EP3469778A1

EP3469778A1 - Memory device, data transmission device, and method for transmitting data

Info

Publication number: EP3469778A1
Application number: EP17735058.4A
Authority: EP
Inventors: Rainer Falk; Steffen Fries; Martin Wimmer
Original assignee: Siemens Mobility GmbH
Current assignee: Siemens Mobility GmbH
Priority date: 2016-07-19
Filing date: 2017-06-27
Publication date: 2019-04-17
Also published as: CN109565502A; US20210286906A1; WO2018015111A1; DE102016213164A1

Abstract

The invention relates to a memory device (30) for transmitting data between at least two computer devices, which are assigned to different network zones (40, 45), which memory device contains at least one memory unit (37) for storing data, at least two interfaces (31, 32) which lead towards the exterior and to which a respective one of the external computer devices can be connected for reading and/or writing data, and at least one control unit (36) which is designed in such a way as to establish access rights to the data of the memory unit (37) as a function of at least two of interfaces (31, 32) which lead towards the exterior. Thus, for example a data transmission can be established exclusively from a first computer device to a second computer device.

Description

description

Storage device, data transfer device and method for transferring data

The invention relates to a memory device, a data transmission device and a method for transmitting data between at least two computing devices which are assigned to different network zones.

In specific areas, such as government communications, where security requirements are high and where there is a security classification of documents and information, so-called cross-domain solutions are known, through which an automated and secure exchange of documents and messages, such as e-mails , are implemented between security zones with different degrees of security. For the coupling of industrial control networks, such as automation networks, with an office network, the public Internet or other control networks so far conventional firewalls are used, which filter the Da ^¬ tenkommunikation. Data communication is permitted or blocked depending on the address of the communication partner and the communication protocol used. It is also common to have a network connection through an application proxy server that terminates the TCP connection.

In WO 2012/170485, a cross-domain security solution based on a virtualization solution is realized in which a virtual machine controls an information transfer between two information domains with different security levels.

EP 2981926 discloses a data-validating dual-port memory in which data is stored on a first port. On a second port of a dual-port memory device, the data is only visible after the data content has been successfully validated. Furthermore, semiconductor drives, so-called SSD

Hard disks known to have two interfaces. These hard drives are designed for high-availability applications where two redundant computers access the same hard drive.

Furthermore, data locks are known as security gateways for the transmission of data between different classified security zones and the exchange between physically separate networks. This is made possible by the use of an intermediate memory, so that two interfaces of the data lock are only activated mutually. This ensures that a direct connection between the different networks is never established. For the exchange of data between an office network and a

Control network with complex solutions zwischenge ^¬ switched firewalls or virtualization solutions are not practical when a real-time communication within the control network by a data transfer should not be delayed. Furthermore, should a non-reactive data transfer ^¬ be guaranteed, that is, it should by the data transfer any new or changed data in the network are read from the data are introduced.

It is thus the object of the present invention to provide an easily implementable and easily applicable solution for feedback-free data transmission between networks with different security requirements or generally between two network zones.

The object is achieved by the measures described in the independent claims. In the subclaims are advantageous developments of the memory device according to the invention shown.

The memory device according to the invention for transmitting data between at least two computing devices, different network zones are assigned includes at least a memory unit for storing data, Minim ^¬ least two externally leading interfaces, to each of which one of the external computing devices for reading and / or writing Data is connectable, and at least one

Control unit, which is designed to set access rights to the data of the memory unit depending on at least two of the externally leading interfaces. This makes it possible that data from each of at least two exter ^¬ NEN computing devices can be written to the memory device or read or both written or read. By the control unit access rights of each interface to the data of the memory unit can be set up and enforced. Thus, for example, a data transmission can be set up exclusively by a first computing device to a second computing device by the first computing device having a first computing device

Interface and the second computing device with the second external interface of the memory device is connected and as access rights for the first external ^{Schnittle ¬} le only write access and for the second external interface exclusively reading access to the data of the memory unit is set up in the control device. In order for a feedback-free transmission ^{sicherge ¬} provides. The access rights are also simply structured and easy to set up.

In particular, the computing devices are stand-alone devices separate from the memory device. Interface-dependent access rights are, for example, an authorization for read access or

Write access or read and write access from the computation Device on data of the storage device over the considered to external leading interface. The Rechenvor ^¬ direction is about one of the leading externally

Interfaces connected to the storage device. In this case, only read access, only write, or read and write access via the interface under consideration can be released to the memory unit. There may be different read-write permissions at the at least two interfaces of the memory device. The term "external interface" is used synonymously with "an externally leading interface". Similarly, the term "port" is used synonymously as "interface".

In an advantageous embodiment, the memory unit is configured to store data in different data structures and the control unit is ^{configured in} such a way to set up access rights for such a data structure depending on the interface. Data structures are, for example, a partition, a directory or a file. In each of these data structures, for example, a varying amount of data can be stored. Access to data via the respective interface can thus be set up granularly on the corresponding data structure. Thus may be different set up to ^¬ access rights for different data structures. For example, since ^¬ th of a given partition can be transmitted only from a first external interface to the second external interface, whereas only written to a second partition data from the second interface and is read out via the first interface, and thus a data transfer in the reverse direction possible is. It is likewise possible to set up a read and a write access to one of the data structures merely from a first interface and not to access the data structure via the second interface. so that the storage device can also be used for "storage of data.

In an advantageous embodiment, the access rights are enforced by an interface-dependent authorization ^information in a file system of the memory device.

This has the advantage that access rights are easier and faster changeable compared to a direct enforcement of the access rights to the interfaces.

In an advantageous embodiment, the access rights are enforced by a configuration of the external interfaces themselves.

For example, in a configuration of the external interfaces of the memory device, an interface is configured as a read-only interface. Thus, a different type of transmission can be excluded with very high probability ^¬ . Control of the access rights by additional queries in, for example, the control unit is no longer necessary after such a configuration. Thus, such enforced access rights very reliable overall genüber absence of feedback and transmission security, so as ^¬ very quickly in terms of transmission reliability.

In an advantageous embodiment, the access rights are formed by short-circuit bridges or by DIP switches.

As a result, one-way communication with high reliability can be realized. For enforcing access rights by a Kombina ^¬ tion of configurations of interfaces and authorization information in a file system attributes to a file structure, stored on a file system checked on access to the file structure. Thus, authorization information such as read-only or read-only or read-write permissions by the first port and read-only or read-only or read-write permissions may be given to a particular file structure be assigned to the second external port. Authorization information can also be extended by further attributes which are linked to the different read and / or write authorizations.

In an advantageous embodiment, separate data structures are designed for different access rights or different access rights can be configured for a single data structure.

Separate data structures for different access rights, for example, have a faulty is minimized to ^¬ drew on data the advantage. A data structure which is read-only for a first interface, for example, or a data structure which is only capable of writing with respect to the second interface does not contain any data which is from the first

Interface were written. Access different ^¬ right for a single data structure have the advantage that can be used to optimize at a transfer of a large amount of data of comparable-availability storage, since no separate data structure, and thus, for example, a fixed data capacity for example, other communications ^¬ direction is reserved. In an advantageous embodiment, separate data structures are formed for different access rights or different access rights are for a single Since ^¬ ten-structure formed. Administrative data are, for example, information as to when a file was written to a data structure or the information that the file is ready for collection. Further administrative data is for example information, that lying ready file was read and can therefore play as deleted when ^¬ again by the adjustment ends. Furthermore, as administration data, information about errors that have occurred can be stored, for example when reading the data. If these management data stored in a separate data structure, so accidental Übertra ^¬ supply of such management data is minimized instead of user data. In an advantageous embodiment, the control unit checks the data before passing it to an external interface of ^¬ le to a test specification.

In particular, checking the data by means of checksums for correct transmission or integrity checking can be done in the

Control unit are made. This is particularly useful ^¬ fully when one of the external interfaces is connected to a zone may occur in the potential malware. In this case, the control unit can be used to check the data in the respective data structures before the access is released by the other interface.

In an advantageous embodiment, a first control unit checks the data arriving at an interface against input rules, and a second control unit checks the data output at an interface against outgoing rules. The said input or output rules are often referred to as access policy for the first and second external interface.

In an advantageous embodiment, in addition to a read and / or write authorization, an access right can be set up in the control unit as a function of a role of the reading or writing external computing device. This has the advantage that the access right of a Rechenvor ^¬ direction which is connected to a first externally leading port can be designed differently depending on the role of the computing device.

In an advantageous embodiment, an access right can be set up and / or checked in the control device as a function of an information path of the data written to the memory unit or of data read out of the memory unit.

An information path is defined as a number of Informati ^¬ ones that specify, for example, components of the computing device, the data on which the data before ben Scream have passed through the storage device. These are, for example, information about the user of the data. For example, data used to boot hardware may be marked as such. Entspre ^¬ accordingly, data relating, for example, the operating system egg ner computing device, be labeled as such or data for an application to be identified as such and be included as information in the information path. Furthermore, an identifier of the computing device or, for example, an identifier of the external interface via which the data is read into the memory device are contained in the information path. In the control unit, an access right to an external interface is established depending on the specified information. Upon access of a computing device via an external interface of the memory device, an information path, that is to say the information mentioned, is read into the memory device and checked by the control unit with respect to the access rights and assigned resulting rights. This makes it possible to control access rights very flexibly and depending on different properties or boundary conditions.

In an advantageous embodiment, the storage device is used as a mass storage device, in particular as a semiconductor storage device. SSD, designed as magnetic disk storage HDD, as a redundant arrangement of independent storage disks RAID or directly connected storage DAS. By using, for example, commercially Products Available ^¬ ren dual-port solid-state drives, a memory device according to the invention can be provided inexpensively and with only minimal modification effort.

Furthermore, the use of a storage device having the described characteristics is claimed as a data transfer device, often referred to as a data gateway, for transferring data between different zones of a network. The invention includes Datenübertra ^¬ constriction device for transferring data between different network zones

at least two computing devices, each associated with different network zones, and

a memory device with at least two externally leading interfaces,

wherein the at least two computing devices under ^¬ possible according externally leading interface of the memory device are connected, and

the memory device is configured to set up access rights to data of the memory device depending on the accessing interface.

The inventive method for transmitting data between at least two computing devices that are associated with different chen network zones, wherein a first rake ^¬ device having a first externally leading interface of a storage device is connected, and a second computing device with a direction different from the first second to external leading interface of the memory device is connected, has the following Verfahrensschrit ^¬ te on:

Establishment of interface-dependent access rights to the data of the storage device as a function of the min. at least two of the externally leading interfaces of the memory device,

Writing data from an external computing device via a first to externally leading interface of the memory device as a function of the established access rights for the first external leading interface,

- Reading data by a second computing device via a second external leading interface depending on the established access rights for the second external leading interface.

By the method of access interfaces dependent ^¬ right to a memory device can be set up with at least two ex ternal ^¬ interfaces and one below or for data read to be applied. Thereby, such a storage device becomes usable for transferring data between zones of different security relevance of a network. In an advantageous embodiment, the access rights are additionally dependent on an information path is directed ^¬ and the information about the path is provided by external lead ^¬ de interface. In particular, the information path in addition at least one of the following arrival gave on an indication of the role of computing devices, an indication of the type of data source or data sink in the rake ^¬ device and an identifier of the data sink or data source.

Through this additional information in the information path access rights can be very flexible designed and set ^¬ the. This is not an exhaustive list of information that an informational path may contain. Other obvious details about the data source or data sink or about the path traversed by the data are included in the scope of protection. An indication of the role of the data source is in ^¬ play, the use of the computing device as a service terminal. Information about the type of data source can be, for example, whether it is hardware, software or application software. related data. This can also be specified in the form of an at ^¬ tation by a trusted module (Trusted Platform Module, TPM). An identifier of the data sink or data source can be, for example, a processor identifier or an EPID (Enhanced Privacy Identity).

Authentication or an interface identifier of a storage device in the computing device act.

There is further claimed a computer program product directly loadable into a memory of a programmable memory device, comprising computer code parts adapted to perform the steps of the method as described. It also claims a volume that stores the computer program product.

Embodiments of the inventive method and the storage device according to the invention and the use of the storage device as a data transmission device are exemplified in the drawings and are explained in more detail with reference to the following description. Show it:

Figure 1 shows an embodiment of the method according to the invention as a flowchart; Figure 2 shows an embodiment of the inventive method with a transfer path information to a first embodiment of an inventive ^¬ SEN storage device in a schematic representation;

FIG. 3 shows an exemplary embodiment of a data transmission device according to the invention in an exemplary application scenario in a schematic representation; 4 shows a first embodiment of an inventive ^¬ SEN memory device in block form; 5 shows a second embodiment of a erfindungsge ^¬ MAESSEN memory device having a test method in a block diagram; and

6 shows a third embodiment of a erfindungsge ^¬ MAESSEN memory device with checking of data with respect to input and output rules.

Corresponding parts are provided in all figures with the same reference numerals and have, if not deviating described, the same configuration.

Figure 1 shows the inventive method in a schematic representation. In the initial state 10 there is a memory device with at least two external interfaces for reading and / or writing data. Each of the interfaces is connected to a directly connectable external computing device that acts as a data sink or data source, ver ^¬ prevented. The two computing devices can act as lock computers. The first computing device is connected, for example, to a safety-critical zone of a network. The second computing device or the second

Lock computer is connected to a second zone of the network, which has lower security requirements, for example. The storage device assumes the function of a data lock in the described method.

For this purpose, in method step 11, interface-dependent access rights to the data of the memory device are established based on at least one information path. The information path contains at least one indication of the external interface of the storage device used. In the simplest case, for example, for the first

Interface only a write access to the data of the memory device, for the second external interface le ^¬ diglich read access to the data of the memory device are set up. Thus, a data transfer from the first interface to the second interface or from the with the first interface directly connected first computing device to the second computing device, which is connected to the second external interface of the memory device take place. But it can be to handle ^¬ quite set up for each external interface both be read and be written. In particular, the SpeI ^¬ chervorrichtung may contain several different data structures and access rights for each of these data structures are set up dependent interface.

For example, separate data structures may be designed for different access rights. For example, a data structure can only be set up for a data transfer in one direction, and another data structure for data transfer in the opposite direction. As a result, an asynchronous treatment of the forward direction of the memory device is achieved. A data structure can be a partition, a directory, or a file. Depending on the configuration of the port-specific access rights, a one-way communication or a network separation can be realized with the memory device. Already a network separation can prevent the spread of network-based attacks. However, it is also possible for a data structure to be designed for different access rights, so that a data structure can be used for data exchange in both directions. Alternatively, a data structure can only have access rights for a transmission direction.

It is also possible to design data structures which store only administration data or merely user data. Furthermore, test regulations can be checked by a control unit of the storage device. Only with a positive test result, the data transmission is performed according to the ^¬ to access rights. In particular, the interface of ^¬ len-dependent access rights can be set up depending on further information, particularly an information path. Such information of an information path is the role of the data source or the data sink, information on the type of data source, the type of data transmitted itself and a Ken ^¬ tion of the data sink or data source. Setting up the access rights can be carried out during the commissioning of a Speichervorrich ^¬ tung. Access rights can be changed or deleted and new access rights can be added. This can be ^¬ limited to certain modes of operation of the storage device or be possible during operation.

When reading in data, see method step 12, from an external computing device via an external interface, the established access rights for these

Interface checked. In addition to the interface, which provides the data, the data itself and the information ^¬ path of the memory device can be provided. The access rights for the assigned data are selected based on this information. The data is now written to the storage device according to the determined access rights. In process step 13 are prior to the reading of data on a second external interface to a second ^¬ ex ternal computing device the access rights of the second

Interface checked on the storage device. Here, too, path information for the read-out data sink can be checked. The data sink is here the second computing device or an application set up in the second computing device. With a positive test result, the second rake ^¬ device reads the data. Thus, data can be forwarded in a controlled manner via the storage device between two network zones. Thus the path-based data transmission ^¬ completed by the storage device, see state 14th

Figure 2 shows the process step 12, that is, the Einle ^¬ out data in a memory device 30 using a path information 20. The storage device 30 includes a first external interface 31 and a second external interface 32. The storage device 30 includes a storage unit 37 made up of two logical data structures 34 and 35. The access rights 33 in a control unit 36 are set as ^¬ in such a way that is allowed from the first interface 31, a write access to the data structure of the 34th On the other hand, the data readout 35 can be accessed via the first external interface 31 in a read-only manner. The access rights for the second interface 32 are set up in the illustrated example such that only a read access to the data structure 34 is permitted and a write access to the data structure 35 is possible.

Together with the data to be transmitted 21, an information path 20 ^¬ provides to the first external interface 31 bereitge. The control unit 36 is now checked against the access rights information in the information path 33, 20 and SpeI ^¬ chert the provided data corresponding to the determined access rights. If a read access is requested via a second external interface 32, the access rights of the second external interface 32 to the data are checked on the basis of the established access rights. Again, you can

Path information provided by the second computing device and taken into account in the examination of access rights. If the read access is permitted, the data is output via the second interface 32. The data are thus forwarded from a first computing device to a second computing device.

In addition to the information about which external interface the data is read in, the information path 20 includes, for example, information on the role R, on the type T or also an identification ID of the data source.

Figure 3 illustrates an application scenario of the described storage device 30 and a data transfer device 48. A first zone 40 of a data network is for example a game ^¬ automation network. Therein, components 41, 42, 43, for example field devices, are connected. Such a first network zone 40 usually has particularly high levels Requirements with respect to data security, in particular, when used as a backup system, for example, the train control ^¬ or Zugsignalsteuerung or even in power plants. Such a first network zone 40 is usually formed as a closed network and a data transfer from a less secure second network zone 45 into the first network zone 40 or the transmission of data from the first network zone into the second network zone 45 is only possible under strict conditions. This requires in particular be ensured in data transmission from the first zone 40 in the second zone 45 that no Since ^¬ th from the second zone are introduced into the first zone 45 or changed data from the first zone 40 and back into the first zone 40 be transmitted. In particular, for the evaluation of diagnostic data of the components of the first network zone 40, a simple possibility for discharging data into a second network zone 45 is interesting.

The memory device 30 serves as a data lock and forms together with two computing devices 44, 47 as a lock computer, a data transmission device 48, which is also referred to as a data gateway.

The memory device 30 according to the invention is illustrated here in simplified form and corresponds to the memory device 30 shown in detail in FIG. 4. It comprises a first external interface 31 to which a first computing device 44 of the first network zone is connected. In this case, an interface is referred to as an external interface, via which data can be read into the data ^loop from outside the data ^lock or data can be read from the data lock to the outside into a connected computing device. A second external interface 32 of the SpeI ^¬ chervorrichtung 30 is now connected to the second network zone 45, for example, a computing device 47th Through the first and second interface 31, 32, respectively, supplied ^¬ resorted to, since ^¬ th, which are stored on a storage unit 37 may be. By the memory device 30 in the formed access rights for the first and second ^{interface ¬} not only a network separation, but also a controlled data exchange between the first zone 40 and the second zone 45 is possible. If, for example, only one write access to the memory unit 37 is set up for the first interface 31, then data can be written to the memory unit 37 from the first network zone 40. If only one le ^¬ sender access to the memory unit 37 granted for the second interface 32, for example, a diagnostic computer 46, which is connected via an office network with the second interface 32, read diagnostic data in the second zone 45.

Thus, no open data channel is used for data exchange, but the data transmission is made possible by an intermediate storage of the data in the memory device and the interface-dependent access rights to the memory unit. The storage device 30 is operated in each case with a lock computer, which is connected in each case to one of the external interfaces 31, 32 of the storage device. Both lock computers 44, 47 have access to a common file system that is physically mapped in the storage unit 37 of the storage device. A lock calculator 44, which is connected to the interface 31 may, for example, query and diagnostic data from the field devices 41, 42, 43 save it as a file on the storage unit 37 of the memory device ^¬. There the file of a

Lock computer 47, which is connected to the second interface 32, are read out and transmitted, for example via Internet 45 to a cloud service 46 for evaluation. Likewise, in the opposite direction, for example, a firmware update of the second zone 45 in the automation network 40 are transmitted in a controlled manner. Within the memory device 30 may now ^¬ represents sicherge via a control unit 36 is that the storage units or on the storage Chere unit configured data structures 34, 35, only je ^¬ Weils from one direction are readable or writable.

In FIG. 4, the memory device 30 is shown enlarged. A control unit 36 controls the access rights of the first or second interface 31, 32 to the data or the data structures 34, 35. The control unit 36 monitors the access rights defined for the interfaces 31 and 32, which are shown here schematically as a unit 33 are shown. However, the access rights can also be configured via short ^¬ bridge, also known as jumpers, or as a DIP switch. Thus, the access right is enforced physically. However, the access rights can also be specified by a file system which is set up in a complex control unit of the storage device or in the connected computing devices 44, 47. Here, in the file system data structures such as a partition or a directory or a file read and write permissions for an output to the interface of storage are given chervorrichtung 30, monitored and thus Runaway sets ^¬. In addition, areas for management data 38, 39 may be formed in the storage unit 37.

The memory device 50 in FIG. 5 shows a further embodiment with two interfaces 31, 32, two data structures 34, 35 and a control unit 51. The control unit 51 additionally includes a test function 52, which respectively stores data before reading in and out The data is checked against a test specification by a computing device connected to the interface 31 or 32. This is particularly useful if one of the interfaces is connected to a network zone, can occur in potentially malicious code or Manipu ^¬ lation. In this case, the control unit 51 can be used to check the data in the respective data structures before the access is enabled by the other side. As a test specification for ^¬ a checksum of the data can play as evaluated or the compared to the current checksum formed.

A computing device connected to the interface 31, 32 may validate a file after reading, for example, perform a format check before the computing device accepts the file. Via a network interface, data can be loaded from or to the computing device in the respective network zone.

FIG. 6 shows a memory device 60 in which two control units 61, 63 are formed as an alternative implementation ^variant , each of which converts an input or output rule 62, 64, also called access policy. An access to the memory unit or the data structures is only possible via the control unit if access is allowed entspre ^¬ accordingly the respective input and output rules. A control unit is divided into two separate instances as an input control unit 63 and an output control unit 61, which respectively check data written to the memory unit 65 against input rules 64. The output control unit 61 verifies the read data ge ^¬ genüber output rules 62 before this advertising output via the interface 31 to a connected computing device to.

Thus, a reliable lock solution or a data gateway can be realized inexpensively. The network ^¬ connectivity between a first and second network zone is interrupted. A corresponding configuration, that is about the access rights, the read and write permissions can accordingly limita ^¬ ken depending on the interface. Thus, an asynchronous treatment can be achieved per forward direction. Furthermore, data can be buffered and checked or validated according to different criteria. By defining interface from ^¬ pending permissions to sub-structures of the storage unit, so by setting up partitions, directory Sources or files and access rights directed to them can flexibly separate data streams and forward them according to various rules or even store them. By including information that takes into account the processing or originating path of the read or written data, the transfer of different types of data can be taken into account very flexibly.

All described and / or designated features can be combined advantageously within the scope of the invention. The invention is not limited to the described embodiments.

Claims

claims

A memory device for transferring data between at least two computing devices (44, 47) associated with different network zones (40, 45), comprising:

- at least one storage unit (37) for storing Since ^¬ th,

- At least two externally leading interfaces (31, 32), to each of which one of the computing devices (44, 47) is connected for reading and / or writing data, and

- At least one control unit (36), which is designed such access rights to the data of the memory unit (37) depending on at least two of the leading to the outside

To set up interfaces (31, 32).

2. A memory device according to one of the preceding claims, wherein the memory unit (37) is designed to store data in different data structures (34, 35) and the control unit (36) is designed to be interface-dependent access rights for each Set up data structure (34, 35).

3. Storage device according to one of the preceding claims, wherein the access rights are enforced by an interface-dependent authorization information in a file system of the storage device.

4. Storage device according to one of the preceding claims, wherein the access rights are enforced by a configuration of the external interfaces to the memory unit (37) itself.

5. The memory device according to claim 4, wherein the access rights are formed by shorting bridges or DIP switches.

6. Storage device according to one of claims 2 to 5, wherein separate data structures (34, 35) for different accessories access rights are configured and / or different are formed to ^¬ access rights for a single data structure.

The storage device according to claims 2 to 6, wherein separate data structures (34, 35) are formed for management data and payload data.

8. che memory device according to any one of the preceding Ansprü-, wherein the control unit (36) data before passing it to an external interface (31, 32) checked against a testing regulations ^¬ writing.

9. Storage device according to one of the preceding claims, wherein a first control unit (61) receives the data arriving at the first external interface (31) in relation to input rules (62) and a second control unit (63) connected to the second external interface (32). outgoing data against exit rules (64).

10. Storage device according to one of the preceding claims, wherein in the control unit (36, 51, 61, 63), in addition to a read and / or write authorization, an access right depends on a role of the read or write remote computing device (44, 47 ) can be established.

11 Memory device according to one of the preceding claims, wherein in the control unit (36, 51, 61, 63) one to ^¬ reached quite dependent written by an information path in the storage unit (34, 35, 65) data or from the storage unit (36 , 51, 61, 63) can be set up and / or checked.

12. Memory device according to one of the preceding Ansprü- che, wherein the memory device (30, 50, 60) as masses ^¬ store, in particular as a semiconductor drive, as a magnetic disk, as a redundant array of independent storage cherplatten or as directly connected memory is formed.

13. Data transmission device for transmitting data between different network zones (40, 45), comprising

- At least two computing devices (44, 47), each associated with different network zones (40, 45), and

a memory device (30) with at least two external interfaces (31, 32),

wherein the at least two computing devices (44, 47) are connected to different externally leading interfaces (31, 32) of the memory device (30), and

the memory device (30) is designed in such a way

Establish access rights to data of the memory device (30) depending on the accessing interface (31, 32).

14. A method for transmitting data between at least two computing devices (44, 47), the different network zones (40, 45) are associated, wherein a first re ^¬ chenvorrichtung (44) having a first externally leading port (32) of a storage device ( 30) and a second computing device (47) is connected to one of the first different second externally leading interface (31) of the memory device (30), with the method steps:

Establishing (11) interface-dependent access rights (33) to the data of the memory device (30) as a function of the at least two of the externally leading interfaces (31, 32) of the memory device (30),

- writing (12) data from an external computing device (44, 47) via a first externally leading section ^¬ point (31, 32) of the storage device (30, 50, 60) depending ex- of the established access privileges for the first to leading interface (31),

- Reading (13) of data by a second computing device (44, 47) via a second external leading interface (31, 32) depending on the established access rights for the second external leading interface (32).

15. The method according to claim 14, wherein access rights are additionally provided as a function of an information path (20), and the information path (20) is provided via the externally leading interface (31, 32).

16. The method of claim 15, wherein the information path (20) has at least one of the following:

an indication of the role of the computing device (44, 47), an indication of the type of data source or data sink of the Rechenvor ^¬ direction (44, 47) and an identifier of the data sink or data source.

17. A computer program product directly loadable into a memory ei ^¬ nes programmable memory device, comprising program code portions which are suitable to carry out the steps of the method according to any one of claims 14 and sixteenth

18, data carrier storing the computer program product according to ^¬ demanding 17th