EP3231150A1

EP3231150A1 - Method and device for transferring data in separate networks

Info

Publication number: EP3231150A1
Application number: EP15801356.5A
Authority: EP
Inventors: Thomas Köhler
Original assignee: Seciq Holding GmbH
Current assignee: Seciq Holding GmbH
Priority date: 2014-12-08
Filing date: 2015-11-16
Publication date: 2017-10-18
Also published as: DE102014118069A1; WO2016091540A1

Abstract

The invention relates to a method and a device (50) for transferring data between an open computer network (2) and a closed computer assembly (1). For this purpose, first image and/or audio data (VD1, AD1) of a computer (3) of the open computer network (2) is recorded in a previously precisely reserved first transfer memory region (16U, 13U) of a memory that is connected to the open computer network (2). The first image and/or audio data (VD1, AD1) is read by means of a data-copying unit (11) via uni-directional memory access (20) from the first transfer memory region (16U, 13U). On the basis of this, second image and/or audio data (VD2, AD2) is generated, each representing an image that is defined by the first image and/or audio data (VD1, AD1). The second image and/or audio data (VD2, AD2) is then passed on to the closed computer assembly (1).

Description

DATA IN SEPARATE NETWORKS

The invention relates to a method and a usable device for transmitting data between an open or insecure computer network, in particular a network of computer networks such as the Internet, etc., and a closed computer arrangement.

Attacks on computers and computer networks, in particular via the Internet or other outward-open connections, by means of viruses, spyware, Trojans or other malicious programs are a common problem these days. Many attacks are aimed at obtaining secret information from the compromised computer system or even remotely controlling it. Some attacks are generally directed against all computers that are not adequately protected. In addition, there are also targeted attacks against certain users, such as organizations whose business secrets are to be spied on. To a large extent, the use of a good firewall already helps against common attacks. In highly critical applications, such as in computers or computer networks for controlling security-related facilities such as power plants, communication networks, military installations, data centers, development departments, etc., such measures are usually not sufficient. In order to ensure the greatest possible security, such cases are often provided with complete "dismissal", ie care is taken that there is no longer any connection between the closed computer system to be secured and an open network such as the Internet. However, such a strict separation of the network infrastructure into an insecure area and a secure area without any network connection has the disadvantage that those working in the secure area can no longer access Internet applications via their computers used for their daily work On the one hand, they work with secret data, but on the other hand, the employees should have access to generally accessible information as well as possible - although it is possible to provide each employee with two separate computers so that they can surf the Internet with one computer as usual, and the other computer is only used within the closed organization network. However, this too is relatively cumbersome and hinders the daily work.

In order to increase the security of obtaining information on the Internet, it is possible to install remote-controlled virtualized computers in e.g. to use private data centers. An example of this is the "BitBox" ("Browser in the Box"), a virtualized solution based on Debian Linux, which was developed on behalf of the Federal Office for Information Security. The control computer remotely controls the virtualized computer via a remote access protocol and sees a copy of the screen of the virtualized computer in the window of its own computer, which acts as a remote desktop client. As remote access protocols, the protocols RFB (Remote Frame Buffer Protocol) are currently predominantly used for Linux-based systems or Mac computers (only suitable for remote screen transmission and for the transmission of keyboard and mouse input) or the program VNC based thereon (Virtual Network Computing) as well as the RDP (Remote Desktop Protocol) predominantly for Microsoft-based systems (audio transmission is also possible here). The direct access of the control computer to the Internet is usually blocked by a firewall and should therefore not be vulnerable directly from the Internet. However, one problem here is that firewalls and other protection mechanisms, especially in a targeted attack, are bypassable. An increased risk exists especially if the security-relevant software of the firewalls contains errors, which is the rule in the complexity of today's software. In addition, many manufacturers are forced to incorporate back doors for government agencies in their safety components. This often explains the many recent successful break-ins in internal networks that are protected by professional firewalls.

Furthermore, in Gennuso K .: Disconnect from the Internet - Whale ^'s e-Gabp In Depth. SANS Institute, 13 September 2001, proposed a connection between the external network and a memory area via a switch SCSI e-disk, then free all incoming data from TCP headers and save only the payload on the SCSI e-disk. Subsequently, the connection to the external network is cut off and a connection is established to the internal network in order to take over the user data. Here, too, the original user data from the external to the internal network, which in principle opens the possibility that in the user data hidden malicious code is transmitted.

It is an object of the invention to provide an alternative to the above-described possibilities of obtaining information from an open computer network such as the Internet in a closed computer arrangement in which the risk of attacks on the completed computer arrangement is further reduced , This object is achieved by a method according to claim 1 and a device according to claim 10.

In the method according to the invention for the transmission of data between the open or insecure computer network, for example the Internet, and the closed computer arrangement to be secured, a computer of the open computer network receives incoming first picture and / or audio data, for example the current image of the Internet browser or website content, stored in a pre-precisely reserved first transfer memory of a connected to the open computer network memory. This computer of the open computer network may be any instance or device which is integrated in the open computer network or connected to the open computer network, for example, has an Internet access to the image and / or Transfer audio data and store it in the memory.

Furthermore, the first image and / or audio data are read out by means of a secure, preferably hardware-based, data copying unit via a unidirectional memory access from the first transfer memory. It will be then generates second image and / or audio data, which in each case represent an image that is defined by the first image and / or audio data (currently read out of the first transfer memory area). These second image and / or audio data are then forwarded to the completed computer arrangement for further processing, in particular display and / or storage.

The completed computer arrangement can be a single-user computer or a network to be secured with several computers or even partial networks, ie. H. also comprise a network of computer networks. This completed computer arrangement is "completed" in the sense that there is no physical connection between the closed computer arrangement and the open computer network except via the method according to the invention or with the device according to the invention.

Under an image is understood in the image data (which may also be moving image data) to be encoded in color values image content. For the coding different color schemes can be used. The audio data can be z. B. to act a digital image of the analog audio signal, z. B. in the form of amplitude values as a function of time. "Moving pictures" or "moving picture data" here are to be understood sequences of individual pictures, which can also represent a video data stream.

That is, in the method according to the invention, only the raw local images of the data are transmitted, and not the original data or part of the original data, as in the case of the above-described method described by K. Gennuso, for example. In other words, it is a method of transferring images of data, ie the images of the original rendered data and not the original data itself, between the open or insecure computer network, not by the first image and / or audio data itself, but based on it newly generated second image and / or audio data are used internally. Thus, no data subject to interpretation is passed, which must still be interpreted on the basis of metadata and therefore manipulated. bar and could be used for attacks on the completed computer arrangement, but only metadata-free media data. It is therefore a protocol-free memory access in which only a convention on the address of the transfer memory area is required, from which the hardware-based data copying unit can read the data.

A memory area, in particular transfer memory area, in the sense of the invention may also comprise a plurality of individual (partial) memory areas, which may also be assigned different data or functions, for example a memory area for the picture data and a further memory area for the audio data. These storage areas may also be arranged on different physical memories. The transfer memory area for the image data can be, for example, a video frame buffer of the computer connected to the open computer network, so that images, and / or moving image data in the form of individual images (frames) are stored there repeatedly, in particular cyclically at defined time intervals and be picked up by the data copying unit. For the audio data, an audioring memory may preferably be used as the transfer memory area. In this context, it should be noted that the unidirectional memory access to multiple physical and / or logical memory areas can be done.

In the context of the invention, a "hardware-based" data copying unit is understood to mean a data copying unit whose essential components, in particular also the definition of the addresses of the transfer memory area, are determined by hardware and which, in particular, are not determined by any software that comes via the open computer network If this data copying unit also contains software components at all, these are at most implemented by a separate access directly to the physical data copying unit, but particularly preferably there is no possibility of software manipulation, but the entire data copying unit is constructed only in the form of hardware , For example, by means of suitable ASICS, etc., where - if an adjustment of addresses in principle should be allowed - this example, by hardware switching banks or the like can be adjusted, which then z. B. are sealed or their setting can only be changed by specially authorized personnel.

A corresponding device according to the invention for the transmission of data between the open computer network and the closed computer arrangement has for this purpose an "external" computer unit which is designed to receive first picture and / or audio data from a computer of the open computer network In addition, this device has the said, preferably hardware-based, data copying unit Finally, the device comprises an "internal" computer unit, which is designed to store the data second image and / or audio data in the completed computer arrangement to pass. The terms "outer" and "inner" computer units are to be understood that the external computer unit is connected to the open computer network and thus ultimately forms part of this open computer network, whereas the internal computer unit just no connection except via the hardware-based Data Copy unit has to the open computer network, but instead is connected to the completed computer arrangement or is a part of this. In this sense, the terms "inside" or "internally" and "externally" or "externally" are also to be understood below.

Due to the read-only access of the, preferably hardware-based, data copying unit to a permanently defined memory area via the unidirectional memory access, the possibility that data subject to interpretation, for example malware, on the part of the open computer network without conscious intervention from inside the computer Arrangement, almost impossible. In particular, it is not possible to write from the side of the open computer network or the connected computer in the direction of the safe area. The activity of the computer, which is connected to the open computer network, ends with the filing of the image and / or audio data in the previously precisely reserved transfer memory area. Nevertheless, image and / or audio data stored in the open computer network, For example, on the Internet, made available to be viewed or listened to by a user of the completed computer arrangement without further personal effort. In particular, the use of a separate computer is not required, as would be the case with a complete Entnetzung between the open computer network and the completed computer arrangement.

Further, particularly advantageous embodiments and developments of the invention will become apparent from the dependent claims and the following description, wherein the claims of a particular category can be developed according to the dependent claims of another category and where features of different embodiments can be combined to form new embodiments. In the simplest case, to generate second image and / or audio data representing the desired local image defined by the first image and / or audio data currently stored in the first transfer memory area, in principle the first image or audio data, i. the rendered original data or their images, also be copied or copied directly. In order to achieve a particularly high level of security, it is possible for the image data within the hardware-based data copying unit to use a type of display and an image recording device, for example a camera, which displays the image displayed on the display, which is actually based on the current data Transferred storage area deposited image data, records and outputs the data generated as second image data again or stored in a further memory area. Similarly, the audio data could be outputted to a sound output device and recorded by means of a microphone or the like second audio data as an "image" of the first audio data, in which case the image data is transmitted purely optically and the audio data is transmitted acoustically.

The second image and / or audio data are particularly preferably generated on the basis of the first image and / or audio data with a method which is carried out independently by the data copying unit and is neither processed by the open computer system. Network is still completely controllable from the completed computer arrangement. In other words, the generation of the second image and / or audio data on the basis of the first image and / or audio data is not completely determinable or predictable from the outside. For example, the data may be changed slightly, but preferably so that in the image data this is optically not visible to a user and not audible with respect to the audio data, but on the other hand not the original bits of the first image and / or audio data are transmitted. In a particularly preferred variant, the second image and / or audio data are generated on the basis of the first image and / or audio data using random numbers. Most preferably, these are true random numbers, which in turn can be generated based on hardware, for example based on noise at a PN junction of a semiconductor or the like. When using a pseudo or quasi-random number generator, it is preferably ensured that it is restarted in relatively short time intervals with new start parameter values, whereby these start parameter values can be generated on the basis of a true random event so as not to cause any long quasi-randomization. or generate pseudo-random number chains which, with a correspondingly high outlay, could possibly be predictable again.

Even with the help of the random numbers, the change of the image and / or audio data preferably takes place so that they are below the markability threshold for the human eye (for the image data) or for the human ear (for the audio data), so that the image and / or audio data for the user apparently unadulterated transmitted.

In order to control an Internet application, for example a browser, keyboard inputs and / or inputs by means of a pointer arrangement, such as a mouse, are required by the user. In order to increase the security also with regard to the data stream of such input data or control data, input data from the closed computer arrangement are preferably provided. of an input device of a user interface, for example a simple input device such as a keyboard or mouse, copied from a first input memory of the completed computer arrangement in a connected to the open computer network second input memory area. The first and / or the second input memory area can also have several

(Partial) memory areas include, for example, a keypad memory, a mouse ring memory, etc. Again, at least the second input memory area, but preferably also the first input memory area are defined in advance precisely, ie. H. the address ranges are specified in advance.

The copying of the input data from the first input memory into the second input memory preferably takes place with the aid of a hardware-based data copying unit, particularly preferably with the data copying unit described above. This copying process is preferably also unidirectional, in which case it is only possible to write to the second input memory, which is in fact connected to the open computer network, ie no read access on the part of the open computer network to the first input memory is possible. In principle, there may also be the risk that employees uncontrolled transfer data from the unsafe area in the separated area or vice versa. Therefore, the data rate is very particularly preferably limited to a predetermined, preferably input device-dependent, safety limit value when copying the input data into the second input memory. This limitation provides for increased protection against attacks from the inside itself, ie by persons who have access to the closed computer arrangement, but want to create unauthorized data via the open computer network to the outside, for example, to spy on an organization. By means of a suitable safety limit, it can be ensured that maximally as much data per time is given out to the outside via this interface, as described, for example, in US Pat. B. are usually required to operate an Internet application. A transport of larger amounts of data is deliberately impeded in such a way that Data usage via this route is extremely unattractive or even completely impractical.

When using a keyboard as an input device, the security threshold is preferably selected so that no more than 10 keystrokes per second, more preferably no more than 5 keystrokes per second, can be transmitted. In the case of a mouse as input device, it is ensured that not more than 1000 actions per second, particularly preferably not more than 100 actions per second, for example mouse clicks or position updates or the like, can be transmitted or copied into the second input memory. Such a limitation is possible by e.g. the first input memory and / or the second input memory are dimensioned correspondingly small and / or the memory access frequency is lowered. In organizations where no internal attacks are to be feared, such data limitation can of course also be dispensed with. In particular, in such cases, it is also appropriate, a transfer of image and / or audio data from the completed computer arrangement, d. H. from the inside, to the open computer network, d. H. to the outside, to admit.

In this case, third image and / or audio data preferably originating from the completed computer arrangement can preferably be stored in a preferably also previously precisely reserved third transfer memory area within the closed area. The third image and / or audio data are read out again via a unidirectional memory access from the third transfer memory area by means of a preferably hardware-based, data copying unit, preferably the same hardware-based data copying unit which is also used for the first image and / or audio data. Corresponding fourth image and / or audio data are then generated, each representing a (local) image, which is defined by the third image and / or audio data currently being fetched from the third transfer memory area. The fourth image and / or audio data is then processed for further processing and / or storage in the open network via a unidirectional memory access in one again stored in advance precisely reserved fourth transfer memory area of a connected to the open computer network memory. Again, no read access from the outside is possible, but the data copy unit writes in this fourth specified transfer memory area. Likewise, the fourth image and / or audio data on the basis of the third image and / or audio data can preferably also be generated with a method that can not be controlled from the outside, particularly preferably with the aid of a random number generator.

In order to ensure the smoothest, delay-free transfer of the data, preferably the first image and / or audio data before depositing in the first transfer memory area and / or the second image and / or audio data prior to transfer to the closed computer arrangement cached. Preferably, the third image and / or audio data and the fourth image and / or audio data are also temporarily stored. The same is also preferable for the input data.

The first image and / or audio data can preferably be stored in the first transfer memory area using a remote access protocol (also abbreviated to FZP below) and / or the input data of the input device can preferably be retrieved from the second input memory area using a FZP. As a remote access protocol can preferably be used in Microsoft applications, an RDP protocol (Remote Desktop Protocol) and in Unix or MAC applications, an RFB protocol (Remote Frame Buffer Protocol).

For this purpose, the device according to the invention preferably comprises an external remote access protocol server with an interface for integration into the open or insecure computer network. This interface may be a standard WLAN or LAN interface or an interface via a mobile radio network or the like. For Internet applications, this remote access log server has an Internet application program such as a browser or the like. The external computer unit of the device according to the invention then additionally has a remote access protocol client to communicate with the Remote Access Log Server To exchange data according to the defined remote access protocol.

In this variant, therefore, a similar method is used as in the case of the BitBox mentioned above, but in this case the remote access protocol method is used only in the outer area and is supplemented in the direction of the closed computer arrangement by the method according to the invention using the data copying unit. In order to make the entire transmission as comfortable and "invisible" as possible for the user in the closed area, a remote access protocol is preferably also used on the secure, inner side, Preferably, the second image and / or audio data are made using a remote access protocol second, already located in the safe area transfer memory area of the completed computer arrangement passed and / or the inputs of the input area are stored using a remote access protocol in the first input memory area. Again, preferably an RFB protocol or an RDP protocol can be used.

The inventive apparatus preferably comprises an internal remote access protocol client having a user interface, such as a user's laptop or computer in the secure area, and the internal computer unit of the device comprises a remote access protocol server for communicating with the internal remote access protocol client data to replace the defined remote access protocol. Ultimately, both the non-secure outer side and the secure inner side are provided with remote access protocol servers and clients chained one after the other, with the remote access protocol server on the inner side with the remote access protocol client on the outer side Page is coupled via the data copier unit. More preferably, the device comprises a number of (ie, at least one) virtual remote access remote protocol servers on a computing device integrated with the open computer network. Particularly preferably, it is also possible to realize at least one of the outer remote access protocol servers virtually directly on the outer computer unit of the device. In this case, then no further downstream computer on the outer side is required, but the inventive device or the external computing unit of the device according to the invention can directly via the open computer network by means of a suitable network interface, such as a LAN connection, wireless LAN connection, Mobile network or the like, be coupled to the open computer network.

As already mentioned above, the method according to the invention and the device according to the invention should not only be available for use on single-user computers, but it should also be possible to securely connect closed-loop networks with several computer units, for example a company intranet According to the invention, it is particularly preferred for the device to have a plurality of virtual external remote access protocol servers on a computer device integrated in the open computer network, and to provide access to applications in the open computer network In addition, the external computer unit can correspondingly have a first transfer memory area with a multiplicity of individual (partial) memory areas for the picture and / or audio data of the different types en separately parallel running channels, wherein for each parallel channel in each case second image and / or audio data are to be generated as local images.

Incidentally, the virtual remote access protocol servers can otherwise be permanently set up, ie, a separate virtual FZP server with its own memory area is assigned to different users operating on the secure side within the computer device in the open computer network, so that the user has presettings there deposit for yourself and use again in a later session can. In another variant, each time a connection is established, the remote access log server is recreated, for example, with generally default settings. After completing the session, this FZP server is completely deleted again. This has the additional benefit of automatically destroying any malware received on the remote access log server after the session ends.

It is clear that real servers could be used instead of the virtual servers, but this involves higher hardware costs.

The internal computer unit can accordingly have a plurality of remote access protocol servers and the completed computer arrangement then indicates e.g. comprise a number of internal remote access protocol clients, each coupled to a user interface and each accessing a remote access protocol server of the internal processing unit, especially dedicated during a session.

Furthermore, there is also the possibility that the users from the secure area via the external FZP server download data from the open network in a specific area, but should have no direct physical connection to the completed computer arrangement. Only specially authorized persons, such as administrators with special certification, can collect data from this area, examine it for malicious software and then send it to the respective user via data carriers, for example.

The invention will be explained in more detail below with reference to the accompanying figures with reference to embodiments. The same or similar components are provided with identical reference numerals in the various figures. Show it:

FIG. 1 shows a schematic illustration of a first exemplary embodiment of a device according to the invention, FIG. 2 shows a schematic illustration of a second exemplary embodiment of a device according to the invention,

Figure 3 is a schematic representation of a third embodiment of a device according to the invention.

In the exemplary embodiments illustrated in the figures, it is assumed that the non-secure computer network 2 is one or more computers which are connected to the Internet 27 or are integrated in the latter and via which it is correspondingly possible As shown in Figure 1, there is a separation of the open, so potentially unsafe computer network 2 of the completed computer assembly 1 (in Figure 1 as the simplest example a Single-user computer 5, for example a laptop) with the aid of the device 50 according to the invention. In this case, a part of this device 50 is already part of the insecure computer network 2, whereas another part of the device 50 is already counted to the completed computer arrangement 1 could. The device 50 here consists of an external computer unit 7, which is integrated in the open computer network 2, an internal computer unit 9, which is connected in the closed computer arrangement 1 or connected to the laptop 5, and a hardware-based data copying unit 11 which enables the internal computer unit 9 to read or write to precisely defined storage areas of the external computer unit 7.

This hardware-based data copying unit 1 1 provides in the manner according to the invention for a data transport, without forming a true network connection in the conventional sense, but only a logless memory access for a well-defined mapping of data from certain memory areas of the external computer unit in memory areas of the internal processing unit and vice versa , All memory accesses are only unidirectional, wherein the memory areas in the outer computer unit 7 by the data copying unit incoming data only read-only or outgoing data only write-access. On the part of the external computer unit 7, no read or write access in the direction of the data copying unit 11 or the internal computer unit 9 is possible at all. As a result, the closed computer arrangement 1 (also referred to below more generally as "internal network" 1) is completely network-technically separated from the insecure computer network 2 (also referred to below as "external network" 2). The internal network 1 is under no circumstances directly accessible from the external network 2 and thus not vulnerable via the external network 2. In particular, there is also no hardware network path from the external network 2 to the internal network 1. Only images (in particular also of the web page content) can be transported unidirectionally between the outer computer unit 7 and the inner computer unit 9 by means of the data copying unit 11. The memory copies can only be performed by the internal computer unit 9. Thus, viewed from the external network 2, the memory areas from which the images for the internal network 1 are generated are true end stations.

In the embodiment shown in Figure 1 access to the Internet 27 by means of a computer 3, which is connected directly to the Internet, for example via LAN, WLAN or other network interface. This can, as will be explained later, also be a virtualized computer. This computer 3 is remotely controlled via a remote access protocol (FZP). For this purpose, an FZP server 4 is installed on the computer 3. On the outer computer unit 7, a matching FZP client 8 is installed.

Analogous to this, an FZP client 6 is installed in the internal network 1 on the computer 5 and an FZP server 10 is installed on the internal computer unit 9 of the device 50. Via the FZP client 6 of the computer 5 in the internal network 1, a client application 18 can be remotely controlled on the external computer 3 by means of the local FZP server, the device 50 according to the invention with the external computer unit 7 with the external FZP client 8 and the internal computer unit 9 with the internal FZP server 10 and the data copying unit 1 1 operating in the form of special hardware acting therebetween as a proxy for the FZP. is used. This proxy forwards the necessary for remote control FZP data streams, but at the same time ensures the separation according to the invention, so that no network data, but only secure images of the information, namely image and / or audio data or control information from input devices, such as the keyboard 5T or the mouse 5M, the computer 5 are transmitted.

Specifically, the necessary data exchange takes place as follows: In the main memory of the external computer unit 7 there is a precisely defined addressable memory area 13U for the audio data AD1 of the external computer 3. For example, these are taken from the audioring memory of the computer 3. Likewise located in the main memory of the outer computer unit 7 is a precisely defined memory area 16U for the image or moving image data VD1 which are taken over by the external computer 3 via the remote access protocol, for example from the frame buffer of the external computer 3. This first audio data AD1 and first video data VD1 in the sub-memory areas 13U, 16U are cyclically updated, as otherwise provided in accordance with the remote access protocol.

In order to transfer the audio contents or image contents, in particular the respective current image of the Internet browser, which are to be transmitted by these first audio data AD1 or image data VD1 into the internal network 1, the data from the data copying unit 11 are cyclically transferred from the memory areas 13U , 16U read out. This is a read-only access to the precisely predefined memory areas 13U, 16U. For this purpose, the data copying unit 1 1 has a reading unit for each of the storage areas 13U, 16U.

The read data is then fed to another unit, which could also be called an entropy unit, which adds variability to the data. That is, second audio data AD2 and second image data VD2, which are a relatively accurate local image of the first audio data AD1 and AD2, are generated from the incoming first audio data AD1 and first image data VD1 first image data are VD1, but are not completely identical to these. The added variability in the data is such that it is below the perceivable threshold for the user. This means that it is ensured, for example, in the image or moving image data that the image contrast or the color representation of the image does not change noticeably, or that the audio experience does not distort the audio experience, but nevertheless the individual bitstreams so far have changed, that any malware hidden in the image data or in the audio data can no longer be transferred. In order to make such manipulation of the data unpredictable, so that data modification can not already be considered in advance by adequately programmable malware, a random number generator 12 is preferably used for this, which generates random numbers, for example, from the noise of a PN junction of a semiconductor. These random numbers are then used in the algorithm for generating the second audio data AD2 and second image data VD2 on the basis of the first audio data AD1 and first image data VD1 from the entropy unit.

A modification of the data is shown in Figure 1 by the circles in the unidirectional memory access 20 (or memory access path 20). The generated slightly different second audio data AD2 and image data VD2 are stored in precisely predefined memory areas 13S, 16S in the main memory of the internal computer unit 9 and can be further processed there from the internal FZP server 10 implemented on the internal computer unit 9 or to the FZP Client 6 are routed to the computer 5 of the user and output there. Therefore, the user sees on his computer 5 a client application 22, as it corresponds to the client application 18 on the external computer 3, for example, the current image of the Internet browser.

The access of the data copying unit 1 1 to the memory areas 13U, 16U, 13S, 16S of the outer computer unit 7 and the inner computer unit 9 takes place as explained unidirectionally, ie only read in the direction of the outer computer unit 7 and in the direction of the inner computer unit 9 only. In particular, this access can also be implemented by means of DMA (Direct Memory Access) or RDMA (Remote Direct Memory Access), in order to achieve the highest possible diziness to realize. The data copying unit 1 1 is realized here as a pure hardware device. If an implementation using firmware is desired, this is also possible. In this case, however, the firmware should be through a separate physical access, such as a USB plug, that is completely separate from the other networks, so that a technician with an appropriate level of confidentiality can update the data copying unit 1 1 via this USB access or the like.

Control data or input data TD, MD from the keyboard 5T and the mouse 5M of the internal computer 5 are first transferred from the keyboard ring memory and mouse ring memory of the computer 5 in corresponding memory areas 14S, 15S in the main memory of the internal computer arrangement 9 by means of the remote access protocol. From there, it is then possible to copy these data TD, MD again via a unidirectional memory access 23 into corresponding memory areas 14U, 15U which have been defined in advance for this purpose in the main memory of the external computer unit 7. In this case, only one write access of the data copy unit 1 1 to these memory areas 14U, 15U of the outer computer unit 7 takes place. In the preferred variant, this copying takes place using a data rate limiter which ensures that the channel for the control data is not broadband Data channel can be used. Accordingly, the memory areas 14U, 15U are designed only limited. For example, it ensures that no more than 10 keystrokes per second are transmitted and no more than 1000 mouse actions, such as clicks or position updates. Incidentally, the memory areas 14S, 15S, 14U, 15U for this input data TD, MD but may be constructed as usual keyboard ring memory or mouse ring memory and from their respective FZP servers (on the internal processing unit 9) and FZP client 8 (on the outer Computer unit 7) as usual be driven. A transfer of larger amounts of data, such as secret software programs, CAD files etc. via these channels, would then take a long time and would ultimately not be practical. Unauthorized data transport to the outside with the help of unfair persons Those who work as users in the organization with the internal network are then almost completely prevented from doing so.

If such attacks are not to be feared with the help of internal persons, the data transmission of the input data or control data via keyboard, mouse or the like can also take place without such a data limitation. If such a data limitation for outgoing data from the internal network 1 into the external network 2 does not have to be taken into consideration, video data and / or audio data in particular can also be transmitted from the internal network 1 to the external network 2. For this purpose, the moving image data VD3 can be stored, for example, from a frame buffer or in a precisely defined memory area 25S in the main memory of the inner computer unit 9 and correspondingly can audio data AD3 be stored in an audioring memory or precisely defined memory area 24S of the main memory of the internal computer unit 9 , The data copier unit 1 1 then reads in these third audio data AD3 and third motion picture data VD3, respectively, and generates fourth audio data AD4 and fourth motion picture data VD4 thereon in a similar manner as described above for the path from the external network 2 to the internal network 1 is. These audio data AD4 and moving image data VD4 are written in correspondingly well-defined memory areas 24U, 25U in the main memory of the external computer unit 7, whereby again only a write access from the data copying unit 11 into the memory areas of the external computer unit 7 is possible and no access on the part of external computer unit 7 in the direction of the data copying unit 1 1 or in the direction of the internal network 1. Changes in the audio data AD3, AD4 or moving image data VD3, VD4, z. B. by random numbers, in this way are optional. In principle, a simple copying of the data may also be permitted in this way, unless it is to be feared that software in the image and / or audio data will be smuggled out of the internal network in encrypted form.

The outer FZP client 8 on the outer computer unit 7 transmits both the control data or input data from the memory 14U, 15U as well as possibly the audio data AD4 and / or moving image data VD4 to the external computer 3, see FIG that the data can then be further used within the application 18 on the external computer 3. Such a transfer of moving image and audio data to the external computer 3 would be useful, for example, if the user in the internal network 1 is to be allowed to perform a video conference or video call or the like over the Internet.

It is pointed out at this point that the memory areas 13S, 16S, 14S, 15S, 24S, 25S on the internal computer unit 9 are optional and, in principle, the data are also sent immediately to the internal computer 5 or to corresponding computers of an internal larger computer. Network can be forwarded. However, such memory areas are useful to speed up the entire process and to ensure a smooth process, without the user at the internal computer 5 ever noticed a delay. FIG. 2 shows a simplified representation of a variant of the device 50 according to the invention. In this case, the internal network 1 is represented symbolically as a composite of several computers.

Shown here is a variant in which the external computer 3 is realized as a virtual computer on the outer computer unit 7 within the device 50. This virtual computer 3 then has a corresponding FZP server 4, d. H. the whole operation is exactly as in the variant of Figure 1, but one less device is needed. The device 50 can thus be made available as a physical unit or box and simply interposed in the usual Internet connection between the internal network 1 and the Internet 27.

Another variant is shown in FIG. Here, instead of the normal computer 3 between the Internet 27 and the connection of the device 50 for the external network, a server 3 is connected, on which virtually several FZP servers 4 are realized. The device 50, ie both the external computer unit 7 and the internal computer unit 9 and the data copying unit 1 1, are designed so that several channels or sessions for the individual FZP devices Server 4 can be operated. In this way, several users of the internal network 1 with their computers can each access the FZP servers 4 assigned to them in the server 3 via the device 50 and use the Internet in the manner according to the invention. For configuring the parallel channels, only the internal and external computer units 9, 7 each have a corresponding number of (likewise virtual) FZP servers and FZP clients, and more memory areas for the audio data, video data, and input data of the various channels must correspond to the number of channels to be provided. Likewise, the data copying unit 1 1 must be designed so that it can operate several channels in parallel.

The FZP server 4 on the server 3 can be designed so that they are each newly created when a session is opened by a user of a computer in the internal network 1, and at the end of the session, this FZP server 4 is deleted again and thus destroyed all possible malware. Likewise, it is also possible to provide the users with their own FZP server 4 on the server 3, so that the users can deposit their profile data for the use of the Internet here, for example, preferred websites, etc.

It is finally pointed out once again that the devices described in detail above are only exemplary embodiments which can be modified by the person skilled in many different ways without departing from the scope of the invention. Furthermore, for the sake of completeness, it is also pointed out that the use of the indefinite articles "one, one" does not exclude that the characteristics in question can also be present several times There are even spatially separated subunits. LIST OF REFERENCE NUMBERS

1 completed computer arrangement / internal network

2 open computer network / external network

3 external computers

4 external FZP server

5 internal computer / laptop

5T keyboard

5M mouse

6 internal FZP client

7 external computer unit

8 outer FZP client

9 internal computer unit

10 inner FZP server

1 1 Data Copy Unit

12 random number generator

13U outer transfer storage area (for audio data) / storage area

13S inner memory area (for audio data)

14U outer transfer memory area (for keyboard events)

14S inner memory area (for keyboard events)

15U outer transfer storage area (for mouse events)

15S inner memory area (for mouse events)

16U outer transfer storage area (for image data) / storage area 16S inner storage area (for image data)

17 application program

18 client application

20 unidirectional memory access / memory access path

22 Image of the client application

23 unidirectional memory access / memory access path

24U outer transfer memory area (for audio data out)

24S inner memory area (for audio out)

25U outer transfer memory area (for image data out)

25S inner memory area (for image data out) 27 Internet

50 device

AD1 first audio data

VD1 first video data

AD2 second audio data VD2 second video data AD3 third audio data

VD3 third video data

AD4 fourth audio data

VD4 fourth video data

TD Input data of the keyboard MD Input data of the mouse

Claims

claims

1 . Method for transmitting data between an open computer network (2) and a closed computer arrangement (1), wherein

- First image and / or audio data (VD1, AD1) from a computer (3) of the open computer network (2) in a pre-precisely reserved first transfer memory area (16U, 13U) connected to the open computer network (2) Memory are deposited,

- The first image and / or audio data (VD1, AD1) by means of a, preferably hardware-based, data copying unit (1 1) via a unidirectional memory access (20) from the first transfer memory area (16U, 13U) are read and based on second image and or audio data (VD2, AD2) are generated, each representing an image defined by the first image and / or audio data (VD1, AD1),

- The second image and / or audio data (VD2, AD2) to the completed

Computer arrangement (1) are passed.

2. The method of claim 1, wherein the second image and / or audio data (VD2, AD2) are generated on the basis of the first image and / or audio data (VD1, AD1) with a non-externally controllable method.

3. The method of claim 1 or 2, wherein the second image and / or audio data (VD2, AD2) based on the first image and / or audio data (VD1, AD1) are generated using random numbers.

4. The method according to any one of the preceding claims, wherein of the completed computer arrangement (1) input data (TD, MD) of an input device (5T, 5M) of a user interface from a first input memory area (14S, 15S) of the completed computer arrangement (1) in a second input memory area (14U, 15U) connected to the open computer network (2) is copied, wherein the data rate is limited to a predetermined, preferably input device-dependent, safety limit value.

5. The method of claim 4, wherein the safety threshold is set so that at

a keyboard (5T) as input device (5T) not more than 10, preferably not more than 5, keystrokes per second

and or

a mouse (5M) as input device (5M) not more than 1000, preferably not more than 100, actions per second

into the second input memory (14U, 15U).

6. The method according to any one of the preceding claims, wherein

- From the completed computer arrangement (1) third image and / or audio data (VD3, AD3) in a third transfer memory area (25S, 24S) are deposited

- The third image and / or audio data (VD3, AD3) by means of a, preferably hardware-based, data copying unit (1 1) via a unidirectional memory access (26) from the third transfer memory area (25S, 24S) are read and based on fourth image and or audio data (VD4, AD4) are generated, each representing an image defined by the third image and / or audio data (VD3, AD3),

- The fourth image and / or audio data (VD4, AD4) are stored in a fourth transfer memory area (25U, 24U) connected to the open computer network (2) memory.

7. The method according to any one of the preceding claims, wherein the first image and / or audio data (VD1, AD1) before the deposit in the first transfer memory area (16U, 13U) and / or the second image and / or audio data (VD2, AD2 ) are cached before the transfer to the completed computer arrangement (2).

8. Method according to one of the preceding claims, wherein the first image and / or audio data (VD1, AD1) are stored in the first transfer memory area (16U, 13U) using a remote access protocol and / or the input output data (TD, MD) of the input device (5T, 5M) from the second input memory area (14U, 15U).

9. The method according to any one of the preceding claims, wherein the second image and / or audio data (VD2, AD2) using a remote access protocol from a second transfer memory area (16S, 13S) to the completed computer arrangement (1) are passed and / or the input data (TD, MD) of the input device (5T, 5M) are stored in the first input memory area (14S, 15S).

10. Device (50) for transmitting data between an open computer network (2) and a closed computer arrangement (1), with

- An external computer unit (7) which is adapted to first image and / or audio data (VD1, AD1) from a computer (3) of the open computer network (2) in a pre-precisely reserved first transfer memory area (16U, 13U ) to store on a memory connected in operation with the open computer network (2),

- One, preferably hardware-based, data copying unit (1 1), which is adapted to the first image and / or audio data (VD1, AD1) from the first transfer memory area via a unidirectional memory access (20)

(16U, 13U) and based thereon generating second image and / or audio data (VD2, AD2), each representing an image defined by the first image and / or audio data (VD1, AD1),

- An internal computer unit (9), which is adapted to the second image and / or audio data (VD2, AD2) in the completed computer arrangement

(1) to pass on.

1 1. Apparatus according to claim 10, comprising an external remote access protocol server (4) with an interface for integration into an open computer network (2), the external computer unit (7) having a remote access protocol client (8) to communicate with to the remote access log server (4) to exchange data according to a defined remote access protocol.

12. Device according to one of claims 10 to 1 1, comprising a number of virtual external remote access protocol servers (4) on a in the open computer network (2) integrated computing device (3).

13. The apparatus of claim 12, wherein at least one external remote access protocol server (4) is virtually implemented on the external computer unit (7).

14. Device according to one of claims 10 to 13, comprising an inner remote access protocol client (6), which in operation is coupled to a user interface (5T, 5M), wherein the inner computer unit (9) has a remote access protocol server (8). 10) to communicate with the inner remote access protocol client (6) according to a defined remote access protocol.

15. The apparatus of claim 14, comprising a plurality of internal remote access protocol clients (6) each coupled to a user interface (5T, 5M) and each to a, preferably during a session dedicated, remote access protocol server (10 ) of the computer unit (9).