular non-volatile, storage unit (MU) for the registration data (AD) of the legacy client (11) and/or for log entries. System (100) according to any one of the preceding claims, wherein the login analysis module (23) is designed to client ID and / or client management on the server platform (20) to the security token (12). tie. Use of a system (100) according to one of the preceding claims in a distributed infrastructure (S). Distributed infrastructure (S), comprising: a plurality of client platforms (10) and a plurality of server platforms (20), wherein the plurality of client platforms (10) are the same as or different from the plurality of server platforms (20), and wherein a tunnel (40 ) is constructed using a system (100) according to any one of the preceding claims. Method for upgrading at least one client / server application for secure and confidential data transmission between a client platform (10) with a legacy client (11) and a server platform (20) with a legacy server (21), wherein according to the client/server application, the legacy client (11) is granted access to the legacy server (21) using credentials (AD), having: - running the client platform (10) with a security token (12), to set up a tunnel (40) to the server platform (20) for encrypted and authorized communication, and to enable authentication of the legacy client (11) for communication with the legacy server (21), - running the server platform (20) with a security server (22), to set up the tunnel (40) to the client platform (10) for encrypted and authorized communication, and to perform the authentication of the legacy client (11) for communication with the legacy server (21), - Running the server platform (20) with a login analysis module (23) to check the login data (AD) of the legacy client (11) for access to the legacy server (21).

Images