WO2007134784A1

WO2007134784A1 - Authentication for remote function calls

Info

Publication number: WO2007134784A1
Application number: PCT/EP2007/004388
Authority: WO
Inventors: Stephan Spitz; Gisela Meister
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2006-05-18
Filing date: 2007-05-16
Publication date: 2007-11-29
Also published as: DE102006023436A1; EP2025119A1

Abstract

The present invention relates to a method, a mobile data carrier (C), a device, a system, and a computer program product for secure data transmission between a calling instance (Ri) and a called instance (Gi), the called instance (Gi) being designed for the execution of a RPC-command (RPC-B). According to the invention, the transmission of the RPC-command (RPC-B) with the corresponding required parameters is combined with authentication information (A) in relation to the respective instances (Ri, Gi). In this process, the authentication information (A) is either transmitted with the RPC-command (RPC-B) or with the result (RPC-E) to the corresponding command.

Description

Authentication for a canceled function call e

The invention is in the field of data transmission with respect to mobile data carriers, such as e.g. Smart cards, using security mechanisms, in particular authentication methods.

In particular, the invention relates to a method for the secure exchange of data between at least two instances, inter alia, exchanging their data via so-called remote function calls or remote procedure calls (hereinafter referred to as RPC commands for short), wherein in the exchange of RPC commands an additional safety mechanism is provided.

A chip card can serve as a data storage as well as authorization for certain information and / or for the execution of certain commands in addition to the function. An important aspect of data transfer, therefore, is to ensure the integrity and authenticity of messages to be transmitted and, where appropriate, the confidentiality and binding nature of the messages. The purpose of verifying authenticity is, on the one hand, to ensure an unambiguous association between sender and recipient of the message and, on the other hand, to prove that a message received from the recipient has not been changed during its transmission.

The verification of authenticity plays an essential role in the context of an authentication. The purpose of an authentication is to verify the identity and authenticity of a communication partner during data transmission. In the prior art, a variety of methods and mechanisms have been developed in this context to increase the overall security of data transmission in connection with smart cards. These mechanisms and procedures fall under the generic term "Secure Messaging". When applying secure messaging methods to chip card technology, it must be taken into consideration that the computing power of at least one of the two communication partners and / or the transmission speed between the two communication partners may be subject to restrictions. A secure messaging technique has been standardized in ISO / IEC 7816-4 and advanced features have been standardized in ISO / IEC standard 7816-8. The purpose of secure data transmission is in particular to ensure the authenticity and, if necessary, the confidentiality of the message to be transmitted. In this context, it is known to build a secure channel to the smart card and then transfer the data over this secure channel. Secure messaging (also referred to as SECM method) thus relates to the data transmission via an interface which is secured against manipulation and / or against eavesdropping.

In order to increase the flexibility and functionality of applications or services, it is further known in the prior art to use remote function calls, so-called remote procedure calls (also referred to as RPC for short). However, no method is yet known in the prior art, as a secure data transmission can be ensured when using RPC commands without, for example, each have their own secure channel for each participating instance must be built (which with significant disadvantages in terms of resources connected is). The present invention has therefore set itself the task of providing a way to remote function calls (Remote Procedure Calls), which are executed directly on the mobile disk - especially on the smart card - to combine with an additional security mechanism, while the resources the instances involved are claimed to the least extent possible. In particular, the flexibility and performance of using RPC commands on a mobile data carrier should be increased without sacrificing security. Furthermore, the above-mentioned limitations and disadvantages of the prior art are to be overcome.

This object is achieved according to the invention by a method for authentication between at least two instances which are assigned to a mobile data carrier, in particular a chip card, wherein an execution of RPC commands in connection with the mobile data carrier is supported by a calling entity authorizing the RPC request. Sends a command to a called instance for execution, and wherein the method is based on security mechanisms, in particular secure messaging, which ensure at least the authenticity and, if necessary, the confidentiality of the data to be transferred or parts thereof, with the following method steps:

Generation and / or acquisition of secure messaging data records, in particular of an authentication information in relation to at least one of the participating instances, in particular with respect to the calling entity

Transmitting parameters for the RPC command and transmitting the RPC command from the calling entity to the called entity,

Generate results of the RPC command by executing it on the called instance and especially on the mobile Disk and

Transferring results of the RPC command from the called entity to the calling entity, transmitting the secure messaging records as the RPC command parameters are transmitted and / or when the results for the RPC command are transmitted; wherein during the procedure a verification of the Secure Messaging data records takes place.

The present invention will be described below with reference to the method of the problem. The alternative embodiments, advantages and particular features of the invention mentioned here are likewise to be transferred to the other solutions and in particular to the device-related and system-related solutions and to the solution by the computer program product.

It should be noted in advance that the present invention is not limited to the counting order of the method steps. The enumeration order mentioned in the description and / or in the claims is therefore not to be understood as limiting the scope of protection. In alternative embodiments of the invention, another sequence is also conceivable or it is possible to carry out individual method steps partially or completely in parallel or in interlocking fashion (in an interleaved mode).

The secure data transfer is a

Data transmission that takes into account security mechanisms. The mechanisms and procedures applicable in this context may also be referred to as secure messaging. This includes procedures that determine the authenticity of a communication partner, the identity of a Communication partners, the confidentiality of the data to be transmitted and / or the liability of the data to be transmitted and / or the confidentiality of the data to be transmitted. The term "liability" of the data transmitted in this context should be understood as the possibility of the sender to check whether a particular recipient has received a message. A denial of the receipt of a message is no longer possible with a binding data transmission. Which of the above-mentioned mechanisms are used according to the invention in the context of secure data transmission can be determined dynamically and flexibly to the respective application. Usually, a secure channel is set up for secure messaging, via which the data to be transmitted is exchanged. An important advantage of the solution according to the invention is the fact that it is sufficient to provide a secure channel for data transmission, via which an access of possibly different instances then takes place in a secure manner. It is therefore not necessary that a separate, separate secure channel must be set up for each instance (accessing remote or "foreign" data records), which can significantly save the resources of the entire system.

"Secure messaging records" in the context of this invention are records that are relevant in the context of a security mechanism for data transmission. According to the invention, however, different security mechanisms can be used, so that the content of the secure messaging data records can be designed differently in content.

However, the secure messaging record usually includes one Authentication information. In an advantageous development of the invention, the secure messaging record additionally comprises confidentiality information. This feature is optional. Purpose of the authentication is the verification of the authenticity and / or the identity of the respective partner instance. The authentication information thus serves in particular to determine whether the card or the terminal is actually a real card or a true terminal. The authentication information or the authentication record thus clearly refers to an instance or a person. For the purposes of this invention, the term "identification" is encompassed by the term "authentication".

The authentication method on which the authentication information according to the invention is based differs from one application to another. In principle, according to the invention, different authentication methods can be used, in particular asymmetric or symmetric authentication, one-sided or mutual authentication, as well as static or dynamic authentication.

Depending on the protocol used for transmitting the RPC commands, the authentication record or the authentication information may have different formats. When transmitting the RPC commands via the SOAP (Simple Object Access Protocol) or XML-RPC protocols, the authentication information can consist of a digital XML signature about the data to be transmitted. The

However, in other cases authentication information may also be based on a different protocol and thus comprise a modified digital signature. In a complex development of the invention, the authentication information can alternatively or cumulatively from a Signing certificate authority signed certificates or other identification mechanisms.

For the purposes of this invention, a mobile data carrier may be a smart card, a smartcard or other card with a microprocessor, or it may also be a complex electronic component or device, such as e.g. a security token or other mobile bearer of digital data, each equipped with appropriate interfaces for data communication.

In the context of this invention, an "instance" is to be understood as meaning all units or modules which are involved in a data transmission. In particular, there is a calling entity that requests data from another entity and is destined to receive that data. There is also a called instance that receives a particular command and is destined to execute that command. After executing the command on the called instance, the result of the command is returned to the calling entity. In particular, the calling entity is for issuing an RPC command and the called entity is for executing the RPC command and outputting a result. Of course, as part of the entire data transfer between the instances in addition to the RPC commands, any other type of data exchange possible. An instance can be functions, procedures or more complex program parts or programs, but also separate electronic devices or components. An instance can run directly or directly on the mobile disk. Moreover, it is possible that an instance does not run directly on the mobile volume, but is assigned to it only indirectly, by running on an external unit that is in communication with the mobile volume. there can it be z. For example, a chip card terminal or another back office act.

According to the invention, RPC commands are used as the communication mechanism. In one embodiment of the invention, only RPC commands are used for the entire data exchange. Alternatively, other communication structures may be provided in other embodiments.

The basic principle of RPC commands is to provide the ability to execute functions on remote instances, devices, platforms, or machines (not local). This program functions can also be used across computer boundaries and together with other applications. There are several variants for the execution of RPC calls, e.g. the Java standard based RMIs (remote method invocations) or so-called web services, e.g. based on protocols such as Simple Object Access Protocol (SOAP) or XML-RPC. An RPC structure is based on an RPC client and an RPC server. In the context of this invention, the calling entity is usually designed as an RPC client and the called entity as an RPC server.

With the use of RPC commands, a much higher functionality and complexity of the overall system can advantageously be provided.

According to the invention and applied to the smart card technology, this means that procedures can also be accessed that are either in multi-application systems (ie in systems where several Applications can be operated on a card) are assigned to another application on the same card or to be executed by an external entity directly on the chip card. The RPC client and / or the RPC server can thus be provided on the same or another mobile data carrier or in a (smart card) terminal.

In the new generation multi-application operating systems mentioned above, it is possible to combine and combine multiple applications on one card (such as the applications of a health card, a calling card, etc.). Also for these multi-

Application operating systems, it is possible according to the invention that RPC commands are executed directly on the chip card. In this context, for example, certain Web services should be mentioned, which allow access to various services via Internet-based protocols. Depending on the application and in particular in the data transmission of safety-critical information, it is necessary to provide additional safety Mecharύsmen, even if previously a secure channel has been established. With regard to this technology, according to the invention, it is therefore possible to access different instances within a secure channel, which is secured by additional security mechanisms. This not only increases flexibility but also improves performance since the resource-intensive structure of a separate, dedicated, secure channel is not necessary for each instance.

In the preferred embodiment, the called entity serving to execute the RPC command runs on the mobile volume, particularly on the smart card. When calling an RPC function, this should therefore be executed directly on the chip card. For the purpose of a According to the invention, secure messaging combines this RPC call with the secure messaging data record. In other words, according to the invention, in addition to the actual remote function call and / or in addition to the parameters for the function call, a further data record is transmitted. This additional dataset concerns the Secure

Messaging data, in particular the authentication information, in relation to the participating entities.

It is possible that the authentication information refers to the complete set of parameters to be transmitted for the RPC command. Alternatively, it is also possible that the authentication information concerns only a part of the parameters to be transmitted with respect to the RPC command. This has the advantage that the amount of data to be transferred can be reduced as part of the execution of the RPC command.

According to the invention, several possibilities are provided by which instance the authentication information is provided and / or generated.

On the one hand, it is possible for the authentication information to be specified by the calling entity. Alternatively, on the other hand, it is possible that the authentication information is not provided by the calling entity, but is automatically generated by a middleware. Within the scope of this invention, a "middleware" is to be understood as a technology which is application-independent and offers different services for switching between separate applications. It is, so to speak, one of the Actual application decoupled platform to mediate function calls between individual instances and organizes the transport of complex data. It is thus possible to handle remote procedure calls via middleware.

In this case, the authentication information can be generated automatically by the middleware.

According to the invention, the authentication information is transmitted in combination with the transmission of the parameters for the remote function call, ie the RPC command. In turn, different options are provided for this. On the one hand, it is possible to combine the authentication information with the transmission of the parameters for the function call and / or with the transmission of the function call itself. The authentication information is preferably linked to the transmission of the parameters of a function call to the chip card. In this case, the authentication information may be particularly involved in marshaling (where "marshaling" means receiving and converting a set of structured data elements into a format required to send the data elements in a message to a recipient).

On the other hand, it is possible to bind the authentication information to the result of the RPC command. In this case, the authentication information is tied to the smart card's response to the RPC command. The "result" of the RPC command is here to be understood to mean all return values to the RPC command which, if appropriate, are sent back next to the actual response. Alternatively, the authentication information can also be done after the transmission of the actual RPC command, in particular in a credits after the RPC sequence.

According to the invention, the method comprises a check of the authentication information. For the verification different variants are also provided according to the invention. Thus, it is possible that the check is made directly on the smart card or on the security device to which the RPC command has been addressed. However, in alternative embodiments, it may also be provided to have the verification of the authentication carried out in other instances or on an external module.

It is also possible to implement the functionality for checking the authentication distributed. In this case, the authentication is carried out both on the chip card and on at least one external unit. The external unit may be a smart card terminal or another back office in connection with the transfer of a smart card.

In a further advantageous development of the invention, it is provided that after the authentication an authorization for further actions takes place, in particular on the basis of the data transmitted with the RPC command. In other words, following the verification of the authentication on the mobile data carrier, in particular on the security device, subsequent permissions can be assigned. Possibilities, as can be realized technically, are mentioned in the publication DE-10234 158, the content of which is included in full in this context. An advantage of the solution according to the invention is the fact that the method can basically be adapted to the selected transmission protocol. This is achieved by providing different formats for the secure messaging data record, in particular for the authentication information. Depending on the particular RPC

Protocol can then be set the format for the authentication record dynamically.

Another advantage of the solution according to the invention is the fact that increased flexibility can be achieved by separately and / or independently assigning a secure messaging data set to the different instances. This makes it possible to check different instances separately with regard to the security mechanisms. In particular, it is possible to authenticate different instances separately and / or separately from each other. Thus, according to the invention, flexible authentication of different instances can be connected with the function calls, in particular with the RPC structures, independently of the secure channel via which the data transmission takes place, in particular via which the function calls are handled.

The inventive method also relates to the processing and / or management of RPC structures in the data transfer from or to a smart card. For this, advantageously different variants are provided, depending on how the chip card is operated. There are different categories of operating systems for operating a smart card today. The usual operating systems are based on one application per chip card and can also be referred to as a single application system. In contrast, in more modern systems is a simultaneous Operation of several applications or applications provided on a smart card. These systems are called multi-application systems. An example of this is the combined use of a GSM application, a scheduling application and / or applications for the transfer of electronic monetary units. Such multi-tasking operating systems are usually based on a multi-tasking kernel. Another significant advantage of the solution according to the invention in this context is the fact that the invention can be used both in the context of the hitherto customary single-application systems as well as in modern multi-application systems.

At least one of the two communication instances runs on the mobile data carrier, in particular on the chip card. Usually, this is the called instance used to execute the RPC command. If it is a multi-application system, the other instance, ie the calling entity, can be assigned to another application on the same chip card. For an operating system that supports only a single application at a time, the calling instance may be associated with an external environment. The external environment may be any other instance that is in communication with the smart card. In particular, web services are to be mentioned here, which are based on data transmission over the Internet. This feature mainly affects networkable internet smart cards. In modern multi-tasking-capable or multi-user-capable chip card operating systems, a further field of use can be covered according to the invention by using flexible function calls with remote function calls from different instances independently of the secure channel for data transmission, via which the function calls are transmitted. can be combined. Another task solution consists in a mobile data carrier, in particular in a chip card, in a security token or in a chip card module according to claim 12, in a more complex device, which is equipped with such a mobile data carrier, according to patent claim 13. In the device it can be any electronic device, preferably a portable device such as a cell phone or a PDA equipped with a mobile data carrier. Other task solutions can be seen in a system according to claim 14 and in a computer program product according to claim 15.

It is possible that the method according to the invention is designed as a separate or independent module in the form of a software module or an application, which extends the previous transmission method according to the invention. It is also possible that all or individual method steps can be implemented in hardware components.

An alternative task solution provides an interface with respect to a mobile data carrier which is controlled and / or operated according to the method described above.

Additional advantageous embodiments emerge from the subclaims.

In the following detailed description of the figures, non-restrictive exemplary embodiments with their features and further advantages will be discussed with reference to the drawings. Show it:

1 is a schematic representation of transmitted remote procedure calls according to a preferred embodiment of the invention, Fig. 2 is a schematic representation of a protocol stack, which is used in a preferred embodiment of the invention and used

3 shows an overview of modules according to a preferred embodiment of the invention.

The invention relates to a method for secure data transmission between multiple instances Ri, Gi, wherein at least one called instance Gi runs on a mobile data carrier, in particular on a chip card C. The data transmission may include execution of remote function calls, namely remote procedure calls RPC-B, RPC-E.

In the preferred embodiment, at least one calling entity Ri is provided which issues an RPC command RPC-B and sends it to a corresponding called entity Gi on the smart card C for execution. The called entity G ₁ on the smart card C executes the RPC command RPC-B and returns a response or result RPC-E to the RPC command RPC-B to the calling entity Ri.

Basically, with the RPC command RPC-B, further information regarding the same is transmitted. These are meta-information, e.g. when and by whom the RPC command is to be executed, etc. This meta-information is called parameter here and in the following.

In Fig. 3, the data transmission according to the invention is shown schematically. An RPC command structure is based on a client-server approach and is usually handled synchronously. This means that a calling party Ri sets an RPC command RPC-B and waits until it receives the corresponding result RPC-E from the called instance Gi on the RPC command RPC-B. While the calling entity Ri is waiting, the called entity Gi processes the RPC command.

So that security mechanisms can be used in the execution of RPC commands without the resources of the involved entities Ri, Gi being unnecessarily heavily used, it is provided according to the invention that a call of at least one remote function via an RPC command RPC-B, which is to be executed directly on the chip card C, is combined with a secure messaging data record. In the preferred embodiment, the secure messaging data record is authentication information A. In alternative embodiments of the invention, in addition to the authentication information A, further security-relevant data records can also be taken into account. Amongst other things, the authentication information A is used for identification and, in the preferred embodiment, refers to the respective calling entity Ri. In alternative embodiments of the invention, the authentication information refers to the called entity Gi or to both instances.

Usually, the authentication information A is combined with parameters that are transmitted in connection with the function call RPC-B. Alternatively or cumulatively, the response from the chip card C, ie the result RPC-E of the RPC command RPC-B, be provided with an authentication information A.

According to the invention, it is provided that the authentication information A is checked. The check can either be on the smart card C or on another unit to which the RPC command RPC-B has been addressed.

As shown in Fig. 3, it is possible that the data exchange between the participating entities Ri and Gi is handled via a so-called middleware, which implements the corresponding commands. In this embodiment, the RPC data including the necessary parameters and the authentication information A may also be transmitted separately. If a protocol according to the ISO / IEC 7816-4 standard is used as the transmission protocol, then the

Transmission units as APDU's (APDU stands for Application Protocol Data Unit) trained. In this case, the RPC data with the authentication information A can be transmitted in several different APDU sequences. As a rule, the authentication information A is a plurality of data units to be transmitted

Application layer (especially on several APDU's) distributed (see in this context ISO 7816 and ISO WD 24727 Part 2, Generic Card Edge or RMI in Javacard 2 standard).

As shown in Fig. 1, it is possible that a plurality of different calling entities Ri are provided. FIG. 1 shows the case that there are two calling entities Ri and R ₂ which transmit corresponding RPC commands RPC-B to the chip card C. After execution of the RPC command on the chip card C can be transmitted from this, the answer or a result RPC-E back to the calling entity Ri. Depending on the configuration of the method, the authentication information A is transmitted with the RPC request RPC-B and / or with the RPC response RPC-E.

A particular advantage of the solution according to the invention is therefore too see that the transmission according to the invention can be dynamically configured. For this purpose, appropriate settings can be made via configuration parameters that z. B. specify which RPC protocol is used, in which format the authentication record A should be present, whether the authentication information A all or only part of the parameters to be transmitted, whether the authentication information A with the RPC command RPC-B and / or to be transmitted with the RPC result RPC-E and / or on which instance Ri, Gi a check of the authentication is to take place.

In alternative embodiments, further settings via the respective configuration parameters are possible here. Thus, the inventive method can be dynamically adapted to the particular application. According to the invention, therefore, flexible authentications of different entities Ri, Gi can be connected, independently of the secure channel over which the function calls RPC-B, RPC-E are handled.

As shown in Fig. 1, it is possible according to the invention, individual RPC structures (at least consisting of a command and / or a

Command result) RPC-B, RPC-E to be provided with a respective individual authentication information A. Thus, there is an individual first authentication information Ai for the first RPC structure RPC-Bi / RPC-Ei of the first instance Ri and a second authentication information A2 for the second RPC structure RPC-B ₂ / RPC-E _{2 of} the second instance R ₂ , The construction or the provision of an additional secure channel is advantageously not necessarily required. Such an additional channel, which is also based on authentication, is merely optional. FIG. 2 shows a protocol stack which is used in the method according to the invention according to a preferred embodiment. According to the ISO-OSI model, the respective layers are hierarchically structured. The lowest layer refers to a transport layer, which according to the transmission protocols ISO / IEC 7816-3 T = O (asynchronous,

Half-duplex, byte-oriented), T = I (asynchronous, half-duplex, block-oriented), according to the USB standard or according to the MMC standard, etc. may be formed. In addition, a network layer can be arranged as an optional feature, for. For example, a TCP / IP layer. Over the network layer can also be formed as an optional element, a backup layer. This can be based on SSL or SECM protocols or other protocols. The uppermost layer is the application layer, which according to the invention is designed on a modified application protocol for the transmission of RPC commands RPC-B, RPC-E with authentication data A.

In other words, the invention relates to an additional functionality for forming a corresponding interface for communication with a mobile data carrier C and different instances Ri, Gi. The modification relates to the combined transmission of RPC commands RPC-B, RPC-E and authentication information A. The interface according to the invention is controlled and / or operated by the method described above.

Due to the flexible configurability of the interface according to the invention, it can be optimally designed for the respective application. In particular, it is adjustable which security mechanisms are to be used, for. As a backup against tampering with the Authentic-Verf ears and / or against interception by appropriate Encryption mechanisms, in particular by means of the combined method.

A particular advantage is also to be seen in the fact that the present invention can also be applied to smart card operating systems of the new generation, such. For example, multi-application systems based on a multi-tasking kernel (MTK, Javacard3). In this case, a calling entity Ri, which is assigned to a first application on the chip card C, can call a called instance Gi, which is assigned to another application on the same chip card C.

According to the invention a secure data exchange between the two instances can be ensured.

In an alternative development of the invention, it is provided that the RPC structures are processed not asynchronously, but in conjunction with threads, and asynchronously using a multi-threading operating system.

In the preferred embodiment, a java-based implementation of the method according to the invention is provided. For this purpose, the so-called RMI method (RMI stands for "remote method invocation") is used, which is intended for remote function calls between Java objects and possibly uses a Java class library, on which the calls are handled.

Finally, it should be noted that the description of the invention and the illustrated embodiments are basically not restrictive in terms of a particular physical realization of the invention to understand and thus modified in various ways can be without departing from the scope of the invention. For a person skilled in the art, it is particularly obvious that the invention can also be implemented as a heterogeneous system partially or completely distributed by software and / or hardware modules and / or on a plurality of physical products - in particular also computer program products.

Claims

Patent claims

A method for secure data transmission between at least two instances (Ri, Gi) associated with a mobile volume (C), wherein performing RPC instructions (RPC-B) between the instances (Ri, Gi) and / or the mobile data carrier (C) is supported by a calling entity (Ri) sending the RPC command (RPC-B) to a called entity (Gi) for execution, and the method being based on secure messaging, with the following process steps:

Generating and / or acquiring secure messaging records, in particular authentication information (A), transmitting the RPC command (RPC-B) and parameters for the RPC command (RPC-B) from the calling (Ri) to the called (Gi) instance,

Execute the RPC command (RPC-B) on the called instance

Transferring results (RPC-E) of the RPC command (RPC-B) from the called instance (Gi) to the calling entity (Ri), passing the parameters for the RPC command (RPC-B) and / or or by transmitting the results (RPC-E) for the RPC command, transmitting the secure messaging records and verifying the secure messaging records during the procedure.

2. The method according to claim 1, characterized in that the verification of the secure messaging records on the mobile data carrier (C).

3. The method according to at least one of the claims 1 or 2, characterized in that different instances each separately and / or can be authenticated independently of each other if secure messaging is based on authentication information (A).

4. The method according to at least one of the preceding claims, characterized in that the RPC command (RPC-B) is implemented via a middleware and / or that the secure messaging data sets are divided into several to be transmitted, protocol-independent units, which in particular can be transmitted separately.

5. The method according to at least one of the preceding claims, characterized in that the secure messaging data records relate to all or only part of the parameters to be transmitted.

6. The method according to at least one of the preceding claims, characterized in that the secure messaging records directly with the RPC command (RPC-B) and / or with the parameters for the RPC command (RPC-B) and / or be transmitted with the results (RPC-E) of the RPC command and in particular be included directly in a marshaling.

7. The method according to at least one of the preceding claims 1 to 5, characterized in that the secure messaging records are transmitted separately from the parameters for the RPC command (RPC-B), in particular in a credits after the RPC command (RPC -B).

8. The method according to at least one of the preceding claims, characterized in that the secure messaging data sets are provided by the calling entity (Ri).

9. The method according to at least one of the preceding claims, characterized in that after the verification of the Secure Messaging data records, in particular after an authentication, an authorization for an execution of further commands.

10. The method according to at least one of the preceding claims, characterized in that at least one of the two instances (Ri, Gi) runs on the mobile data carrier (C).

11. The method according to at least one of the preceding claims, characterized in that the mobile data carrier (C) is operated with a multi-application system and that both instances (Ri, Gi) run on the same mobile data carrier (C), but different applications assigned.

12. Mobile data carrier (C), which supports execution of RPC commands (RPC-B) between at least two instances (Ri, Gi) and which is designed for secure data transmission between the entities (Ri, Gi), with at least one secure -Messaging module comprising means for carrying out a method according to at least one of the claims 1 to 11 are determined.

13. Device for secure data transmission with a mobile data carrier (C) according to claim 12.

14. A secure data transfer system between multiple instances (Ri, Gi) associated with a mobile volume (C), the system supporting execution of RPC instructions (RPC-B), comprising: at least one calling entity (Ri), which is responsible for issuing an RPC command (RPC-B), for supplying parameters for the RPC command and for transmitting the RPC command (RPC-B) with the respectively required parameters to a called entity (Ri) Gi) is designed,

at least one called entity (Gi) running on the mobile volume (C) and executing the RPC command (RPC-B) and sending a result (RPC-E) of the RPC command to the calling entity (Ri) is designed and with

at least one secure messaging module which is intended to generate or record data records for a secure messaging between the calling entity (Ri) and the called entity (Gi), in particular an authentication information (A), these data records with the RPC command (RPC-B), its parameters and / or a result (RPC-E) of the RPC command (RPC-B) to combine and check.

Computer program product which is directly loadable into a memory of a mobile data carrier (C) for the purpose of supporting RPC commands (RPC-B), with program code means for carrying out all steps of a method according to at least one of claims 1 to 11 when the program is running in the mobile volume (C).