DE19716849A1 - Secure data transmission method e.g. for remote control of vehicle door locks - Google Patents

Abstract

The method involves coding a word from a sequence of reference words (201) twice to get a double coded word (203) by each transmission from a transmitter to a receiver. At the receiver the data are checked whether the double coded word correspond to the reference word before validate the double coded word. Each reference word for each transmission is double coded at the transmitter in a sequence which corresponds to a regularity stored at the receiver. The receiver secures the reception of a sequence of words which have the stored regularity.

Description

When transferring data from one point to one other or within a network it may be necessary be to make the data inaccessible to third parties, in particular for reasons of confidentiality. The applicant has set themselves the task of an infrared Remote control for vehicles to make the is intended for this, for example the opening of the doors remote control. The object of the invention should be everyone not as a solution to this particular problem be viewed in a limited way.

A device for remote control using infrared enables illuminates a user to display data for commands to be executed to transmit a receiving device of the vehicle. The Transfer of a confidential or password that the  Users must know between the remote control and the Receiving device of the vehicle in the vehicle is stored and is intended, for. B. the opening triggering the doors offers no guarantee for Security, because a third party uses this word at any can record the transmission and later for the purpose of can play unauthorized opening of the doors.

In this context, the more general pro arises due to repeated transmission between a transmitter and a recipient, information that is given by the Emp can be checked for validity. The protection egg ner such transmission requires that the trans data that carry the specified information (e.g. Opening the doors), do not repeat yourself.

A known method for protecting the transmission of Data consists in that in the transmitter starting from one Reference word according to a random law through closures an encrypted word with a secret key is generated, and that then the reference word and the ent speaking encrypted word transmitted to the recipient what is transmitted in the receiver based on that a second encryption and received reference word word by encryption with the same secret Key is generated, after which the two ver words to be compared to each other Confirm transmission in case of their identity or to make it valid. In this context you put notes that the transmission of the randomly selected Refe enables the sender and the receiver for the  "Synchronize" encryption.

This method offers relatively good protection of the Transfer of data, especially if it is is about making a retransmission valid to explain.

From US-A-5 363 448 is yet another, high-performance known method in which it is proposed so Probably the sender as well as the receiver side who randomly selected te reference number in two successive encryption keys levels using one or two secret keys to encrypt. Generated based on the reference number you get a second number that after it has been encrypted, in turn a two provides encrypted third number. The transmitter is broadcasting to the recipient only the reference number and the ent speaking, double-encrypted third number, so that a Third party no possibility of access to the once ver has keyed second number, which prevents him from or get the secret keys.

The two methods above see also before receiving the novelty of the transmitted data check by using those previously validated and in a repetitive prevention Memory stored data can be compared.

The protection of the transmission of data may be ge compared to the means of computer science for the analysis of data is bigger, but it's still only a partial one  Protection against recurrence exists as the novelty the data is only checked in relation to such data that were previously received within a window, that by the size of the prevention of repetition serving memory is limited.

The object of the invention is seen in the transfer supply of data by a method that in particular a provides more effective protection against repetition, to make it even safer.

This object is achieved by a method for protected transmission of data between a transmitter and solved a receiver, with each transmission on the transmitter side two consecutive ver keyings are made with at least one secret key, being a word from a sequence of Reference words are encrypted before a double ver key word is obtained, and the one on the page of the recipient, after the transmission of data that the considered double-encrypted word that contain Novelty of the received data is checked, after which checked whether the received, double-encrypted word and the considered reference word correspond to each other before the double-encrypted word is declared valid, where the method according to the invention is characterized in that that the reference words of a after the other and for each individual broadcast in in a double-encrypted order, that of a law Temperance corresponds to that on the side of the recipient is stored, on the side of the recipient si  It is established that the receipt of a sequence of words complies with the stated legality.

It can be provided that one is on the side of the transmitter an initial synchronization of the transmitter with the emp catchers by sending out a special reference word acts, with the special on the side of the recipient Reference word is recognized and as the start word of the series (N₀) is saved.

The method according to the invention requires not only in front the absolute novelty of the received Da It also eliminates the problems associated with the Ver drive inherently occurring according to the prior art Resynchronization problems. Knowing not random law and the last send The reference word enables the recipient to Determine word in advance that he will receive next must, and in this way to synchronize itself automatically ren.

It can be provided that one on the side of the recipient gers the correspondence between the reference word and the received, double-encrypted word checked by double ver the reference word with the named key is encoded and the result with the received, dop pelt encrypted word is compared. It can also be provided that the dop on the side of the recipient pelt encrypted word with the named keys ent is keyed to get the reference word so can be checked whether it is the sequence of words  hear.

The receipt of a reference word after the named Lawfulness follows the word previously received was made possible in this way, at the same time check whether it is a valid word that is marked by the law is set and a new word, since it is checked whether the order of words in the desired direction.

The transmitted data can either only encrypt this rare word or both the encrypted word as also include the corresponding reference word.

In the first case (only encrypted transmission Words) the recipient can check whether or that the ge sent and received, double-encrypted word did the envisaged corresponding reference word speaks which of the recipient according to the law expects, based on the double key rare word with two consecutive decryption keys a reference word is reconstructed. If that on thus reconstructed reference word with the one that is intended and expected is identical the recipient fulfills the novelty requirement, resynchronizes with respect to the sender and vali dated the data. In this case, a third person just monitor the encrypted words without in to be able to get knowledge of the reference words keep what the protection of security encryption considerably enlarged.  

In the second case (transmission of both the encrypted Word and the corresponding reference word), the Check receiver whether or that the transmitted and emp caught reference word and the double-encrypted word correspond to each other. This review can be based on two ares ten done, namely either by two successive encryption processes, with the secret Keys, the reference word, whereby the ver keyed word is generated, or by two successive decryption processes of the double encrypted word by the secret key or keys sel in reverse used to go back to get to the reference word.

Furthermore, the transmission of the reference word leads to a automatic synchronization of the receiver with the sen the, e.g. B. for initial commissioning or after activation of the transmitter outside the range of the Recipient.

The novelty of the data transmitted to the recipient will with the help of the new reference word and the last ref word that is validated and stored in the memory for ver Avoidance of repetitions is saved, checked. On this way this novelty becomes relative to the last Reference word and, as a result, in relation to al len previous reference words found what therefore comes that it is checked whether the episode in a fixed direction. There is no need for one large and necessarily limited amount of previously validated store data, and beyond that is protection  against repetition of data, even very old ones Data, complete.

The invention further relates to a transmitter for implementation of the method according to the invention, with a device, to successively control a storage device which is set up to respond accordingly other via a device for double encryption a sequence of reference words to a transmitter transmitted, the transmitter being characterized by that the storage device is set up so that the successive reference words of a predetermined one Obey lawfulness.

It can preferably be provided that the storage device device has a computing device that is set up in this way is that, according to the above-mentioned law, the Refe Limit word determines that based on a previously sent and time Reference stored in the memory device word follows.

Finally, the invention relates to a receiver to implement the method according to the invention, with a Device for receiving and storing sent Data, the two successively sent reference words represent, whereby the recipient is characterized by that it has a computing device that is set up in this way What is important is that, according to a certain law, it Reference word that follows the first reference word, be true, and the second reference word declared valid, if it matches this.  

It can preferably be provided here that the computing direction a decryption device for the received gene data.

It is preferably provided that the computing device Decryption device for reference words, which are received together with the data, and so on is directed that this by comparing the result with validated the received, encrypted reference word will.

Although the sender and the receiver are necessary at the same time are to carry out the inventive method, bil which they nevertheless separate subjects of the invention since each individually used for commercial purposes or in the Can be traded.

The invention is based on an embodiment example for the protected method according to the invention for the transmission of data between a transmitter, here one Infrared remote control of a motor vehicle, and one Transmitter of the vehicle explained further, being on a Drawing is referred to in which:

Fig. 1 is a schematic block diagram of the transmitter shown for carrying out the method according to the invention;

FIG. 2 shows a schematic block diagram of the receiver belonging to the transmitter in FIG. 1, and

Figure 3 shows a schematic block diagram of another embodiment of a receiver.

On the side of the transmitter ( Fig. 1), a user who wants to open the doors of his vehicle with the remote control, presses a button 1 with which a counter 2 is activated, which controls a computer block 3 , which in turn a reference word in N _i 201 delivers.

The reference word N _i 201 is encrypted in an encryption unit 4 to 7 , which has an encryption device 4 which uses a secret key K 1 stored in a memory 6 . The reference word N _i is encrypted into a second word N ′ _i 202 , which is encrypted once, and which in this example is encrypted again with a further encryption device 5 . The device 5 is located below the device 4 and uses another, secret key K₂, which differs from the key K₁ and is stored in a memory 7 . From the second encryption results a third word N _i '' 203 , which is encrypted twice.

Subsequently, data are transmitted to the receiver via a transmission block 8 , in this case via infrared signals, which in this case contain the double-encrypted word N _i '' 203 and the reference word N _i 201 .

In the receiver ( FIG. 2), the above-mentioned data ( 201 , 203 ) are received with a reception block for infrared signals 9 and temporarily stored in a working memory 10 .

The received and stored reference word N _i 201 is encrypted with two encryption devices 14 and 15 connected in series. The devices 14 and 15 are identical to the devices 4 and 5 of the transmitter and also use the two secret keys K₁ and K₂, which are stored in the respective memories 16 and 17 , a third word N _i ''' 204 being generated, which is double-encrypted and can deviate from the one that is received and stored in the working memory 10 . This can be the case in particular if an unauthorized access attempt has been made by third parties. With a comparator 18 , the word N _i ''' 204 , which was encrypted twice in the receiver, with the word N₁'' 203 , which was encrypted twice in the transmitter and is stored in the working memory 10 of the receiver. If the two words are identical, a first match signal 21 is sent to the input of a logic AND gate 19 .

On the other hand, the novelty and the conformity with the legality of the received and stored reference word N _i 201 is checked. The reference word 101 , which was previously received and declared valid, and which is referred to here as N _i -1, has been stored in a memory 11 to avoid repetitions, as will be explained in more detail below. The memory 11 is a simple register that feeds a computer block 12 , which also receives the last reference word N _i 201 , which is stored in the memory 10 . The computer block 12 passes the words 101 and 201 on to a comparator 13 , which, as will be explained, generates a second match signal 22 which is applied to another input of the logic AND gate 19 . The reference words N _i-1 101 and N _i 201 are representative of their respective rank R _i-1 and R _i , as will be explained below. The AND gate 19 outputs upon receipt of the first and second correspondence signals 21 and 22, a signal 23 for the validity of the data obtained, where is actuated by an actuator, which is not shown here, and the doors of the vehicle are unlocked. The signal 23 also triggers the Aktualisie tion of the memory 11 from by a gate 20 is unlocked, whereby the last reference number N _i cher in the SpeI 11 is transmitted 201 where it replaces the number N _i -1 and automatically in this way the Receiver synchronized.

According to the invention, the method also provides that the reference words N _i belong to a series of words which are defined by a specific law. These words are generated one after the other and transmission process for transmission process when the push button 1 of the remote control is actuated to unlock the doors, the counter 2 being increased by one unit. The state of the counter 2 is represented by an integer R _i-1 .

The integer R _i-1 is replaced by the next following integer R _i , the computer block 3 receiving this latter integer R _i . In block 3 , with the aid of a reciprocal function F, which is stored locally, the reference words, in this case the reference numbers N _i 201 , are calculated one after the other during successive transmission processes of the remote control, starting from the successive integers R _i 200 , which are obtained by incremental increments and represent the rank of each remote control command sent. Based on a sequence of precursor values R _i (here a sequence of integers), the function F generates a sequence of reference numbers N _i 201 , each of which is an image of the numbers R _i 200 , with each precursor value R _i previously from the counter 2 had been issued and had been temporarily stored in the form of its rank R _i-1 in the counter 2 or in the form of the reference word N _i-1 in the computer block 3 .

The reciprocal function F is designed such that each previous value R _i 200 only leads to a single image N _i 201 , and that each image N _i 201 is only generated by a single preliminary value R _i 200 .

In this example, the regularity is represented by a Function F shown, which has the following form:

N _i = F (R _i )

Here, R _i is the rank of the command that increases by one unit each time, starting from an initial value of zero.

The function F (R _i ) is reciprocal and, for the sake of simplicity, is assumed to be a monotonically growing function. In this example, it corresponds to a simple multiplication of the value R _i by a constant value, here by a positive integer that is equal to 2, ie:

N _i = 2R _i

In other words, in this case, the reference number N _{i must be} an integer and even, which means conversely that any number N _i that does not meet these two criteria cannot be recognized by the receiver since it does not result in discrete sequences Heard values that correspond to the successive rankings R _i over the above-mentioned regularity.

Instead of the computer block 3 , one could alternatively have provided a simple memory, the capacity of which is sufficient to store the sequence of reference words N _i 201 .

The sequence R _i 200 is also determined in the receiver in order to be able to check the novelty of the numbers N _i 201 that are received and to resynchronize the receiver with the transmitter, as will be explained in more detail below. The last valid reference number N _i-1 101 is stored in the memory 11 , which is provided for preventing repetitions and is connected to the working memory 10 . Alternatively, provision could also be made to store this reference number in its encrypted form N ′ ′ _i-1 103 . In the computer block 12 , which is connected to the working memory 10 and to the memory 11 to avoid repetitions, a function F ^-1 is used to calculate the rank values or precursor values R _i and R _i-1 , 200 and 100 , the reference numbers N _i and N _i -1, 201 and 101 . The function F ^-1 is the inverse function of the reciprocal function, ie it can generate the precursor values R _{i based} on the images N _i . In this case the function F-1 corresponds to a simple division by the whole positive number mentioned, which is equal to 2, ie:

The comparative precursor values R _i and R _i-1 , 200 and 100 are then compared in the comparator 13 . If the precursor value R _i 200 of the reference number 201 received and stored in the working memory 10 is a value which is greater than the precursor value R _i-1 100 of the last valid reference number N _i-1 100 , it is assumed that that the novelty is given. In order to avoid that any new remote control command is accepted whose rank R _i does not correspond to that of the previous remote control command that has the rank R _i-1 , and in this way to make the transmission more secure, the comparator 13 is in this In the case of a subtractor which only issues a validity signal 22 if the rank R _{i of} the previous or last remote control command is equal to that increased by one unit of the previous remote control command R _i-1 100 . In other words, the computer block 12 and the subtractor 13 have the function of determining a second reference word ( 201 or 203 ) according to the regularity represented by the function F ^-1 , which follows a first reference word 101 or 103 received immediately before, and to declare the second received reference word 201 or 203 valid or to validate it if it matches the first ( 101 , 103 ). It could, however, also be provided that this acceptance range of rank values is larger than a unit in order to tolerate a partial desynchronization between transmitter and receiver, which can occur, for example, because the transmitter has been actuated while it is out of the reach of the Recipient. In this case, the comparator 13 would consist of said subtractor, followed by a circuit which compares its (positive) result with an upper threshold, which limits the acceptance range, and emits the signal 22 if this result is below the threshold or equal This is.

In the case of validation of the consignment ( 23 ), the last validated reference number N _i -1 101 is replaced by the new validated reference number N _i in order to prevent the repetition of the repetitive memories 11 in order to maintain the synchronization of the receiver with the transmitter .

For the purpose of initial commissioning, a first synchronization of the transmitter and the receiver is carried out by initializing the sequence 201 of the reference words, with this synchronization in the counter 2 of the transmitter and in the memory for preventing repetitions 11 of the receiver integer with an initial rank R₀ or the reference number N₀, which corresponds to it by the function F, are stored. For this purpose, the number N₀ 201 and the double-encrypted, corresponding number N ′ ′ ′ ₀ 203 is sent out by the transmitter.

The receiver accepts the numbers N₀ and N''₀ and updates the memory 11 by the reference number N _i0 without a novelty test being carried out in this example, ie the receiver recognizes the special number N₀ as a single remote control signal serving the synchronization , which opens the gate 20 via a further input, not shown, but without having a mechanical effect for unlocking the doors.

The transmission of the number N₀ is done by a special key triggered by the receiver, which in the case of a match the need for later synchronizations after the original initial commissioning enabled.

In a second embodiment, which is explained in Fig. 3, the transmitter transmits data to the receiver, which only contain the third number N _i '' 203 , which is double-encrypted. In this case, the double-encrypted number N _i '' 203 is received in the receiver with a receiving block 29 for infrared signals and stored in a working memory 30 . Then the number N _i '' 203 is decrypted with two decoding devices 35 and 34 connected in series, the secret keys K₂ ^-1 and K₁ ^{-1 being} used, which are stored in the memories 37 and 36 and are each inverse to the are secret keys K₂ and K₁ of the transmitter. In this way, the corresponding reference number N _i 201 is returned . Starting from this reference number and starting from the preceding reference number N _i-1 101 , which is validated and stored in a memory 31 to avoid repetitions, its precursor values R _i and R _i ₄ 200 and 100 are determined by the reciprocal inverse function F ^{- 1} calculated in a computer block 32 . These precursor values R _i and R _i-1 200 and 100 are compared with one another using a comparator 33 . If the precursor value R _i 200 is greater than the precursor value R _i-1 100 , namely by one unit, the shipment is validated and the transmitter and the receiver are resynchronized by storing the last validated reference word 101 in the memory 31 to avoid how repetitions is replaced by the new validated reference word 201 , specifically by a gate 40 which is opened by the comparator 33 .

In a modification of the invention it can be provided that the reference words 201 and / or the second words 202 or the third words 203 are a sequence of any letters and / or numbers and not, as in this case, only of integers.

The one in the previous description, in the drawing as well as features of the invention disclosed in the claims can be used individually or in any combination for the realization of the invention in its various NEN embodiments may be essential.

Claims (10)

1. A method for the protected transmission of data between a transmitter and a receiver, in which two consecutive encodings ( 4 , 6 ) are made with each transmission on the side of the transmitter, with at least one secret key (K₁; K₂), wherein a word from a sequence of reference words ( 201 ) is encrypted before a double-encrypted word ( 203 ) is obtained, and on the receiver side, after the transmission of data containing the double-encrypted word ( 203 ) under consideration , the novelty of the received data is checked, after which it is checked whether the received double-encrypted word ( 203 ) and the considered reference word ( 201 ) correspond to one another before the double-encrypted word ( 203 ) is declared valid, characterized in that on the side of the transmitter, the reference words (201) one by one and for each sending process in a row Sequence e double-encrypted, which corresponds to a regularity (F), which is stored on the side of the recipient, whereby on the side of the recipient it is ensured that the receipt corresponds to a sequence of words of the said regularity (F). 2. The method according to claim 1, characterized in that one on the receiver side an initial synchro nization of the receiver and the transmitter by sending of a special reference word, whereby on the page te of the receiver the special reference word is recognized and is stored as the start word of the sequence (N₀). 3. The method according to any one of claims 1 or 2, characterized in that the reference word ( 201 ) is transmitted together with the data. 4. The method according to claim 3, characterized in that on the side of the recipient, the match between the reference word's ( 201 ) and the received, double-encrypted word ( 203 ) by double encryption of the reference word ( 201 ) with said key (K₁ , K₂) and checked by comparing the result with the double-encrypted, received word ( 203 ). 5. The method according to any one of claims 1 to 4, characterized in that on the side of the recipient with said keys (K₁, K₂) the double-encrypted te word ( 203 ) is decrypted to obtain the reference word ( 201 ), so can be checked whether it belongs to the sequence of words. 6. Transmitter for carrying out the method according to claim 1, with a device ( 1 ) to successively control a memory device ( 2 , 3 ) which is set up in such a way that it responds successively via a device ( 4 to 7 ) to double encryption transmits a sequence of reference words ( 201 ) to a transmitting device ( 8 ), characterized in that the storage device ( 2 , 3 ) is set up in such a way that the successive reference words ( 201 ) obey a certain law (F). 7. The transmitter of claim 6, characterized in that the memory means (2, 3) a computing device (3) includes, which is set up so that after a law temperance (F), the reference word (201) determines that a previously sent and temporarily stored in the memory device ( 2 , 3 ) (R _i-1 ; 101 ) reference word follows. 8. Receiver for carrying out the method according to claim 1, with a device ( 10 , 11 ; 30-31 ) for receiving and storing transmitted data, which represent two successively transmitted reference words ( 101 ; 103 , 201 ; 203 ), characterized that it has a computing device ( 12 , 13 ; 32 , 33 ) to determine the reference word ( 201 ; 203 ) according to a predetermined law (F), which follows the first received ( 101 ) reference word ( 101 ; 103 ) , and to validate the second received reference word ( 201 ; 203 ) if it matches this ( 101 ; 103 ). 9. Receiver according to claim 8, characterized in that the computing device has a device for decrypting ( 34 to 37 ) the received data. 10. Receiver according to claim 8, characterized in that the computing device has an encryption device ( 14 to 17 ) for the reference words ( 201 ) contained and received in the data and is set up ( 18 ) to compare the result with the receive validate an encrypted reference word ( 203 ).