EP4128656A1

EP4128656A1 - Devices, computer-implemented method and computer program product for giving access to a control function, using an object

Info

Publication number: EP4128656A1
Application number: EP21739571.4A
Authority: EP
Inventors: Thomas JETZFELLNER; Carlos MORRA
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2020-06-30
Filing date: 2021-06-21
Publication date: 2023-02-08
Also published as: WO2022002663A1; US20230254156A1; CN115943605A; EP3934195A1

Abstract

The invention relates to an ecosystem of devices which autonomously interact with one another by means of a blockchain or a network application. In particular, the invention allows creation of a security-protected data processing of sensor data or measurement data for an object by means of a distributed infrastructure. Fields of application include supply-chain scenarios or industrial control applications of blockchains.

Description

description

DEVICES, COMPUTER-IMPLEMENTED METHODS AND COMPUTER PROGRAM PRODUCT FOR GRANTING ACCESS TO A CONTROL FUNCTION USING AN OBJECT

The invention relates to methods, devices and a system for the security-protected provision of data records, the data records comprising, for example, sensor data.

The increasing networking of smart devices (e.g. mobile phones, smartwatches) or production systems means that more and more sensor data is being recorded by these smart devices and production systems. In particular, this data is intended to be used to monitor, for example, the production or the transport of objects (e.g. workpieces, food, etc.).

A method for identifying an additively manufactured workpiece is known from EP3435272A1.

Aspects of the invention are explained below.

The technology of blockchains or "distributed ledgers" is currently an intensely discussed technology that can be implemented in particular as a distributed database system or as a network application. In addition to applications for decentralized payment systems (e.g. Bitcoin), new application options are being developed in the financial industry. In particular, transactions between companies can be carried out in a manipulation-protected manner without an intermediary or clearing house. This enables new business models without a trustworthy intermediary, it reduces transaction costs, and new digital services can be offered flexibly without having to set up a specially set up infrastructure and trust relationships. A transaction data set protected by a blockchain (or transaction for short) includes z. B. program code, which can also be referred to as a so-called "smart contract".

According to one aspect, the invention relates to a device for granting access to control functions on the basis of an object, comprising: a detection module (110) for detecting individual features (M) of an object (0) by means of a detection device (A); a checking module (120) for calculating a test result based on a comparison of the individual features with a reference value; a control module (120) for granting access to control functions, the control functions being accessed depending on the test result if the test result is sufficiently accurate Correspondence of the reference value with the individual characteristics confirmed.

Unless otherwise stated in the following description, the terms “perform”, “calculate”, “computer-aided”, “calculate”, “determine”, “generate”, “configure”, “reconstruct” and refer to The like preferably to actions and / or processes and / or processing steps that change and / or generate data and / or convert the data into other data, the data being or being present in particular as physical quantities, for example as electrical pulses In particular, the term "computer" should be interpreted as broadly as possible, in particular to cover all electronic devices with data processing properties. Compu ter can thus be, for example, personal computers, servers, programmable logic controllers (PLC), handheld computer systems, pocket PC devices, cellular phones and other communication devices that can process computer-aided data, processors and other electronic devices for data processing . In connection with the invention, "computer-aided" can mean, for example, an implementation of the method in which a processor in particular carries out at least one method step of the method. For example, "computer-aided" also means "computer-implemented". "Computer-implemented" means, for example, that the method or its method steps are carried out by one processor or by several processors.

In connection with the invention, a processor can be understood to mean, for example, a machine or an electronic circuit. A processor can in particular be a central processing unit (CPU), a microprocessor or a microcontroller, for example an application-specific integrated circuit or a digital signal processor, possibly in combination with a memory unit for storing program commands, act etc. A processor can also be, for example, an IC (integrated circuit), in particular an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit), or a DSP (Digital Signal Processor) or a graphics processor GPU (Graphic Processing Unit). A processor can also be understood to mean a virtualized processor, a virtual machine or a soft CPU. It can, for example, also be a programmable processor that is equipped with configuration steps for executing the aforementioned method according to the invention or is configured with configuration steps in such a way that the programmable processor according to the invention the features of the method, the component, the modules, or others Aspects and / or partial aspects of the invention realized. A “memory unit” or “memory module” and the like can be understood in connection with the invention, for example, a volatile memory in the form of random access memory (RAM) or a permanent memory such as a hard disk or a data carrier.

In connection with the invention, a "module" can be understood to mean, for example, a processor and / or a memory unit for storing program commands To implement or realize a method or a step of the method according to the invention. A module can for example also be a node of the distributed database system which, for example, realizes the specific functions / features of a corresponding module. The respective modules can for example also be separate or independent modules For this purpose, the corresponding modules can include further elements, for example, these elements are, for example, one or more interfaces (e.g. database interfaces, communication interfaces - e.g. network interface, WLAN interface) and / or a ne evaluation unit (e.g. B. a processor) and / or a memory unit. The interfaces can be used, for example, to exchange data (e.g.

B. received, transmitted, sent or provided who the). By means of the evaluation unit, data can be compared, checked, processed, assigned or calculated, for example with the aid of a computer and / or in an automated manner. By means of the storage unit, data can, for example, be stored, retrieved or made available in a computer-aided and / or automated manner.

Under “include”, “have” and the like, in particular with regard to data and / or information, in connection with the invention, for example, a (computer-aided) storage of corresponding information or a corresponding date in a data structure / data record (the z. B. in turn is stored in a storage unit) ver stood.

In connection with the invention, "assign", in particular with regard to data and / or information, can be understood to mean, for example, a computer-aided assignment of data and / or information , unique identifier (UID)) is assigned a second datum in which, for example, the first datum is stored in a data record together with the memory address or the unique identifier of the second datum.

In connection with the invention, “providing”, in particular with regard to data and / or information, can be understood to mean, for example, computer-aided provision Via this interface, for example, corresponding data and / or information can be transmitted and / or sent and / or retrieved and / or received during provision.

In connection with the invention, “providing” can also be understood to mean, for example, loading or saving, for example a transaction with corresponding data. This can be done, for example, on or from a memory module a sending or a transfer) of corresponding data from one node to another node in the block chain or the distributed database system (or its infrastructure) or a network application.

Under a "checksum", for example a data block checksum, a data checksum, a node checksum, a transmission Action checksum, a concatenation checksum or the like can be understood in connection with the invention, for example, a cryptographic checksum or cryptographic hash or hash value, which in particular uses a cryptographic hash function over a data set and / or data and / or one or more of the transactions and / or a subarea of a data block (e.g. the block header of a block of a block chain or data block header of a data block of the distributed database system (or the network application) or only part of the transactions of a data block). A checksum can in particular be a checksum (s) or hash value (s) of a hash tree (e.g. Merkle tree, Patricia tree). Furthermore, it can also be understood to mean, in particular, a digital signature or a cryptographic message authentication code. By means of the checksums, for example, a cryptographic

Protection / manipulation protection for the transactions and the data (records) stored in them are implemented. If a high level of security is required, for example, the checksums are generated and checked at the transaction level. If a less high level of security is required, for example the checksums are generated and checked at block level (e.g. over the entire data block or only over part of the data block and / or part of the transactions).

A "data block checksum" can be understood in connection with the invention as a checksum that is calculated, for example, over part or all of the transactions of a data block. A node can then, for example, check the integrity / authenticity of the corresponding part of a data block using the data block checksum In addition or as an alternative, the data block checksum can in particular also have been formed via transactions of a previous data block / previous data block of the data block. wise a Merkle tree [1] or a Patricia tree can be realized, the data block checksum in particular being the root checksum of the Merkle tree or a Patricia tree or a binary hash tree. In particular, transactions are secured by means of further checksums from the Merkle tree or Patricia tree (e.g. using the transaction checksums), the further checksums in particular being leaves in the Merkle tree or Patricia tree. The data block checksum can thus secure the transactions, for example, by forming the root checksum from the other checksums. The data block checksum can in particular be calculated for transactions of a specific data block of the data blocks. In particular, such a data block checksum can enter a subsequent data block of the specific data block in order to concatenate this subsequent data block, for example, with its previous data blocks and in particular to make the integrity of the distributed database system (or the network application) verifiable. As a result, the data block checksum can, for example, take over the function of the chaining checksum or can be included in the chaining checksum. The header of a data block (e.g. of a new data block or of the data block for which the data block checksum was formed) can include the data block checksum, for example.

In connection with the invention, “transaction checksum” can be understood to mean a checksum that is formed in particular over a transaction of a data block Leaves of a Merkle tree, for example, can be used.

A "concatenation checksum" can be understood in connection with the invention as a checksum which, in particular, contains a respective data block of the distributed database system (or the network application) the preceding data ten block of the distributed database system (or the network application) specifies or references (in the technical literature in particular often referred to as "previous block hash")

[1]. For this purpose, a corresponding concatenation checksum is formed in particular for the corresponding preceding data block. For example, a transaction checksum or the data block checksum of a data block (i.e. an existing data block of the distributed database system or the network application) can be used as the chaining checksum in order to combine a new data block with an (existing) data block of the distributed database system (or the network Application). However, it is also possible, for example, for a checksum to be formed over a header of the previous data block or over the entire previous data block and used as a concatenation checksum. This can also be calculated, for example, for several or all of the preceding data blocks. For example, it is also possible to use the header of a data block and the data block checksum to form the concatenation checksum. A respective data block of the distributed database system, however, preferably comprises a chaining checksum, which was calculated for a previous data block, in particular even more preferably the data block immediately preceding, of the respective data block or relates to it. For example, it is also possible for a corresponding chaining checksum to be formed over only part of the corresponding data block (e.g. the previous data block). In this way, for example, a data block can be implemented which comprises an integrity-protected part and an unprotected part. For example, this could be used to create a data block whose integrity-protected part cannot be changed and whose unprotected part can also be changed later. In this context, integrity-protected is to be understood in particular to mean that a change in integrity-protected data can be determined by means of a checksum. The data that are stored, for example, in a data block transaction, can in particular be provided in different ways. Instead of the data, e.g. B. User data such as measurement data or data / ownership of assets, for example, a transaction of a data block can only include the checksum for this data. The corresponding checksum can be implemented in different ways. This can e.g. B. be a corresponding data block checksum of a data block (with the corresponding data) of another database or of the distributed database system or network application, a transaction checksum of a data block with the corresponding data (of the distributed database system or one of its databases) or a data checksum that over which data was formed.

In addition, the corresponding transaction can contain a reference or information on a storage location (e.g. an address of a file server and information on where the corresponding data can be found on the file server; or an address of another distributed database that contains the data includes) include. The corresponding data could then, for example, also be provided in a further transaction of a further data block of the distributed database system (or the network application) (e.g. if the corresponding data and the associated checksums are included in different data blocks). However, it is also conceivable, for example, that this data is provided via another communication channel (for example via another database and / or a cryptographically secured communication channel).

For example, in addition to the checksum, an additional data record (for example a reference or an indication of a storage location) can also be stored in the corresponding transactions, which in particular specifies a storage location where the data can be called up. This is particularly advantageous to the extent that a data size of the block chain or the shared database system (or network application) as low as possible.

In connection with the invention, “security-protected” or “cryptographically protected” can be understood to mean protection that is implemented in particular by a cryptographic method. For example, this can be realized by using the distributed database system (or the network application) for the provision or transmission or transmission of corresponding data / transactions. This is preferably achieved by a combination of the different (cryptographic) checksums, in that they interact in particular synergistically in order to improve the security or the cryptographic security for the data of the transactions, for example. In other words, “security-protected” in connection with the invention can also be understood to mean “cryptographically protected” and / or “tamper-proof”, where “tamper-proof” can also be referred to as “integrity-protected”.

"Chaining the data blocks of a distributed database system" can be understood in connection with the invention, for example, that data blocks each contain information (e.g. concatenation checksum) that refers to another data block or several other data blocks of the distributed database system ( or the network application) or reference them [1] [4] [5].

"Insertion into the distributed database system (or into a network application)" and the like can be understood in connection with the invention, for example, that in particular a transaction or the transactions or a data block with its transactions to one or more nodes of a distributed database system If, for example, these transactions are successfully validated (for example by the node (s)), these transactions are in particular considered to be newer Data block concatenated with at least one existing data block of the distributed database system (or network application) [1] [4] [5]. For this purpose, the corresponding transactions are saved in a new data block, for example. In particular, this validation and / or chaining can be carried out by a trustworthy node (for example a mining node, a block chain oracle or a block chain platform). In particular, a block chain platform can be understood to mean a block chain as a service, as proposed in particular by Microsoft or IBM. In particular, a trustworthy node and / or a node can each store a node checksum (e.g. a digital signature) in a data block (e.g. in the data block they have validated and generated, which is then chained) in particular to enable the creator of the data block to be identified and / or to enable the node to be identified. This node checksum indicates which node, for example, has concatenated the corresponding data block with at least one other data block of the distributed database system (or the network application).

"Transaction" or "transactions" can be understood in connection with the invention, for example, a smart contract [4] [5], a data structure or a transaction data record, which in particular comprises one of the transactions or several transactions. In connection with the invention, “transaction” or “transactions” can also be understood to mean, for example, the data of a transaction of a data block of a blockchain. A transaction can in particular comprise a program code which, for example, implements a smart contract. For example, in connection with the invention, a transaction can also be understood as a tax transaction and / or confirmation transaction. Alternatively, a transaction can be, for example, a data structure that stores data (e.g. the control commands and / or contract data and / or other data such as video data, user data, measurement data Etc.). In connection with the invention, a "transaction" can for example also be a message or a communication message or be referred to as such. or also includes prerequisites (e.g. specified requirements) for executing the control commands.

In particular, “storage of transactions in data blocks”, “storage of transactions” and the like are to be understood as meaning direct storage or indirect storage. Direct storage can mean, for example, that the corresponding data block (of the distributed database system / network application) or the corresponding transaction (of the distributed database system / network application) includes the respective data. Indirect storage can be understood to mean, for example, that the corresponding data block or the corresponding transaction includes a checksum and optionally an additional data record (e.g. a reference or an indication of a storage location) for corresponding data and therefore not the corresponding data are stored directly in the data block (or the transaction) (i.e. only a checksum for this data instead). In particular, when storing transactions in data blocks, these checksums can be validated, for example, as is explained, for example, under "Insertion into the distributed database system (or into a network application)".

A “program code” (for example a smart contract or chain code) can be understood in connection with the invention, for example, as a program command or several program commands that are stored in one or more transactions in particular. The program code can be carried out in particular and is carried out, for example, by the distributed database system (or by the network application). Management environment (z. B. a virtual machine) can be implemented, the execution environment or the program code preferably being Turing-complete. The program code is preferably executed by the infrastructure of the distributed database system (or the network application) [4] [5]. For example, a virtual machine is implemented through the infrastructure of the distributed database system (or the network connection).

In connection with the invention, a “smart contract” (or also called a chain code) can be understood to mean, for example, an executable program code [4] [5] (see in particular the definition of “program code”). The smart contract is preferably stored in a transaction of a distributed database system (e.g. a block chain) or a network application, for example in a data block of the distributed database system or the network application. For example, the smart contract can be executed in the same way as is explained in the definition of “program code”, in particular in connection with the invention.

In connection with the invention, a “smart contract process” or a “smart contract” can in particular also mean executing a program code or a smart contract in a process through the distributed database system or its infrastructure.

In connection with the invention, “proof of work” can be understood to mean, for example, solving a computationally intensive task that is to be solved in particular depending on the data block content / content of a specific transaction [1] [4] [5 Such a computationally intensive task is also known as a cryptographic puzzle, for example.

A “network application” can be, for example, a distributed database system or distributed communication Under a "network application", in connection with the invention, for example, a decentrally distributed database, a distributed database system, a distributed database, a peer-to-peer application, a distributed memory management system, a blockchain , a distributed ledger, a distributed storage system, a distributed ledger technology (DLT) based system (DLTS), an audit-proof database system, a cloud, a cloud service, a block chain in a cloud or a peer-to-peer database For example, a network application (or also referred to as a network application) can be a distributed database system that is implemented, for example, by means of a block chain (e.g. Hyperledger) or a distributed ledger Implementations of a block chain or a DLTS are used, such as a block chain or a DLTS, which are generated by means of a Directed Acylic Graph ( DAG), a cryptographic puzzle, a hash graph or a combination of the implementation variants mentioned [6] [7] is implemented. Different consensus algorithms can also be implemented, for example. This can be, for example, a consensus procedure using a cryptographic puzzle, Gossip about Gossip, Virtual Voting or a combination of the procedures mentioned (e.g. Gossip about Gossip combined with Virtual Voting) [6] [7]. If, for example, a block chain is used, this can be implemented in particular by means of a Bitcoin-based implementation or an Ethereum-based implementation [1] [4] [5]. A “distributed database system” or a “network application” can also be understood, for example, as a distributed database system or a network application, of which at least part (or all parts) of its nodes and / or devices and / or infrastructure are realized by a cloud. For example, the corresponding components are implemented as nodes / devices in the cloud (e.g. as a virtual node in a virtual machine). This can be done using VM-Ware, Amazon Web Services or Microsoft Azure, for example. On- Due to the high flexibility of the implementation variants explained, in particular, partial aspects of the implementation variants mentioned can be combined with each other by z. B. a hash graph is used as a block chain, the block chain itself z. B. can also be blockless.

If, for example, a Directed Acylic Graph (DAG) is used (e.g. IOTA or Tangle), in particular transactions or blocks or nodes of the graph are connected to one another via directed edges. Acyclic means in particular that there are no directed loops in the graph.

The distributed database system or the network application can be, for example, a public distributed database system or a public network application (e.g. a public block chain) or a closed (or private) distributed database system or a closed network Application (e.g. a private block chain).

If, for example, it is a publicly distributed database system or a public network application, this means that new nodes and / or devices can join the distributed database system or network application without proof of authorization or without authentication or without login information or without credentials or be accepted by it. In particular, the operators of the nodes and / or devices can remain anonymous in such a case.

If the distributed database system or the network application is, for example, a closed distributed database system, new nodes and / or devices require, for example, valid credentials and / or valid authentication information and / or valid credentials and / or valid login information to be able to to be able to join a distributed database system or the network application or to be accepted by it. In the case of a distributed database system or the network application, it can also be, for example, a distributed communication system for data exchange. This can, for example, be a network or a peer-to-peer network.

A / the distributed database system can also be, for example, a decentralized distributed database system and / or a decentralized distributed communication system.

A "network application" can also be a network application infrastructure, for example, or the network application comprises a corresponding network application infrastructure. This infrastructure can be nodes and / or communication networks and / or data interfaces and / or other components, for example The network application can, for example, be a distributed network application (for example a distributed peer-to-peer application or a distributed database system) which is executed, for example, on several nodes of the network application infrastructure.

Under a "distributed database system", which can also be referred to as a distributed database, for example, in connection with the invention, a decentrally distributed database, a blockchain, a distributed ledger, a distributed storage system, a distributed ledger technology (DLT) based system (DLTS), an audit-proof database system, a cloud, a cloud service, a block chain in a cloud or a peer-to-peer database. Different implementations of a block chain or a DLTS can also be used, for example such as a block chain or a DLTS, which is generated by means of a Directed Acylic Graph (DAG), a cryptographic puzzle, a hash graph or a combination tion from the implementation variants mentioned [6] [7]. For example, different consensus algorithms can also be implemented. This can be, for example, a consensus procedure using a cryptographic puzzle, Gossip about Gossip, Virtual Voting or a combination of the mentioned procedures (eg Gossip about Gossip combined with Virtual Voting) [6] [7]. If, for example, a block chain is used, this can be implemented in particular by means of a Bitcoin-based implementation or an Ethereum-based implementation [1] [4] [5]. A “distributed database system” can also be understood, for example, as a distributed database system of which at least some of its nodes and / or devices and / or infrastructure are implemented by a cloud. For example, the corresponding components are available as nodes / devices in the Cloud (e.g. as a virtual node in a virtual machine). This can be done, for example, using VM-Ware, Amazon Web Services or Microsoft Azure. Due to the high flexibility of the implementation variants explained, in particular, partial aspects of the implementation variants mentioned can also be combined with one another can be combined, e.g. by using a hash graph as a block chain, whereby the block chain itself can also be blockless, for example.

If, for example, a Directed Acylic Graph (DAG) is used (e.g. IOTA or Tangle), in particular transactions or blocks or nodes of the graph are connected to one another via directed edges. This means in particular that edges (preferably all edges) have the same direction (preferably always the same direction), similar to z. B. is at time. In other words, it is in particular not possible to start or jump to the transactions or the blocks or the nodes of the graph backwards (that is, contrary to the common direction). Acyclic means in particular that there are no loops when running through the graph. The distributed database system can be, for example, a public distributed database system (e.g. a public block chain) or a closed (or private) distributed database system (e.g. a private block chain).

If, for example, it is a public distributed database system, this means that new nodes and / or devices can join the distributed database system or are accepted by it without credentials or without authentication or without login information or credentials. In particular, the operators of the nodes and / or devices can remain anonymous in such a case.

If the distributed database system is, for example, a closed distributed database system, new nodes and / or devices require, for example, a valid credential and / or valid authentication information and / or valid credentials and / or valid login information to access the distributed To be able to join the database system or to be accepted by it.

A distributed database system can, for example, also be a distributed communication system for exchanging data. This can be a network or a peer-2-peer network, for example. As an alternative or in addition, the invention can also be implemented, for example, by means of a peer-2-peer application instead of the distributed database system.

In connection with the invention, for example, a data block of a distributed database system (e.g. a block chain or a peer to peer database) or a network application, which is implemented in particular as a data structure and preferably comprises one of the transactions or several of the transactions. In one implementation, for example, the database (or the database system) can be a DLT-based system (DLTS) or a block chain and a data block can be a block of the block chain or the DLTS. A data block can, for example, include information on the size (data size in bytes) of the data block, a data block header, a transaction counter and one or more transactions [1]. The data block header can, for example, be a version, a chaining checksum, a data block checksum, a time stamp, a proof-of-work certificate and a nonce (one-off value, random value or counter that is used for the proof-of-work certificate) include [1] [4] [5]. A data block can, for example, only be a specific memory area or address area of the total data that are stored in the distributed database system. This allows, for example, blockless distributed database systems, such as B. realize the IoT Chain (ITC), IOTA, and Byteball. In particular, the func tionalities of the blocks of a block chain and the Transaktio NEN are combined with one another in such a way that, for. B. the Transaktio NEN itself secure the sequence or chain of transactions (of the distributed database system) (that is, in particular, are stored securely). For this purpose, for example, the transactions themselves can be chained to one another using a chaining checksum, preferably by using a separate checksum or the transaction checksum of one or more transactions as the chaining checksum, which is also saved in the corresponding new transaction when a new transaction is saved in the distributed database system . In such an embodiment, a data block can, for example, also comprise one or more transactions, wherein in the simplest case, for example, a data block corresponds to a transaction.

In connection with the invention, “nonce” can be understood, for example, as a cryptographic nonce (abbreviation for: “used only once” [2] or “number used once” [3]). or a combination of letters that is preferably used once in the respective context (e.g. transaction, data transmission).

Under "previous data blocks of a (specific) data block of the distributed database system (or a network application)" can be understood in connection with the invention, for example, the data block of the distributed database system (or the network application), in particular a (specific) data block directly Alternatively, "previous data blocks of a (specific) data block of the distributed database system" can also be understood to mean, in particular, all data blocks of the distributed database system (or the network application) that precede the specific data block. In this way, for example, the chaining checksum or the transaction checksum can only be formed over the data block (or its transactions) directly preceding the particular data block or over all data blocks (or their transactions) preceding the first data block.

Under a "block chain node", "node", "node of a distributed database system or a network application" and the like, devices (e.g. field devices, cell phones), computers, smart phones, Clients or participants are understood that carry out operations (with) the distributed database system (e.g. a block chain) [1] [4] [5]. Such nodes can, for example, transactions of a network application or a distributed database system or their data blocks or insert or link new data blocks with new transactions in the distributed database system (or in the network application) using new data blocks. In particular, this can be validated and / or linked by a trustworthy node (e.g. a Mining Node) or exclusively by trustworthy nodes. A trustworthy node is, for example, a node that has additional safe security measures (e.g. firewalls, access restrictions to the node or similar) to prevent manipulation of the node. Alternatively or additionally, for example, a trustworthy node can store a node checksum (e.g. a digital signature or a certificate) in the new data block when chaining a new data block with the distributed database system. In this way, in particular, evidence can be provided which indicates that the corresponding data block was inserted by a specific node or indicates its origin. The devices (e.g. the corresponding device) are, for example, devices of a technical system and / or industrial plant and / or an automation network and / or a manufacturing plant, which in particular is also a node of the distributed database system (or the Network application). The devices can, for example, be field devices or devices in the Internet of Things, which in particular are also a node of the distributed database system (or the network application). Nodes can for example also comprise at least one processor in order to e.g. B. perform their computerim plemented functionality. A node can be configured as a device or, for example, or a node can comprise a device, for example.

In connection with the invention, a "block chain oracle" and the like can be understood to mean, for example, nodes, devices or computers which, for example, have a security module that is implemented, for example, by means of software protection mechanisms (e.g. cryptographic methods), mechanical protective devices (e.g. a lockable housing), electrical protective devices (e.g. tamper protection or a protective system that deletes the data of the safety module in the event of unauthorized use / treatment of the blockchain oracle) or a combination of the possibilities mentioned The security module can include, for example, cryptographic keys or a secret (for example a character string) that are used for the calculation the checksums (e.g. transaction checksums or node checksums) are necessary.

In connection with the invention, a “computer” or a “device” can be understood as meaning, for example, a computer (system), a client, a smart phone, an IoT device, a device or a server, each of which is outside the block chain are arranged and are not part of the infrastructure of the distributed database system (or the network application) or form a separate, separate infrastructure. A device is, for example, a manufacturing device and / or an electromechanical device and / or an electronic device and / or a device of an automation network (e.g. for industrial technical systems, manufacturing systems, energy or resource distribution systems) , In particular, these devices are not able to communicate directly with the distributed database system (directly) or with the network application.

Such a device outside the distributed database system (or the network application) cannot access the data of the distributed database system (or the network application), for example, because the device is too old and neither has the necessary cryptographic and / or IT Security capabilities are still compatible with the data format of the distributed database system (or the network application).

A device can, for example, also be a node of a network application or a distributed database system.

In connection with the invention, a “separate and / or direct communication channel” can be understood to mean, for example, data transmission (e.g. sending, receiving, transmitting, providing or transmitting) by means of a communication channel Channel transactions / messages are sent faster and a confirmation of this data transmission exchange can be stored in the distributed database system. Since with, for example, important and / or time-critical transactions or messages (z. B. control commands or control transactions) can be transmitted at a higher speed to a corresponding target (z. B. a device) and since z. For example, the slower data transmission of the distributed database system (e.g. when replicating the data blocks / transactions) can be avoided. For example, a separate and / or direct communication channel can be built for the invention and the aspects mentioned, exemplary embodiments, embodiments of the invention and its variants for data transmission between a device (and / or nodes). For example, in a direct communication channel, the transactions / messages are exchanged directly between a sender (e.g. the (first) and a recipient / target (e.g. the device that is to execute, process or evaluate the control commands) without further nodes and / or devices of the distributed database system being involved in this data exchange. On the other hand, with a separate communication channel, nodes and / or devices of the distributed database system can be involved in the data exchange, for example successfully established between the sender and the receiver (in particular a communication connection was established as a result), data can be exchanged between the sender and the receiver in the form of transactions or messages, for example especially a communication link ended) so, for example, a result of the data transmission z. B. in the form of transactions (z. B. as a transfer confirmation transaction or confirmation transaction) stored in the distributed database system (z. B. in data blocks of the distributed database system). The result of the data transmission can be, for example, a confirmation of the transmission or receipt of the corresponding transactions / messages and / or an analysis result and / or the last transaction / message transmitted was transmitted via the separate and / or direct communication channel before the communication channel was closed. The transaction with the result can be saved, for example, by the sender and / or recipient. The analysis result can be, for example, the confirmation of receipt of the message / transaction and / or that the message / transaction and z. B. whose control commands can be processed by the target / recipient (e.g. confirmation of the feasibility by the target). This can, for example, in turn be stored in a transaction (e.g. in a feasibility confirmation transaction). Alternatively or additionally, the feasibility confirmation transaction is stored in the distributed database system. The feasibility confirmation transaction includes, for example, a unique identifier for the device that is able to execute the control commands and / or can, for example, specify when the control commands of the message / transaction will be executed at the latest. As an alternative or in addition, the executable confirmation transaction includes, for example, data on the execution z. B. how well or to what degree the control commands are processed (e.g. how quickly the control commands are processed, when they are safely processed, how exactly or precisely the control commands are executed - for example when executing production control commands to e.g. B. to document a processing of a workpiece).

Alternatively or additionally, the feasibility confirmation transaction includes, for example, device-specific data (e.g. type of device; current device status such as ready for operation, maintenance required, error status of the corresponding device; serial number of the device; location of the device; a checksum / Hash of the executed control commands, calculated for example with the aid of the mentioned invention; tools used; materials used or a combination of the mentioned data) of the corresponding device (e.g. the target / recipient) that are relevant for the execution of the control commands, where z. B. the device-specific see data from the corresponding device at the time of confirmation of feasibility by the device. This takes place z. B. the confirmation of the feasibility and the determination of the device-specific data (approximately) at the same time - for example within a time window of a few seconds or minutes. For example, the data of the feasibility confirmation transaction can also have been exchanged between the sender and the recipient before the feasibility confirmation transaction z. B. is stored in the distributed database system. The feasibility confirmation transaction can, for example, also be cryptographically protected (for example it can be encrypted or protected by a transaction checksum). Also, for example, the message last exchanged via the communication channel can be stored in the transmission confirmation transaction (z. B. if the communication channel is interrupted) and the transmission confirmation transaction z. B. then be stored in the distributed database system. This most recently exchanged message can be used, for example, to continue the data exchange or the data transmission when the communication channel is set up again. The transfer confirmation transaction can also be cryptographically protected, for example. The transmission confirmation transaction can include, for example, the control commands and / or the control transaction and / or the last message exchanged between the sender and the recipient. A continuation of the data exchange or the data transmission can also be used for other data transmissions, for example, and is not specifically limited to the data transmission or the data exchange of a single message.

The separate and / or direct communication channel is advantageous in order to improve a transmission speed and / or transmission latency. For example, a hybrid method is also possible by using, for example, a corresponding communication channel for time-critical control commands (e.g. with high or critical priority. ority) is used. For example, on the basis of the execution requirements (e.g. there are time-critical control commands, priority control commands for a real-time application), it can be determined whether these are corresponding control commands that are to be transmitted via a corresponding separate communication channel and / or direct communication channel. Alternatively or additionally, the determination module can determine corresponding instructions for a data transmission of the message, for example when determining the message control data record.

In connection with the invention, an "object" can mean, for example, a physical object, physical goods, a workpiece (e.g. an engine part or an engine part or an electronic component or a circuit board with electronic components), an intermediate product in manufacture, raw material substances (e.g. diamonds, crude oil), food (e.g. milk or bananas) or devices (e.g. electrical devices, electro-mechanical devices, IoT devices, electronic devices or mechatronic devices).

"Individual features" (or, for example, only referred to as features) can be understood in connection with the invention, for example, features (for example in the form of data) that are detected by a sensor from or via the object can and can correspond, for example, to a physical quantity (e.g. wavelength of light). The individual features are, for example, object-specific features, i.e., for example, that these features or data are a unique combination of a sequence of ones and zeros (digital fingerprint or a type of unique identifier) in the form of binary-coded data that can, for example, be permanently assigned to a corresponding object or the object As an alternative or in addition, the individual features can be, for example, spectroscopic data (which, for example, also a ls spectral data act on the object (e.g. measured spectra, hyperspectral images). For example, the object can be gemstones, crude oil or food, of which z. B. a spectrum for the object or a predetermined position (z. B. a predetermined area and / or position) of the object is detected by means of a detection device in the form of a spectroscope. In this respect, the individual features can be, for example, spectroscopic individual features. The indi viduellen features can, for example, also be features that z. B. can not be removed from the object without damaging or changing the object. Corresponding features can, for example, be referred to as intrinsic individual features of the object.

The individual features can also be, for example, individual features of a noise signal that z. B. is detected by the detection device (z. B. an oscilloscope). If the object is an electronic component, for example, an object-specific noise signal or an object-specific signal (e.g. a signal generator that generates an unchangeable specific signal that can be configured once) can be transmitted via an interface of the object be captured. With this noise signal, for example, the amplitude of the noise signal can be recorded and / or taken into account for certain resistances and / or attenuations. A predetermined test signal can also be provided by the object, for example, and signal distortions for the individual features can be taken into account. Alternatively or additionally, for example, the detection device can send a test signal that z. B. is transmitted / sent by predetermined circuits of the object. For example, the object or the corresponding circuitry of the object generates a response that z. B. comprises the test signal, the response being transmitted to the detection device. For example, the individual influence of the circuits on the test signal is then used by the recording device as the individual len characteristics recorded. This individual influence can, for example, be a distortion of the test signal. Accordingly, the individual features can be, for example, individual electronic features. The individual features can also be, for example, acoustic features of the object (e.g. engine noises, operating noises). So that, for example, the recording device can record the individual features as simply as possible, the manner and location (e.g. can be referred to as configuration) on the object is specified, for example, by an object data record. This object data set can for example be provided by the network application or a database (e.g. a distributed database system) or this object data set can be called up to the object by means of a data memory for the acquisition module or for the acquisition device that is enclosed with the object. The object can also include the data memory, for example. The object data record can include information, for example, which type of measurement (e.g. optical, spectral, acoustic, electrical, optoacoustic, multispectral optoacoustic), with which type of sensor (e.g. microphone, ultrasonic sensor, infrasound sensor, spectral measuring systems, optoacoustic measuring systems, optoacoustic measuring systems), at which location, over which period and with which measuring parameters (e.g. attenuation; signal filters such as high pass, low pass, band pass, frequencies, wavelengths) are to be carried out in order to determine the individual To capture characteristics.

In particular, tolerance values can be taken into account when capturing and / or evaluating and / or comparing and / or checking and / or processing the individual features in order to, for.

B. measurement tolerances or measurement inaccuracies, e.g. B. of the acquisition device to compensate.

Alternatively, for objects of the same type (e.g.

B. workpieces of the same type) the corresponding information NEN, which are not agile for recording the individual characteristics, are firmly specified. For example, at an object in the form of a workpiece, the underside of the ob ject detected or there are, for example, markings attached to the object so that the object finds the appropriate positions on the object and can detect the individual features sen. This fixed information can for example be stored for objects of the same type in a network application or a database system (e.g. the distributed database system) or be permanently preconfigured in corresponding devices.

An "object-specific characteristic" (or, for example, only referred to as a characteristic) can be understood in connection with the invention, for example, as processed (for example by data processing) individual features which are processed in particular in such a way that the individual characteristic can be reproducibly generated for the same individual features. In particular, tolerance values can be taken into account, e.g. to compensate for measurement tolerances or measurement inaccuracies of the recording device. The object-specific characteristic is, for example, a digital fingerprint for the object. The digital fingerprint is calculated, for example, using an algorithm for digital fingerprints (e.g. Rabin's fingerprinting algorithm) If the individual features are, for example, a signal or noise signal, the signal / noise ratio, phase of the signal, frequencies, We All length information and frequency amplitudes are used.

Also, for example, the individual features such. B. be evaluated in terms of wavelengths and amplitudes in spectra. In the case of hyperspectral images, for example, the intensity of the wavelength at one or more image positions or positions on the object can be evaluated for the respective wavelengths of the images (or in the corresponding captured images).

Before, for example, the corresponding characteristic is calculated for the corresponding individual features, can z. B. the individual features are preprocessed to compensate for the measurement inaccuracies. For example, measured values of the individual features lie in a possible value range (e.g. 1 to 100). This range of values is divided into predetermined intervals, for example. B. 5 value intervals (1 - 20, 21 - 40, 41 - 60, 61 - 80, 81 - 100). The individual value intervals are then assigned interval-specific values (e.g. 1 - 20: A, 21 - 40: B, 41 - 60: C, 61 - 80: D, 81 - 100: E). For example, if a measured value of the individual features is evaluated or preprocessed, then z. B. checks in which value interval the specific measured value lies and the interval-specific value is used to calculate the digital fingerprint. For the values 1 and 100, for example, the result would be "AE". Other methods can also be used, for example. These are, for example, mean value methods or sliding mean value methods. The corresponding, possibly pre-processed, individual features are then used, for example, as input parameters for an algorithm As an alternative or in addition, for example, one of the mentioned variants of preprocessing / processing can be applied to the data (individual features and / or object-specific features) which are used to determine or provide or calculate the first cryptographic key. Alternatively, for example, the pre-processing / processing explained for the corresponding data (for example the individual features and / or object-specific features and / or object-specific characteristics) can be used before they are also used for other purposes Otherwise, the cryptographic checksum can be calculated using this data processed in this way. B. can be used as a secret when calculating the cryptographic checksum (e.g. this can be used for the device).

In connection with the invention, “messages” can mean, for example, messages of a communication protocol and / or transactions of a database system (e.g. a distributed database system) or a network application. A message can, for example, correspond to the data structure or a message can comprise the data structure. The corresponding message can also include the corresponding cryptographic checksum, for example.

In connection with the invention, a “data structure” can be understood to mean, for example, a message or a transaction. Alternatively, for example, a message or a transaction includes a corresponding data structure. For example, the data structure, the message or the transaction may include a corresponding cryptographic Check sum for the data structure.

In connection with the invention, a “cryptographic key” can be understood to mean, for example, a symmetrical cryptographic key or a private key of an asymmetrical cryptographic key pair or a public key of an asymmetrical cryptographic key pair.

For example, a data structure used by the invention can also include further data, such as control commands, in order to e.g. B. to control a further transport or a Wei terprocessing of the object if z. B. was found with the invention that the object is authentic or corresponds to the object for which z. B. already a corresponding data structure (z. B. with a checksum) z. B. was saved in the network application.

With the invention, it is possible in particular to implement a decentralized infrastructure (e.g. based on block chains) that manages real or physical goods (e.g. objects) through a digital infrastructure and processes them (e.g. production, Transport and confirmation of their authenticity) is controlled. In addition, certain services or services can be provided, for example, if there is a corresponding object with which these services are associated. These services can be activated or released, for example, by means of the control functions.

Often, for example, physical objects are assigned a (digita Ler) service or a corresponding physical object is to use a corresponding service (z. B. in the form of provided control functions) to complete z. B. to control the further processing of an object (e.g. a workpiece) and / or to document its transport and work steps.

The invention makes it possible, in particular, to provide corresponding control functions for a (physical) object in order to use corresponding (digital) services. Are z. B. for the object identified the allowed control functions, for example, data between the object and z. B. a network application can be exchanged via a corresponding control function. In the data structure z. B. Data on the status of the object (e.g. a device status, if the object is a device,

- such as B. ready for operation, maintenance necessary, error status of the corresponding device) are communicated and / or other re required control functions z. B. be asked for in the network application. The control functions can then, for. B. software updates of the object are made or software updates of other objects or systems are made, the object here z. B. enables the necessary control functions.

For example, if a corresponding object is delivered or if it is to be processed or edited, there is B. a need or a need to be able to check which control functions are available for the corresponding object. In order to solve this task, the individual features of the object are recorded by the recording device, for example, and compared or checked with the corresponding reference value. The individual features can be surface structures of the object, for example, if the object is, for example, a workpiece that was manufactured by means of machining. Here, for example, the detection device (e.g. a surface detection device such as a 3D surface scanner or a surface camera) can detect the individual features at predetermined positions of the object, in which case the individual features are, for example, in such a case individual surface features of the property. It is also conceivable, for example, that a digital fingerprint was incorporated into the object in the form of the individual features. This fingerprint or the digital features cannot be determined, for example, with the naked eye and / or without knowledge of the type and position, or can only be determined with considerable technical effort. Correspondingly, for example, the information to record the individual features can be stored in a protected memory of the device so that this information cannot be accessed by unauthorized persons. The incorporated fingerprint can be, for example, surface irregularities that are generated during the manufacture of the object. Alternatively or additionally, the fingerprint can be implemented by applying colors or particles, with the colors or particles being applied, for example, in such a way that an individual spectrum is generated for the object. For this purpose, for example, different colors / particles can be distributed over the upper surface of the object, so that the example se a geometric spectrum is generated so that, for. B. a predetermined spectrum can be measured at certain positions of the object. The spectrum or the colors / particles are selected, for example, in such a way that they are not in the spectrum that is visible to the human eye. This can, for example, be a spectrum that extends beyond 800 nm (e.g. B. wavelengths> 800 nm such as a wavelength range between 800 nm and 1000 nm).

The individual features can also be features other than surface features, for example. For example, the individual features can be spectroscopic data about the object. For example se it can be in the object to precious stones, crude oil or Le bensmittel, of which z. B. by means of a detection device in the form of a spectroscope, a spectrum for the object or a predetermined position (z. B. a predetermined area and / or position) of the object is detected. In this respect, the individual features can be, for example, spectroscopic individual features. The individual features can also be, for example, individual features of a noise signal that z. B. is detected by the detection device (z. B. an oscilloscope). If the object is an electronic component, for example, an object-specific noise signal or an object-specific signal (e.g. a signal generator that generates an unchangeable specific signal that can be configured once, for example) can be sent via an interface of the object. are recorded. With this noise signal, for example, the amplitude of the noise signal for certain resistances and / or attenuations can be recorded and / or taken into account. A predetermined test signal can also be provided by the object, for example, and signal distortions for the individual features can be taken into account. Alternatively or additionally, for example, the detection device can send a test signal that z. B. is transmitted / sent by predetermined circuits of the object. For example, the object or the corresponding circuitry of the object generates a response that z. B. comprises the test signal, the response being transmitted to the detection device. For example, the individual influence of the circuits on the test signal is then recorded by the recording device as the individual features. This individual influence can for example a distortion of the test signal. Accordingly, the individual features can be, for example, individual electronic features.

Depending on the object and / or a corresponding configuration / definition, the individual features can thus be, for example, individual surface features and / or individual spectroscopic features and / or individual electronic features. The individual features can also be, for example, acoustic features, optoacoustic features or multisprectral optoacoustic features. The corresponding individual features can, for example, be recorded in a reproducible manner for the object.

The individual features (can also be referred to as object-specific features, for example) can also be, for example, a combination of the examples mentioned for individual features.

Using the individual features, an object-specific characteristic can then be calculated, for example. Here, for example, tolerance values for the individual features can be taken into account in order, for example, to generate a reproducible, object-specific characteristic for the object. The object-specific characteristics are advantageous in order to compensate for measurement inaccuracies when recording the individual features, for example.

For example, the mentioned data structure can be a message or a message can include the data structure where the message is to be stored or processed, for example, by a distributed database system or a network application, the distributed database system or the network application being, for example, a block chain and the data structure being a Transaction of the distributed database system (or network application) and the crypto graphic checksum is, for example, a transaction checksum. For example, the cryptographic checksum is appended to the data structure so that the integrity and / or origin and / or authenticity of the data structure and its association with the object can be checked.

The network application or a database can include, for example, a variety of reference values to which z. B. the corresponding (permitted) control functions (e.g. write functions and / or access restrictions) are assigned for a corresponding object. For example, by comparing and / or determining the test result based on the individual features with the reference value, it is identified which of the control functions are available or can be provided when the object is present.

In this context, providing means, for example, that the control functions assigned to the object or the corresponding reference value are accessed by z. B. the device or the object corresponding access data for the control functions (e.g. a web service) are transmitted (e.g. via a communication link). The access data can preferably be used for a limited time in order to ensure that this data is e.g. B. can not be used unnecessarily long in the absence of the property.

In a first embodiment of the device, the device comprises, for example, a cryptography module, the cryptography module calculating, for example, a first cryptographic key on the basis of an object-specific characteristic and / or on the basis of the individual features.

In further embodiments of the device, the individual features are compared with the corresponding reference value, with the first cryptographic key and / or access data being released by the cryptography module if the reference value matches the individual features with sufficient accuracy. Alternatively or additionally In addition, for example, the corresponding control functions can be accessed using the first cryptographic key and / or using the access data. For example, the first cryptographic key can be used to cryptographically sign a corresponding request message (e.g. implemented as a corresponding data record or data structure in a message). If z. B. a correctness of the corresponding digital signature could be confirmed by a check by means of a corresponding assigned further cryptographic key or assigned key material (z. B. provided by a trustworthy entity such as a trustworthy server or a certificate authority), z. B. provided the corresponding control functions or granted access to them.

In further embodiments of the device, a communication link is established between the object and / or the device. Alternatively or additionally, a communication connection is set up between the object and / or a network application. Alternatively or additionally, a communication connection is set up between the object and / or the device and / or a network application.

In further embodiments of the device, the communication connection is protected by means of cryptographic protection.

In further embodiments of the device, the cryptographic protection can be generated and / or checked and / or removed with the first cryptographic key.

In further embodiments of the device, the reference value is a reference hash value or an unambiguous (reference) identifier, for example the reference hash value or the unambiguous (reference) identifier being formed for one or the stored reference value. Alternatively or additionally, the individual features are an object hash value or a unique (object) identifier, with, for example, the object hash value or the unique (object) identifier having been or will be formed when the individual features were recorded (e.g. based on the individual features recorded). To calculate the corresponding hash values or the corresponding unique identifiers, z. B. corresponding (cryptographic) functions can be used.

In further embodiments of the device, the reference value is established when the object is generated, the reference value being assigned to the object in particular when it is generated.

In further embodiments of the device, the control functions allow access to a database or network application in order to exchange or synchronize data about the object in a data structure with the database or the network application.

In further embodiments of the device, the control functions are corresponding control functions of the device and / or corresponding control functions of the object and / or corresponding control functions of a network application.

In further embodiments of the device, the network application or the distributed database system is, for example, a block chain, the device being designed, for example, as a node or oracle of the distributed database system or the network application, and the cryptographic checksum is, for example, a digital signature.

In further embodiments of the device, the device comprises, for example, a calculation module (120), wherein the calculation module (120) is set up, for example, to calculate an object-specific characteristic based on the individual features, the characteristic is calculated, for example, taking into account predetermined tolerance values of the individual features, for example the characteristic and / or the individual features are compared with the corresponding reference value , for example in the case of a sufficiently precise match between the reference value and the characteristics and / or the individual features, the first cryptographic key is released by the cryptography module.

In further embodiments of the device, the device comprises, for example, a monitoring module, the monitoring module, for example, being set up to monitor the device and, in particular, to store information from the monitoring in a file or in a data structure. So that the operation of the device can be monitored and z. For example, it can be determined when changes have been made to a device (e.g. a software or firmware update has been imported) or when a device status of the device changes, e.g. B. has changed.

In further embodiments of the device, the object and / or the device comprises an object data record, the object data record specifying the geometric locations and / or interfaces at which the recording device can record the individual features, the object data record, for example, the individual features and / or the object-specific characteristics in encrypted form, for example the encrypted the individual features and / or the object-specific characteristics Characteristic by means of the first cryptographic key, the object data set includes, for example, further object data, such as measured values of the object, measured values about the object, manufacturing details of the object, whereabouts of the object, the other object data, for example from sensors of the device for the object are detected, the sensors are, for example, a GPS module and / or temperature sensors and / or optical Sen sensors that detect, for example, corresponding properties of the object.

The device is advantageous in that it allows, for example, certain selected areas of the object or the interfaces to be defined via which the individual features can be recorded by the recording device. The interfaces can be, for example, interfaces of the object if, for example, the object is an electronic component. For this purpose, the object data set can be stored, for example, in a corresponding data structure and exchanged between the object and / or the device and / or the network application.

In a further embodiment of the device, the property-specific characteristic is calculated taking into account given tolerance values of the individual features.

The device is advantageous to compensate for measurement inaccuracies when calculating the characteristic, for example, in order to calculate the object-specific characteristic for the correct object in a reproducible manner, if necessary. For example, the tolerance values can be selected such that in the case of spectroscopic individual features (also called spectral individual features) of an object, for. B. in the form of food, no first cryptographic key is provided (or no valid first cryptographic key graphic key can be provided) if the object or the food are no longer fresh enough. If, for example, the object is bananas, the tolerance value for the spectrum of the surfaces of the bananas can be selected in such a way that if the bananas turn brown over a large area (e.g. there is a significantly reduced green and / or yellow component in the spectrum, so that, for example, a corresponding reference value is not reached), no first cryptographic key is provided for these bananas (or no valid first cryptographic key can be provided). Accordingly, the bananas or a banana delivery with these bananas can no longer be confirmed / stored as "fresh" in a supply chain by means of a message with the data structure or the data structure in the distributed database system (or in the network application) at a transport point or at an intermediary In the same way, for example, other objects in the form of perishable goods can be monitored using messages / data structures in a distributed database system (or in a network application). The corresponding tolerance values are then selected so that no first cryptographic key may be provided if the perishable goods have degenerated too much (e.g. the shelf life of food has expired or the food has spoiled) Alternatively, an alternative cryptographic key can be provided if the tolerance values are exceeded, for example hand which can be traced at which point in the documentation of the transport of the object the tolerance values were exceeded. In other words, by means of the tolerance values, for example, a threshold value can be established, and if it is exceeded, in particular no corresponding valid first cryptographic key is provided or no valid cryptographic checksum is created. In particular, in such a case, for. B. a tolerance value correspond to a threshold value. In further embodiments of the device, the first cryptographic key is calculated, for example, on the basis of the object-specific characteristics and / or the individual features and / or a character string. Alternatively, instead of the first cryptographic key, for example, the cryptographic checksum can be calculated.

In a further embodiment of the device, a predefined tolerance value is taken into account when comparing the individual features with the corresponding reference value.

The device is advantageous to take into account, for example, measurement inaccuracies when recording the individual features, in order to determine the individual features for the correct object, if necessary, in a reproducible manner. For example, the tolerance values can be selected in such a way that in the case of spectroscopic individual features (also called spectral individual features) of an object, for. B. in the form of food, no first cryptographic key be provided (or no valid first kryptographi cal key can be provided) if the object or the food are no longer fresh enough. If, for example, the object is bananas, the tolerance value for the spectrum of the surfaces of the bananas can be selected in such a way that when the bananas are brown over a large area (e.g. there is a significantly reduced proportion of green and / or yellow in the spectrum present, so that, for example, a corresponding reference value is not reached) no first cryptographic key is provided for these bananas (or no valid first cryptographic key can be provided). Accordingly, the bananas or a banana delivery with these bananas at a transport point or at an intermediary can no longer be confirmed / stored as "fresh" in a supply chain by means of a message with the data structure or the data structure in the distributed database system (or in the network application) in the same way you can For example, other objects in the form of perishable goods are monitored by means of messages / data structures in a distributed database system (or in a network application) by e.g. B. corresponding information can be stored in the network werkapplikation. The corresponding tolerance values are then selected accordingly so that no first cryptographic key is provided if the perishable goods e.g. B. have degenerated too much (e.g.

B. the shelf life of food has expired or the food has spoiled). Alternatively, for example, if the tolerance values are exceeded, an alternative cryptographic key can be provided, which can be used to trace the point at which the tolerance values were exceeded in the documentation of the transport of the object. In other words, by means of the tolerance values, for example, a threshold value can be established which, when exceeded, in particular no corresponding valid first cryptographic key is provided or no valid cryptographic checksum is created. In particular, in such a case, for. B. a tolerance value correspond to a threshold value.

In further embodiments of the device, the object data set comprises data which indicate the geometric locations and / or interfaces at which the detection device can detect the individual features.

The device is advantageous in that it allows, for example, certain selected areas of the object or the interfaces to be defined via which the individual features can be recorded by the recording device. The interfaces can be, for example, interfaces of the object if, for example, the object is an electronic component.

In further embodiments of the device, the object data set includes, for example, the individual features and / or the object-specific characteristics in encrypted form. rare form, where for example the encrypted individual features and / or the object-specific characteristics can be decrypted by means of the first cryptographic key.

The device is advantageous to the extent that, for example, the characteristics can be checked by a recipient (e.g. in the sense of a delivery of goods) in order to e.g. B. determine how much the individual features and / or the object-specific characteristics have varied during the processing of the object. This is relevant, for example, if the object was transported over a long transport route or several production steps were carried out in the manufacture of the object. In these mentioned cases and other cases, a data structure is created for the object and stored, for example, in a distributed database system (or in a network application) (as already explained above, for example). The data structure can, for example, include additional information about the production step, production conditions (temperatures during production), tools used and materials used. In the case of a transport, the data structure can, for example, contain information about the transport conditions (temperature for cold chains, position information, etc.). This additional information can be referred to as further object-related data, for example. For example, in the case of a transport, the object can be a transport container which comprises corresponding sensors and / or the device. The transport container can be, for example, a transport container for milk, precious stones or other food / materials. The transport container could, for example, comprise a device according to the invention and a corresponding detection device.

In further embodiments of the device, the object data set includes, for example, further object-related data, such as measured values of the object, measured values about the object, manufacturing details of the object, whereabouts of the Object, the other object data being recorded for example by sensors of the device for the object or by sensors of the object, the sensors being, for example, a GPS module and / or temperature sensors and / or optical sensors and / or acoustic sensors and / or optoacoustic sensors - Are table sensors that, for example, detect the corresponding properties of the object.

For example, the sensor values can be recorded during production or during transport of the object and z. B. in the distributed database system (or in the network werkapplikation) stored or processed (z. B. by control functions such. B. a service) (z. B. by means of the data structure, preferably in conjunction with the cryptographic checksum).

According to a further aspect, the invention relates to a computer-implemented method for granting access to control functions using an object with the following method steps:

Detection of individual features (M) of an object (0) by means of a detection device (A);

Calculating a test result based on a comparison of the individual features with a reference value;

Granting access to control functions, the control functions being accessed depending on the test result, if the test result confirms a sufficiently precise match of the reference value with the individual characteristics.

In further embodiments of the method, the method comprises further method steps in order to implement the functional features or in order to implement further features of the device or its embodiments. Furthermore, a computer program product with program commands for performing the above-mentioned methods according to the invention is claimed, whereby one of the methods according to the invention, all methods according to the invention or a combination of the methods according to the invention can be carried out by means of the computer program product.

In addition, a variant of the computer program product with program commands for configuring a creation device, for example a 3D printer, a computer system or a manufacturing machine suitable for creating processors and / or devices, is claimed, the creation device being configured with the program commands in such a way that the aforementioned device according to the invention is created.

In addition, a provision device for storing and / or providing the computer program product is claimed. The provision device is, for example, a data carrier that stores and / or provides the computer program product. Alternatively and / or additionally, the provision device is, for example, a network service, a computer system, a server system, in particular a distributed computer system, a cloud-based computer system and / or virtual computer system, which the computer program product preferably stores and / or provides in the form of a data stream.

This provision takes place, for example, as a download in the form of a program data block and / or command data block, preferably as a file, in particular as a download file, or as a data stream, in particular as a download data stream, of the complete computer program product. This provision can, for example, also take place as a partial download, which consists of several parts and, in particular, is downloaded via a peer-to-peer network or made available as a data stream. Such a computer program product is read into a system in the form of the data carrier using the provision device, for example executes the program commands so that the method according to the invention is executed on a computer or the creation device is configured in such a way that it creates the device according to the invention.

The properties, features and advantages of this invention described above and the manner in which they are achieved will become clearer and more clearly understandable in connection with the following description of the exemplary embodiments, which are explained in more detail in connection with the figures. The following are shown in a schematic representation:

1 shows a first embodiment of the invention;

Fig. 2 shows a further embodiment of the invention;

3 shows a further embodiment of the invention;

In the figures, functionally identical elements are provided with the same reference symbols, unless otherwise stated.

Unless otherwise stated or already stated, the following exemplary embodiments have at least one processor and / or one memory unit in order to implement or carry out the method.

In particular, a (relevant) person skilled in the art, with knowledge of the method claim (s), is of course familiar with all of the options for realizing products or options for implementation that are customary in the prior art, so that there is no need for a separate disclosure in the description. In particular, these customary implementation variants known to those skilled in the art can be implemented exclusively by hardware (components) or exclusively by software (components). As an alternative and / or in addition, the person skilled in the art can largely use any combination according to the invention within the scope of his professional ability. NEN from hardware (components) and software (components) select to implement implementation variants according to the invention.

A combination of hardware (components) and software (components) according to the invention can occur in particular if some of the effects according to the invention are preferably exclusively through special hardware (e.g. a processor in the form of an ASIC or FPGA) and / or another part through the (processor- and / or memory-based) software is effected.

In particular, given the large number of different implementation options, it is impossible and also not expedient or necessary for understanding the invention to name all of these implementation options. In this respect, in particular, all of the following exemplary embodiments are intended to show only examples of some ways in which such implementations of the teaching according to the invention in particular could look like.

Consequently, in particular the features of the individual exemplary embodiments are not restricted to the respective exemplary embodiment, but rather relate in particular to the invention in general. Accordingly, features of one exemplary embodiment can preferably also serve as features for another exemplary embodiment, in particular without this having to be explicitly mentioned in the respective exemplary embodiment.

FIGS. 1 to 3 each show exemplary embodiments of the different aspects of the invention.

Fig. 1 shows a system that is used to store sensor data in a network application (z. B. a distributed database system) for example and / or to grant access to control functions based on an object. The sensor data is, in particular, information about an object 0. The control functions are Is it, for example, (digital) services that z. B. should be used by the property or the device. The network application includes z. B. a database or a database that uses reference values and / or access data to identify and / or provide appropriate control functions on the basis of the object.

1 shows a first node NI, a second node N2, a third node N3 and a fourth node N4, which are the nodes of the network application BC (for example the distributed database system which is implemented, for example, as a block chain ) form, one of the nodes, e.g. B. the first node NI which comprises the device (according to the invention). The nodes are z. B. connected to one another via a first communication network NW1.

Furthermore, FIG. 1 shows blocks B, for example a first block B1, a second block B2 and a third block B3, a network application BC, a section of the network application BC being shown here as an example. In this specific case, the network application BC z. B. be implemented as a block chain or DLT.

The blocks B each include several transactions T. The transactions T can include control transactions and / or confirmation transactions and / or a data structure and / or an object data record and / or recorded individual features.

The first block B1 includes, for example, a first transaction Tla, a second transaction Tlb, a third transaction Tic and a fourth transaction Tld.

The second block B2 comprises, for example, a fifth transaction T2a, a sixth transaction T2b, a seventh transaction T2c and an eighth transaction T2d. The third block B3 comprises, for example, a ninth transaction T3a, a tenth transaction T3b, an eleventh transaction T3c and a twelfth transaction T3d.

The blocks B each also include one of the concatenation checksums CRC, which is formed as a function of the direct predecessor block. The first block B1 thus comprises a first chaining checksum CRC1 from its predecessor block, the second block B2 a second chaining checksum CRC2 from the first block B1, and the third block B3 a third chaining checksum CRC3 from the second block B2.

The respective chaining checksum CRC1, CRC2, CRC3 is preferably formed using the block header of the corresponding preceding block. The concatenation checksums CRC can preferably be formed using a cryptographic hash function such as SHA-256, KECCAK-256 or SHA-3. For example, the chaining checksum can also be calculated using the data block checksum or the header includes the data block checksum (the data block checksum is explained below).

In addition, each of the blocks can include a data block checksum. This can be implemented, for example, using a hash tree.

In order to create the hash tree, a transaction checksum (e.g. also a hash value) is calculated for each transaction of a data (block). Alternatively or additionally, a transaction checksum, which was preferably created by the creator of the transaction when creating the transaction, can be used for this purpose.

Usually for a hash tree, e.g. B. a Merkle Tree or Patricia Tree is used, whose root hash value / root checksum is preferably stored as corresponding data block checksum in the respective blocks. In one variant, the data block checksum is used as a concatenation checksum.

A block can furthermore have a time stamp, a digital signature, a proof-of-work evidence, as was explained in the embodiments of the invention.

The network application or the BC block chain itself is implemented using a block chain infrastructure with several block chain nodes (nodes NI, N2, N3, N4 and other blocks). The nodes can be, for example, block chain oracles or trusted nodes.

The nodes are communicatively connected to one another via the network NW1 (for example a communication network such as the Internet or an Ethernet network). By means of the network application infrastructure or the block chain infrastructure, for example, at least some of the data blocks B or all of the data blocks B of the network application BC are replicated for some or all of the nodes of the network application.

The device (according to the invention) can be, for example, as a component of the network application or in variants of a communication infrastructure (e.g. a peer-2-peer system, a distributed communication infrastructure). The device can, for example, communicate with other devices or databases or systems or distributed database systems by means of the network application or, in variants, communicate with one another by means of a communication infrastructure (e.g. a peer-2-peer system, a distributed communication infrastructure).

The nodes of the network application (e.g. blockchain nodes) and / or the distributed database system and / or the device (according to the invention) can each additionally comprise, for example, one or more additional components, such as a processor, a storage unit , other communication interfaces (e.g. Ethernet, WLAN, USB, fieldbus, PCI), an input device, in particular a computer keyboard or a computer mouse, and a display device (for example a monitor). The processor can, for example, comprise several further processors which can be used in particular to implement further exemplary embodiments.

Fig. 2 shows an example of a further embodiment, for example, the functioning of the device (according to the invention). The device can also be referred to as a device, for example.

2 shows in detail a device 100 (according to the invention) for granting access to control functions on the basis of an object, the control functions being, for example, functions of a network application, the device or the object 0.

A node from FIG. 1 can e.g. B. comprise the device 100 or be designed as the device 100 or a node from FIG. 1 is connected to the device 100 via a data line or a communication network.

For granting access to control functions on the basis of an object, the device 100 comprises a detection module 110, a checking module 120, a control module 130 and a communication module (e.g. a network interface) 101, which are connected via a bus (e.g. a PCI Bus, CAN bus, USB or data line) 102 are communicatively connected to one another.

The device 100 optionally includes a processor and / or a cryptography module and / or a calculation module and / or a protection module, which may or may not be available via the bus (e.g.

B. a PCI bus, CAN bus, USB or data line) 102 are also communicatively connected to one another.

The acquisition module 110 is for acquiring individual features M (these individual features can also be used, for example, as object-specific features are designated) of the object 0 set up by means of a detection device A. For this purpose, the recording device A is connected to the recording device A via a data connection (wireless or wired) (e.g. with USB, LAN, W-LAN, Bluetooth, Firewire) C. For example, the detection device A detects / measures surface unevenness as individual features for the object 0 by means of a scanning beam and transmits (Sil) the individual features to the detection module 110.

The checking module 120 is set up to calculate a checking result based on a comparison of the individual features with a reference value.

The control module 130 is set up to grant access to the control functions, the access to the control functions taking place as a function of the test result (S1) if the test result confirms a sufficiently precise correspondence of the reference value with the individual features.

The control functions F (z. B. a first control function F1, a second control function F2 and a third control function F3) are, for example, (digital) services that z. B. should be taken from the object or the device in claim men. The checking module 120 and / or the control module 130 are used, for example, to identify which control functions are relevant for the object 0 or should be used on the basis of the object. Alternatively or additionally, the object 0 or the device or a user of the device sends a request for corresponding control functions to the device (or a network application) via a corresponding communication connection.

Based on the individual features and / or based on the reference value, the device can, for. B. identify the relevant control functions. A network application (e.g. the network application from FIG. 1 or a cloud CL) or a database can include, for example, a large number of reference values. B. the corresponding (permitted) control functions (e.g. write functions and / or access restrictions) are assigned for a corresponding object. For example, by comparing and determining the test result on the basis of the individual features with the reference value, it is identified which of the control functions are available or can be provided when the object is present. Al ternatively, the corresponding control functions by ei ne request that z. B. by the object or by the device or by a user, identified or selected.

In this context, providing means, for example, that the control functions assigned to the object or the corresponding reference value are accessed by z. B. the device and / or the object and / or the network application corresponding access data for the control functions (z. B. a web service) are transmitted (z. B. via a communication link). The access data can preferably be used for a limited time in order to ensure that this data is e.g. B. can not be used unnecessarily long in the absence of the property.

The test result confirms, for example, a sufficiently precise correspondence between the reference value and the individual features.

If the test result is negative - sufficient correspondence between the reference value and the individual characteristics is not confirmed - access to the control functions is prevented or not granted.

The reference value can, for example, be a key for an entry in an assignment table (e.g. hash table) or a database, whereby for a key or reference corresponding information or a data set is stored with corresponding information indicating which control functions are available for the corresponding reference value.

Are now z. B. recorded the individual features, when comparing z. B. checks whether an associated key (reference value) for an entry with a data record with corresponding information about control functions in the hash table or in the database exists for the corresponding individual features. Correspondingly, checking the individual features with the reference value as checking the presence of a key (reference value) for a corresponding entry with information about control functions can be.

For example, if no entry can be identified or assigned net, no corresponding control functions are identified, for example, and it can, for. B. an error message can be issued.

As already explained, should, for. B. via the device, with a sufficient match of the individual characteristics with the reference value, access to control functions can be granted. The corresponding control functions to which access is to be granted (z. B. the first control function F1 and the second control function F2) can, for. B. can be identified via the in dividual features and / or the reference value and / or via a request (z. B. by the object, by a user of the device or by the device itself). Alternatively, it can e.g. B. also be that the corresponding control functions do not even have to be identified or selected, since z. B. for each request or use, the same control functions are provided (control functions Fl-F3) and it should be checked in particular whether z. B. a suitable object or an object that corresponds to the reference values is present. In the case of further variants, the reference value can be e.g.

B. a sequence of numbers of several reference values or instead of the reference value several reference values are used when comparing.

When comparing or checking the individual features, tolerance values can be taken into account, for example, in order to B. Measurement inaccuracies of the detection device A to be taken into account.

Analogously to the recorded individual features, z. B. the reference value is also available as a hash value, the z. B. was calculated by means of a one-way function.

It is advantageous that the corresponding features or values are only available indirectly and thus cannot be easily copied or a forged object can be created without, for example, B. to have access to the original object 0.

The communication with the object 0 and / or the cloud CL and / or the network application and / or the database preferably takes place via the communication module (e.g. a network interface) 101.

Once the communication link has been established, various computer-controlled operations can be carried out.

For example, the control functions can allow access to the network application (e.g. the cloud CL) in order to exchange or synchronize data about the object in a data structure with the database or the network application. For this purpose, for example, corresponding control functions F of the cloud CL can be used to z. B. to save the corresponding data (e.g. status data about the object or measurement data about the object) in the cloud or at another location. Alternatively or additionally, maintenance work on object 0 can be carried out using the control functions be by z. B. a firmware update or a software update or an update of configuration files or an update of access authorizations for the object is carried out by a corresponding control function of the control functions.

For example, parts of a technical system (e.g. a production system) for object 0 can be controlled via the control functions. This can be, for example, controlling a conveyor belt so that object 0 (e.g. a melting furnace) is supplied with material for melting down or object 0 (e.g. a production robot) is supplied with the next part to be produced.

The corresponding control functions can be implemented, for example, as a smart contract for the network application.

The optional calculation module is set up to calculate an object-specific characteristic based on the individual features M. When calculating the object-specific characteristics, tolerance values can be taken into account, for example, in order to B. Measurement inaccuracies of the detection device A to be taken into account in the determination of the first cryptographic key mentioned below. The calculation module can, for example, be dispensed with in implementation variants in which the cryptographic key is provided on the basis of the individual features.

The optional cryptography module is designed to provide a first cryptographic key on the basis of the individual features and / or the object-specific characteristics.

In one variant, the optional cryptography module can, for example, calculate a first cryptographic key on the basis of an object-specific characteristic and / or on the basis of the individual features. In one variant, the individual features are compared with the corresponding reference value (e.g. by the cryptography module), with the first cryptographic key and / or access data being released by the cryptography module or control module if the reference value matches the individual features with sufficient accuracy will.

For example, the corresponding control functions are accessed using the first cryptographic key and / or by means of the access data. Preventing access to the control functions (e.g. if the individual features do not match the reference values sufficiently) can e.g. B. can be realized by un terbinden the access to the first cryptographic key and / or to the access data.

The provision of the first cryptographic key or the access data can be implemented in different ways, for example. For example, the individual features and / or the object-specific characteristic can be compared with reference values or a reference value, in which case, for example, corresponding tolerance values are taken into account. If the individuel len features and / or the object-specific characteristic match the reference value (z. B. after taking into account the tolerance values), then the first cryptographic key and / or the access data z. B. loaded from a secure Datenspei cher. The reference value can be recorded or stored, for example, during an initialization phase and / or installation phase of the device. The initialization phase and / or installation phase for the device can preferably only be carried out once.

Alternatively, the first cryptographic key or the access data is calculated on the basis of the individual features and / or the object-specific characteristics by the individual visual features and / or the property-specific characteristics can be used as input data for a key derivation function. Additional data can also be used here (e.g. a stored user name). For example, a character string (e.g. a secret password) can be linked with the individual features and / or the object-specific characteristics, in which case, for example, these linked data are used to derive a key using a key derivation function (e.g. PBKDF2 ) to calculate the first cryptographic key or the access data (e.g. a password for a user name, whereby the user name is stored in the device, for example).

In one variant, the communication connection is protected by means of cryptographic protection.

In one variant, the cryptographic protection can be generated and / or checked and / or removed with the first cryptographic key and / or the access data.

For example, the communication link can be a secure communication link in which the object 0 and the cloud CL each require a cryptographic key in order to establish the secure communication link. For example, the reference value or the reference values or a value derived therefrom (e.g. using a hash function or key derivation function) can serve as a cryptographic key for the secure communication connection for the cloud CL (or the network application). To be here z. B. corresponding reference values managed by the cloud CL or by the network application.

The individual features or a value derived therefrom (e.g. by means of a hash function or key derivation function) can serve as a cryptographic key or as access data for the secure communication connection for object 0. For a data exchange between the object 0 and the cloud CL, a data structure can be used which is protected by means of a cryptographic checksum. The data structure and the cryptographic checksum are stored, for example, in a data record, the data record being stored, for example, as a transaction in the distributed database system or the network application. For this purpose, the transaction can include an additional checksum (z. B. a transaction checksum), which z. B. by means of a cryptographic key (z. B. a private cryptographic key) was generated, which is assigned to an entity or is used by this. The entity can be, for example, an operator of a measuring station or processing station that controls, processes or manages the object 0. The data record can, for example, also be a message or a transaction, depending on the implementation.

Depending on the implementation variant, the data structure can e.g. B. also correspond to the data record if z. B. the data structure comprises a data field to store the cryptographic checksum or the cryptographic checksum of the data struc ture is appended. As already explained, in particular the data structure and / or the data record can be stored or included in a message or a transaction. Alternatively, for example, the data structure and / or the data record can be a message or a transaction.

In a further variant, the optional protection module is set up for cryptographic protection of the data structure using the cryptographic checksum, the protection module calculating the cryptographic checksum using the first cryptographic key. The cryptographic checksum can be calculated, for example, with a keyed hash message authentication code (HMAC, e.g. using MD5, SHA1, SHA256). In further implementation variants, the cryptographic checksum can be implemented as a digital signature or as a digital certificate, with Depending on the cryptographic method used (symmetrical or asymmetrical method), the first cryptographic key functions, for example, as a private key in order to generate the digital signature. To check the digital signature, for example, the public key is derived from the first cryptographic key and provided by a trustworthy entity (e.g. a trustworthy server), so a checking authority, for example, can access the corresponding key in variants. Is the private key e.g. B. have been generated and z. B. been stored in a memory of the cryptography module, for example, the corresponding individual features of the object can be changed or made unusable so that the first cryptographic key can no longer be derived. This can be done, for example, by polishing the corresponding position on the surface of the object in the case of surface features, washing colors / particles from the object (e.g. using solvents) or additionally applying colors / particles to the object in order to remove the to make corresponding individual characteristics unusable or to change. It is also possible, for example, that the individual features are made unusable in such a way that the first cryptographic key can no longer be calculated directly from them, but the object-specific characteristic can still be calculated using the changed individual features, taking tolerance values into account to z. B. provide or calculate the public key through the cryptography module.

Alternatively or additionally, in a further variant, the public key can be a (digital) fingerprint, the digital fingerprint being formed on the basis of the individual features. The individual features (e.g. surface unevenness, a dye with a specific spectrum that, for example, decays after a specified time, in particular to encode a shelf life) can be incorporated / incorporated into the object or applied to the object. This fingerprint or the individual features cannot be determined / readable, for example, with the naked eye and / or without knowledge of the type and position, or can only be determined with considerable technical effort. Correspondingly, for example, the information (e.g. the object data record) to record the individual features can be stored in a protected memory of the device so that this information cannot be accessed by unauthorized persons. The incorporated fingerprint / individual features can be, for example, surface irregularities that are generated during the manufacture of the object or the further processing of the object. Alternatively or additionally, in a further variant, the fingerprint can be implemented by applying colors or particles, with the colors or particles being applied in such a way that an individual spectrum is generated for the object. For this purpose, for example, different colors / particles can be distributed over the surface of the object, so that, for example, a geometric spectrum is generated so that z. B. a predetermined spectrum can be measured at certain positions of the object. The spectrum or the colors / particles are selected, for example, in such a way that they are not in the spectrum that is visible to the human eye. This can, for example, be a spectrum that lies beyond 800 nm.

The use of tolerance values is e.g. B. to that effect, for example, to take into account (or compensate) measurement inaccuracies when calculating the characteristic or capturing the individual features, in order to reproducibly calculate the object-individual characteristic or the individual features for the correct object, if necessary.

For example, in a further variant, the tolerance values can be selected in such a way that in the case of spectroscopic individual characteristics of an object z. B. in the form of food, no first cryptographic key is provided (or no valid first cryptographic key can be provided) if the object or the food are no longer fresh enough. If, for example, the object is bananas, the tolerance value for the spectrum of the surfaces of the bananas can be selected in such a way that if the bananas are brown over a large area, no first cryptographic key is provided for these bananas (or no valid first one cryptographic key can be provided) or is generated. Accordingly, the bananas or a banana delivery with these bananas at a transport point or at an intermediary can no longer be confirmed / stored as "fresh" in a supply chain by means of a message with the data structure or the data structure in the distributed database system In a further variant, for example, other objects in the form of perishable goods can be monitored by means of messages / data structures in a distributed database system B. have degenerated too much (e.g. the shelf life of food has expired or the food has spoiled) Alternatively, for example, if the tolerance values are exceeded, an alternative cryptographic key can be provided, which can be used to reconstruct which point in the documentation of the transport of the object the tolerance values were exceeded.

Accordingly, the specified tolerance values can be used not only for the object-specific characteristics, but they can also be used when the first cryptographic key is to be provided on the basis of the individual features. This may be necessary, for example, if the individual characteristics (which can also be referred to as object-specific characteristics) with a reference renzwert should be compared in order to release the first cryptographic key in the event of a corresponding match or the individual features should serve as input parameters for a key derivation function and z. B. Errors with regard to a reproducible Schlüsselab line due to measurement inaccuracies should be prevented.

The invention can be used advantageously, for example, in supply chain management or when monitoring a supply chain. In particular, if, for example, during the transport of objects (e.g. goods such as food, electronic components, precious parts, etc.), object-related data from the different entities (e.g. manufacturers, several logistics companies, sales, buyers) that e.g. B. are involved in the manufacture, transport or sale of the object, are generated at different points in the processing / editing of the object and / or times for documentation reasons. The invention is particularly advantageous if the entities involved do not trust each other, since the corresponding data z. B. are protected ity by the cryptographic checksum and / or a checksum of a corresponding Enti. The device can, for example, be part of a transport container to, for. B. to transport food such as bananas or milk or there are several Gleicharti ge devices at the different points of processing / processing of the object or the times when this occurs.

For example, at a processing location (e.g. transfer of the object to the logistics company), object-specific data (e.g. what type of object it is, type, manufacturer, unique identifier / UID, etc., time of arrival at the logistics company) recorded and stored in an object data record or documentation data record and should z. B. be saved in the network application. The object data record / documentation data record can then, for. B. for saving in the network application in the data Structure are saved and as already explained z. B. be protected with the cryptographic checksum by the first cryptographic key is provided in accordance with the explanations.

By using the individual features for providing the first cryptographic key or the access data, a corresponding object, in particular a physical object, can be more closely linked by means of the “digital world.” For example, if the object is transported too long or is being processed / Processing / transport changed in such a way that, for example, the corresponding tolerance values are no longer adhered to, the exceeding of the tolerance values or improper handling of the object can be proven without gaps was exchanged, which is relevant, for example, in the case of counterfeit products.

If the object were to be exchanged for a counterfeit object, the corresponding individual characteristics would change. This can be relevant for medicine products, for example, to find out whether it is z. B. a silicone implant is actually a manufacturer's silicone implant and not an implant that has been counterfeited. For this purpose z. B. in the manufacture of the object (implant), the corresponding data for the object is written into the distributed database system according to one of the above-mentioned variants. Logistics companies, sales companies and clinics that transport, trade and implant the object document the relevant processing steps, times and other relevant data (information on the respective entity) carried out by them in accordance with the procedure mentioned. The individual features of an implant can be, for example, surface features of the implant (e.g. surface of the silicone cushion or the surface of a metallic implant). In the case of the silicone cushion, it can be, for example Even with the individual characteristics, a measured spectrum of the content (silicone) of the silicone cushion is involved. The invention is not limited only to silicone pads. Other implants with other fillings can also be checked. It is also possible to determine the authenticity of other medical products such as drugs (e.g. using spectra) or medical devices such as MRIs, CTs and their electronic components (e.g. using test signals or noise signals).

The device can also use different individual features, the individual features preferably encoding a predetermined key (e.g. as a fingerprint).

The different individual features are then z. B. at different, preferably randomly selected, positions on the object. If necessary, these positions can be saved in an object data record.

Alternatively, the individual features cannot be determined randomly, but rather are in a known / assigned position for a corresponding object (e.g. on the base of the object or on uneven areas of a workpiece).

Fig. 3 shows a further embodiment of the inven tion, which is shown as a flow chart for a method.

The method is preferably implemented in a computer-implemented manner.

In this exemplary embodiment, a method for granting access to control functions is explained in detail on the basis of an object.

The method comprises a first method step 310 for capturing individual features of an object by means of a capturing device. The method comprises a second method step 320 for calculating a test result based on a comparison of the individual features with a reference value.

The method comprises a third method step 330 for granting access to control functions, the control functions being accessed depending on the test result if the test result confirms a sufficiently precise match of the reference value with the individual features.

Another embodiment of the invention, which is not shown in a figure, relates to a method for computer-aided checking of a cryptographic checksum.

The invention relates to an ecosystem of devices that interact with one another autonomously by means of a block chain or network application. In particular, security-protected data processing of sensor data or measurement data for an object is implemented by means of the invention with a distributed infrastructure (e.g. the network application). Areas of application are supply chain scenarios or industrial control applications of block chains.

Although the invention has been illustrated and described in more detail by the exemplary embodiments, the invention is not restricted by the disclosed examples, and other variations can be derived therefrom by the person skilled in the art without departing from the scope of protection of the invention. [1]

Andreas M. Antonopoulos "Mastering Bitcoin: Unlocking Digital Cryptocurrencies", O'Reilly Media, December 2014

[2]

Roger M. Needham, Michael D. Schroeder "Using encryption for authentication in large networks of computers" ACM: Communications of the ACM. Volume 21, No. 12 December 1978,

[3]

Ross Anderson "Security Engineering. A Guide to Building Dependable Distributed Systems" Wiley, 2001

[4]

Henning Diedrich "Ethereum: Blockchains, Digital Assets,

Smart Contracts, Decentralized Autonomous Organizations, "CreateSpace Independent Publishing Platform, 2016

[5]

"The Ethereum Book Project / Mastering Ethereum" https://github.com/ethereumbook/ethereumbook, as of October 5, 2017

[6]

Leemon Baird

"The Swirlds Hashgraph Consensus Algorithm: Fair, Fast, Byzantine Fault Tolerance",

Swirlds Tech Report SWIRLDS-TR-2016-01, May 31, 2016

[7]

Leemon Baird

"OverView of Swirlds Hashgraph",

May 31, 2016

[8th]

Blockchain Oracles https: // blockchainhub .net / blockchain-oracles /

As of March 14, 2018

Claims

1. Device for granting access to control functions on the basis of an object, comprising: a detection module (110) for detecting individual features (M) of an object (0) by means of a detection device (A); a checking module (120) for calculating a checking result based on a comparison of the individual features with a reference value; a control module (130) for granting access to control functions, the access to the control functions taking place as a function of the test result if the test result confirms a sufficiently precise correspondence of the reference value with the individual characteristics.

2. Device according to claim 1, wherein the device comprises a cryptography module, the cryptography module calculates a first cryptographic key on the basis of an object-specific characteristic and / or on the basis of the individual features.

3. Device according to one of the preceding claims, wherein the individual features are compared with the corresponding reference value, with a sufficiently accurate match of the reference value with the individual features, the first cryptographic key and / or access data are released by the cryptography module or control module Access to the corresponding control functions takes place through the first cryptographic key and / or by means of the access data.

4. Device according to one of the preceding claims, wherein a communication connection is set up between the object and / or the device, or a communication connection is set up between the object and / or a network application, or a communication connection is set up between the object and / or the device and / or a network application.

5. Device according to one of the preceding claims, wherein the communication connection is protected by means of cryptographic protection.

6. Device according to one of claims 2-5, wherein the cryptographic protection can be generated, checked or removed with the first cryptographic key.

7. Device according to one of the preceding claims, wherein the reference value is a reference hash value or a unique identifier that was formed for a / the stored reference value, the object-specific features is an object hash value or a unique identifier that was formed when the object-specific features were recorded or become.

8. Apparatus according to one of the preceding claims, wherein the reference value is fixed when the object is generated, and the reference value is assigned to it when the object is generated.

9. Device according to one of the preceding claims, wherein the control functions allow access to a database or network application in order to exchange or synchronize data about the object in a data structure with the database or the network application.

10. Device according to one of the preceding claims, wherein the control functions are corresponding control functions of the device and / or corresponding control functions of the object and / or corresponding control functions of a network application.

11. Device according to one of the preceding claims, wherein the network application or the distributed database system is a block chain, the device is formed as a node or oracle of the distributed database system or the network application, the cryptographic checksum is a digital signature.

12. Device according to one of the preceding claims, wherein the device comprises a calculation module, the calculation module is set up to calculate an object-specific characteristic based on the individual features, the characteristic is calculated taking into account predetermined tolerance values of the individual features, the characteristic and / or the individual features are compared with the corresponding reference value, if the reference value matches the characteristic and / or the individual features with sufficient accuracy, the first cryptographic key is released by the cryptography module, the device includes a monitoring module, the monitoring module is set up for this Monitor the device and save the monitoring information in a file or in a data structure.

13. Device according to one of the preceding claims, wherein the object and / or the device comprises an object data record, the object data record indicates at which geometric points and / or interfaces the recording device can capture the individual features, the object data record the individual features and / or the object-specific one Characteristics in encrypted form, the encrypted the individual features and / or the object-specific characteristics can be decrypted by means of the first cryptographic key, the object data record includes further object data such as measured values of the object, measured values about the object, manufacturing information of the object, whereabouts of the Object, the further object data are detected by sensors of the device for the object, the sensors are a GPS module and / or temperature sensors and / or optical sensors are that detect the corresponding properties of the object.

14. Computer-implemented method for granting access to control functions based on an object with the following procedural steps:

Calculating a test result based on a comparison of the individual features with a reference value

15. Computer program product with program instructions for implementing the method according to one of claims 14.

16. Provision device for the computer program product according to claim 15, wherein the computer program product is stored and / or made available by the provision device.