US20190050857A1 - Process and system for data transmission - Google Patents
Process and system for data transmission Download PDFInfo
- Publication number
- US20190050857A1 US20190050857A1 US16/154,078 US201816154078A US2019050857A1 US 20190050857 A1 US20190050857 A1 US 20190050857A1 US 201816154078 A US201816154078 A US 201816154078A US 2019050857 A1 US2019050857 A1 US 2019050857A1
- Authority
- US
- United States
- Prior art keywords
- communications terminal
- encrypted data
- data
- user
- accordance
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034 method Methods 0.000 title claims abstract description 34
- 230000005540 biological transmission Effects 0.000 title claims abstract description 23
- 230000008569 process Effects 0.000 title description 23
- 238000004891 communication Methods 0.000 claims abstract description 139
- 238000012546 transfer Methods 0.000 claims description 6
- 238000010200 validation analysis Methods 0.000 claims description 3
- 230000003213 activating effect Effects 0.000 claims 1
- 230000008901 benefit Effects 0.000 description 13
- 230000006870 function Effects 0.000 description 7
- 238000013478 data encryption standard Methods 0.000 description 4
- 238000010295 mobile communication Methods 0.000 description 4
- 238000010586 diagram Methods 0.000 description 3
- 230000003993 interaction Effects 0.000 description 3
- 230000009466 transformation Effects 0.000 description 2
- 230000004913 activation Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000000717 retained effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
Definitions
- the present invention relates to a process and a system for data transmission.
- a transmission of data between terminals and/or servers takes place in accordance with various processes. Such processes are often particularly adapted in order to transmit messages such as, for example, E-mail messages or current headlines, or in order to transmit multimedia data such as an audio or video file.
- messages such as, for example, E-mail messages or current headlines
- multimedia data such as an audio or video file.
- a transmission of data often takes place over public networks, it is advantageous to carry out this transmission of data by means of a secured data connection, such as by means of a VPN connection (VPN: virtual private network).
- VPN virtual private network
- the transmission of data between a server and a terminal can thus be subdivided into a phase for the check on entitlement, or authentication phase, and a phase for the transfer of data.
- the authentication phase often takes a relatively long time, though only little network bandwidth is required.
- the data transfer phase may on the other hand last only for a short while, depending on the volume of data, and use all of the available network bandwidth.
- E-mail messages to a user are, for example, stored on an E-mail server.
- the user retrieves the E-mail messages stored on the E-mail server by means of an E-mail client.
- protocols such as POP (POP: Post Office protocol) or IMAP (IMAP: Internet E-mail access protocol) are used for this purpose.
- POP Post Office protocol
- IMAP Internet E-mail access protocol
- a connection is made between the E-mail client and the E-mail server, whereupon the E-mail client checks the E-mail server for available E-mail messages and, if necessary, downloads new E-mail messages to the E-mail client.
- the E-mail client is, of course, checked by authentication for its entitlement to access the E-mail messages.
- the authentication often takes much longer than the subsequent checking and downloading of the E-mail messages.
- the checking of E-mail messages can also be based on a VPN tunnel. In this case, however, a VPN tunnel is set up even if no new messages are available on the E-mail server. This leads to inefficiency, since a VPN tunnel is set up even if no data is ready for transmission.
- WLAN wireless local area network
- UWB ultra wide band
- GSM global system for mobile communications
- UMTS universal mobile telecommunications system
- a digital rights management architecture is disclosed in the document EP 1 372 055.
- a packager prepares data for a user and a licensor provides a license to the user.
- the packager and the licensor share a secret key and can calculate a content key for the prepared data.
- the prepared and encrypted data, as well as the content key, are transmitted to the user.
- the present inventions include a new process and a new system for data transmission which overcome the disadvantages of the prior art.
- authentication data and an electronic key are generated, whereby the electronic key is stored as assigned to the authentication data, that by means of an authentication module of a central module at least part of the electronic key is transmitted to a communications terminal, that by means of an encryption module and by means of at least part of the electronic key data are encrypted into encrypted data, that the encrypted data are transmitted between the central module and the communications terminal, and that by means of a decryption module of the communications terminal and by means of at least part of the electronic key the encrypted data are decrypted.
- Such a process has the particular advantage that the transmission of the authentication data or electronic key and the transmission of the encrypted data can take place completely asynchronously.
- E-mail messages can be created on the communications terminal and be encrypted with the electronic key.
- the encrypted data can be securely transmitted over the wireless communications network, be decrypted by the central module and be passed on to an E-mail server. Encrypted data can of course be transmitted both from the central module to the communications terminal and from the communications terminal to the central module.
- data are encrypted into encrypted data by the central module, and the encrypted data are transmitted from the central module to the communications terminal.
- a process has the particular advantage that the authentication for access to data and the actual transmission of data to a communications terminal can take place at different points in time.
- the transmission of encrypted data can take place at a time when the user is situated in the vicinity of a powerful network, and the authentication for access to the electronic key and thus to the data can take place at a time when the user has enough time to carry out authentication.
- data are encrypted by the communications terminal, and the encrypted data are transmitted from the communications terminal to a further communications device.
- a process has the particular advantage that, for example, data can be prepared for transmission on a mobile communications terminal, in that the data are encrypted into encrypted data.
- the encrypted data can be transmitted to a further communications device.
- the user can, for example, process a video file on the train, request a code for encrypting the video file while on the train, and encrypt the video file into an encrypted video file.
- the encrypted video file can be transmitted to a further communications device, to a file server, for example.
- a user profile is stored in the central module or on the communications terminal, data being selected and encrypted in accordance with the user profile and transmitted to the communications terminal or to a further communications device.
- a process has the particular advantage that a user can enter into a user profile what data are to be encrypted and transmitted to the communications terminal or to the further communications device. So, for example, it can be entered into a user profile that all E-mail messages of a user are each encrypted and transmitted to the communications terminal of the user at a defined time, for example, in the morning around the time when the user is at the railway station in order to board a train.
- the availability of the communications terminal or of a further communications device is checked by means of an availability module of the central module or of the communications terminal and, if the communications terminal or the further communications device is available, the encrypted data are transmitted to the communications terminal or to the further communications device.
- Such a process has the particular advantage that the encrypted data can be transmitted to the communications terminal or to the further communications device at the earliest possible time.
- a network interface of the communications terminal is activated by means of an activation module of the central module, and the encrypted data are transmitted to the communications terminal over the activated network interface.
- a first network interface of the communications terminal such as a GSM network interface
- a second network interface of the communications terminal such as a WLAN network interface
- Such a process has the particular advantage that network interfaces are only switched on by the central module if encrypted data are ready for transmission, whereby in particular the power consumption on the communications terminal can be minimized.
- the encrypted data are transmitted to a network device of a network infrastructure, whereby the encrypted data are stored on the network device, and are transmitted asynchronously from the network device to the communications terminal.
- the network device mentioned can, for example, refer to a network device of a WLAN hot spot, whereby the encrypted data are transmitted to the network device at a first time, for example, in the early morning at a time of low network load, and are transmitted, by this network device to the communications terminal of the user at a second time, for example, at a time when the user is waiting for a train at the railway station.
- a process has the particular advantage that the capacity utilization of a network infrastructure can be optimized.
- the data Before the encryption of the data, the data can of course be matched to a communications terminal.
- the communications terminal of the user is a mobile computer with an XGA screen resolution of 1024 ⁇ 768 pixels, it makes no sense to encrypt directly a video file with very high resolution. It is much more sensible in this case first to match the video file by transformation of its resolution to the screen resolution of the user and only then to carry out an encryption of the video file. Such a transformation of the data can in particular be carried out if, for example, appropriate information is stored in a user profile.
- a user account is debited with a monetary value upon the transfer of at least part of the electronic key.
- chargeable services such as the provision of audio or video files, can be offered to the user by means of the transmission of encrypted data.
- the service is only considered to have been provided if both the encrypted data and the associated key have been transmitted to the communications terminal of the user.
- the encrypted data include program code that must be executed in order to decrypt the encrypted data, while validation criteria are checked during the execution of the program code.
- the program code can, for example, be of such form that the validity of the key is checked with reference to a time measurement on a central server with which the validity of codes is monitored, or in accordance with any other process.
- Such a process has the particular advantage that, for example, a time can be defined after which the encrypted data are no longer available.
- DRM digital rights management
- an identification is assigned to the data and/or to the encrypted data, and the authentication data are stored as assigned to the identification.
- an identification can, for example, be formed as the result of a hash function on the encrypted data.
- Such a process has the particular advantage that authentication for access to the encrypted data can also be of different forms with reference to the encrypted data.
- FIG. 1 shows a block diagram with the individual components for the encryption of data and for the transfer of the encrypted data.
- FIG. 2 shows a block diagram with the individual components for the authentication and decryption of the encrypted data.
- FIG. 3 shows a block diagram with the individual components for the encryption and sending of encrypted data.
- the reference mark 10 refers to a central module.
- the central module 10 can, for example, be formed as a software module of a network server.
- the central module 10 can also, of course, be formed completely as a hardware module with appropriate electronic circuits.
- the reference mark D refers to electronic data.
- the data D can be electronic data of any kind, for example E-mail messages, texts, animations, audio files, video files, or electronic data of any other kind.
- the reference mark A refers to authentication data and the reference mark S refers to an electronic key.
- the authentication data A can, for example, include a user name and a password or pass phrase.
- the electronic key S can, for example, consist of a symmetrical electronic key with a secret key or an asymmetrical electronic key with a public key and a private key.
- the authentication data A are stored as assigned to the electronic key S while, for example, with the central module 10 including a corresponding table.
- the reference mark 40 refers to a communications network.
- the communications network can, for example, refer to the Internet and can be constructed from various networks of differing technologies.
- the communications network can include GSM networks, UMTS networks, WLAN networks, Ethernet networks, UWB networks, or networks of any other kind.
- the central module 10 can in particular be connected to the communications network 40 .
- Data D can be encrypted by means of the electronic key S and an encryption module of the central module 10 .
- Such encryption can refer to any encryption algorithm, for example a DES algorithm (DES: data encryption standard), a PGP algorithm (PGP: pretty good privacy), an IDEA algorithm (IDEA: international data encryption standard), or any other encryption algorithm.
- Encrypted data vD are generated by the encryption of the data D.
- the authentication data A and the electronic key S can moreover be stored as assigned to an identification iD of the data, so that the authentication data A and the electronic key S are valid only with reference to data that can be identified by the identification iD of the data.
- Corresponding tables can of course also be provided for in the central module 10 with reference to the identification iD of the data.
- reference mark 20 refers to a communications terminal.
- the communications terminal 20 can be any terminal of a user, for example a mobile computer such as a notebook or a PDA (PDA: personal digital assistant), a mobile telephone, a games console, a permanently installed computer, or any other communications terminal.
- the communications terminal 20 can be connected to the communications network 40 .
- Such a connection can refer to a wireless connection, such as a WLAN connection, a GSM connection, or any other wireless connection, or to a wire-based connection, such as a twisted-pair Ethernet connection, or any other wire-based connection.
- the encrypted data vD can thus be transmitted over the communications network 40 to the communications terminal 20 and be stored there.
- data D can be stored on the communications terminal 20 .
- E-mail messages, texts, animations, audio files, video files or data of any other kind can be stored on the communications terminal 20 as encrypted E-mail messages, encrypted texts, encrypted animations, encrypted audio files, or encrypted video files. It is, however, the case that the encrypted data vD may still be useless, since for the time being the key to decrypt the encrypted data is stored only on the central module 10 .
- the transmission of the encrypted data vD to the communications terminal 20 can take place at any convenient time.
- a convenient time can refer to the arrival of new E-mail messages, the availability of texts, or the publication of a new audio file.
- a convenient time can also refer to the availability of a communications link between the communications network 40 and the communications terminal 20 , the capacity utilization of the communications network 40 , the capacity utilization of parts of the communications network 40 , a time that occurs due to an input from the user on one of the communications terminals, or any other time.
- the transmission of the encrypted data vD can also take place in accordance with various scenarios.
- One scenario can be that the encrypted data vD are transmitted to the communications terminal 20 at any time during the night over a broadband communications link, such as an Ethernet connection.
- a broadband communications link such as an Ethernet connection.
- Such a scenario may be selected, for example, in order to transmit a very large encrypted video file, of an order of magnitude of 5 Gbyte, for example, to the communications terminal 20 .
- encrypted data may be transmitted to the communications terminal 20 as soon as the user carrying this communications terminal 20 comes into the range of a wireless communications network, such as a WLAN network or UWB network at a railway station or on the site of an airport.
- Such a scenario may be selected, for example, in order to transmit encrypted E-mail messages or encrypted texts to the communications terminal 20 of a user before he boards a train. It may be remarked here that encrypted texts may refer for example to the current electronic issue of a daily newspaper.
- FIG. 2 the reference marks introduced in FIG. 1 are retained.
- authentication data A are transmitted from the communications terminal 20 to the central module 10 . Entitlement is thus authenticated with the electronic key S. At least parts of the electronic key S are then transmitted from the central module 10 to the communications terminal 20 .
- the encrypted data vD stored on the communications terminal can be decrypted and stored as data D on the communications terminal, so that the user can access these data D.
- An authentication of entitlement with the electronic key S can take place in accordance with known processes. Such processes can take place on the basis of a password or pass phrases, by means of a SecureID card (SecureID: authentication process of the firm RSA Security), on the basis of the acquisition of biometric characteristics, or on any other basis that provides proof of entitlement.
- SecureID authentication process of the firm RSA Security
- the identification iD, the authentication data A, and the key S can be stored in a table containing tuples of such data.
- a particular tuple may be provided with an identification iD, with authentication data A, and with a key S for a defined purpose.
- a first tuple may include an identification iD that refers to video data.
- a second tuple may include an identification iD that refers to audio data.
- video data and audio data for example, can be encrypted with different keys, with a key for video data, for example, that causes particularly high efficiency in the encryption of the video data and with a key for audio data, for example, that causes particularly high security.
- the reference mark 10 ′ refers to a local copy of the central module 10 placed on the communications terminal 20 .
- the local copy 10 ′ of the central module 10 may include the same functions as the central module 10 .
- local copies of the tuples with an identification iD, with authentication data A, and with a key S can also be stored on the communications terminal 20 .
- the local copy 10 ′ of the central module and the local copies of the tuples mentioned can be protected, for example, by the use of a secret key, such as a PIN (PIN: personal identification number).
- PIN personal identification number
- data D can be encrypted into encrypted data vD on the communications terminal 20 and be transmitted to a further communications device.
- a local copy 10 ′ of the central module 10 with functionality for the encryption of data and with a corresponding key S can be stored on the communications terminal 20 .
- the user of the communications terminal 20 may, for example, record a new video file.
- the video file can be encrypted into an encrypted video file by means of the functions provided by the local copy 10 ′ of the central module 10 .
- the user can also, by making an appropriate request, obtain a key S from the central module 10 for encrypting the video file.
- the video file can be encrypted into an encrypted video file and the encrypted video file can be stored on the communications terminal 20 .
- the encrypted video file can be transmitted to a further communications device.
- the further communications device can refer, for example, to the central module 10 , a file server, a communications terminal of another user, or any other further communications device.
- the previously described process may be encoded in software on a computer readable medium including a compact disk, memory device, flash memory or any other computer readable physical medium.
- the software is configured to cause a processor-based device to carry out one or more of the steps described above.
- Computer operations are described in “How Computers Work, Millennium Edition,” by Ron White, Que Publications, 1999, the entire contents of which being incorporated herein by reference.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computing Systems (AREA)
- Accounting & Taxation (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- Multimedia (AREA)
- General Business, Economics & Management (AREA)
- Finance (AREA)
- Storage Device Security (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
- This application is a continuation of and claims the benefit of priority from U.S. Ser. No. 11/774,674, filed Jul. 9, 2007, which claims the benefit of priority of European Patent Application No. 06116828.2, filed Jul. 7, 2006, the entire contents of each of which are incorporated herein by reference.
- The present invention relates to a process and a system for data transmission.
- In the state of the art, a transmission of data between terminals and/or servers takes place in accordance with various processes. Such processes are often particularly adapted in order to transmit messages such as, for example, E-mail messages or current headlines, or in order to transmit multimedia data such as an audio or video file. In order to transmit data from a server to a terminal of a user; for example, it may be necessary first to check the entitlement of the user to access certain data. Such a check on entitlement may be made, for example, by a request for a user name and a password. Since a transmission of data often takes place over public networks, it is advantageous to carry out this transmission of data by means of a secured data connection, such as by means of a VPN connection (VPN: virtual private network). The transmission of data between a server and a terminal can thus be subdivided into a phase for the check on entitlement, or authentication phase, and a phase for the transfer of data. Because of the user interaction, the authentication phase often takes a relatively long time, though only little network bandwidth is required. The data transfer phase may on the other hand last only for a short while, depending on the volume of data, and use all of the available network bandwidth.
- E-mail messages to a user are, for example, stored on an E-mail server. The user retrieves the E-mail messages stored on the E-mail server by means of an E-mail client. In the state of the art, protocols such as POP (POP: Post Office protocol) or IMAP (IMAP: Internet E-mail access protocol) are used for this purpose. By means of the E-mail client and such protocols, a connection is made between the E-mail client and the E-mail server, whereupon the E-mail client checks the E-mail server for available E-mail messages and, if necessary, downloads new E-mail messages to the E-mail client. The E-mail client is, of course, checked by authentication for its entitlement to access the E-mail messages. The authentication often takes much longer than the subsequent checking and downloading of the E-mail messages. The checking of E-mail messages can also be based on a VPN tunnel. In this case, however, a VPN tunnel is set up even if no new messages are available on the E-mail server. This leads to inefficiency, since a VPN tunnel is set up even if no data is ready for transmission.
- In the state of the art, such a two-phase transmission of data suffers from many disadvantages, particularly for users of mobile terminals. It is admittedly the case that powerful WLAN or UWB networks (WLAN: wireless local area network; UWB: ultra wide band) are available to the user at railway stations, for example. But a user at a railway station often has no time to be authenticated for access to data and to download data to the mobile terminal. After the user has taken a seat on the train, however, the user often has enough time to be authenticated for access to data. At this time, however, the train has often already left the site of the station and frequently at this time the user only has much less powerful networks available, such as a GSM or UMTS network (GSM: global system for mobile communications; UMTS: universal mobile telecommunications system). Thus, the user cannot access large quantities of data at this time, such as an E-mail message with a video file as an attachment, since the transmission capacity of such a less powerful network would be inadequate. Thus, in summary, the authentication followed by data transmission used in the state of the art is, for one thing, inconvenient for the user, since the latter must undertake a user interaction. For another, this kind of user interaction prevents optimization of the capacity utilization of a network infrastructure.
- A digital rights management architecture is disclosed in the document EP 1 372 055. A packager prepares data for a user and a licensor provides a license to the user. The packager and the licensor share a secret key and can calculate a content key for the prepared data. The prepared and encrypted data, as well as the content key, are transmitted to the user.
- The present inventions include a new process and a new system for data transmission which overcome the disadvantages of the prior art.
- According to an embodiment of the present invention, these objectives are achieved in particular by the elements of the independent claims. In addition, further advantageous embodiments emerge from the dependent claims and the description.
- These objectives are achieved by the inventions in particular by the fact that authentication data and an electronic key are generated, whereby the electronic key is stored as assigned to the authentication data, that by means of an authentication module of a central module at least part of the electronic key is transmitted to a communications terminal, that by means of an encryption module and by means of at least part of the electronic key data are encrypted into encrypted data, that the encrypted data are transmitted between the central module and the communications terminal, and that by means of a decryption module of the communications terminal and by means of at least part of the electronic key the encrypted data are decrypted. Such a process has the particular advantage that the transmission of the authentication data or electronic key and the transmission of the encrypted data can take place completely asynchronously. Thus, for example, E-mail messages can be created on the communications terminal and be encrypted with the electronic key. At any time, for example as soon as the communications terminal is situated within the range of a wireless communications network, the encrypted data can be securely transmitted over the wireless communications network, be decrypted by the central module and be passed on to an E-mail server. Encrypted data can of course be transmitted both from the central module to the communications terminal and from the communications terminal to the central module.
- In one embodiment of the present invention, data are encrypted into encrypted data by the central module, and the encrypted data are transmitted from the central module to the communications terminal. Such a process has the particular advantage that the authentication for access to data and the actual transmission of data to a communications terminal can take place at different points in time. Thus, the transmission of encrypted data can take place at a time when the user is situated in the vicinity of a powerful network, and the authentication for access to the electronic key and thus to the data can take place at a time when the user has enough time to carry out authentication.
- In another embodiment of the present invention, data are encrypted by the communications terminal, and the encrypted data are transmitted from the communications terminal to a further communications device. Such a process has the particular advantage that, for example, data can be prepared for transmission on a mobile communications terminal, in that the data are encrypted into encrypted data. As soon as the mobile communications terminal is situated within the range of a powerful network, the encrypted data can be transmitted to a further communications device. Thus, the user can, for example, process a video file on the train, request a code for encrypting the video file while on the train, and encrypt the video file into an encrypted video file. As soon as the user's mobile communications terminal comes into the range of a powerful wireless network, when the user gets off the train at the railway station, the encrypted video file can be transmitted to a further communications device, to a file server, for example.
- In one embodiment of the present invention, a user profile is stored in the central module or on the communications terminal, data being selected and encrypted in accordance with the user profile and transmitted to the communications terminal or to a further communications device. Such a process has the particular advantage that a user can enter into a user profile what data are to be encrypted and transmitted to the communications terminal or to the further communications device. So, for example, it can be entered into a user profile that all E-mail messages of a user are each encrypted and transmitted to the communications terminal of the user at a defined time, for example, in the morning around the time when the user is at the railway station in order to board a train.
- In accordance with the inventions, the availability of the communications terminal or of a further communications device is checked by means of an availability module of the central module or of the communications terminal and, if the communications terminal or the further communications device is available, the encrypted data are transmitted to the communications terminal or to the further communications device. Such a process has the particular advantage that the encrypted data can be transmitted to the communications terminal or to the further communications device at the earliest possible time.
- In a further embodiment of the present invention, a network interface of the communications terminal is activated by means of an activation module of the central module, and the encrypted data are transmitted to the communications terminal over the activated network interface. Thus, for example, a first network interface of the communications terminal, such as a GSM network interface, can be permanently switched on and a second network interface of the communications terminal, such as a WLAN network interface, can be activated over this first network interface. Such a process has the particular advantage that network interfaces are only switched on by the central module if encrypted data are ready for transmission, whereby in particular the power consumption on the communications terminal can be minimized.
- In another embodiment of the present invention, the encrypted data are transmitted to a network device of a network infrastructure, whereby the encrypted data are stored on the network device, and are transmitted asynchronously from the network device to the communications terminal. The network device mentioned can, for example, refer to a network device of a WLAN hot spot, whereby the encrypted data are transmitted to the network device at a first time, for example, in the early morning at a time of low network load, and are transmitted, by this network device to the communications terminal of the user at a second time, for example, at a time when the user is waiting for a train at the railway station. Such a process has the particular advantage that the capacity utilization of a network infrastructure can be optimized. Before the encryption of the data, the data can of course be matched to a communications terminal. If, for example, the communications terminal of the user is a mobile computer with an XGA screen resolution of 1024×768 pixels, it makes no sense to encrypt directly a video file with very high resolution. It is much more sensible in this case first to match the video file by transformation of its resolution to the screen resolution of the user and only then to carry out an encryption of the video file. Such a transformation of the data can in particular be carried out if, for example, appropriate information is stored in a user profile.
- In another embodiment of the present invention, a user account is debited with a monetary value upon the transfer of at least part of the electronic key. Such a process has the particular advantage that chargeable services, such as the provision of audio or video files, can be offered to the user by means of the transmission of encrypted data. The service, of course, is only considered to have been provided if both the encrypted data and the associated key have been transmitted to the communications terminal of the user.
- In a further embodiment of the present invention, the encrypted data include program code that must be executed in order to decrypt the encrypted data, while validation criteria are checked during the execution of the program code. Thus, the program code can, for example, be of such form that the validity of the key is checked with reference to a time measurement on a central server with which the validity of codes is monitored, or in accordance with any other process. Such a process has the particular advantage that, for example, a time can be defined after which the encrypted data are no longer available. Such a process moreover guarantees compatibility with processes known from DRM (DRM: digital rights management).
- In another embodiment of the present invention, an identification is assigned to the data and/or to the encrypted data, and the authentication data are stored as assigned to the identification. Such an identification can, for example, be formed as the result of a hash function on the encrypted data. Such a process has the particular advantage that authentication for access to the encrypted data can also be of different forms with reference to the encrypted data.
- A more complete appreciation of the invention and many of the attendant advantages thereof will be readily obtained as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings, wherein:
-
FIG. 1 shows a block diagram with the individual components for the encryption of data and for the transfer of the encrypted data. -
FIG. 2 shows a block diagram with the individual components for the authentication and decryption of the encrypted data. -
FIG. 3 shows a block diagram with the individual components for the encryption and sending of encrypted data. - Referring now to the drawings, wherein like reference numerals designate identical or corresponding parts throughout the several views.
- In
FIG. 1 , thereference mark 10 refers to a central module. Thecentral module 10 can, for example, be formed as a software module of a network server. Thecentral module 10 can also, of course, be formed completely as a hardware module with appropriate electronic circuits. InFIG. 1 , the reference mark D refers to electronic data. The data D can be electronic data of any kind, for example E-mail messages, texts, animations, audio files, video files, or electronic data of any other kind. InFIG. 1 , the reference mark A refers to authentication data and the reference mark S refers to an electronic key. The authentication data A can, for example, include a user name and a password or pass phrase. The electronic key S can, for example, consist of a symmetrical electronic key with a secret key or an asymmetrical electronic key with a public key and a private key. The authentication data A are stored as assigned to the electronic key S while, for example, with thecentral module 10 including a corresponding table. InFIG. 1 , the reference mark 40 refers to a communications network. The communications network can, for example, refer to the Internet and can be constructed from various networks of differing technologies. Thus, the communications network can include GSM networks, UMTS networks, WLAN networks, Ethernet networks, UWB networks, or networks of any other kind. As shown inFIG. 1 , thecentral module 10 can in particular be connected to the communications network 40. Data D can be encrypted by means of the electronic key S and an encryption module of thecentral module 10. Such encryption can refer to any encryption algorithm, for example a DES algorithm (DES: data encryption standard), a PGP algorithm (PGP: pretty good privacy), an IDEA algorithm (IDEA: international data encryption standard), or any other encryption algorithm. Encrypted data vD are generated by the encryption of the data D. The authentication data A and the electronic key S can moreover be stored as assigned to an identification iD of the data, so that the authentication data A and the electronic key S are valid only with reference to data that can be identified by the identification iD of the data. Corresponding tables can of course also be provided for in thecentral module 10 with reference to the identification iD of the data. - In
FIG. 1 , reference mark 20 refers to a communications terminal. The communications terminal 20 can be any terminal of a user, for example a mobile computer such as a notebook or a PDA (PDA: personal digital assistant), a mobile telephone, a games console, a permanently installed computer, or any other communications terminal. As shown inFIG. 1 , the communications terminal 20 can be connected to the communications network 40. Such a connection can refer to a wireless connection, such as a WLAN connection, a GSM connection, or any other wireless connection, or to a wire-based connection, such as a twisted-pair Ethernet connection, or any other wire-based connection. - The encrypted data vD can thus be transmitted over the communications network 40 to the communications terminal 20 and be stored there. There is the widest variety of options in order thus to store data D as encrypted data vD on the communications terminal 20. E-mail messages, texts, animations, audio files, video files or data of any other kind can be stored on the communications terminal 20 as encrypted E-mail messages, encrypted texts, encrypted animations, encrypted audio files, or encrypted video files. It is, however, the case that the encrypted data vD may still be useless, since for the time being the key to decrypt the encrypted data is stored only on the
central module 10. - The transmission of the encrypted data vD to the communications terminal 20 can take place at any convenient time. A convenient time can refer to the arrival of new E-mail messages, the availability of texts, or the publication of a new audio file. A convenient time, however, can also refer to the availability of a communications link between the communications network 40 and the communications terminal 20, the capacity utilization of the communications network 40, the capacity utilization of parts of the communications network 40, a time that occurs due to an input from the user on one of the communications terminals, or any other time.
- The transmission of the encrypted data vD can also take place in accordance with various scenarios. One scenario can be that the encrypted data vD are transmitted to the communications terminal 20 at any time during the night over a broadband communications link, such as an Ethernet connection. Such a scenario may be selected, for example, in order to transmit a very large encrypted video file, of an order of magnitude of 5 Gbyte, for example, to the communications terminal 20. Or, in another scenario, encrypted data may be transmitted to the communications terminal 20 as soon as the user carrying this communications terminal 20 comes into the range of a wireless communications network, such as a WLAN network or UWB network at a railway station or on the site of an airport. Such a scenario may be selected, for example, in order to transmit encrypted E-mail messages or encrypted texts to the communications terminal 20 of a user before he boards a train. It may be remarked here that encrypted texts may refer for example to the current electronic issue of a daily newspaper.
- In
FIG. 2 , the reference marks introduced inFIG. 1 are retained. As shown inFIG. 2 , authentication data A are transmitted from the communications terminal 20 to thecentral module 10. Entitlement is thus authenticated with the electronic key S. At least parts of the electronic key S are then transmitted from thecentral module 10 to the communications terminal 20. By means of the electronic key S, the encrypted data vD stored on the communications terminal can be decrypted and stored as data D on the communications terminal, so that the user can access these data D. - An authentication of entitlement with the electronic key S can take place in accordance with known processes. Such processes can take place on the basis of a password or pass phrases, by means of a SecureID card (SecureID: authentication process of the firm RSA Security), on the basis of the acquisition of biometric characteristics, or on any other basis that provides proof of entitlement.
- As indicated by the dotted areas in
FIGS. 1 to 3 , the identification iD, the authentication data A, and the key S can be stored in a table containing tuples of such data. A particular tuple may be provided with an identification iD, with authentication data A, and with a key S for a defined purpose. Thus, a first tuple may include an identification iD that refers to video data. A second tuple may include an identification iD that refers to audio data. Thus, video data and audio data, for example, can be encrypted with different keys, with a key for video data, for example, that causes particularly high efficiency in the encryption of the video data and with a key for audio data, for example, that causes particularly high security. - In
FIG. 2 , thereference mark 10′ refers to a local copy of thecentral module 10 placed on the communications terminal 20. Thelocal copy 10′ of thecentral module 10 may include the same functions as thecentral module 10. Thus, local copies of the tuples with an identification iD, with authentication data A, and with a key S, can also be stored on the communications terminal 20. Thelocal copy 10′ of the central module and the local copies of the tuples mentioned can be protected, for example, by the use of a secret key, such as a PIN (PIN: personal identification number). Thus, it can be provided for that access to the local copy of these functions and data is only enabled for a user who knows the secret key. For example, the functions and data of this local copy can of course track incrementally the corresponding functions and data of thecentral module 10, or only specific functions and data may be stored in the local copy. - As shown in
FIG. 3 , data D can be encrypted into encrypted data vD on the communications terminal 20 and be transmitted to a further communications device. Thus, alocal copy 10′ of thecentral module 10 with functionality for the encryption of data and with a corresponding key S can be stored on the communications terminal 20. The user of the communications terminal 20 may, for example, record a new video file. As soon as the video file has been completed, the video file can be encrypted into an encrypted video file by means of the functions provided by thelocal copy 10′ of thecentral module 10. Of course the user can also, by making an appropriate request, obtain a key S from thecentral module 10 for encrypting the video file. The video file can be encrypted into an encrypted video file and the encrypted video file can be stored on the communications terminal 20. As soon as the communications terminal 20 comes within the range of a powerful network, a WLAN network, for example, the encrypted video file can be transmitted to a further communications device. The further communications device can refer, for example, to thecentral module 10, a file server, a communications terminal of another user, or any other further communications device. - The previously described process may be encoded in software on a computer readable medium including a compact disk, memory device, flash memory or any other computer readable physical medium. The software is configured to cause a processor-based device to carry out one or more of the steps described above. Computer operations are described in “How Computers Work, Millennium Edition,” by Ron White, Que Publications, 1999, the entire contents of which being incorporated herein by reference.
- Obviously, numerous modifications and variations of the present invention are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims, the invention may be practiced otherwise than as specifically described herein.
Claims (21)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/154,078 US20190050857A1 (en) | 2006-07-07 | 2018-10-08 | Process and system for data transmission |
Applications Claiming Priority (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP06116828 | 2006-07-07 | ||
EP06116828.2A EP1876550B1 (en) | 2006-07-07 | 2006-07-07 | Method and system for encrypted data transmission |
US11/774,674 US8527420B2 (en) | 2006-07-07 | 2007-07-09 | Process and system for data transmission |
US13/163,374 US10096024B2 (en) | 2006-07-07 | 2011-06-17 | Process and system for data transmission |
US16/154,078 US20190050857A1 (en) | 2006-07-07 | 2018-10-08 | Process and system for data transmission |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/163,374 Continuation US10096024B2 (en) | 2006-07-07 | 2011-06-17 | Process and system for data transmission |
Publications (1)
Publication Number | Publication Date |
---|---|
US20190050857A1 true US20190050857A1 (en) | 2019-02-14 |
Family
ID=37603348
Family Applications (5)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/774,674 Active 2029-05-01 US8527420B2 (en) | 2006-07-07 | 2007-07-09 | Process and system for data transmission |
US13/163,374 Active 2031-10-08 US10096024B2 (en) | 2006-07-07 | 2011-06-17 | Process and system for data transmission |
US13/965,890 Active 2029-01-24 US10102527B2 (en) | 2006-07-07 | 2013-08-13 | Process and system for data transmission |
US16/154,078 Abandoned US20190050857A1 (en) | 2006-07-07 | 2018-10-08 | Process and system for data transmission |
US16/160,666 Abandoned US20190130395A1 (en) | 2006-07-07 | 2018-10-15 | Process and system for data transmission |
Family Applications Before (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/774,674 Active 2029-05-01 US8527420B2 (en) | 2006-07-07 | 2007-07-09 | Process and system for data transmission |
US13/163,374 Active 2031-10-08 US10096024B2 (en) | 2006-07-07 | 2011-06-17 | Process and system for data transmission |
US13/965,890 Active 2029-01-24 US10102527B2 (en) | 2006-07-07 | 2013-08-13 | Process and system for data transmission |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/160,666 Abandoned US20190130395A1 (en) | 2006-07-07 | 2018-10-15 | Process and system for data transmission |
Country Status (3)
Country | Link |
---|---|
US (5) | US8527420B2 (en) |
EP (1) | EP1876550B1 (en) |
ES (1) | ES2434335T3 (en) |
Families Citing this family (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1876549A1 (en) * | 2006-07-07 | 2008-01-09 | Swisscom Mobile AG | Method and system for encrypted data transmission |
EP1876550B1 (en) | 2006-07-07 | 2013-08-14 | Swisscom AG | Method and system for encrypted data transmission |
KR101662251B1 (en) * | 2010-06-01 | 2016-10-04 | 엘지전자 주식회사 | Mobile terminal and control method for mobile terminal |
WO2016069004A1 (en) * | 2014-10-31 | 2016-05-06 | Hewlett-Packard Development Company, L.P. | Multi-factor authentication based content management |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5999622A (en) * | 1995-11-22 | 1999-12-07 | Microsoft Corporation | Method and apparatus for protecting widely distributed digital information |
US6157941A (en) * | 1998-03-18 | 2000-12-05 | Oracle Corporation | Architecture for client-server communication over a communication link |
US20020002674A1 (en) * | 2000-06-29 | 2002-01-03 | Tom Grimes | Digital rights management |
US20060126582A1 (en) * | 2004-12-09 | 2006-06-15 | Nokia Corporation | Delivering data to a mobile node in idle mode |
Family Cites Families (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6157723A (en) * | 1997-03-03 | 2000-12-05 | Motorola, Inc. | Method and apparatus for secure communications with encryption key scheduling |
US6925182B1 (en) * | 1997-12-19 | 2005-08-02 | Koninklijke Philips Electronics N.V. | Administration and utilization of private keys in a networked environment |
US6226618B1 (en) * | 1998-08-13 | 2001-05-01 | International Business Machines Corporation | Electronic content delivery system |
US7073063B2 (en) * | 1999-03-27 | 2006-07-04 | Microsoft Corporation | Binding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out/checking in the digital license to/from the portable device or the like |
JP3717733B2 (en) * | 2000-01-11 | 2005-11-16 | シャープ株式会社 | Network system |
IL136233A (en) * | 2000-05-18 | 2009-05-04 | Whitmaps Us Foundation Llc | Method and system for downloading map data through a communication network |
US7231043B2 (en) * | 2000-06-20 | 2007-06-12 | Canon Kabushiki Kaisha | Data processing apparatus and method, and computer-readable storage medium on which program for executing data processing is stored |
US7146636B2 (en) * | 2000-07-24 | 2006-12-05 | Bluesocket, Inc. | Method and system for enabling centralized control of wireless local area networks |
EP1271951A1 (en) * | 2001-06-22 | 2003-01-02 | Octalis S.A. | Conditional access system for digital data by key decryption and re-encryption |
CA2356573A1 (en) * | 2001-08-31 | 2003-02-28 | John-Paul J. Gignac | Method of cropping a digital image |
US20030108205A1 (en) * | 2001-12-07 | 2003-06-12 | Bryan Joyner | System and method for providing encrypted data to a device |
US7065787B2 (en) | 2002-06-12 | 2006-06-20 | Microsoft Corporation | Publishing content in connection with digital rights management (DRM) architecture |
US20040022391A1 (en) * | 2002-07-30 | 2004-02-05 | O'brien Royal | Digital content security system and method |
US20050021539A1 (en) * | 2003-03-07 | 2005-01-27 | Chaticom, Inc. | Methods and systems for digital rights management of protected content |
US7493499B1 (en) * | 2003-05-22 | 2009-02-17 | Copyright Clearance Center, Inc. | Method and apparatus for secure delivery and rights management of digital content |
US7245908B1 (en) * | 2003-06-19 | 2007-07-17 | Sprint Spectrum L.P. | Method and entity for processing communications based on altitude |
US7688976B2 (en) | 2005-07-14 | 2010-03-30 | Tara Chand Singhal | Random wave envelope derived random numbers and their use in generating transient keys in communication security application part I |
EP1876550B1 (en) | 2006-07-07 | 2013-08-14 | Swisscom AG | Method and system for encrypted data transmission |
EP1876549A1 (en) | 2006-07-07 | 2008-01-09 | Swisscom Mobile AG | Method and system for encrypted data transmission |
-
2006
- 2006-07-07 EP EP06116828.2A patent/EP1876550B1/en active Active
- 2006-07-07 ES ES06116828T patent/ES2434335T3/en active Active
-
2007
- 2007-07-09 US US11/774,674 patent/US8527420B2/en active Active
-
2011
- 2011-06-17 US US13/163,374 patent/US10096024B2/en active Active
-
2013
- 2013-08-13 US US13/965,890 patent/US10102527B2/en active Active
-
2018
- 2018-10-08 US US16/154,078 patent/US20190050857A1/en not_active Abandoned
- 2018-10-15 US US16/160,666 patent/US20190130395A1/en not_active Abandoned
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5999622A (en) * | 1995-11-22 | 1999-12-07 | Microsoft Corporation | Method and apparatus for protecting widely distributed digital information |
US6157941A (en) * | 1998-03-18 | 2000-12-05 | Oracle Corporation | Architecture for client-server communication over a communication link |
US20020002674A1 (en) * | 2000-06-29 | 2002-01-03 | Tom Grimes | Digital rights management |
US20060126582A1 (en) * | 2004-12-09 | 2006-06-15 | Nokia Corporation | Delivering data to a mobile node in idle mode |
Also Published As
Publication number | Publication date |
---|---|
US20110251961A1 (en) | 2011-10-13 |
US20190130395A1 (en) | 2019-05-02 |
US10102527B2 (en) | 2018-10-16 |
EP1876550A1 (en) | 2008-01-09 |
US20080010216A1 (en) | 2008-01-10 |
US20130332734A1 (en) | 2013-12-12 |
US10096024B2 (en) | 2018-10-09 |
EP1876550B1 (en) | 2013-08-14 |
ES2434335T3 (en) | 2013-12-16 |
US8527420B2 (en) | 2013-09-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20190050857A1 (en) | Process and system for data transmission | |
US7046991B2 (en) | System and method for supporting multiple certificate authorities on a mobile communication device | |
US6424718B1 (en) | Data communications system using public key cryptography in a web environment | |
US7711959B2 (en) | Method for transmitting encrypted user data objects | |
CN1522516B (en) | Secure header information for multi-content e-mail | |
US20240048535A1 (en) | Process and system for selectable data transmission | |
US6826395B2 (en) | System and method for secure trading mechanism combining wireless communication and wired communication | |
US20120311326A1 (en) | Apparatus and method for providing personal information sharing service using signed callback url message | |
US7191343B2 (en) | Voucher driven on-device content personalization | |
KR20050052495A (en) | System for digital content access control | |
Chen | An all-in-one mobile DRM system design | |
CN107154920B (en) | Encryption method and decryption method for security information and receiving device for receiving security information | |
EP1351466B1 (en) | A method of exchanging secured data through a network | |
JP4091438B2 (en) | Cryptographic signatures on small devices | |
CN114760111B (en) | File confidentiality method and file confidentiality device based on block chain | |
CN117896148A (en) | File encryption method and device, storage medium and electronic equipment | |
CN118432793A (en) | Method, device, equipment, storage medium and product for retrieving encrypted data | |
JP2004078269A (en) | Content supplying system | |
JP2003216571A (en) | Information transmitting and receiving system, information transmitting and receiving method, information transmitting and receiving program, and computer readable recording medium |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: SWISSCOM AG, SWITZERLAND Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SWISSCOM MOBILE AG;SWISSCOM FIXNET AG;SWISSCOM (SCHWEIZ) AG;REEL/FRAME:047122/0722 Effective date: 20091021 Owner name: SWISSCOM MOBILE AG, SWITZERLAND Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DANZEISEN, MARC;LINDER, JAN;WINIKER, SIMON;AND OTHERS;REEL/FRAME:047122/0405 Effective date: 20070727 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: APPLICATION DISPATCHED FROM PREEXAM, NOT YET DOCKETED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STCV | Information on status: appeal procedure |
Free format text: NOTICE OF APPEAL FILED |
|
STCV | Information on status: appeal procedure |
Free format text: APPEAL BRIEF (OR SUPPLEMENTAL BRIEF) ENTERED AND FORWARDED TO EXAMINER |
|
STCV | Information on status: appeal procedure |
Free format text: EXAMINER'S ANSWER TO APPEAL BRIEF MAILED |
|
STCV | Information on status: appeal procedure |
Free format text: ON APPEAL -- AWAITING DECISION BY THE BOARD OF APPEALS |
|
AS | Assignment |
Owner name: INTERDIGITAL CE PATENT HOLDINGS, SAS, FRANCE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SWISSCOM AG;REEL/FRAME:060382/0138 Effective date: 20211223 |
|
STCV | Information on status: appeal procedure |
Free format text: BOARD OF APPEALS DECISION RENDERED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION |