EP3234853A1

EP3234853A1 - Method and device for securely storing data and for accessing said data

Info

Publication number: EP3234853A1
Application number: EP15813691.1A
Authority: EP
Inventors: Rainer Urian
Original assignee: Giesecke and Devrient Mobile Security GmbH
Current assignee: Giesecke and Devrient Mobile Security GmbH
Priority date: 2014-12-17
Filing date: 2015-12-14
Publication date: 2017-10-25
Also published as: DE102014018889A1; WO2016096117A1; US20170351867A1

Abstract

The invention relates to a method for securely storing data D on a terminal by means of a portable data carrier, wherein an attribute vector A and a master key MK are stored on the portable data carrier. The method comprises the following steps: deriving a key K from a predicate P and the master key MK by means of a key derivation function KDF, wherein the predicate P is a Boolean function of the attribute vector A; encrypting the data D by means of the key K; and storing the encrypted data D together with the predicate P on the terminal. The invention further relates to a method for accessing encrypted data D by means of a portable data carrier. The method comprises the following steps: extracting the predicate P from the encrypted data and the predicate P; applying the predicate P to the attribute vector A; and, if the attribute vector A fulfills the predicate P, deriving the key K from the predicate P and the master key MK by means of the key derivation function KDF and decrypting the encrypted data D.

Description

Method and apparatus for securely storing and accessing data

Field of the invention

The invention relates to the field of storing data and accessing these data. More particularly, the invention relates to a method and apparatus for securely storing and accessing data. Background of the invention

More and more data is available in digital form. These data must be stored, usually safe. The secure storage of data may be considered as an area of cryptography in which the plaintext, the data, is sent in encrypted form to the user at a point in the future.

In a secure environment, an access control mechanism can be readily implemented. In an insecure environment (e.g., in the cloud) this is no longer possible because the access control mechanism is no longer trustworthy.

Against this background, the object of the present invention is to provide improved methods and devices for the secure storage of data, in particular for the secure storage of data in unsafe environments.

Summary of the invention

The above objects are achieved by the subject-matter of the independent claims. Preferred embodiments are defined in the dependent claims. According to a first aspect of the invention, a method for securely storing data D by means of a portable data carrier is provided on a terminal, wherein an attribute vector A and a master key MK are stored on the portable data carrier. In this case, the method comprises the following steps: the derivation of a key K from a predicate P and the master key MK by means of a key derivation function KDF, the predicate P being a Boolean function of the attribute vector A; encrypting the data D with the key K; and storing the encrypted data D together with the predicate P on the terminal.

Preferably, the key K is destroyed after encrypting the data D with the key K. According to preferred embodiments of the invention, the master key MK is a global master key.

According to a second aspect of the invention, a method for accessing encrypted data D by means of a portable data carrier, which has been stored on a terminal by means of a method according to the first aspect of the invention, is provided. In this case, the method comprises the following steps: extracting the predicate P from the encrypted data and the predicate P; applying the predicate P to the attribute vector A; and if the attribute vector A satisfies the predicate P, deriving the key K from the predicate P and the master key MK by means of the key derivation function KDF and decrypting the encrypted data D. According to a third aspect of the invention, a method for the secure storage of data D by means of a portable data carrier is provided on a terminal, wherein a predicate P and a master key MK are stored on the portable data carrier. In this case, the method comprises the following steps: the derivation of a key K from an attribute vector A and the master key MK by means of a key derivation function KDF, the predicate P being a Boolean function of the attribute vector A; encrypting the data D with the key K; and storing the encrypted data D together with the attribute vector A on the terminal.

According to a fourth aspect of the invention, a method for accessing encrypted data D by means of a portable data carrier, which has been stored on a terminal by means of a method according to the third aspect of the invention, is provided. In this case, the method comprises the following steps: extracting the attribute vector A from the encrypted data D and the attribute vector A; applying the predicate P to the attribute vector A; and if the attribute vector A satisfies the predicate P, deriving the key K from the attribute vector A and the master key MK by means of the key derivation function KDF and decrypting the encrypted data D. According to a fifth aspect of the invention there is provided a portable data carrier adapted to store data D on a terminal according to a method of the first aspect of the invention or the third aspect of the invention or according to a method of the second aspect of the invention the fourth aspect of the invention to access data D on a terminal.

According to a sixth aspect of the invention, there is provided a terminal configured to store data D on the terminal according to a method according to the first aspect of the invention or according to the second aspect of the invention, or to store data D on the terminal according to Method according to the second aspect of the invention or the fourth aspect of the invention is accessed. Other features, advantages and objects of the invention will be apparent from the following detailed description of several embodiments and alternative embodiments. Reference is made to the drawings, in which: FIG. 1 shows a schematic representation of a portable data carrier according to the invention in communication with a terminal,

Figure 2 shows the steps of a method for storing data with the portable data carrier of Figure 1 according to a first preferred embodiment of the invention, and

Figure 3 shows the steps of a method for storing data with the portable data carrier of Figure 1 according to a second preferred embodiment of the invention. FIG. 1 shows a schematic representation of a preferred embodiment of a portable data carrier according to the invention in the form of a chip card 20 in communication with an external entity in the form of a terminal 10.

The portable data carrier in the form of a chip card 20 shown in FIG. 1 is designed to exchange data with the reader 10. As an exchange of data is here a signal transmission, a mutual control and in simple cases, a connection between the reader 10 and the smart card 20 understood. In information theory, a data exchange is characterized in particular by the transmitter-receiver model: data or information is encoded in characters and then transmitted by a transmitter via a transmission channel to a receiver. It is crucial that the sender and receiver use the same encoding so that the receiver can decode the data.

For data transmission or communication between the chip card 20 and the terminal 10, both the chip card 20 and the terminal 10 have suitable communication interfaces 22 and 12. For example, the interfaces 22 and 12 may be configured so that the communication between them or between the smart card 20 and the reader 10 is contactless, i. via the air interface, as indicated in Figure 1 by the jagged arrow. Alternatively, the smart card 20 may be galvanically, i. contact, be connected to the interface 12 of the terminal 10. In this case, the interface 22 is generally designed as a contact field arranged on one side of the chip card 20 with contact surfaces for data exchange with the terminal 10.

Of course, the present invention also includes portable data carriers in the form of smart cards, both an interface to the contact as well as an interface for contactless communication with a terminal and which are known in the art as dual-interface smart cards. In addition to the interface 22 for communication with the terminal 10, the chip card 20 comprises a central processor or computing unit (CPU, also called a processor) 21 which is in communication with the interface 22. As is known, among the primary tasks of the processor 21 are the execution of arithmetic and logic functions and the reading and writing of data elements, as defined by a software application running on the processor 21. The processor 21 is further connected to a volatile random access memory (RAM) 23 and a non-volatile rewritable memory 24 (referred to in Figure 1 as "NVM" (non-volatile memory)). Preferably, the nonvolatile memory 24 is a flash memory (flash EEPROM). This may be, for example, a flash memory with a NAND or a NOR architecture. Besides a rewritable portion, the nonvolatile memory 24 may further comprise a ROM.

In the preferred embodiment shown in Figure 1 is stored in the non-volatile memory 24 of the smart card 20 program code that can be executed by the processor 21. In particular, program code may be implemented in the nonvolatile memory 24 of the smart card 20, by which the smart card 20 is configured to perform the inventive method for storing data on the terminal 10 described below in connection with FIGS. 2 and 3. For example, the terminal 10 may be a cloud server act that is designed to be stored on this data.

FIG. 2 shows a first preferred embodiment for storing data with the portable data carrier 20 on the terminal 10 or a background system in communication therewith.

Step S1 of FIG. 1 relates to the personalization of the portable data carrier 20, which is generally carried out as part of the production of the portable data carrier 20 by the manufacturer or subsequently by the publisher of the portable data carrier 20. According to step Sl of FIG. 2, an attribute vector A, a master key MK and a key derivation function KDF ("key derivation function") are stored on the portable data carrier 20 during personalization. The attribute vector A preferably consists of at least, but usually of several components, each defining a particular property (i.e., an attribute) of the user of the portable volume 20. Attributes of this type include age, gender, height, weight, security status, rank, department, and the like. The master key MK is preferably a global master key, that is to say a master key, which is stored on a plurality of portable data carriers, such as the portable data carrier 20.

According to the invention, the data carrier 20 personalized according to step S 1 of FIG. 2 can be used to securely store data D on the terminal 10 or a background system in communication therewith. For this purpose, a predicate P is provided by the terminal 10 in step S2 of FIG. From the Masterkey MK and the predicate is preferably in the secure environment, by the portable disk 20, a key K is derived by means of the key derivation function KDF. As will be described in more detail below, the predicate is a function that has the attribute vector A as its argument and provides the value 0 or 1 as the function value, ie, a Boolean function that is applied to the attribute vector A. By way of example, if a component of the attribute vector A is the user's age, a query implemented in the predicate P could be whether the owner is already 18 years old and is answered by predicate with 0 or 1. In practice, a predicate P could be stored as a bit string, for example by means of TLV coding. Preferably, the predicate can be selected by the user of the portable data carrier 20. As will be described in detail below, by choosing a suitable predicate P, the user of the portable volume 20 may determine which persons (ie, which group of persons designated by the attribute vector A) have access to the data D.

In step S3 of FIG. 2, the data D is encrypted with the key K and the encrypted data ENC (D, K) is stored together with the predicate P on the terminal 10 (or a background system in communication therewith). Preferably, after encryption with the key K, this key is deleted again. According to the invention, the encryption can be carried out both by the portable data carrier 20 and the terminal 10. For common storage of the encrypted data ENC (D, K) with the predicate P, these can preferably be concatenated with each other, which is indicated in Figure 2 by the symbol "||". After the data D have been securely stored in steps S2 and S3 of FIG. 2, according to the invention, these can be accessed again by means of steps S4 and S5 of FIG. In step S4 of FIG. 2, the predicate P is extracted from the data packet stored on the terminal 10 in step S3, which consists of the encrypted data ENC (D, K) and the predicate P. Subsequently, the predicate P thus extracted is applied to the attribute vector A, which is stored on the portable data carrier 20. As already described above, the predicate P is a Boolean function which, with the attribute vector A, can yield two function values as an argument, preferably 0 or 1. Preferably, P (A) = 0 means that the attribute vector A is the predicate P does not satisfy, whereas P (A) = 1 means that the attribute vector A satisfies the predicate P.

According to the invention, it is now provided in step S5 of FIG. 2 that, if the attribute vector A does not satisfy the predicate P (ie in the above example P (A) = 0), access to the data D is denied. Only if the attribute vector A satisfies the predicate P (ie in the above example P (A) = 1) is the key K derived from the master key MK stored on the portable data carrier 20 and the predicate P by means of the key derivation function KDF. Since this key is derived in step S2 of Figure 2 and has been used to encrypt the data D, the data D can be decrypted with this key again in step S5, whereby the user of the portable data carrier 20 again has access to the data D. (or a user of another portable volume whose attribute vector A 'also satisfies the predicate P and which has the same global masterkey MK). FIG. 3 shows a second preferred embodiment of the invention for storing data with the portable data carrier 20 on the terminal 10 or a background system in communication therewith. The second preferred embodiment of Figure 3 differs from the first preferred embodiment of Figure 2 essentially in that in the second preferred embodiment, the roles of the predicate P and the attribute vector A are interchanged. In this case, in step S3 'of FIG. 3, as shown, preferably the attribute vector A or alternatively the predicate P can be used to derive the key K (as well as in the corresponding derivation in step S5' of FIG. 3). Since there are no further differences between the second preferred embodiment shown in FIG. 3 and the first preferred embodiment shown in FIG. 2 except for the interchange of the roles of the predicate P and the attribute vector A, reference may be made to the above description of the steps S 1 to S 5.

Claims

claims

A method for securely storing data D by means of a portable data carrier (20) on a terminal (10), wherein an attribute vector A and a master key MK are stored on the portable data carrier (20), the method comprising the following steps:

deriving a key K from a predicate P and the master key MK by means of a key derivation function KDF, the predicate P being a Boolean function of the attribute vector A;

encrypting the data D with the key K; and

storing the encrypted data D together with the predicate P on the terminal (10).

2. The method of claim 1, wherein after encrypting the data D with the key K, the key K is destroyed.

3. The method of claim 1 or 2, wherein it is the master key MK is a global master key.

A method of accessing, by means of a portable data carrier (20), encrypted data D stored on a terminal (10) by a method according to claim 1, 2 or 3, the method comprising the steps of:

extracting the predicate P from the encrypted data and the predicate P;

applying the predicate P to the attribute vector A; and if the attribute vector A satisfies the predicate P, deriving the key K from the predicate P and the master key MK by means of the keywords self-routing function KDF and decrypting the encrypted data D.

5. A method for the secure storage of data D by means of a portable data carrier (20) on a terminal (10), wherein on the portable data carrier (20) a predicate P and a master key MK are deposited, the method comprising the following steps :

deriving a key K from an attribute vector A and the master key MK by means of a key derivation function KDF, the predicate P being a Boolean function of the attribute vector A;

encrypting the data D with the key K; and

storing the encrypted data D together with the attribute vector A on the terminal (10).

6. The method of claim 5, wherein after encrypting the data D with the key K, the key K is destroyed.

7. The method of claim 5 or 6, wherein it is the master key MK is a global master key.

A method of accessing, by means of a portable data carrier (20), encrypted data D stored on a terminal (10) by a method according to claim 5, 6 or 7, the method comprising the steps of:

extracting the attribute vector A from the encrypted data

D and the attribute vector A;

applying the predicate P to the attribute vector A; and if the attribute vector A satisfies the predicate P, deriving the key K from the attribute vector A and the master key MK by means of the Key derivation function KDF and decrypting the encrypted data D.

A portable data carrier configured to store data D on a terminal in accordance with a method of any of claims 1 to 3 or 5 to 7 or to data D according to a method of claim 5 or 8 to access a terminal (10).

A terminal (10) adapted to receive data D according to a method of any one of claims 1 to 3 or 5 to 7 on the terminal

(10) or that data D is accessed on the terminal (10) according to a method of claim 5 or 8.