DE102015108543B4 - Method for authenticating a computer system to a server, protected peripheral device and use of a protected peripheral device - Google Patents

Abstract

Method for authenticating a computer system (11) to a server (12), comprising the steps of:- requesting a first certificate (19) from a protected peripheral device (10) via a connection;- creating the requested first certificate (19) by the protected peripheral device (10) based on a second certificate (19') stored in the protected peripheral device (19);- providing the created first certificate (19) to the computer system (11) via the connection;- sending the provided first certificate (19) by the computer system (11) to the server (12);- checking the sent first certificate (19) by the server (12) using a third certificate (19''); and- providing data on the server (12) if a result of the check was successful, wherein the second certificate (19') and the third certificate (19'') are based on a main certificate (24), wherein the provided data is encrypted on the server (10) and wherein the encrypted data is decryptable after downloading from the protected peripheral device (10), wherein the encrypted data requires decryption by the protected peripheral device (10) before use.

Description

The invention relates to a method for identifying a computer system to a server, a protected peripheral device with a port and a memory, and the use of a protected peripheral device.

As a service or to support the use of peripheral devices and especially protected peripheral devices, users can be offered certain programs and software. Another service is to offer so-called software developer kits (SDKs) with which users can program their own, specialized software that suits the peripheral device. It is in the manufacturer's interest that people who use these SDKs also own a peripheral device. Various authentication methods are known. These are either complex for the manufacturer or for the user.

From the US 2003/0163700 A1 A procedure and a system for user-generated keys and certificates are known.

The EN 10 2008 028 701 A1 describes a method and system for generating a derived electronic identity from a main electronic identity.

From the EN 10 2008 000 067 A1 Furthermore, a method for reading attributes from an ID token is known.

The US 2013/0167211 A1 describes a method for re-authenticating a user device by comparing data with a database.

The object of the invention is to demonstrate methods and devices which enable an advantageous, in particular a simple and secure, authentication of a computer system.

According to a first aspect of the invention, the object is achieved by a method for authenticating a computer system to a server. In a first step, a first certificate is requested from a protected peripheral device via a connection. The requested first certificate is created by the protected peripheral device based on a second certificate that is stored in the protected peripheral device. The created first certificate is provided to the computer system via the connection. The computer system sends the provided first certificate to the server. The server checks the sent first certificate using a third certificate and provides data on the server if the result of the check was successful. The second certificate and the third certificate are based on a main certificate. The data provided on the server is encrypted. The encrypted data can be decrypted after being downloaded from the protected peripheral device. The encrypted data requires decryption by the protected peripheral device before it can be used.

The second certificate is stored in the protected peripheral device. This means that every owner of the protected peripheral device can have a first certificate issued. By linking the second and third certificates to the main certificate, the server and the protected peripheral device share a secret that can be used to authenticate the computer system to the server.

Encryption ensures that the data downloaded from the server can only be used by the user who uses the protected peripheral device through which the first certificate was created.

If the encrypted data in the peripheral device is decrypted, it can be used freely. This is useful, for example, in companies where a team works with the downloaded data. Different computer systems can then be used for work, so that it is not necessary to use a secure peripheral device at every workstation.

In one embodiment, the data provided requires an active connection to the protected peripheral device or can only be executed on the protected peripheral device.

Use of the data provided can thus be restricted to one platform.

According to an advantageous embodiment, the first certificate has restriction information, wherein the server makes the provided data available in a restricted manner depending on the restriction information.

By restricting, particularly restricting in time, the server can make a download available for a limited period of time.

According to a further advantageous embodiment, the requesting step comprises transmitting user data to the protected peripheral device. The first certificate is based on at least part of this user data and/or comprises at least part of this user data.

If user data is stored in the certificate, it is not only possible to assign it to the user, but downloads on the server can also be restricted for certain users.

According to a further advantageous embodiment, the first certificate comprises device information of the protected peripheral device.

Individual protected peripherals can be manufactured for specific user groups or groups of people, such as companies or private end users. Because the first certificate contains the device information, different protected peripherals manufactured for a specific user group can be assigned different rights.

According to a further advantageous embodiment, access to a secure area on the protected peripheral device requires authentication with the first certificate.

If an administrator has the first certificate created, he can ensure that only people who also have the first certificate or who have been authorized by the administrator have access to the protected peripheral device or to secure areas of the protected peripheral device.

According to a further advantageous embodiment, the server also checks location information, in particular an IP address, in addition to the first certificate. The data is only provided by the server if the result of the check of the first certificate and the location information was successful.

Checking location information also provides greater security against illegal downloads.

According to a second aspect of the invention, the object is achieved by a supported peripheral device with a port and a memory. A second certificate based on a main certificate is stored in the memory. The protected peripheral device is designed to create a first certificate based on the second certificate upon request and to provide it via a connection established via the port.

The protected peripheral device is further configured to decrypt data encrypted with a third certificate, where the third certificate is based on the main certificate.

The protected peripheral can be used to enable authentication to a server using a third certificate that is dependent on a master certificate.

A user can decrypt data encrypted with the third certificate without having to purchase additional hardware.

According to a third aspect of the invention, the object is achieved by using a protected peripheral device with a memory, wherein a second certificate based on a main certificate is stored in the memory. The protected peripheral device is used to create a first certificate for authenticating a computer system to a server with a third certificate based on the main certificate.

Access control to the server can thus be regulated by issuing a certificate from the protected peripheral device.

The invention is described in more detail below using embodiments and figures.

• 1 eine schematische Darstellung eines geschützten Peripheriegeräts zusammen mit einem Computersystem und einem Server;
• 2 eine Übersicht von Zertifikaten; und
• 3 ein Ablaufdiagramm für ein Verfahren gemäß einer Ausgestaltung der Erfindung.

In the figures show:

• 1 a schematic representation of a protected peripheral device together with a computer system and a server;
• 2 an overview of certificates; and
• 3 a flow chart for a method according to an embodiment of the invention.

1 shows a schematic representation of a protected peripheral device 10, a computer system 11 and a server 12. In the exemplary embodiment, the protected peripheral device 10 is a terminal for carrying out financial transactions for which a user must authenticate himself, for example a PalmSecure ID Match with a palm vein scanner from Fujitsu. The user uses the protected peripheral device 10, for example, to enter personal data. In other embodiments, the protected peripheral device 10 is a computer system for checking access controls, an ATM, an on-board computer in vehicles or, in general, a computer system that stores and/or processes security-relevant data.

The protected peripheral device 10 has a connection 13 that is set up to connect the protected peripheral device 10 to the computer system 11, for example via an SSH connection. In the exemplary embodiment, the connection 13 is a LAN socket, but in other embodiments it can also be a USB interface, a WLAN connection or other connections for transmitting data. In further exemplary embodiments, the connection between the protected peripheral device 10 and the computer system 11 is an Internet connection or another data connection.

The protected peripheral device 10 further comprises a memory 14 in which a device certificate 22 is stored as a second certificate 19' (a hierarchical overview of the described certificates is shown in 2 shown). The device certificate 22 is stored in the memory during production of the protected peripheral device 10. From the device certificate 22, a user, in particular an administrator, can have a user certificate 21 created as the first certificate 19. The user certificate 21 can be used both to download data from the server 12 and to restrict access to the protected peripheral device 10. For example, access to administrator settings is only possible after the user certificate 21 has been sent to the protected peripheral device 10. In a further embodiment, one or more user-specific device certificates 22' are stored in the protected peripheral device 10 during production of the protected peripheral device 10. For example, a company is sold several different protected peripheral devices 10 with identical user-specific device certificates 22'.

In a further embodiment, several different protected peripheral devices 10 are offered with different user-specific device certificates 22', all of which share a common feature, so that an assignment to a user or a company is guaranteed. These user-specific device certificates 22' can also pass on a corresponding identifier to a specific user certificate 21'. The computer system 11 can use this specific user certificate 21', which is based on the user-specific device certificate 22' with the user identifier, to authenticate itself to the server 12 and identify itself as a company computer. This specific user certificate 21' is granted a special download right.

In the exemplary embodiment, the computer system 11 is a desktop computer that is used by a software company to program software applications for the protected peripheral device 10.

Of course, in further embodiments, the computer system 11 may also be other computer systems that can, for example, establish a data network connection.

In the exemplary embodiment, the server 12 is a download server via which data, in particular software products such as a so-called Software Developer Kit (SDK), are provided by a manufacturer of the protected peripheral device 10.

The computer system 11 has a connection 15 and a data network connection 16. The computer system 11 is connected to the connection 13 of the protected peripheral device 10 via the connection 15. The computer system 11 is connected to the Internet via the data network connection 16. The server has a data network connection 17, which is also connected to the Internet and thus to the computer system 11. In other embodiments, the server 12 and the computer system 11 are connected to one another directly or via another network.

The server 12 has a memory 18. A server certificate 23 is stored in the memory 18 as a third certificate 19''. The server certificate 23 and the device certificate 22 both go back directly to a single main certificate 24.

When manufacturing the protected peripheral device 10, the device certificate 22 and the user-specific device certificate 22' are created from the main certificate 24. In the exemplary embodiment, the certificates are created from the main certificate 24 using an OpenSSL process, so that a hierarchical chain of trust is formed.

3 shows a flow chart 30 of a working method according to an embodiment of the invention.

In step 31, a user requests the user certificate 21 from the protected peripheral device 10 via the computer system 11 in order to authenticate the computer system 11 to the server 12. To do this, the request is sent from the computer system 11 via the port 15 to the port 13 of the protected peripheral device 10. For example, a web service that accesses the protected peripheral device 10 is used to make the request.

In addition to the request, the user submits personal data such as name or address. The web service contains a form for entering personal data. In alternative configurations, additional personal data or no personal data can be submitted.

In step 32, the user certificate 21 is created by the protected peripheral device 10. For this purpose, the user certificate 21 is created based on the device certificate 22. In addition, the user certificate 21 contains the user's personal data transmitted in step 31.

In further embodiments, the user certificate 21 contains device information of the protected peripheral device 10. This device information includes, for example, a serial number, a manufacturing date or a country of manufacture.

When the certificate is created, information is recorded in predefined fields. The predefined fields can have content adapted to different devices and/or customers. In the example, this information in the predefined fields includes personal data or device information.

In further embodiments, the user certificate 21 is created based on the device certificate and the personal data and/or the device information. In this embodiment, the personal data and the device information are not contained in the user certificate 21 in a readable manner, for example by a check value.

The user certificate 21 can be requested by the user several times, for example in order to be able to use different computer systems 11. In another embodiment, the user certificate 21 can only be created once. This increases the security of the protected peripheral device 10. If another user certificate 21 is to be created, the user must contact customer service, which can re-enable the protected peripheral device 10 for the user. To do this, customer service can reset the protected peripheral device 10 to factory settings.

In step 33, the protected peripheral device 10 provides the created user certificate 21 to the computer system 11 via the port 13. The user certificate 21 is imported into the web browser on the computer system 11.

The user certificate 21 that was provided to the computer system 11 is sent in step 34 from the computer system 11 via the data network connection 16 and an https connection from the web browser to the server 12. For this purpose, the computer system 11 stores the user certificate 21 in a 1 not shown memory. The stored user certificate 21 is read out for sending.

In step 35, the server 12 compares the received user certificate 21 with the server certificate 23 stored in the memory 18. The comparison is carried out based on an https standard. The server certificate 23 and the user certificate 21 are considered to be consistent if the comparison shows that the server certificate 23 and the user certificate 21 are based directly or indirectly on the main certificate 24.

In an alternative embodiment, corresponding comparison values are stored in a hash value table based on the main certificate 24. In this case, the server 12 checks the user certificate 21 using a stored hash value in the hash value table.

The server 12 logs access to the download area with the data provided. For this purpose, certificate information and a device number of the protected peripheral device 10 are stored.

If the check in step 35 shows a match, the server 12 provides data to the computer system 11 in step 36. The computer system 11 can now download the provided data from the server 12. In the exemplary embodiment, the computer system 11 downloads an SDK from the server 12.

Depending on the user certificate 21, the server 12 gives the user access to different software products, such as different versions of a firmware. Information about the software and device status of the protected peripheral device 10 is stored in the user certificate 21. The transmitted device information is read by the server 12 from the user certificate 21.

In the described embodiment, the user certificate 21 includes a time stamp. The server 12 can use the time stamp to identify when the user certificate 21 was issued. The server 12 then makes the data available for a predetermined period of time, for example one week from the date of issue of the user certificate 21.

In an alternative embodiment, the server 12 provides the data from a request time for a predetermined period of time.

In a further alternative or additional embodiment, the server 12 only provides the data to the computer system 11. For this purpose, the server 12 stores an identifier, for example a MAC address, of the computer system 11. Subsequent downloads can thus be carried out by the computer system 11 without transmitting the user certificate 21.

In the described embodiment, the server 12 encrypts the data. The data is encrypted with the server certificate 23. In a further embodiment, the data is encrypted by the server 12 with a key assigned to the server certificate 23.

Decryption is possible with the user certificate 21. For this purpose, the protected peripheral device 10 must be connected to the computer system 11 or to a computer system on which the encrypted data is stored. In a further embodiment, the protected peripheral device 10 does not have to be connected to the computer system 11. In this embodiment, decryption is possible with the stored user certificate 21 from the computer system 11.

In the described embodiment, the protected peripheral device 10 must be permanently connected to the computer system 11 in order to work with the downloaded data.

In a further embodiment, the protected peripheral device 10 unlocks the data by decrypting the downloaded data so that it can be used on any computer system even without a connection to a protected peripheral device 10. In doing so, the protected peripheral device 10 deletes information in the files that makes use impossible without a protected peripheral device 10 connected to the computer system 11.

If the check in step 35 does not show a match, the server 12 does not provide any data to the computer system 11. The method ends in step 37, for example, with the server 12 interrupting the data network connection between the computer system 11 and the server 12.

List of reference symbols

10

protected peripheral device

11

Computer system

12

server

13, 15

Connection

16, 17

Data network connection

14, 18

memory

19

first certificate

19'

second certificate

19''

third certificate

21, 21'

User certificate

22, 22'

Device certificate

23

Server certificate

24

Main certificate

30

Flowchart

31-37

Process steps

Claims (10)

Method for authenticating a computer system (11) to a server (12), comprising the steps: - Requesting a first certificate (19) from a protected peripheral device (10) via a connection; - Creating the requested first certificate (19) by the protected peripheral device (10) based on a second certificate (19') stored in the protected peripheral device (19); - Providing the created first certificate (19) to the computer system (11) via the connection; - Sending the provided first certificate (19) by the computer system (11) to the server (12); - Checking the sent first certificate (19) by the server (12) using a third certificate (19''); and - providing data on the server (12) if a result of the check was successful, wherein the second certificate (19') and the third certificate (19'') are based on a main certificate (24), wherein the provided data is encrypted on the server (10) and wherein the encrypted data is decryptable after downloading from the protected peripheral device (10), wherein the encrypted data requires decryption by the protected peripheral device (10) before use. Procedure according to Claim 1 , wherein the decrypted data can be used independently of the protected peripheral device (10). Procedure according to Claim 1 , wherein the data provided requires an active connection to the protected peripheral device (10) for use or can only be executed on the protected peripheral device (10). Procedure according to one of the Claims 1 until 3 , wherein the first certificate (19) has restriction information and the server (12) makes the provided data available in a restricted manner depending on the restriction information. Procedure according to one of the Claims 1 until 4 , wherein the step of requesting comprises transmitting user data to the protected peripheral device (10), and wherein the first certificate (19) is based on at least a portion of this user data and/or comprises at least a portion of this user data. Procedure according to one of the Claims 1 until 5 , wherein the first certificate (19) comprises device information of the protected peripheral device (10). Procedure according to one of the Claims 1 until 6 , wherein access to a secure area on the protected peripheral device (10) requires authentication with the first certificate (19). Procedure according to one of the Claims 1 until 7 , wherein the server also checks location information, in particular an IP address, in addition to the first certificate (19) and only provides the data if a result of the check of the first certificate (19) and the location information was successful. Protected peripheral device (10) with a port (13) and a memory (14), wherein a second certificate (19') is based on a main certificate (24) and is stored in the memory (14), and wherein the protected peripheral device (10) is configured to create a first certificate (19) based on the second certificate (19') upon a request and to provide it via a connection established via the port (13), wherein the protected peripheral device (10) is further configured to decrypt data encrypted with a third certificate (19''), wherein the third certificate (19'') is based on the main certificate (24). Use of a protected peripheral device (10) according to Claim 9 , for creating a first certificate (19) for authenticating a computer system (11) to a server (12) with a third certificate (19'') based on the main certificate (24).

Images